[ NNSquad ] Re: P2P resource taking (was Re: pcap files of the Comcast forgeries?)

[Brett Glass <nnsquad@brettglass.com>]

At 11:21 PM 12/19/2007, Lauren Weinstein wrote:
 
>Hmmm.  Well, as long as we're using the buffet analogy, how about this one:
>
>A satisfied customer of the buffet posts a message to a buffet-fans
>mailing list, and suddenly the buffet owner is faced with crowds of
>"heavy" eaters, who tend to eat much more than the average customer,
>but are not violating any rules of the buffet by eating as much as
>they do.  Rather than put a specific announced limit on the amount
>anyone can eat -- or raising prices -- the buffet owner watches
>people eat and when he personally believes someone has eaten too
>much, starts to harrass that person so that they won't keep going
>back for more food.

Not analogous. Firstly, people who are heavy eaters ALREADY frequent
buffets, so the owners of a buffet have to factor this effect in from
the start. It's not something that suddenly happens because of
publicity.

However, if the owner of the buffet finds that he is losing money even
though people are not smuggling food out, it IS appropriate for him
to raise prices, limit the number of return trips to the buffet, or 
stop doing "all you can eat" and sell the food by the pound. (Some 
cafeterias actually do this. I remember that when I spent a summer at 
Lawrence Livermore Laboratory as a college student, their concessionaire
did it that way.)

The problem, though, is that in the case of Internet access people 
really, really want an "all you can eat" buffet. Any ISP who doesn't
offer it will go out of business. What's more, in the case of P2P,
the smuggling is automatic -- more effective at commandeering resources
than a human could be. It is designed to clean out the buffet extremely 
efficiently -- before legitimate customers even get a chance
to eat! So, the proper thing to do is to stop the food smuggling. 

>What would ISPs do, I wonder, if large numbers of people set up
>their own virtual networks using continuous or semi-continuous stream
>ciphers?  Continuous ciphers are systems (traditionally popular in
>government and military circles) that send continuous encrypted data
>whether there is meaningful content at that moment or not.  The
>purpose is to deny the adversary both meaningful traffic analysis
>and content.

You can still tell that P2P is going on via a customer's usage patterns,
just as the owner of the buffet can tell that a user is taking far too
much food even though he doesn't know which food the consumer is eating
and which food he's smuggling out. 

The only difference between encrypting everything and not doing so is
that the ISP cannot de-prioritize or selectively throttle the P2P. So, 
he is forced to take harsher action than before. He must throttle 
EVERYTHING, or boot out the user. (Raising prices is not a realistic
option, since customers already complain that they want to pay less for
broadband.)

>I'm not recommending this course of action, but to the extent that
>ISPs behave like overbooking airlines that promise seats and then
>don't deliver, 

That's a bad analogy. If you're going to use an airline as an analogy,
it would be better to talk about customers abusing an "unlimited luggage"
policy, or sprawling out on multiple seats, or smuggling stowaways
on board.

>resourceful users are going to move increasingly to
>encryption wherever possible.  It *will* happen.  The only question
>is how quickly this transition will occur, and to a significant
>extent ISPs can influence this by their own actions.

Again, Lauren, encryption will not do a thing to solve the problem.
In fact, it will exacerbate it by forcing ISPs to throttle ALL traffic,
with hard limits, raise prices, and/or aggressively boot users off of
their networks for overuse. Is that what you want? It's surely not 
what consumers want. What you are championing will not solve the
problem but rather will escalate the war between ISPs and rogue users, 
with the innocent and honest ones caught in the crossfire.

--Brett Glass