Friday Squid Blogging: Glow-in-the-Dark Finger Tentacles
Archie McPhee sells glow-in-the-dark finger tentacles.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Comments
Earl Gray • July 29, 2016 4:47 PM
motherboard.vice.com/read/gchq-url-shortener-twitter-honeypot
Another Clive Fan • July 29, 2016 5:04 PM
@All
Clive Robinson recently took a pause, which we noticed. He was then back describing a very serious health scare. And straightaway returned in full force responding with intelligence and wit, even managing to bite back at @ianf on occasion.
I hope we don’t take Clive Robinson for granted. We have all benefited and enjoyed his contributions for all these years – and all those readers whom don’t post have also. It is not an exaggeration to say his sharing has saved some lives, somewhere.
I am sad he hasn’t written up his fabulous knowledge and life experiences in a good handful of books (or have you, Clive??)
So. if this group was a physical gathering of friends, this would be the point at which we pass around the hat to collect the baht, rand, pesos, rupees and other assorted currencies for which to donate to Clive as a support – or use ourselves to buy him a special gift / health retreat / ticket to a Rolling Stones concert etc.
the logistics of doing so are a bit tricky for a self professed anonymous virtual space.
Is there
1. Someone able to set up a electronic online donation thingy for all of us to contribute to or
2. Are there folk that know Clive in the physical realm that can organise a gathering hat in a physical sense?
lets not take Clive for granted and just allow him to carry on as if nothing has happened. He deserves our gratitude and support.
Crypto Advice? • July 29, 2016 5:11 PM
@Everyone, whom responded to my query about Vera Crypt. For the diversity and intelligence shared – I salute you , plus with thanks, a couple of bex, and a cup of russian caravan.
@ Markus Ottela • July 25, 2016 12:14 AM
Thank you for taking the time to offer such a detailed and insightful reply about encryption et al . In fact I can say that about everything you post. I extend my admiration. RE: encrypted mail, you didn’t think of Proton Mail? They have street cred having been faced with state level actor DDOSing, and then crowdsourced the infrastructure to overcome it – and provide full details on their website of exactly how it works.
https://protonmail.com/blog/ddos-protection-guide/
They are transparent about everything, offer encrypted email from proton mail to external domains – they have seriously done a far better job than anyone else in the field.Because they have focused on usability. Incidentally Moxie Marlinkspike has the amusing following about why he hates GPG (Hiya Moxie)
https://moxie.org/blog/gpg-and-me/
@Stanley • July 24, 2016 6:29 AM
Your stance is based around the idea that someone would choose to use windows 10? And thus, Bitlocker is a better alternative than veracrypt? It’s a funny way of looking at things. thank you for your detailed reply though. but after your detailed exposition your refrain ‘but remember to disable telemetry etc’ – it raises the question ‘why is one using windows 10, then?’ – I mean, surely windows 7, if one really doesn’t have the time, patience or expertise to venture into linux etc.
@r • July 23, 2016 5:25 PM
” I buy water proof ones every three months but switching carriers and I get them for free, Qualcomm trustzone and all.Waterproof phone + duct tape and a custom apk/ROM can keep you well ahead of the Jones’. ”
By waterproof phone do you mean you keep it submerged in a bucket of water as a quote faraday cage unquote?
@Love Bubble • July 29, 2016 5:21 PM
@Clive Robinson July 24, 2016 2:00 AM
“The important part of learning, is something teachers do not know how to teach, which is how to learn. ….Thus the three types of teaching that are around, “spray and prey”, “teach by drill” and “drill to the test”. “”
According to Idries Shah whom wrote extensively and deeply on Sufism, the primary problem is that people say they want to be taught but they do not know how to learn. Thus Sufism is oft foremost concerned with teaching how to learn. His book The Way of The Sufis is excellent. Incidentally he says Sufism is older than Islam and doesn’t belong to Islam or indeed any creed or religion
As an addition to your learning modes suggested, I can suggest for everyone Spaced Repetition Systems, (SRS) supported by heaps of research, which is the technology of teaching something, then waiting until just before you have forgotten it, then teaching it to you again – which your brain then responds with ‘ah this is very important’ and proceeds to deposit it into long term memory. Most easily available in the FOSS flashcard software ANKI. Teach yourself anything you want, quickly, and retain it.
@Clive said:
“One skill you should develop is “constructive skim reading””
i recall a neuroscience Phd explaining that you could only expect to succeed at his level of academia, in medical science at least, if you knew how to pre empt what direction a paper was going to take and, invariably, what it was going to say, before you read it. That, if you expected to progress in your studies by just reading straight through the sum total of everything presented to you, insanity and failure was assured.
As an aside, Clive, RE: your comments on health and dietary measures – have you investigated the ketogenic diet. Dr Peter Attia is a world class academic leader in medical nutrition and intervention with diet – on the cutting edge, a true hinky thinker yet inside the establishment.
http://eatingacademy.com/
@ Slime Mold with Mustard • July 24, 2016 11:00 AM
“I believe it important that every human have an academic project, of whatever ambition, current. It makes us not squirrels.”
@SMwM , this is equal to the most priceless and wise piece of advice or commentary I have read here. Legend
Slime Mold said:
“Start here. Search unfamiliar terms and issues. Pick a topic and become a genuine expert. This largely done by reading, but it is critical that you reach out to people studied in the field”
Languages are a great one. Because they are measurable and quantifiable – one can know exactly where one is up to with their progress and have real world experience in applying that expertise. One can sit the Common European Framework exam to get an exact level of their fluency in the affiliated language (C2, A2, etc) . Language learning has ALL kinds of secondary benefits on ones brain and life
** Fluent Forever by Gabriel Wyner is by far, hands down, the most sophisticated yet easy and practical methodology to learning a language. The website of the same name is packed with free resources and the first chapter of the book free.
It’s purely a DIY process. With this method, the author taught himself about 5 languages to working fluency (writing and conversing) in about as many years – about an hour a day, between the ages of 20 and 30 . No gimmicks or frills, but a well rounded well articulated, accessible and grounded approach that also debunks a lot of the mystique and myths about language learning
The book 4 HOUR CHEF by Tim Ferriss is about meta learning – the first 100 pages or so. (The remained of the book is how he applies meta learning to going from 0-100 in the art of cooking) .
I recommend the first 100 pages to everyone, he covers everything from languages and world memory championship methods to, well, a bunch of other stuff
The book The Power of No by James Altucher is highly recommended by leaders and influential types in all kinds of fields – everyone can benefit from it – but on page 197 for about 10 pages it explains how to become an expert in a passion and make a career out of it
@Love Bubble • July 29, 2016 5:28 PM
further on from last weeks Friday Sepia Ink
RE: how to become learn-ed , or an ‘expert’
@ianf July 24, 2016 9:53 PM said the following
“Anyone, who in earnest is asking how to become an expert (like X and Y, say) is too… immature, to begin with, to understand what s/he’s asking for”
but then as a contrast of worldview and emotional mindset
@ Nick P • July 24, 2016 10:24 PM
responds by actually answering the question of how he learned, in a open, transparent, authentic fashion. He did this, he did that. This is how he feels about it. Fantastic
It’s beautiful Nick how you can be so plain with expressing the fact of feeling disadvantaged in a number of respects as the ‘exchange’ for being savant of mind and being. I am touched by your open ness. Ironically, your self awareness and ability to be such a real human being when you communicate, and suggesting your scenario is not the most ideal – detracts from your suggestion of being impaired socially [or other]. I always find your way of writing so very honest clear and refreshing and, dare I say, quite un-american (i picked up you are a US citizen) No filters, no attitude, no cynicism dressed up as worldliness or intellectual vigor or..something else. It’s an inspiration.
@Nick you said
” Thing about savants is nature trades off certain properties for others, especially absorbing tons of information. We’re nature’s intellectual vacuums. Now, most savants will suffer in social life and sometimes physical properties due to different wiring. Combined with a fucked up world & social stuff driving it, I think we’re disadvantaged and continually challenged by it.”
do you know [detective] Saga Noren Malmo Police, Nick ;-)
@ianf July 24, 2016 9:53 PM said
“Finally, there’s no path to expertise in any field that does not include at least a passing acquaintance with the entire body of literature (and by extension other arts), which one then can mine for analogies, and human interaction methods there recorded, to be applied to one’s area of endeavor. Literature is the carrier of knowledge, and the glue for combining otherwise disjointed pockets of “hardcore” insight into coherent shape. Reading up on hardcore alone, learning by rote, at best leads on to constipation.””
This is exceptional. Hang on to that, everyone
My, there are some insightful folk here. Thank you very ,very much
I always confuse your name with international monetary fund – the acronyms are so similar
Love Bubble • July 29, 2016 5:35 PM
@ianf • July 27, 2016 4:42 AM
“non-assisted home births and keeping the placenta attached instead of cutting the cord.cart it around, like a macabre saline drip, until it drops off naturally ”
it’s known as the Lotus Birth, it’s a serious and thorough procedure practised by many and I personally know mothers and children whom are the fruit of it. It’s meant to originate with Native Americans now made public. There are books . One main idea is that cutting the umbilical cord results in a instant loss of about two- thirds the blood supply to the infant, quite radically, and is a very traumatic shocking event for the child on a number of levels. Allowing the natural process sans violent medical intervention also means the mother must keep close to the child for the week or so for the natural process of drying up and separation – which allows for a psychological wholeness at that critical time. It also means the mother is going to be in a safe protected environment for that period and not doing stupid shit like jumping on an international flight and having full body scans, or going to a live gig at a bar with new born baby in arms. Both of which I have witnessed yankee mothers doing. Being so divorced from the reality
of earths natural rhythms is so tragic
@ Clive Robinson • July 28, 2016 2:36 AM
RE SOE wireless operators in WWII
” (look up Noor Inayat Khan, who’s agent name was Violette Szabo, or watch the film “Carve her name with pride”).
related to (daughter?) famous Hazrat Inayat Khan, brought Sufism to west, wonderful musican and sage author. Noor had an anecdote of being apprehended by a german solider or agent and pretending her wireless antenna was a clothesline ‘will you be a good lovey and help me get my washing line attached, good lad’
“I could give more details of the “missing in action” SOE wireless operators,”
many brave english women performed this role, some captured yet survived the war. some great biographies although details escape me presently
Greetings to all from Cape Town South Africa
kaninchen • July 29, 2016 5:37 PM
Mostly harmless cartoon on wretapping, not accepted for publication:
Jist Curious • July 29, 2016 5:39 PM
Anybody know the going rate on a pint of Keith Richard’s blood? Seems to me, the first step in the best way to keep Clive around is a transfusion that will make him immortal.
Seriously, Clive, you are a treasure.
@Crypto Advice,
No, but that’s kind’ve a question I have for Clive about salt water/oil negating sound/thermal and EM. W/E though I’m probably one of those crazies.
Minus one thing, I just woke up from my nap and all 5 of my xfinity nodes are MIA.
You wouldn’t be able to store a phone directly in salt water, it would corrode the cheap protections (they’re only rated for a short time under small pressures). I don’t see why you couldn’t keep it sealed in a couple ziplocks in an aquarium though. The water proof aspect is more for emergency’s, it’s kind’ve a robust vehicular tracking system.
@All,
I’ve been waiting for the new squid to post this, it’s kind’ve preaching to the quior but ah well:
http://www.csoonline.com/article/3091847/it-careers/so-you-want-to-be-a-security-researcher.html
Words of encouragement.
Did I forget to mention police too?
Long live the Clive • July 29, 2016 6:51 PM
@Clive
In addition to @Another Clive Fan’s sentiments I’ll add…
I’ve learned much from you, the conversations you inspire, and those to which you reply. You regularly lead me to where I can learn more (even if only by mentioning the significance of a topic I would have otherwise overlooked). Not to mention all the interesting anecdotal/peripheral stories you provide.
I for one, don’t take you for granted. Know that if you were gone, I’d very much feel the lack. As I’m sure many would.
So, I would very much appreciate it if you not die before me.
Thanks in advance.
Dan3264 • July 29, 2016 7:23 PM
@Another Clive Fan,
That would be a nice idea. If anyone actually tries something like that they should think about the security of that scheme. Anyone can claim to be anyone else in these discussions. I could pretend to be Clive Robinson right now if I wanted to, and It would be undetectable(except by Clive Robinson, but then there is the issue of who to trust). There is simply no way any of the non_moderator/non_Bruce_Schneier people here can tell if someone is the person they are claiming to be(without any previous shared secret(or shared non-secret, such as a public)). Bruce Schneier and the moderator might not even be able to tell one person claiming to be Clive Robinson from another person claiming to be Clive Robinson(it depends on the kind of server logs kept, and whether or not anonymizing tools are used by the person in question). I, for instance, do not have any shared secrets with anyone here. Thus, you have no proof that the person who made this comment made any previous comments here. It is pretty unlikely that someone would try to impersonate me but, if someone really wants to, they can do so. Having a fundraiser for Clive Robinson would raise the incentives for someone to try to impersonate Clive Robinson. That is just something to keep in mind. I hope my response doesn’t get in the way of any potential gifts to Clive Robinson.
David • July 29, 2016 7:46 PM
Glad I won’t be around when this method of hacking is perfected by those off budget programs that will show their results to the world in ways that will be incomprehensible to civilian hospitals and unknowing experimental human trial victims.
http://www.techworm.net/2016/04/scientists-write-code-hack-living-cells.html
Note, the good is accentuated here.
anony • July 29, 2016 8:15 PM
2 factor auth not secure
http://thehackernews.com/2016/07/two-factor-authentication.html
Dan3264 • July 29, 2016 8:16 PM
@Long live the Clive, @all,
I have the same feelings for Clive Robinson. Clive Robinson is one of the people on this blog I respect the most. Other important peers include Nick P and Thoth (Wael, r and ianf are pretty high on that list too. There are very many people on this blog. I can’t list everyone. If I didn’t mention you, I still probably think you are above me, just not way above me.). Bruce Schneier deserves a mention too, though I consider him to be way above me. I think it has something to do with this being his blog. Thank you all. I am a relative newcomer to this community. It is great to know(well, be in contact with) people who care about security(and who like math and technology). Especially Bruce Schneier,Clive Robinson, Nick P and Thoth, who I hope to be like someday(I am rather young. I won’t say my actual age, but I am pretty sure I am one of the youngest people here). This is a great community to be a part of. I will be following this blog and contributing(from time to time) for a long time.
Scott "SFITCS" Ferguson • July 29, 2016 8:22 PM
There is simply no way any of the non_moderator/non_Bruce_Schneier people here can tell if someone is the person they are claiming to be(without any previous shared secret(or shared non-secret, such as a public)).
Even the site admin would be unable to confirm a post comes from Clive as he posts from a dynamic address (Blackberry phone?). Perhaps if this plugin was updated and included in the site (which AFAIK is Moveable Type)?
I do not think you have thought through how publishing internal emails of political parties during an election campaign would help democracy. It wouldn’t.
Without supplying an argument to support your opinion – it seems an ironic statement. Surely Nick was proposing transparency… are you seriously suggesting that wouldn’t “help” the democratic process? (i.e. form the basis for an informed decision).
<snipped forum-flooding sophomoric spray>Does that my agreement with your stance satisfy you, or are there any boots anywhere I could spit-lick-polish in penance?
Word count is no substitute for quality. If you can’t make a constructive post, please keep it sensible. The only one “making a fuss” or “trying to make” anyone “agree to something”, is you.
P.S. try giving Caps Lock a rest, it can lead to the wrong impression.
@Scott Ferguson,
“Even the site admin would be unable to confirm a post comes from Clive as he posts from a dynamic address (Blackberry phone?).”
Was that an assertion or speculation? That only comment I’ve seen him make about the location of his posting habits was his reference to switching public transport systems the other day. Be careful if you’re disclosing any near-omnipotenence.
@Scott Ferguson,
You may want to drop the whole “SFITCS” thing, it leaves a slime trail.
From the linux foundation on the topic of UEFI:
Scott “SFITCS” Ferguson
9 February 2013 at 03:00Great stuff!
Many thanks for your work and I look forward to using it with a portable Debian utility over the coming weeks (as time permits).
I know a lot of people are opposed to the idea of UEFI – I strongly support it, my only misgivings (strong concerns) are about the “vendors” role. Kudos to those concerned for getting the keysigning sorted.
eg. You’re A-OK with corporate entities holding the keys to your empire, you sir – I do not trust.
Dan3264 • July 29, 2016 8:48 PM
@Scott “SFITCS” Ferguson,
Look at the next sentance of that post.
Bruce Schneier and the moderator might not even be able to tell one person claiming to be Clive Robinson from another person claiming to be Clive Robinson(it depends on the kind of server logs kept, and whether or not anonymizing tools are used by the person in question).
Bat-boy impregnates Wasserman-Schultz • July 29, 2016 9:12 PM
Foreigners scratching their heads over Schneier saying stuff he’s not nearly stupid enough to say.
If I didn’t know better I would suspect this is like that old running clickbait-headline goof only the whole article’s a clickhole.
MrC • July 29, 2016 10:22 PM
Re: Distinguishing the real Clive:
Clive’s writing style could probably be faked, but it would be nigh impossible for an imposter to produce posts containing the same depth and breadth of rare and specialized knowledge… or the same crimes against proper spelling. (I jest!) I’m pretty sure the regulars around here would spot an imposter pretty quickly.
Wael • July 29, 2016 10:42 PM
@Another Clive Fan,
would be the point at which we pass around the hat to collect the baht, rand, pesos, rupees and other assorted currencies for which to donate to Clive as a support – or use ourselves to buy him a special gift / health retreat / ticket to a Rolling Stones concert etc.
Great idea! I’m in for that. This blog won’t be the same without him!
Wael • July 29, 2016 10:53 PM
@Dan3264,
Bruce Schneier deserves a mention too, though I consider him to be way above me.
Mr. Schneier [is] sitting in a blimp up their watching the castles around the world, and giving them advise, and sometimes enjoying movies at “Security Theaters” near you ☺. Would be nice to see more frequent yellow boxes from @Bruce, busy as he is, just to show he’s connected.
