Delicious recipe of squid with cabbage, bean sprouts, and noodles.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
EDITED TO ADD (10/9): Posted a day early by mistake….
bcs • October 8, 2015 5:34 PM
Bruce must be in Japan or something, it’s still Thursday in the US?
Lien Jerky • October 8, 2015 5:51 PM
hmm… I occasionally poke through my Windows 10 (Pro) settings to find surprises. After doing a Windows Update, I found that both my C: and D: drive (my disk is partitioned to a C: and D:) had the “Allow file contents to be indexed” turned back on. This is the third time since I did a clean install a month ago that the setting has changed after an update. I guess Microsoft wants to index my file contents even though I turn everything I can find off.
I also notice that although I select to defer updates, Windows 10 is doing update checks and installs anyway. I air-gap my computer most of the time, but do occasionally have to connect for the project I am working on. I keep noticing occasional significant slow downs while compiling my program. I look at my router and the lights are blinking away even though the program I am running is not accessing the internet or network. Looking in Task Mangler.. er… Manager, it show windows update running, not even waiting for an idle time.
Ugh… I hate Microsoft. If I did not have to use it for this project, I would use Linux or BSD or anything but Microsoft.
ALien Jerky • October 8, 2015 5:52 PM
lol, typo in my name in previous post
Clive Robinson • October 8, 2015 6:18 PM
@ Alien Jerky,
ay. I air-gap my computer most of the time, but do occasionally have to connect for the project… …Manager, it show windows update running, not even waiting for an idle time.
I’ve not given house room on my machines to anything past XP and I have a standalone “on loan” laptop with Win7 that never gets connected to a network for doing some very esoteric support.
However there will be a point in time when I will have to support Win10 or later.
I would be curious to know if anybody knows the answer to the question “What does Win10 (home) do when connected to the Internet but all the currently known Micro$haft update service IP addresses ranges are blocked at the first firewall it sees?”
For instance does it not try to run the update manager or does it continuously bash it’s self against the Firewall or perhaps take another route to get around the IP address routing?
AndrewJ • October 8, 2015 6:20 PM
Bruce makes a special cameo in a video entitled “Why The TSA Doesn’t Stop Terrorist Attacks” – https://www.youtube.com/watch?v=-LDzOi1dyAA
Whilst it’s nothing new to readers of this blog, using pop culture & humour to communicate these kind of facts is very effective. The video has been watched more than 1 million times in under 4 days!
It’s TGIF in Australia, is Bruce here?
Dirk Praet • October 8, 2015 7:17 PM
@ Clive
I would be curious to know if anybody knows the answer to the question “What does Win10 (home) do when connected to the Internet but all the currently known Micro$haft update service IP addresses ranges are blocked at the first firewall it sees?”
I suppose a red shield with some exotic error code in the updater would be the desired outcome. By now, there’s already scores of telemetry/tracking blockers out there, some of which you can download from Github and inspect their code. Some examples are DisableWinTracking and BlockWindows (also works on Windows 7-8.x). There’s another one called DoNotSpy10 but which according to Virustotal would contain an adware PUP.
scapegoat softwareengineer • October 8, 2015 8:18 PM
Why is this important?
All software engineers, coders and CTOs like Mr. Schaneier are at risk!
CEO scapegoats the ‘few bad apples.’
This ‘legal ploy’ will fail in a similar way to the
Enron Accounting
and BP Macondo Oil Rig Scandals.
The counter-attack (this is not legal advice and could be ill-founded, read at
risk) is called
“Of Bad Apples and Bad Trees: Considering Fault-Based Liability…” by Geraldine Szott Moohr.
Analogy: the CEO is the fungus rot. His
nenchmen spread the virus to the Tree.
The Tree poisons people.
And the CEO SCAPEGOATS the few
‘bad apples.’
This alone and mentally ill ‘bad apples’ – (not fully human but apple-like) are scape-goats.
Appendix 3: How to Pick a Scapegoat like consultant – CTO Mr. Schneier?
1.)choose software. Most on the jury do NOT understand software and definitely not SECURITY software.
2.) Software has many touch points, unlike hardware (engine combustion chamber seals metal processing). So, there are many possible scapegoats – ALL software engineers including those 3rd party vendors who touched
‘version control’ or CVS or github or even Linux.
8.) It’s best to pick out the minorities who perhaps the JURY does not like. These could include, as cited in the NUREMBERG TRIALS after World War II,
the Jews. Note. Mr. Schneier seems to be Jewish. Maybe there’s a Latvian whose parents used to be Communists.
Other possibilities.
9.) The CEO has acces to ‘intelligence orgs’ and this could be called a ‘cutout’ or
plausible scapegoat scenario.
The criminal gangs (all considered innocent, even the CEO until proven guilty in court of law that could apply) the CRIMINAL GANGS call this framing the ‘fall guy.’ – in this case,
the low level software coder.
Other examples from the World War II Nuremberg Trials can be explored.
12.) What is strange is that the GERMAN VW Org is known for precise details. The CEO in front of the US Congress on TV did NOT say the names of the alleged scapegoats.
14.)Expect the German ‘intelligence orgs or collaborator media’ to leak dirty
and sordid details about the alleged software engineers fired.
18.)In my opinion, I can understand this sort of thing in a USA culture organization. But a
GERMAN one strains credulity?
As we know from the internet, during the Nuremberg Trials, after World War III or rather 3 -1 = 2,
The Germans KEEP DETAILED RECORDS and love to document their improvements and performance.
bad apple – fauler Apfel CEO or low level coder?
tyr • October 8, 2015 9:17 PM
Another instance of the famous Bruce.
http://efanzines.com/eapa/eapa138.pdf
Just a snippet and a picture with a mean interpretation
of his opponent. : ^ )
I’m sure an FR routine can ID him from the picture.
Peanuts • October 8, 2015 11:57 PM
Windows 10 and the indexing is just the tip, with the w10 implants having been back ported and deployed to Windows 7 & 8, check or re-check your customer improvement participation settings.
all w7 8 and 10 now need mass Survailance payloads, now that includes turning CIP on if you had not set it or set it to off and the sending telemetry and diagnostics on installing kb’s marked optional and important. The updated privacy policy says paraphrasing analysis, cloud service enabled operations may result in your confidential data (which presumably they need indexed) being exfiltrated where any authority related to law may troll the cloud held data and service you directly if your offline thought(s) are ever of interest.
They override you prior CIP elections of settings without so much informing or obtaining consent. Bet you don’t remember being informed that installing the Kb would drop your drawers to the floor and instrument all your on and offline activities at big datas discretion.
Find the script to detect patches on last weeks squid post, but check your CIP settings and read privacy policy if you have need to throw up lyour lunch from the kb Survailance platform update poisoning.
So what could possibly go wrong with your documents indexed, cloud shared, tracked like a lab rat
name.withheld.for.obvious.reasons • October 9, 2015 12:32 AM
About little over a week ago I proffered that there has been a substantial transmogrification of CIA structure, mission, and operations. A significant change in directorates, and new “cyber-centric” focus, and what I can only assume is a large scale “scrubbing” of their organization. It’s as if they are deliberately hiding their very existence. The following article begins to explain the situation:
There is also a summary post at Cryptome:
https://cryptome.org/2015/09/cia-ddi.htm
Michael • October 9, 2015 12:54 AM
@ scapegoat softwareengineer
Every market needs a rogue trader from time to time
As every peaceful nation needs a war criminal or two
In Japan • October 9, 2015 2:08 AM
It’s been Friday here in Japan for over 16 hours!
Also, the Adam Ruins Everything sketch is over on College Humor’s YouTube channel.
ianf • October 9, 2015 2:41 AM
@ Wesley Parish‘s post dealing with “Opsec by Lisbet Salander” in an earlier squid thread.
“What do people think of hidden cameras as a defensive tool of OPSEC? Can they be spoofed?”
If their software/video drivers are not air-gaped, certainly can be spoofed with ghost or dynamically subtracted shapes/ images (provided that such fooling of the target is needed for the attacker’s subsequent ingress operation, and cost of breaching it remotely be justified – even spooks have budgets). This in turn presumes advance knowledge of the acquisition/ make/ placing of the cameras, which means that they could’ve been subverted prior to delivery/ setting up. Anyway, this entire plot device feels out of place in such a low-budget civilian investigation case as that ascribed to the punk Salander, The Twentysomething With The Opsec Skills of a Veteran Dragon. In liberal-fascist Sweden where CCTV cameras grow on trees (low hanging fruit).
Who let that video surveillance genie out of the lab: lazy git programmers one flight of steps away from the Trojan room coffee pot.
“What about misdirection, indirection, drawing up dossiers on the target – in this case the police state, as a tool of OPSEC?”
What about them? It’s SOP: Know Thy (real or imaginary) Enemy, subvert the workings of thy enemy. It goes without saying that, without substantial opposition research, any counter op you mount will at best amount(sic!) to random vandalism.
As for misdirection of intent for leading subsequent forensics astray, the only example I can come up with was in some techno-crime fiction, where the police spent considerable effort on breaking into a culprit’s armored vault—only to discover it EMPTY. As in signaling “it isn’t here,” rather than leading them further astray with bogus, needing-to-be-laboriously-deciphered, contents. Fortunately soon a hobby-minded protagonist realizes that the enormous model railroad network in the attic is in reality an analog digital computer, with the input data masquerading as train time tables (assembly and reassembly of wagon sets in automatic marshaling yards no less). I KID YOU NOT. Considering the overall speed of setting up AND DEBUGGING IT INTO PERFECTION, let alone that of subsequent “calculations,” I wonder when the baddie found time to do the nasty. Seems that novel’s author became enamored of Babbage’s concepts in @sciencemuseum & tried to translate them into the tech he was familiar with ;-)) [Can’t come up with the title, alas.]
As for the rant, consider it a serendipitous bonus. The whole Larsson series seems speculatively targeted at the main new fiction-buying segment of the public (Larsson did his homework): the 40-something educated ladies. Hence the frisky heroine, the weepy male investigator, and the absence of any hardware-heavy violence. It’s amateurish at best (I’ve seen the movie), and should’ve been labeled FANTASY alongside Harry Potter—that no one accuses of bad magick opsec.
