Schneier on Security

Clive Robinson • November 25, 2012 5:02 AM

@ Figureitout, Nick P,

It appears the BSD CVSup breach due to lost certificates is becoming higher profile news,

http://www.pcworld.com/article/2014744/hackers-crack-two-freebsd-project-app-dev-servers.html

Clive Robinson • November 25, 2012 6:00 AM

OFF Topic:

Now this is of serious concern,

http://www.bbc.co.uk/news/technology-20461752

Not for the “mark of the beast” reasons but because it’s a full blown invasion of a persons privacy done under threat by an authority in a position in which they can over extend their authority in an abusive manner.

And don’t fall for the “faux pro” arguments of safety and security these tags are absolutly nothing of the sort those in position of authority have an agenda be it simply cost saving or much more sinister and they will “work the crowd” with any “think of the children” or “it’s anti-drugs” or “anti-terrorist” etc and will jump up and accuse any dissenters or protestors of being pro-drugs / pro-terrorism / pro-child abuse etc in any way they can to get their way.

Clive Robinson • November 25, 2012 6:33 AM

OFF Topic:

Over on Finacialcryptoography IanG has put up a post about Facebook finally going all SSL and giving the reasons why all sites should do so,

https://financialcryptography.com/mt/archives/001397.html

Oh and his second but last link points of to one of his earlier posts “in praise of Bruce” over the selling of vulnerabilities and his reasoning for thinking that the NSA has a significant hand in why the Internat is so vulnerable to day and as to why the US War Hawks can go and demand appropriations for Cyber-Warfare.

Clive Robinson • November 25, 2012 11:51 AM

@ Simon,

So, what if products are made desirable and people really want them, but really do the same thing? It’s like mixing some suga with the poison, eh

If you are aware of the products failings, are over 18 and it is realy your choice then, that’s your choice.

If however you are doing it because “it’s cool” or “what every one else does” then still your choice but, are you realy an independent person or a pack animal?

If however you feel you have to wear it like “gang colours” because otherwise you have misgiving or fears about how you will be treated then that is bordering on compulsion and not somewhere you want to be, unless you have good reason.

If however you are unaware of the features or cannot apreciate what harm they can do if you are correctly informed then again you are in effect being coerced by someone being decitful or taking advantage of you.

It’s an awkward situation because we get compulsion such as addatives in bread and tap water, the ability to avoid them is dependent on your ability to be able to purchase alternatives or make an alternative.

Take for instance “corn syrup” it is a product of chemical aduteration of a geneticaly modified plant (even if only by controled cross breading) that current research appears to indicate has undesirable properties that give rise to behaviour equivalent to some forms of drug addiction.

Take cigarettes, they are not just tobacco in fine paper, both are adulterated with chemical addatives that you would not be allowed to put in food and also in effect “freebase” the adictive alkaloid drug that causes the addiction to be rather more than mild.

These forms of compulsion we appear to accept as a society for reasons that are beyond me as the longterm cost to society can be quite significant.

Is tracking adults continously any worse in longterm outcomes to these? I don’t know.

But I assume properly informed parents will make a choice if they can for their children, but it appears there is no longterm option in this case. At the moment it’s only two out of a hundred or so schools that ALL will be eventually put in thhe trial so moving your child to another school is putting off the inevitable not making a choice. It’s a bit like being caught out in a storm and standing under a tree when you start to get wet and you could run to a tree where it’s still dry but you know eventually even that tree won’t provide shelter…

I don’t like choices being enforced on me and I don’t expect many parents like them being enforced on their children, especialy when you have good reason to belive that the coercion is not as presented and thus far from either benign or acceptable.

But at the end of the day there is societal norms, does this fall in line with the norms of the society you live in? if it does and you find it uncomfortable you have to choices protest by whatever means you can or up stickc and go to another society if you can.

Clive Robinson • November 25, 2012 5:51 PM

@ Nick P,

Speaking of Certs that don’t match, the first one that pops up on this site has,

*.defendinovation.org

As they say “there’s a lot of it going about”.

Clive Robinson • November 27, 2012 4:49 AM

@ figureitout,

Google skeptical of WCIT-12

Google are not the only ones have a look at,

http://www.internetsociety.org/doc/WCITSubmissionOctober2012

With the reply from the ITU they are being a little disingenuous to put it mildly.

Firstly IT IS ONLY the nation states that can vote not any other organisations that might be attached to the delegations in an advisory position.

Second “freedom to communicate” does not in any way cover the privacy angles, or political suppretion…

As an example under various bits of human rights legislation and treaties you “have rights” but there are many places in the world where torture, control of food supplies, water (and more recently by Russia) energy supplies are used as political tools.

You need also to bear in mind that Governments are just like parasites that live on the host body of the citizens of a nation state. Like all parasites they want to survive at any measure including destroying the host as they feed off of it.

So a government needs a food source (taxation) and a method of ensuring it (control of legislation) and to defend it’s self (rigged election and running process of representational democracy) and it’s ability to control the populous in various ways including as we have seen with “terrorism” excuses to monitor and prejudice against what it sees as a threat to it’s existance.

So from a government perspectiiive the Internet lacks “their guiding hand” and importantly they are not making tax off of it, they want this to change. Further they don’t likee the way it does not conform to their Geo-Political view of the world as can be seen by proposals to effectivly turn the internet from the advantages of packet switched to the disadvantages of circuit switched traffic, in that Governments want to know not just where traffic originates but how it was routed.

So yes there is a lot at stake, because the ITU are looking to swittch from the harmonisation of methods and spectrum (it’s original purpose) to control of traffic and importantly content.

One thing you have to watch out for is the use of “for testing”. Testing is a method/tool that is agnostic to it’s use. It is extreamly invasive and as such makes an idea vehicle for illicit monitoring etc. Go back to the CarrierIQ debacle on smart phones to see this, oh and other current thinks like “rage shake” fault reporting where by if you shake a beta “test” phone (see Facebook and Android smart phones) it sends it’s whole current state back to the software developers. I can assure you that the low level “hooks” for such a thing will remain present in the final versions of software and OS because they are integral to the design methodology and thuss fundemental functions of the software. And the thing about such hooks is once they are there all somebody has to do to be malicious is work how to “hook up” with them (as was seen with the Greek Olympic phone hacking scandle).