Schneier on Security

Mr. Pragma • May 13, 2014 7:50 PM

I don’t trust greenwald any further than I’d trust nsa or, for that matter, any us-american entity whatsoever.

He has worked and is working for/with newspapers that are well known to “negotiate” (read: bend over) with regimes like the usa and uk. And his new project is with a billionaire well known to have (and probably still) partnering with cia.

Maybe those “freedom fighters” are just working on usa’s panopticon project, maybe it happens to just suit someones agenda to “strip” some us agencies, maybe Snowden is just an asset (not necessarily knowingly) of an infight between nsa and cia, whatever.

What I personally find more shocking than ever more “revelations” about nsa is the sheep-like readiness to be manipulated into focussing but the usa. Of course I can’t prove it but I’m certain beyond any doubt that every government does or, provided it had the means, would do, too. Similarly pretty government quickly forgets anything about democracy when secret services are concerned. Granted, usa — as usual — acts particularly law-ignorant, criminally, and brutally, but in the end pretty every country’s secret services so whatever their means allow; some like Russia or Suisse might have at least some reasonable restraint by, for instance, actually using their services to fight off espionage and the like while others like almost certainly pretty every nato member act no better than any mafia syndicate.

And I find it shocking how many are basically quite content to lament somewhat but to happily continuing their use of windows or linux and their unreflected praise of open source software.

And there is something more.

For whatever strange reason pretty no country seems to have any interest in developing alternatives or, god beware, their own ICT industry. China is mainly occupied with producing whatever can be produced and sold and even the whole of europe seems to be content to do hardly more than to staff us-american corp. factories.

Didn’t it strike anyone that having basically no options besides using us-american processors or uk designs/licences (arm) they played themselves into usa’s hand to do whatever they fu**ing please?

Roughly 99% of all business or government computers are based on us-american cores.
Roughly 99% of all network backbone equipment is based on us-american products product cores.
Roughly 99% of all business, government or network equipment is using or based on us-american (or easily controllable or to be manipulated) software like windows and linux (you don’t like me putting linucks there? Well, go and look up who is “sponsoring” the core and majority of kernel and critical standards software in linucks … Hint: ibm, redhat, etc.)

Pardon me but this whole thing reminds me of a very attractive woman having a walk in a transparent gown without bra or panties in a very, very bad neighborhood around 3 am and her family complaining the next day that she has been a victim of undecent approaches …

So, yeah, go right ahead and bash the nsa some more (“oh no! they’ve actually (ab)used yet another free meal we provided to them. Yuck, how despicable!”) – or else go and do your part in building a more solid, safe and secure ICT world. Or at least demand your government to support some kind of national project.

Or, in other words, stop lamenting being raided in your tent and start building some brick walls.

Mr. Pragma • May 13, 2014 8:21 PM

Leon Wolfeson (May 13, 2014 8:13 PM)

Last time I checked Arm was in uk. As I said (” or uk designs/licences (arm)”).

And whatever “here” means, no, I do not want to stop or dictate american companies doing business “here”, elsewhere or whatever.

What I said was that a) I suggest to avoid using american products and b) other countries finally start to work on their own designs or any significant ICT industry at all, beyond copy-producing us or uk products, that is.

So, in your dictum:

Oookay… I suggest you read something before commenting it.

Mr. Pragma • May 13, 2014 11:57 PM

Figureitout (May 13, 2014 10:53 PM)

No. I didn’t assess “the americans” but their country and those in control of it.
Granted, it’s not easy to like americans and it’s seductive to reason that all that ugly dirt is their responsability. But sadly, I’m afraid, “the americans” are hardly more in control of their country and the actions of its agencies than we non-americans are.

So, I’m perfectly willing to see that there are single americans who are decent beings and who do decent work; Bruce Schneier comes to mind (he is american, isn’t he?) or Prof. Bernstein.

Unfortunately, however, it’s not these decent americans who are in control of usa’s agencies and institutions of crime, espionage, anti-democracy attacks, mass-murder, etc. Consequently, so it seems, it is a reasonable and sound approach to simply avoid any and all american products and services, assuming that they are tainted or corrupted.

If it helps usa lovers to feel better, I see much responsibility with other nations, too (although guilt isn’t my interest; solutions are). After all it’s (from what I know) not usa’s guilt that other nations lazily took whatever usa served rather than building up their own ICT industries (beyond merely copy-producing).

