Announced officially to the mythical cypherpunks@toad.com mailing list...
Fighting to legalize cryptography on the internet. PGP was banned. Sending encrypted emails was illegal...
Cypherpunks won. Thanks to them.
Announced officially to the mythical cypherpunks@toad.com mailing list...
Fighting to legalize cryptography on the internet. PGP was banned. Sending encrypted emails was illegal...
Cypherpunks won. Thanks to them.
“Can I have port 22?”
“Yes”
the early days of the internet are so fantastical to me I can’t stand it. Makes me sad to be too young to have witnessed it.
The early days of the internet were dominated by InfoSeek Net Search, then later on Alta Vista was the search engine of choice. Then later on, Google appeared and everyone else couldn't compete.
Was it DEC than ran Alta Vista? They were involved in some search engine
Indeed.[1]
I recall using it as my main search engine at altavista.digital.com before they moved to get its own domain at altavista.com.
I remember when AltaVista was the best, and despairing because it was so terrible.
At a dinner party, we were arguing about how to move forward with discovery on the web, because the situation was so dire. Someone was arguing for keyword registration, a la AOL.
I really, really hope that someone wasn’t me; I’ve convinced myself over the years it wasn’t, but I didn’t have any better ideas, just knew that wouldn’t work.
That's closer to an abridged history of "World Wide Web" search engines.
The internet was decades old when Infoseek appeared.
the internet was decades old when http appeared.
The early days of the internet were dominated by InfoSeek Net Search
That's 20-some years after the early days of the Internet.
I was using Archie and gopher in the late 80s. Do you mean web search instead of internet search?
I'd been using the internet for 14 years before InfoSeek Net Search appeared in 1994, this is honestly the first time I've heard of it.
I don't even consider myself an early user of the internet either, the people I learnt from had already been using it a good while.
You don't really need permission to take a port; you can run your service on 80/tcp if you like.
Here it's different than this, the question is rather "Can it be recorded that port 22 is reserved for my tool so it becomes a worldwide convention?"
There is no worldwide convention. Go ahead and run your services on whatever ports. That's what I do.
No convention at all, just FTP defaulting to 21 and SSH to 22 and websites to 80 randomly.
There is no Internet Police that will give a fine for using the 'wrong' ports.
(In fact, not running SSH on port 22 is an industry best practice in 2024, sadly.)
You are thinking of a law, not a convention.
A convention is a common language. It is something you have the right to break when needed / suitable but which is otherwise nice to follow when interacting with others.
Such conventions allow you to omit the port when typing a URL in a browser for instance. They allow taking nice shortcuts and avoiding verbose / irrelevant technical details.
(now, some conventions are mandated by laws indeed. For instance, if you are setting up electricity somewhere, you'd better use the right colors. One might argue that we ought to call such things rules)
Yes there most certainly is a worldwide convention. Please read the article before commenting. Just because you don't happen to follow the convention does not mean it doesn't exist and isn't worldwide.
You can, but you'll have to deal with the consequences of violating conventions and the impact of that might matter very little or a whole lot depending on the situation. Running a random service over port 80 can be a good idea (lots of networks have that port open), but you'd better be willing to deal with the traffic from people/bots/crawlers looking for a webserver there. If you aren't careful you can break things on your own network or get yourself cut off from others. The rules and standards that exist are there to make everyone's lives easier and promote things working. Deviate from them at your own risk.
Wow that's a lot less negotiation than is required to tell a TCP joke! ;)
Hello, would you like to hear a TCP joke?
Yes, I'd like to hear a TCP joke.
OK, I'll tell you a TCP joke.
OK, I'll hear a TCP joke.
Are you ready to hear a TCP joke?
Yes, I am ready to hear a TCP joke.
OK, I'm about to send the TCP joke.
It will last 10 seconds,
it has two characters,
it does not have a setting,
and it ends with punchline.
OK, I'm ready to hear the TCP joke
that will last 10 seconds,
has two characters,
does not have a setting,
and will end with a punchline.
I'm sorry, your connection has timed out...
...Hello, would you like to hear a TCP joke?OMG, this is brilliant! How have i never heard this one before!?! Thanks for sharing! :-D
I'd tell you a UDP joke, but you might not get it. ;)
Ah yes back when NANOG was an irc channel and anyone could join and discuss their routing problems.
It was a simpler time for sure
There was also that time Jon Postel asked all the DNS root server operators to make his server the root, and they did. https://www.wired.com/2012/10/joe-postel/
Even if you were old enough, you probably wouldn't have witnessed it because it was only being worked on by a small number of people. There must be amazing future things which are in their early days right now but you and me aren't involved with them and nobody knows for sure what they even are until they explode.
