Friday Squid Blogging: Squid Overfishing in the South Pacific

Regulation is hard:

The South Pacific Regional Fisheries Management Organization (SPRFMO) oversees fishing across roughly 59 million square kilometers (22 million square miles) of the South Pacific high seas, trying to impose order on a region double the size of Africa, where distant-water fleets pursue species ranging from jack mackerel to jumbo flying squid. The latter dominated this year’s talks.

Fishing for jumbo flying squid (Dosidicus gigas) has expanded rapidly over the past two decades. The number of squid-jigging vessels operating in SPRFMO waters rose from 14 in 2000 to more than 500 last year, almost all of them flying the Chinese flag. Meanwhile, reported catches have fallen markedly, from more than 1 million metric tons in 2014 to about 600,000 metric tons in 2024. Scientists worry that fishing pressure is outpacing knowledge of the stock.

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Blog moderation policy.

Tags:

Posted on April 10, 2026 at 5:03 PM • 52 Comments

Comments

Sapient • April 10, 2026 7:32 PM

Those cephalopods shure live in the fastlane!
‘https://www.scientificamerican.com/article/octopus-and-squid-populations-exploding-worldwide/

Clive Robinson • April 10, 2026 9:45 PM

@ Bruce, ALL,

Don’t say you were not warned!

Another casualty of the “War on Stupidity” is the supply of Helium.

As I’ve mentioned before Helium is actually a “strategic reserve gas” and the US Government held a reserve but “as stupid does” in a neo-con Government they “sold it off”…

Now that particular chicken 5h1t action has “come home to roost” crowing loudly…

Helium Is Hard to Replace

The war in Iran, and the subsequent closure of the Strait of Hormuz, has unfortunately made us all familiar with details of the petroleum supply chain that we could formerly happily ignore. Every day we get some new story about some good or service that depends on Middle East petroleum and the production of which has been disrupted by the war. Fertilizer production, plastics, aluminum, the list goes on.

“What I find interesting about helium is that in many cases, it’s very hard to substitute for. Helium has a unique set of properties — in particular, it has a lower melting point and boiling point than any other element — and technologies and processes that rely on those properties can’t easily switch to some other material.“

https://www.construction-physics.com/p/helium-is-hard-to-replace

Note the last sentence quoted above about “a unique set of properties”.

The reality is in most cases helium simply can not be replaced with another gas such as hydrogen.

Virtually every “quantum device” used in medical imaging and physics research including “Quantum Computing” are very much dependent on it. As is the more high tech end of “Semiconductor production”. With any shortage in the supply producing price rises way way higher than capacity lost, thus even the price of PC’s and Motor Cars now disproportionately effected.

So loosing 1/3rd of World Production is having a significant disproportionate effect.

Whilst the article is “low key” on the effects to mankind it’s a very serious problem.

maqp • April 10, 2026 10:03 PM

It’s been a few years but TFC got its first bigger update in years this week.

The most important changes are internal. Type aliases and complex data types that allow linter and runtime instance checks to ensure the type of data being handled. Subclassing plaintext and ciphertexts and associating them with keys that offer cryptographic services to specific types of PT/CT objects. Keys are encapsulated into the DB store objects and exporting the keys accidentally is next to impossible. These changes focus on the correctness of Transmitter Program which has a crucial task of never accidentally outputting sensitive keys.

There’s also new abstraction called Datagram that encapsulates the logic to serialize and deserialize data fields for transmission over each data diode, and for delivery/reception over the server/client link.

On feature side, there’s now relay-to-relay traffic masking where for quantity, the server now yields random number of assembly packets including noise packets, and for timing, the client that randomizes the fetch time of next batch of packets. This helps hide TFC’s traffic fingerprint to some extent. This is far from perfect but it’s an improvement. It also does not work if the Networked Computer is compromised. For that you still need to enable the traditional traffic masking.

There’s also finally some changes to ensure data makes it across the data diode.

First being the setting to control how many consecutive duplicates of each packet is sent for every output packet. This immediately corrects a single bad packet.

Second, there’s also an optional replay loop mechanism that repeats the 50 most recent packets over and over. The receiving device will wait until the missing packet is available.

Third, there’s a option for requiring resends where the sending and receiving device cache all packets being sent over the data diode on disk, and the receiving device will complain about missing packets, refusing to move them forward until all missed packets are specified to be resent with a command. This will be unusable if the data diode is poor and constantly drops packets, but the goal was to have options.

The pure-python Reed-Solomon is now replaced with an LLM-hallucinated Rust port that runs about 85x faster, which should make robust error correction possible on lower end HW too. Tests showed the output is identical to the original version.

The installer got some improvements too and TFC now also installs on Arch variants and Fedora.

There’s plenty of other changes, many of which are not backwards compatible, so the major version number was (had to be) bumped. You can find the rest in the update log: https://github.com/maqp/tfc/wiki/Update-Log#tfc-22604-update-log

Clive Robinson • April 10, 2026 11:20 PM

@ Bruce, ALL,

If you “know not the tools” then hidden “client Side” will bite.

As I’ve repeatedly pointed out about “signal” and other “secure messaging apps” they are not secure if you do not correctly understand and secure “the whole system” they form a part of.

Yes my viewpoint was “unpopular” with “fanboi’s and even “supposed security gurus” indicating I was wrong / paranoid (yet again). But I’ve maintained my assertion that “Signal and other secure apps are a liability” for the average user and always will be when “used as the system designers” like Moxie Marlinspike etc intended on consumer and commercial devices.