Jacob • October 9, 2015 3:41 AM
At the beginning, government desire to be able to access encrypted information was “to fight terrorism”. Then came the excuse of paedophilia. Now – hold tight – to investigate car crashes!
“On Thursday, Comey said the issue afflicts not just federal law enforcement but also state and local agencies investigating child kidnappings and car crashes..”
More disturbing are other facts mentioned in the above article: although the Obama administration will not, at present, pursue legislation that will force tech companies to be able to decrypt user data, it is suggested that the companies may nevertheless help the FBI “in some ways”:
“The FBI and Justice Department have been talking with tech companies for months. On Thursday, Comey said the conversations have been “increasingly productive.” He added: “People have stripped out a lot of the venom.””
and
“One senior administration official said the administration thinks it’s making enough progress with companies that seeking legislation now is unnecessary. “We feel optimistic,” said the official, who spoke on the condition of anonymity to describe internal discussions. “We don’t think it’s a lost cause at this point.””
ianf • October 9, 2015 4:32 AM
@ Wesley Parish asked about “hidden cameras as defensive tools (of OPSEC)” but I just remembered a fictional case of offensive deployment of such by a non-state actor. BBC 3?-episodic mini-series from mid-1990s, which is when I VCRd such en masse, again can’t remember the title.
It concerned a middle aged journalist, who invaded someone’s privacy in a rag (British speciality then and now), and then defended that vigorously on Question Time & in print. Privately, she was a hidden alcoholic living by herself in a desacralized (apt word?) former church. Her deepest kept secret was abandonment of her aged mother in an old people’s home.
Well, someone took exception to her invading the privacy of others’, and decided to teach her a lesson of do unto others by surreptitiously moving into the hitherto unoccupied attic, installing mics and cameras, and recording son-et-lumiere video of the gal getting plastered in a bath tub (gratuitous full frontal nudity delicately obscured by The London Evening Standard, I think). Which cassette was then put through her mail slot, with copies delivered to the Fleet Street. By that time the occupant of the attic had vanished, so the police couldn’t do much. That’s it—though there must’ve been something more to it, which I’ve blotted out, because the series concluded with the daughter getting old Mama out of that home.
Clive Robinson • October 9, 2015 4:35 AM
@ ianf,
I to remember the empty safe model railway computer plot.
It was from a long time ago, the bit that also sticks in my mind was where the intel officer had to explain to his boss why he had to go to the auction and outbid everybody for all the lots. And for some reason it makes me think it might have been a “Harry Palmer” era film as for some reason I see the boss as “Col. Ross”…
The other thing was it left me with the feeling it was not a computer that worked in the more conventional sense but one that worked more like a “DNA Computer”.
Maybe somebody else will remember the exact film name.
ianf • October 9, 2015 4:47 AM
@ Jacob
Doesn’t it practically sound like an invitation to future industry whistleblowers to START GATHERING EVIDENCE NOW of para-legislative, potentially unlawful collusion between one’s employer in business and the spooks?
Intrustive Google Auto • October 9, 2015 5:32 AM
The proposed American Cyber Sharing law supposedly prohibits data mining for competitive advantage. But it does nothing to prevent companies from instrumenting competitor’s computer systems for themselves.
http://www.motortrend.com/features/mt_hot_list/13-cool-facts-about-the-2017-porsche-911/
Notice Google declined to provide a full list of what data is collected as you drive. It makes sense that Google removed the “Do No Evil” from their masthead.
Governments must start developing transparent data-exchange agreements where citizens are told exactly what data is being gathered and under what circumstances.
The terms of service format must be clear, in detail and searchable, not some annoying 173 pages in a little scroll box. Agreements cannot be one sided all-or-nothing. In autos GPS must have a switch to disable by the owner with a status similar to Blue-tooth status. Citizens must have the right to disable the tracking at any time similar to cell phones.
Here are the dim-wit automakers allowing an arch competitor to instrument their autos. https://www.android.com/auto/
Clive Robinson • October 9, 2015 6:00 AM
@ Jacob,
More disturbing are other facts mentioned in the above article: although the Obama administration will not, at present, pursue legislation that will force tech companies to be able to decrypt user data, it is suggested that the companies may nevertheless help the FBI “in some ways”
Back when Comey started his “front door” nonsense I did a brief analysis of his motives for putting his credibility on the line by asking for something that was basically not possible.
One scenario I thought likely and mentioned on this blog was the old “horse trader trick” of pushing impossibly hard for the best horse, knowing that the owner would not sell at that price but would as a consequence give further than they would otherwise have done on the second best horse just to make a sale.
Later with the nature of Win10 and back porting to every OS as far as Win7, it became obvious as I also mentioned that the “front door” was simply going to be “collect it all from everybody” to avoid the “tipping off” issue altogether, and then go for a legal loop hole via a “cut out” of a company and it’s business records via NSL etc. Which if nothing else proves the case against Micro$haft and their incestuous relationship with the US IC&LE. A sweet little deal that means the Feds don’t have to pay for infrastructure or storage, which also avoids all FOI attempts and was a nice little wheeze until a couple of days ago when the European Courts of Justice said “NO”… Not that ECJ was first the Russia’s politicos sent a clear shot across Micro$hafts bows about the illegality of Win10 data harvesting.
Thus, I think it’s safe to say from a practical perspective Comey has a major victory if he has not out right won Crypto Wars ][ in the US at least. The question then as I indicated on the ECJ judgment page of this blog is how does the US Gov force this down other nations throats? And as I indicated there the secret terms in Obamas Trade Treaties is one obvious way in which US Companies could be used to make countries pay through the nose until they fall in line.
The only solution to this is to get rid of BGP and it’s deficiencies that can be used to route traffic through US or other FiveEyes Nations controlled telecomm’s space and change the fundamental physical network topology to get rid of the “all roads lead to Rome” issue that makes the US the black widow spider sitting in the centre of the web. Which would also require the cessation of use of routers that originate or pass through the US and other FiveEye etc, where “a little extra spice” might well be added…
Bob Paddock • October 9, 2015 6:39 AM
I like Friday on Thursday, works out better for us morning people. 🙂
“… Adding to the problem are self-encrypting drives (SEDs) that further thwart techniques to recover data from SSDs,…”:
ianf • October 9, 2015 7:03 AM
@ Clive, that “intel officer had to explain to his boss why he had to outbid everybody for all the model railroad lots” sounds even more daft than in the book (not film) that I remember. Must’ve been a movie plot device, to jazz up the narrative with something that the moviegoers could relate to. Because, if a complex analog computer first needed to be broken down for the auction, then had to be rebuilt, how would that ever work for reals? “Harry Palmer” does ring a bell, but probably another one. OH, SCRIPTWRITERS HOW I LURVE YOU BIG TIME.
[…] “left me with the feeling it was not a computer that worked in the more conventional sense but one that worked more like a “DNA Computer”.”
We hardly know how DNA works, yet here is a GENIUS that can simulate its base flows using but simple HO scale model railroad? No wonder he had to be hunted down like Alan Turing.
ianf • October 9, 2015 7:05 AM
How Eating Squid Destroys IQ
Found in a cultural-events newsletter from Embassy of Japan:
It’s 2015, two Japanese were just awarded Nobel prizes, yet their centrally-run embassy networks’ admins have not learned that no URL of a rearranged or even deleted page ever need be retired? What, server redirection or simple aliasing of files doesn’t work in Japan? The worst of it, there’s no way to communicate that to the local embassy staff, because (a) they don’t grok the problem; (b) they’re not in charge here.
Bob S. • October 9, 2015 7:08 AM
Some good news for a change:
“On Thursday, California Governor Jerry Brown signed a bill into law that requires police get a warrant to use a stingray during investigations.
The devices, which are also known as cell-site simulators, are usually used to locate a phone but can also in some cases intercept calls and text messages. ~arstecnia
The law is written using general terms rather than to specify devices or technologies, in anticipation of new technology coming along. Arstechnia asked law enforcement to comment and they refused.
Will they comply?
mike~acker • October 9, 2015 7:44 AM
[Barton Gellman] showed leaked NSA slides at Purdue, so feds demanded the video be destroyed
Op-ed: Snowden confidante, a journalist, recounts recent tale at Purdue University.
Source: URL: ars technica by Barton Gellman – Oct 8, 2015 3:40pm EDT
if you or I violate the law we end up in jail. the Feds just order the evidence destroyed .
Jacob • October 9, 2015 8:02 AM
Parallel Construction training guide for DEA agents:
https://www.muckrock.com/news/archives/2014/feb/03/dea-parallel-construction-guides/
@Bob S : this can help the California LEO while continuing to operate stingray devices.
Clive Robinson • October 9, 2015 8:06 AM
More pain for SPE on the way?
For some time there have been claims of sex discrimination in Hollywood. Back in may the ACLU called on the US Equal Employment Opportunities Commission (EEOC) and other agencies to investigate the hiring practices of Hollywood.
In essence Hollywood appears to think it is immune to the 1964 US Civil Rights Act (CRA). Thus long over due the EEOC appears to have finally stirred from it’s near comatose performance in this by sending out fifty letters to Hollywood directors asking them to make appointments with EEOC agents to talk.
This sort of behaviour in the past has led to Class Action law suits.
The problem for SPE is after they were hacked and all those EMails were released into the public domain, it’s going to be impossible for SPE to claim there is no sexism because the emails are riddled with it…
Just something to keep an eye on over the next few months/years.
Remember though that no matter how bad Hollywood sexism appears, the IT industry appears as bad. So much so that in the UK interviews with those attending Uni suggest just the apparent image is stopping women considering IT as a career path, even though there is a desperate shortage of IT qualified staff and employers are getting desperate for even entry level staff.
ianf • October 9, 2015 8:33 AM
What’s SPE, Clive? The only unexplained acronym in the post. I suppose you could have meant Sony Pictures Entertainment, but then why not simply type SONY?
Duck doesn’t know
https://duckduckgo.com/?q=SPE&iax=1&ia=meanings
neither does Jimmy
https://en.wikipedia.org/wiki/SPE
BoppingAround • October 9, 2015 9:32 AM
[re: Win10] Dirk Praet, Clive Robinson,
I am also interested as to what would it do. Especially if one uses the built-in
firewall (wf.msc). Will it obey or will it do something nasty?
None of my machines were able to virtualise Win10, though.
the Russia’s politicos sent a clear shot across Micro$hafts bows about the
illegality of Win10 data harvesting
Funny. I have been told that the infamous Roskomnazdor declared Win10 to be
‘clean’, as users ‘agree’ to surveillance via EULA.
viscose pigeon • October 9, 2015 10:01 AM
In case there’s anyone in the GCHQ or the NSA who has ever considered moving on to a line of work that is actually beneficial to their fellow citizens (or perhaps just something that is a bit more in line with the constitution):
“A group of Berlin-based anti-surveillance activists launched Intelexit, a campaign to encourage employees of the NSA and British spy agency GCHQ to reconsider the morality of their spy work and to persuade them to quit. They planned to kick the project off with a series of billboards strategically posted near intelligence agency buildings around the world. One, reading “listen to your heart, not to private phone calls,” was to be installed next to the Dagger Complex, a military base and NSA outpost in Darmstadt, Germany.”
-Intelexit website: https://www.intelexit.org/
Luke • October 9, 2015 10:38 AM
Any thoughts on LastPass being acquired by LogMeIn?
Skeptical • October 9, 2015 11:22 AM
@Jacob: More disturbing are other facts mentioned in the above article: although the Obama administration will not, at present, pursue legislation that will force tech companies to be able to decrypt user data, it is suggested that the companies may nevertheless help the FBI “in some ways”
Of course – there are times when it would be unethical NOT to help the FBI.
This is a no-brainer for most people. For some people, it’s more about “fighting the government” than privacy, and for them, any cooperation with the government is anathema. Such people are, at least in this respect, idiots (though holding at least one idiotic opinion is difficult for anyone to avoid). For others, it’s about privacy and autonomy, not fighting the government; for them, if they’re able to protect other users and help shut down X/Y/Z heinous activity at the same time, they’ll do so.
Is this really that difficult to understand?
Bob S. • October 9, 2015 12:16 PM
@boppingaround
Re: “users ‘agree’ to surveillance via EULA”
Absolutely!
In a nutshell, I am pretty sure that is the new paradigm agreed upon secretly by the government and corporations.
Major corporations by default opt-in EVERYONE to mass corporate surveillance via the EULA then turn the data flow over to the government (and marketers) for a handsome fee. It’s a win-win for them, but lose-lose for everyone else of course. Users can try to opt-out but it’s a maze of whack-a-mole sliders, multi-screens and super fine print to even find a mole. And once there are millions of moles, it’s game over.
I think it’s spreading to hardware and firmware, too.
What about those who try to evade mass surveillance? They, by definition, become adversaries, the enemy, targets, traitors (see comment by skeptical) and suspected criminals thus justifying even more intrusive surveillance.
As for the opt-outs option, there is no doubt in my mind the corporations will be able reverse the settings via mandatory auto-updates as well as simply add new auto-opt-ins that override the opt-outs. FB is infamous for that maneuver.
So what if I have an no-squeak air-tight box with every known defense? When I send an email to a google user the content is immediately lost to the corporate-government regime. Etc.
There comes a point when the mass surveillance devices, apps, and firmware become so iniquitous there is virtually no escape. I think that’s the accommodation Comey is referring to: auto-opt-in makes encryption, opting-out, etc. irrelevant. And, it’s all legal because they make the laws, interpret the laws and choose which laws to follow or enforce.
Who the hell cares what the peasants/adversaries think?
They are the venomous snakes (new official government slander term for cyber dissidents) and the enemy.
Selja T • October 9, 2015 12:39 PM
Hidden money in free open source software?
Lets assume this completely 100% hypothetical example of Mrs. X who’s participation in a free open source software project Y is public domain knowledge. One afternoon she went to a bar. In the ladies room, when in front of a mirror, some woman came in and checked that no third person was in the room, before saying something to the effect of “Mrs. X, our organization greatly values your contributions to software Y, so take this bag full of cash and read the paper note with instructions on how to contact us via tor to get more” while opening the bag’s zipper, revealing stacks of cash.
Later, via tor, Mrs. X would regularly receive coordinates of dead drops with cash buried. She would have to drive tens of kilometers to desolate places, take a shovel and dig third of a meter deep to get bags of money out of the ground. She tried to tell the mystery benefactors that “please funnel at least part of that money via proper channels to software Y”, but no. All this secrecy and shady cash handling made Mrs. X to think that the funders might be somehow related to some illegal activity. Maybe they are some sort of drug cartel or other drug dealers? Maybe that mystery woman on the ladies room was an enforcer for a drug cartel? How likely is that? Drug dealers from Pablo Escobar and Griselda Blanco down have been known to donate to various causes.
Probably the organization read the software project’s Github pages. That enforcer or whatever probably followed Mrs. X from home, which is creepy and weird to think about.
It is already public knowledge that drug dealers use free open source software for their business. That issue is settled. It is part of the deal that society has accepted (except maybe few people who are TLA directors).
The mystery cash enabled Mrs. X to quit her day job and buy all kinds of nice things, including: golden necklace, pearl necklace, rolex watch, ridiculously expensive shoes, two really nice cars, big 4k screens, custom built golden mouse and keyboard made of rare rainforest tree, caviar, helicopter trips, several custom built silent liquid cooled computers mostly for fuzz testing the software Y… Every computer runs either Linux or FreeBSD, because they are the best (despite being free).
Does anyone have a problem with that? What should Mrs. X do? Not take the money? She did not steal it, she earned it. Someone might say that Mrs. X bought things with drug money, but as far as she is considered, the drug money transforms to FOSS money as soon as she digs it from the ground. Drug dealers are at most a tiny fraction of the user base of software Y. In any case Mrs. X is not involved with illegal activity per se. At least that funding did not go to guns, ammo and paying hitmen or hitwomen for kills, if they are the kind of organization that does that sort of things.
Mrs. X thinks that other core members of software project Y receive cash the same way. Looks like this open source software project is hooked on drug money.
To prevent a situation where some people might start to mistakenly think that Mrs. X might herself be involved in some illegal activity, there has to be little bit of money laundering, on which the donating organization gives some legal advice. They say they have lawyers for that. Communication is never real time. It is mostly by tor and sometimes the cash dead drop also includes an SD card with an encrypted partition. They make feature requests, which then take first priority. Since there is reason to believe that the money is drug related, Mrs. X asked if the benefactors could sell her some cocaine for testing how it feels. Next dead drop included that, which is even stronger indication of drug relation, but they might have bought it from “the street” like any other consumer. Anyway, snorting that cocaine just made Mrs. X sick and nose itchy along with a strange feeling. She sold the rest to others, who said it was ok for them.
Mrs. X does not have any information that could hurt the mystery funders.
Jacob • October 9, 2015 12:57 PM
@Skeptical
It is not the anathema to anything government. It is a push-back against the “extraordinary rendition” of user data, en masse, done without due process (FISA court, presidential orders and parallel construction do not count) or universal justice, while also doing horse trading in a dark alley with Corporations that we used to trust – to access that personal data of ours.
I am sure that if a suspected criminal is forced by the court to provide his decryption password, and only by the court, the masses would go along with that, and only the constitutional purists would complain. However, to connivingly extract personal data, wholesale, from the world population and keep it to the end of time, ready for use to any governmental agency that would like to mold it for whatever reason they see fit, is very difficult to digest.
I am also sure that if the FBI/NSA would say, with effective oversight and gurantees, “we will gather information that would be automatically destroyed after 1 year. No back door in encryption products. Anything to the contrary must carried out only against a specific designated target or be approved by a Judge” would go a long way to calm us all.
Principalities & Powers • October 9, 2015 1:50 PM
Headline: “Government Likens Ending Bulk Surveillance to Opening Prison Gates”
Comment: the examples continue daily, almost endless. Populations at large remain ignorant. The real purpose of the surveillance state is not to deter terrorism, halt pedophilia, or investigate car wrecks. A cocktail napkin cost/benefit analysis proves this. In fact, it is likely to be used for the subjection of the governed to authoritarian rule. Literally. Whether planned that way or not.
It’s best to do your private work ‘off the grid’, entirely. Resign to the fact that all of your efforts produced ‘on the grid’ are observed, cataloged, mined, and modeled. If you do not behave 1) like an apathetic post-apocalyptic zombie or 2) like a state-compensated shill then you will be targeted for further analysis. If you are an actual threat to the authority rather than a mere dissident, you will be dealt with. Eventually, dissidents will be dealt with, too, I suspect.
I view my glass of milk as half full; I wish I were not so cynical about this subject.
ianf • October 9, 2015 2:30 PM
Hypothesizes Selja T:
… etc conspicuous consumption that drew unneeded attention to herself from her social circle, from authorities, perhaps from criminals. Or didn’t the mystery donor warn her of the danger of playing Sudden Riches, a clear breach of any, even formally not illegal, OpSec. Perhaps in a setting where such overt displays of affluence are the norm it wouldn’t attract undue attention. But it only takes one hungry for promotion, zealous tax inspector to observe that a FOSS developer, hardly that lucrative a niche, rides a Porsche and sports a Rolex.
[As an aside, it could as well be a long-playing entrapment operation, esp. with the respect to “feature requests, which then took first priority.” WHAT KIND OF FEATURES other than library hooks for backdoors and similar innocuously looking tweaks in the code?]
