Publius

» see cs.nyu.edu/~waldman/publius as it lived, on the wayback machine

~ the obit ~

In July 2000, three researchers put a system on the web for a two-month trial and named it after the joint pen name on The Federalist Papers. Marc Waldman was at NYU. Avi Rubin and Lorrie Cranor were at AT&T Labs-Research. The paper they wrote about it took the best paper award at the ninth USENIX Security Symposium that August, and the New York Times ran a piece on it on 26 July under the headline Divided Data Can Elude the Censor.

Fifty servers and a hundred-kilobyte file limit is not a product, it is a demonstration. Demonstrations do not reach anybody, anywhere, and this one was over before I finished secondary school. I came to it a quarter century late, through the citation trails of the systems that came after it, which is where Publius actually lives now.

The problem it was built for was specific. Anonymous publishing already existed in 2000 through remailers and free hosting, but anonymous publishing that survives is a different thing entirely. If your host knows what it is hosting, someone can make it stop. Publius set out to remove that lever by making sure the host could not know.

~ the rap sheet ~

~ how it worked ~

A publisher encrypted the document with a random symmetric key. The key was then split by secret sharing into shares distributed across the static list of participating servers, arranged so that only a small number of shares had to be recovered to rebuild the key. Each server ended up holding an encrypted blob and one fragment of a key, which is to say each server held nothing it could read and nothing it could pick out for deletion.

That produced two properties that mattered more than the encryption. Tamper evidence meant unauthorized changes to a document could be detected by the reader rather than merely suspected. Deniability meant the person running a Publius server could truthfully say they had no idea what was on their disk, which converts a legal threat into a technical impossibility. The publisher could still update or delete their own work, which most later systems gave up on.

The hundred-kilobyte cap was the compromise that made it feasible, and there was a workaround built into the design. A Publius file could reference other Publius files, so anything that fits the shape of HTML or PDF could be published across many pieces. During the trial the network ran across fifty machines, among them boxes at Xerox PARC and at the Center for Democracy and Technology, so the servers were volunteered by institutions with a stake in the argument.

~ what survived ~

The reception in 2000 was more clear-eyed than the reception these systems usually get. The National Post ran a piece in July headlined around the thorny questions, noting that a system nobody can take content off is a system that will be used for content people want taken off. Scientific American published a piece that October titled Speech without Accountability. Every objection that would be made to file sharing over the following decade was made to Publius first, before it had a single user worth arguing about.

Then the trial ended and nothing happened. The project was never updated after the initial run, there was no company behind it and no funding round to lose, and 2001 is simply the year the last activity stops. Wikipedia's entry for it says the experiment terminated with no significant results, which is accurate about the trial and wrong about the outcome. Secret-shared storage spread over servers that cannot read what they hold became ordinary in the years afterward, and Publius is the paper that shape gets cited from.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »