Schneier on Security

Clive Robinson • June 5, 2021 5:29 AM

@ Winter, SpaceLifeForm, MarkH, JonKnowsNothing,

Things get more and more curious…

I was shown this just now,

https://m.youtube.com/watch?v=fyhMoWDSZ7Y

Long answer short the University of Barcelona are publishing 12th March 2019 as the discovery epoch data,

https://www.medrxiv.org/content/10.1101/2020.06.13.20129627v1

No doubt a whole bunch of people hanging around 77, 2′, 11″ West are going to be upset as it spoils their pet theories they’ve built up on bad or no logic…

Clive Robinson • June 5, 2021 11:04 AM

@ ALL,

Common folks, think.. why did I say,

“Things get more and more curious…”

What does the word “Epoch” imply?

And Why the latitude?

They are to do with time and location of current not previous events.

The UoB stuff is a year old, all of it and nothing has changed other than it had slipped out of peoples minds, thus many were hoping they could safely ignore it. But now that cupboard has been opened again and the skeleton now has a spotlight lighting it up again.

As for the latitude, it goes through Washington DC…

What is currently happening there?

Penny dropping yet?

OK most of the virus oragin arguments boil down to “hoe can I make them fit my agenda”. Like the idiotic,

“If not wet market then must be lab”

Or,

“People got sick at the lab first”

We know both logically are false, but Jo Public what do they know or care?

So much QAnon, Alt-Right and other MAGA claptrap is continuing apace (apparently there is a Trumpian event comming up) and there is apparent buy in from the talking heads of MSM etc.

Politically the US has a problem, “China bashing” is still the number one sport, even though most house holds are reliant on China tech and Production.

As I’ve mentioned before there is a sort of joke about senior managment that says,

“The first rule of senior managment is never be in the same room as a decision.”

It’s even more true for senior politicians, who survive on “plausable deniability”

But the joke goes on,

“The second rule is never ask a question that will give you an answer that does not align with your agender”

And,

“The third rule is always delegate not command.”

These rules are why the “Make it so” attitude expressed in Startrek Next Generation quickly became a real life managment style for

“Teflon Tony, sociopathic leader”.

And just about every politician still. It’s also called “Suround yourself with fall guys managment” a much beloved style of a real political leader called Tony, UK PM Tony Blair, oh and Enron etc.

So back to the present, what’s so special about the timing of the video?

Well the Dear Dr is playing it a bit dumb (he is an actualy not a medical doctor but holds a research doctorate PhD.). He is very popular and he is interviewed by MSM quite frequently thus he has “reach” and people listen… He’s also known about the UoB findings since they first came out and has mentioned them before, and has always pointed out the paper is “pre-print” and needs peer-review…

So why is he bringing it up again now?

Well what’s going on in Washington currently?

Well POTUS has made a fairly major tactical mistake…

He’s not only asked a question nobody in Washington or many orher places want answered, he’s also said “on my desk in 90days” in a way that has raised expectations the report will not just provide him with answers, but the answers will be made public…

Look at it as a “Schrodinger’s Cat” experiment, every one is happy believing the “both alive and dead” hypothesis that can be maintained indefinately as long as nobody takes the lid off the box… Only some one who has not thought it through has said “time to lift the lid”… Opps, that’s not what anyone else wants to happen.

Their hope as it’s being dragged back from the long grass would be to “reboil the cabbage”. That is take those pig stupid lacking in actual logic arguments such as “if not wet market then lab” and slap fresh lipstick on them as well as conveniently ignoring any data points that do not fit their chosen narative to fit the agenda.

Well by accident or design the dear Dr has made all of that way way more difficult. In fact it means that to keep the agenda wanted by various parts of Washington that the UoB findings will have to be not just addressed and answered but addressed in a much broader sense.

As Tatütata had pointed out, it opens a rather awkward and inconvenient series of cans of worms…

The issue behind it all though is rather broader in scope,

1, Scientists usually want evidence based answers.