I'm old enough to remember the early days of Bitcoin and how nobody I talked to about it had ever heard of it and was either dismissive ("That would be easy to hack" / "that can't work") or just treated it like a random chit-chat that didn't matter.
"The -p <port> option can be used to specify the port number to connect to when using the ssh command on Linux. The -P <port> (note: capital P) option can be used with SFTP and scp."
The most annoying thing about SSH/scp!
I always just use -o port=<xx> for this reason.
I use rsync with -e 'ssh -p PORT', so that I can also have the ability to resume just in case :D, interesting how everyone has a different solution ^^, let's see how many ways of doing the same thing can we collect in this thread
Another one is places where you can use `user@host` and those where you can't and have to use `-l user` (and thus have to use `-e 'ssh -l user'` or equivalent)
Usually I use per host `ssh_config(5)` (both for port and user) but some tools also don't make use of that!
Wait, lower case 'o' works?
Looks like I've got BSD SSH installed. From `man ssh`:
-o option
Can be used to give options in the format used in the configura‐
tion file. This is useful for specifying options for which there
is no separate command-line flag. For full details of the op‐
tions listed below, and their possible values, see ssh_config(5).
ssh -o <option_name> <option_value>
Even more fun when you are doing ssh, scp and throw in some random nmap in there as well, where -P and -p are both used.
Add the lowercase -r for recursive scp and you have two screens with man pages open.
Use ~/.ssh/config to add per host or wildcard values for port :)
This right here is the next big trick behind using CTRL+R to find the last ssh command.
What's even more annoying is that -P for scp has to be put before the target while -p for the ssh client I am using can be put after the target.
So when you write your scp command and then realize you forgot to put in the port you have to go back and put it before the target.
The most annoying thing about SCP is args ordering, I would have preferred a single direction arg for transfer details, if it meant we didn't have to worry about positional args.
Then again, I'm speaking as someone that came into the scene well after development, so that could just be annoyance via naivete.
Agreed :). I always have to google which case applies where as I use ssh and scp heavily.
This tripped me up hardcore at work recently, because I was trying to SSH into a VM using a non-standard port, but the port-forwarding went from the non-standard port into the usual 22 on the VM. So when I got "Connection Refused" on port 22, I thought that meant the connection was getting through the NAT layer but then failing at the VM for some reason.
NOPE I'd just specified the option wrong!
I’ve always wanted to see something like a common port dictionary or encyclopedia. Just a big list of all the ports, each with their common usage and the history behind it.
There's this wiki page that's pretty cool https://en.m.wikipedia.org/wiki/List_of_TCP_and_UDP_port_num...
Wikipedia's list is better than the official one because it explains what some of those protocols actually are – especially the early ones which don't have any RFC specified in IANA's registry.
Although, in several cases, there is an RFC, even though IANA's registry doesn't record it. For example, port 1 (tcpmux / TCP Port Service Multiplexer) uses a protocol defined by RFC1078, as Wikipedia's article on it helpfully explains – https://en.wikipedia.org/wiki/TCP_Port_Service_Multiplexer – but IANA's registry doesn't mention that.
Or similarly, port 5 is listed as rje / Remote Job Entry in the registry, but Wikipedia helpfully notes that it is the protocol defined by RFC407 (and maybe RFC725 is a newer version of it?). I doubt that ARPANET RJE protocol (whose syntax resembles FTP, SMTP, etc) ever saw any great amount of implementation; I believe historically the most popular RJE protocols were IBM's (2780/3780 and later Network Job Entry / NJE which was used in RSCS, most notably on BITNET) – but those protocols don't have an assigned port number, since they don't natively run on top of TCP/IP.
There are however some historical mysteries in this IANA registry for which even Wikipedia does not know the answer: the first of many is what ports 2 and 3, "compressnet", were used for. (Edit: What Wikipedia doesn't know, HN does: https://news.ycombinator.com/item?id=37016159
Seconded. I made some Anki cards out of the table of the "Well-known ports" table and it has proven surprisingly helpful fingertip knowledge for my kind of work (Linux systems and small scale networks in odd places).
Notably: port 666 - "Doom, the first online first-person shooter"
I'd like to see that email to IANA.
I mean if we wait long enough everything will be on port 443...
Questions from the distant future: "Why is there this hardcoded 16-bit field in the UDP header which is always 443? Why do we have an IPv6 header which is always followed by a UDP header which is always followed by a QUIC header? Why not just merge the three headers into one?"
