Join us for a party.

When:  Sunday, October 2nd, 2005 at 5 p.m.

Where:  EFF Headquarters in San Francisco, 454 Shotwell Street, 94110

EFF is 15 years old this year, and we are going to celebrate! We're having an anniversary bash at our San Francisco headquarters on Shotwell Street on Sunday, October 2nd, 2005. The party starts at 5 p.m.

If you noticed a long break in the blogging, it's because I was at Burning Man. And while people do blog from Burning Man, it's not what you want to spend your time doing. I will have more entries in the future, but let me relate some stories of the network and the phone booth first.

Last year, we erected a free phone booth in the desert to great results. This year, it was going to be even better because of a plan for a new internet connection. In the past, John Gilmore had brought his satellite dish, which had all the latency and bandwidth limits of satellite. This year he splurged on getting a microwave link in, which will be even faster next year. Sadly, much of that money was wasted because we never got the "first mile" -- the on-playa 802.11 network -- operating at a satisfactory level. There was huge packet loss and jitter in most places, when it was up at all. Next time some of the money will go into better equipment and planning for the local network.

As such, the phone booth, located in our camp on 7:30, only worked intermittently and rarely with great voice quality. We eventually decided to sacrifice the aesthetic purity of a booth sitting in the desert, connected to nothing, and moved it on its wagon by trike to the center camp, home of the incoming microwave link. The we set it up on the street, with an ethernet wire snaking in. We were no longer wireless, but the voice quality was top notch. I wasn't able to spend much time with it but reports were that the line got very long at times.

In our own camp, you could tell if it was working or not based on whether there was a line. Even waiting for it to work was better than the 2-3 hour time investment of taking the bus to the phone booth in Gerlach.

Last year, I recounted the emotional experience people had using an unexpected and impossible phone to hear the voices of loved ones. This year, this was magnified by Katrina. I learned of Katrina, in fact, when people came to ask to use the phone to contact their relatives in NOLA. (Read on...)

A mantra in the security community, at least among some, has been that crypto that isn't really strong is worse than having no crypto at all. The feeling is that a false sense of security can be worse than having no security as long as you know you have none. The bad examples include of course truly weak systems (like 40 bit SSL and even DES), systems that appear strong but have not been independently verified, and perhaps the greatest villian, "security through obscurity" where the details of the security are kept secret -- and thus unverified by 3rd parties -- in a hope that might make them safer from attack.

On the surface, all of these arguments are valid. From a cryptographer's standpoint, since we know how to design good cryptography, why would we use anything less?

However, the problem is more complex than that, for it is not simply a problem of cryptography, but of business models, user interface and deployment. I fear that the attitude of "do it perfectly or not at all" has left the public with "not at all" far more than it should have.

An interesting illustration of the conflict is Skype. Skype encrypts all its calls as a matter of course. The user is unaware it's even happening, and does nothing to turn it on. It just works. However, Skype is proprietary. They have not allowed independent parties to study the quality of their encryption. They advertise they use AES-256, which is a well trusted cypher, but they haven't let people see if they've made mistakes in how they set it up.

This has caused criticism from the security community. And again, there is nothing wrong with the criticism in an academic sense. It certainly would be better if Skype laid bare their protocol and let people verify it. You could trust it more. Read on...

I've called before for a system of Universal DC Power and I still want it, but there is a partial step we could take.

I have a laptop power supply that comes with a variety of tips. The tips tell (through something as simple as a resistor) the power supply how much voltage and current to supply for the laptop they are designed for. I bought mine for use in an airplane, others are sold that do both 12v and AC power.