2, Politicians never want evidenced based answers, because that ties them down and forces their hand.

The reality is that politicians want cheap and easy solutions to the agenders they have, that keep the money flowing in and can be blaimed on others should evidence of harm etc come to light…

So is the Dear Dr stiring it up deliberately himself or has he been put up to it some how…

Clive Robinson • June 5, 2021 5:00 PM

@ FA,

Ever said “Why the latitude?” it has a different meaning as in “freedom of movment”.

As others have noted in the past I’ve a habit of playing word games in my posts (puns etc), many don’t see them but some do, and with good reason

@Wael and I found you could use word games as an obfuscated communications channel on this blog for covert communications (Shakespeare Sonnets was just one way). @Wael went on with @Ratio to develop other methods for such channels using unused thus non printing “Unicode Transformation Formatting”(UTF) codes. Others still use variations on these methods to send information across this blog as can be seen when OSInt was being done to identify certain people tying up court time with nonsense voting challenges (one ended up with a real estate video confirming where one of them lived because she was daft enough to have a photo of her and another of the idiots drinking wine in the kitchen).

Because at the end of the day there is a difference between Moderation and Censorship, and a curious mind can find significant latitude inbetween.

Clive Robinson • June 5, 2021 7:39 PM

@ SpaceLifeForm, Hedo, Weather,

To Drop, or Not to Drop. Tis the question.

Ah Shakespeare twice in just a few hours. Mind you, you would probably not believe the number of smutty,crude, rude if not socially untreatable versions of the next line 😉

But back to the subject in hand.

Many will have heard of “port knocking” but do not realise that generally that is a TCP protocol “subliminal channel”[1] and has a lot of issues, including fairly easy tracing due to Syn-Ack bidirectional handshaking. Whilst you can use UDP ports as they are “fire and forget” as opposed to “reliable” they again are “up the stack” where they are more obvious and more easily blocked. ICMP works at a lower level and whilst it can be blocked it is less obvious than TCP or UDP, it also has the advantage of being able to haul large quantities of data “tacked on the end”.

The use of IP however can not be blocked, you first have to accept it at the bottom of the networking stack to check it to see if it should be blocked, thus host based firewalls do not stop it (something all Windows users should take on board). Also most of the header is redundant and can be faked easily. For instance the “source address” has no value in the delivery process so can hold any value, also the IP packet can be launched withva faked source address from most places up-stream of the host at the destination address.

Quite a number of network stack implementations are ambiguous at the lower levels, thus the “knock” code can be hidden in the network card device driver as a “translator” to pass fake traffic up the host stack that never originated on the actual wire. So from an attackers perspective it can be used to get around perimiter firewalls etc.

I’ve yet to see others do this but I’ve had quite a bit of fun in the past doing such things…

It will be interesting to see if and when it gets reported in the wild (I kind of stopped looking over a decade and a half ago).

[1] with 20-20 hindsight the idea behind Gustavus Simmons’ “Subliminal Channels” are “obvious”. However back in 1984 when he published about them they were a surprise to many. I was one who knew about the “linguistic version” based on looking into the history of how the “Code Talkers” came about. There is a whole history of “criminal lingo” such as “Cockney Rhyming Slang” that is “obvious in it’s use” but not it’s meaning. One is a “Richard” from “Richard the third” many assume quite incorectly that what rhyms with the unsaid “third” is not what you might find deposited on the street by an animal. Whilst crimina “lingo” or “patois” enables messages to be hidden it is in no way “covert”. Over the centuries criminals did develop “covert” communications, especially prisoners under continuous surveillance. Which is probably why Gustavus Simmons described it via what he called the “Prisoners’ Problem” (not to be confused with the entirely different “Prisoners Dilemma”). As is often the case where “criminals lead” “the authorities follow”, and they have adopted similar liguistic covert chanbels and you will find it as part of “Spycraft, fieldcraft” along with many other criminal talants such as slight of hand for “pass offs” etc.

