Schneier on Security

Clive Robinson • April 4, 2021 4:31 AM

@ Matrix,

With respect to,

https://blog.can.ac/2021/03/22/speculating-x86-64-isa-with-one-weird-trick/

@SpaceLifeForm brought it up March 25, 2021 3:11 AM,

https://www.schneier.com/blog/archives/2021/03/friday-squid-blogging-squid-cartoon.html/#comment-371417

In part in response to a conversation we were having where I described part of the underlying problem on March 22, 2021 11:22 PM

https://www.schneier.com/blog/archives/2021/03/friday-squid-blogging-squid-cartoon.html/#comment-371280

In part it is as a direct result of the Marketing “Go faster Stripes” mentality that has come out of Intel for one reason or another for many decades.

As the article notes Intel have an overly rich CISC system at the CPU ISA level, but in reality dropped the internal CISC von Numann architecture for a RISC Harvard architecture a very long time ago.

Thus the reality is the actual core CPU of registers and ALU are but a tiny fraction of the design. With in effect multiple state machines surrounding the RISC Harvard core, with branch prediction and other logic using massive resources to get a few percent at best more performance.

So much so that some of the state machines are Turing Compleate by design, but others accidently so, due to the complexity of the interaction of the CPU addressing and physical addressing of system memory.

The “go faster stripes” mentality is what has given us the joys of those low level hardware faults like Meltdown and Spector that to solve require not just major changes in the low level “Register Transfer Language”(RTL) that underlies even the most basic of microcode, it more importantly takes ten’s of percents of ISA level performance away from the user.

But there is a more interesting effect which is in part why those high resolution timers exist…

The Ia32/64 architecture is not fully determanistic in performance due to two main areas,

1, Cache Memory control.
2, Branch prediction control.

For example, take two basic instructions that read from memory and put the result in their own register. It should not matter what order you perform them in the number of CPU cycles should be the same. But due to cache issues they may well not, that is just reversing their order in the code has side effects at the cache level.

But worse rather than read from a memory location if the instructions read from registers… The same issue arises this time with branch prediction…

So to get a real measure of code performance you actually have to profile it in the CPU with those timers…

It’s this second issue that is being used to instrument the CPU instruction decode state machines to find out which instructions are,

1, Valid but undocumented.
2, Invalid and treated as such.
3, Invalid but treated as valid.

So not all of those “undocumented instructions” are valid by design, some are artifacts of design changes and the like that have not been cleaned up properly.

Which leaves the interesting prospect of the “side effects” of that third set of instructions, those that are not just undocumented but invalid but are treated as valid, and can those side effects be vulnerabilities in potentia…

Personally I think they can, Meltdown and Specter were “The Xmas Gifts that just keep giving”, undocumented invalid instructions that get treated by the CPU as valid are potentially “The Bunny that keeps giving Easter Eggs with sharp teeth”. After all not all eggs give cute fluffy chicks, some hatch crocodiles with realy shap teeth, others give forth a nest of snakes…

But as I’ve repeatedly noted, there are many other nasties that exist below the CPU level in the computing stack”. We’ve known about some such as Direct Memory Access(DMA) unit issues since before the 8080 and other 8bit computers were affordable[1].

Likewise the issues that alow “reach around attacks” like RowHammer and similar to work at the high level software levels on the computing stack, but act on hardware way below the CPU level, that the underlying mechanisms have been known about from before the days of the 1802 processor back in the first half of the 1970’s…

And as I found out with the 1802 it was not just “cosmic radiation” that caused problems, you could also make active attacks using not just EM Carrier Wave(CW) signals but those that were effectively Amplitude Modulated(AM) by amongst other things Pulse Modulation such that you could reliably and repeatedly cause a change in behaviour of the CPU.

So I’m fully expecting quite a few more attacks at below not just the CPU ISA level, but at further down the computing stack. In almost all cases the attacks alone will only make very basic bit changes and the like. But as RowHammer was later to show, if you can change just one bit in the page table for the MMU functioning, then the kernel code becomes available to user level code. It’s why I call such very low level vectors “bubbling up attacks” because like bubbles in a glass of Champaign, they start from nothing with the most primitive of changes, and as they rise up expand into way way larger things, those bit flips become major security vulnerabilities.

