Clearly Microsoft (and most of the software industry, not to single out just Microsoft.)is trying to have it both ways. They want to sell it like a product, but continue to collect revenue on it like a service. Another model says give away the software, and sell the service. Unfortunately that model hasn't worked very profitably so far.
But just because the 'software as a service' model hasn't worked yet doesn't mean it's wrong. Nor does it make 'software as a tangible good' or 'software as a tangible + continuing revenue' good.
In practice, it appears that after taking a considerable amount of time to bring a given piece of software up-to-snuff, it really is mostly done. Then, in order to treat it as a 'tangible + continuing revenue' product, you have to keep overdeveloping it, adding features and junk to 'justify' the continuing revenue stream. Hence the mess we call MS Word today, dancing paperclips and all.
The historical side of all of this is that software is sufficiently new, and the hardware it sits on has evolved so much that we've barely reached 'maturity' on anything. So thus far, software has had the appearance of tangible goods. I suspect that MS Office may be one of the few/first pieces of software to move past that category.
We're really talking about something fundamentally new in the past 20 years: Revenue for IP. Up until 20 +/- years ago, IP was sufficiently bound into some form of matter (books, records, etc) that it wasn't commonly distinguished from something physical. Now it is, due to super-cheap media like CDs and the ease of electronic distribution of the Internet.
Publishing (music, text, software, what-have-you) has always had two aspects, content creation and duplication/distribution. In a very fundamental way, the duplication/distribution part of the publishing industry is as obsolete as a buggy whip. But the duplication/distribution side is where most of the publicly perceived value lies.
Therefore the publishing industry is hanging on to that role as hard as they can, trying to keep their buggy-whip in the pre-automotive model, and using the government and copyright law to do it.
They're simply making too much money to let go of that revenue stream.
Nor did the PT boats. One needs to look at the mission here. PT boats and aircraft are both designed for short or short-ish missions, and therefore come home for the type of care that you need an engineering space for.
Carriers, battleships, destroyers, and the like stay at sea for weeks or months. They have to be capable of greater repairs on-the-spot.
But there was at least one aircraft that had 'engineering space', the B36. It had walkways through the wings, and sufficient space around each of its 6 prop engines. You could take one engine offline, feather its prop, and do some fairly extensive work on it while airborne.
>My theory is that Intel made none of your claimed hidden monopolistic dealings, and that Gateway
>chose to drop AMD for cost reasons, just like the article suggests.
The way I hear that the Intel pricing model works, there are prices, and there are rebates. Pretty much everyone pays the prices, but the rebates go to the 'faithful'. The way the PC marketplace has been working, the rebate makes the difference between profit and loss on a box. Kind of like the way Microsoft effectively licenses per-CPU, even though calling it that was declared illegal.
Coming window of opportunity / Jeffersonian issues
on
Slashdot in Politics?
·
· Score: 1
Today on NPR they talked about the coming bicentennial of the Lewis and Clark expedition. It sounds as if in the next few years, there's going to be a decent amount of noise about this.
What may be key to us is that Thomas Jefferson sent Lewis and Clark, and there will hopefully be increased interest in all three historical figures. Any renewed interest in Thomas Jefferson gives us the opportunity to bring up his politics, including his beliefs on copyright.
Some sort of Jefferson-fad wouldn't hurt Geek issues a bit.
Re:geeks are to lazy to be very political in gener
on
Slashdot in Politics?
·
· Score: 2
When the time came to write my anti-weakened-crypto letter, not only did I get it onto one page of dead tree, but I hand-delivered it to the local congressional offices downtown. Especially with all the WTC disruption, I had no idea how fast or slow mail delivery would be had I mailed the directly to DC. There's some sort of diplomatic-pouch type thing from the local offices.
There is now someone I can write to, with reasonable expectations of a good reading. I'm now in the loop instead of an interested mostly-spectator.
Microsoft's situation is interesting, and perhaps a little sad. Their business model appears to have two cornerstones: Aggressive compound growth and fast, frequent shipment of incremental improvements focused on user perception. Besides that, they've until recently been a 'gentle monopoly' to the end user, not taking advantage their power to control prices.
This model has served them well, up until recently. But they've effectively reached the limits of desktop revenue, owning monopolies on the OS and the office applications. They're trying to break into imbedded, server, and game console markets. So far their fast/incremental business model has not helped them get as far into the imbedded or server markets as they'd like, where 'next release' and eye candy simply don't cut it when base functionality is unreliable or insecure.
