Schneier on Security

Clive Robinson • December 23, 2021 7:23 AM

@ Canuck,

Why was office efficiency highest around 1973?

Well it goes back to Hut 8 at Bletchley Park during WWII.

A young “civilian” got put in charge of a small section that very rapidly grew. His name was Gordon Welchman.

He realised that “optomising s process” was actually detrimental to organising a system.

He was not unique in his views about spliting jobs into small processes and sub processes Henry Ford knew it as did pin makers in France hundreds of years before,

https://www.johnkay.com/2019/12/18/adam-smith-and-the-pin-factory/

What Welchman brought to the party that the famed Adam Smith did not in his work of fiction book the wealth of nations was actual insight from being not just a “real observer” but one who was “part of the system”.

But before all of that nature had evolved processess that were based first on resilience then system efficience then process efficiency.

If you try doing it the other way you always end up with a very fragile system thst lacks stability.

What Welchman did after the war was start “systems analysis and application” to business. The result by the 1970’s were resilirnt and efficient systems.

The introduction of the business personal computer with the Apple ][ and VisiCalc had a very very unfortunate result. It made sub process efficient at the expense not just of processes but systems and caused chaotic systems to exist and become increasingly chaotic and less stable.

The result of chaotic systems is sometimes things are very good sometimes they are very bad. If you ride the good but not the bad, or atleast appear to you look like some kind of guru…

The simple fact is chance is random, and though chaos can look random it is not it had structure… If you can spot the structure you can ride it like a surfer does a wave. But the ability to ride a wave to success does not mean you control the wave…

The thing is as production systems became chaotic due to computers some gurus thought adding more computers was the solution and to pay for it they ripped out processes in the middle. Because they did not realise that whilst senior managment might be like a pilot of a vessel set the direction, they did not work the vessel to keep it ship shape and seaworthy and importantly ensure the ship gets through not just storms but also when it is becalmed.

So they ripped out the most important part of any organisation the “experience” held in “middle managment”. This disastrous process that started in the 1980’s and went through to “crash on the rocks” in the 1990’s was “Business Process Reengineering”.

It’s a lesson that should bee beaten into the heads of those at the Chicargo School with industrial grade sledge hammers…

But they won’t change because they are paid not to change, thus the Upton Sinclair observation applies.

But who is paying them you might ask. Well remember I said chaos has structure, so although you can not control it you can ride it?

Well theres lots of money to be made if you know when to jump on and then jump off… Some go by the name of Hedge Fund Managers, and their sole source of income is extracting resillience out of systems in the good times then jumping away before the ship hits the rocks…

I hope that helps answer your curiosity.

Clive Robinson • December 23, 2021 9:01 AM

@ Anonymous, ALL,

There’s always https://xkcd.com/538/

It obviously only works if,

1, The user knows the valid key or passphrase.
2, The key or passphrase are still valid.

I designed a system that I’ve given details on here in the past that stopped those two from being true.

Importantly though for legal reasons the user had no control over it in any way, and could demonstrate that,

A, They had no control.
B, Those –plural– that have control not only have it anonymously, but they are in other –plural– jurisdictions.

So not only would the $5 wrench be usless, so would threats of “contempt”[1]. But it can also make provable deniability at trial more clear cut and that can be quite adventageous in some cases, but not all[2].

Though this might all sound “crazy impossible” it’s actuall not that difficult and all the crypto primatives to do it have been around for quite some time.

[1] The rules of contempt of court are complicated, but if it can be shown that the person can not comply the “wilfull” aspect colapses to zero thus they are not in contempt by deductive logic. Which makes detaining them unlawful on contempt (though they could be held on remand pending trial[2]).

[2] In many jurisdictions you have a right to a speedy trial, though time scales are not in the legislation. Sometimes it’s worth pushing for this as it limits what the prosecution can do, and forces them to show their hand earlier than perhaps they are ready to do.

Clive Robinson • December 23, 2021 1:38 PM

@ Nick, Ted, ALL,

“How exactly did the FBI obtain the private key?”

A clue might be found in the documrnt @Ted linked to.

Look for the bit about the account pin, being “sent to the phone” where the phone was the alledged perpertrator’s “personal phone” registered with Sony HR and having been used by the alledged perpetrator.

If that “account pin” was sent in “plain text” then it would be easily recoverable. If the person controling the account did not change the pin, then “game over”.

As far as I can tell from the document all the evidence against the alleged perpetrator appart from the phone is at best circumstantial and could have been carried out by his supervisor.

It’s just the use of the phone that appears to be more than maybe circumstantial.

It’s entirely possible that the supervisor had access to the alledged purpetrators personal phone for various reasons (leaves it in desk at lunch etc). So could have used it or just “pulled the SIM”.

Which suggests there is other evidence out there we have yet to find out about…

So pop some more Popcorn in the microwave and get comfy in the LazyBoy for the next episode 😉