Currently we have no commercial computing systems that can defend against bubbling up attacks, which is why they are going to become bigger and bigger news as people start to investigate below the CPU ISA level in the computing stack…

There are ways to design hardware to solve such attacks, but they only go a little bit down the computing stack, “So move not solve the issue”. I know of other ways (search this blog for C-v-P) but they are a major design change I can not see the likes of Intel wanting to develop.

[1] Back in the early 1980’s when I was doing my first serious computer design job using “bit slice processors” and the like, I had the job of making sure the very high speed DMA from I/O did not cause issues. It was as part of a disk array design that was not only patented, but working but being sold, that also did all the things and more, half a decade before the team at University of California, Berkeley claimed “RAID” in their paper published in 1988 as “A Case for Redundant Arrays of Inexpensive Disks (RAID)”. The annoying thing is that all though the patent was granted, we were later told that “it was to obvious an idea” thus we would loose if we chased royalties in the US or Far East through the courts.

Clive Robinson • April 4, 2021 6:10 AM

@ Fed.up,

I always knew those cookies were magic.

And all in 60 days, that must be one heck of a merit badge…

More seriously though STEM suffers from a lack of women, not because men are brighter, or any other nonsense like that, but because,

1, The money is not good.
2, STEM is made dull and uninteresting in education.
3, The HE environment is not welcoming.
4, The work environment is not welcoming.

Whilst STEM is starting to change, the fringe parts such as those to do with IT are not, in some cases they are getting worse.

Basically IT tends to attract “non nuero typical” minds as engineering in general still does, but IT rather more so on the higher level of the scale.

The prevelance of Non-NT in the general Western population is about four times that in men than it is in women. More so in those areas that ICTsec tends to cover.

For NT people especially “those who network” etc being in a crowd of Non-NT people can be way more than annoying it can be highly stressful.

Especially with a group of people who can do the seemingly impossible routienly, but trip up over simple social conventions. Like the linguistic convention of “Don’t you think it’s…” they will take it at the language level, not the social convention level and give you a yes or no answer, rather than see it as a hint or order to do something. The fact that quite a few Non-NT people “Can not make heads nor tails” of “raining cats and dogs” or similar with both confusing them straight off can bring those who are outwardly as opposed to inwardly focussed to a “screaching halt”.

Let’s just say that all social conventions are not generally a strong suit when it comes to Non-NT people, and that is problematic for many NT people not just those who are outwardly focused.

There is a fun but true story that has become apocryphal on the retelling, and I’ve actually worked at a place where something similar almost happened.

As many know the EU has become rather strong on environmental issues, especially the wastage of energy, the UK especially so. Thus you might have seen “motion sensor lighting” in toilets and corridors, closets or sometimes other areas including meeting rooms. Usually there is no “on/off” switch with such lighting, because “why have an off switch when it will turn off automatically?”…

But there are occasions when you need to force the lights on or force them off, meeting rooms being one where forcing the lights off is required, so that “Death by viewfoil” can be inflicted on meeting participants, after all you don’t want the lights to come on because you yawned do you 😉

Well the company I was working for two decades ago moved into a “new build” office block in Trendy Chiswick West London, and it had all sorts of features like a hydrolic lift system solar foil windows and many other green ticks on the environmentally friendly check list. Part of which was “motion sensor lighting” without off switches in meeting rooms…

However unlike the apocryphal story we got the problem fixed in a few days, and cracked a few jokes about being a tough stoney faced audiance as we all had to play a game of statues.

In the apocryphal story, a company elects not to fix the problem thus in presentations given by outsiders when they ask for the lights to be turned off they get told “If you stand very still the lights will go off in a minute”…

Usually the story teller means for you to think that “All the employees think it’s the way to do things, so are weird Non-NT types etc” (forgetting a more rational argument that “managment don’t want to spend the money” as it does not effect them 😉

But it’s stories like that which are the thin edge of a rather large wedge that puts people off of working in STEM for Tec, ICT, and Cybersecurity companies.

Clive Robinson • April 4, 2021 7:16 AM

@ John Cochran, ALL,

Best question to ask “Intelligent Design” proponents.

I generaly find not talking to Creationists, Flatearthers, etc is the best thing to do unless I’m in a particulary sadistic mood (though Pastafarians are generally good for a laugh 😉

Parasites come in many flavours with interesting life cycles.

