From: jrochkin@cs.oberlin.edu (Jonathan Rochkind)
Date: Wed, 20 Mar 96 13:27:41 PST
To: IPG Sales <ipgsales@cyberstation.net>
Subject: Re: The return of the IPG Unbreakable System (fwd)
Message-ID: <ad75e0fb00021004414c@[132.162.233.188]>
MIME-Version: 1.0
Content-Type: text/plain


At 1:24 AM 03/20/96, IPG Sales wrote:
>Perhaps a battle has been lost, maybe even probably? But the war is not
>over, not by a long shot - with minor modifications this system is
>absolutely secure as events will prove. However, be assured that we
>will not sell our product to anyone until that can be definitively
>established. We greatly appreciate the contribution of some of those on

You used to claim "our system is absolutely safe, we're sure of it, but we
can't tell you the algorithm cause it's secret."  People said that was
stupid, so you finally agreed to show people the algorithm (apparently
sending it to them unsolicited, and then expecting them to be bound to some
sort of non-disclosure agreement?  You might want to hire a lawyer to
familiarize you with how trade secrets work legally, cause they don't work
like you think they work).  The people you showed the algorithm to pointed
out flaws in it.

Now you say "Yeah, okay so there were flaws, but we'll fix them and then it
will be perfect, except you can't see the code or algorithm cause it's
secret."  Sounds like we're back where we started, eh?   No one was willing
to trust the algorithm before without it being reviewed publically.  No one
will be willing to trust it now either, _especially_ after the previous
concerns that the algorithm wasn't secure were _confirmed_.

The cypherpunks list doesn't have to provide free cryptanalysis to you.  I
doubt anyone will want to waste their time looking at  future iterations of
your algorithm, if you deign to show it to them.  The fact that people on
the cypherpunks list don't want to waste their time doing free
cryptanalysis for you doesn't mean that your code is secure, or endorsed by
anyone.  It means that even those who may have thought it possible that
your algorithm was secure after all have given up on that thought, or at
least decided that it's unlikely enough not to be worth much further
consideration, at least until you start behaving reasonably.