The result of people “not listening and understanding” has been recently seen in Criminal Prosecutions,

FBI used iPhone notification data to retrieve deleted Signal messages

A new report from 404 Media reveals that the FBI was able to recover deleted Signal messages from an iPhone by extracting data stored in the device’s notification database.

“Notification history was accessed even after Signal was deleted

According to 404 Media, testimony in a recent trial involving “a group of people setting off fireworks and vandalizing property at the ICE Prairieland Detention Facility in Alvarado, Texas,” showed that the FBI was able to recover content of incoming Signal messages from a defendant’s iPhone, even though Signal had been removed from the device“

https://9to5mac.com/2026/04/09/fbi-used-iphone-notification-data-to-retrieve-deleted-signal-messages/

(Yes the formatting of this article smacks of being AI generated, but so do many of their much older effectively Pre-LLM articles).

The important point to note the reality of what has happened is what “Client Side Scanning” that Apple and Microsoft are now forcing onto users at the OS Level will give the “Guard Labour” to put you away, they don’t need E2EE “back-doors” with such access.

But I’ve already repeatedly given warning about this and in some respects how to avoid it effecting you. But it requires “diligent OpSec” and few know how to do this or have the ability to maintain it.

The Government “Guard Labour” of Iran and China found ways to “identify CIA informants” due to the CIA not understanding technology sufficiently well to even establish even minimal “ICT OpSec” with the result many people were killed or in other ways harmed.

Does the average reader here think they know how to do things better than the CIA or FBI in all aspects of secure communications via consumer devices and services?

I suspect on sober reflection nobody who reads this is capable of setting up that type of OpSec or maintaining it in general use.

So heed the message about just how insecure consumer systems and “supposedly secure apps” really are and don’t become the next,

“Prime example of an idiot off to jail”

Or worse.

Clive Robinson • April 11, 2026 2:26 AM

@ ALL,

This might cause your brain to melt down without the assistance of several cups of coffee and a couple of aspirin…

But believe it or not there is a direct “engineering link” between why your “Home blood pressure meter” does not work if you have AF or similar, High Frequency Trading, and how to minimise DRAM stalls in modern CPU and GPU systems…

And yes this comment is due to one of those odd “Synchronicity Events” that I just see more and more of these days.

As some will have noticed I’ve just spent time in hospital yet again[1]. And during that period Laurie Wired who works for Google in Seattle in the North West USA put out this YouTube video,

Your RAM Has a 60 Year Old Design Flaw. I Bypassed It.

https://www.youtube.com/watch?v=KKbgulTp3FE

Which tells you why DRAM has CAS/RAS events and why if you are “High Frequency Trader” or “Quant” you would be keen to get around CAS/RAS re-charge events.

But why you can not use simple wall clock or other timer based prediction to do it (some thing I’ve mentioned in the past about the design of high end graphics systems I did back in the 1980’s).

And coincidentally why home medical electronics based around low cost 8bit and similar microcontrollers fail to work correctly when the user has “Atrial fibrillation”(AF). An issue I keep having to explain to Drs who should be taught it but are not.

There is an assumption that a human heart beat is in effect “regular at rest”. That is if you are sitting down relaxed and have been for a few minutes your heart beat is “like a clock” that ticks with a steady rhythm of XX/beats a minute”.

Thus past time events can be used as a predictor of future time events… This enables certain tricks in the behind the scenes software events that enable significant “resource savings” using various “short time window tracking and averaging” buffers…

One such is very limited memory resources to store the short period required for heart beat pattern and blood pressure points that get used to calculate systolic diastolic blood pressure, SpO2 stats, BPM and breathing rate of the patient.

The more memory you want to save, or minimize analysing to increase battery life the more accurate you need “unknown future time” events to be. So you can implement a “tracking filter” buffer as optimally as possible.

Unfortunately AF makes your heart rhythm quite unstable in the short term and thus not súitable for a “small window tracking filter” buffer of minimal resources and repeated averaging.

There are many “hidden” / “out of sight” occasions when “future time/event” prediction is required and “knowing the constraints” and how to work with them rather than against them are important for more people than the system designers.

As Laurie has shown in a fun way semi-synchronous “time locking” can be difficult and done in many different ways. As she demonstrates in the case of DRAM blocking for CAS/RAS refresh knowing when you are going to “take a hit” can be of significant importance.

[1] A curious event even by my all to often “frequent flyer” type events, because this time by a circuitous route I passed through “Accident & Emergency” for suspected sepsis, then a couple of isolation wards before ending up on a Cardiac Ward. Along the way I picked up a “Hospital Acquired Respiratory Infection” and got discharged rapidly for the protection of other patients to finish “festering at home”. Which is still “a work in progress”….

Clive Robinson • April 11, 2026 10:04 AM

@ ALL,

More on FCC “US Only” Router Nonsense.

As foljs should know the FCC issued a highly questionable generalised ban on routers not originating fully in the US.

1, Some put this as attempts at grift by the Executive.

2, Others put it as trying to “onshore” production again.

3, Those with a little memory suspect it is an attempt to disrupt standards processes in the rest of the world.

My own view is that in all the above,

“It takes a hot ember to emit smoke, thus be a danger to all…”

But I’m not the only one who thinks that trying to “on shore” router production is not really going to happen any time soon, because “expertise” has been lost.

See,

Electronics industry says FCC’s foreign-made router policy is a bit of a mesh

Trade group warns onshoring demands will leave Americans stuck with older gear

“The Global Electronics Association (GEA) warns that the US ban on foreign-made network routers is impractical because few are made domestically, leaving consumers with little choice and delaying access to next-gen products, just as Wi-Fi 7 adoption should be ramping up.