With Win2k they've made great strides in reliability, but really they're only getting to the base function point. Prior to this, anyone but Microsoft would have been laughed out of the datacenter with most of what they sold.
In imbedded, they've stuck by WinCE in their usual fashion, but I can't see Microsoft playing in any arena where there isn't enough of a display to show the Windows logo.
In penetrating new markets to expand their revenue base, the XBox is probably the most important product they have. But Sony and Nintendo won't give up without a fight, and the timing of the recession is just plain bad for having the most expensive console on the market, no matter how capable.
So with the desktop OS and office market saturated, server and imbedded markets stalled or slow, and not quite ready for console games, in order to continue the revenue curve that is so essential to their invincible appearance, Microsoft had little choice but to ramp up the license terms.
I dismissed privacy concerns as being currently out of fashion. I *wish* that I had done the same for practicality concerns, because we all agree that truly controlling the flow of such information is impossible.
I emphasized that there are many different crypto channels, and to be effective they'd have to weaken every one of them, because terrorists could simply shift to a different channel if, for instance PGP email were back-doored or weakened.
Then I explained that any inserted backdoor could be rediscovered within a reasonable time. I wish I had had access to the Clipper references mentioned here. But I was also struggling to keep this on one side of one page, so perhaps it doesn't matter.
Finally I added that the safety of our financial and network infrastructure depends on some of these alternate crypto channels, and to compromise them would put us at risk. SSH and https: were mentioned examples.
There, a case based on things other than privacy or practicality.
Just today I noticed an old Byte magazine. I've thrown most of them out, but I especially try to keep technical magazines that attempt to predict the future.
This one has articles on Cairo and Copeland, so I'm glad I kept it.
But it's at work now, and I'm not. I didn't realize when I noticed the magazine today under my box of microwave popcorn that re-reading the article would be timely until seeing this thread.
If this thing could only catch on, maybe we'd finally get fiber to the curb. It's clear that DSL hasn't yet succeeded in doing so. It's also clear that the phone companies don't care squat about data traffic. But maybe if phone traffic drove some serious bandwidth, then they'd get serious about it, too.
So far the discussion seems to center on PGP and email. That's a bunch of bunk, because in addition to everything that everyone else has mentioned, there are several other routes around a crypto-Carnivore.
1: Move to a different port: Conventionally, email is on port 25. Set up some email servers on some other port, and the content will sail right past Carnivore.
2: Use a different channel, and don't forget that other encrypted channels have their own algorithms.
2a: Use a different channel: Move files around with scp or sftp. Once again, doesn't register as email.
2b: Use a different channel. Use secure websites as intermediaries. When the lock closes in the lower-left corner, it's safe to type your credit card number. It's also safe to communicate other information. Either extra fields can be added, or existing fields can be used. It may even be possible to use innocent eCommerce sites, assuming you've already cracked them.
3: USB keyring hardfiles: Since these alternate channels don't leave encrypted files on the box, put the file on a USB keyring hardfile. Unplug from the system, and keep it on your keyring. If the G-men are after you, you have several options:
a: Take a hammer to it.
b: Scuff your feet, comb your hair, and zap it. They no doubt have ESD protection, but it's probably only good against accidents, not deliberately destructive ESD.
c: Throw it into the traffic.
d: Encrypt it using yet another algorithm - tcfs?
So aside from any other concerns, simply doing something to PGP clearly is not sufficient. You'd need to also weaken https: and SSH, and sniff a LOT more traffic.
But if SSH is given a back door, and we MUST assume that some black-hats or terrorists have recovered it, then how the heck to we do secure administration? We've just opened every remote-admin system to info-terrorism, as well as our eCommerce.
Between weakened/broken encryption and key escrow, I'd choose the latter every time. Both are silly, and would only convey a false sense of security. If it's that serious, I'd think simple traffic analysis would be more informative.
Imagine that A-crowd guy in high school or college you never liked, and always gave you a rough time. Then go through anonymizers, and start sending him encrypted datastreams. Fun, fun, fun.
My letters went to my congressional delegation today.
Is enough know about Hailstorm and Passport to know if they are architecturally capable of the security we desire?
Plus I see mention of "The Industry Standard Kerberos 5" in the article. Of course MS Kerberos follows Kerberos 5 standards, just in a way that doesn't play with anyone else. So do we get Real Kerberos 5, or MS Kerberos here?