Wael • July 29, 2016 11:11 PM
I corrected someone in the past regarding the use of “advise” as a noun. Seems I made the same mistake in the past…
Curious • July 30, 2016 1:52 AM
@Another Clive Fan
Whoever goes for being Clive Robinson I think seem like a knowledgeable guy and I usually find it interesting.
Curious • July 30, 2016 1:57 AM
A blogger seems to be pointing out that ‘WhatsApp’ doesn’t truly delete its content, and if I understood it correctly, instead have the content being left to be overwritten with other data again, similar to how Windows deletes its files I think.
WhatsApp is afaik a cross platform mobile messaging ‘app’.
WhatsApp Forensic Artifacts: Chats Aren’t Being Deleted”
http://www.zdziarski.com/blog/?p=6143
The core issue here is that ephemeral communication is not ephemeral on disk.
@Dan3264
Thanks for the shout out. I am pretty young too and as usual, no need to reveal age or PIIs.
@Clive Robinson
If you are still alive, just a note that I am already working on your fleet broadcast theory and putting meat and flesh to your ideas.
@Anura
If our mathematician is around, maybe you can take a look at the preliminary key exchange I designed for the fleet broadcast recently after giving it some thoughts for a long while.
The idea of my take on @Clive Robinson’s fleet broadcast is to use a P2P network via DHT (i.e Kademlia/Bittorrent) as the most practical manner over Ethernet. Assuming that the DHT stores key-value pairs, users would generate their Session IDs as per my paper’s deacription and use their unique SID as the key and their current IP as he value on the DHT.
Another separate DHT or cache can be maintained which is a user’s root ID public key without any connection to the SID and IP address DHT table.
The key exchange would follow my paper’s formula and once a derived session shared secret is negotiated, encrypted communication over fleet broadcast can take place. The key exchange protocol I specified in my paper can be done via 1-1, broadcast or relay between peers with broadcast or in a more accurate sense, multicast, being more secure if used with delayed store-and-forward outboxes alliwing harder attribution of messages to a source.
My personal website uses a self-signed cert so it would almost likely show you the red TLS lock symbol with tonnes of useless warnings.
ianf • July 30, 2016 4:32 AM
- I am constantly running behind with threads within topics and/or vice/versa that I’d like to, even begun writing a comment for, but found no time @ the time to finish. So here comes, a LIFO ragbag of shrt cmnts to current topics, even though FIFO reply order would have been more appropriate.
@ Love Bubble asks Nick P:
“do you know [detective] Saga Noren Malmö Police”
She’s a figment of a screenwriter’s sick imagination, wouldn’t last past basic Police Academy intro, let alone make it above a WPC level. Her character, in terms of DSM V-classified afflictions an escalation over merely once-former-ward-of-social-services-now-detective Sarah Lund, is apparently supposed to show us the human, caring side of the Scandinavian societies, their promotion of way-beyond-borderline autistics IRL. I bet they do. You, however, shouldn’t be swallowing such tripe wholesale—though, I presume, mailing from South Africa, your digestive tract is all upside down already.
@ Jist Curious
proposes we arrange a transfusion of “0.568 litre of Keith Richard’s blood[*]… the first step to keep Clive Robinson immortal.” METRIC PEOPLE, METRIC
Whatever made you think Clive’s organism would be strong enough to survive intravenomous contact with any of Keith Richard’s fluids? I can tell you blindfolded, that if KR wanted to—say—donate his to a blood bank in some GOOD CAUSE, it would beg him off & off the premises under escort, on sight alone. Next Clive-life-extension idea please.
[^*] that’s >10% of all KR’s blood!
@ Wael & rrrrrrrr
Listen, we need to gang up on that whippersnapper Dan3264 guy, teach him a lesson he’ll never forget – just who does he think we are, chopped liver? (halal or otherwise). A second-tier of also-runs? Time to gloves-off, told you before.
@ Scott “HTXIPV” Ferguson
[…] “Try giving Caps Lock a rest, it can lead to the wrong impression.”
Only 2 all-caps words in my last, NOW and USA, the first a graphic embellishment. Previous posting also 2 all-caps: AUDACITY and HOPELESSNESS – obviously a sarcasm. In between deflecting light from verdict of anal-retentiveness, you must be confusing me with someone else.
Re: @ Wael’s
public mea-culpa, mea-culpa, for lexical errors of the past: corrected someone else for abuse of “advise” as a noun, but did the same himself.
Just blame it, IF AT ALL, on auto-compleat conflagrations between OED (UK) and Webster’s (USA) English dictionaries, as I do. Just look at what Clive gets away with, and Nobody’s Girl Friday The Sequel complaints.
[end of shrt cmnts]
Wael • July 30, 2016 5:37 AM
@ianf,
Next Clive-life-extension idea please.
When your time comes, it comes. Whatever hit you was not to miss you, and whatever missed you was not to hit you. Mull on that a bit.
Listen, we need to gang up on that …
Where is my little violin, I need to play another sob tune 🙂
Just blame it, IF AT ALL, on auto-compleat conflagrations
Seems @Clive Robinson’s spelling curse hit you!
Drone • July 30, 2016 5:49 AM
Democratic Party’s Congressional Fundraising Committee was also hacked…
First it was Hillary Clinton’s illegal server use, then Hillary “lost” 30,000+ Emails, then Emails are taken from the DNC and passed to Wikileaks, and now the Democratic Congressional Campaign Committee’S (DCCC) web site is hacked. It seems visitors to the DCCC’s hacked site (including donors) were being redirected to a seemingly identical site.
What is it with Democratic Party Politicians and technology anyway?
ianf • July 30, 2016 6:35 AM
OT : Life Imitating Art Imitating Life
US police are using Pokémon Go to lure criminals to their stations
- Virginia’s Smithfield PD invited eight ‘random citizens’ to catch super-rare Ditto in their processing room, after New Hampshire police employed same tactic. http://gu.com/p/4p9dd
Ergo Sum • July 30, 2016 7:24 AM
Another hack of the democrats, another boogie-man story:
Quote:
<
blockquote>The sources said the Internet Protocol address of the spurious site resembled one used by Russian government-linked hackers suspected in the breach of the DNC
<
blockquote>
Yes, the IPv4 address was in the xxx.xxx.xxx.xxx format, strikingly resembling the IP address of another breach at the DNC.
rob • July 30, 2016 7:41 AM
I’ve seen a lot of debates, articles, analyses about Signal, Whatsapp and Telegram, but not about Wire.
Fellow security specialists, let’s talk about it.
It solves few major problems that the previous messengers have, it doesn’t require a phone nor an address book to work, it has normal desktop application (no routing), it’s always encrypted, it also allows for video calls. It recently went open source, so I think it’s the right time for a discussion. I wish some experts would analyze the code in search for problems such as those found in Whatsapp by Zdziarski recently or check what metadata is still left (even though the phone and address book are not required).
@rob,
Well, on the [week of July 24th 2016] topic of ‘steering’ debate:
https://www.schneier.com/blog/archives/2016/06/comparing_messa.html#c6727330
(Thank you Rover for the synopsis)
@Rover, rover and rob
I think there were other mentions of wire in a less endearing sense too, but I’m not running personal RSS based backups on all you guys over here. So my apologies for an inability to put my finger on the steering wheel I’m alluding to.
@All,
I still can’t believe my nfinity’s got x86’d did someone report me for getting all excited over speculative execution?
Jist Curious • July 30, 2016 9:49 AM
@ianf
Thank you for saving me from that terrible gaffe. The next time I’m in a British pub, I’ll be sure to say “Gimme 0.568 litres of that warm carbonated horse piss, mate! I’ve got kilometers to go before I sleep.” 😉
Thoth • July 30, 2016 10:01 AM
@rob
Since you have requested for a quick look into the security of Wire Swiss app, I do give it a quick look and here are some stuff of my opinion.
Before we begin, pick up the Security Whitepaper and the Privacy Whitepaper in the links below.
Ok, let’s run through the Security Whitepaper …
Page 5. Generation of the Cid via hash (klr) where klr is the last resort prekey. The chances of producing the same Curve25519 key is very very slim but just to be on the assured side, I would prefer that an sequential integer of the clients a user assigns and the user’s email or username be hashed together as well where
CurrentClientInt ∈ {0, 8}.
Cid <— Hash(Email | CurrentClientInt | Klr)
This makes it more robust against duplicate Klr if such a thing ever exist (who knows the probability due to weak randomness in certain devices).
Page 11. Files and assets are stored on end point disk in plaintext. That seems like a partial E2EE as E2EE means that not only are the transmissions encrypted, the arrived and stored forms should be encrypted as per the traditional meaning of E2EE. For users who diligently use Full-Disk Encryption, they should be fine but for lazy users who don’t use FDE, it gives an open window for adversaries into files and assets. Who knows what valuable information might be in the files and assets. This is not a security break yet. It’s severity should be considered as moderate.
No source codes have been revealed but if they implement what they have said in the whitepaper, it should be secure against network threats until an adversary gains physical access and starts looking for the keys on the client devices’ memories.
One thing I wonder is what if the prekeys are quietly swapped on the server. They need to be clear if there is certain signing procedures to ensure the prekeys are not tampered with on the server.
From the Privacy Whitepaper …
Page 5. Crash reports are sent to third party site called HockeyApp and usage data are sent to Localytics. They do better make sure the crash reports are not holding anything sensitive and same for the usage data. I have not viewed the source codes so I cannot tell if that’s the case.
And for the fact, the version on App Stores’ executables can be different from hand compiled binaries from sources and more phones are making sideloading off applications harder and trying to divert as many application installation through official App Stores (thus hiding the true nature of the downloaded App Stores app and makes comparing the open source binaries and the App Store binary even harder).
Also note that the official website for Wire Swiss does not make it easy to find the Github repository for it’s open source codes.
Conclusions …
Excluding code review, if everything works as the papers said, it should be mostly fine. But due to smartphones being inherently insecure devices and the fact that App Stores are becoming the de facto for getting applications and phone makers and providers are frowning upon and making side loading harder, it is better to use a dedicated external encryption device like a portable HSM or secure hardware encryptor which by no means are they easy to obtain and develop. Whether you trust the binary versions downloaded from the App Store is up to you to decide. If side loading hand compiled binaries are allowed, those are more preferred choices.
Links:
– https://wire.com/resource/Wire%20Security%20Whitepaper/download/
– https://wire.com/resource/Wire%20Privacy%20Whitepaper/download/
Thoth • July 30, 2016 10:02 AM
@rob
Allowed HTML filtering engine in the blog post blocked a portion of my words …
CurrentClientInt ∈ {0, 8}.
Cid = Hash(Email | CurrentClientInt | Klr)
Russia hacked Saddam's WMD • July 30, 2016 10:07 AM
NATO sneak attack on Russia (the US rationale for nuking the Japanese was that Pearl Harbor was a sneak attack in international law):
http://de.sputniknews.com/politik/20160729/311815695/nato-abschuss-russischer-kampfjet.html
This is the background for anybody who wants to bloviate about confronting cyber mumblemumble against American Democracy – illegal US undeclared war.
CallMeLateForSupper • July 30, 2016 10:33 AM
@Wael
Nothing wrong with the spelling “compleat”. It is an example of trap-for-non-Brits spelling, like “programme” (which I delight in pronouncing “program-me”).
Why Encrypting at all? (small intro-vid)
Wael • July 30, 2016 1:50 PM
@Mike Barno, @CallMeLateForSupper, (@vas pup)
For what this source is worth, Wiktionary lists “compleat” as an archaic spelling…
Silly me, I thought it was misspelled. Archaic, eh? As in ancient, right? I should’ve headed Hanlon’s razor: “Never attribute to misspelling that which is adequately explained by eldership.”
So that’s understandable, coming from @Clive Robinson! What’s your excuse, @ianf? You haven’t attained this seniority level yet. Leaves us with one option! Are you malicious, punk?
Markus Ottela • July 30, 2016 2:56 PM
@Crypto Advice
“you didn’t think of Proton Mail?”
I’m not familiar with the details of Protonmail. The main problem here is the code that handles encryption, passwords etc. is downloaded from network during every session. It might be possible that someone with power to perform a man-in-the-middle attack against TLS, could inject malicious version of Protonmail’s software that then leaks keys/passwords etc. MITM attack can also happen when you download a native client, but in those cases the client is often signed with PGP. The window of opportunity for MITM attack is also much lower if the client is only downloaded once.
Protonmail isn’t horrible in terms of implementation of PGP, but as there is no deniable authentication or forward secrecy, instant messaging tools are the way to go.
GPG reminds me of Git. If you don’t use it daily in your profession, you tend to forget the commands. Also it’s never a pleasure to use. But you can also run something like Thunderbird + Enigmail that makes PGP easy to use.
The beauty of native clients like GPG is, it can as Matthew Green suggests, be run on airgapped system or, as I’m advocating, in split-TCB-behind-datadiodes (needs a more catchy name).
@Nick P, Thoth et. al.
This reminds me, discussing the security properties of systems could benefit from common jargon. I’ve been writing design rationale for TFC and I’ve come up with some including ‘clean’ that means ‘not infected but not exploit proof’. Describing RxM’s state, something like ‘contained’ could be used (infected but without additional risks).
Clean TxM remains secure as long as it doesn’t output keys on it’s own due to bug, (I’m currently calling the risk ‘eventual erratic behaviour’). All these terms should be clear to everyone, but I definitely don’t want to re-invent the wheel as it would not only confuse people, but be unprofessional and look like marketing (talk about Advanced Evasion Techniques(tm)). I’d love to know if there already exists terms for these or any others that need describing, and if not, come up with the ones that make the discussion and further designing more fluid.
Also, I’ve gone through a huge pile of notes and next up is our discussions here. I’ll try to answer any questions I’ve missed and continue the past conversations.
Wael • July 30, 2016 3:02 PM
@Mike Barno,
it tells me that the writer or editor used a commercial spellcheck function and no brain.
Manual proofreading requires a trained eye. I linked to this startling research in the past. The current deficiency with spell checkers is lack of context evaluations. Better AI would help. Spell checkers got me embarrassed (spell-checker suggested: embraced) more than once.
For code reviews, manual and automated reviews are required as well, imho.
Jist Curious • July 30, 2016 4:28 PM
Spellcheckers: They’re like fat-scooters for your mind. Then again, considering that the vast bulk of the internet is rapidly acquiring the unmistakable ambiance of an Arkansas Walmart…..
yoshii • July 30, 2016 4:35 PM
I am occasionally getting censored from this site, verified by when I come back to read what I’ve written and any responses or other unrelated info that came after.
Usually it happens whenever I mention anything about the threat of NUCLEAR WEAPONS as pertains to security issues. If this is really too hot to handle, somebody needs to make it clear in the terms of this site.
Because I am mixing normal everyday civilian concern with regular everyday site discussion on security issues.
If you don’t think survival is a security issue, maybe your priorities are a bit off. Not talking to anybody in particular, though.
Please let me know by email or just an open letter to this community of readers or whatnot.
Censorship without any context doesn’t look very professional and I am not here to troll nor heckle nor create technical nor sociological problems. There are some valid links between electronic security and military security as well as geopolitical relations exaccerbated by the types of issues discussed here occasionally.
Bruce, or whatother admin, or mod, I read Liars and OutLiars and found it informative. I read it because I believe trustworthiness is culturally valuable–not to get into cryptography secrets or whatnot.
Censorship is often a reflection of a situation where trust has been devalued or discarded. But not always, of course. But I do not engage in profanity nor character attacks nor other types of provocation.
Facts matter, even if, and especially even if the facts make us uncomfortable.
If you can’t talk about a threat because it makes you emotionally uncomfortable, that certainly doesn’t enhance security and in fact weakens it.
If we can’t discuss threats here because of that same emotional insecurity, and instead censor ourselves or each other, then likewise, the technical security is weakened.
I take these topics seriously, and I have emotionally desensitized myself enough to try to be a problem solver enhancer rather than just a noise-maker or beligerent person or a rabble-rouser.
Please take these ideas and consider what I wrote at face value.
I am being honest and direct.
Peace be with anybody and everyone reading this.
@Jist Curious,
“Spellcheckers: They’re like fat-scooters for your mind.”
Certain implementations are also capable of reading one’s unposted thoughts, not that I avoid posting my “type 1” ramblings anyway. I prefer honesty over reservation slight and contempt though.
Another_Clive_fan • July 30, 2016 5:01 PM
@Thoth
“If you are still alive, just a note that I am already” …
I have an old relative who I often address: “Are you still alive”? Instead of good day, how are you, or the like. Perhaps shout-outs to Clive could be like you stated or formatted like:
@Clive
Are you still alive?
…
(I’m not saying that Clive is old, however.)
@All
Krebs on Security and ATM machines:
https://krebsonsecurity.com/2016/07/would-you-use-this-atm/#more-35622
“It’s like the running of the bulls, but with FBI agents”. From Snowden’s twitter feed
regarding the Office of the DNI and National Whistleblower Appreciation Day.
https://twitter.com/snowden
@Markus Ottela
You could show us what you have written so that we can help you.
@Another_Clive_fan
I was in a networking mood due to me just finish writing the paper. Thinking of ICMP PING @Clive Robinson via that greeting since it’s hard to tell when he do respond.
Nick P • July 30, 2016 6:59 PM
@ Love Bubble
Appreciate the comment. I try to do something different with my writing. Interesting also to watch the effects of it throughout the day on Hacker News (nickpsecurity) with the vote mobs. They’re often quite conflicted when I get extra real although usually some positive response. Far as the learning, I was doing more a recommendation for the other person than how I learned. I can trace a lot of how I learned things but it’s complicated & often environment-specific. I’d rather just, as I did, look at the good parts of where I arrived then create simpler method for others to get there finding their own path/preferences along the way.
“Combined with a fucked up world & social stuff driving it, I think we’re disadvantaged and continually challenged by it.”
Another savant that used to be here by name of “Tommy the Turtle” sent me this paper on gifted and effects in society. It was unexpected to most because the research on how well we do appears to be forged for advancement of those authors’ careers. The real results are quite mixed with mostly negative effects it seems. Bonus in the article is bringing story of Sidis to my attention. He was something else.