Nick P • October 9, 2015 2:41 PM
@ Selja T
You talking about Truecrypt or Bitcoin creator(s)? 😛
First, I’m going to point out that reality works the opposite of your scenario: NSA et al are pouring $200+ million into solutions to weaken INFOSEC across the board. These are secret programs, often SAP’s/USAP’s, that spend about a third of their budget on hiding whose doing what. They don’t need cash drops: can just give either no information or legally lie about what they’re working on. This includes cover stories, fake addresses, fake phone numbers, and so on. If it’s private, it will be by a defense contractor who similarly can do that plus has private protections. If it’s covert, they can publicly issue the contract to a person on their team for an unrelated reason while the deliverable is totally different. There’s only a subset that gets paid in bags of cash and it’s not typically for software. 😉
Second, esp after Snowden, the opposite could happen where people who need it discretely pay for security/privacy/anonymity. Well, it’s not necessary to be secret about it because most good projects aren’t & with no negative effect. That was easy, eh? 🙂 The most likely scenario would be sending money to a non-profit supporting such activities or to trusted developers already working on it. Tor project and Moxie Marlinspike come to mind immediately as examples of each. The donor might reduce liability by hiding the donation in any number of ways, including cash. It would likely be messengers rather than holes in the ground, though. So, concealing the source is a possibility.
Third, the best security might come under pressure, legal or secret. This is the scenario that could motivate one or more private parties to pay the right professionals (or dedicated amateurs) to create it. The pro’s’ would also want to use OPSEC. Closest to your scenario. The problem is that the intelligence services would target the developers, not the funders. The developer’s OPSEC would have to be really good as even Tor isn’t guaranteed against globally present adversaries like Five Eyes. So, they’d have to be out of the threat model or assumed to get to the developers eventually. Essentially, you’d have to pick developers you could trust to never betray you under any motivation of FBI/CIA/ISA, never screw up in the intelligence game, or at least let you know somehow so you can stop using the program.
All in all, I’ve only seen a few times where this might be attempted and each time it seems that our enforcers could’ve stomped them. That they even lasted was suspicious given how hard OPSEC, especially laundering, can be in a surveillance state targeting those people directly. The scenario might have happened or even be happening. It would be a good thing as at least it’s investment into good things. However, I’d recommend against the developer taking the deal because it’s (a) high risk in many ways, (b) might lead to extortion/subversion later, and (c) one can get sponsorship from elites/rich instead. You won’t be rich yourself but you’ll make decent to great money. Probably just gotta benefit their company on the side with your brains to help them justify the nice check.
Conclusion: the most deployed scenario is clandestine/covert weakening of all security schemes; most private support would be to non-profits, established developers, or security-oriented companies esp w/ ROI; black bag jobs supporting FOSS or security projects will be rare with significant chance of prosecution or even long-term, subversion goal. Best opportunity is in the middle. Just make sure you give sponsors a selfish reason to do it and the selfless reason to do it. Also, suggest image benefits to make the selfless part benefit their selves, too. 😉 Best, safest model as you can always quit with any benefits you’ve acquired if risk is too high and then you can still go the third route from there if you dare.
Informational Self-Determination • October 9, 2015 2:47 PM
After decades of aggressive mass surveillance by our spies, Silicon Valley and Wall St, America has met its match in the European Union and many other countries.
Since the Snowden Revelations our government has continued to ramp-up storing the World’s Internet traffic in Utah, while other nations are denying us the opportunity to steal their protected private correspondence.
Despite spending billion each year the Russians have out maneuvered the USA numerous times from the war in Ukraine to the military operations in Syria. Who else is embarrassed? Even Congress is publically upset with the lack of Intelligence from our ‘Intelligence’ service. The Office of Personnel Management has be found incompetent after allowing 22 million top-secret investigations to be stolen.
Now over 50 years later the CIA director admits they lied to Congress repeately to cover up the Kennedy assignation.
Being abouve the law, it’s obvious our lies and lack of respect for other human beings is an issue. American Exceptionalism is now America’s Disgrace. God created all people equal. Our leaders urgently need to come to grips with reality. You are NOT going to be allowed to continue stealing other people’s data. Please negotiate verifiable data safeguards on equal and transparent terms.
Here is the wonderful story of the Max Schrems who just won the landmark privacy case in the European Court of Justice. Edward Snowden told him on Twitter that he had “changed the world for the better.”
http://www.nytimes.com/2015/10/11/business/international/behind-the-european-privacy-ruling-thats-confounding-silicon-valley.html?ref=technology
rgaff • October 9, 2015 2:49 PM
@Skeptical
“Of course – there are times when it would be unethical NOT to help the FBI.”
This means, it’s “unethical” to assert your constitutional rights not to talk to the police and incriminate yourself. You have an ethical responsibility to waive your constitutional rights! I’d love to know which law enforcement agency Skeptical works for (not that he’d tell us the truth, it’s legal and encouraged for law enforcement agents to lie to us, but illegal for us to lie to them).
https://youtu.be/6wXkI4t7nuc (by the way, this is from the USA perspective of law)
Not good • October 9, 2015 3:02 PM
So, LogMeIn have acquired LastPass for $110 (£70) million dollars/pounds.
News story here and official blog here. There were so much negative feedback they closed the comments section.
I can see it going the way of LogMeIn – why else acquire LastPass unless they think they can monetize it? LogMeIn has an egregious security record.
Their official response to the comments:
Thank you for all the support we have received in response to our exciting news today. To address the concerns that some in our community have raised, I want to personally assure you that this is good news for our users. First of all, we (LogMeIn/LastPass) have no plans to change our existing business model. Secondly, this acquisition provides us with access to resources that will enable us to innovate faster, as we continue to strive to deliver an even better product than the one you have come to know and love. It is also important to note that the current LastPass team is staying in place and remains committed to deliver on the promise of privacy, security and convenience that has been our mission since day one. I appreciate and am proud of the passion of our community, and we will continue to work hard to maintain your deep loyalty.
Skeptical • October 9, 2015 3:17 PM
@Jacob: However, to connivingly extract personal data, wholesale, from the world population and keep it to the end of time, ready for use to any governmental agency that would like to mold it for whatever reason they see fit, is very difficult to digest.
That’s not what the FBI does when it approaches a company, or a developer, for cooperation in an investigation.
A lot of discussion is focused on foreign “bulk” surveillance, but the FBI has nothing to do with that.
I also think that folks are vastly overestimating the probability of their data ever being viewed, noticed, or even retained by any intelligence agency. A small fraction of total traffic is collected, and from that point the focus is on processing it to remove irrelevant or regulated material, so that when an analyst finally looks at something, the probability is greater that she is looking at something useful to her mission. The US intelligence agencies are not wasting their time building files on every person in the world. Obsessively worrying about it is akin to being concerned about contracting flesh-eating bacteria by riding the tube.
What’s far more disturbing to me is the aggregation of data by private entities, who have every interest in not only selling predictions related to that data, but in pushing hard the idea that the data they’ve aggregated is useful.
Let’s say Data Warehousing Incorporated – well, we’d need to give it another name… how about, Precision Foresight Incorporated – starts to get really serious and granular in its collection and products. What books have you purchased lately? What searches have you run? How long have you lingered over certain pages relative to other pages? How about your significant other? Family members?
And they aggregate it all into a theory about you as individual for certain purposes.
For example: Person X seems to have a steady employment history, but he’s looking at a lot of pages about depression, and his spouse has been reading about marital counseling. There’s a lack of any purchases at pharmacies, and no searches at all looking for mental health professionals.
Person X has just applied for a mortgage. Precision Foresight judges him to be a much greater risk than indicated by his credit score and employment status due to the other factors I’ve described. And unfortunately for Person X, Precision Foresight has a great marketing team that is connected to all the right people at banks – and so the banks have purchased their product.
And hey, let’s assume that Precision Foresight even has a pretty good model – they’re right more often than not, and Person X actually is more of a risk than his credit history and employment would indicate.
Do we as a society want that level of scrutiny when an individual applies for such things? I don’t think we do, for various reasons.
That kind of thing genuinely concerns me, because I think it can trap people in bad circumstances (to name one serious issue among many). And I think private industry is at a point where it can start to “achieve” that type of product, and I think moreover that the dynamics exist for such a product to be sold with success.
But the government? I think the telephone metadata program toed the line, and after 9/11 I do think the US Government – who at that time thought that they had little clue about what threats were around the corner, whose policymakers had insisted on reviewing much greater of raw threat reporting themselves and were understandably disturbed – stretched the legal limits of surveillance relating to foreign contacts.
However, the disclosures have also shown a rather thick level of compliance programs and reporting in place. I think it’s a fair discussion as to how to demonstrate such compliance in a manner more understandable and visible to the average person – how many are going to dig through compliance reporting and FISC opinions (that continue to be released, incidentally), after all? And it’s a fair discussion as to whether the compliance in place is adequate. But, there’s been zero evidence of any surveillance being used for Hoover-era harassment of political dissidents, despite huge amounts of data being placed in the hands of parties extremely adversarial to the US Government.
So, to be perfectly frank, I think we have a fairly good grip on managing government surveillance. It’s not perfect, and there are areas for improvement, but the institutional structures and norms are all there. We’ll continue to argue about it, and discuss it, and as often happens in a democracy where progress is often a matter of compromise, no side will be completely happy with actual policies.
But the collection and use of information by private entities? I think we’re very far from being in a good place there. Paradoxically this is due in part to the same ideology that is most concerned about government surveillance – libertarians are rarely fans of government regulation of business or private transactions. And judging by the difficulty of the US Republican Party in managing the more ardent of such folks in their midst, I think they’ll unfortunately continue to make progress in this area very hard to achieve.
In Europe, the situation is somewhat better so far as private collection of personal data is concerned, but actually much worse so far as government collection of personal data is concerned – which is what makes the advocacy of some in here for European based VPN, email, hosting, or other service providers so unintentionally amusing. And don’t even get me started on the ECJ’s recent decision (a rather limited decision on a narrow question, I’d add, though the Irish court which raised the matter to the ECJ may now make decisions of far more consequence).
ianf • October 9, 2015 4:04 PM
@ Informational Self-Determination/ “After decades of aggressive mass surveillance by our spies, Silicon Valley and Wall St, America has met its match in the European Union and many other countries.