What are the requirements for joining the "Trust Federation"? Who defines the requirements? Who can cast the blackball?
Imagine for a moment if ISPs left NO ports open at all, incoming. For practical purposes, they'd probably have to keep IDENT and FTP-DATA open, but maybe not. IDENT conversations are very small, so a stateful filter could probably chop those to a very short exchange. Active ftp may not be going away, but it's getting less common as an exclusive means. I don't let active ftp (ftp-data incoming) through my firewall, and have seldom missed it. Nearly everyone accomodates passive ftp.
So with the exception of clipped IDENT conversations, cutting off all incoming SYN packets seems feasible, unfortunately.
I guess we're left encapsulating TCP over UDP, or something else silly and inefficient like that.
>Doesn't that seem to open some other sticky questions? I mean, if I'm not breaking the law (other than using strong crypto), how are they
>going to tell or prosecute me?
Simple, just having a crypto stream without a back door can be made a felony.
More dangerous - they won't really want to get too heavy-handed with the geeks that make the information economy move, so beyond the first few "examples" they won't enforce this too hard. It'll be kind of like the speed limit on the NY State Thruway - everybody breaks it, so the police could enforce using *any* criteria they want.
Again, transmission or receipt of a crypto stream could itself be made the felony. The fun hobby for non-US'ers would be sending crypto streams to people inside the US. Imagine when the FBI comes knocking at your door because a stream is coming from known nasties, and you're not lying when you say you don't know or have the keys.
Finally, it's not enough to go after PGP, which is where this whole discussion starts. ANY crypto tunnel can be used for the purpose, not limited to SSH or the various HTTPS: mechanisms. You need backdoors in them ALL.
But an algorithm with a backdoor is fundamentally broken. With most algorithms, we seem to want to know if it's broken. With this, we KNOW, and it's a matter of rediscovery. Would anyone put bets on black-hats not rediscovering the backdoor within months? Plus the insertion of the backdoor may have weakened the crypto beyond original intent. there may be additional backdoors unknown to the designers.
At that point, eCommerce is effectively dead. So is remote system administration. 'nuff said.
If there were a way to fairly devise and administer testing, I think "graduated Internet access," just like the graduated driver's license proposals, would be a good idea. Most people have neither the knowledge nor if truly informed, the wish, to be responsible for an open port. Keep them in "gated communities" (somewhat akin to AOL) until they show desire, motivation, and proficiency to get out on the open road.
But I fear any such test would rapidly devolve into an MSCE-like 'Which boxes do you click?" Perhaps an alternative would be simply net testing and scanning to verify that a machine is adequately administered. Though I hesitate to add it, perhaps a fee to open ports, partly as a deterrence, partly to fund forementioned scanning.
>The post office should be privatised. All this would really require is to repeal the laws making it illegal to compete with it in first-class mail.
>Then, when the private sector kicks the USPS's ass and takes away most of its customers, the government can either disband it or turn it into a
>truly private company that would have some incentive to modernise.
Perhaps a noble thought. But what about when a privatized postal service decides that rural mail pickup and delivery is no longer profitable? The reason the Post Office's monopoly in certain areas is mandated is so that they can afford to give 100% coverage. Let all of the more profitable parts get stripped away, and the outlying service would get even more expensive, since it would turn into a bunch of disconnected isolated routes.
As to why 100% coverage... The government *needs* some sort of secure communications channel with everyone, if only to take care of tax time in April. (By law the mail constitutes a secure channel, even if that may not be true in fact.)
The free market is a wonderful invention. But just like to a man with a hammer, every problem looks like a nail, one must not start believing that the free market can be the solution to every problem.
This is more relevant for broadband connections, cable ISPs are downright broadcast-like in their TOS, and since Code Red have begun enforcing this at their head ends. I haven't had a single hit for W32.nimda yet because Port 80 is blocked. This may be a little worse than it first seems, since W32.nimda can also apparently spread through browsers. The complete lack of Port 80 scans may imply not only head end filtering, but also internal filtering. (No scans at all from a/511 subnet?)
I'm still getting normal scans on other ports, so those haven't been blocked. But the TOS can be used to eliminate P2P, and I have no other high-bandwidth choices. For that matter, I could never get above V.34 on my phone line. How does P2P thrive in this situation?