And then RFC99999 defines a "new protocol" in which there is just a single header, which happens to have the same byte layout as IPv6+UDP+QUIC, with a bunch of fields like "reserved_01BB" which "always contains the bytes 0x01BB due to historical backward compatibility reasons"
Nmap ships with an nmap-services file, which is a lot like /etc/services. However, you might find it interesting because it lists common worm backdoor ports rather than some obscure license server.
You can start with the IANA list [0]. You won't find posts like this listed but it should be a good place to start regardless.
[0]: https://www.iana.org/assignments/service-names-port-numbers/...
On Linux, /etc/services often contains a list of at least protocol names and numbers.
One fun list is in the default NetComm router software which still has a huge list of pre-saved port forwarding info for multiplayer PC Games that hasn't been updated since around 2001. That's quite a fun nostalgic list to browse.[1]
[1] Here's A-D: https://i.imgur.com/tCn2FBB.png
I designed SSH to replace both telnet (port 23) and ftp (port 21).
As I have written here previously¹, that’s actually a bit of revisionist history, or at least a significant omission. Speaking as someone who was actually using Unix systems when this happened, the "ssh" command was replacing the rsh command, and also still ships an "slogin" command, replacing rsh’s companion command, "rlogin" (and "scp" replaced "rcp"). Where I was, nobody was even using telnet or FTP internally; everybody was using rsh, rlogin and rcp! This also better explains the naming; going from "rsh" to "ssh" is easier.
If someone had wanted to make telnet encrypted, they would just have had to implement the standard telnet protocol and add another option in the protocol; it has a bunch already, and even one for encryption, IIRC.
Speaking as someone who was actually using Unix systems when this happened, the "ssh" command was replacing the rsh command,
A different data point: I was also a Unix sysadmin at the time (thought just out of school) and for me ssh replaced telnet and ftp. I never used rsh, rlogin, and rcp except when testing exploits.
In my experience, telnet and FTP were used when accessing external resources; when wandering around the local menagerie of machinery, rsh, rlogin and rcp were predominant.
Ditto, I had been doing sysadmin as my job for a few years in 1995 and as a component of my job or as a hobby for ~5 years before that. I was decidedly a telnet/ftp guy before ssh, and dabbled a little with "ssltelnet". I mostly avoided rsh and family because I didn't love the security model.
SSH was a fantastic improvement at the time, though the whole licensing model interfered with my use for the first several years.
If someone had wanted to make telnet encrypted, they would just have had to implement the standard telnet protocol and add another option in the protocol […]
This document describes a the telnet encryption option as a generic
method of providing data confidentiality services for the telnet data
stream. While this document summarizes currently utilized encryption
types and codes, it does not define a specific encryption algorithm.
Separate documents are to be published defining implementations of
this option for each encryption algorithm.
So I did recall correctly, then.
Oh, rsh, your security model was so cute. It runs on port 513. (There is also rexec, port 512, and rcp on port 514. rlogin runs on port 513 along with rsh.)
I wonder if IANA still assign numbers? Can I have them assign ports for, say, redis?
Yes, they do. Their mission hasn’t changed since IANAs inception.
But getting a port assignment these days is going to be virtually impossible. It’s probably not going to happen without at least a Proposed Standard RFC.
https://www.iana.org/assignments/service-names-port-numbers/...
There’s not a single RFC published that concerns redis. It’s not going to happen.
I got a port assigned a few years ago.
I needed to write a justification why the organisation I represented needs a port number (a custom binary protocol), a formal confirmation that protocol has versioning built-in (so we will not request for a new port number for the next version of the protocol), a confirmation that we have a running code implementing the protocol (if I recall correctly, link to documentation was sufficient), and the reasons why we cannot use any of the existing protocols.
It’s not impossible and I think it’s totally doable for redis unless the port is already reserved for something else.
Probably for the best.
If there was a moderately complicated bureaucratic process to be assured of getting one, it wouldn't be Redis or the next SSH that got assigned ports. It would be Oracle or HP or someone else incapable of pretending to be a good Internet citizen, who filled in 10,000 of the forms promising that they have 10,000 totally necessary well known enterprise services.
Someone should steal 666 TCP/UDP, no RFC and contact email is of a person who leaved id in 1996.
You shouldn’t need a hardcoded port number for a newly designed protocol. Register a service name instead, and use SRV or SVCB records in the DNS (and/or ZeroConf).