In a report, the body representing the international electronics industry argues that the policy is wrong-headed from the start, since vulnerabilities and security flaws are not limited to any particular geography, but appear across different brands and countries of origin worldwide.“

https://www.theregister.com/2026/04/10/gea_fcc_routers/

In short the FCC is making life worse for 100million US people, with no foreseeable upside now, in the medium term, or longterm future. And if the policy is stupidly left in place, then the US market will,

1, Remain crippled
2, And vulnerable
3, And stuck in the technology slow lane
4, At much greater cost

Thus leaving the US behind the rest of the world and at much greater cost Indefinitely…

Which will be the opposite of the supposed intent.

Dave • April 11, 2026 11:32 AM

@clive

Re: iPhone signal

The is a general principle here that all of these large technology companies are in the government’s pocket and it’s naive to pretend otherwise. Apple in particular likes to crow about all the old problems it fixed but never reveals all the new security holes it created. Fundamentally the only secure mobile device is the one dropped in a bucket of acid and then the bucket thrown into an incinerator.

Clive Robinson • April 11, 2026 2:49 PM

@ ALL,

France rejects “Freedom Fries” and all that US bombastic nonsense.

The notion of “Digital Sovereignty” both in the EU and in Europe more generally has been on the rise for a while.

Even the UK Gov is looking to give “Microsoft worming powder” after it became clear UK Members of Parliament and Civil Government had no “out” from US Guard Labour “snooping” and that all Microsoft Executives would “bend over and touch their toes” to trump and co.

Which is why you find more and more articles such as,

https://www.xda-developers.com/frances-government-ditching-windows-for-linux/

Whilst I know how to give SOHO and above separation from “SaaS etc” from the big US corps the level of “convenience” does initially drop for a short while.

But it actually promises to be less than a Win10 to Win11 upgrade so you have to ask the $64,000 question,

“Why has M$ made it so easy for people to want to leave?”

Clive Robinson • April 11, 2026 2:59 PM

@ Markus,

It’s nice to hear you are still around, I hope this finds you well?

Few of the old “usual suspects” remain which is a shame, but time “thins the ranks”

lurker • April 11, 2026 3:21 PM

@Clive,Dave,ALL

Apple often have Security “Updates” to fix their own misakes. I gave up on them when they made it harder and harder for an ordinary user to find out what was being fixed and why.

But even in a so-called security conscious OS like Debian, using apt, “remove completely” can vary from app to app in how much it actually removes.

As for being able to sustain the necessary opsec, that also assumes a sensible device running a sensible OS. I’m currently persuading a new Android phone to behave itself. Chinese designed and manufactured, and approved for use by the US and friends, so it has the best of both worlds’ spyware.

Used debug mode from my desktop machine (avoids permanent root on the phone), uninstalled a boatload of bloat and trackers. Some can’t be uninstalled because they’re so deeply hooked into the OS: e.g. Google Messages, Google Calendar, Find Device. Deny all permissions but don’t hope for the best …

Notifications? I’m still searching for a plain vanilla unencrypted “messaging” app (whatever happened to SMS?) that doesn’t send my messages thru a 3rd party server in Elbonia; or can put a simple notification on the lock screen “New Message Arrived”. They all want to put the sender’s name and first line of content out on the lock screen?

Zibeli • April 11, 2026 4:36 PM

I noticed recently that at least two major retailer websites (Walmart and CVS) allow their users to sign into their accounts just by entering a single use numeric code that is sent to the email address or texted to the phone number on the account, with entry of the users’ passwords no longer being necessary.

Seems like a major step backwards security-wise from two factor authentication to one with that one factor being access to an unencrypted email or possession of an easily lost or stolen phone. Curious to hear you other security watchers’ takes on this.

Winter • April 12, 2026 1:13 AM

@Clive

“Why has M$ made it so easy for people to want to leave?”

The underlying causes of Enshitification are the demand for exponential growth in profit.

MS profits must grow while they already have been maximized in their current customers which already covers 90+% of the market.

MS profits can only grow by taking over new parts of the economy or extracting more money from their current customers. Both strategies can only work by inconveniencing their current customers.

Enter Windows 11.

ResearcherZero • April 12, 2026 8:02 AM

Webloc, made by Cobwebs, used by law enforcement to surveil and track 500 million people.

The product is used to mass surveil, locate and gather intelligence without a warrant. It obtains information from mobile applications through the use of advertising intelligence (ADINT), which exploits the consumers “consent” to the SDKs in the build of these apps.

Webloc allows Tangles to geofence, gather intelligence and track movements of populations.

The Webloc product is an add-on for Penlink’s Tangles web intelligence platform. Tangles is used by law enforcement and government agencies in countries right across the globe. Both Cobwebs and Penlink have connections to spyware companies notorious for targeting members of the public. Webloc significantly expands the ability of Tangles to monitor communities, including tracking of multiple individuals across borders and identifying targets within a
given area. Any of the gathered information can be layered onto the mapping interface.

‘https://citizenlab.ca/research/analysis-of-penlinks-ad-based-geolocation-surveillance-tech/

The broker SCI-Network Ltd, has plans to add a new , easy to deploy zero-click spyware product to the line-up of products. However, SCI-Network built products themselves have so far all been duds, leaving it to instead focus on purchasing contracts as the middleman.

https://vsquare.org/orban-spying-toolkit-cobwebs-webloc-hungary-spyware-citizen-lab/

The AI surveillance platform Tangles used fake accounts on social media platforms to infiltrate communities, convince individuals to disclose personal information and monitor populations by gathering a wide variety of information to amass profiles of its targets.

https://www.forbes.com/sites/thomasbrewster/2025/09/18/ice-spends-millions-on-social-media-spy-tech-banned-by-meta-facebook/

Clive Robinson • April 12, 2026 10:01 AM

@ Winter, ALL,

With regards,

“Both strategies can only work by inconveniencing their current customers.