Wish I were that upbeat as you are, but am afraid this recent EUJ ruling is more of a first shot across the bow of the US Internet juggernaut, than anything solid on which to redefine the relationship of Europe’s dependence on America. Nothing wrong with that per se, as long as neither part is building up a fascist state—which, alas, appears to be happening over there. But even without that we have plenty of homegrown nincompoops and corruptible officials to do American companies local bidding. Anything for jobs for the boys in marginal constituencies and economically depressed areas (Hon. Jim Hacker, MP, would wholeheartedly agree even without Sir Humphrey Appleby’s prodding). So let’s not drape our Microshaft-free windows with the V-for-Victory signs yet on credit!
@ Clive Robinson already said it best:
rgaff • October 9, 2015 4:48 PM
Under USA law, here’s a quick summary from https://youtu.be/6wXkI4t7nuc why you should NEVER TALK TO THE POLICE or any other law enforcement agent under any circumstances:
The idea that “pleading the fifth” is only for the guilty to hide behind, is false, and wrong. Even the US Supreme Court agrees that it’s there specifically to protect the INNOCENT… not just give the guilty a more fair chance at sentencing.
So, here’s why you should NEVER talk to the police:
Here’s the URL again, everyone should watch it if you live in the USA: https://youtu.be/6wXkI4t7nuc
name.withheld.for.obvious.reasons • October 9, 2015 4:57 PM
Finding myself here, again, as Skeptical pontificates on the “sin of business” and the “virtue of government”. Click-bait is always a chore, especially when what is offensive is the lack of perspective and a measured sense of reality. This issue, though not as tragic or unacceptable, is not unlike the “bicycling/living/driving/walking while black”. Law enforcement feels both compelled and righteous about being able to use deadly force to address risks that rate from “flower child or ring bearer at a wedding” to a self confessed and convicted serial killer on the loose.
Where people and businesses use networks and systems to conduct a myriad of transactions, communications, publication, and dissemination it is disconcerting that the U.S. government sees fit to insert itself into the process of person-to-person or business-to-business activities. Eliminating all propriety in human communications cannot be a good thing, the underlying breach of trust, law, and faith in government by citizens cannot help but be a by-product of continuous, expansive, and total surveillance.
@ Skeptical
o, to be perfectly frank, I think we have a fairly good grip on managing government surveillance. It’s not perfect, and there are areas for improvement, but the institutional structures and norms are all there. We’ll continue to argue about it, and discuss it, and as often happens in a democracy where progress is often a matter of compromise, no side will be completely happy with actual policies.
Amazing, did you write this?
Where is it possible to “compromise” when a party to the “agreement” is without the “[con]text” of the operative framework[s]? All we have been left with is a place to put our signature–“Please sign to affirm that you HAVE NOT READ THE AGREEMENT”
Please, demonstrate where in the United States or in the rest of the world where the process of total surveillance provides for a “new” or “improved” representative democracy? The question to you, Skeptical, reminds me of “Mouse and Squirrel”…”Hey Rocky, watch me pull a rabbit out of my hat!”
Again…
ianf • October 9, 2015 5:57 PM
@ rgaff
A by and large sound advice, but then there’s the but: if taken into custody (=euphemism for being cuffed), at some point one will have to talk to the police, or wither away in a holding cell. So while your hardcore “shrinking the footprint of incrimination” may be correct, it is not very practical. Asking what the charges are against one, and what rights does one have in the circumstances, plus asking for Legal Aid in a polite tone, has to be possible. Of course, never answer a question in return, or rise to any “why don’t you tell us in your own words” sincere “storytelling” invites.
I see that this is one of the recurring topics here, e.g.
https://www.schneier.com/blog/archives/2008/07/why_you_should.html
https://www.schneier.com/blog/archives/2013/11/how_to_avoid_ge.html
… and most recently when Clive Robinson sorted out a certain rgaff:
https://www.schneier.com/blog/archives/2015/09/people_who_need.html#c6706710
rgaff • October 9, 2015 5:58 PM
@name.withheld
Yes, watching people pontificate on the benefits of nazism (under the guise of “better democracy”) is particularly disturbing!
rgaff • October 9, 2015 6:28 PM
@ ianf
In the USA, you do not get let out of a cell because of talking to the police and convincing them of your innocence. You really need to WATCH THE VIDEO to see why, if you can’t see it from my summary.
It’s EXTREMELY IMPORTANT in a real life situation to ALWAYS be plucky and happy and cheerful and have a smile on your face, and have a good attitude, and don’t worry about how long things will take, just hang out in silence all day and night for as long as it takes. Let that police officer rack up as much overtime as he wishes asking you questions, or doing his paperwork in front of you with the big blank videotape sitting on the top of the stack… Don’t give him flack for it, don’t mouth off at him, don’t be in any hurry to go anywhere, if you’re missing an appointment people will usually be understanding if you explain later.
There are LOTS AND LOTS of videos on youtube of people having the wrong attitude, it gets them in TONS of trouble, way more than necessary. You don’t DEMAND “am I free to go?” in the middle of every question they ask, for example… You don’t yell at them, you don’t raise your voice, and you don’t explain to them, you don’t get irate and you don’t show it in your voice, you don’t lecture them about the constitution, and you don’t tell them why…. just be polite, sincere, honest, but firm. That’s all. It’s not that hard, just takes a little mental discipline. People need to learn self control. The situation usually only goes south quickly because of a lack of self control on your part, not because of you POLITELY asserting your constitutional rights (I can’t emphasize enough the word “politely”).
rgaff • October 9, 2015 6:31 PM
With regards to Clive Robinson recently “sorting me out”… you might notice I’ve been VERY CAREFULLY emphasizing that what I’m saying ONLY applies to the USA… And if you don’t believe me, you need to watch the video and see what the Supreme Court justices themselves say, don’t take my word for it.
Alien Jerky • October 9, 2015 6:37 PM
Simply, always have YOUR lawyer present when talking with police. Only say what YOUR lawyer tells you to say. Until YOUR lawyer arrives, simply play a game of silent observation.
tyr • October 9, 2015 7:52 PM
OT
This is a fun one.
https://www.youtube.com/watch?v=fi57r_JByNE
The Chinese government bit leading to the Dalai Lama
rejecting his next reincarnation is priceless.
@Jacob
After seeing what the US media considers presidential
candidate material expecting the government to adopt
reasonable methods is not about to happen.
What the CIA is doing is called “distancing itself”
from a lot of ugly questions about the Syrian cluster
of fornication.
I saw somewhere that the Canadian ruling party is giving
money to the Republicans campaign chest. Maybe that’s
the “way forward” (a euphemism I hate) is to let foreign
governments and citizens select the US president. It
might be better than the current system of selection by
giving the one who is the most insane specimen the job.
@rgaff
You forgot one fact about police. they do not talk to
you unless they think you are a criminal already. Most
people have never been around them enough to see how
their mind works.
rgaff • October 9, 2015 8:55 PM
@ tyr
Right… I only summarized the first half from the lawyer… the last half of the video from the policeman he specifically says he tries to never “interview” anyone unless he already has evidence or somehow thinks they’re guilty! It’s good to watch the whole video, not just my little summary…
fet uerteþ • October 9, 2015 9:14 PM
547,285 words, zero facts, 86 unsupported assertions clumsily attempting to suggest insider cred, 54 irrelevant hypotheticals betraying defective analogical reasoning, it must be Skeptical!
Wait, Where’s the Big Lie? There’s got to be one, otherwise it could be any impostor with a 91 IQ and a shit Corinthian Collage education.
Ah. Here we go.
“zero evidence of any surveillance being used for Hoover-era harassment of political dissidents”
Skeptical. His borborygmi are lies. His rales are lies. Even his flatus is false.
Mifi_Stuff • October 9, 2015 9:27 PM
Mike Perry once wrote well of T-Mobile and Verizon cell modem devices that provide a WiFi access point for data services only in the United States.
https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy
(under hardware in the link above)
For reasonably priced prepaid possibilities in the United States, how about:
1) StraightTalk (Verizon or AT&T)
or
2) YourKarma (Sprint)
https://yourkarma.com/
http://techcrunch.com/2015/07/22/karmas-pay-as-you-go-lte-mobile-hotspot-starts-shipping/
http://thenextweb.com/gadgets/2015/08/04/karma-go-review/
Any thoughts or things to consider would be appreciated.
The main interests are: hardware isolation, the fact that yourkarma allows guest users, and not so much trying to be anonymous to the ISP.
Finally, much of the planned internet traffic would use Tor or do you think this invites too much scrutiny. Realistically, if one has been using Tor for years already, perhaps it is too late to avoid scrutiny. VPN use is not really being considered, but is an option.
Threat model: wholesale surveillance, cookie tracking, browser fingerprinting, corporations for whom I am the product, and the like.
name.withheld.for.obvious.reasons • October 9, 2015 9:49 PM
@ Clive Robinson, et al
Recently you suggested that the risk analysis of network computing SECURITY would likely not make the boardroom but instead find it excused as a cost-of-business like statement or DISMISSAL. I did not argue the point but the good news is that given the EUJ decision on safe-harbor, but more specifically, the OECD “Working Party on Security and Privacy” work framing risk components that more than likely produce a 10-K/Q filing requirement that speaks to mitigation from nation state surveillance conduct.
Link to OECD Group:
http://www.oecd.org/sti/ieconomy/digital-security-risk-management.htm
Filings to the SEC, in the near future, may require a statement about “exposure, potential and total loss of assets or business activities, and shareholder/executive liability.” Publically held companies are going to have to bake in the “high risk or potential total loss of assets/investments” given the extreme overreach of the security [sic] state.
Sony Pictures breach is a case study (poor as it is) where a presumed state actor attacks (this seems to be a more useful then accurate description) an entity that trades publically. People may soon find that the true cost of the ever present surveillance, grab everything, state apparatus is VERY EXPENSIVE.
Justin • October 9, 2015 9:52 PM
@ Alien Jerky
Simply, always have YOUR lawyer present when talking with police. Only say what YOUR lawyer tells you to say. Until YOUR lawyer arrives, simply play a game of silent observation.
