lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun Jun 11 03:58:30 2006
From: degeneracypressure at gmail.com (Eliah Kagan)
Subject: Re: blocking tor is not the right way forward.
	It may just be the right way backward.

On 6/10/06, Rodrigo Barbosa wrote
> You are confusing matters.
> No one is proposing to outlaw Tor. Or even to track users back.
> If someone want to force Tor users to identify themselves before
> using a site, I'll be against it. But anyone is free to stop
> Tor users from using their networks/servers.

I never said anyone is proposing to outlaw tor, and I do not believe
that I am confusing anything. And I never said that anyone is not free
to *attempt* to stop tor users from using their networks and servers.
But once the action of stopping the users pertains to user behavior
rather than site admin behavior, the freedom of choice as to how to
act pertains to the users rather than the site admins.

It is worth mentioning that I think that attempting to tracking tor
users back should remain (as it is) perfectly legal, although it would
likely be morally wrong to do so unless the user who is being tracked
back has committed a crime (or agreed to the tracking, for instance as
part of a development effort for technologies to track tor users).

> No. You can remain as anonymous you want. You just can't use those
> sites.

If I have the right to do something, but if I do it I am unable to
survive and participate in society, then that right of mine is not
being respected. When efforts to prevent people from enjoying privacy
are isolated and uncommon, they are an insidious nuisance and an
insult. When they are common and widespread, they result in true
violation of people's privacy rights and harm society as a whole.

> Lets consider a completely unrelated and different situation to
> iluatrate it. I too defend the right to buy stuff at a supermarket
> without providing any means of identification. On the other hand,
> I don't defend the right to buy absolutely anything (weapons etc)
> without providing identification.

I understand that you do not wish to post in this thread any longer,
but would anybody reading this care to explain how this completely
unrelated and different situation (which I agree it is) has anything
whatsoever to do with what we are talking about, and how it
demonstrates something flawed or missing in my arguments?

(By the way, to clarify my position: I don't think that people should
necessarily have the right to buy things at a supermarket without
providing identification, although if it were common for supermarkets
to require ID for all purchases, then the result would be that
people's privacy rights would be materially violated. And, like
blocking tor, I think that requiring supermarket patrons to show ID
constitutes an insidious nuisance. Furthermore, since driver licenses,
learner permits, passports, military ID cards, permits-to-carry,
police identification, and the like are provided by governments, it
*might* be reasonable to legally restrict both governmental and
non-governmental use of state and federal ID for the benefit of
individual privacy.)

> You are, again, wrong. Unless you start paying to use my site, I have
> every right to tell you what and how you can access it, as long as
> my terms are legal. If I say you can only access my web server using
> Lynx, that is all the right you have.

That is simply false. So long as I am not hacking your site or
otherwise violating the law, I may access it in whatever manner I
wish. That only *changes* when I am paying you, in which case there is
a contractual relationship which may govern how I may use your site
beyond the (minimal) restrictions against hacking provided by the law,
or under other circumstance in which we have a valid, legally-binding
contract. Then, when our contractual relationship ends, I may resume
accessing your site in whatever legal manner I wish, unless I signed
to terms restricting how I may access it which explicitly survived
termination or lapse of the contract.

What you are asserting, by the way, is patently ridiculous. If I go to
a website that says, "You are required to eat five pounds of cake and
bow down to the Mona Lisa before surfing the public pages on this
site," it would be absurd to think that I could actually be prosecuted
for eating four pounds of cake and merely nodding my head to the Mona
Lisa.

In addition to all this, I would like to point out that it borders on
the hilarious for site admins to put up "terms of service" to which
you effectively must agree to before reading them, or at least before
going back and reading them again.

> The basic point where you whole argument is flawed is that you consider
> you have any right to do anything regarding a publicaly avaliable
> resource. Lets consider a software license, like the GPL. It is also
> not a contract, the say way a "terms of use" on a site isn't. Do you
> think you have the right to violate the GPL just because it is not
> a contract you have signed ?

First of all, in the laws of all countries that recognize license
agreements as legally binding, they are considered contracts. This is
clear if you actually read the text of license agreements before
agreeing to them.

I do have the right to do anything with a publicly available resource
that is not prohibited by law or a contract that I have signed. In
fact, I have the right to do anything *whatsoever* that is not
explicitly prohibited by law--contractual restrictions apply because
the law provides for them, and restrictions on access to non-public
resources apply due to laws against theft, trespassing, and fraud.
(Those restrictions can then be lifted by consent of the owners of the
resources.) This is the way the law works in every remotely democratic
country--there is no civilized nation in which activities are
"prohibited by default".

If you actually read the GPL, you will see that it says explicitly
that you are *not* required to agree to it in order to use the
software. Without agreeing to a license agreement, however, I would be
prohibited by U.S. copyright law and international treaties to
redistribute the software, with or without modifications. Agreeing to
that contract gives me those rights, with limitations--a right which I
did not have at all before. If I do not agree to the GPL and proceed
to redistribute GPL-licensed software in a manner inconsistent with
the GPL, I am *not* violating the GPL--I am violating US copyright law
and international treaties for distributing copyrighted material
without consent of the author. (That particular contract, by the way,
does not impose *any* limitations on me that were not effective before
signing it. Some contracts do impose such limitations, and that's OK,
but **the contracts only impose limitations once signed or
equivalently agreed to**.)

> If you want others to respect you right to anonymity, then you better
> start respecting the right of others to run their sites (and not YOUR
> site) as they seem fit.

I guess I better go eat another pound of cake, then.

I do respect the rights of others to run their sites as they see
fit--I do not attempt to hack sites that block tor and modify them so
that they do not block tor. *That* would be violating the rights of
the site owners. Accessing the site as I see fit, within the law, does
*not* violate the rights of the site owners. Site owners are free to
adapt their blocking technologies to make them more effective, just as
I am free to adapt my anonymization technologies to make them more
effective.

> This is, by the way, my last post on this subject. I'm really sick
> of this. If there is one thing I hate, are fanatics.

It is probably fortunate that you have chosen to cease posting, as
your arguments appear to be devolving to name-calling. If you think
about it, you will come to the inevitable conclusion that whether or
not I am a "fanatic" has *no* bearing on whether or not what I am
saying is true, and consequently is irrelevant to the argument.

I also think that it is unfortunate that it is considered fanatical to
advocate for libertarian government and still believe that it is
worthwhile for people to act morally above and beyond the restrictions
of their governments, for the common good.

On the other hand, if by "fanatic" you mean someone who believes
something and voices the belief in an intelligent way (which appears
to be what the term usually means on this list), then I thank you for
the compliment.

-Eliah

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