From: Raph Levien <raph@c2.org>
Date: Wed, 31 Jan 1996 00:52:01 +0800
To: cypherpunks@toad.com
Subject: Vladimir: put up or shut up
Message-ID: <Pine.SUN.3.91.960129162111.27262B-100000@infinity.c2.org>
MIME-Version: 1.0
Content-Type: text/plain


Most of the recent cypherpunks traffic from Vladimir has been a 
reiteration of the position that discussing ITAR is bad because it 
discourages cypherpunks from releasing good crypto software.

Well, here's one cypherpunks who recently released some software, and
futhermore did so making significant (some might say extreme) concessions
to the ITAR rules. I made the software available only on an 
export-restricted Web server, and asked explicitly several times for it 
not to be exported. If my timezone math works out right, it took about 
half an hour for it to be available on utopia. The ITAR did _nothing_ to 
stop, or even slow down, the reease of my software.

Why is it, then, that we still don't have usable strong crypto tools?  I'd
say the reason is complex, much more so than could be explained by a
simple conspiracy theory or even too much discussion of ITAR. The main
reason is that it is very damned hard to write good crypto-enabled
applications.  Trust me, I know. I have done the best I could with the
software I released, but I'm still quite frustrated with its limitations,
especially with respect to nontechnical users. 

Ultimately, to create really good crypto-enabled applications, it's going 
to take money. And there's where ITAR is most effective. If the powers 
that be disapprove of your software, then there goes your foreign market. 
There go your government sales. There go those "strategic alliances" with 
the other companies in the market, because the pressure can be applied 
transitively too. ITAR is actually only a small part of the process.

Still, free software has a lot of vitality left in it. It's still strong 
at blazing new trails in software design. Where it's weak (and this is 
what really counts now), is being usable, easy to learn, and easy to 
install. I think if we explicitly work towards these goals, there's hope 
for great free crypto-enabled applications. Hell, PGP came pretty close, 
and it's saddled with all kinds of lousy design decisions.

But back to Vladimir: instead of whining at us about how our fear of the
law is hurting the acievement of our goals, why don't _you_ write that
killer crypto-app and distribute it to the world? Who's stopping you? 

Raph