Enter Windows 11.”

The implication of that is that Microsoft believe the people who comprise “their current customers” believe that they actually,

“have no choice”

I’ll be honest and say as far as I can remember back for each MS-OS upgrade, this time around there are many many more times as many articles not just advising people not to upgrade to Win 11 but actively informing how to “migrate away” to GNU / Linux and BSD or other *nix systems safely and securely.

The only one of which I don’t recall seeing off the top of my head, is an article for Polish Security developer Joanna Rutkowska’s “Qubes OS”, that provides enhanced security by “segregation”.

Though finding the likes of,

https://linuxmind.dev/2025/09/02/how-to-install-the-operating-system-qubes-os/

Is not exactly hard…

And for those that can afford to run two “Energy Gapped” and “Segmented” systems, one that is for “OFF-Line Private work” and the other for “ON-Line Insecure External Communications” with suitably instrumented and mandated “Choke Point” “Gap Crossing” would be advised (especially with the second behind a “Garden Path” style security isolating mechanism from the Internet).

Winter • April 12, 2026 1:17 PM

@Clive

“their current customers” believe that they actually, “have no choice”

When I ask them, they do tell me they don’t have a choice. Their employer is totally chained in MS technology and so they are at work.

The only alternative they believe exists is Apple technology. Linux, they say is only for nerds and somehow defective, but they cannot articulate why.

Apokrif • April 12, 2026 3:25 PM

@Zibeli: Sometimes (e.g. on Wikimedia sites) there is 2FA requiring password+emailed code. I don’t see the point as the same email account can be used to change passwords, so it’s actually a cumbersome 1FA

Your Neighbor • April 12, 2026 4:22 PM

Of course then you add to it all the gag orders they issued on this guy,
stingrays in front of his home, camping in the park behind his house all
the time. Evey.Single.Day.For.Months! Right by the fence.

They labeled him as some french spy.

They, the government, in HIS OWN COUNTRY – LABELED HIM AS A SLEEPER,
A TERRORIST??????????

You should all get sued into bankruptcy – you are the terrorists
terrorizing a DECENT FAMILY. ABUSE.OF.POWER.BIG.TIME.

James Risch, senator – ARE YOU READING THIS????????

What does it even mean to be an AMERICAN anymore????
In America even?????

There is no fckng way any one human being would be able
to WITHSTAND, TO HANDLE THIS MUCH EFFING PRESSURE,
WITCH HUNT / HATE CAMPAIGN – without bursting open
AT THE SEAMS – No way! Absolutely no way!!!!!

Welcome to ideho!

Zibeli • April 12, 2026 4:49 PM

@Apokrif: Ah, not sure I’ve ever used one of those forgotten password links but if they enable changing the password via email or text alone I see your point. I’d much prefer a more involved password change process, like my credit card company asking me about details of recent transactions when I called to change my mailing address, but expect that’s a cost the retailers aren’t willing to bear.

Still, I really wish these retailers would at least give me the option of excluding the phone from the process altogether. For a number of reasons I go out of my away to avoid using my cheap mobile phone for anything sensitive, not the least of which is my tendency to leave it behind somewhere fairly regularly. For now, the only way I’ve found to do this is by deleting my online accounts with both these firms.

lurker • April 12, 2026 5:35 PM

@Apokrif, Zibeli

The merchants who think 1FA = 2FA have been lulled into that by those email providers (I’m lookin’ at you, Google) who have bludgeoned users into using Oauthn so that they now have a “Trusted Device”, no need to trust the user any more ,,,

Certainly a step backwards IMO.

GregW • April 12, 2026 11:25 PM

Anthropic’s refusal to support “all lawful uses” for the US Federal government takes on a bit more resonance with their latest Mythos model’s findings of thousands of vulnerabilities of ever-increasing sophistication.

Ismar • April 13, 2026 3:01 AM

Claiming a new word here HALUCILAND

The Road to Haluciland: Why Statistical Probability is Killing Systemic Truth

We’ve all become comfortable with the term “AI Hallucination.” We treat it as a quirky, occasional bug—a stray fact or a weird finger in a generated image. But as we move toward autonomous systems that refactor their own code and generate their own tests, we are facing a much larger architectural threat.
We aren’t just dealing with hallucinations anymore. We are building systems that live in Haluciland.

What is Haluciland?

Haluciland is a state of systemic failure where an autonomous or statistical process drifts so far from its original intent that it operates in a self-reinforcing loop of incorrect logic.
In Haluciland, the system is perfectly consistent but fundamentally wrong.

How do we get there?

The descent into Haluciland follows a predictable path:
1. Statistical Mimicry: A model identifies the “most likely” way to solve a problem based on frequency, not causality.
2. The Circular Validation Trap: The system is tasked with generating its own regression tests. It “hallucinates” a logic flow and then generates a “hallucinated” test to validate it. The test passes 100% of the time.
3. Invisible Fragility: Because the system maintains “syntactic correctness” (the code runs, the logs look clean), the failure is silent.
4. The Loss of the Anchor: The system smooths out critical edge cases and specialized logic in favor of the “statistical average,” eventually defining its most frequent error as its primary truth.