For instance those like tapeworms who need two sepeate hosts, where one host spiecies eats the other. Generally most people finding out about the parasites in swine/pork flesh puts them right off eating meat (untill they next smell bacon cooking and going crispy 😉

But that life cycle makes eveloutionary sense, much as fruit with seeds that need stomach acid to enable them to germinate.

But to me the mind blowing parasites are those that not only grow inside a host creature by consuming it they then turn the host into a slave zombie, and own it and drive it to it’s death. On this blog before @Bruce has brought up the subject of a mold that attacks ants, makes them climb up grass stems, thrn erupts from their heads. And I’ve mentioned the lava in snails that grows and gets fat off of the snail flesh, then works it’s way into the snails left eye stalk and starts to pulsate, as well as causing the snail to climb up a grass stalk etc, so a bird will see the pulsation and think it’s a juicy caterpillar and byte the snail and eat it or just the eye stalk. Strangely if it’s just the eye stalk the snail returns to it’s ordinary habits, and if it gets the same parasite again later, the new parasite crawls up the right eye stalk and the process is repeated…

Sometimes however the poor mollusc has more than one parasite at the same time,

https://m.youtube.com/watch?v=15WD1K-nGf4

And this is the jeweled wasp doing it’s thing to a roach with two jabs of a neuro toxin,

https://m.youtube.com/watch?v=-ySwuQhruBo

But there are worse out there including “toxo” that is believed to effect human brains,

https://m.youtube.com/watch?v=uvdiYg6ZN-U

Try discusing these with any strongly religious person will almost certainly make the queasy 😉

Oh and something everyone should remember,

“Man made God in his likeness, not the other way around, so what does that say about mankind?”

I think various observers in the US especially are waking up to this realisation.

Clive Robinson • April 4, 2021 10:22 AM

@ Czerno, name.withheld, weather,

… that yielded back a ‘403 forbidden’ answer from Google, as reported. Google has many servers and content-delivery networks worldwide AIUI, maybe this is why the curl command gets thru some and not others ?

You are about on the money.

@ ALL,

Google have decided for their search engine to enforce the EU’s GDPR “their way” or more precisely “their way or no way”.

In essence you have to send back not just valid cookies saying you’ve groveled on your knees and sucumbed to their button, you also need to have both the right “post” and “get” tags in your request without which you get the 403.

From experiments, there is a way to get some very limited service from Google’s search engine, and that is by pretending to be a Chrome browser with a failed URL. You get a response because you’ve handed over their coin of profit “information” about what you were searching for.

Whilst other Google services still work without pressing their button, you have to know what combination of browser settings to use.

Which means that whilst curl works for very many services Google is working hard to stop you getting any kind of anonymous service, if they can force you otherwise without legal risk.

I’ve used curl, wget, lynx and one or two others in my time including netcat, Perl and telnet, the world has grown in the meantime and certain people are determined that their “might is right” and come what may they will have supremacy at no legal risk…

So the tool I’ve used of more recent times is Python, yes I know it’s half a DVD of interpreter and libraries but it’s quicker than edit-compile with C to test things out as a “RAD” method.

Though I kind of expect Python to go the way of Perl in the not to distant future it’s showing many of the signs and symptoms.

Oh with regards “echo ” or “echo ../“, yes it uses the shell to expand it to match all the file names. It’s kind of handy to use when you are in some kind of striped down system or the drive with ls and the like has not mounted. It’s realy usefull when you are developing embedded systems where you get init to just kick off the sh program.

Clive Robinson • April 5, 2021 7:07 AM

@ Who?

Have we talked about this new TrickBot feature before?

Not as part of “TrickBot” but as I’ve pointed out in the past, the fundamental reason it happens goes back more than four decades to the late 1970’s and the Apple ][ computer design. Basically the Open I/O model for hardware is the root of the problem and it’s not going to go away any time soon (if ever I hope).

The Apple ][ Open I/O model was so successful that the idea was adopted/stolen by the team that did the skunkworks stuff that gave IBM the PC in the 1980’s. Which as an unfortunate result made both Intel and Microsoft the nemeseses of the Western World, and with the advent of Flash ROM, more recently the joy of malware writers… (but it could have been worse).

