From: Alex Strasheim <cp@proust.suba.com>
Date: Sun, 3 Dec 95 12:21:29 PST
To: cypherpunks@toad.com
Subject: Re: Jim Clark, "Mr. Bubble"
In-Reply-To: <199512031807.TAA07090@utopia.hacktic.nl>
Message-ID: <199512032022.OAA02418@proust.suba.com>
MIME-Version: 1.0
Content-Type: text


> >I don't expect Netscape, as a corporate citizen, to engage in civil
> >disobedience.  But I hope that Netscape will take seriously its obligation
> >to protect the rights of citizens. 
> 
>       I do. I regard the capacity to do so as crucial, and I regard the
> fact that you *don't* expect them to as very telling. As has been pointed
> out extensively, the chances that he'll manage to hang on to his
> soft-earned cash until he can sell out are a long shot--unless he takes a
> stand against GAK. 

I don't know much about the market.  I can't say whether or not the market
will continue to value Netscape at $5 billion -- I never believed it would
happen in the first place.  If I walked outside and saw the skies filled
with pigs, and then you asked me when pigs will stop flying, I'd have to
say, "I don't know."  It's a lot easier to answer, "when will pigs fly?"
than, "when will pigs stop flying?"

It seems likely to me that the bubble's going to pop one way or another,
but again, I don't really know what I'm talking about. 

But I don't think Netscape can approach their business that way anyway. 
The market is going to do what it wants, and all they can do is try to
sell browsers and servers. 

> Governmental policy on the subject of crypto has relied
> upon secrecy, obscurity, and above all terrorizing individuals; the gov't
> would be extremely reluctant to throw the book Netscape, given its
> symbolic significance in the market. And even if it did, Clark's future
> would be assured--maybe after he got out of Club Fed, but assured
> nonetheless.

Clark's future is already assured.  So what if the bubble pops?  If
Netscape lost 90% of its value it would still be valuable.  The only time
$500 million doesn't look like an awful lot of money is when you compare
it to $5 billion. 

You're not seriously expecting Clark to expose himself to the risk of 
jail time, are you?

>       Let me be clear: if Clark and Netscape said "We're implementing and
> releasing a version with a key length we support," crypto policy would be
> the lead story on the evening news--and the gov't would lose. The only
> question is how fast. 

I agree with you that the government will lose a public debate about GAK 
and crypto export.  I just don't believe that defying the law is the way 
to go, more more accurately, that there's a snowball's chance in hell 
that Netscape would do it.

If you want to talk about what would pop the bubble the quickest, running 
around like a loose cannon and defying the law would have to be right up 
there.

> >The decison that Netscpae is faced with now is a big one.  It's going to 
> >have widespread and long lasting consequences for privacy and civil 
> >liberties all over the world.  When you look at what's going to happen on 

[...]

>       You set forth all these silly generalities as though they suggest
> that NS's best bet--for Clark, for itself, for the public--is to go along
> with US policy? Bullshit. Their best bet is to use their golden-boy status
> to sucker punch the gov't.

Your criticism of what I wrote is valid, to a certain extent.  I was
making general and simplistic arguments.  Sometimes they're the best
arguments.  Read the Contract with America or watch some of the "Why We
Fight" movies. 

And I'm not laying any claims to saying anything new here.  I'm not 
contributing anything in the way of analysis.  On the contrary, all I'm 
doing is pointing out the obvious.

There are two degrees of victory here.  The first is to have access to
strong crypto, legal or not.  That's already won.  If you've got a copy of
Applied Cryptography, you can pretty much do whatever you want.  There's a
lot of code out there, good tools exist and are easily aquired.  Sameer
has an apache ssl server that you can use instead of Netscape's commerce
server, and there are modified Mosaics that will talk to it. 

The battle we're fighting now is for legal access to strong crypto, and an
understanding on the part of the government that software engineers ought
to be able to build strong and secure international systems without
harassment.

You want some more platitudes?  The export restrictions on crypto are bad 
for business and they're not going to prevent the bad guys from 
communicating securely.  The genie is out of the bottle.

Crypto is rapidly becoming a tool that's essential to the operation of
even the most mundane business.  It's simply unrealistic to treat crypto
as a munition in a day and age when (a) everyone knows how it works, (b)
there are many thousands of people all over the world who have the ability
to write good crypto code, and (c) you have to use crypto to conduct your
business. 

The ITAR, as it relates to crypto, is hurting America's ability to compete
in international markets.  As more commerce moves online the damage
inflcted by ITAR will intensify drastically.  If Netscape takes that
argument to the business community, they'll be supported, because it's
reasnable and because it's the truth.

This isn't just about Netscape.  It's going to affect Sun, AT&T,
Microsoft, Oracle, and countless smaller companies.  It's going to affect 
the ability of GM to communicate internationally without falling victim 
to corporate espionage.

We're not selling snake oil here.  The cypherpunk position on crypto is
good for companies like Netscape, it's good for the economy gererally, and
it's good for the political health and general well being of the republic.

> >        1       Netscape will follow all laws and regulations.
> >        2       The current rules are forcing Netscape to choose
> >                between providing reasonable levels of privacy
> >                to its customers and competing in the international
> >                marketplace.
> >        3       Netscape feels the rules should be changed to make
> >                this choice unnecessary.

I still believe this is the winning argument, and that both the public's 
and Netscape's interest will be served if they make it publicly and 
forcefully.

>       1     Make illegal software available by FTP
>       2     Explain it's doing so because ITAR is bullshit
>       3     Face the gov't down in the press and in the courts 

Go for it.  We're behind you 100%.