The Problem: Systems Can’t Define Their Own Truth

From a systems architecture perspective, a system that validates its own output has no “External Oracle.” Without an anchor in physical axioms or hard-coded human intent, the system eventually defaults to statistical drift.
It creates a “Prison-style” architecture of the mind—one where the walls are made of probability rather than hard logic. In a security context, this is catastrophic. A gateway that “statistically reasons” its way through a firewall policy will eventually decide that a rare malicious exploit is just “statistically insignificant noise.”

How to Stay Out of Haluciland

To build resilient, high-integrity systems, we must:
* Hard-Code the Anchors: Use physical isolation and hardware-level constraints that a statistical model cannot “reason” its way through.
* Axiomatic Constraints: Implement rules that exist outside the model’s influence.
* Adversarial Oracles: Never allow a system to write the tests for its own generated logic. Verification must always come from a separate, deterministic source of truth.
If you aren’t anchoring your autonomous systems in external reality, you aren’t building a solution—you’re just booking a one-way ticket to Haluciland.
#AI #CyberSecurity #SystemsArchitecture #DevSecOps #MachineLearning #Haluciland

Clive Robinson • April 13, 2026 4:44 AM

@ Ismar, ALL

With regards “”

You firstly note,

“The Problem: Systems Can’t Define Their Own Truth”

This was proved back in the early 1930’s on earlier thinking by Kurt Gödel that I mention from time to time.

Because one implication of it is a Turing Engine computer can not “know” if it is “telling the truth” about it’s internal state or just saying what “malware” tells it to say. Thus Anti-Virus software that of the sort we commonly use that runs on the computer is effectively useless.

Secondly you go on to note,

‘From a systems architecture perspective, a system that validates its own output has no “External Oracle.”’

However any “External Oracle” suffers from the “observer problem” which I’ve mentioned for quite some years on this blog…

Behind it is a problem to do with the work of Claude Shannon in the 1930’s through to late 1940’s that gave birth to “information theory”. In that he proved that for information to be “communicated” in a Shannon Channel there must be “redundancy”.

In the 1980’s Gus Simmons proved that where there is “redundancy” you can create a Shannon Channel within a “Shannon Channel” and importantly the new Channel can via Shannon Perfect Secrecy be secure against any observer.

I’ve shown that by using further redundancy, not only is the new channel closed to an external “observer” hence the observer problem it can be fully “covert” thus oblivious unprovable to the observer provided the first and second communicating parties follow two basic OpSec steps,

1, Maintain “Perfect Secrecy” rules (ie those of OTP usage).

2, Ensure there is no “correlation” between messages and activities (that is not just “message security” but “traffic security”).

Very recently exactly the same argument has been used by others to provide positive proof that any “guide rails” on Current and Future AI LLM and ML Systems will always be vulnerable to “prompt attacks” “input data bias” and many other illicit/malicious attacks.

Therefore we never will be able to “trust” in the rather more strict than “human sense” AI systems…

So as Ivso often observe “this blog is well ahead of the field”

On average it’s around 8 years ahead.

If you want to read more on these “failings” have a look at what I called “probabilistic security” that arose from my research work on what lead up to the “Castle -v- Prison” model that I discussed in quite some depth on this blog with the likes of @Wael, @Nick P, @RobertT, and many others of the old “usual suspects”.

Though kind and attentive, they were a tough audience and “defending a PhD Thesis” would probably have been easier 😉

Clive Robinson • April 13, 2026 5:11 AM

@ Ismar

With regards,

“Why Statistical Probability is Killing Systemic Truth”

The answer is that it’s like “Brownian motion”, or why “Time only goes in one direction despite symmetry”

It’s the difference between

“The number of bits of information N and the number of states the bits can be in S and their effective weight or parity”.

We know that S = N^2

Thus every bit added doubles S.

But the parity weight only changes fractionally from N to N+1.

Thus S is in effect a measure of “possibility” or as we prefer to say “a measure of entropy”.

I’ve mentioned this before in explaining why my son at a very early age understood it from a pile of Lego Bricks…

If you put the bricks together into one lump or model the only freedom left was how you could rotate the lump or model.

However as a pile of loose bricks the number of “potential models” possible was not one, but an infinity of the imagination, limited by how clever you were.

This is the basic foundation rule of “statistical mechanics / thermodynamics” and gives us more formally a measure of “entropy” on information capacity.

Thus information capacity is favoured by “disorganised” rather than “organised” but importantly the average “weight / parity” is in effect a constant for the number of bits.

This can fairly easily be shown to go from a “flat distribution” to a “normal distribution” which I’ve discussed here in the past when talking about issues with “True Random Bit Generators”.

Any way as this conversation is likely to be lengthy, can I suggest for the sake of others using this thread we wait a while?

JG5 • April 13, 2026 11:37 AM

I think that it was discussed here last year that Russia was forced to tighten access to the cell network, because it was being used to dispatch drones, pop-up and otherwise. At times, on an emergency basis, it could be shut down completely or access restricted to government-only. If needed, I have a link to that story. This story is analogous (link and excerpts herewith).

Encrypted channels may be used to dispatch violence. A fascinating – and unexpected – security development. Even if you knew that violence has been dispatched via covert channels more or less forever. If you need to see other examples of covert channels, I highly recommended “Michael Collins” and “The Pentagon Wars.” The last section of the article hints at “projected intent,” with a phone-home capability and the mid-course adjustments that makes possible.