You’ll notice that on the official IANA list of port numbers and service names, there is a separate section, after the numbered ports, listing only service names¹. Just apply for one of those.
1. At the time of writing, starting on page 135 of the HTML version: <https://www.iana.org/assignments/service-names-port-numbers/...>
They could if redis went the way of proposing a RFC for their protocol. But I don't think it would be a good idea. But, if instead someone came up with a RFC proposing a standard protocol for communications with generic key-value stores like redis, it would make a lot more sense.
I always figured FTP is port 21, SFTP/SSH is port 22
They seem to always leave off port 20 is also ftp.
It’s just a data channel. This changed with nat and the introduction of the PASV command which allowed the client to set a non-well known port for the data channel
the introduction of the PASV command which allowed the client to set a non-well known port for the data channel
PASV instructs the server to specify another ip:port that it’s listening on to enable the client to connect.
PORT expects there to be an open port on the client for the server to connect to.
That's exactly what TFA says?
this WKS field in DNS that it refers to isn't something I've heard about
Why isn't it used?
You can do a lot better now with SRV records.
The WKS record type was, at one point, a record listing all network services available on a host. It consisted of a bitmap where each bit represented a port number, counting from 0 (!), where a bit being set indicated that the host offered a service on that port. This scheme only worked for low port numbers; it also inappropriately conflated DNS names with hosts. (The latter was perhaps a reasonable assumption when WKS was created sometime in the '70s or '80s, but it certainly isn't anymore.)
The most definitive references to WKS are probably:
* RFC 1035 (1987), which defines the record format.
* RFC 1912 (1996), which noted that "[WKS records] serve no known useful function, except internally among LISP machines. Don't use them."
In 1995 everybody sending email was trustworthy. Those were the days...
Edit: Except if their address was @aol.com. Eternal September started in 1993.
I have a shirt that says "The Internet is full: Go Away!"
I will pay you 5 cents to print 15 of those t-shirts, with my company logo on it and a QR code that points to an article about an internet standard and why my crypto startup is better than it. 10 cents, final offer.
From: Tatu Ylonen <ylo@cs.hut.fi>
To: Internet Assigned Numbers Authority <iana@isi.edu>
Subject: request for port number
Organization: Helsinki University of Technology, Finland
Many e-mail client still has a field for it in its account settings.
Yes!
Why 22 was available is also interesting. Network Control Protocol was the precursor to TCP and used different ports for inbound and outbound traffic, typically even for outbound and odd for inbound.
If you look in /etc/services you'll notice that all the older protocols listen on odd numbered ports.
Some of this still survives today. In active mode FTP servers listen on 21, ACK the inbound request and then connect to the client from 20.
I do not miss the days of trying to figure out which FTP mode would work through a given firewall configuration.
I like how he didn’t explicitly request 22. It was more like “anything 1-255 would be great... oh, by the way, I happen to be using 22...”
He did request it:
It would be great if this number could be used
We have assigned port number 22 to ssh, with you as the point of contact. Joyce
Those were the early days when you could be designated as the point of a contact for a TCP port connection number and expect not to be swamped by emails!
This is a good example of make it easy for others to say yes.
Had a very similar experience when I requested a Private Enterprise Number (PEN) in the early 00s.
I was doing some experimentation with LDAP, mailman and identity based encryption and needed some OIDs to support my undergraduate project work.
Private Enterprise Numbers are identifiers that can be used in SNMP configurations, in LDAP configurations, and wherever the use of an ASN.1 object identifier (OID) is appropriate.
So I went about signing up my university for a PEN. It helped that I also worked for the IT Services team at the time but I distinctly remember the request being done by email with the response more of less being "here's your number". :)
To my knowledge, I believe I'm the only person who has made use of the PEN assigned to the university.
Related:
How SSH got port number 22 - https://news.ycombinator.com/item?id=33363795 - Oct 2022 (2 comments)
reminds me of the days when s/keys over telnet were cool.
there should be a vh1 where are they now special for assigned ports in /etc/services that shipped with early slackware.
The headline of the article does not match the posting, which breaks a rule I believe. Could we at least correct the posting's grammar? To "How SSH became Port 22".
SSH is the most fantastic piece of black magic. So many incredible things are easy and secure.
Port forwarding
Reverse port forwarding
Rsync
So much more. And it's free. What a privilege to be alive today - I remember when all this was just a dream.
Where were you that PGP was banned, or encrypting emails was illegal?
Cryptography was considered a war weapon and only allowed for military use.
