Bcc

Recently I had the honor of swearing, and having notarized, an affidavit of bona fide marriage for a good friend as part of an immigration application. Speaking with another friend who had done the same for a friend of hers, she remarked that it was such a basic and important thing to do, that even if she did nothing else this year it would have been an accomplishment. And the formal, official process of notarization was interesting enough itself that I spent some time looking into how to become one.

Notary Public

Becoming a notary is a strange process. By its nature, it's an extremely regulated field: state law specifies exactly what a notary must do, what training they must have, what level of verification is needed for different notarized documents, exactly how much a notary may charge for each service, how the notary may advertise itself, etc. That is, you become a notary public, not just a notary. Presumably this is in part because other legal and commercial processes depend on notarization of certain kinds.

Given all those regulations, if the notary errs or forgets when conducting her duties, the law provides penalties. Forgot to thumbprint someone when you notarized their affidavit? That's $2500. Forgot to inform the Secretary of State when you moved to a new apartment? $500. Screw up the process for identifying an individual in a way that screws up someone else's business? They can sue you for damages. In short, if you're a notary, you need to buy notary errors and omissions insurance, at least $50 for four years. Also, the State wants to be sure that you can pay if you become a rogue notary who violates all these rules. As a result, as soon as you become a notary you're required to execute a bond of $15,000 with your county. In short, you pay a certified bond organization maybe $50 for the bond; if the State thinks you screwed up, they get the money directly from the bondsman and then the bondsman comes and gets the money from you.

Notary Digital?

But mostly I'm curious about this just because I've been thinking about the idea of a digital notary. (This is not to be confused with completing notary public activities with webcam verification instead of in-person, which appears to be illegal in most states, and not what I'm offering.)

That is, it seems like there are some operations we do in our digital, electronic lives these days that could benefit from some in-person verification. Those operations might otherwise just be cumbersome or awkward, but if we have an existing structure — of people who advertise themselves as carefully completing these verification operations in person — maybe that would actually work well, even with our online personas. These thoughts are, charmingly I hope, inchoate and I would appreciate your thoughts about them.

Backup / Escrow

Some really important digital files you want to backup in a secure, offline way, where you're guaranteed to be able to get them back. (Say: Bitcoin wallets; financial records; passwords, certificate revocations, private keys.) You meet with the digital notary; she confirms who you are, who can have access to the files, whether you want them encrypted in a way that she can't access them, how and when to get them back to you (offline-only, online with certain verifications, etc.). You pay her a fee then and a fee at the time if you ever need to retrieve them.

Alternatives: online "cold storage" services; university IT escrow services (not sure if this is common, but Chicago provides it for faculty and staff); bank safety deposit boxes with USB keys in them; online backup you really hope is secure.

Verification and Certification

You can go to a digital notary to get some digital confirmation that you are who you say you are online. The digital notary can give you a certificate to use that has your legal name and her signature (complete with precise verification steps) that you can use to sign electronic documents or sign/encrypt email. Sure, anyone can sign your OpenPGP key and confirm your identity, but the notary can help you set it up and give you a trusted verification (based on her well-known reputation and connection to the Web of Trust and other notaries).

And, traditional to the notary, she can sign a jurat. That is, you can swear an affidavit of some statement and she can verify that it was really you saying exactly what you said, but do so in a way that can be automatically and remotely verified.

Alternatives: key-signing parties; certificate authorities (some do this for free, others require a fee, or require a fee if it's not just personal use); creating your own key and participating in the Web of Trust in order to establish some reputation.

Execution

While we hope to see an increase in the thanatosensitivity (oh man, I've been waiting for an excuse to use that term again; here are all my bookmarks related to the topic) of online services — like Google's Inactive Account Manager — after we die, it's likely that our online accounts will become defunct and difficult for our next-of-kin to access. It would be useful to give someone instructions for what we want done with our accounts and data after death; that person will likely have to securely maintain passwords and keys and be able to verify, offline, our identities. Pay your digital notary a fee and she can execute certain actions (deleting some data, revealing some passwords to whichever family members you chose, disabling social media accounts) after your death, after verifying it using not just inactivity, but also confirmation with government or family.

Alternatives: a lawyer who understands technology well enough to execute these digital terms of your will just as they do your regular will and testament. (Does anyone know the current state of the art for lawyers who know how to handle these things?)

Education

And actually what might be most valuable about digital notary services is that she can explain to you these digital verifications work. That is, not only can a digital notary provide digital execution with in-person verification, she can provide the basic capability, explain how it works and then conduct it. Another advantage of in-person meetings, you can seek individualized counsel, not just formalistic execution of tasks.