Don't read about it, either. There was a title above this article, and you *could* have chosen to bypass if. If you're "tired of reading", it's your own fault for clicking. You even wasted your time on a response.
It's your choice, and that's what this is all about. But don't forget my choice, while you're at it. I'm glad Mozilla is still alive, kicking, and putting out betas for others and me to try.
Remember ALL the uses of strong crypto. It isn't limited to PGP/GPG and email.
Think SSH/OpenSSH, think system administration. For that matter, thing certificates and eCommerce.
Think about moving ALL encryption to an algorithm with a backdoor. Then realize that simply knowing that a backdoor exists is the first step to cracking it. By that token, ALL encryption with a backdoor whose existence is know is fundamentally broken. It'll be cracked in short order. Shortly after, the only people this broken crypto will keep me safe from are the honest ones, for whom I didn't need crypto, anyway.
Imagine the only legal means for remote sysadmin has a backdoor.
Imagine that the transport layers of eCommerce have a backdoor.
Imagine that EVERYONE knows it, and the people we're supposed to be *terrified* of are actively searching for it.
May as well dismantle the Internet now, rather than let it fail us when we really need it.
>My personal worry is the landwarrior system. If windows bluescreens there from the rigors of combat, you may be left with a soldier completely
>out of the communications loop. Even worse, the system is designed so that the soldier can use an HUD to call in mortar fire. Any thoughts on what a
>slipped bit can do to targeting?
Not to worry.
Those problems will be fixed in the *next* version. Promise.
People are missing the other ramification of a mandated cryptographic backdoor.
I'll bet that within a week or two, the backdoor is cracked, even if there is some 'sealing technique' used in the software. After all, they cracked Microsoft's AARD, and that was pretty thoroughly protected. Within another week, organized crime, Drug Lords, and even terrorists will have access to it.
Once the backdoor is cracked, encryption is effectively worthless for anything but protection against other law-abiding citizens. But that's not the worst.
One of the most essential uses of crypto is SSH, OpenSSH, and the like, so we can administer the machines that make the Internet hum. Even WinNT/Win2k uses an encrypted channel for admin. Except now we're mandated to use only crypto with a backdoor, and the blackhats can open it, too.
No secure remote administration. No secure credit transactions. No Internet. No nuthin. It all falls apart.
If this is going to fall away, I'd really rather see key escrow than back doors. A back door is a fundamental breach of security, can be discovered by someone other than the FBI/CIA, and essentially renders the crypto useless.
Key escrow on the other hand, retains the basic security of the algorithm, even though the FBI/CIA may have access to your keys. At least you are secure from others.
But from a different perspective, it is possible to gracefully back out of a key escrow situation. It is possible to cease requiring escrowed keys, and to generate new ones held by a different mechanism. What's key is that the industry built up around the algorithms can remain in place, and that part of the total solution can be trusted.
Now you get to the difference between a code and a cypher. What we think of as cryptography, and often mislabel as a code, is really in the space of cyphers. Codes are something else - where there is not a one-to-one correspondence between visible and hidden messages.
I'm going to risk making an idiot of myself by misusing some terms, and say that crypto and cyphers are syntactical, where codes are semantic. In other words, you can apply crypto to any message. On the other hand, code is usually geared toward a specific set of messages. Your 6lb baby boy code could probably not be used to securely send your credit card number.
Cypher/crypto is more generally usable.
A code is more specific, may be more easily hidden, but would more likely fail in long-term usage.
It kind of interacts with the idea of a one-time-pad as explained in "Cryptonomicon", except that continually developing one-time codes that would retain innocent appearance seems like it would be awfully tough.
>What if" is the very beginning of science, but only if you then proceed with some science.
It would be nice, but I also recognize that I don't have the math or physics skills. Nor do I have the time/resources to acquire them at the moment or near future. I must also admit that it may well be beyond my capacity to do anything orginal or meaningful on this, no matter how hard I might work.
But it's fun to read about, and at best if I post ignorant comments on Slashdot, hopefully someone more skilled or knowledgable would respond, even if to set me straight.
>And what if my Aunt had balls, then she'd be my uncle.
She/He could be a hermaphrodite in that case, too. It does occur at some rate in the general population. Normally they are 'corrected' by surgery, but that is being questioned. (I withold judgement on the whole matter, but I do know that being 'abnormal' is terrible for a child to live through.)