Whilst just about any engineer that had designed a hardware card for an Apple ][ or IBM PC/clone pre PCI bus could not avoid noticing the glaring security hole it created, but it did not get spoken about very much because back then ROM’s were realy Read Only, and networks had not got even close to personal computers. In fact this glaring security hole only realy surfaced in the ICTsec mind around the time of BadBIOS[1] and a couple of years later Lenovo using it to deliberate backdoor the BIOS of consumer grade laptops[2] back in 2015.

The ICT industry had not just been in denial, it was actively policed by the “NIH naysayers” who vigoursly attacked people with an avalanch of “Not Possible” and “You don’t know what you are talking about” postings often under non attributable handles (you can still see some on the blog). Who mysteriously disappered when the case was proven and shown to go back to the Apple ][ in the 1970’s and it’s clear path still in Microsoft documentation to this day.

So 2013 to 2015 the message started getting through to people BUT… as is typical of the ICT industry and in particular ICTsec it’s almost be compleatly forgoton again[3]…

So I guess this addition to “TrickBot” is a good thing in that it’s acting as a “Wakeup Call” to maybe stop much of the ICT industry “SleepWalking into another Nightmare of it’s own making due to not studying it’s own history[3]…

The problem is actually in effect unsolvable in a truely “Open Specification” due to not being able to have a “root of trust” in the earliest part of the BOOT sequence. This is because of a “chicken and egg” situation which originally was not an issue due to actuall PROM and EPROM usage but fell compleatly appart security/backdoor wise with Battery Backed RAM and later Flash ROM came to be standard.

The problem is this,

When you design an Open I/O system you have no idea what new or inovative hardware will be thought up tomorrow let alone a year or two down the line. With all inovative hardware you need software such as device drivers to match it into the hardware I/O and then later OS systems. This software needs to be available very early in the BOOT proces in system memory otherwise the hardware can not be accessed. This is especially true for main secondary memory systems such as hard drives that contain the OS etc. So you can not read the OS drivers off of the hard drive because the computer does not have drivers in it’s system memory to access the hardware to read the hard drive. Therefore you need a leaver loader process to get basic drivers into system memory. But there is no way driver software can be built into the BIOS with Open I/O systems. So you need a mechanism where the driver code is put into system memory prior to actually being required for booting… This is done by putting what was immutable ROM on the I/O card holding the driver code, and have it appear at a fixed location in the system memory map. The BIOS then looks for the ROM on each card and moves it into a different area of System memory that is RAM, hooks it’s routiens into the Device/interupt tables etc, then switches the on card ROM out of system memory.

For this system to work though, both the BIOS and the OS need to respect and not overwrite the I/O Card code that has been loaded into System RAM. Thus any broken or malicious code makes if from the Card ROM all the way through the boot process and bringing up of the OS lurking in the background waiting to be used in some way…

It just so happens that with conventional ROM that stored both the BIOS and I/O card drivers they could not be –easily– overwritten, unlike the use of modern Flash ROM where it’s near enough childs play to do so unless you take precautions. So you now need a second mechanism that provides a “Root of Trust” (which is as bad an idea as “walled Gardens”). In effect the solution is “code signing” of the ROM code. Fine for the BIOS ROM but not for the I/O Card ROM in an “Open Specification”…

I won’t go into details there are other readers and occasional blog posters who are way way closer to knowing the intimate details of UEFI but in essence for use as a “root of trust” the code signing needs to be done via a chaining method not to disimilar to the PKI CA infrastructure, which is far from “Open” and would put way to much power in the hands of those that have already proved themselves to be compleatly untrustworthy (hence it’s a bad idea).

As I’ve noted many times this problem is not going to go away any time soon… Because who want’s to give Intel or Microsoft more “locked in” control of computing or for that matter Far East chip manufacturers that might be as in the US rather to close to their counties security services?

[1] BadBIOS from 2013, https://en.wikipedia.org/wiki/BadBIOS

[2] Lenovo UEFI backdoor from 2015, https://www.techworm.net/2015/08/lenovo-pcs-and-laptops-seem-to-have-a-bios-level-backdoor.html

[3] Yes I know I keep banging on about this ICT “not learning from history” even living history (which it mostly still is). But this TrickBot is just another example of “give it less than a decade and the attack will work again”… In this case it’s only been half a decade since the Lenovo BIOS back door hit the news big style, but it all appears to have been forgoton… In short Lessons are not being learnt and everyone feels the pain.