Violence as a Service
How the gig economy of coercion quietly became an instrument of war
https://romankhimich.substack.com/p/violence-as-a-service
Apr 10, 2026
Thirteen Years Old, Recruited on Telegram: Children as Consumables
By autumn 2024, Ukrainian courts were processing a steady stream of minors charged with terrorism. Children — some as young as thirteen — had burned relay cabinets, torched military vehicles, planted improvised explosives near police stations. Recruited via Telegram, paid in cryptocurrency, handled by someone they never met. According to Ukraine’s Security Service, roughly one in five Russian-linked saboteurs caught inside Ukraine was underage; the youngest arsonists targeting railway infrastructure were thirteen years old.
Meanwhile, in Russia, over a hundred minors had been added to the Rosfinmonitoring extremist registry by September 2024 — the highest figure in at least six years — charged with destroying helicopters, railway infrastructure, and military enlistment offices on behalf of Ukrainian handlers operating through the same encrypted channels, the same payment rails, the same disposable-courier logic.
Western reporting covered one side of this extensively. What it almost never addressed is that the operational template was identical on both sides of the front line. The one known exception is a 2024 piece by Bremen-based researcher Nikolay Mitrokhin — notable precisely because it stands alone.
…
Rented, Not Invented: The Drug Market Built This First
But the deeper problem runs beneath the politics.
Neither Russian nor Ukrainian intelligence invented this model. They inherited it. Across post-Soviet space, drug distribution networks had spent years perfecting the operational template now used for wartime sabotage: disposable couriers recruited through encrypted channels, anonymous handlers, dead-drop task delivery, cryptocurrency settlement, escalating assignment complexity. The infrastructure pre-existed the war. After February 2022, state actors on both sides discovered they could rent it.
This is one instance of a structural transformation I examine in The Digital Transit of Coercion: Industrialization, Distribution, and the Emerging Architecture of Remote Violence. The central argument: coercive capability has undergone a digital transit. What was once a scarce resource, concentrated in states and large criminal organizations, has become modular, scalable, and available as a service.
The strategically significant feature of this architecture is convertibility. An apparatus built for financial extortion — with its industrial recruitment pipelines, scripted escalation protocols, automated target selection, and anonymous settlement infrastructure — can be redirected, on demand, toward proxy logistics, sabotage facilitation, or behavioral conditioning for higher-risk operations. The teenagers recruited to burn relay cabinets are one output of infrastructure whose primary business is something else entirely.
…[anonymity can be used for good or evil]
Existing security frameworks are categorically mismatched to this reality. Traditional threat analysis assumes identifiable actors, centralized command, territorial logic. Distributed coercion operates through none of these. The mismatch is not a failure of analysis — it is a failure of categories. And it is compounded, in the current moment, by political incentives to look at only one side of a symmetric problem.
No Crew, No Flag, No Problem: The $50,000 Migration Crisi
In a separate paper co-authored with Aleksandr Turkhanov — Why Civil Control of Dual-Use Connectivity Will Fail in UK Waters — I examine a scenario that is already technically and economically feasible, requiring no exotic capabilities: the use of Starlink-enabled unmanned surface vessels, modeled directly on Ukrainian combat drone architecture, by organized criminal networks.
The application does not require a war. It requires a crisis — specifically, the kind of engineered migration emergency that Alexander Lukashenko successfully staged in 2020–21, flooding the EU’s eastern border with people as a instrument of political coercion. The same logic, applied at sea, with autonomous platforms operating from outside territorial waters, would be simultaneously deniable, cheap, and extraordinarily difficult to counter using existing maritime governance frameworks built around the assumption that vessels have crews and owners behave lawfully.
This is not a speculative threat. It is an architectural one — a predictable output of the same converging dynamics: cheap connectivity, modular platforms, distributed coordination, jurisdictional cover.
Closing that gap requires both analytical tools and the willingness to apply them without asymmetric framing. That is harder than it sounds when the framing is doing political work.
…

Clive Robinson • April 13, 2026 7:10 PM

@ ALL,

Microsoft Reserection the game no SysAdmin want’s to play.

It appears Microsoft are having “raves from the grave rising up” yet again long after they were dead and buried and paved over as municipal car parking…

Zombie Microsoft bugs rise from the dead, pave way for crims and ransomware scum

One was patched almost 14 years ago

“Crooks are exploiting four Microsoft vulnerabilities – one patched 14 years ago and another tied to ransomware activity – according to America’s lead cyber-defense agency, which on Monday gave federal agencies two weeks to patch them.

The four vulnerabilities added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on Monday are:

CVE-2025-60710…,
CVE-2023-36424…,
CVE-2023-21529…, and
CVE-2012-1854…
“

https://www.theregister.com/2026/04/13/ransomware_gang_other_crims_attacking/

Clive Robinson • April 14, 2026 3:22 AM

@ ALL,

AI report is in it’s nolonger “Mostly Harmless” but yes it is Paranoid

Whilst it might have be fun to joke as Douglas Adams once did about AI with,

“The Encyclopedia Galactica defines a robot as a mechanical apparatus designed to do the work of a man. The marketing division of the Sirius Cybernetics Corporation defines a robot as “Your Plastic Pal Who’s Fun to Be With. The Hitchhiker’s Guide to the Galaxy defines the marketing division of the Sirius Cybernetic Corporation as “a bunch of mindless jerks who’ll be the first against the wall when the revolution comes”

It does encapsulate some of the fears and unexpected directions even Current AI LLM and ML systems are going.

