[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[freehaven-cvs] section 5 cleaned up a bit
Update of /home/freehaven/cvsroot/doc/fc03
In directory moria.seul.org:/home/arma/work/freehaven/doc/fc03
Modified Files:
econymics.bib econymics.tex
Log Message:
section 5 cleaned up a bit
(still need to talk about mojo nation)
Index: econymics.bib
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.bib,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -d -r1.7 -r1.8
--- econymics.bib 15 Sep 2002 06:18:03 -0000 1.7
+++ econymics.bib 15 Sep 2002 23:56:34 -0000 1.8
@@ -101,7 +101,7 @@
year = 1995,
volume = 13,
number = 7,
-pages = {1141-149},
+pages = {1141-1149},
month = {September}
}
Index: econymics.tex
===================================================================
RCS file: /home/freehaven/cvsroot/doc/fc03/econymics.tex,v
retrieving revision 1.16
retrieving revision 1.17
diff -u -d -r1.16 -r1.17
--- econymics.tex 15 Sep 2002 21:58:00 -0000 1.16
+++ econymics.tex 15 Sep 2002 23:56:35 -0000 1.17
@@ -813,7 +813,6 @@
economically viable in the next section.
\section{Alternate incentive mechanisms}
-
\label{sec:alternate-incentives}
As the self-organized system might collapse under some of the conditions
@@ -821,18 +820,22 @@
alternative mechanisms.
\begin{enumerate}
-\item Usage fee. Imagine a scenario where each participating to the system
-actually has to pay for it. This changes the public good with free-riding
-problem discussed above into a ``clubs'' scenario. Participating agents can
-elanborate a pricing mechanism related to how much the agent will use the
-system (traffic) or how much sensitivity it is (which involves mechanism
-design and revelation mechanism). Consider again the Anonymizer, where a
-basic service is offered at low costs to low sensitivity types (there is a
-cost in the delay and the hassles of using the free service), and is offered
-for a premium to the others. In this alternative, the cost of being a node
-is externalized, and then paid to some entity. A mixed solution will involve
+\item Usage fee. Imagine a scenario where each participatant in the
+system has to pay. The public good with free-riding problem discussed
+above turns into a ``clubs'' scenario. Participating agents can elaborate
+a pricing mechanism related to how much they expect to use the system or
+how sensitive they are (which involves mechanism design and revelation
+mechanism). The Anonymizer offers
+basic service at low costs to low sensitivity types (there is a
+cost in the delay and the hassles of using the free service), and offers
+better service for money. With usage fees, the cost of being a node
+is externalized, and then paid to some entity. A hybrid solution involves
distributed trusted mixes, supported through entry-fees paid to a central
-authority and from this authority re-distributed to the nodes.
+authority and redistributed to the nodes.
+
+\item Bilateral contracts. Bilateral or multilateral contracts between
+agents can lead them to agree on cooperation and punishments for breaching
+cooperation.
\item ``Special'' agent. Imagine having a ``special agent'' whose utility
function has been modified to consider the social value of having an
@@ -840,40 +843,36 @@
service. The risks here are congestion and non-optimal use \cite
{mackiemason-varian-95}.
-\item Bilateral contracts. Bilateral or multilateral contracts between
-agents can lead them to agree on cooperation and punishments for breaching
-cooperation.
+\item Public rankings and reputation. The incentives regarding
+reputation can come in the form of wanting a higher reputation to get
+more cover traffic, but also as one of the rewards for the ``special
+agents'' above. Just as the stats pages for seti@home \cite{seti-stats}
+encourage more participation, publically quantifying and ranking their
+generosity and interest in providing privacy systems to the world creates
+an incentive to participate. This incentive is very important to consider,
+even if doesn't fit in our model very well, because to date that's where
+most node operators come from.
-\item Reputation: this comes either in the form of ''i want a higher
-reputation so i can get more cover traffic'', as explained above, but also
-is ''i think offering this service is good for the world. gaining a higher
-reputation makes me feel warm and fuzzy inside, because people see how
-generous i am and how concerned with privacy i am.'' this last group is a
-critical group to describe, even if it's not in our model very well, because
-to date that's where most node operators come from. similarly we hope to get
-governments to run nodes (and in germany they're already working on a
-government-run mix cascade).%[[Roger's email on this topic follows]]
-If we publish a list of mixes ordered by safety (based on number of messages
-each message is expected to be mixed with), then the v\_H people will
-gravitate to those mixes, causing more traffic, and improving their safety
-further (and lowering the safety of other nodes). In effect things will
-stabilize with one or a few remailers. One reason it won't actually
-stabilize like this is because p\_a is influenced not just by n\_h but also
-by some fuzzy notion of diverse jurisdictions --- a given v\_H sender is
-happier with a set of diverse mostly-safe nodes than with a set of very-safe
-nodes run in the same zone. Another reason it may not stabilize is that at
-some point latency will begin to suffer, and the v\_L people will go
-elsewhere, thus taking away the nice anonymity sets. But I suspect that
-certainly at current Mixmaster loads, we're not seeing enough load yet that
-that could happen. More generally, this also argues for a closer examination
-of batching times for each mix --- a mix that chooses a frequent batching
-time may get lots of messages from the v\_L people, and thus end up
-providing better anonymity than one that fires only infrequently. Is a
-message from a v\_H sender ''better'' than a message from a v\_L sender?
-Certainly a dummy message which ends at a mix is ''worse'' than an actual
-message that ends at an actual recipient. I think it's safe to assume that
-all actual messages provide equivalent protection.%
-%[[end Roger's email on this topic]]
+If we publish a list of mixes ordered by reliability (and thus safety,
+based on number of messages each message is expected to be mixed with),
+then the high sensitivity users will gravitate to those mixes, causing
+more traffic, and improving their safety further (and lowering the safety
+of other nodes). Based on our model the system will stabilize with one
+or a few remailers. One reason it won't actually stabilize like this
+is because $p_a$ is influenced not just by $n_h$ but also by some fuzzy
+notion of diverse jurisdictions --- a given high sensitivity sender is
+happier with a set of diverse mostly safe nodes than with a set of very
+safe nodes run in the same zone. Another reason it may not stabilize is
+that at some point latency will begin to suffer, and the low sensitivity
+users will go elsewhere, thus taking away the nice anonymity sets. (On
+the other hand, current Mixmaster use levels are nowhere near that point.)
+
+More generally, a mix that chooses a frequent batching time may get lots
+of messages from the low sensitivity people, and thus end up providing
+\emph{better} anonymity than one that fires only infrequently. Is a
+message from a high sensitivity sender ''better'' than a message from a
+low sensitivity sender? Certainly a dummy message which ends at a mix is
+''worse'' than an actual message that ends at an actual recipient.
\item mojonation: we might be able to get the system to work by building in
a micropayments system, like mojo nation did. however, its design isn't as
***********************************************************************
To unsubscribe, send an e-mail to majordomo@seul.org with
unsubscribe freehaven-cvs in the body. http://freehaven.net/