“[detective] Saga Noren Malmo Police”
Wasn’t familiar with it. Might check it out. Thanks!
yoshii • July 30, 2016 7:19 PM
My apologies about my previous post earlier today.
Turns out I was wrong about a recent post being censored. It did happen several months ago in 2016, but not this summer of 2016. So I apologize if I caused any undue tension about this. But I do stand by my word in terms of my philosphy about censorship in general in the world.
Peace be with everyone.
CarpetCat • July 30, 2016 7:28 PM
News for the Great Unwashed Masses: Deletin’ in the Digital Age:
https://www.yahoo.com/style/just-learned-something-nerve-racking-220811091.html
And more political, under the heading “Be carefull what you wish for:
http://cnsnews.com/blog/eric-scheiner/petition-remove-ac-state-dept-receives-over-33k-signatures
(Also, Clive’s fridge is orange. Or burnt sienna. It lingers near the edge of the kitchen proper)
🙂
@ Love Bubble • July 30, 2016 7:43 PM
@Thoth
” Whether you trust the binary versions downloaded from the App Store is up to you to decide. If side loading hand compiled binaries are allowed, those are more preferred choices. ”
thanks for your as ever pertinent, insightful and interesting commentary. Like many I used to have an instinctive distrust of google play and apple store, because, well, they are google and apple ‘who knows if the app matches what the developer gave them’
Moxie Marlinkspike disagrees with rooting phones, Cynanogen etc and sideloading APK’s he has a few comments in the thread . Be nice to now where he is at these days on the topic
https://github.com/WhisperSystems/Signal-Android/issues/127#issuecomment-13335689
@ r
RE: Clive using a dynamic IP and being omni omni omni
“Was that an assertion or speculation? That only comment I’ve seen him make about the location of his posting habits was his reference to switching public transport systems the other day. Be careful if you’re disclosing any near-omnipotenence.”
Your final sentence betrays the reality. As mentioned recently somewhere here, the film Transcendence is a factual representation of what Clive was working on and what transpired, but unlike the film set in the present, actual events transpired circa 80 years ago
@Nick P
thank you for the feedback and I look forward to the paper.
You may appreciate the bestseller David and Goliath by well regarded Malcolm Gladwell. This title is about adversity being instrumental in success.
It is rich with wisdom and brings hope to all of us who feel disadvantaged , off the top of my head one chapter details one of the most famous and successful lawyers in the world. He cannot read. It was that disability that was solely responsible for him succeeding as he was forced to listen extremely carefully,and remember everything he heard. Which puts him ahead of, uh, every other lawyer..
&
Stay away from any but the original Swedish-Danish versions of
The Bridge.
although there is talk of an Estonian / Russian, and North South Korean versions on their way – who can say
@ianf
I am sorry . For everything. I don’t know the nature or manner of my transgressions, so far, but consider this an apology in advance
@ All
So! Is someone hinky enough to think up an infallible electronic fundraiser mechanism for @ Clive the Indomitable ?
Nick P • July 30, 2016 7:57 PM
especially @ furloin, “Dumber Than”
Limited time this week. Still put this together really quickly. Tried, but failed, to find the reply I did to Wael where he asked for a framework of security & I divided all the efforts into a few categories. Would help here. So, have to re-create it from scratch.
There are a few categories in alternative CPU designs that came in this order:
- Tagged architectures
- Capability architectures
- Language-specific architectures
- Isolation-oriented architectures
-
Crypto-oriented architectures
-
Reconfigurable & mixed hard/softblock architectures
Tagged was the first. Tags words in memory to essentially give them a type with certain opertations or restrictions expected. Actually, Bob Barton et al’s B5000 at Burroughs was actually a combo of 1, 3, and 4. Architecture here. It started with the ALGOL language for safer, high-level programming. Then, iterated a combo of CPU, OS, and compiler that was ideal for it. Hardware included bounds-checks, stack protection, pointer protection, virtual memory, process isolation, and argument checks during function calls at CPU level. Last part was overkill in performance hit, esp for 1961. 🙂 Yet, most of that brilliant work could be copied today matched with a language like C#, Java, Go, Oberon, and so on. Modern examples include SAFE (see “A clean slate…”), Loki, ZKOS, and DIFT-based Raksha.
Capability architectures follow capability-security model that controls access by whether you possess a token of sorts. Often a pointer. KeyKOS, EROS, and E language were software examples. The hardware examples are best illustrated by Levy’s book. Focus on System/38 (later AS/400) and Intel i432. Intel’s i960 vastly simplified things with manual being impressive & worth duplication to a degree. Best, modern effort in capability model is CHERI project which already runs FreeBSD.
Language-specific model starts with safe or secure language semantics that provably eliminate many problems. Ada language plus SPARK extension illustrate this well. Then, the language model gets implemented in hardware. This model eliminates attacks or issues that come from mismatch between high-level code developer sees and low-level assembly that executes. Earliest ones, the LISP machines and B5000, also did it for performance or flexibility where HW is fine-tuned for the language’s style of execution. LISP machines also introduced HW support for garbage-collection as well where it runs concurrently with rest of system. One put it right in memory subsystem of processor invisible to apps themselves: just issue delete/free command. Example Scheme CPU with highly-assured derivation via DDD tool.
Moore’s Forth CPU’s reinvented stack processors in terms of performance per gate & language flexibility. CPUs specific to Standard ML subset and Prolog were created. In high-assurance, researchers attempted to merge tagged CPU’s with high-security runtimes for Ada via Secure Ada Target (SAT). Failed due to immaturity of formal methods. Later, Java popularity & increased safety led to both enterprise and embedded designs for it with one, high-assurance product. SAFE will use functional language but I think Oberon, Ada, & Go could run on it.
Isolation-oriented architecture does exactly that: full isolation of partitions from each other. This model is a precursor to some others. The best examples are MLS and MILS models. MLS was the security policy for the U.S. military. Security kernels like GEMSOS and CPU’s like HWMAC implemented it for high-security in original, certified systems. The MILS model was a simplification that had simple kernels (eg INTEGRITY-178B, seL4) for isolation plus middleware to enforce security of interactions between components. MILS was also implemented at CPU level. Most common use of this is virtualization in industries like cloud market but they rarely use high-security versions. Tons of hypervisor and CPU designs aiming for reduced TCB. Keywords for search are combining “secure,” “hypervisor” “modification,” “TCB” together and/or with other words.
Crypto-oriented architectures try to achieve security by adding crypto to the processor. They might encrypt RAM, storage, bus lines, whatever. Same with integrity checks or authentication. Earlier use gave different processes or trusted components different keys so violating their memory spaces would show them gibberish. Aegis was first I saw. Later designs like SP-Bastion extended into hypervisor model like MILS. Things have gotten more sophisticated since with this example aiming for full, software security.
Reconfigurable and mixed. FPGA’s showing up meant many functions could be accelerated or reconfigured. This has benefits for input validation, monitoring, translation, or even soft cores for high-security. More than one example above is done on FPGA. An extra benefit of FPGA’s is the security mechanisms can be modified constantly for obfuscation at cost of increased risk of them being countered via write ability. Antifuse FPGA’s are write-once, allowing this done once per unit without the risk. Mixed blocks involve combining general-purpose CPU’s with hardware accelerators. The security functionality can often go there without modifying performance-critical, proven blocks like processor pipeline.
Any of these might be implemented openly or improved on by those getting into hardware design. They may also be mixed and matched where the missing properties of one are covered by the properties of another. This can be done not just for security but especially reducing performance hits. An example might be combining a Burroughs-style separation of code/data, in-hardware checks on bounds/stacks, CHERI-style pointer checking + isolation, Rust borrow-checker for temporal security, and crypto model to make RAM untrusted. The combo covers a ton of risks with minimal impact on the main CPU outside pointer-checking. Bounds and stack checks can run in parallel with the pipeline. Borrow-checker costs nothing at HW level. And so on. Many possibilities if carefully borrowing techniques from various hardware & software projects.
@Love Bubble,
Moxie is rightly concerned with his target audience, look at what was going on:
https://www.eff.org/deeplinks/2012/05/fake-skype-encryption-tool-targeted-syrian-activists-promises-security-delivers
https://nakedsecurity.sophos.com/2012/05/29/spying-trojan-targets-iranian-web-surfers-dissidents/
http://arstechnica.com/information-technology/2015/02/syrian-rebels-lured-into-malware-honeypot-sites-through-sexy-online-chats/
When dissidents go underground, the malware follows them. I’m sure there’s other examples, but those are just what I could find offhand. It’s a hostile world, if you want to do risky things you’d better educate yourself as to the many varied and various hazards about.
Worse than mere malware is what the poisoning of the well insinuates, that there’s lurkers and earposts plotting and waiting for your footsteps to enter their playground or line of sight.
Moxie is rightly concerned for* his target audience, look at what is/was* going on:
@ Love Bubble
Moxie’s arguments are somewhat flawed. For the Signal fanbois, there ain’t no such thing as a secure chat if the encryptor lives on the same device as @Clive Robinson and me have mentioned for a long time. Consider your Signal or iMessage fully NSA-ed…
No dostribution of APKs doesn’t mean no one can compile the source or derive another version. Makes no sense. It only makes life harder for people trying to side load but does not fully prevent sideload attacks or cloned versions. He did note that thise who are capable of building the source are one step higher which probably means he recognise that one of the threat models include seone falsifying abd building a prebuily APK and distributing them in Moxie’s name. I rather he make signature checking easier to learn with a tool.
App scaning (a.k.a. automated full scale APT injection). That’s sarcasm but you get my meaning 🙂 ?
No crash reporting ? Even high assurance HSMs I worked with at least generate encrypted crash reports let a lone a low assurance low security chat app that does not exhibit higher assurance security except for crypto.
@Scott Ferguson, Love Bubble; and anyone else interested in Syria, Reporters, History, Action/Inaction, Hillary Clinton and potentially proper-gamma.
@r
“When dissidents go underground, the malware follows them. I’m sure there’s other examples, but those are just what I could find offhand. It’s a hostile world, if you want to do risky things you’d better educate yourself as to the many varied and various hazards about.
Worse than mere malware is what the poisoning of the well insinuates, that there’s lurkers and earposts plotting and waiting for your footsteps to enter their playground or line of sight.”
Thus, my push for hardware secured Secure Execution Environment in tamper resistant security chips (i.e. smart cards).
Oh … and not sure if you had the time to read my entire “short” post on smart cards you requested earlier. If you need more depths on the smart cards, do feel free to ask. Besides providing physical separation of the security critical codes and keys in a tamper resistant and even somewhat side-channel resistant cards, anyone can download the smart card applet, verify the codes, compile it by hand and then provision it onto their smart cards and optionally lock their smart cards to prevent anymore modification.
The tools to compile and load the cards are easily available. Downloading IDEs like Netbeans (full version) would automatically have the environment loaded and you just need to create a project and clone the repository and then “Clean and Build” the thing. To load it, all you need is GPPro tool and run the install command (command line for those who hate command lines) and you have a loaded smart card if you run the command line commands correctly (rather simple commands). The loading of the applet to the card requires a symmetric authentication (as mentioned in the previous post I wrote about smart cards) so the loading of applet process is almost fully in control by the card owner (unless you purchased cards that do not allow you to take over full control but delegate you with permissions).
Physical separation of critical codes and CSPs (keymats, PINs …etc..) onto a tamper resistant secure device is highly essential for security and OPSEC. Just like any other technology that are not well utilized, most new comers will feel intimidated and alienated (not many people to ask for help or trust that can be established) but once it becomes more mainstream, it becomes easier to approach.
AND…
http://www.reuters.com/article/us-russia-cyber-attacks-idUSKCN10A0F0
(the above cites abc & bbc)
@Thoth,
Believe me, I will be investigating said hardening measures shortly (good time to inderdict yo). As for my time? I have nothing but these days, my apologies for squandering it. (And being unjustifiably mean/rude/cruel (@Scott)).
Also, I was thrilled when you mentioned netbeans had javacard capabilities as the android-sdk contains it if you get the right version.
It’s a good reason to have the android-sdk (or a pentest/developers iso) and a great plate of deniability too.
By the way, has anyone else been wondering where all the non-us trolls disappeared to the last couple of days? 😉
@r
I think they have been taking holiday leave to travel overseas with their family and also scout for more helpers ? It’s the mid-year holiday month in my region (SEA) and there is always a crowd of foreign tourists everywhere I go. It’s just too crowded here in SG.
Figureitout • July 31, 2016 12:30 AM
@ Love Bubble
So! Is someone hinky enough to think up an infallible electronic fundraiser mechanism for @ Clive the Indomitable ?
–I wouldn’t be so bubbly about that…Too many threat vectors. Never know on this site, it’d be a fun hack/scam so I’d expect “physical verification” or the project is slightly jokey, which makes most security practictioners nervous (for good reason, but who’s to say they can even be trusted?) so you’ll have no one even remotely trustworthy to run the project.
All RE: Clive Robinson
–I feel as if just your words of appreciation here on the blog are enough “payment” as most anything involving money gets Clive pretty pissed from perhaps (a very blind guess) a lifetime of being taken advantage of (not paying a fair wage for value given).
Most especially “intelligent” jokes, occasionally kind of dirty :p, something that makes you think, he likes those.
Another thing is sound security designs which he hasn’t thought of, as would just about all estimated 250,000 readers, we appreciate analyzing or even able to use strong security-focused designs.
We are all forever indebted to his technical (and not so technical) contributions, but you have evidence of his humanity layed out in the archives and some of his sins (if you put 2 and 2 together). So he can, in very rare instances, “be defeated”. But that’s only in one small area, he’ll probably have at least another 5 unknown attacks to head your way that will “get the job done”. It sounds unbelievable but most of the attacks revealed by Snowden still don’t have any trustworthy defenses. So I’d encourage mostly kind words. :p
Also, be warned, the archives are pretty heavy reading and you have a lot of filtering to still do (for instance viagra spam which may have been removed by now, I figure Bruce/Moderator leave it as proof of the early 2000s or something, kinda hilarious joke but lots of signal/noise to filter out) and I decided to skip the years I wasn’t here and I have too much reading to do to read it all.
tyr • July 31, 2016 1:05 AM
@Love Bubble,
One trick to learning is to write that which you
want to remember down.
The reason it works is because engaging the physical
hardware of your body and the neural module doing
the learning (programming it) gives you the dual
reinforcement. You can read immense volumes with
little sense of memory because you haven’t engaged
the storage with a cross linkage for availability
later.
In addition use Feynmans trick, tag barely understood
conceptual constructs as apples and oranges, follow
the surrounding arguments looking for where an apple
suddenly turns into an orange.
Learn how to use instruments to detect the invisible
which your own senses cannot detect unaided. This is
how you open up the world around you closer to “real’.
Hang around with smart people, for all their faults
it will pay dividends in the span you discover.
@all
For the cyber challenged, all it takes is putting a
snail mail address here so there’s a physical place
to collect for Clive. Resilient has to have an office
space if Bruce is so enclined.
@Figureitout
He (@Clive Robinson) wouldn’t be pissed. He would simply ignore much of the case. He’s pretty much have hardened OPSEC as well noting that he once mentioned of methods of drawing cash from multiple ATMs and not to do online banking and such. The likelihood of reaching him is extremely slim so that would likely mean the funds raise might bot be all too useful or maybe it could be fonated for a good cause to an organisation of @Clive Robinson’s choosing.
Grauhut • July 31, 2016 6:19 AM
The Xtunnel tool used in DNCHack is a magic time jumper! 🙂
A “new, specifically ‘designed for DNC’ tunneling program, that uses an old, ‘well known’ tunneling server”.
“The XTunnel malware that was used by Russian APT threat actor Fancy Bear to penetrate the Democrat National Committee (DNC) network was specifically designed to work against this target, Invincea researchers say.”
securityweek.com/xtunnel-malware-specifically-built-dnc-hack-report
“They then linked this deceptive domain to a long-known APT 28 so-called X-Tunnel command-and-control IP address, 45.32.129[.]185.”
motherboard.vice.com/read/all-signs-point-to-russia-being-behind-the-dnc-hack
This hole bloated DNC hack story begins to look like the remake of some urban hacker myth blown up to a horror c-movie script! 🙂
ianf • July 31, 2016 7:48 AM
Regarding the autocompleathread.
Gosh, Wael and assorted… pups, why are you so thick all of a sudden. In the spirit of public service, I suggest to you to blame any “misspellings” on lexical conflicts between Anglo dictionaries during keyboard input, then attempt to illustrate it in kind by a s.i.m.u.l.a.t.e.d. t.y.p.i.c.a.l, only here NOT subsequently manually corrected, auto-completed word sequence (the “Girl Friday” should have been a dead giveaway of tongue-in-cheek, only it appears you’re not into that sort of elevated intellectual leisure, preferring, perhaps, Grand Theft Auto or similar simpleminded WWIII FPS to mine).
Collectively you ought to know better by now, than think me not in full control over what I post. Instead, you go on off tangent trying to outbid one another… what is this, a Schpelling Bee Across The Atlantic?
ianf • July 31, 2016 7:56 AM
@ tyr‘s recommendation
to Love Bubble of
One trick to learning is to write that which you want to remember down.
Never mind his (otherwise sound) explanations, this, the off-hand recording of insights, is THE ONLY WAY to memorize knowledge long term. Before there was science, before there were theories of educacation, the learned men and women knew that the way to attain clarity was to confront oneself with what one has thought in the near to forgotten past. Of that arose the idea of maintaining commonplace books, a hybrid of a diary, and a destination for impromptu thoughts and reflections; a stepping stone to, and quotes source for later memoir/ essay writing, etc. When newsprint became ubiquitous in the middle of XIXth century, these commonplace volumes oftentimes became what now are known as Victorian scrapbooks, with cut out pictures, notices, news stories, that now look so endearing to us (I have a couple facsimile reprints of such).
My father used to admonish the young me to write things down, but, as he did not lead by example, I never did, and now am sorry (that also tells me that I am not a born writer, as all writers seem to have had this need to record their thoughts from an early age, and many survived essentially by putting their sick thoughts up to light). Instead, in time, I looked upon local email archives, etc., as a form of such “commonplace” records, only to now sadly realize that I’m sitting with drawers full of diskettes and HDs that I’ll NEVER EVER be able to regain content from, much less find time to arrange later in anywhere coherent order. In that sense, this indexed, eternal blog is a there’s-no-godsend.