Slashdot Mirror
Clearly Microsoft (and most of the software industry, not to single out just Microsoft.)is trying to have it both ways. They want to sell it like a product, but continue to collect revenue on it like a service. Another model says give away the software, and sell the service. Unfortunately that model hasn't worked very profitably so far.
But just because the 'software as a service' model hasn't worked yet doesn't mean it's wrong. Nor does it make 'software as a tangible good' or 'software as a tangible + continuing revenue' good.
In practice, it appears that after taking a considerable amount of time to bring a given piece of software up-to-snuff, it really is mostly done. Then, in order to treat it as a 'tangible + continuing revenue' product, you have to keep overdeveloping it, adding features and junk to 'justify' the continuing revenue stream. Hence the mess we call MS Word today, dancing paperclips and all.
The historical side of all of this is that software is sufficiently new, and the hardware it sits on has evolved so much that we've barely reached 'maturity' on anything. So thus far, software has had the appearance of tangible goods. I suspect that MS Office may be one of the few/first pieces of software to move past that category.
We're really talking about something fundamentally new in the past 20 years: Revenue for IP. Up until 20 +/- years ago, IP was sufficiently bound into some form of matter (books, records, etc) that it wasn't commonly distinguished from something physical. Now it is, due to super-cheap media like CDs and the ease of electronic distribution of the Internet.
Publishing (music, text, software, what-have-you) has always had two aspects, content creation and duplication/distribution. In a very fundamental way, the duplication/distribution part of the publishing industry is as obsolete as a buggy whip. But the duplication/distribution side is where most of the publicly perceived value lies.
Therefore the publishing industry is hanging on to that role as hard as they can, trying to keep their buggy-whip in the pre-automotive model, and using the government and copyright law to do it.
They're simply making too much money to let go of that revenue stream.
Same as prostitution.
Nor did the PT boats. One needs to look at the mission here. PT boats and aircraft are both designed for short or short-ish missions, and therefore come home for the type of care that you need an engineering space for.
Carriers, battleships, destroyers, and the like stay at sea for weeks or months. They have to be capable of greater repairs on-the-spot.
But there was at least one aircraft that had 'engineering space', the B36. It had walkways through the wings, and sufficient space around each of its 6 prop engines. You could take one engine offline, feather its prop, and do some fairly extensive work on it while airborne.
It depends on the mission.
Others have mentioned named aircraft in a rather anonymous way, but there is one whose name is well-remembered.
>My theory is that Intel made none of your claimed hidden monopolistic dealings, and that Gateway
>chose to drop AMD for cost reasons, just like the article suggests.
The way I hear that the Intel pricing model works, there are prices, and there are rebates. Pretty much everyone pays the prices, but the rebates go to the 'faithful'. The way the PC marketplace has been working, the rebate makes the difference between profit and loss on a box. Kind of like the way Microsoft effectively licenses per-CPU, even though calling it that was declared illegal.
Today on NPR they talked about the coming bicentennial of the Lewis and Clark expedition. It sounds as if in the next few years, there's going to be a decent amount of noise about this.
What may be key to us is that Thomas Jefferson sent Lewis and Clark, and there will hopefully be increased interest in all three historical figures. Any renewed interest in Thomas Jefferson gives us the opportunity to bring up his politics, including his beliefs on copyright.
Some sort of Jefferson-fad wouldn't hurt Geek issues a bit.
When the time came to write my anti-weakened-crypto letter, not only did I get it onto one page of dead tree, but I hand-delivered it to the local congressional offices downtown. Especially with all the WTC disruption, I had no idea how fast or slow mail delivery would be had I mailed the directly to DC. There's some sort of diplomatic-pouch type thing from the local offices.
There is now someone I can write to, with reasonable expectations of a good reading. I'm now in the loop instead of an interested mostly-spectator.
Microsoft's situation is interesting, and perhaps a little sad. Their business model appears to have two cornerstones: Aggressive compound growth and fast, frequent shipment of incremental improvements focused on user perception. Besides that, they've until recently been a 'gentle monopoly' to the end user, not taking advantage their power to control prices.
This model has served them well, up until recently. But they've effectively reached the limits of desktop revenue, owning monopolies on the OS and the office applications. They're trying to break into imbedded, server, and game console markets. So far their fast/incremental business model has not helped them get as far into the imbedded or server markets as they'd like, where 'next release' and eye candy simply don't cut it when base functionality is unreliable or insecure.