There is no such thing as YOUR lawyer in post-9/11 America. Prosecution and defense work together against you, and police and prosecutors are always privy to whatever you tell YOUR lawyer in any case. If you make a bar complaint, it will be dismissed, and you will never get legal representation in your life again.
name.withheld.for.obvious.reasons • October 9, 2015 10:13 PM
One more oxymoronic product, found this on publicintelligence.net.
Summary from the site abstract about NSA’s SHARKSEER:
Program Definition: Detects and mitigates web-based malware Zero-Day and Advanced Persistent Threats using COTS technology by leveraging, dynamically producing, and enhancing global threat knowledge to rapidly protect the networks.
CAN IT PROTECT ENTITIES FROM OVERLY ZEALOUS AND SELF RIGHTEOUS STATE ACTORS HAVING THREE LETTER ACRONYMS?
name.withheld.for.obvious.reasons • October 9, 2015 10:16 PM
Link markup got scrubbed during post:
65535 • October 9, 2015 10:19 PM
@ Clive R
“…if anybody knows the answer to the question “What does Win10 (home) do when connected to the Internet but all the currently known Micro$haft update service IP addresses ranges are blocked at the first firewall it sees?”
“Microsoft will use its customers’ upload bandwidth to deliver Windows 10’s updates and apps with a peer-to-peer technology resembling BitTorrent, a fact that has caught some by surprise. Baked into Windows 10 is a new technology Microsoft dubbed “Windows Update Delivery Optimization” (WUDO) that is turned on by default for all editions of Windows 10. However, only some SKUs (stock-keeping units) — notably Windows 10 Home and Windows 10 Pro — are set to provide updates and apps to other devices when connected to the public Internet.”
Other links:
http://www.theverge.com/2015/3/15/8218215/microsoft-windows-10-updates-p2p
http://thehackernews.com/2015/03/microsoft-windows-10.html
http://thehackernews.com/2015/08/windows-10-update.html
How to turn off p2p updates[PCworld]:
First, open the Start Menu and select Settings, then click Updates & Security
Make sure Windows Update is selected in the left-hand navigation pane (it’s the default when you open Updates & Security) and then click Advanced Options in the main pane.
You’ll see a lot of options and checkboxes. Peruse them if you’d like, but for today’s task, you’ll want to click on Choose how updates are delivered.
Now you’re on the page with the options that legislate how Windows 10 handles P2P updates. By default, Windows 10 will both send and receive updates from devices on your network and the Internet at large.
It’s the latter option that’s the potential data cap destroyer. Using the options on this page, you can opt to only allow P2P updates among machines on your local network, or disable them completely and rely on Microsoft’s servers alone—just like the good ol’ days.
Your mileage may vary. In fact, it may not be possible to stop Win 10 p2p updates.
@ Peanuts
Do you have a simple script to disable Win 10 p2p updates?
Next, does the Windows Customer Involvement Program have a keylogger? How do you disable it? Does the CIP go back to XP [I thought it did].
CIP privacy statement:
http://cwtuning.com/windows-10-optimization-cip-privacy-statement.htm
Nick P • October 9, 2015 10:57 PM
@ name.withheld
Least they were smart enough to keep the guards in one of those. 😉
@ All
Nice article on SAIC, their history, their corrupt ties to government, and even their involvement in Iraq bullshit:
Washington’s $8 Billion Shadow
Most might have not heard of them but anyone in high assurance has. They got contracts back in the days where it mattered. Much of the good stuff was built without them but they often tied into it somehow. Well, the article shows how… They’re also a major evaluator of such products. Despite their schemes, they do have a lot of talent over there. Just wish these corrupt contractors would be required to apply their talent to solve real problems even if ripping us off with high margins and so on. It would be better corruption than a lot of places deal with haha…
HA2 • October 10, 2015 2:09 AM
Any comments about lastpass acquisition? I’m a lastpass user and wondering whether I need to find a new password manager…
Clive Robinson • October 10, 2015 3:25 AM
@ name.withheld…,
I did not argue the point but the good news is that given the EUJ decision on safe-harbor, but more specifically, the OECD “Working Party on Security and Privacy” work framing risk components that more than likely produce a 10-K/Q filing requirement that speaks to mitigation from nation state surveillance conduct.
It would appear to be good news, starting to head in the right direction. Whilst I would prefer people went for the carrot of “self interest”, sometimes you have to use the stick of “legislation” to do what is good for them. Let’s hope it’s a big enough stick to do the job sufficiently to be worthwhile, not red tape compliance.
Whilst I can understand short term thinking around the C level top table due to shareholder issues, tenure, salary and bonuses. Not paying attention to the “cliff edge risks” of information security is shall we say more than a little short sighted in the current climate.
As I’ve indicated in the past there are a couple of root cause issues that needed to be addressed. The first is “speaking to the man”, most InfoSec guys speak a foreign language when it comes to the C level table attendees, they need to learn to “speak business” and “C Level culture”. Whilst this has started it’s still got a long way to go. Because the security mindset and the business mindset are often from opposite tails of the bell curve. Getting a build up of expertise into the middle ground to act as a bridge is something that needs to be done, and a territory I had hoped women would find worth marking out.
A second issue which most can not get their heads around is that IT risks are “Not normal / natural” in nature due to the “lack of physical world restraints” and “instant army of one” issues. Those on the C Level table need to get to grips with this and further realise that the optimal solutions are moving as fast as the more switched on C levels in the industry, thus best practice is third rate by the time you get to hear about it. Thus the need not just for domain expertise and bridging but dynamic legislation and liability mitigation. An example of this would be the fast evolving insurance market, products are changing at a rate that policies are out of data before you’ve had time to read the documents. This is due in part to the policy issuers trying to develop what is currently a “hear be dragons” and “You’ll sail of the edge of the world” market.
Legislation whilst creating a faux market does bring stability to the natural market, which allows the time for the natural market to evolve into something other than a “dog eat dog” “race for the bottom”. That is the market needs to be nurtured until it’s matured to the point it’s a useful entity to society as a whole (think vehicle safety as an example).
Jacob • October 10, 2015 4:22 AM
So now we know that when Apple device(s?) is locked, IT IS locked. Later this month we will know if Apple can be forced by the court to unlock it.
Interesting case and opinion by Judge Orenstein of New York.
https://ia801501.us.archive.org/27/items/gov.uscourts.nyed.376325/gov.uscourts.nyed.376325.2.0.pdf
Andrew • October 10, 2015 5:27 AM
I’ve made a quantum resistant RC4 based on Spritz, very good random distribution (added an extra “m” in output calculation). Of course, in order to bypass current attacks about 7000 bytes from output start should be discarded and 512 bytes random keys should be used. Still very fast, of course not that fast as hardware AES. Any thoughts?
private void RC4Quantum(ref byte[] bytes, byte[] key, byte[] salt)
{
int i = 0, j = 0, m = 0, z = 0, tmp = 0, idx = 0;
int[] s = new int[512];
int[] k = new int[512];
for (i = 0; i smaller than 512; i++)
{
s[i] = i;
k[i] = key[i % key.Length];
}
j = 0;
for (i = 0; smaller than 512; i++)
{
j = (j + s[i] + k[i]) % 512;
tmp = s[i];
s[i] = s[j];
s[j] = tmp;
}
// discard start then add salt here
// for (idx = 0; idx smaller than 7000 + k[14]; idx++)
// generate dummy z’s, do not reset i, j, m
i = j = m = 0;
for (idx = 0; idx smaller than bytes.Length; idx++)
{
i = (i + 1) % 512;
j = (m + s[(j + s[i]) % 512]) % 512;
m = (m + i + s[j]) % 512;
tmp = s[i];
s[i] = s[j];
s[j] = tmp;
z = s[(j + m + s[(i + s[(z + m) % 512]) % 512]) % 512];
bytes[idx] ^= (byte) (z % 256);
}
}
ianf • October 10, 2015 6:14 AM
@ Jacob re: locked devices “interesting case and opinion by Judge Orenstein of New York.”
Could you quote the key passage(s) which passed me by in all that breathless legal prose? Thanks in advance.
Clive Robinson • October 10, 2015 6:24 AM
@ 65535,
Like you it’s not just the P2P stuff I’m worried about.
It’s become clear that Microsoft have had a green light from somewhere in the USG to perform what are in effect monopolistic and probably more insidious acts which make the old “embrace and extend” game look like “tic-tak-tow”.
In essence the old joke about “Windoze being malware” is now true, sufficient for anybody to see if they chose to look. The intent to exfiltrate any and all user input/activity back to MS for “their business records” should make everybody pause and think.
The problem as in war is “stopping the bridge head” being built
Whilst apparently not quite there yet MS are building in “firewall avoidance technology” that on use of the “looks like a duck… Theory” means it is malware in all but name. They are likewise back porting this technology to all OS and potentially applications the still support, or atleast come knocking on MS’s update front door.
What I’ve not seen information on is how the “MS Discovery system” works, or more correctly how it will soon be abused by MS and others to subvert “end user security” and other rights of ownership.
The MS EULA already reads as though they intend to make Win11 into a “walled garden” environment where they control what you can and can not do. In a similar way that smart phones / tablets / pads have been locked by network operators, Apple and Google and augmented by CarrierIQ “support software”. The question is thus, is it just for “rent seeking” and “commoditization of users” or for the more sinister first stage of the US IC&LE “front door” or both?
The second question is thus “How do you stop MS forming the bridge head?”. So far they appear very determined to force not just the invasive technology but changes to EULA onto everybody irrespective of if they want it or not. And whilst there may currently be a way out of the net [1] that MS are drawing closed, it may not belong before it’s too late to escape.
They easy way to stop the bridge head for pre Win10 users is to “air gap” their systems. The down side of this is that for most home and small business uses the system becomes about as useful as an elephant crapping in the room.
Whilst Peanut’s and others methods to weed out the bad updates currently works, I can see MS blocking that in the future in various ways. One of which would be to hide a stronger discovery method in other updates you need to download for security or functional reasons or even in new application software. And at some later point in time trigger the discovery mechanism to nullify or bypass firewall rules either on the computer or on actual network equipment.