It would be nice if information technology had a profession with a fiduciary responsibility to its clients; the implications of digital work are increasingly important to us but remain hard for non-experts to understand, much less control. Just as we expect with our doctors and our lawyers, we should be able to ask technological experts for advice and services that are in our own best, and varied, interests. Related, it would be useful if the law reflected that relationship and provided liability but also confidentiality, for such transactions. That latter part will take a little while (the law is slow to change, as we know), but a description of the profession and some common ethical guidelines of its own could help.

A Shingle?

As an experiment, I offer you all and our friends the services described above — escrow of files/keys; authentication, encryption and certification of messages; execution of a digital will and testament — at a nominal $2 fee per service.

Sincerely yours,

Nick

P.S. Did you know that payment of fees is one factor used to determine that a privileged client-attorney relationship has been established?

Hi Paul,

This "Great Works of Software" piece is fantastic. Of course I want to correct it, and I'm sure everyone does and I'm fairly confident that was the intention of it, and getting everyone to reflect and debate the greatest pieces of software is as worthy of an intention for a blog post (even one hosted on Medium) as any I can think of.

I don't dispute any of your five [0], but I was surprised by something: where are the Internet and the Web? Sure, the Web is a little young at 25, but it's old enough to have been declared dead a good handful of times and the Internet calls Word and Photoshop young whippersnappers. Does the Web satisfy your criteria of everyday, meaningful use? Of course. But I'm guessing that you didn't just forget the Web when writing about meaningful software. Instead, I suspect you very intentionally chose [1] to leave these out to illustrate an important point: that the Web isn't a single piece of software in the same sense that the programs you listed are.

The Web is made up of software (and hardware): web server software running on millions of machines all around the world; user agents running on every client machine we can think of (desktop, mobile, laptop, refrigerator); proxies and caching middleboxes; DNS servers; software and firmware running on routers and switches, in Internet Exchange Points and Internet Service Providers; software not included in this classification; crawlers constantly indexing and archiving Web pages; open source libraries which encrypt communications for Transport Layer Security; et cetera. But even if one had an overly-simplified view of Web architecture (and I wouldn't criticize anyone for this; this is the poor-man's Web architecture that I teach students all the time) consisting of servers and browsers, anyone would see that there's no singular piece of software involved. You mentioned the TCP/IP stack as a runner up, but there's no single TCP/IP implementation that's particularly great or important: what's important is that separate implementations of the relevant IETF standards interoperate [2]. Other listmakers included a browser (Kirschenbaum highlighted Mosaic [3]; PC World, Navigator) or you could imagine listing Apache as a canonical server (and the corresponding foundation and software development methodology), but even as important as those pieces were (and are!), alone they just don't make a difference.

As a thought experiment then, I submit a preliminary list for a Web software canon, listing not single pieces of software but systems of software, standards and people.

• Blogs (RSS/OPML/Dave Winer/Blogger/Medium): anyone can write for the world to see
• Wikis (c2/Ward Cunningham/Portland Pattern Repository/Jimmy Wales/Wikipedia/MediaWiki): we can write together, not just alone
• SSL (TLS/certificate authorities/CAB Forum/OpenSSL): we can communicate privately and do business online
• Search (Google): we can find each other, and information -- true and untrue -- about anything and everything

Non-exhaustive, of course, but I hope it's helpful for your next blog post, which I hope to see on ftrain.com. Is there something distinctive to these systems of software that are intrinsically tied up with the communities that use and develop them? Whole publics that are recursive, say [4]? I hope there are a few people out there writing books and dissertations about that. (I should really get back to writing that prospectus.)

Sincerely,
Nick

[0] Okay, I'm skeptical about Emacs -- isn't the operating system/joining of small software pieces already well-covered by Unix?

[1] By the Principle of Charity.

[2] It might be tempting, for someone who works on Web standards like I do, to claim that the Web is really just a set of interoperable standards, but that's nonsense as soon as I think about it at all. Sure, I think standards are important, but a standard without an implementation is just a bit of text somewhere. An of course, that's not hypothetical at all: standards without widespread implementation are commonplace, and bittersweet.

[3] Also, Kirschenbaum includes Hypercard in his list, with a reference to Vannevar Bush and the Memex, which I love, and it might be the closest in these lists to something that looks like the Web/hypertext but in non-networked single-piece-of-software form.