The United States had to be brought to court to finally allow cryptography: https://en.m.wikipedia.org/wiki/Bernstein_v._United_States
Before that, export rules could be "worked around" by printing cryptography in books.
See also https://en.m.wikipedia.org/wiki/Export_of_cryptography_from_...
"You have to get an export license if you're distributing from inside the US to outside the US" is pretty different to "sending encrypted emails was illegal", no?
For one thing, it sounds like sending wasn't impacted at all, once you had the software.
How would you send encrypted email without an encryption library?
From what I remember, what was illegal was exporting a (useful) encryption library, and that Wikipedia link supports my memory: It talks about exporting munitions. I remember at the time that even though libraries existed inside the US they weren't supposed to be exported to other countries (i.e. the rest of us should get encryption libraries developed outside the US). Nothing prevented US citizens in the US to use encryption. Nothing in that "cryptography is considered munitions" legal issue, at least, because that was about export.
They can't use encryption if they can't get encryption software. I recall hearing that companies outside the US could distribute software with competent encryption without problems (to people inside and outside the US), but companies inside the US basically couldn't distribute software with competent encryption, because someone outside the US might download it.
But I remember the time. The software could be downloaded from inside USA. Mid-nineties the internet wasn't particularly large and (what's nowadays) simple measures were in place. In practice you could get it from the US even if you were outside, but then again USA wasn't the only place where encryption software was made, so we all thought it a bit silly.
What I'm getting at is that it's simply incorrect that encryption wasn't available in the US, and it's also incorrect that encryption couldn't or wasn't in use. It most definitely was. The regulations were only about export. 40 bits max and all that.
I understand where you're getting at, but lawyers would see "is it possible for people out of the US to download this? Yes? Well lawsuit incoming, by the government/military."
This is way too much of an unknown. And we've seen with P2P/Napster and DMCA where just listing links without distributing still opens people to legal issues.
Those of us who were active back then did see the software. It was not kept off servers. It's just that I don't think archive.org was active at the time so we have no way of showing it to you, I believe.
You (as a US citizen or company) would acquire one from a US vendor. Exporting outside the US was illegal, using it within the US was not.
How would US vendors prevent people from outside the US to acquire the software?
You would use an "encryption library"? I don't understand what's complicated about this. I thought perhaps that top comment was talking about some country other than the USA, where cryptography had actually been outlawed, but it seems people really believe the US outlawed crypto in the 1990s? No, they did no such thing. They didn't even regulate it, excepting export controls.
Sending encrypted email in the US was NOT illegal. Sharing encryption libraries was.
How would you send encrypted emails without an encryption library?
You're not reading or comprehending the multiple correct replies. I won't repeat them because apparently that won't get through to you, but you should go back and read them again and again until you understand, or at least stop repeating the same incorrect information, if not finally understanding the correct information people keep trying to tell you.
https://en.wikipedia.org/wiki/Sealioning
woah I'm so glad he did it, I now got better picture of twitter altogether.
I am reading the replies.
You don't understand the legal liabilities people open themselves to if they provide the software.
Now they have to fully KYC customers to make sure they are from the US, with US only storage, and firewall so that people travelling cannot use the encryption library from out of the US.
You've seen the lawsuits on just P2P link providers, this is even worse.
People inside the US could trade encryption libraries. They just couldn't send those libraries to outside the US. You could download a cryptography library from outside the US, and your foreign recipient could do the same, and thus send emails back & forth. In practice all it meant was that US developers couldn't write make useful cryptography libraries, and the development got done elsewhere.
The US still restricts the export of (some) cryptography to (some) countries & organizations. Mostly that just requires submitting a self-classification report to the BIS stating that the cryptography is "mass market" and matches the definition thereof in the export regulations.
But what happens if the company you're trading with has non-US entities? Or traveling salesmen?
The issue here is the complexity of complying and closing all loopholes that would allow the government to bring the full weight of the legal system against a library writer.
That's an oversimplification and also inferring a completely incorrect situation.
It was perfectly fine for American citizens to use cryptography amongst each other or with outside nationals. It was also completely fine to download and use externally developed software.
What was illegal was developing and exporting cryptographic software. This is why, for the longest time, you would see warnings on web pages (puTTy, for instance) saying the software was only intended for use in the United States.
I disagree.
To fully comply with this you would need as a library provider to fully KYC your clients so that there is a firewall between their US and non-US entities, and that travelling people don't bring out an encryption library at the same time.
It would be a operational nightmare.