Clive Robinson • April 5, 2021 6:29 PM

@ Anders, Who?,

Yes, we talked about it.

It was for months ago almost to the day… which is interesting in of it’s self. That is why has it taken so long to become more recognised?

As I said above, it’s not something that is going to go away any time soon if at all, so it might be “slow burner syndrome” getting to the point “it has passing the exponential knee”.

As I said it’s a double whamy of “chicken and egg”. That is we need the non-lockedin “Open I/O Specification” but likewise we very much need a “Root of trust mechanism” and those two are currently very much at odds with each other.

In the past to change real “read only” ROM, PROM, EPROM and similar required either taking the chips out or changing pin/jumper setings on the motherboard. With the advent of the various “electrically erasable” EEPROM etc technologies, whilst “rework costs” in manufacture and subsequently have dropped dramatically, so has security dropped dramatically as well, and it is definitely “causation not correlation”. Flash ROM in particular is so ubiquitous very very few actially know where all of it is in a modern PC and even if they did there is nothing they can do to stop it being altered.

It’s this lack of knowledge, combined with lack of ability to stop BIOS and I/O ROM and that Flash –tucked away in nearly all SoC microcircuits– being changed, that has become a nasty problem that is only going to get worse by being ignored.

In theory there are “software locks” that can be used. But design experience has taught me that “software locks” are like verbal contracts “not worth the paper they are written on”.

It’s something I’ve been going on about since the last century with “Security Tokens”. These things need to be both mutable for manufactuer / maintenance “rework” but immutable at all other times. The only advantage with security tokens is that being “locked-in” to one hardware supplier is not realy much of an issue currently[1], so they could in theory use “code signing” as we currently have it. Except the history of “games consoles”, “TI Calculators” and “set-top boxes” tells us that given even quite short periods of time such protection methods being essentially software will get bypassed.

So it can be seen that even if we come up with a beter solution than “Code Signing” that we realy desperatly needed way more than a decade or so ago, there can not be a “one size fits all” solution.

But even with “physical interlocks” such as PCB jumpers, we still have another issue, which is the lack of sufficiently secure and usable “tamper evident” systems. Whilst our host @Bruce has a sticker on his laptop indicating it is effectively a weapon of destruction. I somehow do not think he follows the old military maxim of “Eating, sleeping, drinking, etc with his “personal weapon” at all times”.

Thus varieties of unatended “Evil Maid” attacks become an increasing reality, and effective and reliably secure tamper evident solutions are needed, which we just do not have. For instance quite a few clever people thought long and hard about securing drug test samples from athletes, but we have good reason to believe that various Russian entities know how to quickly and easily get around them. How, we do not know, but the betting is once it is known, it will be a simple and obvious defect exploit that was not considered during the design phase. Similarly as many Truck Drivers have found to their cost, “People Smugglers” have found ways around all the fancy security systems used on lorries, trucks and trailers.

Security except in a few cases is a hard problem, a very hard problem, and anyone saying otherwise is shall we say “lacking” in more ways than one. But designing an effective security system that retains all the advantages of an “Open I/O System” I suspect is going to be a considerably harder problem, for which we currently have no idea how to achieve, nor will we do so for some time to come.

[1] Actually not true, as they are becoming an identifier to “Single Sign On”(SSO) systems where the user has no control over the “service covered” database in the SSO servers. Thus the person who controls the SSO database is the person who realy does have “The Keys to the Kingdom”. It does not have to be that way you can develop SSO systems that work differently… But it’s shall we say “Not in the interests of the SSO service providers to do so.”

Clive Robinson • April 6, 2021 8:01 AM

@ SpaceLifeForm,

Regards “All Floc’d up” by Google, a curious point from the EFF,

“Turning off third-party cookies is not a bad idea in general. After all, cookies are at the heart of the privacy problems that Google says it wants to address. But turning them off altogether is a crude countermeasure, and it breaks many conveniences (like single sign-on) that web users rely on.”

I’ve been saying turn cookies off for a very long time, likewise JavaScript. But I’ve also pointed out the “Arbiter In The Middle”(AITM) systems of which SSO are just one of hundreds are bad news in very many ways, for almost as long.