[4] Kelty, Christopher M. Two Bits: The Cultural Significance of Free Software. Duke University Press Books, 2008.

The Knight News Challenge applications are in and I find them a particularly exciting batch this year, perhaps because of a burst of activity spurred on by a handful of surveillance revelations you might have heard about. I read through all 660: below are my list of promising applications from friends and colleagues. I’m sure there are many more awesome ones, including some I already “applauded”, but I thought a starter list would still be useful. Go applaud these and add comments to help them improve.

Which are your favorites that I’ve missed? I’m keeping a running list here: https://pinboard.in/u:npdoty/t:newschallenge

Encrypt all the things

Mailpile - secure e-mail for the masses!

Making secure email (using the OpenPGP standard) easier by developing an awesome native email client where encryption is built-in. They already have an alpha running that you might have seen on Kickstarter.

Encryption Usability Prize

Peter Eckersley, just over the Bay at EFF, wants to develop criteria for an annual prize for usable encryption software. (Noticing a theme to these encryption projects yet?) Notes SOUPS (CMU’s conference on usable security, happening this summer at Facebook) as a venue for discussion.

LEAP Encryption Access Project: Tools for Creating an Open, Federated and Secure Internet

LEAP (leap.se) is a project for developing a set of encryption tools, including proxies, email (with automatic key discovery) and chat, in an effort to make encryption the default for a set of at-risk users. (My colleague Harry Halpin at W3C works with them, and it all sounds very powerful.)

TextSecure: Simple Private Communication For Everyone

TextSecure is likely the most promising protocol and software project for easy-to-use widely adopted asynchronous encrypted messaging. (Android users should be using the new TextSecure already, fyi; it basically replaces your SMS app but allows for easy encryption.) Moxie (formerly of Twitter) is pretty awesome and it’s an impressive team.

Standards

Speaking of encryption, there are two proposals for standards work directly related to encryption and security.

Advancing DANE (DNS-Based Authentication of Named Entities) to Secure the Internet’s Transport Layer

This one may sound a little deep in the weeds, but DANE is a standard which promises end-to-end transport security on the Internet via DNSSEC, without relying on the brittle Certificate Authority system. Yay IETF!

Improved Privacy and Security through Web Standards

My colleagues at W3C are working on WebCrypto — a set of APIs for crypto to be implemented in the browser so that all your favorite Web applications can start implementing encryption without all making the same mistakes. Also, and this is of particular interest to me, while we’ve started to do privacy reviews of W3C specs in general via the Privacy Interest Group, this proposal suggests dedicated staff to provide privacy/security expertise to all those standards groups out there from the very beginning of their work.

Open Annotations for the Web

Hypothes.is (with lots of I School connections!) has been contributing to standards for Web annotations, so that we can all share the highlights and underlines and comments we make on web pages; they’re proposing to hire a developer to work with W3C on those standards.

Open Notice & Consent Receipts

A large handful of us I School alumni have been working in some way or another on the idea of privacy icons or standardized privacy notices. Mary Hodder proposes funding that project, to work on these notices and a “consent receipt” so you’ll know what terms you’ve accepted once you do.

Documenting practices, good and bad

Usable Security Guides for Strengthening the Internet

Joe Hall, CDT chief technologist and I School alumnus extraordinaire, has an awesome proposal for writing guides for usable security. Because it doesn’t matter how good the technology is if you don’t learn how to use it.

Transparency Reporting for Beginners: A Starter Kit and Best Practices Guide for Internet Companies, and a Readers’ Guide for Consumers, Journalists, & Advocates

Kevin Bankston (formerly CDT, formerly formerly EFF) suggests a set of best practices for transparency reports, the new hot thing in response to surveillance, but lacking standards and guidelines.

The positive projects in here naturally seem easier to build and less-likely to attract controversy, but these evaluative projects might also be important for encouraging improvement:

Ranking Digital Rights: Holding tech companies accountable on freedom of expression and privacy

@rmack on annual ranking of companies on their free expression and privacy practices.

Exposing Privacy and Security Practices: An online resource for evaluation and advocacy

CDT’s Justin Brookman on evaluating data collection and practices, particularly for news and entertainment sites.

IndieWeb and Self-Hosting

IndieWeb Fellowships for the Independent and Open Web

I’ve been following and participating in this #indieweb thing for a while now. While occasionally quixotic, I think the trend of building working interoperable tools that rely as little as possible on large centralized services is one worth applauding. This proposal from @caseorganic suggests “fellowships” to fund the indie people building these tools.