In a way some of this reminds me of Microsoft some 25 years ago. Microsoft didn’t get big because they were so great; they got big because the other players were so bloody incompetent and ignorant.

That’s why I don’t like (for instance) Europeans just complaining about how evil nsa and the usa are. After all, Germany and France, to name some examples, had every chance to build their own capabilities. Unfortunately, for whatever reason, they chose not do much more than building factories, most of them even by usa corporations, to produce american CPUs.
And it could be done. Russia, for example, although living through extremely difficult times, managed to at least pick up OpenSparc and build something on it. Similarly China made quite impressive progress based on Mips. So, those “mighty” countries like Germany or France sure enough could have done something similar, too.

In the end it’s simple. If you are dependent on others to provide you with processors they have the capability to manipulate your networks and computers.

So, rest assured that I do see the responsibilities of others too, when I seem to just bash the americans.

Mr. Pragma • May 14, 2014 1:38 PM

Skeptical (May 14, 2014 7:39 AM)

You do not discuss — and even less so on a technically informed level — you merely propagandize. -> No further answer deserved.

@all

Well, this matter does have strongly political aspects. I agree with those, however, who desire to keep the political discussions limited and to concentrate primarily on the technical issues.

I’m missing a well informed essay by someone like Bruce Schneier along the line “What do we have to learn from heartbleed?”.

We may find that “the americans” are guilty, evil, whatever – but this doesn’t make ICT more secure or reliable.
We may discuss again and again about the most minute details of what greenwald et al. have made public and about whether it’s credible and if so, why and to what degree, etc, etc – but this doesn’t make ICT more secure or reliable.
We may stress again and again and again the miraculous advantages of open source – but this doesn’t make ICT more secure or reliable.

No doubt, open source has striking advantages. But there might be buts. For one openssl is open source and yet none of the “many eyes” spotted the problem; neither did the senior guy who nodded OK some youngsters terrible code. Nor did thousands of engineers in projects using openssl – most probably because they didn’t look but simply trusted in the first place.

It seems that at least a major part of the problem is more in the social/psychological sphere rather than in the technical corner.

Did S. Henson nod OK Seggelmanns explosive code because Henson was an nsa or gchq agent or otherwise malevolent? Almost certainly not. Almost certainly he simply assumed a PhD candidate who after all co-worked on the RfC to be qualified and competent and to act accordingly.
And the “community”, for instance, the distribution maintainers in charge, were the evil-minded? Almost certainly not, almost certainly they simply assumed code from openssl, after all a security crown jewel, to be very well checked – or maybe they were just frightened to check it because actually they had occasionally looked into openssl and saw what a nightmare the mixture of encryption (lots of math, not easy) plus a shocking pile of very questionably organized, structured, and maintained code was. Which- or whatever it was, again a layer of control and trust failed and again the next layer relied on non-existing control and safe mechanisms not knowing they were actually playing lotto.

Now whom could concerned individual turn to (and why would they do that, assuming that multiple very knowledgable layers nodded openssl OK and “secure”, in fact in a way “the core of security”?)

Commercial auditors? Hardly. Even mid-size companies could hardly easily afford that, not to even think about your average citizen John Smith.

State authorities? Actually yes, actually that would fall plain in the center of a modern states responsibility, and in fact many states do have something like an agency for ICT security.
Unfortunately, though, those agencies didn’t do their job. Maybe in part the states, in particular nato states, didn’t want citizens too secure from prying eyes. But quite certainly, at least in many cases, also because they made the same error that other layers had made; they assumed that the “crown jewels” were very well engineered and checked. After all, wouldn’t it be insane if, say, some student could check in some unverified explosive code?!

Maybe it’s about time to understand that “open source” is for the most part more a social, political, and psychological issue rather than a technical one (in fact, the very term “open” strongly hints at it).

Don’t get me wrong. I’m by no means anti open-source and I do see its advantages. But it’s about time to also see its disadvantages and it being basically more about social and political issues (democracy, “bazaar”, copyleft, etc.) than about technical ones.

What we need, both as states and as citizens, are never sleeping and well trained technical guard dogs. Dogs that act like “I don’t care who you are, I don’t care how great, democratic, beloved, respected or whatever you are. You want to pass that bag of code into my area and I will sniff it carefully and based on the assumption that a first day newbie with evil intentions wrote that code, period.”