- So listen to tyr, and start writing things down! [Thank us later in the preface to your upcoming memoirs.]
@ianf,
Don’t feel too bad, you’re not the only one who’s lost data. We can move on though, and programming is an extension of the “commonplace books” for thoughts. But, I come from a long line of hobbiest writers, I’m not sure I can help dumping incoherence onto paper or whiteboards.
@all,
https://linux.slashdot.org/story/16/07/31/0017225/onion-debian-services-are-now-available
It’s a start. 🙂
ianf • July 31, 2016 8:29 AM
- I apologize for the 3.3k length; saison du concombre is upon us.
Pursuant to your advance(d) apology, I hasten to assure you that you did not offend me, nor transgress anything, save, perhaps, for dumping a shitload of naïveté disguised as TV-fare recommendation.
Because, frankly, I can not see how anybody could treat such a theatrical production as that Bron/Brœn[*] with its initial premise of discovery of a corpse surreptitiously placed in the middle of the Øresund Bridge, as anything as a adolescent fable.
This is as synthetic a weave as they come:
- (1) body lies smack across the border line – hence both countries’ police HAVE TO be involved, because they COULD NEVER GIVE UP an iota of legal jurisdiction [IRL they’d try to palm off the investigation on one another, just as in season 2 of “The Wire” detective McNulty succeeded in dumping the 14 unsolved suffocated bodies on his old department].
(2) body SURREPTITIOUSLY placed there AFTER first the lights (but not CCTV surveillance) were switched off. Then the car that briefly delivered the payload exited without a trace back to Copenhagen [IRL one of the more closely guarded AND reserve-powered/ maintained infrastructure objects on Earth, right up/down there with The Chunnel – both are made up of above ground, and below sea components. The car registration ## would have been known, and it stopped before it exited the tunnel. Frankly, the only somewhat practical way to escape such a caper would be to rappel down to the water, and swim away with long-range scuba gear (with replacement extra air tubes in prearranged places), if that].
(3) corpse composed of otherwise unrelated one male and one female part. That’s equal murder gender opportunity at its best, and oh-so-PC! Must’ve been drained of all blood, else it’d leave quite a mess behind, can’t have that even on primetime TV.
(4) the two police forces shotgun coöperation requires that the chosen investigators be at extreme ends of their respective ranges. Thus we end up with soon to be Nick P’s silver screen love interest Asperger-syndromic Swedish Saga (also means “fable”) beginning her collaboration with a Danish bear of a cop by reporting him upstairs for dereliction of duties or something (no joke, and she’s proud of it). I told you, even had she memorized the entire set of law books, she wouldn’t have lasted the intro course, as no police force anywhere tolerates overt disloyalty to its perceived siege mentality—and she was born that way.
(5) the British remake The Tunnel had the mutilated corpse placed you already know where. Otherwise a carbon copy of the (novel in TV terms) wacko behavioral patterns, with the borderline autistic investigator part courteously offered to a Frenchwoman. I once heard a feminist commend some other TV series solely due to “absence of artfully arranged dead women in it.” By that standard, both Bridge versions are but artificial exploititillation.
[^*] being a joint Danish-Swedish project, they could but name it Bron/Brœn, just as that once expression of Anglo-French concord was named Concorde, to make the Frogs joyeux.
@ BTW,
why are you trying to reward(?), honor(?), embarrass(?) Clive Robinson by attempting to express your puppy-love’y (grrrrr)atitude in monetary terms?
Figureitout • July 31, 2016 10:31 AM
Thoth
–Yeah he may just ignore. Also I think, for the banking, he just moves some smaller amount in person not via ATM, at the bank, that wouldn’t be catastrophic if the account got drained, into a debit account he can use w/ a card. We rely on savings in bank accounts up to a certain amount to be insured from loss/theft.
albert • July 31, 2016 11:56 AM
@Damn you, Nick P. 🙂
Do you realize the amount of reading and study you put me through with that last comment?
Seriously, thanks!
Speaking of Burroughs, my last great mentor was a Burroughs man. He always called them “real computers”, even compared to the DEC VAX* we used at the time, not to mention DOS:) It’s a term that still applies today.
- The VAX came ready to roll. You had an assembler and a linker! C compliers were very expensive ($10k, IIRC)
. .. . .. — ….
Dirk Praet • July 31, 2016 12:19 PM
@ ianf
Gosh, Wael and assorted… pups, why are you so thick all of a sudden.
Well, you do have a bit of a tendency to indiscriminately lash out at people. I suppose it’s all in good fun and most regulars have gotten used to it, but it’s occasionally bordering on abrasive. Back in the days, spitting at the band was kinda fashionable with punk rockers, but I stopped doing it after the firs time I had gotten on stage myself.
@ Grauhut
This hole bloated DNC hack story begins to look like the remake of some urban hacker myth blown up to a horror c-movie script!
Probably not a coincidence that “The Net” was released 20 years ago.
Nick P • July 31, 2016 12:33 PM
@ Love Bubble
I watched an episode of the show last night. It was stretching believability too much for both the scenario and character. I enjoyed a few moments of it but overall couldn’t get into it. I found Dexter to be way ahead if we’re talking fictional character with different brain, others’ interactions with him, & killers doing crazy stuff with body parts. I don’t watch enough foreign films to know if it’s the producer or style that limited this one.
@ Markus Ottela
I agree with Thoth. Put your ideas into some post all together at least in sections. Then we can read and comment on them better. That last conversation was scattered between so many comments here that I had to cut and paste the relevant ones into a text file to follow it haha. At least one, integrated post to start with might be nice.
Nick P • July 31, 2016 12:47 PM
@ albert
“Do you realize the amount of reading and study you put me through with that last comment?Seriously, thanks!”
Appreciate the feedback as I’m not sure if intended parties even saw it. I’m gradually evolving it into a different post that collects more approaches and more organizes them. Not many more links, though, as I want to keep number relatively small. Mainly the innovators and modern examples.
“He always called them “real computers”,”
They were. The other computers were giant, calculating machines. The Burroughs were systematically designed to achieve a tradeoff between performance, safety, programming in the large, and maintenance. All others focused on performance. Part of the reason they ignored the last two was that software engineering basically didn’t exist at that time. Alan Kay confirmed to me on Hacker News that Bob Barton’s vision and paper was a compressed version of what was discovered later. Note that he derives: high-level CPU’s, safe languages, combined HW/SW scheme, notations to enable compilation, stack machines, small team approach to development, roles for the teams, and so on in 4 pages. Such brilliance, combined with many engineers, led them to develop the first, business mainframe that had all traits needed for business development rather than just speed & backward compatibility. Unfortunately, people of then (now haha?) put those two above everything usually not even seeing other requirements as they didn’t think they mattered. Later, Burroughs’ Anderson invented INFOSEC based on their HW/SW lessons and another added security features to Intel 286. Legacy lives on in all x86 systems anywhere near secure. 😉
Note: Burroughs merged with Sperry to form Unisys. The MCP system is still updated although in legacy mode & now mostly a relic. Should’ve kept original name I think due to accomplishments.
“The VAX came ready to roll. You had an assembler and a linker! C compliers were very expensive ($10k, IIRC)”
This I find interesting. I recall that a good chunk of VMS was written in BLISS language. Did the VAXen not come with a compiler for that? Also, I’ve read that it used a macro, assembly language that should’ve been easier to code in than many others. There were papers on structured programming with it. Was that your experience?
Tatütata • July 31, 2016 1:03 PM
Re: Bron/Brœn
That series didn’t invent the premise of a bilingual investigation of a corpse lying smack on the jurisdictional border.
It had already been done in the 2006 Canadian flick “Bon Cop Bad Cop“, with corpus delicti dangling from a Québec/Ontario welcome sign.
I think I would probably find an even earlier implementation of the concept if I put my mind to it.
anony • July 31, 2016 2:22 PM
anyone looking at the security of the Snaps sandboxing of libraries in new Ubuntu?
Sad American • July 31, 2016 2:27 PM
The FBI has been investigating Clinton for months—but the NSA has its own important beef with her. This is from last March and is required tro understand the valid NSA concerns:
http://observer.com/2016/03/hillary-has-an-nsa-problem/
Like Snowden William Binney (an architect of the NSA’s surveillance program) surmised that “the hack of the DNC could have been coordinated by someone inside the U.S. intelligence community angry over Clinton’s compromise of national security data with her email use. She lifted the material that was in her emails directly out of Gamma reporting. That is a direct compromise of the most sensitive material at the NSA. So she’s got a real problem there. So there are many people who have problems with what she has done in the past. So I don’t necessarily look at the Russians as the only one(s) who got into those emails.”
http://www.breitbart.com/jerusalem/2016/07/31/exclusive-nsa-architect-agency-clintons-deleted-emails/
DNC Data Director Seth Rich Fate
Many Bernie Sanders supporters worked at the Democratic National HQ. Notice after this death Bernie Sanders quit the Democratic Party and has been remained silent.
http://hiddenamericans.com/politics/dnc-data-director-seth-rich-was-likely-assassinated-multiple-clinton-connections/
A terrible mess caused by a few, lazy, careless negligent people.
Andrej • July 31, 2016 2:34 PM
Can you believe it? ISIS offer a lengthy explanation why they hate the West and they also offer a truce to the West. Apparently they just released it today in the Dabiq 15 magazine:
Dabiq Issue 15 (Shawwal) “Break the Cross”
Why We Hate You & Why We Fight You
Shortly following the blessed attack on a sodomite, Crusader nightclub by the mujahid Omar Mateen, American politicians were quick to jump into the spotlight and denounce the shooting, declaring it a hate crime, an act of terrorism, and an act of senseless violence. A hate crime? Yes. Muslims undoubtedly hate liberalist sodomites, as does anyone else with any shred of their fitrah (inborn human nature) still intact. An act of terrorism? Most definitely. Muslims have been commanded to terrorize the disbelieving enemies of Allah. But an act of senseless violence? One would think that the average Westerner, by now, would have abandoned the tired claim that the actions of the mujahidin – who have repeatedly stated their goals, intentions, and motivations – don’t make sense. Unless you truly – and naively – believe that the crimes of the West against Islam and the Muslims, whether insulting the Prophet, burning the Quran, or waging war against the Caliphate, won’t prompt brutal retaliation from the mujahidin, you know full well that the likes of the attacks carried out by Omar Mateen, Larossi Aballa, and many others before and after them in revenge for Islam and the Muslims make complete sense. The only thing senseless would be for there to be no violent, fierce retaliation in the first place!
Many Westerners, however, are already aware that claiming the attacks of the mujahidin to be senseless and questioning incessantly as to why we hate the West and why we fight them is nothing more than a political act and a propaganda tool. The politicians will say it regardless of how much it stands in opposition to facts and common sense just to garner as many votes as they can for the next election cycle. The analysts and journalists will say it in order to keep themselves from becoming a target for saying something that the masses deem to be “politically incorrect.” The apostate “imams” in the West will adhere to the same tired cliché in order to avoid a backlash from the disbelieving societies in which they’ve chosen to reside. The point is, people know that it’s foolish, but they keep repeating it regardless because they’re afraid of the consequences of deviating from the script.
There are exceptions among the disbelievers, no doubt, people who will unabashedly declare that jihad and the laws of the Shari’ah – as well as everything else deemed taboo by the Islam-is-a-peaceful-religion crowd – are in fact completely Islamic, but they tend to be people with far less credibility who are painted as a social fringe, so their voices are dismissed and a large segment of the ignorant masses continues believing the false narrative. As such, it becomes important for us to clarify to the West in unequivocal terms – yet again – why we hate you and why we fight you.
- We hate you, first and foremost, because you are disbelievers; you reject the oneness of Allah – whether you realize it or not – by making partners for Him in worship, you blaspheme against Him, claiming that He has a son, you fabricate lies against His prophets and messengers, and you indulge in all manner of devilish practices. It is for this reason that we were commanded to openly declare our hatred for you and our enmity towards you. “There has already been for you an excellent example in Abraham and those with him, when they said to their people, ‘Indeed, we are disassociated from you and from whatever you worship other than Allah. We have rejected you, and there has arisen, between us and you, enmity and hatred forever until you believe in Allah alone’” (Al-Mumtahanah 4). Furthermore, just as your disbelief is the primary reason we hate you, your disbelief is the primary reason we fight you, as we have been commanded to fight the disbelievers until they submit to the authority of Islam, either by becoming Muslims, or by paying jizyah – for those afforded this option – and living in humiliation under the rule of the Muslims. Thus, even if you were to stop fighting us, your best-case scenario in a state of war would be that we would suspend our attacks against you – if we deemed it necessary – in order to focus on the closer and more immediate threats, before eventually resuming our campaigns against you. Apart from the option of a temporary truce, this is the only likely scenario that would bring you fleeting respite from our attacks. So in the end, you cannot bring an indefinite halt to our war against you. At most, you could only delay it temporarily. “And fight them until there is no fitnah [paganism] and [until] the religion, all of it, is for Allah” (Al-Baqarah 193).
- We hate you because your secular, liberal societies permit the very things that Allah has prohibited while banning many of the things He has permitted, a matter that doesn’t concern you because you separate between religion and state, thereby granting supreme authority to your whims and desires via the legislators you vote into power. In doing so, you desire to rob Allah of His right to be obeyed and you wish to usurp that right for yourselves. “Legislation is not but for Allah” (Yusuf 40). Your secular liberalism has led you to tolerate and even support “gay rights,” to allow alcohol, drugs, fornication, gambling, and usury to become widespread, and to encourage the people to mock those who denounce these filthy sins and vices. As such, we wage war against you to stop you from spreading your disbelief and debauchery – your secularism and nationalism, your perverted liberal values, your Christianity and atheism – and all the depravity and corruption they entail. You’ve made it your mission to “liberate” Muslim societies; we’ve made it our mission to fight off your influence and protect mankind from your misguided concepts and your deviant way of life.
- In the case of the atheist fringe, we hate you and wage war against you because you disbelieve in the existence of your Lord and Creator. You witness the extraordinarily complex makeup of created beings, and the astonishing and inexplicably precise physical laws that govern the entire universe, but insist that they all came about through randomness and that one should be faulted, mocked, and ostracized for recognizing that the astonishing signs we witness day after day are the creation of the Wise, All-Knowing Creator and not the result of accidental occurrence. “Or were they created by nothing, or were they the creators [of themselves]?” (At-Tur 35). Your disbelief in your Creator further leads you to deny the Day of Judgment, claiming that “you only live once.” “Those who disbelieve have claimed that they will never be resurrected. Say, ‘Yes, by my Lord, you will surely be resurrected; then you will surely be informed of what you did. And that, for Allah, is easy’” (At-Taghabun 7).
- We hate you for your crimes against Islam and wage war against you to punish you for your transgressions against our religion. As long as your subjects continue to mock our faith, insult the prophets of Allah – including Noah, Abraham, Moses, Jesus, and Muhammad – burn the Quran, and openly vilify the laws of the Shari’ah, we will continue to retaliate, not with slogans and placards, but with bullets and knives.
-
We hate you for your crimes against the Muslims; your drones and fighter jets bomb, kill, and maim our people around the world, and your puppets in the usurped lands of the Muslims oppress, torture, and wage war against anyone who calls to the truth. As such, we fight you to stop you from killing our men, women, and children, to liberate those of them whom you imprison and torture, and to take revenge for the countless Muslims who’ve suffered as a result of your deeds.
-
We hate you for invading our lands and fight you to repel you and drive you out. As long as there is an inch of territory left for us to reclaim, jihad will continue to be a personal obligation on every single Muslim.
What’s important to understand here is that although some might argue that your foreign policies are the extent of what drives our hatred, this particular reason for hating you is secondary, hence the reason we addressed it at the end of the above list. The fact is, even if you were to stop bombing us, imprisoning us, torturing us, vilifying us, and usurping our lands, we would continue to hate you because our primary reason for hating you will not cease to exist until you embrace Islam. Even if you were to pay jizyah and live under the authority of Islam in humiliation, we would continue to hate you. No doubt, we would stop fighting you then as we would stop fighting any disbelievers who enter into a covenant with us, but we would not stop hating you.
What’s equally if not more important to understand is that we fight you, not simply to punish and deter you, but to bring you true freedom in this life and salvation in the Hereafter, freedom from being enslaved to your whims and desires as well as those of your clergy and legislatures, and salvation by worshiping your Creator alone and following His messenger. We fight you in order to bring you out from the darkness of disbelief and into the light of Islam, and to liberate you from the constraints of living for the sake of the worldly life alone so that you may enjoy both the blessings of the worldly life and the bliss of the Hereafter.
The gist of the matter is that there is indeed a rhyme to our terrorism, warfare, ruthlessness, and brutality. As much as some liberal journalist would like you to believe that we do what we do because we’re simply monsters with no logic behind our course of action, the fact is that we continue to wage – and escalate – a calculated war that the West thought it had ended several years ago. We continue dragging you further and further into a swamp you thought you’d already escaped only to realize that you’re stuck even deeper within its murky waters… And we do so while offering you a way out on our terms. So you can continue to believe that those “despicable terrorists” hate you because of your lattes and your Timberlands, and continue spending ridiculous amounts of money to try to prevail in an unwinnable war, or you can accept reality and recognize that we will never stop hating you until you embrace Islam, and will never stop fighting you until you’re ready to leave the swamp of warfare and terrorism through the exits we provide, the very exits put forth by our Lord for the People of the Scripture: Islam, jizyah, or – as a last means of fleeting respite – a temporary truce.