What Gustavus Simmons’ “Subliminal Channels” brought to cryptography was covert channels that can be used to communicate secretly in normal looking communication over an insecure channel. Interestingly from the technology perspective his covert channels were “found” in digital signature crypto systems, due to the fact that all digital signiture systems have a very high degree of “in-band” redundancy, which most traditional crypto systems do not have.

Clive Robinson • June 6, 2021 3:00 AM

@ SpaceLifeForm,

Are the ransomware attacks actually staged, and in reality, a way to launder money?

With ColPipe, the way it is set up and by which companies, I would be surprised if you were not suspicious.

However there are other reasons to pay up,

1, No tax to pay.
2, Use somebody elses money.

If you think back to 9/11 one of the buildings was “over insured” and with more than one insurer. Thus the building owner claimed the full amount from each insurer and made a nice profit on the deal. Likewise some of the employers had large “life policies” on their employees that the employees and their families were totaly unaware of. Again a very nice “windfall” bonus to the balance sheet etc.

Thus I suspect if you look for evidence of questionable if not illegal behaviour with ColPipe I would be very suprised if you did not find it, some if not all of the companies behind it have been found guilty and fined in court on multiple occasions.

The murky setup is such that it would make finding a “Directing Mind” not just difficult but deliberately impossible.

So yeah you are not the only one who has that “raised short hair” feeling at the back of their neck.,

Clive Robinson • June 6, 2021 3:09 PM

@ Robin, MarkH,

Yes, and in my brief quote I missed out the context that Wade presents, that Yunnan and Wuhan are 1500km apart, with no firm records of cases between the two. If the transmission had been part and parcel of ‘normal’ interactions between humans and bats some cases would be expected elsewhere, but the outbreak appeared (important word, that) to originate in Wuhan, thus raising the question: why does a virus found in Yunnan turn up as a disease in Wuhan?

You’ve left out an important factor, as have nearly all people, including those who desperately want it to be a Bio-Engineered Weapon out of a Chinese Lab, so they can have a war etc.

Importantly it applies to the early 2019 observations, tests and resulting information as well (which hopefully will increase with time).

Which is “strain lethality” and “strain virulence” combined with rate of mutation.

The first thing to understand is SARS-2 is unusual, in that it avoids an evolutionary trap that happens so often it’s considered normal or typical. A trap which worked well for pathogens untill as little as fifty years ago.

The trap was to cause symptoms that would draw people together whilst they were infectious. Thus mammals when infected would suffer the chills etc whilst still infectious that drew them to other mammals thus causing infectious spread.

The upside of this eveloutionary trap was it caused the rapid spread of infection. The traditional downside and why it was a trap is in the longer term it causes pathogens to become increasingly less leathal etc.

Put there has been a “state change” which in evolutionary time scales is in effect a “Step Change”. Modern Western society has increasing numbers of singletons many lipng on their own. So any signs of sickness normally results in self issolation during the infectious period. Thus pathogens spread less rapidly even though there is a vastly increased population density. So typical pathogens are trapped by rapid changes in mankinds behaviours [1][2].

SARS-2 is not typical. If you are infected you become most infectious before you start to feel sick. I fully expect to see this sort of changed pathogen behaviour increase as a viable response to the social changes where at the first sign of illness people issolate.

Consider what this means in terms of spread by travel through travel hubs. Normally if you feel ill delaying travel is not a problem. Thus you keep the infection to yourself or local. If as is the case with SARS-2 you don’t feel ill you travel. In modern society the time you come into contact with most people is when you travel in shared transportation, “boats, planes, busses and trains” are all very high density very high contact places. Thus you would expect to see infection spread these days in “hops” along major travel routes. With the hops being several hundred or even thousands of miles appart.

Think about those photographs from space at night that show population density by the density of illumination. Well people travel in hops through those places and mostly not in between.

Thus saying “1500km apart” is realy not relevant to disease spread these days.