With Win2k they've made great strides in reliability, but really they're only getting to the base function point. Prior to this, anyone but Microsoft would have been laughed out of the datacenter with most of what they sold.
In imbedded, they've stuck by WinCE in their usual fashion, but I can't see Microsoft playing in any arena where there isn't enough of a display to show the Windows logo.
In penetrating new markets to expand their revenue base, the XBox is probably the most important product they have. But Sony and Nintendo won't give up without a fight, and the timing of the recession is just plain bad for having the most expensive console on the market, no matter how capable.
So with the desktop OS and office market saturated, server and imbedded markets stalled or slow, and not quite ready for console games, in order to continue the revenue curve that is so essential to their invincible appearance, Microsoft had little choice but to ramp up the license terms.
They're between a rock and a hard place.
I dismissed privacy concerns as being currently out of fashion. I *wish* that I had done the same for practicality concerns, because we all agree that truly controlling the flow of such information is impossible.
I emphasized that there are many different crypto channels, and to be effective they'd have to weaken every one of them, because terrorists could simply shift to a different channel if, for instance PGP email were back-doored or weakened.
Then I explained that any inserted backdoor could be rediscovered within a reasonable time. I wish I had had access to the Clipper references mentioned here. But I was also struggling to keep this on one side of one page, so perhaps it doesn't matter.
Finally I added that the safety of our financial and network infrastructure depends on some of these alternate crypto channels, and to compromise them would put us at risk. SSH and https: were mentioned examples.
There, a case based on things other than privacy or practicality.
Just today I noticed an old Byte magazine. I've thrown most of them out, but I especially try to keep technical magazines that attempt to predict the future.
This one has articles on Cairo and Copeland, so I'm glad I kept it.
But it's at work now, and I'm not. I didn't realize when I noticed the magazine today under my box of microwave popcorn that re-reading the article would be timely until seeing this thread.
If this thing could only catch on, maybe we'd finally get fiber to the curb. It's clear that DSL hasn't yet succeeded in doing so. It's also clear that the phone companies don't care squat about data traffic. But maybe if phone traffic drove some serious bandwidth, then they'd get serious about it, too.
So far the discussion seems to center on PGP and email. That's a bunch of bunk, because in addition to everything that everyone else has mentioned, there are several other routes around a crypto-Carnivore.
1: Move to a different port: Conventionally, email is on port 25. Set up some email servers on some other port, and the content will sail right past Carnivore.
2: Use a different channel, and don't forget that other encrypted channels have their own algorithms.
2a: Use a different channel: Move files around with scp or sftp. Once again, doesn't register as email.
2b: Use a different channel. Use secure websites as intermediaries. When the lock closes in the lower-left corner, it's safe to type your credit card number. It's also safe to communicate other information. Either extra fields can be added, or existing fields can be used. It may even be possible to use innocent eCommerce sites, assuming you've already cracked them.
3: USB keyring hardfiles: Since these alternate channels don't leave encrypted files on the box, put the file on a USB keyring hardfile. Unplug from the system, and keep it on your keyring. If the G-men are after you, you have several options:
a: Take a hammer to it.
b: Scuff your feet, comb your hair, and zap it. They no doubt have ESD protection, but it's probably only good against accidents, not deliberately destructive ESD.
c: Throw it into the traffic.
d: Encrypt it using yet another algorithm - tcfs?
So aside from any other concerns, simply doing something to PGP clearly is not sufficient. You'd need to also weaken https: and SSH, and sniff a LOT more traffic.
But if SSH is given a back door, and we MUST assume that some black-hats or terrorists have recovered it, then how the heck to we do secure administration? We've just opened every remote-admin system to info-terrorism, as well as our eCommerce.
Between weakened/broken encryption and key escrow, I'd choose the latter every time. Both are silly, and would only convey a false sense of security. If it's that serious, I'd think simple traffic analysis would be more informative.
Imagine that A-crowd guy in high school or college you never liked, and always gave you a rough time. Then go through anonymizers, and start sending him encrypted datastreams. Fun, fun, fun.
My letters went to my congressional delegation today.
Is enough know about Hailstorm and Passport to know if they are architecturally capable of the security we desire?
Plus I see mention of "The Industry Standard Kerberos 5" in the article. Of course MS Kerberos follows Kerberos 5 standards, just in a way that doesn't play with anyone else. So do we get Real Kerberos 5, or MS Kerberos here?