Idno: a collective storytelling platform that supports the diversity of the web

And @benwerd (werd.io) is one of these people building easy-to-use software for your own blog, not controlled by anyone else. Idno is sweet software and Ben and Erin are really cool.

Mail-in-a-Box

Even if you had your own domain name, would you still forward all your email through GMail or Hotmail or some free webmail service with practices you might not understand or appreciate? This project is for “a one-click, easy-to-deploy SMTP server: a mail server in a box.”

Superuser: Internet homeownership for anyone

Eric Mill (@konlone) has been working on a related project, to make it end-user easy to install self-hosted tools (like Mail-in-a-box, or personal blog software, or IFTTT) on a machine you control, so that it’s not reserved for those of us who naturally take to system administration. (Also, Eric is super cool.)

I feel that our noise list has become too predictable and not nearly noisy enough. To address that, below I've included an attempt at an ethnographic and interpretive review of a short talk from a well-known security expert at an SF hacker space. —npd

Seeing Jacob Appelbaum speak at Noisebridge is something of an event, and I think it's perhaps uniquely appreciated as I saw it, with the company of an entirely non-computer-geek friend.

"5 Minutes of Fame" is a version of "lightning" or "ignite" talks, held about one evening a month at Noisebridge, a hacker collective space in the Mission District in San Francisco. (Both of those concepts bear a little explanation.) Lightning talks are kind of the opposite of lectures — they are dramatically short, generally five minutes. Different emcees will manage them differently, but in many cases you revel in the short, tight timeframe: slides might be set to auto-advance, speakers may be forced from the stage at the end of their time limit and so they rush to get everything in and the Q&A period common to academic conferences is generally ignored, you can talk over beer later. (Noisebridge is pretty casual about theirs; scheduled for 8pm to 10pm, I left in the middle in order to catch the midnight Bart train.)

And what is a hacker space? Noisebridge is one of the most well-known of these; it's generally a warehouse space with tools and supplies for mechanical and electrical tinkering. Noisebridge sports classes for knitting and for soldering and has a pretty strong software bent as well, including running Tor nodes (software and infrastructure for Internet anonymity) off of their servers and Internet connection. Members pay some regular dues, can come and go as they please, use the tools and the space for storing stuff and building things. As you might imagine, Noisebridge (and I imagine this is true of hacker spaces in general) is really more about the community of people than it is about the shared physical resources; this is less a tool-lending library and more a makers' clubhouse.

And so that's where M. and I see Jacob Appelbaum talk. Except, he's not on the agenda (a few of these talks are planned well in advance, and others are practically spontaneous — it doesn't, after all, require all that much preparation to give a five minute talk, though, that's not to minimize the act itself, talking for exactly five minutes to a group of your peers can be a nerve-wracking experience), just listed as "Person of Mystery" whom the emcee doesn't even know. But then he appears from the back of the room and there's a kind of roar of appreciation from the crowd, the kind of audience reaction I might imagine for a rock star, except the audience is 50 or 60 nerds of various types and ages. He is introduced initially just as Jake (I recognize him from one or two previous events we've attended together) and then formally as Jacob Appelbaum, though at that point it's clearly unnecessary for the audience, with no background or affiliation given; Jake was a founding member of Noisebridge, back in the day. I try to whisper to M. to explain what's going on before he dives immediately into his talk about this official trip he's just gotten back from to Burma and all of his illegal antics while there; I say, "he's, like, a security guy who works for Wikileaks" and recognize that this is inadequate and kind of incorrect, but what else can I say?

Noisebridge, like many of these informal collectives, is architected to be open and welcoming. Once we navigate the old fashioned elevator (the kind with two gates that you have to open and close, the kind that I've only ever seen in movies and this is the first time that I've actually had to operate one), there is nothing at all holding us back from entering and we are only most casually asked for cash donations during the evening itself. People are loud and friendly and, while many of us are awkward, all are pretty willing to talk to strangers. But at the same time, it can be incredibly insular, with acronyms, handles and inside jokes thrown around without the slightest pause. I give up on the futility of whispering explanations to M. and many of the scifi jokes fly over my head too. (M. notes later how unnerving it is to be invited by strangers to join in on conversations when participating inevitably reveals your lack of the shared expertise.)