But when combined with SARS-2 atypical behaviour the effect is significantly magnified, COVID in reality is “the travelers plague” it’s developed a new evolutionary advantage that other pathogens just do not have.

There is a major side effect to this which many miss, even professionals.

Pathogens have “mutation rates” they are often incorectly specified in terms of time, because in pathogens that behave “typically” that’s an acceptable fudge that makes modelling easier to do.

The reality is mutation is based on probability, thus each infectious person has a small probability they are going to create a mutated strain. So the more people infected at any given point in time the greater the probability of mutation.

Thus mutation is going to happen where people are in greatest contact with each other, which these days is with those who travel or have older life styles with multigenerational families and or high density housing with shared fascilities due to poverty and manual labour occupations.

So consider the fact that SARS-2 started of fairly benign and traveled with tourism and manual labourous. It then mutated most likely in transit or at a travel nexus, such as Wuhan.

Lifestyles in Southern Europe are still agrarian based and people live in dense multigenerational homes.

Now consider the very rapid spread and mutation in South Africa, Brazil and India.

A case can thus be easily made that SARS-2 did originate in those caves as far back as 2018 and was fairly benign thus traveled widely. At some point in it’s travels it mutated into a less benign form which was when it started to cause increased hospitalisations etc and finally became recognised for what it was a novel disease. It could have happened anywhere but it was most likely to happen at or associated with travel thus travel hubs.

The so called “Kent VoC” or “UK varient” we know started on a major travel route and followed it fairly rapidly and then only slowely spread out from there. Similar SARS-2 outbreaks have all occured in high human contact environments and traveld rapidly.

Wuhan got unlucky, as Kent UK did, and as has been shown and most of the other serious vatients likewise.

If people start doing the probabilty graphs then they will find the most likely oragin of SARS-2 was not Wuhan, but Wuhan was were a more serious mutation got a toe hold at exactly the wrong point in time, when Chinese New Year occured and traveling was so intense that human contact was so high it spread out like wildfire.

The limited evidence we have and the probabilities and certain social behaviours (bush meat) make a lab escape way way way less probable than “travel”. In fact nearly all the evidence from Wuhan on points a massive finger at,

1, SARS-2 atypical behaviour
2, Contact through travel

It’s only later that community spread runs rampant in certain social environments such as high density occupancy in high density housing.

Oh and as both New Zeland and Australia have found SARS-2 spreads in high density housing called hotels even though people are supposadly “issolated” they are infact not. The same was seen early on with the “floating petrie dishes” that cruise ships are.

The evidence for another cause of the outbreak other than the Wuhan lab is increasing day by day, the fact people do not want to acknowledge it is “very human”.

It’s the reason “ambulance chasers lawyers” exist. People are hurt emotionaly and they want to blaim others and “get vengence” etc.

I’m on record as saying there is no such thing as an accident, only lack of observation and the time to process the information arising from observation. Whilst we can slightly improve observation and response times, the way to reduce these events is by “mitigation” plain and simple. But as we’ve seen with “mask wearing” even though it works and works well it becomes “political” very very quickly thus becomes rapidly toxic and polarizing.

Remember there was not a flu season 2020-2021 because we took simple mitigations[1].

Thus I for one will continue to wear a mask whenever I’m likely to get within 10m of people out doors or continuously indoors. As I’ve mentioned befor on this blog long before SARS-2 when I cycled to work and had my own office where I turned the heating down and kept the windows open I never used to get even the sniffles let alone colds or the flu. Perhaps we should start viewing such illnesses in the way venerial disease once was, signs of a sinfull and dirty existance 😉

[1] It’s not just increasing issolation due to being ill. The 2020-2021 winter flu season was predicted to be a nasty one for various reasons. But flu did not happen in the Northern Hemisphere. Two main reasons, lockdown and the “Hands, face, space, ventilate”. Our usual “filthy habits” the flu virus relied upon for transmission were broken it failed to propergate thus mutate and flu season effectively did not happen. Which I don’t know how many hundreds of thousands ot millions of people that became COVID cases needing hospital care own their survival to. As the care they received was possible because the healthcare system was not saturated with hospitalized flu cases. Hence I hope society learns to stick with “Hands, Face, Space, Ventilate” it will continue to save lives for years to come.