What are the requirements for joining the "Trust Federation"? Who defines the requirements? Who can cast the blackball?
Imagine for a moment if ISPs left NO ports open at all, incoming. For practical purposes, they'd probably have to keep IDENT and FTP-DATA open, but maybe not. IDENT conversations are very small, so a stateful filter could probably chop those to a very short exchange. Active ftp may not be going away, but it's getting less common as an exclusive means. I don't let active ftp (ftp-data incoming) through my firewall, and have seldom missed it. Nearly everyone accomodates passive ftp.
So with the exception of clipped IDENT conversations, cutting off all incoming SYN packets seems feasible, unfortunately.
I guess we're left encapsulating TCP over UDP, or something else silly and inefficient like that.
>Doesn't that seem to open some other sticky questions? I mean, if I'm not breaking the law (other than using strong crypto), how are they
>going to tell or prosecute me?
Simple, just having a crypto stream without a back door can be made a felony.
More dangerous - they won't really want to get too heavy-handed with the geeks that make the information economy move, so beyond the first few "examples" they won't enforce this too hard. It'll be kind of like the speed limit on the NY State Thruway - everybody breaks it, so the police could enforce using *any* criteria they want.
Again, transmission or receipt of a crypto stream could itself be made the felony. The fun hobby for non-US'ers would be sending crypto streams to people inside the US. Imagine when the FBI comes knocking at your door because a stream is coming from known nasties, and you're not lying when you say you don't know or have the keys.
Finally, it's not enough to go after PGP, which is where this whole discussion starts. ANY crypto tunnel can be used for the purpose, not limited to SSH or the various HTTPS: mechanisms. You need backdoors in them ALL.
But an algorithm with a backdoor is fundamentally broken. With most algorithms, we seem to want to know if it's broken. With this, we KNOW, and it's a matter of rediscovery. Would anyone put bets on black-hats not rediscovering the backdoor within months? Plus the insertion of the backdoor may have weakened the crypto beyond original intent. there may be additional backdoors unknown to the designers.
At that point, eCommerce is effectively dead. So is remote system administration. 'nuff said.
When they can't find qualified sysadmins, they'll just hire MSCEs.
If there were a way to fairly devise and administer testing, I think "graduated Internet access," just like the graduated driver's license proposals, would be a good idea. Most people have neither the knowledge nor if truly informed, the wish, to be responsible for an open port. Keep them in "gated communities" (somewhat akin to AOL) until they show desire, motivation, and proficiency to get out on the open road.
But I fear any such test would rapidly devolve into an MSCE-like 'Which boxes do you click?" Perhaps an alternative would be simply net testing and scanning to verify that a machine is adequately administered. Though I hesitate to add it, perhaps a fee to open ports, partly as a deterrence, partly to fund forementioned scanning.
>The post office should be privatised. All this would really require is to repeal the laws making it illegal to compete with it in first-class mail.
>Then, when the private sector kicks the USPS's ass and takes away most of its customers, the government can either disband it or turn it into a
>truly private company that would have some incentive to modernise.
Perhaps a noble thought. But what about when a privatized postal service decides that rural mail pickup and delivery is no longer profitable? The reason the Post Office's monopoly in certain areas is mandated is so that they can afford to give 100% coverage. Let all of the more profitable parts get stripped away, and the outlying service would get even more expensive, since it would turn into a bunch of disconnected isolated routes.
As to why 100% coverage... The government *needs* some sort of secure communications channel with everyone, if only to take care of tax time in April. (By law the mail constitutes a secure channel, even if that may not be true in fact.)
The free market is a wonderful invention. But just like to a man with a hammer, every problem looks like a nail, one must not start believing that the free market can be the solution to every problem.
Fat lotta good it does as ISPs crank down on TOS.
/511 subnet?)
This is more relevant for broadband connections, cable ISPs are downright broadcast-like in their TOS, and since Code Red have begun enforcing this at their head ends. I haven't had a single hit for W32.nimda yet because Port 80 is blocked. This may be a little worse than it first seems, since W32.nimda can also apparently spread through browsers. The complete lack of Port 80 scans may imply not only head end filtering, but also internal filtering. (No scans at all from a
I'm still getting normal scans on other ports, so those haven't been blocked. But the TOS can be used to eliminate P2P, and I have no other high-bandwidth choices. For that matter, I could never get above V.34 on my phone line. How does P2P thrive in this situation?
Then don't use it.