Further if I can figure out how to bypass “air gaping” in a number of ways, it’s a reasonable assumption that MS can as well. Especially as they now have the significant advantage –I did not have– of being shown not just that it’s possible but having actual code such as Stuxnet and later to dissect, copy and possibly learn from.
Whilst I regard MS’s actions as “first strike” illegal cyber-warfare others may not. Thus whilst a few may be able to stop the MS bridge head now, it’s going to get harder to do so with time.
Thus perhaps the best option for many is to follow the advice given at the end of that cult film “War Games” and “Not to Play”. But switching over to alternative OS’s and applications is not a game for the faint hearted either. Whilst a lot of effort has gone into making Google’s Android “user friendly” and have useful apps, it is another walled garden OS and thus has issues. Getting to “root Android” is getting harder and it will not be long before making Android apps run on non walled garden OSs –even Linux– becomes to difficult for even die hard Open OS aficionados.
To quote Babylon 5, “Mankind’s Last Best Hope” may be the European Courts of Justice and the EU Commission “throwing a spanner in the works” not just on the likes of Data Protection, Privacy and similar, but by pulling back into focus the old Open Systems regulations, that helped bust open the old walled gardens of IBM etc.
The simple fact is history has shown time and time again that walled gardens of any form hurt innovation and thus the economy and national security of all. The most recent in most peoples minds being the “deregulation” of communications where the breaking of a Government Monopoly into sufficient independent entities made innovation that gave us the Internet possible.
Just a couple of days ago the head of the UK’s Office of Communication (OfCom) made it abundantly clear you need sufficiently open markets with sufficient major players otherwise markets will not be open except in name and consumers will suffer.
Arguably we have an insufficient number of major players in the OS market. And it is becoming clear we consumers are really suffering because of it. That is we are regressing into the old tied-in walled garden badness of the past.
Hopefully legislators will wake up and ignore the lobbyists from Microsoft, Google, Apple and the entertainments industries and take the measures history shows are right for all not just a self appointed few. Otherwise the economy will go back into recession and stay there for quite some considerable time.
In the meantime we need to keep Microsoft and Google stymied at every step we can, without loosing the freedoms we already have.
It’s easier for me than many, because I’m not dependent on “new technology / ways” I’m still a CLI user at heart and have always segregated what I do as a matter of principle / way of life. Along with the fact I have archived resources and older technology I can fall back on, I have also innovated my own security and other technology (as have a few others). Thus with the guards, sluices, data diodes and other instrumentation I’ve designed and built I can have a reasonably reliable core I can work out from in a secure manner to the insecure walled gardens that Microsoft and Google wish to own us with. But sadly I’m not an island, and thus have to not just deal with but support others not so fortunate who can only start in a non secure place. Worse perhaps is technology now has such a breadth, that it’s “A Red Queen’s Race” just trying to stay current, in any depth, in just one tiny tiny fraction of it. So I in turn have become needful on others who have depth in areas I do not.
[1] I suspect that for both legal and business reasons there must currently be a way out no matter how twisty or convoluted that MS lawyers can show to any non US Judge with market regulatory authority. Or sell at vastly inflated value to those that have legal or business requirements for confidentially.
ianf • October 10, 2015 6:45 AM
RE Gerard van Vooren‘s “interesting (but probably stupid) idea” [refer to post for the entire explanation, here just a quote, emphasis mine]
[…] “What if there [was] a non-profit foundation or cooperation where people pay 50 € or $ a year (fixed) subscription fee and then they could surf the web sites of the participating companies without ads or tracking cookies.”
This wouldn’t work for a whole range of reasons beginning with it essentially being a form of extortion for something we never asked for in the first place. The web advertising industry likes to think of itself as providing independent web-content creators with funds to run the websites, if by way of—in their own eyes as justifiable as any other—commercial content vying for the readers’ attention. Because of the digital nature of the web, advertisers and their lackeys/ agents of visual disruption a.k.a. advertising agencies, now have ready tools in place to measure the effectiveness of their hawking endeavors; unlike ads in print media, where response can be measured but without precision for analysis, here it can be done at pretty granular levels practically the moment a web page has been visited, let alone online buy button been pressed.
This is unprecedented in the 150+ years history of advertising, and they won’t give up that “science” easily, nor acquiesce to anything that’d threaten to upend their carts (which your scheme wouldn’t, but the industry isn’t keen to find that out anyway). Online advertising is a very lucrative business for the simple reason that it works—and there are no ready alternatives where the upkeep, never mind profitability, of websites is concerned.
And all that without even mentioning the v. much real €50 hole in an individual’s pocket – large enough to be noticed, regretted, and never renewed.
Luci Krom • October 10, 2015 6:46 AM
@HA2
“Any comments about lastpass acquisition? I’m a lastpass user and wondering whether I need to find a new password manager…”
Your passwords are now owned by a for-profit, USA-based company running proprietary software. They won’t let you see what their code is doing behind the scenes but you know their main aim is to monetize your data and you also know that they will be bound by any subpoenas enforced on them by a court at the request of any law enforcement body. My advice: run! KeepassX would be my choice (but this subject has been discussed in the blog many times before, you might want to look it up through the search function).
GustyOlive • October 10, 2015 7:01 AM
@66535 et al.
Re. Win 10 updates, intel ME, etc.
I have noticed that some posters have recommended using firmware, software or OS that we know to be vulnerable, or downright malicious, so long as you configure a firewall to reign in the data.
This is VERY BAD advice. If you want to see how trivial it is for these systems to bypass a firewall (often in automated mode, with no user intervention), have a look at how something like rpcnet (computrace) is designed to systematically detect browsers running in the system and piggyback on port 80 traffic when it is unable to punch straight through a firewall by itself. This is just a very basic, simple example of a principle that can be implemented on any level.
The solution: don’t use them.
China Eavesdropping Aligns with Corporate USA • October 10, 2015 7:13 AM
Skeptical states:
“I also think that folks are vastly overestimating the probability of their data ever being viewed, noticed, or even retained by any intelligence agency. A small fraction of total traffic is collected, and from that point the focus is on processing it to remove irrelevant or regulated material, so that when an analyst finally looks at something, the probability is greater that she is looking at something useful to her mission. The US intelligence agencies are not wasting their time building files on every person in the world. Obsessively worrying about it is akin to being concerned about contracting flesh-eating bacteria by riding the tube.”
China Eavesdropping Aligns with USA
USA intelligence agencies are hardly the only stake holders. They rely on partnerships with corporate Big-Data. Advertisers want to know EVERYTHING and have built-up verified dossiers by sharing their collected data. Under the proposed cyber sharing law these corporations are legally immune and are authorized to lie stating they have never shared your information with the government.
The totalitarian Communist China government loves this system too which is why China’s Premiere chose to meet at their (quess who) Seattle campus. Google and Facebook weren’t even invited.
Jacob • October 10, 2015 7:56 AM
@ ianf
“Could you quote the key passage(s) which passed me by in all that breathless legal prose? Thanks in advance.”
It is impossible to cut&paste passages since the PDF is image-based. However, this is the main gist:
The Judge declares:
1. That Apple submits its view on the matter by Oct 15th, stating if circumventing the protection is feasable and if so, if this imposes undue burden on Apple.
2. If USG or Apple wishes to provide oral arguments, they can do that on the 22nd of Oct.
The Judge continues to expand on the request. He covers the “going dark” concerns, Sen. Wyden proposed privacy bill, Director Comey’s view which are in conflict the All Writs Act now advocated by the government in the current case etc.
Then he compares the pen register efforts directed at public telephone companies, which is “normal business” for them, as opposed to Apple, which is a private company that may not be forced to disrupt its operation to serve something which is not specifically asked by the law, and it is free to promote its customers’ interest in privacy over the competing interests of law enforcement
However, the judge opines that an alternative to forcing Apple to support the request is to force the device owner to divulge the password under a lawful court order.
He finalizes his opinion by declaring that he does not agree with other courts’ rulings in the past, where they based their compelling order on the law directed at public utility companies, and that Apple made a conscientious design choice to protect its customers’ privacy, and he need to hear its opinion on this USG request for help before ruling.
ianf • October 10, 2015 8:00 AM
May I recommend BBC Newsnight Kirsty Wark’s interview with the author Jonathan Franzen who’s being “aghast at destructive social media.” A [5m44s] video, advance to [3:54] to hear this:
His latest book, Purity [haven’t read it yet], deals with secrecy, identity, search for a missing parent, in the age of the Internet – of which he has some bad, and some good things to say.
Curious • October 10, 2015 8:20 AM
Off topic: (TPP related)
Electronic Frontier Foundation, on the content said to be afaik a leaked final agreement of the ‘Trans-Pacific Partnership’ (TPP) agreement dated 5. Oct.
https://www.eff.org/deeplinks/2015/10/final-leaked-tpp-text-all-we-feared
*Oops, I posted this initially in last weeks quid thread.
Clive Robinson • October 10, 2015 8:31 AM
@ GustyOlive,
The solution: don’t use them
Is in effect a Utopian Ideal, users and those who support them in various ways live in at best a pragmatic world.
There are two extreme types of user in this argument that form the end points of a line,
1, Those who NEED connectivity to carry out ALL their functions.
2, Those who DON’T need connectivity to carry ANY of their functions.
Every one else falls in between.
However the applications they need also fall on the same line even the connectivity is just for updates.
Importantly though to a user the computer consists primarily of two parts the physical presence of the hardware and the virtual UI of the applications they use. They have a far greater investment in the applications than they do in the Hardware or OS.
One past solution was two separate computers, but that no longer works for various reasons.
Switching to a more secure OS works for a limited number of use cases. But whilst an OS might be secure, web browsers and other applications most definitely not.
Further switching applications goes against the “least surprise” maxim for the users so even though they might switch OS they are not going to as easily switch applications.
So in the practical world you have to plug the holes, not buy a nice new ship.