In the time period we're discussing, I was on a team shipping a commercial (shrink-wrap!) software project that extensively used cryptography, including an export version of same. It was not a big deal; it was not an operational nightmare; in the North American market, it wasn't a thing at all, you just did whatever you wanted.
Which part are you disagreeing with? I'm literally laymaning the law.
The law never covered using cryptography, it was always about exporting it. Mostly it was written around keeping military specific cryptography from entering rival powers hands, but was overbearing. So they amended it to allow commercially developed/homegrown cryptography (explicitly not developed for governmental/military use) to be distributed normally. In practice, it's still a little muddy as many of those use DoJ/DoS-funded cryptography patterns, but the government has chosen to take a fairly hands off approach on those (RSA and DSA are key examples).
You're correct that it would also be almost impossible to enforce the original wording in today's world of globalization. They also have little power to enforce it on foreign nationals, which is why a warning was usually Good Enough(TM) for American software developers.
I remember publishing some apps to the iOS App Store and was asked to “declare cryptography to the US government”. I’m not even American.
The form made it clear that using HTTPS is considered cryptography, so I’m fairly sure almost every app on the store has checked “yes” to that question.
So far as I'm aware, this was never the case. Bernstein's case started in 1995 (it was decided in 1999). I assure you, cryptographic software was widespread and, apart from export controls, unchecked in 1995. Source: my professional career started in 1995.
In (I think) early 1995 I bought a "This T-Shirt Is A Munition" shirt with RSA source code on it, by typing the information from the bottom of a personal check(!) into a web page. It was a whole thing.
not quite crypto related, or at least directly, i remember this old Mac G4 ad: https://youtu.be/lb7EhYy-2RE?si=3tvJK4BXbA71LbGQ
It still is.
e.g in France:
https://cyber.gouv.fr/en/protection-sensitive-and-restricted...
It's just that import/export constraints have been relaxed.See Annexe 1 here: https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000646995?...
This is one of the reasons why MobiusSync is not available in the French iOS App Store since it doesn't use iOS crypt which already has approval plus it doesn't fit into some of the exceptions to the restrictions, so they'd have to fill in paperwork which is only available in French and submit via snail mail (go figure, although they do accept answers written in English as a courtesy).
https://github.com/MobiusSync/MobiusSync/issues/27
Similar concerns, processes, and exceptions are effective for other countries, e.g for the U.S. you need Encryption Registration (ERN) approval from the U.S. Bureau of Industry (BIS). Exceptions are described in Category 5, Part 2 of the U.S. Export Administration Regulations.
PGP was not exactly banned but if you were in Europe when ITAR restricted its export, and you were trying to download from strait-laced corporate types like AOL, they wouldn't let you.
And even if a determined person could get around the blocks, they severely limited the network effects; office workers on their employers' PCs weren't going to be getting encryption software from IRC bots to bypass arms export laws.
Some time towards the late 90s PGP became much more easily available.
Its effects are still with us. Hardly anyone uses encrypted email even though it is now easy to set up. The (lack of) network effects has persisted.
IMO that's less due to the ease of setup and more due to the lack of any sane key exchange system & general impossibility of encrypting all email content (e.g. subject line).
You are probably from the US and not aware how things looked outside of it? https://en.m.wikipedia.org/wiki/Crypto_Wars
Quite recently, the researchers behind the Tetraburst attack (https://www.tetraburst.com/) discovered that Tetra's encryption has "levels" which depend on the intended recipient's country.
This leaves the critical infrastructure of emergency services and police force for a lot of countries (notably, US non-allies) wide open to attack.
The existence of the levels was previously known; what they discovered was just how bad some of them are.
Encryption was (and in some countries, still legally is) considered dual use technology. You needed to go through paperwork and licensing to export cryptography across the border. Symmetric keys longer than 64 bits were considered too strong.
This led to all kinds of stupidity. Internet Explorer shipped with nerfed TLS capabilities, limiting key sizes to 40 bits or 56 bits depending on the version.
When the encryption laws changed in 2000, Microsoft allowed users to download an update to improve SSL encryption: https://learn.microsoft.com/en-us/previous-versions/tn-archi...
You could legally encrypt emails, of course, as long as you kept the key sizes small and didn't export the encryption software to another country.
If you sell and export encryption products from the USA (and a bunch of other countries, see the Wassenaar Accords) to certain places (including China and Russia), you're still obligated to register your product if you use modern key sizes. I'm not sure if governments still care now that OpenSSL and PGP are freely available to anyone, but if your proprietary email encryption program is found on North Korean computers, your government may ask you some uncomfortable questions.