And a report to the actual state of affairs is “hot off the laser printer”,

<

blockquote>The votes are in: AI will hurt elections and relationships

Latest report from Stanford’s AI boffins finds unsafe usage practices, widespread anxiety about impacts, and China catching up to the USA

“Artificial intelligence has achieved mass adoption faster than the personal computer or the internet, reaching 53 percent of the population in just three years. The number of harmful AI incidents has increased correspondingly. And both experts and laypeople believe the impact will be felt in two areas: Elections and relationships.

According to the 2026 AI Index Report [PDF], from Stanford University’s Institute for Human-Centered Artificial Intelligence (HAI), “Responsible AI is not keeping pace with AI capability, with safety benchmarks lagging and incidents rising sharply.”

Documented AI incidents – defined as “harms or near harms realized in the real world by the deployment of artificial intelligence systems” by the AI Incident Database – reached 362 in 2025, up from 233 in 2024, the report says.”

<

blockquote>

https://www.theregister.com/2026/04/14/ai_report_2026_stanford_hai/

The obvious first question is,

“Is this unexpected?”

Especially as usage of AI is so high even though it’s not even making it as far as being as bright as a real “Stochastic Parrot” in the intelligence scales. With Current AI systems still showing distinct lack of “reasoning” and/or “real world” knowledge cognition. It is apparently further off than it ever has been as the size pile of “Soft Bullshit” / hallucinations is actually still on the rise…

Thus the second thought that arises is,

“Where is the failing, is it on the AI or human side of the divide?”

The answer should perhaps be visible by looking at the industry speakers to investors… People are still locking as to what Sam Altman and Co have done with the truth…

But read carefully and you will find the early signs of psychological sickness in users that is already leading to deaths…

It would be way to easy to write this off as in times past in the US on “the feeble minded” and “cult followers” and more recently “Doom Scrollers” of Social Media. But what ever you do don’t mention what is sacrilegious, that is it is actually the US social system that actively causes this to be the problem it is.

So the report “thick as it is” has “a long way to go”.

Winter • April 14, 2026 6:56 AM

@+

“Staunch Trump Supporters Are Now Asking if He’s the Antichrist”

I am an atheist, so I tend to keep clear of metaphysics. But when I saw The Mad & Criminal Red Hatter was being described as a Tool of God to force humanity (==Americans) onto the “Right” path it reminded me of stories of my youth.

These stories were about people selling their soul to Satan to get what they want. If you make the end justify the means, you most certainly have left the path of Christianity and moved onto that road paved with good intentions. And so they have.

Now, it dawns on these people what they have done to their own soul, and their country. Obviously, they will blame someone else, most likely the victims of their votes.

Winter • April 14, 2026 1:00 PM

Continued…

@+

“Staunch Trump Supporters Are Now Asking if He’s the Antichrist”

There was already an article about this in 2024. The three temptations offered by Trump.

The last temptation of Donald Trump: How he lured evangelicals to follow Satan
Donald Trump has tempted evangelical Christians just as Satan tempted Jesus — except this time it worked
https://www.salon.com/2024/11/03/the-last-temptation-of-donald-trump-how-he-lured-evangelicals-to-follow-satan/

The final temptation offered by the devil, and by Trump, is the most obvious. The devil offers Jesus power over the whole world, and all he has to do is kneel before Satan and submit to his authority. I feel that I barely have to write anything here — the truth of this is louder than anything I can put into words. People support politicians, most of the time, based what they perceive as their own self-interest.

ResearcherZero • April 15, 2026 2:56 AM

@Clive Robinson

Linux has dd to simply make bootable USBs and install Qubes. Debian is pretty easy to use and updating Linux installs is so much faster than the enormous Windows update packages. You can also make bootable USBs using the GUI in most modern distributions from an ISO image/archive.

CopOS (Windows) can probably make a bootable USB from an image, but Linux is better IMHO.

Who has time to wait for an hour for Windows to update every month? Who wants an operating system full of bloated rubbish and spyware that requires a bunch of tricks to disable? Even setting up a proper offline account requires a hack to access the terminal and create an account that does not require an email and registering with Microsoft. Then – ensuring that encryption keys are changed and not shared with Microsoft – is essential. (though you are still f–ked)

Once all the necessary changes are made, Windows then jams another load of junk into the system with the next update, which require disabling and another hundred or so bug fixes.

At some point Windows will ask people to verify their age and upload a selfie before the system boots and Microsft will hoard biometrics of everyone for account verification. Windows already has the necessary components to make it a reality. It is cop operating system, not a free one.

–

@ALL

Government wants even more cop in your firmware and operating systems. California wants to introduce regulations to prevent 3D printers from printing from unapproved print files.

‘https://www.theregister.com/2026/04/14/eff_california_3dprinted_firearms/

lurker • April 15, 2026 3:12 AM

@Winter, Researcher Zero

A phenomenon of ‘Madness Literature,’ characterized by exaggeration, playfulness, and irrationality, is gaining popularity among contemporary Chinese youth in cyberspace. References to a couple of papers on it turned up in my inbox, but the abstracts don’t explain how some current world leaders are afflicted with it. One headline: “Daily expression of madness as a communication practice: an interaction ritual chain analysis of hysterical literature”

https://doi.org/10.1080/17544750.2026.2655346

Winter • April 15, 2026 3:43 AM

@lurker

“Daily expression of madness as a communication practice: an interaction ritual chain analysis of hysterical literature”

Sounds very interesting. Sadly, I cannot yet get the full paper, but I will keep an eye on this.