[2] In part there is another reason why issolation is more prevelant these days in the Western World and it’s something we are going to have to think carefully about. Untill recently work was by “man-power” often necesitating lots of people to be in closed confined work places. Well the use of various force multipliers means less “man-power” is required, also the move from tangable physical work to intangable information work means people do not have to be close together. In fact there are scientists working on different continents, who have never met in person actively colabarating more productively then they have at any other point in mankinds history. Work is changing and the “physical distance” factor creates the eveloutionary trap for pathogens that need close proximity.

Clive Robinson • June 6, 2021 5:12 PM

@ echo,

Not every one knows who Baroness “Typhoid” Dido Harding is, or why she might also be called “Poison Ivy”.

Lets’s just say she has taken “inept” to new hights or should it be lows…

Of course being as thick as a “yard of lard” has never been an impediment to those who marry their way into positions of office even if they are a sinecure without the usuall attendent backhander payments money is just one form of remuneration, for others with narcistic streaks vacuous status can be more desirable.

Tony Blair was known to surround himself with incompetents who flaunted status, did his bidding and fell on their swords if things went wrong Teflon Tony was not going to let his “Vosene bottle” shoulders get marked by such things.

Obviously Blow Jo has rather less charisma than road kill and could not hold down a job sitting outside a locked back door with a crimson and gold commissioners uniform as he’s just not smart enough for that.

So it takes little imagination to work out what sort of people he would employ as “fall guys” to do his bidding. I guess you could say Baroness “Typhoid” Dido would be considered a floater on that saucer of congealing sour milk.

Lest people think I’m being a little harsh, I’ll let the words of anorher be read,

https://www.theguardian.com/politics/2020/nov/10/typhoid-dido-proves-fluent-in-management-bollocks-and-contradiction

Oh if proof were needed she is a prime example of why some interns are not worth the money you don’t pay them.

Clive Robinson • June 6, 2021 6:32 PM

@ Weather,

At least the troll stayed away for three days for a simi desculsion.

I’ve watched the various comments about the troll and had a look back over when in a broader sense.

They appear to be a “weekend warrior” type as well as US public holidays.

Thus they might be in the US and have a day job to do. Or they might just figure the Moderator does not work those days thus their inanity stays longer.

Clive Robinson • June 7, 2021 2:13 AM

@ the real summer,

You say,

I was careful to point out that it’s not just the CCP at fault.

And then,

You have, apparently, chosen to promote the CCP’s version of events above impartial (currently incomplete) scientific enquiry.

You will find I did not mention the CCP at all and only China in geographical context of traval and labour supply.

So stop lying.

You also say I’m not impartial when I was pointing out there is a lot of things people are getting wrong because they are too blinded by their own partiality…

So you accuse me of the opposit of what I am actually doing, how very transparently unreasoned…

But you go on to say,

How do we move forward and stop this dangerous viral research activity if we do not get to the root of the matter?

Showing intense partiality and extream cognative bias…

You then go on and make the clasic cognatively biased zelots mistake,

It may be years before we get to the truth but we probably will in the end nomatter how many CCP schills deflect and evade …
I wouldn’t want to be in your shoes if the truth come out.

Making threats etc whilst hiding behind a false identity how very silly and by the way illegal…

But lets be honest, you’ve entirely failed to reason about the viral behaviour and how it has actually been shown to have behaved.

Whilst most of what you claim and believe has no evidence to support it, and is at best congecture of ‘The CCP must have done it’ because “coincidence”…

Kind of shows your compleat lack of ability to reason or follow anything close to logic or the scientific method. In reality much closer to the vigilante thug method of incitement my “knee jerk” statments.