That level of mystery around his introduction is clearly indulged by Jake and enthralling to the Noisebridge crowd. "Oh, that's not supposed to be in there," he says, unconvincingly, about the very first photo in his set, which just happens to be a photo of the Dalai Lama from this official visit he's just come back from. And "indulgent" really seems like the right word at times: Jake enjoys cursing and insulting prominent figures and entire governments, and gets great appreciation from the audience whenever he cheekily disavows having conducted some illicit probe of a technical system he encountered. He does pause a bit on realizing that a young girl is among the audience (Noisebridge really does bring people of all ages and all types, a more diverse crowd than I'm accustomed to among technical groups) but ultimately doesn't self-censor much. She ends up asking some of the best questions after his talk and we are all simultaneously impressed by and proud of her.

Appelbaum's five minutes of fame go on for maybe 45 minutes, with no pretense of anyone trying to cut him off. The topic itself is fascinating: a report from Burma on the steps necessary for obtaining a cellphone and using one to access the Internet; results from attempts to penetrate Internet censorship and other insecure technical systems within the country; recounting conversations with activists (political or technical) about how they handle living under such a regime. His talk is half "look at the cool stuff I did" and half "isn't this unacceptable and horrifying"; Jake may be irreverent, but he's also deadly serious about human rights abuses and the murders and imprisonments connected to government surveillance. He ends by saying he has to leave straight for the airport to fly to another state ("fly to another state" he repeats again — are we meant to be impressed or to wonder which state it might be?).

M. asks me later what GSM is (just one piece of the alphabet soup), which has been the main topic of his talk, and I struggle to explain the technologies of our and other cellphones, a technical area that I find I really don't know much about. But the history of phones in this sort of technical community, what I would now call the Internet community, is so canonically well-known that I can recite stories about Captain Crunch and blue boxes just like anyone else can. And the way that @ioerror talks about Burmese cellphone restrictions, freedom of access to information and the conditions for hacking are really quite reminiscent of that irreverent mode of making free long-distance telephone calls to foreign countries, even when at many times it's unclear why they wanted to call Vatican City anyway.

I find myself listening to RadioLab a couple of days later, in my new mostly empty apartment without any Internet access (it gets to me; I honestly feel cut off from the world), to the story of a blind kid in Southern Florida who found he could whistle phone calls.* Was this the youth of Captain Crunch? No, I find, this is Joybubbles**, a part of this story that I haven't heard and apparently news coverage of Joe's getting caught phreaking at college is what reveals to phone phreakers around the country that they're not alone in doing this, and then whole communities spring up that find they can call in to certain broken telephone numbers that act as a kind of party line where they can talk to one another for free, an early chatroom/message board, I suppose.

I actually went to Noisebridge that night primarily because of a talk that was pre-listed, one from Schuyler Erle, a cartographer I know through some geo folks. (Neogeographers are that certain subset of the Internet community that loves doing cool stuff with maps and the latest often informal Web technologies. I would like to count myself among them at least to the extent that I've been going to WhereCamp, the geo unconference, for 4 years straight.) Schuyler doesn't actually talk about cartography at all really, but about science fiction, about strategy board games and about space travel. This talk (I won't try to repeat it, hey, the slides and notes — and this talk is more immaculately prepared than most — are online***) goes in to some detail about the challenges of future space travel (special relativity, cryogenesis, etc.) and colonization and war. And though it's late in the evening, this is the one moment of the night that surpasses even the enthusiasm of Jake Appelbaum giving a surprise talk at Noisebridge — Schuyler rhetorically asks, why, given all the challenges and hardships involved in near-speed-of-light space travel, would we ever bother to colonize and conquer the stars? Because they're there! Because we can!

And that moment of united enthusiasm (which, I imagine, includes M. and myself and all the Noisebridge regulars) explains, I think, a lot of what a hacker space is, what hacking is, why Jake Appelbaum is so revered here. Whether it's building your own X-ray machine, devising a one-meal-a-day diet, making free phone calls to a foreign embassy or circumventing Internet censorship in Burma — *because you can* is reason enough to do something.

* The last act of the episode "Escape!", February 20, 2012.

** Perhaps because of his own troubled childhood, Joe eventually changes his name to Joybubbles, declares himself to be five years old again and dedicates himself to this call-in service "Stories and Stuff" for kids to call and listen to. Children and phones! Another sort of connection to Steve Wozniak; when I saw him speak at Microsoft he was clearly most fascinated about the call-in joke line, or having a cellphone number that was all repeated digits so that kids would accidentally call him when they first played with a phone. How can there be so many of these internal connections?

*** http://iconocla.st/m/Light_Speed_notes.pdf Ha, and what a domain name, as I've just noticed. Having your Internet address be "Iconoclast" is an excellent micro-explanation of the ethic of Noisebridge.