The combination of good higher education and pervasive censorship in China has bred a remarkable level of different argots to express “anti-social” thoughts and feelings. Madness and hysteria has always been an outlet to express what could not be articulated in regular language, cf court jesters. I do suspect that this expression of madness might also be used to channel thoughts and ideas that Chinese censors want to suppress.

As China has embraced AI for everything, including censorship, there will be a perpetual arms race between humans and machines about the meaning of expressions.

smoke • April 15, 2026 9:26 PM

Government wants this
Government wants that

“All governments are lying cocksuckers” – Bill Hicks

“You are free to do as we tell you!”
“You are free to do what we tell you!”

the end of gates • April 15, 2026 9:29 PM

The powers that be SEE how Linux and alternative OSes are really taking off..

This age verification bullsh*t is partly to KEEP YOU from using anything but the slop the government wants you to run. And Microsoft is a powerful beast still flailing around in government and corporate worlds.

Join the resistance – switch to Linux and other free/open source operating systems. Fk Windows and Fk Microsoft.

Anonymous • April 15, 2026 9:55 PM

Do not despair – for even if the Internet is locked out by age verification/meat bag scans of face, eye, hand veins or what not – we still have mesh networks and other technology to raise our own communication networks.

Does anyone remember BBSes? No, not the WWW message boards, but the dial-up BBSes where a SysOp (human) had control and not an ISP! While some dial-up BBSes still exist, many have gone Telnet (insecure) and/or SSH!

The dial-up BBS movement was so popular the users had to be pushed to the Internet for greater monitoring. Have fun monitoring thousands or millions of different BBSes ran by different SysOps outside of the Internet! Ha, ha! One day they shall return as the government and corrupt corporations such as Microsoft try and thrust you into digital chains.

If you are unfamiliar with the dial-up BBS age and when it could thrive again, check out the following documentary:

BBS: The Documentary
https://en.wikipedia.org/wiki/BBS:_The_Documentary

While I have not seen it personally, it’s a good starting point in your journey.

Control belongs in the hands of users and their human SysOps, NOT snooping ISPs!

Here is more info:

https://en.wikipedia.org/wiki/Bulletin_board_system

And if you wish to check out (some) of the BBSes running today:

“The Telnet BBS Guide focuses Bulletin Board Systems – the original Social Network, serving the BBS community for over 28 years! We list both Dial-Up and Telnet accessible Bulletin Board Systems all over the world. We currently list 1019 BBS and related systems with brief and detailed descriptions and a downloadable text-version listing suitable for listing on your BBS or for as a download for others to view and use.”

https://www.telnetbbsguide.com/

The future is in our hands.

maqp • April 16, 2026 4:09 AM

@Clive Robinson

Yeah I’m still kicking. Glad to hear some people are still around. How are you?

Clive Robinson • April 16, 2026 6:02 AM

@ maqp,

Glad to hear you are still mobile enough to “kick” those who need it 😉

As for me, I’m just out of hospital again… And I’ve acquired a respiratory infection whilst being in there, so can now cough up a good supply of bathroom tile adhesive ={

The annoying thing is it was all very unnecessary due to “politics”.

In the past I was given anti-biotics in advance as a pre-prescription, so I had them on hand. Such that at the first sign of trouble likely to lead to sepsis[1] I could get on top of it fast and stop it in it’s tracks, whilst the medicos caught up with what other wise is a rapidly spreading infection (atypical cellulitis leading to sepsis and worse).

But now such pre-prescribing is nolonger allowed in the UK so by the time I get to see a prescriber even through A&E I’m well into the danger zone… So get not just admitted for several days but very expensive anti-biotics. So hundreds of times the cost of a pre-prescription of out of patent meds that cost more for the packaging they come in than the meds themselves…

But it gets worse… As I started in A&E got put into isolation where another event happened, I actually ended up on a Cardiac ward and thus my “discharge notes” make no real sense at all…

So perhaps unsurprisingly I get a bit grumpy over the idiocy clearly on display…

Especially as now “due to the new meds” they can not get blood out of me for very important tests to adjust other meds to stop strokes, TIAs, CEs, PEs and other DVT type blood clotting events that could easily lead to something called DIC[2].

[1] Sepsis is a world wide mass killer and sadly many Drs still don’t take it as seriously as they should,

https://en.wikipedia.org/wiki/Sepsis

I’ve had it sufficient number of times to make me quite the “statistical outlier” and what some Drs call an “Expert Patient” which is actually quite a derogatory term when you think about it.

[2] Outside of “critical care” DIC “Disseminated intravascular coagulation” or as the dark humour the Medical profession call it “Death is Coming” is not really known to many and something you really don’t want.

It is to put it simply, blood clots and lack of platelets in the internal organs giving rise to systemic and unrecoverable organ failure,

https://bestpractice.bmj.com/topics/en-gb/184

Clive Robinson • April 16, 2026 5:42 PM

@ Bruce,

Not sure if you’ve seen this or not?

Iran-linked hackers disrupt operations at US critical infrastructure sites

As the US and Israel’s war has ramped up, so too have hacks on US industrial sites.

“In an advisory published Tuesday, the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency, Department of Energy, and US Cyber Command “urgently” warned that the APT, or advanced persistent threat group, is targeting PLCs, short for programmable logic controllers. These devices, typically the size of a toaster, sit in factories, water treatment centers, oil refineries, and other industrial settings, often in remote locations. They provide an interface between computers used for automation and physical machinery.“

https://arstechnica.com/security/2026/04/iran-linked-hackers-disrupt-operations-at-us-critical-infrastructure-sites/

In effect a “reverse play” on stuxnet.

Leave a comment

Blog moderation policy

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.