The thing is there is evidence for all the behaviours of the virus I’ve given it’s happening around us right now and it’s documented… Something you avoid very noticably, which begs the question “Why?”.

The fact that you want, what you admit is “coincidence”, to be “altetnative facts” to support the conclusion you’ve already made is to use a quaint phrase, “arse about face”.

This trying to move from unsupported conclusion to cause is not the way science works, not even for a first approximation hypothesis.

It is as I’ve pointed out in the past the major cause as to why all those “miscarriages of justice” happen.

Your process is,

1, Gain of function is bad,
2, CCP does Gain of function,
3, Therefore CCP is bad,
4, Therefore CCP must be Guilty.

Do you see any problems with that thinking?

Probably not which is why you then go on with,

5, Look at anything that makes CCP look guilty regardless if true or not.
6, Deliberatly ignore all evidence that does not support your “CCP is Guilty” view.
7, Derid, abuse and threaten any one who points out you are wrong to do so.

Whilst many agree with your first point is true, and why many countries have banned such research. You fail to make your case even for that, you also fail to show any evidence as to why it’s being done in China.

The reason you fail to give such evidence is your cognative bias and resulting process.

I also suspect why you have such a cognative bias is your own inabilities that you deflect onto others with your contemptuous,

There’s no way for a layman to determine if it was a “weapon”

Which as others would no doubt tell you if you asked politely and did not threaten, is a strong indicator you do not understand “gain of function” or the logical arguments involved about it.

That is “you believe” in the religious / cult sense that it is bad, because you can not logically arrive at that conclusion because of your lack of knowledge or reason.

Your resulting fervor makes you think you have moral superiority which is a fairly clear indicator of your societal culture. Therefore you automatically assume if you can not understand it, “obviously” in your limited view point nor can anyone else. Which is obviously false to anyone not so cognatively biased.

Thus we get the rest of your –what might politely be called– unreasoned behaviour… And it’s of the sort that often gets attributed to self promoting “Social Justice Warriors” and those who are “Anti-vaxxers” and “Anti-maskers” and acolytes of QAnon, Alt-Right and similar discredited “cult thinking” denialists.

You think “gain of function is bad” fine, but make your case for why in a balanced and reasoned way, and don’t assume people are stupid or incapable of rrason or logic.

You actually have not attempted to show if “gain of function” could be anything other than as you say “coincidence”. So you need to demonstrate why other evidence supported arguments are false with very high probability first.

Nor have you shown gain of function experiments are in anyway causal or even could be causal.

Nor have you in anyway shown why gain of function might be involved or the drivers behind that possibility.

Which obviously invites the question “What are you hiding or trying to hide?”…

I think people are going to want answers to that question above anything else. And no your current “arm wavery” will not do.

You’ve painted yourself into a corner with your soap boxing, false accusations etc, how are you going to get out of it?

Are you even capable of doing so?

Clive Robinson • June 8, 2021 5:06 PM

@ SpaceLifeForm, ALL,

Yes, criminals are dumb.

So are the sales people…

In the US you have a very broad scope piece of legislation that gets called “Obstruction of Justice” the FBI tack it onto charge sheets the same way they do “Conspiracy to…” charges.

In essence these are used as a method of compulsion to get around 5th amendment and other rights US citizens “only” have. They are also a way to “make plea bargins happen” when there realy is no crime for a person to answer to.

So if you sell a product that some US LEO claims is “assisting criminals” then that puts you on the slipery slope that “Obstruction of Justice” has become.

Worse the US regards it’s justice system as “applying universally” that is you can be doing something quite legaly in your own country and being a fully law abiding up right tax paying citizen there. However if the US can get it’s hands on you by say diverting an aircraft or similar or waiting for you to leave your home nation for any reason then it will grab you and start proceadings against you… Whilst US citizens have some protective rights apparently non US citizens don’t…

It’s fairly clear from this latest encryption device debate that they intend to go down this route further…

Thus the question of how they will define “Obstruction” in the past with “Conspiracy” they have prosecuted people for being in the same room serving food, knowing full well that any conspirital conversation that might not have stopped was in a language that those they were prosecuting did not speak, so by any reasonable measure could not have been involved in…

Thus I can see “The war on crypto” taking a worse turn, such that even writing a document that describes how to use a cryptographic proceadure will become “Obstruction of Justice”. After all what impediment is there against the FBI and DoJ from “trying it on” and if not stopped get case law president (think back to FBI/DoJ -v- Apple).