I was on the Cypherpunks list, mostly as a lurker. The technical discussions were amazing. I was really into it at the time, but now I find some of the political ideas to be embarrassing.
Other people had a lot to do with the spread of strong crypto as well. Many people realized that encryption was necessary if we wanted to do business online. Matt Blaze (who was on the Cypherpunks list, but never said anything crazy), helped blow up the government's compromise solution, mandatory key escrow, by demonstrating flaws in their Clipper chip technology. The MIT Press published PGP's source code in book form, using an OCR font, because books couldn't be blocked as munitions. I think Hal Abelson, who wasn't on the list, was the person behind that.
The basic political idea behind the list was that you could effect change by writing code. Instead of going to the government, with your cap in your hand, and saying, Please, sir, can we have strong encryption?, you write code and give it away, thus making the law impossible to enforce. This sounds really cool when you're young, especially if you write code, but it's an anti-democratic idea.
The political positions of some of the leaders was kind of an extreme, anarchist spin on libertarianism. Bitcoin is a currency designed to solve a specific problem -- it's kind of the ultimate solution to the old goldbug fear that governments will print money and dilute the currency. That's impossible under Bitcoin.
The original crypto currency the Cypherpunks were really into was David Chaum's Digicash, which was designed to solve a completely different problem, the same one Monero is aimed at today. It was supposed to be untraceable. Instead of asking governments to lower taxes, the idea was that programmers could create a way to transfer funds anonymously. In theory, taxes would become impossible to collect, and national borders would collapse.
Eventually this led to things like discussions of anonymous murder contracts. There was a proposed protocol that was supposed to allow you to put out a hit on someone with complete safety. You could pay the killer anonymously with digital currency. I think the payment would go into some sort of escrow, so the killer would know they'd get paid. I don't remember how the system was able to know that the hit had taken place.
Those murder contracts were one of the things that made me pull back from the list. But it really was terrific to read, even though I think it would be a mistake to lionize it too much. Arguably, they were struggling to make the whole world run on 8chan's rules.
Is it? Code was deemed free speech, after all. So suppressing it would be anti-democratic, not spreading it.
I -think- the anti-democratic thing is making it impossible to enforce the laws of a democratic society. If a democracy decides that strong encryption should be banned, going against that is going against the will of the people.
Of course, we all (technical people) agree that it was the right thing, but ask yourself: If there was a vote on the issue, do you think the majority of people would vote for keeping strong encryption, or do you think they'd ban it? Especially back then.
I personally think they'd ban it. I bet the majority would just go "encryption is for terrorists and bad people, we don't need it", and we'd lose the vote.
Democracy is funny that way.
Now for an alternative thought exercise consider the situation in which a democracy votes to end itself and initiate a dictatorship. Is it democratic or anti-democratic to try to stop it?
Although the end of the Weimar Republic was essentially an electoral choice, significant chunks of the electorate by then had been skewed, divided, disenfranchised, or even displaced it wouldn't be accurate to call the elections fully representative. And yes, similar efforts are underway in the US too.
Rather than speculate, let's just wait a few months.
Democracy is just a tyranny of the masses.
Through the good advertising it's now usually understood as 'we vote => we are in control => values', except democracy is clearly has nothing with social and humanitarian values.
Is it? That's clever sounding but mostly wrong.
Democracy is a system where political disagreements are resolved through a set of agreed-upon rules (AKA "rule of law") instead of violence. The alternative to Democracy is mass murder. There is still plenty of violence in a Democracy -- witness the prison system in the USA, but it isn't neighbors just casually murdering each other (as also happened in the USA in an organized way in the Jim Crow era). Interesting to note -- both counter-examples were / are founded on denying parties participation in the democratic process...
The Rwandan and Bosnian civil wars are both examples of "tyranny of the masses" where there's no mechanism for resolving disputes between groups, besides killing your neighbor.
Well said, correct, and insightful.
I never subscribed to cypherpunks, but I know a bunch of the people who created and ran it, and saw up close and over a long period of time how their idealistic stubborn anarchist libertarian ideals devolved and played out over the years, and it's pretty tragic and shockingly toxic.
It's ironic that some of those people never question their own hard-held Libertarian beliefs about politics and economics, and instead believe conspiracy theories just as crazy as and aligned with a run-of-the-mill dime-a-dozen 14-year-old MAGA edgelords living in their mother's basement and tweeting 4chan memes, because they think they're so much smarter than everybody else, and nobody else's opinion is worth listening to, just because they got lucky and made a whole lot of money off of some other technology they actually knew something about.