Alien Jerky • July 31, 2016 2:49 PM
The computers (that I still have) in my garage:
TI-58C
Ti-59 (with the print cradle, and two rolls of thermal paper, and a batch of the magnetic cards and a variety of programs on the mag cards)
HP-11
HP-12
HP-45
Altos 5D
Altos 10D
IMSAI 8080 (1 MHZ 8080a with the Realistic tape recorder used to upload CPM)
DEC PDP-11
Two home built S-100 bus computers
A 10MB original Winchester Drive (Its 10″ platters sound like a 747 taking off as it winds up)
Commodore 64
PIC-10
Atari with the non-mechanical keyboard
Several home-built Z80 wire-wrapped computers
TRS-80 (Model 1 and Model 2
And some others I cannot get to at the moment
Curious • July 31, 2016 3:14 PM
Off topic: (Particle physics)
I just listened to this fascinating lecture in physics and it gave me a bunch of ideas that in an instant cleared up some confusion for me as to what energy and anti matter sort of might be. 🙂
https://www.youtube.com/watch?v=OoNF0fyOD8U
(“Introduction to Particle Physics Part 1 4 2”)
It was fascinating in the video how the scales of wavelength, energy and temperature was explained.
Here’s an idea:
Not having studied physics and maybe being totally wrong, I was thinking that one way to explain particle wave duality, is to think of a particle/wave as being a field (a force). That fields sort of is considered to be either “matter” when it is stable/normative, and that all matter in the local part of the universe contain anti-matter and more importantly also being dependent on some kind of structure for charge conjugation for it to persist as either radiation and/or matter, and that the magnitude of charge conjugation is what eventually determines whether or not something is determined as being matter or anti-matter, in which anti-matter would always be thought of as being a destructive and highly energized field which breaks down weaker magnitudes of charge conjugation which in turn could be considered to be normal as being either “normal” radiation or just matter.
Wael • July 31, 2016 3:32 PM
@ianf,
why are you so thick all of a sudden.
All of a sudden? I’ve always been “thick” with you and a couple of others! Perhaps I was “thicker” than normal? Lol 🙂
I know you can take it with stride.
ianf • July 31, 2016 3:53 PM
@ Wael
OK, thanks for the heads up, will adopt informal pseudo-tags [Wael laugh now] and [/Wael end laughing now], and derivates, from now on.
ADMINISTRIVIA @ Andrej,
if you have something OFF-TOPIC’KY to post, esp. as it formally could be construed as regurgitating ISIS propaganda verbatim (even if that wasn’t your intention), I suggest you publish it whole to e.g. http://justpaste.it/, get the short URL from it, then post just the first paragraph, or an intro together with the URL here. That way, those who read this on limited screen-real-estate smartphones (40-50% of readers on average), won’t have to scroll past this perhaps more than once.
ianf • July 31, 2016 4:18 PM
ADMINISTRIVIA @ fajensen
3 weeks ago I asked you a question, which soon fell off the 100 recent comments list, and so you missed it. Perhaps better luck this time
OTHERS IGNORE
https://www.schneier.com/blog/archives/2015/02/samsung_televis.html#c6727832
albert • July 31, 2016 4:19 PM
@Nick P,
“…Did the VAXen not come with a compiler for that? Also, I’ve read that it used a macro, assembly language that should’ve been easier to code in than many others….”
The VAX was a server for the biz s/w. I don’t recall if that was the case. We never wrote assembly for it. The C compiler was acquired specifically to avoid writing in assembler, and it’s sole purpose was to write s/w to concatenate huge HEX files*. Those files were used to burn ROMs for the ‘smart’ industrial terminals we manufactured. They had Z80s (and a math co-processor!), and a small but very cool BASIC. I wrote mostly comm drivers for many different PLCs, which interfaced with the users BASIC program in the terminal. We programmed the terminal code in Z80 assembler. I don’t recall other details. This was ca. 1983.
- My mentor wrote it, and gave it to me to optimize. It ran like blazes on the VAX.
. .. . .. — ….
Dan3264 • July 31, 2016 4:37 PM
@Andrej,
Reading that was interesting. What it says is reasonable, if the underlying assumptions are held(one crucial assumption is that Islam is the “one true religion”(if any religion is true)). I personally do not believe that all of those assumptions are valid(points 5 and 6 make sense to me. They are the only ones that do). I do not believe that what the terrorists are doing is justified. My opinion on the matter is not necessarily what other people think( if you think that ISIS is justified, it might be unwise to say so).
ianf • July 31, 2016 4:40 PM
@ Wael “knows I can take it with(?) stride.”
Damn Americans and your grammar floatsam. I figured out already that it HAD TO BE YOU, look the part, too. What I still haven’t figured out, however, is whether this is your main gig, so to speak, or is it just a time filler between industrial strength programming ones.
albert • July 31, 2016 4:45 PM
@Curious,
“…I was thinking that one way to explain particle wave duality…”
The simple way is to eliminate EM radiation as particles. EMR, magnetism and gravitation are states of the vacuum. They’re not particles.
[Caution! Paradigm destruction ahead!]
Please read:
http://zpenergy.com/downloads/HotsonPart1.pdf
http://zpenergy.com/downloads/HotsonPart2.pdf
http://blog.hasslberger.com/docs/HotsonIE86.pdf (commentary and Part 3)
Enjoy!
. .. . .. — ….
Wael • July 31, 2016 4:58 PM
@ianf,
My bad. Take it in stride — not with stride. I don’t know why I typed it that way.
No, it’s not me. I paid my dues in programming long ago. Now I just draw boxes and arrows.
Alien Jerky • July 31, 2016 5:17 PM
Imagine how advanced society would be without the fairy-tales and superstitions.
Techniques to Obscurie The Truth • July 31, 2016 6:03 PM
What may be obvious may bit be obvious to others.
A common technique is to ‘bury’ a post with long posts of spam hoping to provide a distraction or to frustrate. Works every time against those who take things at face value.
To others this is an exciting red flag to focus in on the preceding posts the spam author is trying to ‘hide’.
Another technique is to twist the readers mind with numbing nonsense. From The Intercept this weekend:
“ice Ka ta Ra
I wonder when the terrorist organization that is the nsa is going to brief the general public on the fact that they have the technology, have for decades, and utilize it for the purposes of spying on civilians (including but not limited to children who are unaware of what an electromagnetic wave is) while they shower, urinate, defecate, and sleep, as well as during other times that they are engaged in private actions protected by constitutional law, and ostensibly by international law that is enforced so sparingly that to mention it in this comment quite nearly constitutes an absolute embarrassment pertaining to the appropriation of my time and what else it is that I could or should be doing with it in order to undermine and delegitimize said crimes committed against myself and, more importantly, the criminals responsible for perpetuating them against me since I was a fetus in my mom’s womb.”
https://theintercept.com/unofficial-sources/
CarpetCat • July 31, 2016 6:58 PM
@albert
@Curious
I often wonder if it was not easier to think of matter as a temporary thing, much like a standing wave. Any confusion or lack of understanding would be our muddled perception of the truth.
For example, is the electron even a part of the atom? Or is it just the slightly detectable edge of the ether? This shell, constantly moving, or just replaceing one electron with another as matter “moves”?
Well, someone had the key idea of positive charge flow, and they re-thought that.
If you read the contempory letters between Einstein and his peers, you can see they had some doubt about everything. Of course, mentioning anything against the standard brands you an apostate- the ether theory is disproven! But if the ether doesn’t move, the electrons are all standing in place, packed like sardines, and the matter…. oh bother. I just want my starship now, whether I must steal it or not…
@CarpetCat,
The only positive money flow I want to recognize is a carpet cat money >> pocket.
@All,
See what happens when I add an editing layer to my submissions?
That meant to read ‘positive flow’ not ‘positive money flow’.
@All,
‘”Does your web browser have a unique fingerprint? If so your web browser could be tracked across websites without techniques such as tracking cookies…” warns a new site created by the University of Adelaide and ACEMS, adding “the anonymization aspects of services such as Tor or VPNs could be negated if sites you visit track you using your browser fingerprint.”‘
https://yro.slashdot.org/story/16/07/31/1357234/new-site-checks-your-browsers-fingerprint
tyr • July 31, 2016 10:29 PM
I’d like to know what this means !!!
http://www.districtdispatch.org/2016/07/top-secret-hush-hush/
I know there’s a cloud of anal stupidity that fogs the
air around copyright, but why the need for secretive
proposals to congress. Is the issue of libraries some
arcane secret that hasn’t been solved since the time
of Alexander the Great and must be now fixed in secret?
I lost track of the computer count around here with
number 38, that’s one advantage of being old as Hel
you no longer bother numbering your obselete equipment.
@Wael
MuhaaHAA cryptocurrency !!!
Mark • July 31, 2016 10:41 PM
@ Another Clive Fan
Err, he probably took a short vacation, in reality. it’s break time of the year, you know?
@ Clive Robinson
“The important part of learning, is something teachers do not know how to teach, which is how to learn. ….Thus the three types of teaching that are around, “spray and prey”, “teach by drill” and “drill to the test”. “”
The methods themselves may have more to do with the purpose of. In order to teach, teachers must first identify the objectives. Teaching can be a mean of indoctrination, conformity, intellectual growth (of the teached or the teacher), to spread an ideology, goodwill, raise a status (tenureship), earn a living, etc.
To each objective, teaching methods are adjusted for optimal outcomes. The true problem is that most teachers did not identify their own objective.
Mark • July 31, 2016 10:48 PM
“To each objective, teaching methods are adjusted for optimal outcomes. The true problem is that most teachers did not identify their own objective.”
Err, or perhaps, the true problem is most teachers KNOW their objectives.
Wael • July 31, 2016 11:32 PM
@tyr,
Is the issue of libraries some arcane secret that hasn’t been solved since the time of Alexander the Great and must be now fixed in secret?
At the time of Sasha[1] the Great, there were no internet whackos…
They want to wrap up this issue. Now is not the time to solicit comments that would be publicly posted from a bunch of Internet whackos who don’t know what they’re talking about.
Do you know what you’re talking about, @tyr? 🙂
[1] Sasha is the Russian nick name for Alexander. Like Bob and Robert in the US.
Michael • August 1, 2016 12:48 AM
@ Techniques to Obscurie The Truth
“To others this is an exciting red flag to focus in on the preceding posts the spam author is trying to ‘hide’.”
hence, imitation is the sincerest form of flattery. 😉
A little bit of verbosity is a nuisance, but when verobosity is done en masse scale, one deserves a Nobel Peace Prize equivalent of the Pulitzer.
Thoth • August 1, 2016 12:50 AM
@Wael
re: Bitcoins
I think he prefers cold hard cash wrapped in plastic bag, placed under the seat of a park’s bench and given the time and coordinates to pick up over encrypted ham radio link. He doesn’t even trust electronic cash and online banking, let alone crypto cash.
He might further step up his OPSEC and exchange those cash he gotten with someone to clean off his trails or buy something useful like some his snacks and tea 😀 .
@r
re: Browser Fingerprints
Mozilla should consider adding a fingerprint falsification engine into their Servo browser and make each session generate fake browser fingerprints (not accessible and unique between each tab session) to throw off possible fingerprinting attacks. No fingerprints is a problem as attackers are expecting fingerprints and by finding out that the fingerprints do not exist, it may force them to step up their attacks but to give fake fingerprints, it might fool them into thinking they got what they are after and make them all merry and satisfied.
@Mark
re: Clive Robinson on a short holiday
Interesting theory. Yes, it’s the holiday seasons and crowds of tourists flooding the world. Maybe @Clive Robinson is all right and enjoying himself. Hmmm …. nice alternative theory.
Curious • August 1, 2016 1:16 AM
“Bringing HSTS to http://www.google.com”
https://security.googleblog.com/2016/07/bringing-hsts-to-wwwgooglecom.html
“For many years, we’ve worked to increase the use of encryption between our users and Google. Today, the vast majority of these connections are encrypted, and our work continues on this effort.”
“To further protect users, we’ve taken another step to strengthen how we use encryption for data in transit by implementing HTTP Strict Transport Security—HSTS for short—on the http://www.google.com domain.”
I guess HSTS is a nice thing, though I can’t help but wonder if Google is too vague about their intentions when they start a blog post with that first paragraph. It is as if they are saying “we are simply working, and guess what, we will say that we will continue to work”. I mean what Google wrote in its first paragraph isn’t much of a mission statement.
From Wikipedia, about ‘HTTP Strict Transport Security’:
“HTTP Strict Transport Security (HSTS) is a web security policy mechanism which helps to protect websites against protocol downgrade attacks and cookie hijacking. It allows web servers to declare that web browsers (or other complying user agents) should only interact with it using secure HTTPS connections, and never via the insecure HTTP protocol.”
Wael • August 1, 2016 1:59 AM
@r, @Thoth,
DFP was discussed here. There is a subtle difference between Device fingerprinting and Browser fingerprinting, mainly revolving around limitations the browser sandbox imposes. Obtaining DFP from a native app is more deterministic…
There are also a multitude of techniques for fingerprinting, also were discussed sometime ago, such as clock skew and canvas…
Clive Robinson • August 1, 2016 2:20 AM
@ All,
I am alive (I think 😉 and still hopping along on two sticks.
Thank you for your kind thoughts, some have made me a little pink in the ear region but… like a stiff upper lip and all that other sort of national “cultural” stuff once infected it stays with you (yup makes it sound horribly like something you might find in a Petri dish).
As for rewarding me for ideas etc, if you are making some gain by it, as I’ve mentioned in the past “buy Bruce two drinks” one for being our host, and the other he can buy me in return at some point in the future, when we don’t “near miss”. If you are using it to benifit others, well done and keep up the good work, and just mention our host for making it possible and myself. And for those of a practical nature, get out and “share with the young” via the likes of “Maker and HackerSpace” organisations or more formal organisations such as Amateur/Ham organisations such as the UK’s RSGB, US’s ARRL etc, they are our future. Or if you are fit and healthy those organisations like the RNLI or Mountain Rescue or similar, real heros are those calm faces you see when things have gone wrong and you most need them, but you are usually not in a fit state to say thank you to them.
Finaly for those wondering where I have been for the past few days, the simple answer is at a Satellite design/engineer/deploy/use/education colloquium. Not quite a holiday but surprisingly relaxing even though quite hectic.
Curious • August 1, 2016 2:36 AM
Reading more about HSTS on Wikipedia, I see there is this Sophos article from 2015 that not only points out that HSTS can be abused, but that such abuse apparently is also pointed out in the RFC document for HSTS.
https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-browser-dilemma-how-hsts-supercookies-make-you-choose-between-privacy-or-security/
(“Anatomy of a browser dilemma – how HSTS ‘supercookies’ make you choose between privacy or security”)
The article has apparently this quoted passage, supposedly from the RFC article:
It is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course … Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains).
Such a technique could potentially be abused as yet another form of “web tracking”.
Looking at the RFC article, things are worded differently:
Since an HSTS Host may select its own host name and subdomains thereof, and this information is cached in the HSTS Policy store of conforming UAs, it is possible for those who control one or more HSTS Hosts to encode information into domain names they control and cause such UAs to cache this information as a matter of course in the process of noting the HSTS Host. This information can be retrieved by other hosts through cleverly constructed and loaded web resources, causing the UA to send queries to (variations of) the encoded domain names. Such queries can reveal whether the UA had previously visited the original HSTS Host (and subdomains).
Such a technique could potentially be abused as yet another form of “web tracking”.
It looks like as if maybe the Sophos article explains how supercookies works, though it isn’t clear to me and so I wouldn’t know what to think about it.
Wael • August 1, 2016 3:08 AM
I am alive
Strange! A, B, C: rotate left, substitute …
Then you get: Clive Alive!
Who? • August 1, 2016 3:42 AM
@ Clive Robinson
Finaly for those wondering where I have been for the past few days, the simple answer is at a Satellite design/engineer/deploy/use/education colloquium.
Definitely I would not use the term “being alive” to describe someone at this seminar.
Glad to see you are fine!
Curious • August 1, 2016 3:51 AM
To add to what I wrote above in my last comment about HSTS:
I wonder if the noted issue with HSTS about tracking concerns, would be considered to be even a larger issue if multiple parties could conspire to utilize such a feature across the internet.
ianf • August 1, 2016 7:11 AM
@ Clive Robinson […] has attended a “Satellite design/ engineer/ deploy/ use/ education colloquium.” [emphasis mine]
I vaguely remember that you “did something” with satellite technology in the past. As for future uses of it, I understand that some businessman has unveiled a scheme for piggybacking 10 gram containers of Dearest Deceased’s ashes onto communications satellites in geostationary orbit. I think ashes made into a diamond would be even better; or why not used as carbon substrate for something vital up there, forever bearing one’s name? (just in case you intend to become immortal as has here recently been proposed—no obligations though).
ianf • August 1, 2016 8:13 AM
ADMINISTRIVIA @ Rebecca
Haldon @ June 25, 2016 6:59 PM,
Haldron @ July 2, 2016 1:12 AM, or
Hadron @ July 14, 2016 11:24 PM
… you’re still in the queue. I’m working off the backlog, but, as you’re no longer with us, my priority of response to you gets pushed further back, perhaps into oblivion.
Curious • August 1, 2016 8:51 AM
“SSL Flaw in Intel Crosswalk Exposes Apps to MitM Attacks”
http://www.securityweek.com/ssl-flaw-intel-crosswalk-exposes-apps-mitm-attacks
They found that when an invalid or self-signed SSL certificate is used for communications with the server, an error message is displayed and the user is asked to allow or reject the certificate. If that certificate is allowed, other SSL certificates will be allowed by default without being checked.
“Crypto flaw made it easy for attackers to snoop on Juniper customers”
http://arstechnica.com/security/2016/07/crypto-flaw-made-it-easy-for-attackers-to-snoop-on-juniper-customers/
“When a peer device presents a self-signed certificate as its end entity certificate with its issuer name matching one of the valid CA certificates enrolled in Junos, the peer certificate validation is skipped and the peer certificate is treated as valid,” Wednesday’s advisory stated. “This may allow an attacker to generate a specially crafted self-signed certificate and bypass certificate validation.”
Thoth • August 1, 2016 10:13 AM
@all
Old news, new spin … I mean old spin. Just repeats. Russian KGB/FSB claims they can collect crypto keys. Nothing new.
Do you think Microsoft ought-to correct this?
That’s a little bit bigger than autocorrect/suggestivity problems.
Mark • August 1, 2016 12:05 PM
@ Wael, “Then you get: Clive Alive!”
Another interesting take-away is that when letters are rotated and pronounced by a foreign tongue, Clive & Wael sounds like “alive and well” – but my hunch says that story has an interesting digression.