@ ALL,

It’s interesting to note in the Wired article how everybodies communications were “routed abroad” and decrypted. Then except for those of some US Citizens were sent to the FBI…

There are lessons to be learned by everybody in this, not least do not trust any encrypted system you do not have 100% control over, and even then look out for attacks on the “plain text” side of the “security end point”.

As has been pointed out the likes of Amazon Ring and other CCTV devices “phone home” into or via the UD as do “Smart assistants” and increasingly any and every IoT and Smart device and entertainment system that can connect to a communications network.

Remember communications networks are any channel that can carry energy with information impressed upon it. That includes sound going down a corridor or metal pipes. It also includes those new fangled “Smart Meters” Governments and others are trying to push into peoples homes, where the “power signiture” of any electronics in your home travels down the household wiring to the Smart Meter that can be programed remotely to do all sorts of things over the mobile phone network. It’s been reported by some people doing “strip downs” of Smart Meters that there is a lot of odd circuitry rather more than needed for measuring power and implimenting “anti-tamper” functions. Others have pointed out that modern MEMS microphones are very small, dificult to spot and even harder to recognise thus some have drawn certain conclusions (no I’ve no idea either, othet than it’s easily technically possible).

And that’s all before we start looking at “offset radar” systems that use WiFi points in your neighbours home as an illuminator etc that even undergraduates are doing as projects these days. All have sufficient resolution to map not just your major movments as you move around your home but quite a few of your minor movments as well such as things you might be doing with your hands…

I guess it won’t be long before wearing a tin foil hat becomes “Obstruction of justice”…

Thankfully my traveling days are over for medical reasons, but the UK has an abomination of an extradition treaty with the US which should be of concern to everyone.

Clive Robinson • June 9, 2021 4:19 PM

@ the real summer,

I read the Nikolai Petrovsky quote some time ago, it struck me then as “inadequate”. I gather I was not the only one.

There is to much politics wanting it to be from the lab, with the result much much else and rather more probable is being ignored because of it.

Sorry that you are one of those so desperate for it to be the lab that you ignore simple logic and probability as well as being completely unscientific by cherry picking your way back from effect to cause.

It’s not rational behaviour, but I should not be surprised there is a lot of that going on in the world, the reason is people feel inadiquate and as though they are drowning in information, this grasp at any straw they get told will give them certainty.

As I’ve already told you News Corp International nominally owned and controled by the known committer of purjury who instructed teams of people to carry out illegal surveillance on people Rupert Murdoch has been spreading much in the way of very questionable infornation for political reasons involving the far right in US politics amongst other things.

Stop clutching and put some effort into actually doing a little reading of peer reviewed papers not opinion pieces in mostly wanabe news websites.

Clive Robinson • June 11, 2021 1:23 AM

@ Not so fake!, ALL,

“Linux Foundation Readies Global COVID Certificate Network”

It’s one of those “Oh not again” moments… Or “How can clever people be so utterly stupid yet again?”…

It’s very clear that the purpose is to,

1, Push Blockchain.
2, Setup a Global Unique ID system.

Both are very bad ideas and we should know by now not to touch either with an infinitely long pole[1]… (but then domain history is not something that realy happens in ICTsec as I’ve previoisly pointed out on a number of occasions).

Firstly Blockchain realy is a very bad idea, always has been and it’s getting worse day by day…

One the face of it, blockchain appears to offer many Security advantages. The reality is they are not advantages people realy want or need and infact are turning out to be significant disadvantages. Especially at the cost incured, and as is becoming more and more clear the disadvantages are always going to significantly outweigh the minimal not needed advantages.