In my personal experience, it led to a multi-millionaire ironically Deadhead Libertarian patronizingly mansplaining to their less-well-off LGBTQ+ friend about white victimhood and the terrible dangers of widespread systemic reverse discrimination against rich white men, enthusiastically quoting and defending Scott Adams, and vehemently arguing that "Black people are a hate group", and that "White people should stay the hell away from Black people" and "It's OK to be White". That's where the cypherpunk road and philosophy leads, in at least in the sad case of John Gilmore, one of its founders.
https://news.ycombinator.com/item?id=38743199
DonHopkins 51 days ago | parent | context | favorite | on: The personal, political art of board-game design
Discussions about politics with reasonable people you disagree with are fascinating and illuminating, but I've found it's always the unreasonable people who have reprehensible indefensible politics who try to unilaterally inject them into the conversation, but then when somebody calls them on it and stands up to their bullying and gaslighting, they suddenly don't want to talk about politics any more after bringing it up, because they don't want to discuss or defend or justify what they just said, "loftily indicating by some phrase that the time for argument is past" [1]. Many people unfortunate enough to have brainwashed alt-right relatives they're seasonally visiting are experiencing that this holiday season.
I recently lost a long term friend of several decades I used to adore and respect, John Gilmore, to this disgracefully common pathological mental decline and intellectually dishonest trolling. It started with his gleefully and frequently bringing up climate change conspiracy theories, then finally degenerated into blatant racism, a straight white privileged over entitled libertarian millionaire man bitterly complaining about white victimhood and reverse discrimination and the woke mind virus, and literally quoting and enthusiastically agreeing with and intellectually dishonestly arguing in support of Scott Adams statements that "Blacks people are a hate group" and "White people should stay the hell away from Black people" and White Supremacist slogans like "It's OK to be White".
https://en.wikipedia.org/wiki/It%27s_okay_to_be_white
https://time.com/6259311/dilbert-racism-scott-adams/
https://www.washingtonpost.com/media/2023/02/28/rasmussen-po...
It sucks to lose a friend, but it sucks a hell of a lot more to tolerate racism and abuse and gaslighting from a troll.
Tolerating him and his ilk but just avoiding talking about politics around him is exactly the wrong approach, since he's never going to change. Packing up my luggage, leaving his house, returning his key, checking into a hotel, terminating the friendship, and never talking with him again is much cleaner and healthier for all involved.
That's what the EFF did too, when they voted to kick him off the board of the organization he founded. But it's also important to warn other people about him and others like him, because he certainly wouldn't want me to self censor or keep my experiences and what I think a secret.
"The Net interprets censorship as damage and routes around it." -John Gilmore
https://en.wikipedia.org/wiki/John_Gilmore_(activist)
https://www.eff.org/deeplinks/2021/10/john-gilmore-leaves-ef...
My heart and sympathy goes out to others stuck with sociopathic trolls like John Gilmore, because of family or financial or other commitments, and all I can suggest is don't tolerate any of it, don't try to fix them, just cut them out of your life as much as you can.
[1] “Never believe that anti-Semites are completely unaware of the absurdity of their replies. They know that their remarks are frivolous, open to challenge. But they are amusing themselves, for it is their adversary who is obliged to use words responsibly, since he believes in words. The anti-Semites have the right to play. They even like to play with discourse for, by giving ridiculous reasons, they discredit the seriousness of their interlocutors. They delight in acting in bad faith, since they seek not to persuade by sound argument but to intimidate and disconcert. If you press them too closely, they will abruptly fall silent, loftily indicating by some phrase that the time for argument is past.” ― Jean-Paul Sartre
This quote is from Jean-Paul Sartre's work "Anti-Semite and Jew" (originally "Réflexions sur la question juive"), written in 1946. In this passage, Sartre analyzes the behavior and motives of anti-Semites. He argues that anti-Semites are aware of the absurdity and frivolity of their arguments. According to Sartre, they engage in such discourse not to persuade through rational debate but to amuse themselves and to disconcert their opponents. They do this by undermining the seriousness of any conversation, thus avoiding genuine discussion. When pressed, they may cease the discussion, indicating that they are above argumentation. This approach, Sartre suggests, is a form of bad faith, a concept he discusses in his existentialist philosophy, referring to acts of self-deception or dishonesty in one's dealings with oneself and others.
Conspiracy-minded theory: only once the government successfully arranged for a process (behind closed doors) to subvert or capture any US-based cryptography efforts or communications.