Wael • August 1, 2016 12:55 PM
@Mark,
but my hunch says that story has an interesting digression.
No disrespect meant… please start flapping your lips, I’m all ears!
Curious • August 1, 2016 1:48 PM
I am probably wrong in thinking this, but I wonder if it is possible to turn a ‘cubic curve’ into something that resembles an elliptic curve ala ECC curves. I.e taking the cubic curve and making it a straight line with a transformation operation, and then, have any straight line intersecting the old ‘cubic curve’ bent into a curve that crosses the now straightened line. Heh, imagine if you could invert an elliptic curve (for ECC) into a cubic curve or something.
Wallcroft • August 1, 2016 2:54 PM
Has anyone watched the most recent Rambam’s talk on HOPE XI? How much new info is there?
@All,
Another small win for modkind (and privacy/security activists).
@Wael,
From your article:
“the FCC’s proposal still likely bans open source, third-party firmware, as designed, and takes away all access to the radio software from users.”
From the current one @ /.:
“But the FCC also did something unprecedented. It required TP-Link to support open source firmware on its routers. You might recall that, last year, the FCC caused a ruckus when it mistakenly suggested it was banning open source router firmware. In fact, the FCC only required that router vendors implement protections for specific radio emission parameters. But the FCC didn’t work with router vendors in advance to maintain open source compatibility, resulting in certain vendors (including TP-Link) trying to lock down their routers.
The FCC eventually issued a clarification, but the damage was done. Only recently have a couple router vendors (Linksys and Asus) affirmed that they will continue to support open source firmware.”
Last years attack on open source firmware was appearently intended for the radio specific stuff and interoperability etc, this is a clarification and a small win. 🙂
@Wael, small win though for sure as the radio part of said systems will remain under lock and key.
@Wael,
The FCC settlement is pretty profound (even if it does only affect TP-Link).
They have to pay $200,000, implement an FCC compliance program, issue a software update for all of their devices which can be made-compliant, attempt to remove non-compliant non-upgradeable devices from the US market…
AND!
“TP-Link has also agreed to take steps to support innovation in third-party router firmware by committing to investigate security solutions for certain 5GHz band routers that would permit the use of third party firmware while meeting the Commission’s security requirements and maintaining the integrity of critical radio parameters.”
Way to go FCC but I guess we still have to wait and see if they start cracking down on SDR.
Wael • August 1, 2016 7:24 PM
@r,
small win though for sure as the radio part of said systems will remain under lock and key.
That’s understandable!
Thoth • August 1, 2016 7:32 PM
@all
A Chinese shill in the FBI leaked technology back to China. That’s why NSA doesn’t share it’s secrets with the FBI, CIA and everyone else as these sort of leaks are so common in the US Govt. In fact, the US Govt is so much more leaky than any other Govt known. Talk about highly advanced high assurance security the US Govt uses … but there are still so much leaks … ohhhh… bad actors and rotten apples amongst the people there 🙂 .
For one part, I don’t agree on giving converted citizens the rights to highly classified information. Singapore’s clearance systems only allows citizens naturally born in Singapore are given a chance (not even a guarantee) into higher compartmentalized information which I find those being really helpful in terms of secrecy. Singapore’s system is also bias in the sense only those pro-Government guys gets selected by an internal privy council to important positions and higher clearances and generous benefits are given to them to maintain loyalty and a sense of ownership while the common people are treated like expendables thus a rift in the class system in Singapore but that is exactly what keeps secrets behind closed doors for a much longer periods. For one I don’t agree with the style of hiring people into positions but somehow it works.
Recently a change of wind allows people from other nations to slowly climb the ranks and get into the higher clearance and elite parts of Singapore’s society which may turn out to one day work against those closely guarded secrets of the current benevolent dictatorship regime here and who knows what ugly secrets might seep out through these opening gaps in the linings.
Link: http://www.theregister.co.uk/2016/08/01/fbi_techie_cops_to_china_spy_charge/
anony • August 1, 2016 8:04 PM
Preventing future offending of delinquents and offenders.
Doris L.Makenzie J of Exp Criminology
Results: Interventions based on surveillance, control, deterrence or discipline were ineffective.
win_for_whom • August 1, 2016 10:01 PM
@r
Way to go FCC but I guess we still have to wait and see if they start cracking down on SDR.
Although, was it really such a small win — for sure!? I’d say it’s a huge win!!!
A big win for the “open source” community against the freedom to tinker movement, in my humble opinion…
I have to wonder how many non-FCC compliant (ab)users are causing so much trouble by owning their own radios. My guess is a very, very small number. Of those few, how many will now care that the laws have changed to make them overt criminals instead of competent engineers? Almost none, probably.
However, if it’s now acceptable to apply new worldwide computational restrictions whilst still appearing to be fighting for the little guy — who can complain?
“We got our edge-cases covered, and who would care about the wider area network, amiright?”
@all
I’ve been looking forward to the discussion here in re: FISA order to stop using intercepted phone call content because it was too obvious. It’s quite possible that I’ve missed that…
@et al
Ehhh, ya dont say 😛
Thoth • August 2, 2016 7:33 AM
@all
Chinese smartphone maker claims to have baked in a dedicated hardware encryption chip into their Gionee M6 smartphone.
Usual advise is to take all these with a huge bucket full of salt. If you trust hardware encryption chip made in … ahem …
Links:
– http://www.theregister.co.uk/2016/08/02/chinese_android_smartphone/
– http://www.beeep.co/gionee-m6
ianf • August 2, 2016 7:59 AM
- [This OT topic moved to the more appropriate ragbag Squid thread]
@ Ted
RE: Bethany McLean’s State of Journalism: The Lost Art of Fact Checking (2014), reminds me of this golden age of fact-checked reporting: “what was it like to be edited by William Shawn? I’m appending ‘a few questions,’ he told a writer of a New Yorker profile. There were 178…”
But perhaps we shouldn’t complain too much, and be content with media with no uncorrected stupid typos[*], spelling errors, and “mysteriously” dropped paragraphs, because the formatting software has done an “educated guess” which sentences can be cut or slimmed down because they contain no obvious keywords, place names or “weighted tokens” deemed to be lexically decisive or conclusive. And, best of all, the readers can not complain on account of what they haven’t been served!
[^*] how hard it is to avoid such can best be exemplified by that there is one such in the top image caption of the otherwise named editor-attributed essay on education in Æon.
@tyr: there’s a cloud of anal stupidity fogging the air around ©opyright, but why the need for secretive proposals to congress. Is the issue of libraries some arcane secret that hasn’t been solved
Elementary, my dear tyr, no need to blow the gasket (also costs serious money to replace). If the big copyright hoarders stress the need for secrecy on account of some parallel-constructed imaginary mayhem that otherwise will be visited upon us, then SURELY they must know what they’re doing & the circle of mutually beneficial logrolling and surety of future campaign funding stays intact. Break it, and who knows what could come next, some Chinese factories might start pushing out Mickey Mouse® trinkets in droves, and not caring for who’s in or out. Oh, wait…
ianf • August 2, 2016 8:10 AM
@ Dirk Praet’s
valuable criticism of yours truly, ‘ho “has a tendency to indiscriminately lash out at people… occasionally bordering on abrasive”
Not “lash out” and not indiscriminately, otherwise guilty as charged (remember Nora Ephron mother’s adage: everything is copy). Also I do so love it when others talk ABOUT ME IN EARNEST.
I suppose it all comes down to our individual approaches to stupidity: how do we individually handle instances of such (yes, you read it right) here. There is this widely adopted “everybody’s opinion has equal weight” principle that we all adhere to, but in practice it often leads to such dead-end exchanges as that recent of yours with @free (other samples on request).
Let’s say I filter new comments here through a different “sieve” and, using the loaded weapons of hyperbole, veiled ridicule, and THEHORROR THEHORROR sarcasm, I show no mercy to such sieved-residue submitters, hoping that the initial dollop will make them go post somewhere else. Sometimes it doesn’t work.
- We could discuss whether it is the appropriate; sole; or the right approach, but it has been derived from a long practice and the insight that, no matter how “nice” one be, there’s no way to prevent occasional others’ occasional displeasure.
In this particular case, I don’t get what got you so riled about me “accusing” Wael & Assorted Pups (good name for a band!) of being thick (Wael even protested the restriction of my prettifying “…all of a sudden, as he wants to be—known as, mind—thick as a brick at all times.)
- If anything, it should be YOU LASHING OUT @ Wael for playing a blowhard when he was on to my mea-culpa suggestion.
@ Love Bubble
look what you did: first you post a naïve referral to some supposedly-überhuman savant—my ass—heroïne; then you get called out by me; then Dirk gets all wound up on account of my general abrasiveness; and in the end you steal an hour of Nick P’s valuable time for checking her out. AN HOUR that could better be spent on posting his lifetime’s worth of security-related insights, complete with 29 links to document troves and sites, that only would take any one here 6 or so full-time-sitzfleisch months on average to read, and a lifetime to grok (ask albert.)
@ Tatütata
The Bron/Brœn series didn’t invent the premise of a bilingual investigation of a corpse lying smack on the jurisdictional border.
Definitely not, and there only are so many ways to murder a mannequin on the silver screen, and even less on TV (different moral rules apply).
But you’re missing the finer points: was that Canadian hangee composed of 2 corpses? Was it multi-gender? Was the sign it hung from under constant multiple-eye surveillance? I suppose the Quebec/ Ontario division is a jurisdictional border in a country at loggerheads with itself, but do they both not fly the RMCP flag? Etc.
Observe some additional dimensions of that Brœn-corpse that went unused here, but that undoubtedly will appear in later copycats: it could have been made up of different “races” or colored people. Or of wildly different ages. The “halves” could have been arranged differently, the upper front turned verso from the lower part’s recto, or even one upside down. The parts could have been drenched in… champagne, milk, honey, linseed oil. One part could have been burned, the other deep frozen. Or one real, the other an ET. One painted red, other bleached. Etc. I bet your film’s producers didn’t think of that, heh?
ianf • August 2, 2016 8:16 AM
@ Wael’s
[…] subtle difference between Device and Browser fingerprinting, mainly revolving around limitations the browser sandbox imposes. Obtaining DFP from a native app is more deterministic… (cc: @rrrrrrrrr, @Thoth)
It definitely is, and the technical metodology employed to surreptitiously harvest and “share” such data is by now fairly well understood. But it always stops short of HOW those data are then collated, analyzed, packaged for sale, marketed to buyers, AND utilized.
That it takes place is hard to miss: every time I search for some defined product (needn’t be brand of), even with duckduckgo.com, then visit linked results’ websites, and even if I do buy it from some linked place, in a day or two I see ads in my news flow for the same product, or a range of similar. Like the “teller hand” didn’t communicate with the “promo hand,” but had to maximize the returns just in case I only was looking over the website leading to no sale.
- The strange thing is that the news corporations that buy and make use of such aggregated data packages, first need to assign not inconsiderable resources for “fishing” for visits from fingerprinted origins, in essence capturing the profiles, then matching them against back-end databases.
Only if the op finds a matching fingerprint there can it get at the previously gathered “areas of this-ID’s purchase-mood interest” and send THAT to some ad-server that will deliver a “suitable” ad. Lots of CPU cycles exerted for pretty small returns, yet at a non inconsiderable webpage delivery delays for all, even not fingerprinted, users/ readers. But all that is largely logic[k]al conjecture, have yet to see that back-of-the-back-of-the-server process described in detail, and its individual segments or components quantified in terms of time to browser delay, cost in CPU cycles, AND the fractional charges that they command up and down the chain.
Incidentally, I was reminded of the companion IoT recently, the non-browser-based data harvesting and upload for sale and aggregation elsewhere. I had to explain the concept to a group of ~>70 yo congressioners(?) on a city outing, who were ogling a number of strange devices in a shop’s window (that I knew nothing about, my part of town apparently undergoes rapid gentrification).
These devices were a Automatic Waffle Maker, and a similarly IoT “mood cushion” – with lights, heat and massage (I suppose the latter could be called a camouflaged nether regions dildo?). The waffle batter was made from water, butter and flour, then channeled onto an iron to bake it. While explaining their “IoTness,” I found myself at a loss to convey the WHY.
- Because, let’s face it, WHAT is the value of those shared “waffle preparation frequency and number of data” to the device’s maker? HOW does someone knowing that someone else in (say) given GPS location sits on that “intelligent” cushion and uses the slow-fade-to-blue option profit from that “knowledge.” WHEN comes the revolution so that we can take all such no-hope commercial parasites out and shoot them at dawn [0600 Zulu time] – all questions demanding an answer.
(The bug is actually dated to w95 era, but network shares were disabled until windows 8. THIS ALLOWS YOUR PASSWORD HASH TO BE effectively XSS’d from outlook/edge)
@win_for_whom,
Fair enough, I understand the criticism behind your statement.
I did find myself thinking that: “man, it might be nice to get some of those offending TP-Link devices before they are gone.”
Thoth • August 2, 2016 9:59 AM
@r
Everyone is pwn-ed (for those using M$ products) without a doubt. For now the only two viable OSes that are secure enough would be OpenBSD and Qubes despite them using untrusted huge TCBs since there are no other options left for better OSes.
Dirk Praet • August 2, 2016 10:07 AM
@ ianf
In this particular case, I don’t get what got you so riled about me “accusing” Wael & Assorted Pups of being thick
In the case of @vas pup, I can understand him taking offense to your involving his mother in the discussion. We do get your sarcasm, hyperbole and veiled ridicule, but the simple fact of the matter is that some readers do in fact take offense at certain remarks due to cultural or other differences.
As to @free, it’s obvious that he is on to us and that there is no more point in denying that we are all getting paid about $10k a day for writing comments in support of our Supreme Leader Obama, who is actually not black and the last living descendant of our revered Reichsführer. All of us members of his inner circle know that his birth certificate says he’s German and that his real name is Karl-Heinz Volkswagen.
Dirk Praet • August 2, 2016 11:54 AM
@ r, @ Thoth
For now the only two viable OSes that are secure enough would be OpenBSD and Qubes
I think I have asked before, but any of you guys have any thoughts on SubgraphOS ?
Wael • August 2, 2016 12:57 PM
@Dirk Praet, @ianf,
All of us members of his inner circle know that his birth certificate says he’s German and that his real name is Karl-Heinz Volkswagen.
Hahaha! Thanks for putting a smile on my face in stressful day…
Why are you leaking these secrets out?
As far as being “thick”, I do it on purpose when I’m annoyed with illogical, incoherent or ___ posts. But no insults are usually intended,
@Dirk,
I haven’t followed the OS game in years, currently I only track hardened linux’s and obsd.
And am interested in Qubes.
I defer to Thoth and Nick P on questions of real security.
@Dirk,
About SubgraphOS,
It’s linux, Grsec+PAX – I’m not sure if it’s LFS or what at it’s core though.
Looks like in the general sense SubgraphOS > Mempo (drop in kernel for debian(now outdated))
It’s in alpha stage though, so likely ALOT of weeding left to do.
Of note: OpenBSD as of 5.9 is developing it’s own native hypervisor (ia32/aa64 only) so keep your eye on that.
One thing I’ve learned from you guys, and from the Qualcomm TZ exploit is that simulated isolation != true isolation.
That being said, SubgraphOS says it enforces sandboxing. So it’s got some good features for someone who may not want to or know how to configure them.
Sophia • August 2, 2016 5:40 PM
– Tails Linux 2.5 is out (Aug 2, 2016)
https://tails.boum.org/news/version_2.5/index.en.html
https://tails.boum.org/install/download/openpgp/index.en.html
http://dl.amnesia.boum.org/tails/stable/tails-i386-2.5/tails-i386-2.5.iso
https://tails.boum.org/torrents/files/tails-i386-2.5.iso.sig
https://tails.boum.org/torrents/files/tails-i386-2.5.torrent
https://git-tails.immerda.ch/tails/plain/debian/changelog
– Tor Browser 6.0.3 is released (August 2nd, 2016)
https://blog.torproject.org/blog/tor-browser-603-released
https://www.torproject.org/dist/torbrowser/6.0.3/
https://www.torproject.org/download/download-easy.html
– Tor 0.2.8.6 is released! (August 2nd, 2016)
https://blog.torproject.org/blog/tor-0286-released
– Debian and Tor Services available as Onion Services[1]
https://blog.torproject.org/blog/debian-and-tor-services-available-onion-services
[1] “August 1st, 2016
“We, the Debian project and the Tor project are enabling Tor onion services for several of our sites. These sites can now be reached without leaving the Tor network, providing a new option for securely connecting to resources provided by Debian and Tor.
The freedom to use open source software may be compromised when access to that software is monitored, logged, limited, prevented, or prohibited. As a community, we acknowledge that users should not feel that their every action is trackable or observable by others. Consequently, we are pleased to announce that we have started making several of the various web services provided by both Debian and Tor available via onion services.
While onion services can be used to conceal the network location of the machine providing the service, this is not the goal here. Instead, we employ onion services because they provide end-to-end integrity and confidentiality, and they authenticate the onion service end point.”
Thoth • August 2, 2016 6:11 PM
@r, Dirk Praet
These days, I havr largely given up on any sort of Linux considered hardened or secure. That includes Android and it’s many hardened variants. Anything coming from a Linux kernel or derived is considered as broken and compromised as any Windows or Mac.
OpenBSD puts in great effort at maintaining the OS with as much essentials as they need and putting security as the basis for the OS which neither Windows nor Mac and Linux have such goals to build a secure and essential OS from bottom up.
Qubes being the only OS that brings virtualization and a hypervisor being the most secure but still having much left to be desired since Xen hypervisor is not the best choice due to it not having a tiny TCB but better than nothing for now.
Subgraphy with it’s sandboxing … but it’s still running on a bloated Linux kernel anyway. How secure can it be wih such a bloated TCB to host the VM host ? I consider that compromised too.
