7 ms·

I understand where you're getting at, but lawyers would see "is it possible for people out of the US to download this? Yes? Well lawsuit incoming, by the govern

I understand where you're getting at, but lawyers would see "is it possible for people out of the US to download this? Yes? Well lawsuit incoming, by the government/military." This is way too much of an unknown. And we've seen with P2P/Napster and DMCA where just listing links without distributing still opens people to legal issues.

Tor3 3y ago
Those of us who were active back then did see the software. It was not kept off servers. It's just that I don't think archive.org was active at the time so we have no way of showing it to you, I believe. Edit: As for Napster and DMCA, the Napster story happened in 1999 and the DMCA in 1998. The limitations on crypto were loosened in 1998 and 1999 and removed in 2000. In other words, Napster and DMCA isn't really relevant here - the encryption story mostly unfolded before that time.
- DiggyJohnson 3y ago
  You are speaking past the GP by missing the de jure (their point) versus de facto (your point) aspect of the discussion, I think.
  - Tor3 3y ago
    Possibly - but my impression is that the GP is rejecting as impossible what I'm stating - that in fact you could use cryptographic libraries in the US, because they were, indeed, available. GP seems to argue that they could not have been available because that would have allowed them to potentially be downloaded (exported) outside of the US, which was illegal at the time.
tptacek 3y ago
None of this is true. It really feels like there are a couple people who were, like, alive in the 1990s trying to explain to people that cryptography was not in fact illegal or even regulated in the USA during the heyday of Ace of Base, and then a lot of younger people trying to axiomatically derive an alternate history where nobody could encrypt anything. You could just download PGP and run it, and if you go look at back issues of Wired, you'll see that lots of people were begging Americans to do just that.
- mratsim 3y ago
  The fact that it was not enforced doesn't mean there wasn't a sword of Damocles above your head.
  - Tor3 3y ago
    As someone who watched all of that at the time.. I believe nobody in the US felt any sword of Damocles above their heads. The net was a very different place from now. A simple automated download check was what was needed, or even just a statement. There was other kind of software as well, and I remember having to fill out a form stating that I wasn't going to re-export the software to [short-list of certain countries] before I got the actual download link. That was about it, back then.
    - mratsim 3y ago
      What would that check do? Check IPs?
      - tptacek 3y ago
        Some companies literally just provided two links, one for the US version and one for the international version. That's how not-serious this whole thing was. Really, even back in 1995, people did understand how the Internet works. Nobody was under any illusions that you could actually control "export" of cryptographic software. If you were a US-based company that sold shrink-wrap software, you probably also filled out some paperwork once a year. For "open source" software (note: not a thing, as such, in 1995): forget about it.
      - Tor3 3y ago
        geoiplookup wasn't a thing until 1999 or so, plus/minus, but "whois" was, and mid-nineties the net was pretty small compared to now (for a definition of "small"). So yes, knowing where an IP address came from was a thing even then. But there were also the two-versions links mentioned by the sister comment. Among other things. This was not a big deal. Really.
  - 3y ago

Tor3 3y ago

Those of us who were active back then did see the software. It was not kept off servers. It's just that I don't think archive.org was active at the time so we have no way of showing it to you, I believe. Edit: As for Napster and DMCA, the Napster story happened in 1999 and the DMCA in 1998. The limitations on crypto were loosened in 1998 and 1999 and removed in 2000. In other words, Napster and DMCA isn't really relevant here - the encryption story mostly unfolded before that time.

DiggyJohnson 3y ago
You are speaking past the GP by missing the de jure (their point) versus de facto (your point) aspect of the discussion, I think.
- Tor3 3y ago
  Possibly - but my impression is that the GP is rejecting as impossible what I'm stating - that in fact you could use cryptographic libraries in the US, because they were, indeed, available. GP seems to argue that they could not have been available because that would have allowed them to potentially be downloaded (exported) outside of the US, which was illegal at the time.

tptacek 3y ago

None of this is true. It really feels like there are a couple people who were, like, alive in the 1990s trying to explain to people that cryptography was not in fact illegal or even regulated in the USA during the heyday of Ace of Base, and then a lot of younger people trying to axiomatically derive an alternate history where nobody could encrypt anything. You could just download PGP and run it, and if you go look at back issues of Wired, you'll see that lots of people were begging Americans to do just that.

mratsim 3y ago
The fact that it was not enforced doesn't mean there wasn't a sword of Damocles above your head.
- Tor3 3y ago
  As someone who watched all of that at the time.. I believe nobody in the US felt any sword of Damocles above their heads. The net was a very different place from now. A simple automated download check was what was needed, or even just a statement. There was other kind of software as well, and I remember having to fill out a form stating that I wasn't going to re-export the software to [short-list of certain countries] before I got the actual download link. That was about it, back then.
  - mratsim 3y ago
    What would that check do? Check IPs?
    - tptacek 3y ago
      Some companies literally just provided two links, one for the US version and one for the international version. That's how not-serious this whole thing was. Really, even back in 1995, people did understand how the Internet works. Nobody was under any illusions that you could actually control "export" of cryptographic software. If you were a US-based company that sold shrink-wrap software, you probably also filled out some paperwork once a year. For "open source" software (note: not a thing, as such, in 1995): forget about it.
    - Tor3 3y ago
      geoiplookup wasn't a thing until 1999 or so, plus/minus, but "whois" was, and mid-nineties the net was pretty small compared to now (for a definition of "small"). So yes, knowing where an IP address came from was a thing even then. But there were also the two-versions links mentioned by the sister comment. Among other things. This was not a big deal. Really.
- 3y ago