[freehaven-dev] Thoughts on 2/25/2001 meeting notes (Red Rover)

["maxentropy2" <maxentropy2@netzero.net>]

Thanks, Freehaveners, for thinking about Red Rover.  I have no
doubt that any doubts about security, etc., are valid ones and
no illusions that there's a lot to be done yet.  But I haven't heard
the argument yet that the multiplicity of a peer-to-peer approach
(I'm using that term really broadly here to just mean "napster-like",
though the actual communication between the clients would be
even less than with napster) isn't what these goals call for.  The
idea has been to provide an amoeba-like population, one that
can't be pinned down and then blocked.  We can't centralize
the beacons in an onion routing way between the clients and
the recipients or we will be looking at DoS attacks (just as if we
were planning this system to be identical to napster).  I'm 
repeating myself, of course--and I'm very open to suggestions.
But P2Ping this Red Rover appears to do two things we need:
1) it provides a centralization model from the viewpoint of the
servers, since they all rely on a central hub of reliable information,
and 2) it provides decentralization from the viewpoint of the 
recipient (and police).  These are both desiderata of the system, 
as I see it, and I'm not sure what alternatives there are that will
still achieve both points.

A point for clarification, too.  Certainly the final goals of 
getting around firewalls could be done any number ways.  Clarke
thinks he's solved it, for example.  But RR is based on a
contextual approach to the problem which is not purely technical,
and its important to remember that.  Clarke's is a good case in
point of a brilliant, anonymous, ingenious system--that will 
to get a lot of people behind bars because it completely ignores
the legal context of the problem. The balance is not between 
this or that version of technological security--its between levels of
technological security and elements of risk to users in the 
context of their environment.  Hope this helps.

News from Oxblood, by the way, and this is purely confidential.
Long story short, we have a window of opportunity again, if we 
were to get something going with Red Rover.  They've been 
delayed at least 6 months. Their original launch date was to be
in March.  If we *were* to get RR going by the end of the 
summer term, RR should beat them out.  On the other hand,
one programmer on the team I've spoken to has expressed
interest in potentially partnering with RR once their own system
is finished.  So, if their system looks like something you think
we should copy, we may have to ride their coat tails.  

There are two other viable partnerships which I'm working on
developing at this point, aside from the Austrian ones which
will likely come to life late this year.  

Red Rover doesn't have to be perfect from the receiver's
point of view--it just has to be "common sensical".  The "can do"
of Red Rover is to make the website information available
at all times--its not to crash firewalls.  And its to make sure
people can find the sites when they want to (hence the 
rococo notification system).  The risk is *not* that recipient
emails get discovered by the Chinese cops--that's turning
Red Rover into a logical problem.  Its not.  The risk is that
if the Chinese *did* discover the email addresses that 
they would then trace and prosecute the visitor.  From 
what we know of the Chinese, yes, we'd like to avoid 
user's being found out--but visiting websites that haven't
been blocked hasn't been getting people into trouble
there--so as far as I'm concerned, the logical problem
is not the problem we need to concentrate on--it might
be overworking the problem.  We don't need to reinvent
Freenet, afterall--we just need a delivery system with as
much security as we can muster to make it 1) run 24/7i
and 2) with *reasonable* care, contextually defined
country by country, to permit a user to find out about and
visit undiscovered/unblocked personally run websites.
In my opinion, we can then worry about security refinement 
in version 2.  :)

All the best,

Alan


>3) Red Rover. I think the current concensus is that the overall
>goals seem good, but the approach may not be the right one to take at
>all. Peer-to-peer is a nice notion in that it will garner support and
>publicity, but that doesn't mean it's the best approach from a technical
>point of view. We should try to get more info from Alan and Oxblood, and
>see where it goes. In the meantime (independently), Rachel is looking at
>"steganography in big brother countries" papers with the intent of trying
>to find a masters thesis in it.



Shop online without a credit card
http://www.rocketcash.com
RocketCash, a NetZero subsidiary