Thoth • August 2, 2016 6:32 PM
@r, Dirk Praet
In fact, consider no OS running on a general purpose hardware secure. You can have tiny TCBs and whatever but it is like betting on the CPU not having hardware backdoors, malfunctions in the CPU hardware or HAL layer, ensuring the tiny TCB separation microkernel does not have bugs. Even if the microkernel maybe able to invoke some memory locking and protection mechanism from hardware and if the hardware glitches, that memory protection mechanism maybe invoked by the microkernel but the CPU’s MPU doesn’t deliever the security function properly, it’s still game over.
The best separation gaurantee is dedicated hardware per logical function (a.k.a physical separated hardware). If you need security, use a smartcard as a HSM. If you need a CPU for Secret classification emails, only use the CPU and RAM for Secret classification emails and nothing else (as an example). Thus the reason why SCIF departments have so many terminals dedicated to different classifications and functions is for that reason of physical separation being the most secure.
That is also a reason why multi-application security devices are not considered as secure as single application devices (i.e. differences between general purpose HSM and payment HSM). By the way, if you are running a PCI compliant business, you should know that a HSM doesn’t immediately make it PCI security compliant until it runs approved modes used for approved functions and approved procedures by the PCI standards. Similarly, physical separation while running in alproved single application modes with approved procedures are much more stronger in security gaurantees than say some form of multi-application separation via hardware or software.
Hay!
I got a letter from James Comey today!
Re: FEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE INTERNET.
James Comey
EXECUTIVE DIRECTOR FBI
FEDERAL BUREAU OF INVESTIGATION FBI.WASHINGTON DC.
FBI SEEKING TO WIRETAP INTERNETFEDERAL BUREAU OF INVESTIGATION SEEKING TO WIRETAP THE INTERNET.
Dear Beneficiary
We hope this notification arrives meeting your good health and mind. (FBI) Washington, DC in conjunction with some other relevant investigation agencies here in the United STATES of America have recently been informed through our Global intelligence monitoring network that you have an over-due payment in tone of USD 10.3M Citibank.
Well hot damn! Who wants to take a vacation?
Curious • August 3, 2016 2:04 AM
“Landlord installs Faraday cage to block phone signals because social media is ruining British pubs”
http://www.telegraph.co.uk/science/2016/08/02/landlord-installs-faraday-cage-to-block-phone-signals-because-so/
A cocktail bar owner has installed a Faraday cage in his walls to prevent mobile phone signals entering the building.
The article doesn’t really state if this supposed faraday cage works as intended or not, so this seems for me to be a bit of an advertisement.
Thoth • August 3, 2016 6:39 AM
@Nick P
Mozilla’s Rust is coming to Firefox (a.k.a Servo). The latest update of Firefox would start replacing C++ codes with Rust codes for security.
Link: https://hacks.mozilla.org/2016/07/shipping-rust-in-firefox/
Clive Robinson • August 3, 2016 7:31 AM
@ Bruce,
You might find this of interest,
Basicaly it has been found that CCTV footage when played slowly effects the way those viewing it make judgments about the actions of those in the footage. Thus in a doubtful case it is considerably to the advantage of the prosecution not the defendent to have the footage shown slowly…
@Clive, All
Let’s roll back the footage and have a look at it again, shall we?
Clive Robinson • August 3, 2016 12:21 PM
@ r,
All jokes aside, English law was based on the idea of “equity in arms” and is the base model for many other nations.
In recent times we have seen many states change the game in favour of “might is right” which harks back to the very bad old idea of “Divine Right” of the sovereign(ty). Such behaviour is usually the hallmark of disfunctional states where you are guilty by accusation with no right to realisticaly contest.
The US judicial system where you have to pay your own costs as a defendent, is clearly biased against those without significant wealth. It’s also been used by various Government agencies to punish and in effect destroy those not in favour. See NSA treatment of what we would call whistleblower’s etc, there is no equity in arms there, just “might is right”.
The use of low resolution / poor quality CCTV footage has raised questions of injustice in the past. The use of CCTV footage slowed down so a prosecuter can put lots of verbal spin on top is fairly obviously not presenting evidence “as is” but highly prejudicialy augmented.
Such behaviour used to be a major “no no”, but increasingly is seen as a way to ensure that “justice is seen to be done” for the sake of political expediency rather than actually done.
Curious • August 3, 2016 3:18 PM
Something about HTTP/2 flaws from Blackhat conference.
“Two first-gen flaws carried over to HTTP/2, warn security bods”
http://www.theregister.co.uk/2016/08/03/http2_flaws/
Extorsion anyone?
Source forged… all over again.
It’s official, researchers stunned again, ugh this is draining.
Thoth • August 3, 2016 8:14 PM
@r
re: Comcast extortion for privacy.
Do not expect privacy and security in this age if nothing is done to secure yourself. And yes, Comcast is a big bad bully. I am glad neither of the 4 ISPs in my country does that though. But just to ensure that no ISPs are listening in, always try and use HTTPS or otherwise setup some sort of VPN to a Swiss or Icelandic end point to fetch your contents albeit the slower speed.
re: Sourceforge 2.0
Most developers simply upload codes and binaries. It would be better to do code signing for code authenticity checks. That means if someone release a malware version of your codes, they need to have your code signing private key. Store that code signing key inside a smartcard just to be sure. Also, if possible, get Keybase.io to recognize your code signing key so you have a sort of community-based CA to ensure the authenticity of your claims and lastly would be to host a project website that is not linked to the code repository site to publish your project code signing public keys and project statuses. A free “blog.com” account would be useful to turn the blog into a key publishing site.
re: Sneaky batteries
Batteries these days have IC chips and who knows what the IC chips in the battery packs are doing besides preventing over-charging.
I just repost certain things incase other’s miss them.
I try to not be too annoying or irrelevant, just try to keep awareness up – I’m working on cohesion and tact.
That was 2 new immediate usage tracking warnings and a potential subversion of loved ones computers that may or may not be on your home networks.
JG4 • August 4, 2016 6:16 AM
this makes some good points that are distant tangents from the post
http://www.nakedcapitalism.com/2016/08/instant-payment-services-payer-beware.html
@All,
This is something Clive and Nick P were discussing last week?
https://news.ycombinator.com/item?id=12225085
http://www.ipspace.net/History/Local_Area_Networking_on_RS-232
Curious • August 4, 2016 8:54 AM
“New attack steals SSNs, e-mail addresses, and more from HTTPS pages”
http://arstechnica.com/security/2016/08/new-attack-steals-ssns-e-mail-addresses-and-more-from-https-pages/
The exploit is notable because it doesn’t require a man-in-the-middle position. Instead, an end user need only encounter an innocuous-looking JavaScript file hidden in an Web advertisement or hosted directly on a webpage. The malicious code can then query a variety of pages protected by the secure sockets layer or transport layer security protocols and measure the precise file sizes of the encrypted data they transmit. As its name suggests, the HEIST technique—short for HTTP Encrypted Information can be Stolen Through TCP-Windows—works by exploiting the way HTTPS responses are delivered over the transmission control protocol, one of the Internet’s most basic building blocks.
I don’t understand how this works, but maybe you people do.
CallMeLateForSupper • August 4, 2016 9:30 AM
re: Michigan’s misguided legislation against vehicle hacking
Making it a felony punishable by “imprisonment for life or any number of years” will absolutely deter potential hackers. Not.
(tongue-in-cheek: ON)
Why pull your punch, Michigab? Incarcerating just one person for life costs taxpayers $millions. A lower cost solution is simply killing the offender. Note the resulting benefit: there would be no possibility that she could re-offend.
I note that the posted parts of the bill donotaddress cases of actual or intended death or bodily harm; the penalty for hacking a vehicle to cause damage is the same as hacking a vehicle to kill. OK, so kill every offender, but if she intended that her dastardly deed result in death or bodily injury then kill her again. All bases covered; mash the “That Was Easy” button and move on to unemployment and lead in drinking water.
(tongue-in-cheek: OFF)
Thoth • August 4, 2016 9:33 AM
@r
It was not originally designed for security purposes though but it’s something similar just with a different purpose in mind.
CallMeLateForSupper • August 4, 2016 9:50 AM
@Curious
“I don’t understand how this works, but maybe you people do.”
I don’t either, but some unknowns can safely remain so. I am always relieved when I see that a malware is dependant on Javascript, because rendering that malware impotent is fall-over easy. Just say “no” to Javascript.
Thoth • August 4, 2016 8:39 PM
@all, exclude Blackberry fanbois
Blackberry goes on a patent lawsuit spree due to it’s failing handset business, now it needs to earn cash by being a patent troll.
Blackberry also claims that a particular ECC crypto technique has OpenSSL as an infringer as well. Talk about the absurdness and trolliness of a failing and sinking Blackberry ship trying to drag everyone down with ot before it becomes submerged.
One reason ECC is still not recommended for usage is even if the algorithm is secure by any chance (in a timeline where quantum computing is still not capable of making ECC ineffective), it has a ton of live patent minefield which is very hard to navigate. The safest would typically be the traditional Diffie-Hellman with DSA for signing but these days almost no one uses DSA.
0b-wand • August 4, 2016 8:41 PM
if you disrupt the monkeys from building their nest-egg you will probably find yourself in trouble.
monkey #438281 • August 4, 2016 8:43 PM
@Andrej
“Why We Hate You & Why We Fight You”
very much rings of “anonymous”
Thoth • August 4, 2016 8:54 PM
@Curious
It seems to be mostly about traffic analysis which @Clive Robinson always harp about. We have to wait until the presentation happens before we get more clue about it.
To prevent traffic analysis, you need to confuse others on the traffic size by not revealing the true length of the ciphered material via padding schemes. There are two approaches to padding with a fix length padding whereby you append x amount of pads according to a formulated circumstance and there is the other method which is the random sized padding scheme. The random sized pad scheme would have an upper and lower limit on the amount of pads to be used and from the upper and lower limits of the pad size, a random amount of pads of suitable sizes would be generated be added to the plaintext before encryption to give the illusion that the data is bigger than what it is. The benefits pver fixed size padding is under the condition when same sized padding can be used to determine a particular traffic and be used as a filtering requirement. The down side is the complexity to implement a dynamic padding scheme as care must be taken to generate the right amount of random pads to fill the plaintext before encryption on top of the usual PKCS 5/7 pads used in common symmetric crypto after key exchange has been done.
@Thoth,
DSA includes an ECC variant? Thanks for the recommendation on patent avoidance, are there any derivative works one needs to be aware of when modeling DSA?
Thoth • August 4, 2016 9:41 PM
@Figureitout
Groggybox file format for JavaCard smartcards have been updated to allow to now cover all kinds of cryptographic keying method ranging from hardware supplied, user supplied, hybrid hardware + user keying, multiple recipient mode (using public keys to add wrap symmetric keys for email and online transmissions) and also multiple recipient mode with user supplied KEK key. Five types of keying modes for a user ranging from paranoid to just want to get over (a.k.a convenience and all defaults mode). The encrypted file format headers are now obfuscated to allow slipping pass network firewalls.
Obfuscation is done by SHA-256 hashing over 1000 iteration of 32 byte encrypted blocks and then XOR-ed with header data. Pushing beyond 1000 iteration would make the smartcard crawl pretty badly while generating the obfuscation “boxes” (kinda like S-Boxes in crypto). When used for multiple recipient, 2 obfuscation boxes are generated so it turns out to have 2000 iteration of SHA-256 hashing of two different data sets. That’s as much pushing as can be done without turning the users impatient form generating obfuscation materials. It is only used to mitigate network firewalls and network analysis since if a network filter wants to catch Groggybox file format, it needs to essentially SHA-256 hash at least 1000 iterations per network packet to have a slight clue but against an APT threat, the hashing of 1000 iterations of SHA-256 would be trivial. Other algorithms are not considered (BCRYPT and such) since the codes need to be compact in a smartcard and the default would simply be SHA-256 hashing for now for obfuscation. I am currently contemplating a “header-less” mode to simply remove all headers but this will inconvenience the recipients as their endpoints need to work hard to guess the format without headers (reserved for extra-paranoia mode).
What it still lacks:
– Hardcore testing and optimizing codebase.
– Login PIN and self-destruct PIN (code feature suite).
– Secure channel from PC to card (core feature suite).
– Testing currently done with only a handful of multiple recipients and requires more multiple recipients to see if the codes holds up to abuse.
– Export and import of master symmetric key keymat and PKI keypair (for multiple recipient mode) (core feature suite).
– Desktop Java client.
– Android client.
So some way ahead for a usable and deniable file encryption format that can be transmitted over the Internet (via multiple recipient modes unless the user already pre-shared some symmetric keys).
@All,
Curious court case, USPTO v FCC over Copyright?
Cable set-top boxes and the FCC suggesting that on-demand and regular channels should be available to after-market devices.
They should probably open this one to public debate prior to battling it out in court, I haven’t read it yet though.
Thoth • August 4, 2016 9:46 PM
@r
ECC has a DSA variant called the ECDSA and is based on DSA but uses ECC. The problem is due to ECDSA using ECC maths, it becomes encumbered in patents and royalty crap pool which I have been very careful in not including any ECC into anything I do.
An an example, my encryption file format I am developing, Groggybox, specifically denies the use of ECC and has no provision at all to include ECC into it’s development and document lifecycle. I only support RSA 2048/4096 and DH 2048/4096 for any crypto projects I work on unless it’s business requirements (contract basis). DSA, being outdated and seldom supported on smartcards and crypto accelerator hardwares these days, are left out and in most cases close to being fully depreciated and replaced with RSA and ECDSA.
@Thoth,
Sorry, I see what happened.
I wondered why a hash algo would include error correcting code, you meant eliptic curve cryptography.
@Thoth,
“that a particular ECC crypto technique has OpenSSL as an infringer as well. Talk about the absurdness and trolliness of a failing and sinking Blackberry ship trying to drag everyone down with ot before it becomes submerged.
One reason ECC is still not recommended for usage is even if the algorithm is secure by any chance (in a timeline where quantum computing is still not capable of making ECC ineffective), it has a ton of live patent minefield which is very hard to navigate. “
This is what caused me to stumble, sorry about getting hung up on goppa++ every time I see ECC.
ianf • August 5, 2016 2:32 AM
From the
YOU’RE NOT GONNA LIKE IT ALL NOISE NO SIGNAL CONSIDER YOURSELF WARNED DEPARTMENT.
- High on heels of rrrrrrr‘s, Thoth‘s, and Wael‘s warnings about dangers of device/ browser fingerprinting, comes this from The Guardian:
Your mobile phone’s battery status can be used to track you online
[…] Intended to allow site owners to serve low-power versions of content to users with little battery capacity left, soon after [the HTML5 battery-level API] was introduced, privacy researchers pointed out that it could also be used to spy on users. The values of battery life in percents + these in seconds offer 14 million combinations, providing a pseudo-unique identifier for each device.
Suppose a user loaded their church website in Firefox, and then opened up the website for a satanic cult using Chrome via a secure VPN. Ordinarily, the two connections should be very difficult to associate with one another, but an [SPYING JAVASCRIPT PROGRAM CODE MASQUERADING AS] advert that was loaded on both pages at once [AND REPORTED BACK IN REAL TIME TO THE SAME DATA THIEVES’ DEN] would be able to tell that the two devices were almost certainly the same, with the certainty increasing the longer they stayed connected. http://gu.com/p/4pd5e
Well, well, I do say, for once something of use for the common good. I don’t mean the satanic cultists, they do groovy riffs, but… viewing a church’s webpage…? Already that borders on blasphemy of the gravest kind: WHAT DO YOU MEAN, CAN’T YOU ASK YOUR CHURCH’S MASTER “GOD” DIRECTLY????
(You CAN’T because mumble… mumble… or because that “god” is a figment of your sick imagination period.)
More such APIs I’d say.
Zuc • August 5, 2016 2:45 AM
Intresting blog post on Faraday cages. Perhaps the engineers already know this, but it seems that the ‘physics textbook’ explanations aren’t quite correct.
Wael • August 5, 2016 2:46 AM
@ianf,
or because that “god” is a figment of your sick imagination period.
Claim-based arguments are worthless.
ianf • August 5, 2016 3:59 AM
@ Wael
show me an argument, ANY ARGUMENT (in any field of inquiry) that isn’t “claim-based” (=tautology). The mere word “argument” implies a point of view. In fact, other than our ability to question our very foundations, we have no philosophical proof that WE ALL ARE NOT figments of some amorphous entity’s “imagination.” But even if we accept that we might be just that, there are degrees of SICK that that our imagination-within-grander-imagination can emit.
- Incidentally, was this your argument in defense of your “god,” or against this “as good as it gets god”?
PS. you just lost a stripe off your SIGNAL badge, maybe even several (Brunhilde has the details). Welcome to the club.
Clive Robinson • August 5, 2016 4:27 AM
@ Zuc,
Intresting blog post on Faraday cages.
Yes, engineers have known for some time for various reasons, think about how your yargi or Log periodic antennas work or for that matter the “elephant cage” Wullenweber antenna used for direction finding during the cold war,
Thoth • August 5, 2016 4:33 AM
@Nick P
Google is trying to play the higher assurance security game for Android kernel security by putting in memory protection via segmentation and other protection memory corruption protection mechanisms in Android Nougat.
Despite all the security efforts, the fact that Android is running a huge TCB is still a glaring security flaw. It would be nice if Google or someone could break the huge monolithic Android kernel and then implement a microkernel underneath the Android kernel parts and then run the parts of Android kernel as different microkernel userspace objects (similar to Qubes approach of segmenting parts if an OS to run on top of a Xen hypervisor).
This might allow the preservation of traditional Android system calls while still being hardened via only crashing a small subsystem.
The usual microkernel with multiple OSes running on top might be too resource consuming when compared to running Android kernel subsystems in userspace with a tiny core kernel TCB in priviledged CPU ring where pnly a single Android instance is needed.
Link: http://www.theregister.co.uk/2016/07/29/google_hardening_androids_linux_kernel/
Wael • August 5, 2016 5:35 AM
@ianf,
show me an argument, ANY ARGUMENT (in any field of inquiry) that isn’t “claim-based” (=tautology).
That’ll have to wait until @JJ comes back. I’m eager to witness his illustration of his claim or demonstration of his reasoning that: I am known to bring down without mercy the imaginary “realities” atheists are building for themselves.”! Who knows, he might “huff and puff” and blow your sick figments of imaginations into smithereens. If he’s a person of his word, he’ll come back with a reply by August 16th. If not, then “huff and puff” once or twice. Honker down… incoming …
The mere word “argument” implies a point of view.