Don't read about it, either. There was a title above this article, and you *could* have chosen to bypass if. If you're "tired of reading", it's your own fault for clicking. You even wasted your time on a response.
It's your choice, and that's what this is all about. But don't forget my choice, while you're at it. I'm glad Mozilla is still alive, kicking, and putting out betas for others and me to try.
(I keep saying this every spot it's applicable.)
Remember ALL the uses of strong crypto. It isn't limited to PGP/GPG and email.
Think SSH/OpenSSH, think system administration. For that matter, thing certificates and eCommerce.
Think about moving ALL encryption to an algorithm with a backdoor. Then realize that simply knowing that a backdoor exists is the first step to cracking it. By that token, ALL encryption with a backdoor whose existence is know is fundamentally broken. It'll be cracked in short order. Shortly after, the only people this broken crypto will keep me safe from are the honest ones, for whom I didn't need crypto, anyway.
Imagine the only legal means for remote sysadmin has a backdoor.
Imagine that the transport layers of eCommerce have a backdoor.
Imagine that EVERYONE knows it, and the people we're supposed to be *terrified* of are actively searching for it.
May as well dismantle the Internet now, rather than let it fail us when we really need it.
>My personal worry is the landwarrior system. If windows bluescreens there from the rigors of combat, you may be left with a soldier completely
>out of the communications loop. Even worse, the system is designed so that the soldier can use an HUD to call in mortar fire. Any thoughts on what a
>slipped bit can do to targeting?
Not to worry.
Those problems will be fixed in the *next* version. Promise.
People are missing the other ramification of a mandated cryptographic backdoor.
I'll bet that within a week or two, the backdoor is cracked, even if there is some 'sealing technique' used in the software. After all, they cracked Microsoft's AARD, and that was pretty thoroughly protected. Within another week, organized crime, Drug Lords, and even terrorists will have access to it.
Once the backdoor is cracked, encryption is effectively worthless for anything but protection against other law-abiding citizens. But that's not the worst.
One of the most essential uses of crypto is SSH, OpenSSH, and the like, so we can administer the machines that make the Internet hum. Even WinNT/Win2k uses an encrypted channel for admin. Except now we're mandated to use only crypto with a backdoor, and the blackhats can open it, too.
No secure remote administration. No secure credit transactions. No Internet. No nuthin. It all falls apart.
If this is going to fall away, I'd really rather see key escrow than back doors. A back door is a fundamental breach of security, can be discovered by someone other than the FBI/CIA, and essentially renders the crypto useless.
Key escrow on the other hand, retains the basic security of the algorithm, even though the FBI/CIA may have access to your keys. At least you are secure from others.
But from a different perspective, it is possible to gracefully back out of a key escrow situation. It is possible to cease requiring escrowed keys, and to generate new ones held by a different mechanism. What's key is that the industry built up around the algorithms can remain in place, and that part of the total solution can be trusted.
Now you get to the difference between a code and a cypher. What we think of as cryptography, and often mislabel as a code, is really in the space of cyphers. Codes are something else - where there is not a one-to-one correspondence between visible and hidden messages.
I'm going to risk making an idiot of myself by misusing some terms, and say that crypto and cyphers are syntactical, where codes are semantic. In other words, you can apply crypto to any message. On the other hand, code is usually geared toward a specific set of messages. Your 6lb baby boy code could probably not be used to securely send your credit card number.
Cypher/crypto is more generally usable.
A code is more specific, may be more easily hidden, but would more likely fail in long-term usage.
It kind of interacts with the idea of a one-time-pad as explained in "Cryptonomicon", except that continually developing one-time codes that would retain innocent appearance seems like it would be awfully tough.
>What if" is the very beginning of science, but only if you then proceed with some science.
It would be nice, but I also recognize that I don't have the math or physics skills. Nor do I have the time/resources to acquire them at the moment or near future. I must also admit that it may well be beyond my capacity to do anything orginal or meaningful on this, no matter how hard I might work.
But it's fun to read about, and at best if I post ignorant comments on Slashdot, hopefully someone more skilled or knowledgable would respond, even if to set me straight.
>And what if my Aunt had balls, then she'd be my uncle.
She/He could be a hermaphrodite in that case, too. It does occur at some rate in the general population. Normally they are 'corrected' by surgery, but that is being questioned. (I withold judgement on the whole matter, but I do know that being 'abnormal' is terrible for a child to live through.)