Which is why I’ve been trying to find a way to replace them with a new form of “rendezvous protocol” to replace the likes of “Forced DNS” and similar that Google has lumped on people for decades.

Just about every thing Google and it’s parent Alphabet do has a very solid heart of psychopathic evil in it. Mostly their behaviours are carefully planed and can be likened to the behaviours required by someone not only giving a Type I diabetic child a sugar laced Easter Egg transfered into the wrapping that says it’s sugar free, but also planning to avoid all consequences coming back on them should things be investigated.

Clive Robinson • April 6, 2021 6:28 PM

@ Fed.up, ALL,

I am buying the Honeywell noise cancelling Covid mask. Ingenious. The world is so much easier to deal with in silence.

I note it’s in part “hard shell” that will,

1, Reduce ability of face recognition.

It also contains HEPR filters that will,

2, Reduce the effects of CS and other dibilitating agents used by Law enforcment.

Perhaps I should chat to Wil.I.am about designing RF proof jackets with micro fine woven copper or silver cloth lining, backed with Kevlar which will,

3, Stop hidden “nudy scanners” working.

4, Reduce the chance of your RFID cards being read.

5, Stop the average tasser shot dead in a short circuit.

Something tells me LEO’s are going to be getting quite twitchy about what COVID will do to reduce their technological lead.

Clive Robinson • April 7, 2021 5:38 AM

@ ALL,

If you also want to avoid “cookies and javascript” usage but find out a little more.

Strip the last part of the Slashdot link off and replace the hyphens with spaces and drop it as a search string in DuckDuck. You will find several links to the original story.

This one worked first time with both cookies and javascript turned off,

https://japantoday.com/category/tech/cosmic-rays-causing-30-000-network-malfunctions-in-japan-each-year

The reality of Slashdot is it’s a “cabbage reboiler site” and most of what gets put up on it comes from other sites, that are not so determined as Slashdot is to make your browsing process insecure.

My advice give Slashdot a big thumbs down and go elsewhere. Maybe if enough people say “Sayonara”[1] to them.

[1] Sayonara is often the first word non native Japanese speakers learn… Problem is it’s rarely used as it means rather more than the Western notion of a simple “goodbye” or just “bye” (many younger Japanese have taken “bye bye” as their own),

https://livejapan.com/en/article-a0002834/

Clive Robinson • April 7, 2021 8:49 PM

@ Wesley Parish, ALL,

I just love the irony in the last paragraph of the Vice article,

“But maybe everyone whose number is listed in the leaked database should follow Facebook founder and CEO Mark Zuckerberg’s lead: Zuckerberg uses the highly secure messaging app Signal, which isn’t owned by Facebook.”

Somebody is not prepared to “Eat their own dog…”.

Clive Robinson • April 8, 2021 10:48 AM

@ name.withheld…,

I likely know that you know where I come from in regard to the InfoSec hat I wear

There have been a few small pieces over the years, not enough to finish the jigsaw, but enough to see what the picture probably is, thus maybe find the box with the rest of the puzzle pieces.

Like you,

I wouldn’t be here if I didn’t think there was a possibility for improvement or constructive and valuable conveyance of thoughts and ideas.

Sadly as I get older, I see more and more that technology is used to abuse people in various ways, not least of which is the new “class distinctions” which indicate the level of privacy to which you have access.

I suspect that like me you fall below the “class” where privacy in effectively inate, thus have to work at getting what privacy you can by aquired skills not by fourtune or by inbred birth right. To quote the words of the song,

“It ain’t me, It ain’t me, I ain’t no senetors son”[1]

I am not fortunate, apart from an inheritance of part of the house I was born in, I’ve worked not just for what I have but the knowledge I’ve built up.

Whilst I’m not financially altruistic, I do give freely of what I know and where I can my time. The reason is the old saying,

“Give a man a fish and you feed him for a day, teach him to fish and he feeds himself for a lifetime”

Nobody was around to teach me to fish when I was orphaned, I had the pain of learning to fish the hard way. If I can cut the pain for someone else, then hopefully they will pass the knowledge on and there will be less pain in the world, and more knowledge, neither of which I think is a bad thing.