How can you defend a “claim”? By your definition, claims aren’t defensible, or for that matter, even assailable! Therefore “points of view” with no supporting evidence or logic are worthless.
In fact, other than our ability to question our very foundations, we have no philosophical proof that WE ALL ARE NOT figments of some amorphous entity’s “imagination.”
What are the possibilities, and which ones are more probable? Give me your explanation to our existence, so I know where to bite you from 🙂
But even if we accept that we might be just that, there are degrees of SICK that that our imagination-within-grander-imagination can emit.
I haven’t accepted the condition.
Incidentally, was this your argument in defense of your “god,” or against this “as good as it gets god”?
Neither.
PS. you just lost a stripe off your SIGNAL badge, maybe even several (Brunhilde has the details).
Welcome to the club.
Not ready to join the low SNR club yet! Your invitation is much appreciated, though.
Curious • August 5, 2016 6:22 AM
Off topic: (Physics) (I have goofed around on youtube again)
Here’s an idea: Treating the same old notion of time as being an illusion for thinking of linearity as a concept, in which the motion of matter would be considered the mere propagation for the philosophical concept of time, instead of that, how about also thinking about time-as-an-inversion as a propagation for the mechanics of whatever way energy fields work, where, as I imagine, the motion of matter becomes a meaningless concept, this in turn have ‘time’ at micro scale being thought of as being the inverse of motion (an inverse of the act of creating references), in which symmetry is simply a product of non-symmetry, such that the forces of fields will propagate only from outside any and all frames of reference, for the (seemingly circular) reason that: in order for potential energy to exist, a limitation on mass is given by the speed of light.
I guess I am concluding that the speed of light as I imagine it, could be something of an illusion, in the sense of space-time-concept is limiting the calculation of energy as such (potential energy), because of how motion of matter (linear time) would be an illusion, given the idea that micro scale field forces is something paradoxical, energy rich, yet massless. Suppose the observable universe is generating energy from some turbulent non-dimensional field, being analogous to having an electrical appliance powered off electrical charges from an alternate current (Planck’s constant?), and that spin 0 particles only can “propagate” inversely, but can only be observed as en effect but in reverse (somehow a random effect), being an illusion of spin 0 particle moving linearly through what we usually think of as time. Suppose that inverse time can only be thought of as being imprecise echo’s, forever displaced in random locations. All particle fields being an effect from echo somehow. Using the AC power analogy, suppose one could create infinite power sources, by creating stable systems that could tap into some oscillating field, relying a means to create some kind of cavity that could invite echo (bose-einstein condensate?). 🙂
Curious • August 5, 2016 8:25 AM
“Apple, Intel, Google Employee Accounts Exposed in Data Breach of Developer Forum”
https://motherboard.vice.com/read/apple-intel-google-employee-accounts-exposed-in-data-breach
Hackers have stolen thousands of accounts from a developers’ forum, including some belonging to Apple, Google, and Intel employees.
I thought passwords were supposed to be encrypted when store. Even I know that. 🙂
Curious • August 5, 2016 8:33 AM
To add to what I wrote:
I guess the plaintext passwords referred to in the article above, might perhaps be just associative, as if having been added afterwards for the few thousand entries that was mentioned.
Thoth • August 5, 2016 8:36 AM
@Curious
You forget to put attention to this line:
“Motherboard was provided a SQL file of just under 3,000 accounts for the site. The data includes usernames, email addresses, plaintext passwords, sign up IP addresses and dates, and in some cases physical addresses.”
The passwords are plaintext. Not even attempting to hash them in any possible way, let alone encrypting passwords with a proper cipher.
About time to move away from passwords and start pushing FIDO UAF standards into web browsers. FIDO UAF standards would use PKI (ECC or RSA keys) to sign and autheticate request. There are hardware tokens (with USB interfaces, Bluetooth and NFC) ready to transit from passwords to PKI based FIDO UAF authentication but the problem is the browsers are too slow to push FIDO out.
For the server end, all they need to store is the user’s public key certificate that was used during registration and that’s about it. No need for CAs and all that cumbersome stuff.
I thought of creating a shim between the brower and the FIDO token but the hardest part is to access the TLS connection information per session tab for any browsers using legitimate APIs to browser function calls but apparently most browsers don’t allow such access to sensitive connections (which is a good thing) so the shim method to help get FIDO onto all browsers kinda fell apart for now and have to rely on the browser makers to carry on their efforts.
@Thoth,
“No need for CAs and all that cumbersome stuff.”
Don’t kid yourself, there’s a very real need for CAs:
Considering the alternative method you’re proposing consider them a backdoor with a sign over it that says “employees only”.
It’s to invite one’s self into an MiTM party with the strong systems you’re describing.
Additionally, the SHIM methods work just fine with a little elbow grease. If what you’re saying was true then there wouldn’t be TLS form injecting bank login malware.
Said companies, just ‘discourage’ it.
Thoth • August 5, 2016 9:35 AM
@r
Please read the specifications on FIDO UAF first when you are new to the topic. The guarantee of FIDO UAF does not need to the website to host a bunch of CAs other than storing public keys used during registration.
If your interpretation is the total removal of some form of CAs, then you have interpreted my words wrongly. What I meant as stated in the FIDO specifications is the website hosting the FIDO service does not need to host CAs other than needing the website to have a legitimate TLS certificate. CAs would only be hosted by those CA providers like GlobalSign and VeriSign.
Browse to Fig 1 in the beginner’s guide first and read the overview then continue reading the rest of the other 12 documents on FIDO UAF protocols and setup. It’s a lot to read but the beginner’s guide should give a good start.
The assumption is you need to have some command and understanding of secure element based authentication (SIM Cards, Smart Cards, Touch IDs, TPMs and the stuff).
How FIDO basically works in an overly simplified sense is you register the public key to the website, the website registers it in their database. The next time you call for an authentication service, one of the binding factors to prevent 3rd party forwarding the signed challenged is to include the TLS session as part of the binding during authentication thus ensuring that the TLS session is bound to the challenge and thus the user and the server within that session’s time frame thus preventing TLS MITM you can get into the session somehow. Read the specifications for more details as I am over-simplifying the security setup here as it’s much more complex than that.
What I am looking for is legitimate APIs offered by browsers, not manipulating memory or some non-standard options or illegal / insecure options. I could just as well inject and shim the TLS connection for the browser (especially with Mozilla Firefox and it’s SSLKEYLOGFILE system option) but that’s not what I want. A legitimate browser plugin talking to a Java application bridge for the tokens would be much better than getting some hackish methods that becomes unstable when the browser updates.
Link:
– https://fidoalliance.org/specifications/download/
– https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-overview-v1.0-ps-20141208.pdf (READ THIS BEGINNER’S GUIDE FIRST !!!)
@Thoth,
I will read the beginners guide, and thank you.
But I fully meant what you just illustrated, that the CAs above have the high ground in such cases.
Thoth • August 5, 2016 9:58 AM
@r
Just for a quick glance into it’s flow chart, look at Fig. 6 and 7 for registration and Fig. 8 and 9 for authentication. What they use for HTTPS/FIDO/UAF would be called TLS Channel Binding method. Of course just glancing at the charts would not give a bigger picture so if there is any interest, read all the 12 documents.
Also a bunch of slides by the FIDO Alliance (who governs the standards) for a quick overview.
Link:
– https://fidoalliance.org/specs/fido-uaf-v1.0-ps-20141208/fido-uaf-protocol-v1.0-ps-20141208.pdf
– http://www.slideshare.net/FIDOAlliance/fido-uaf-specifications-overview-tutorial
ianf • August 5, 2016 11:01 AM
@ Wael,
You want to embroil me in a you-said-I-said spaghetti debate over… something, and neither of us is even Eyetalian (oops!).
I’m not gonna let you embroil me in a you-said-I-said spaghetti debate.
In fact, I will bide my time, and then, perhaps, unleash my accumulated angst simmering in ire over how you embroiled some no-hoper in THIS PUBLIC spaghetti debate. He was leaving us, tail between his legs
“if you don’t want me back, feel free to say it.
I came in here and offered you a bad taste of myself.”
… and then along come you with your schpiritual schallenges! (Have you been drinking alcohol-free Absinthe? I hear it’s even more deadly than the real thing.)
“Just when I thought he was out, YOU pull him back in!” And now you use it as an excuse rhyme accidental for idling your brain in neutral gearbox metaphor intentional.
If the logorrhea-afflicted gent comes back, do you know what I already optionally licensed for utterance in your general direction?
(Hint: the last line of Planet of the Apes.)
was your argument in defense of your “god,” or against this “as good as it gets god”?
Neither.
I see. Both then.
Give me your explanation to our existence, so I know where to bite you from
Gimme, gimme, gimme—who do you think I am, dispenser of Wael-bitesize thoughtlets? (I’d have to get a microscope). As for “the explanation,” there is no explanation. We are stardust, but not golden. We come from nowhere, lead meaningless lives, exit to oblivion. And we should be glad for it, as any other scenario, us being some celestial Lego inside some other Minecraft, is beyond contemplation. The closest to the meaning of life is this paraphrase of something I found on the Internet:
- Life is like a giant sinkhole
at the bottom of which
echelons of disorganized goblins
sift through our thoughts
for clues to existence
Go, chew on that, here’s ???? the magnifying glass.
Wael • August 5, 2016 11:20 AM
@ianf,
You want to embroil me in…
You embroiled yourself! If you’re not interested in participating in a particular topic (OT), then you shouldn’t contribute a single post on it! I never started these topics, either.
(Have you been drinking alcohol-free Absinthe? I hear it’s even more deadly than the real thing.)
I stay away from the stuff, regardless of the alcohol content.
And now you use it as an excuse rhyme accidental for idling your brain in neutral gearbox metaphor intentional.
No need for idling beyond what I stated!
I see. Both then.
Whatever makes you happy!
As for “the explanation,” there is no explanation.
Then you shouldn’t be interested in the subject. If you ignore it, and the rest ignore it, you won’t see me forcing the discussion.
Go, chew on that…
Thanks but no, thanks!
Curious • August 5, 2016 12:54 PM
Uhm, guys, a trick to understanding disagreements is to keep it short and not start bickering.
tyr • August 5, 2016 7:17 PM
@r
Thanks for the RS-232 Lan link.
@ianf, Wael,
There is better poetry available for a pittance.
And worse if I start composing for you.
Wael • August 5, 2016 8:10 PM
@Curious, @tyr, @r,
RE: Bickering…
Certainly qualifies! Noted for future reference.
ianf • August 5, 2016 8:46 PM
@ tyr “There is better poetry available for a pittance.”
There is? Such that might leave Wael aga pe at the obvious artistry of it, hence unwilling to concede being able to respond in kind. Lay it on me.
- (And BTW what was so substandard about the p-sample I listed in response to his direct RFE2 [“explanation on existence”]?)
@ Curious, what disagreements?
Figureitout • August 5, 2016 9:37 PM
Thoth
–Looks like it’s coming along nicely. Docs/code look good. Probably could be written better but main thing is get it working first, then optimize/re-design. Pictures would be nice, screenshots or whatever. What you’ll need next is a “User Manual”. :p What do you use to build etc? I’d put the “paranoid” settings as defaults too (chaining AES->Serpent), just a preference of mine using security software first time.
Don’t have time to review more…But so long as crypto works we’d really have to dig into how info gets from A to B…I didn’t get to it this summer but I want more research in data diodes (I’m going to build the original design from discrete components, not like M.Ottela’s with optoisolator chips), so could (for PoC) take various $Protocol -> to Serial converter and would that work. If you’re using something like this it’s probably for airgapped PC’s to net PC’s so if you can isolate those damn comms, that’s where I’d settle security-wise for awhile for that area (file transfer via internet). For instance Arduino SD card’s, it’s SPI, not sure if a RS232 data diode would work inbetween there, I default to “no”.
Here’s a pic of my latest (quickie) project before school starts and I have to be forced what to do, Silabs_Detekt lol. Same simple concept, just want to connect a sensor and keep count. Who knew you could “brick” a board by changing a GPIO setting…almost ruined my night. I think I just shut off comms from chip to LCD though. There’s other more interesting projects to do w/ this chip besides security ones too. 64 bytes of FIFO data packet to work w/ too. Oh it has a menu! Just for you… :p I want a board like this for nRF_Detekt but it takes awhile to build that…Porting some crypto to it would take a little while. This is still short range (few kilometers) unless you have a huge antenna. And I’m willing to bet almost no schneier.com readers have the board too lol (which is why I like popular boards, boring if I can’t load someone else’s code etc.).
Wael • August 5, 2016 10:18 PM
@ianf,
what was so substandard
Nothing substandard about it! Well-written, clever word play, and pretty amusing, I mean it. I actually laughed hard when I read this reply, because I also thought: Let’s see what @tyr & @Curious got themselves into 🙂
Thoth • August 6, 2016 12:12 AM
@Figureitout
“Pictures would be nice, screenshots or whatever.”
That will be for the Java desktop client and Android client. Currently designing the GUI for the desktop. Usability would be the first class citizen there.
“I’d put the “paranoid” settings as defaults too (chaining AES->Serpent), just a preference of mine using security software first time.”
I have decided for the dumb smartcard version, it would simply handle AES to make it easier to maintain due to he quirks of the smartcards OSes. The paranoid and Serpent modes would be moved to Ledger Blue and Nano S where they give you more raw access to the ARM chip and better control. Javacard API doesn’t have that sort of flexibility I wanted.
Nice board. It would be nice if more community reaearch can go to data diodes. These research info are useful for building future high assurance schemes with greater ease.
Scott "SFITCS" Ferguson • August 6, 2016 12:56 AM
That only comment I’ve seen him make about the location of his posting habits was his reference to switching public transport systems the other day.
I’ve been following all of his posts since he started posting to this forum. Perhaps you didn’t read/comprehend all of them.
His misspellings(?) are somewhat distinctive, my somewhat educated guess is that he often writes while walking and that he uses a Blackberry phone.
You may want to drop the whole “SFITCS” thing, it leaves a slime trail.
From the linux foundation on the topic of UEFI:
Great stuff!
Many thanks for your work and I look forward to using it with a portable Debian utility over the coming weeks (as time permits).
I know a lot of people are opposed to the idea of UEFI – I strongly support it, my only misgivings (strong concerns) are about the “vendors” role. Kudos to those concerned for getting the keysigning sorted.
eg. You’re A-OK with corporate entities holding the keys to your empire, you sir – I do not trust.
- [sigh] I’m not trying to hide my identity. Quite the reverse.
- Your ability to understand what you quote (even out of context) is exceeded only by your Google-foo. You’ve been nominated Sophist of the Year for not letting ego or ignorance of UEFI stop you from publishing your opinion – it so advances the security field. (Fortunately your lips got too sore from reading to see the more damaging post I made further down that page.)
tl;dr I am astounded by the ability to “interpret” such a short quote – are you a professional intelligence analist? Such “sleep of reason” must knit some “interesting” garments – much needed romper-suits for atrophied squid and such-like.
<
blockquote>Look at the next sentance of that post.
[gently] I had.
An IP address is not proof of the identity of the poster. No kind of “server logs” is going to change that, at best they would only confirm that the poster appears to be sending from the same device, and maybe, the same IP address (or same allocated pool of portable addresses). I would be very surprised if Bruce, or his chosen staff, would mistake that for proof.
@thoth – sorry, somewhere you made a reply about radio which I can no longer find in the vast flood of recent comments. Not that I know more about the subject than the difference between aerial and antennae.
@Scott Ferguson,
You’re right, of course. Thank you again.
The thing you’re mentioning here about Clive and blackberry, through all the garbage I spew here I’ve started to wonder if you can’t draw conclusions as to someone’s particular device from their keyboard emissions. Swype-able ones leave distinct mispellings and insertions/substitutions too.
Thoth • August 6, 2016 7:06 AM
@Scott “SFITCS” Ferguson
I hardly ever track my posts either 🙂 .
Dan3264 • August 7, 2016 8:04 AM
@Scott “SFITCS” Ferguson,
Good point. It is so convenient to make a few(or very many) assumptions about the integrity of technology. I treat my computer as if it isn’t compromised, even though I have no way of knowing if it is compromised. It is useful to treat IP addresses as ‘proof of sender’ (even though I know it isn’t). That assumption only breaks down when there is a targeted attack(which is a bad time to fail). I think it would drive me crazy to treat absolutely everything as fundamentally untrusted. I can understand how I thought when I treated IP addresses as ‘proof’. I hope you can to.
Scott "SFITCS" Ferguson • August 7, 2016 10:05 PM
<snipped>It is so convenient to make a few(or very many) assumptions about the integrity of technology <snipped>
Not just technology. It’s that “trust” thing that our host has covered more thoroughly and eloquently than I can. It seems to the only way to do it properly (and avoid cognitive dissonance) it to differentiate between how much you trust the plumber and the babysitter. Just as the plumber might trust your cheque(check) for a washing machine repair, but require you to put your credit card details on the back when it’s a cheque for re-plumbing an entire house.
tl;dr The moderator might require less proof to warn a poster than required to target a donation recipient.
Whether identity theft is more likely for financial advantage than ego, or which causes the greatest harm is a subject of interest (to me). Especially when I consider how little effort people (in general) put into identifying themselves (using crypto proof), and how much effort entities put into making that hard to do (e.g. allowing crypto proof in forums, requiring proof of ID to be sent by unencrypted email, using SMS as dual factor proof, trusting faxes etc).
While it may seem unconnected – I suspect it’s not. “We” want to trust our “intuitions” – it’s a major human bias/failing. Question someone’s intuition and you’ll usually feel their anger, ask them to test it and see an irrational investment of energy in avoiding the test. Which is why the media so value pictures of criminals looking dodgy – they like to keep their consumers happy.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Mike Barno • July 29, 2016 4:34 PM
Glow-in-the-dark finger tentacles are sure to be a boon for the Japanese porn industry. Watch for a new tag on xHamster, XNXX, PornHub, etc.