Worse people are discovering more and more, how blockchain haemorrhages PII via meta-data and meta-meta-data analysis and this leakage is as a direct consequence of it’s supposed advantages. Thus the law of “unintended consequences” runs rampant with Blockchain, especially when other databases are involved, which they almost always are or can be easily made to link to a blockchain system.

As for a “Globaly unique ID System” do I realy have to say just how bad an idea that realy is?

Look at it this way it’s an easy to use major tool for repression and police state activities, religious and other discrimination and so on. It’s also a “Data-miners” and Identity theft criminals wet dream, it’s “the one true key” to all you are and all you own. It will in short kill society as you currently know it.

But it also has two major issues nobody has resolved, and may never do so,

1, Root of Trust.
2, Hierarchical Power/Control.

Put simply, you can not prove who you are, only that you are possessing of some of the “authentication tokens” created by bureaucrats without thought to the consequences[2].

The ability to control such authentication tokens is an on going war of a bloodyness that few see or realise.

As the tokens are “issued” from a “hierarchical” system the old laws of such systems apply. That is money, power and status increases the closer you are to the top of any hierarchy. Thus the opportunities for corruption, abuse, and other criminality likewise accrue at the top of a hierarchy it’s fundementally inherent in the makeup of a,hierarchical system.

So the bigger the hierarchy the worse the problem, and the harder –to a significant power law– it is to clean up such a system. Thus they almost always “go bad”, and usually fairly “quickly”. Worse when they have gone bad they usually “stay bad”, with the only way out being to destroy the current hierarchy and replace it… But with what? Hence the cycle repeates over and over as history shows[3].

All of these failures have two things in common,

1, Over time they become more desirable to attack.
2, Over time they become much easier to attack.

Thus it’s not hard to see they will always fail, no ifs or iffs, no doubts, and no maybes, they will fail and fail bad…

It’s just a matter of when as long as those two issues are in effect, and we currently have no idea how to mitigate or solve them. In fact you can reasonably show that the two issues are drivers of each other. That is whilst seemingly independent of each other, they do infact drive each other into a downward spiral, the result of which is either total failure, or the current system gets destroyed and replaced, which is likewise a total failure of the system, but the associated effects might be reduced.

The whole idea is a bad one and the system will either just fail or worse via mission creep turn into a totalitarian tool. Which would be just to desirable to certain political types who would use it for oppressive purposes that would have an increasingly detrimental effect on anyone who’s details have been “Indelibly and publically Time Stamped” into such a system.

[1] The statment of “Would not touch with a ten foot pole” comes from some very wise advice about dealing with disease and corpses. But importantly it applies as much to security and computer systems as it does to heakth hazzards. Put simply sufficiently organised/complex living organisms are infested with pathogens and pests. When the organism is in distress, dying or dead those pathogens and pests need to find new hosts, the closer you are the greater the probability is it is going to be you. Look at it this way Y-pestis or the plauge / Black Death infected fleas on rats. Whilst it did not kill the fleas it did kill the rats all be it slowly. Thus a rat and it’s flea population became infected, as the rat died it’s fleas migrated to any warm blooded animal they could hop onto, which was a range of about five to six feet on the flat, more if the corpse was elevated. Hence the safety margin of an extra four foot of pole, and if sensible arms length usage. All computer systems and security systems can be viewed in exactly the same way. As systems they have things dependent on them and the dependencies will migrate to other systems if the first system ceases to opperate. Thus though dead, the ill effects live on through other sacrificial systems…

[2] See the history of the US social security number system and the mission creep around it that makes identity theft so easy thus criminalisation of innocent individuals even easier.

[3] If people doubt this look at all the problems with “security authentication tokens” that is going on with Level III attackers going after any organisation or individual at the top of a hierarchy. RSA a decade ago, and SolarWinds just recently, and inbetween all those Certificate Authorities that failed.