Other people I know disagree but then I don’t happen to think their morals, ethics or behaviours are good for society. As I’ve said rather more of more recently people have choices and thus the question of “Personal rights -v- Social Responsability” arises and much as many think they do not need the support of society as COVID has pointed out, they very much do. In short society is what floats everybodies boat and enables them to fish, so they can have a life where rights have meaning.

That view is not Socialist or Communist or any other of the purjatives some like to shout out when they feel the wrongness of their parasitic existence of self entitlement threatened. People should where they can chat to the grandparents or grandparents to learn about social responsability and the rewards of helping thy neighbour. After the war my parents barely survived, and it was the kindness of ordinary people in the US sending food parcels over to the UK that kept them alive, whilst the politicians just… Well people should look at the history shortly prior to the Marshal Plan, lets just say it might be informative.

[1] https://www.songfacts.com/facts/creedence-clearwater-revival/fortunate-son

Clive Robinson • April 8, 2021 6:21 PM

@ SpaceLifeForm, Weather,

Sorry for the confusion. Clive mentioned ICMP, so I was just pointing out the ICMP Tunnel issue.

My point was that too many organisations ignore both DNS outbound and ICMP outbound pacjets effectively alowing both to go without checking them in any way, as well as in effect ignoring inbound ICMP packets as well.

Yes ICMP gets dropped by some routers and it realy should not because it can cause problems when using tunneling protocols where say IPv6 gets tunneled across an Ipv4 network[1] or a full size packet tries to get tunneled into another packet something has to give be it TCP, UDP, or GRE, often ICMP is the only way a router can send back a message to the originating host to reduce the MTU.

The problem with ICMP is realy historical, and goes back several generations of routers and Hosts, when there were network attacks that could exploit these historic failings. These old attacks were used for creating a means of Denial of Service disruption / attack such as the ICMP flood attack, the ping of death attack, and the Smurf attack.

From memory the trick used the failing of the assumption of a “Network Address” as opposed to a “Host Address”. So if you pinged with a spoofed network address a reply would get sent to every host address in that network range. As ICMP is not a connection oriented protocol spoofing was relatively trivial.

But hosts should nolonger respond to network addresses and propperly set up routers should stop any spoofed packet leaving a network. But do neywork Admins do this? Well lets just say “it depends…”.

Needless to say I try and avoid getting my hands dirty at layer three and below with the Internet these days, life is to short and the pay not large enough… At one time I got so frustrated I had the notion of writing a book called something like “Shooting yourself in the pes with a network protocol whilst swinging from a network cable neck tie”. Apparently according to an editor I worked with at the time, the title was not snappy enough.

Mind you the world has turned for the worse… If you want a security nightmare to consider look up the “Seamoby” “Candidate Access Router Discovery”(CARD) protocol. Thankfully it is still in the experimental stages and the protocol is outlined by RFC 4065 and RFC 4066. Overly simplistically it’s a way for wirless networks to discover adjacent wireless networks by asking the mobile devices what they can hear at their current location… Or how to turn everything into a location beacon… I can see certain Google types getting all hot and enthusiastic over it as in theory it could unmask networks that do not broadcast their presence.

[1] IPv4 and IPv6 do not play nicely with each other when it comes to errors. ICMP thus comes in two flavours so far. For IPv4 it is defined in RFC 792, whilst an entirely separate ICMPv6, for IPv6 is defined by RFC 4443. Bridging ICMP error messages from tunnels can be a frustrating experience and some avoid it by in effect breaking other functionality like deliberately making the MTU short for all packets. Worse “Path Maximum Transmission Unit”(PMTU) works very differently on IPv4 where fragmentation signalling by routers is alowed to IPv6 where it is not and only Hosts get to play.

Clive Robinson • April 9, 2021 3:18 AM

@ ALL,

Apparently yesterday evening WhatsApp, Instergram etc were down,

https://usa-sciencenews.com/2021/04/08/facebook-instagram-and-whatsapp-appear-to-be-experiencing-issues-as-thousands-report-outages/

Did anybody notice?

I didn’t but then I don’t use them or other social media.

Clive Robinson • April 9, 2021 8:28 AM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter,

A little more on the rare type of blood cloting and COVID jabs.

Firstly it needs to be noted that these rare blood clots with low platelet counts have do occured in the population long peior to covid. Whilst no definitive causal relattionship has been found due to their rareity, they have been associated with women on hormone medications, that is the oral contraceprive and HRT.

Secondly and importabtly similar problems are starting to be seen in not just the AZ vaccine but the Pfizer mRNA jab as well.

If this turns out to be confirmed then there is the distinct possibility the same will be true for the Moderna mRNA jab as well. As for other vaccines well, they are in the main not being administered in Europe so we don’t have data. As for the US what data they do or do not have is publically unknown.

Denmark suspects the issue is to do with the vaccines been given incorrectly such that they go pertially or fully into a blood vessel. What the EMA and UK agencies think about this is again not public information, and it has not been mentioned in any official communications to the public.

As I’ve said before there are a whole list of problem areas to be considered and it may not be specific jabs, it could be due to life style or environmental issues along with administration issue.

The fact that it has been seen with two different jabs could suggest that it is possible it is the way the human immune system responds to not just COVID but the analogs used for immunization.

As most of these revolve around the spike protein which for all we know about it we know very little, it could be an artifact of the interaction. We do after all know that one of the causes of death in sever COVID is various forms of blood clotting.

At the moment due to the limited information we have is that there is an age related crossover point with comparative risk.

The younger you are the lower your risk of death from the original COVID strains, although newer strains appear to be shifting the risk down the age range. Thus the point where the risks are comparable have gone from being about late fourties early fifties with the older strains appears to have shifted down to the early to mid thirties in Brazil and it’s VoC’s. The Brazilian strains are becoming prevelant in Contenental Europe and America and due to foolish air travel and deficient testing are starting to turn up in other places.

What is not clear is why predominantly younger women not men are getting these rare low platlet counts and blood clots, and publically there appears to be no intention of investigating this (which would be stupid to negligent if the actual case).

EU countries appear to be going entirely their own way on things thus there is a veritable mish-mash of approaches.

My concern is the “Shelter under a tree in a storm effect”[1] without knowing how many jabs of each type have been given and the occurance and fatality ratios, just switching from the AZ vaccine to the Pfizer mRNA jab or again the moderna mRNA jab as political or marketing whim dictates may not stop the occurances or fatalities. Which is why getting to the bottom of it as early as possible should be a very high priority.

[1] The sheler under a tree effect, describes a certain type of not realy logical thinking. That is you are under a tree and at first you are dry, then you start to get wet, so you run to another tree expecting that it is going to still be dry under there…The reason this is not logical is the simple fact that both trees are in the same storm thus are getting about the same amount of rain per square footage of area as each other. So unless there is a marked difference in the trees and their foliage most likely they are saturated to the same extent. So running from one tree to another similar tress is unlikely to keep you any drier than the tree you start out under.

Clive Robinson • April 10, 2021 3:34 AM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter, Weather, ALL,

Low platelets and blood clots are an “odd” combination.

Yes and no.

Yes we are told one heck of a lot about platelets in blood cloting, in part because of their role in what gives rise to heart attacks and strokes that kill us via arterial disease.

But actually blood cloting is so important to us as a species to get us beyond our breeding point that through evolution we actually have a multiple set of “cloting paths”…

I’m not going to go into them, because as long term readers might remember, I’ve had lots and lots of issues with blood cloting and hemorrhaging over the past decade or so that have regularly put me in hospital with clots in the legs(DVT’s), lungs(PE’s), brain(CE’s, TIA’s/ministrokes), and to have blood transfusions. As a result I’ve looked into all sorts of things to do with blood and it’s clotting, and to be honest it’s a veritable warren and thus a rabit hole you do not want to go down, unless you are aiming to pick up a PhD along the way.

The upshot is I’m full of blood thiners and anti cloting drugs and any bleading I have to take seriously which has some definate downsides when one of my “hobbies” is not just cooking but the preperation and storage of food stuffs. Including the turning of carcasses into joints, chops, and cuts known as butchery but also the more interesting area of presserving meat called charcuterie. Needless to say all of which involves lots of very sharp knives and similar very close to both fingers and the hand but also the lower arm including the wrist where lots of blood vessels are just skin deep… As has been pointed out to me “an accident waiting to happen”, but what is life without enjoyment spiced with a little risk?