Observer • October 10, 2015 8:57 AM
@ianf
I think the reason Jacob posted that case is to show the state of Apple’s encryption. A cursory (and I mean cursory… under 1 minute) of that case tells me that:
1 – Federal agents have tried, and failed, to unlock an iPhone (I assume it is protected with a strong passphrase and NOT a passcode/fingerprint).
2 – Apple are compelled to produce evidence to demonstrate whether or not it’s technically feasible/possible to decrypt the data (and, if so, to provide assistance in decrypting it).
3 – Being a private body (and not a ‘highly regulated’ utility provider) Apple are under no duty to provide law enforcement front/back doors.
It’ll be interesting to see what Apple (under pain of contempt of court) tender as evidence. If decrypting the data is impracticable then Apple will say so whereas if it IS possible to break (within a reasonable time) then people will know that their security isn’t as secure as they profess it is.
India Caste Discrimination System and American High-Tech • October 10, 2015 8:59 AM
Definition
Sociology.
1. an endogamous and hereditary social group limited to persons of the same rank, occupation, economic position, etc., and having mores distinguishing it from other such groups.
2. any rigid system of social distinctions.
Between 1860 and 1920, the British segregated Indians by caste, granting administrative jobs and senior appointments only to the upper castes.
Today there are numerous fault lines in India’s complex society and history that can flare up almost anytime.
Now associate this caste system to American High-Tech leaders stating there is a shortage of the best engineers. They desperately want to allow immigration from India’s top Universities. They inadvertently bring the caste system into American High Tech data-mining.
Are the caste system and the USA Constitution Americans freedom and liberties compatible?
British society is also class oriented and they too aggressively surveil their citizens and everyone else.
Is there a relationship between the caste social class system and high levels of mass surveillance?
It’s hard not to notice the remarkable ramp-up after Steve Balmer left.
http://www.cnn.com/2015/08/28/asia/india-gujarat-caste-protests/
BoppingAround • October 10, 2015 9:31 AM
rgaff,
Is that a video transcript you have posted?
If yes, thanks. I have been meaning to watch the damn video for a long time and
I definitely will at some point. But text is still better for me.
Mifi,
much of the planned internet traffic would use Tor or do you think this
invites too much scrutiny
I think if you are going to use Tor, you had better send all kinds of traffic
through it, relevant and irrelevant.
I guess if you encrypt only the important parts it is just as though you have
marked them for collection. Put garbage there too.
[re: firewall avoidance tech] Clive Robinson,
One thought I’ve just had. Prior to MS’s acquisition of Skype, it [Skype] used
to be p2p-orientated and — if all those sysadmins weren’t damn liars — quite apt
at bypassing whatever firewall was on its way and therefore a PITA to block.
Even if it isn’t that way anymore, the bypass technology can probably be well
utilised for whatever other means MS would like it to use.
Bob • October 10, 2015 9:56 AM
“On Thursday, Comey said the issue (encryption) afflicts not just federal law enforcement but also state and local agencies investigating child kidnappings and car crashes…”
I thought someone had misquoted Comey. He wouldn’t, couldn’t, didn’t say that did he? I fact checked….:
YES HE DID !!!
They want a wide open pipe to E V E R Y T H I N G ! ! !</> Down to the local podunk cop having a tap to the stream for busting jay walkers. Literally.
Encryption is a stumbling block for some data, but they want it all, encrypted or NOT!
Our parallel globalist government of military, police and corporate power freaks and kleptocrats is taking fine advantage of our stuck on stupid and broken official government which now only represents interests of the highest bidder.
The final nail is CISPA/CISA. As it stands now the law will pass easily in one of those late night, no debate, voice votes before the end of the year. The fix is in.
People are starting to get it, but is it too late?
ianf • October 10, 2015 9:58 AM
@ Clive Robinson “in the practical world you have to plug the holes, not buy a nice new ship.”
@ GustyOlive “don’t use Windows/ apps.”
Logical, but there always will be new (or on purpose reintroduced) holes in software and OSes. Mere users have no recourse for that, can but resign themselves to the knowledge that the mighty corporations that sold them the hardware and/or gave them free applications and cloud storage, will snoop on them in return for advertising/ commercial reasons, with some, if not all of that “spillage” going in parallel to the IC.
Frankly, the only somewhat workable way to stop such creeping encroachment on one’s virtual persona, is to walk away from the Internet, or at least walk away from it as much as possible (which is also Clive’s suggestion).
That said, most Internet users don’t have enough of a distinct, preservation worthy, persona, to see the dangers in them being studied, filed, foldered, and in specific cases ultimately mutilated, from afar. They must be interesting to rate all that attention!
I suppose one (technically viable but as yet imaginary) way to thwart ad-tracking and snooping on individuals, would be establishment of distributed P2P web caches – instead of accessing web pages directly, go via a “torrential” local proxy (one in a merry-go-round of peers) which will serve already cached, or fetch anew, cache and then serve desired content like it was originating there.
As for hardware-malware misbehavior – there are currently no alternatives to present, leaky terminals, not until someone manages to produce a secure-OS running on non-standard/non-Intel CPU & TPM combo using standardized subassemblies of e.g. (just an example!) Novena, or similar that MOTIVATED PARTIES can mold into a laptop or a desktop (if not a tablet).
vas pup • October 10, 2015 12:48 PM
How to predict mass shootings:
https://www.newscientist.com/article/dn28300-how-to-spot-the-warning-signs-and-prevent-mass-shootings/
For all LEOs, private security Cos, schools of all levels!!!
gniot • October 10, 2015 12:53 PM
At least slavs had the balls to knock over their totalitarian state. Prominent US public figures just bend over and take it
ianf • October 10, 2015 1:08 PM
@ mike~acker […] “if you or I violate the law we end up in jail. the Feds just order the evidence destroyed.”
First of all, Barton Gellman showing a few slides of web-resident, if still classified, documents from Edward @Snowden‘s cache during a lecture on same was not evidence of anything unlawful, or else the presenter would have ended up prosecuted, journalist or not. That’s a fact.
What happened was that some spineless Uni administrator used the video uptake with blurry images of the slides to ingratiate ‘self with the Feds [called up Defense Security Services for opinion] and then, unbeknownst even to that colloquium’s organizers, ordered the video tapes immediately physically destroyed (I’m surprised the camera was spared, although in theory it might have carried some air-pixel residue of the “incriminating” images inside). The Uni now admits it was an overreaction, and should have stopped at simple editing out the slides sequence.
65535 • October 10, 2015 1:11 PM
@ Clive R
“…it’s not just the P2P stuff I’m worried about. It’s become clear that Microsoft have had a green light from somewhere in the USG to perform what are in effect monopolistic and probably more insidious acts
“Whilst apparently not quite there yet MS are building in “firewall avoidance technology” that on use of the “looks like a duck… Theory” means it is malware in all but name. They are likewise back porting this technology to all OS and potentially applications the still support, or atleast come knocking on MS’s update front door.
What I’ve not seen information on is how the “MS Discovery system” works, or more correctly how it will soon be abused by MS and others to subvert “end user security” and other rights of ownership.”
I agree. Your points are well taken.
I have not seen the specifics of MS Discovery system nor the inter-workings of the p2p update structure. I suspect the two are intertwined to ex-filtrate data and possible encryption keys.
My guess is that all data M$ desires is store in an encrypted/bin/compressed file. As soon as a laptop comes on the local LAN of any other M$ device it transmits the data to that device – and eventually to internet.
“The MS EULA already reads as though they intend to make Win11 into a “walled garden” environment where they control what you can and can not do. In a similar way that smart phones / tablets / pads have been locked by network operators, Apple and Google and augmented by CarrierIQ “support software”. The question is thus, is it just for “rent seeking” and “commoditization of users” or for the more sinister first stage of the US IC&LE “front door” or both?
“The second question is thus “How do you stop MS forming the bridge head?”. So far they appear very determined to force not just the invasive technology but changes to EULA onto everybody irrespective of if they want it or not.” – Clive
Bill Gates’ Father is a lawyer and a successful one. I am concerned that he will feel free to back-date or change in the middle of the game any contracts or EULA’s between M$ and its customers. If you look at the history of M$ you will see a number legal maneuvers that raided IMB’s IT property trove.
If Gate’s can legally out maneuver IBM [and other huge adversaries] the little guy doesn’t stand a chance.
“…easy way to stop the bridge head for pre Win10 users is to “air gap” their systems. The down side of this is that for most home and small business uses the system becomes about as useful as an elephant crapping in the room.” – Clive R
Yes, that is very true. Small Business needs to be on the internet. Once an M$ device is connected to the internet it could act as a bridge to the mother ship. This is could be done by the p2p bitTorrent style of LAN2WAN [including wireless] connections. As a M$ Laptop is fired up and in communication with a Windows phone the data could possibly be exfiltrated [wireless or bluetooth].
“I can figure out how to bypass “air gaping” in a number of ways, it’s a reasonable assumption that MS can as well. Especially as they now have the significant advantage..” – Clive
This is my main concern. We know that M$ pre-loads it Certificate Store [at the OS level] and could slip in a few bogus Certificates to perform SSL Stripping. The same is MS Discovery where it could by pass firewalls via a common port [80 or 443] or even a dynamic port. This function could be in a hidden binary.
“…we need to keep Microsoft and Google stymied at every step we can, without loosing the freedoms we already have.” – Clive
How true, but given their monopolistic positions and close relationship with the Government that is a difficult task. Sooner of later you will have a communication circuit with a customer, friend or family member who use M$ or Google products [or Yahoo, Facekook and so on]. Then the ex-filtration circuit will be made.
“…I can work out from in a secure manner to the insecure walled gardens that Microsoft and Google wish to own us with. But sadly I’m not an island, and thus have to not just deal with but support others not so fortunate who can only start in a non secure place. Worse perhaps is technology now has such a breadth, that it’s “A Red Queen’s Race” just trying to stay current, in any depth, in just one tiny tiny fraction of it…” –Clive
With a million dollar reward to find zero-days for Apple iPhones it is a Red Queen’s Race. Worse, this race is filled with well funded companies on an international scale. The race is truly huge and dangerous.
@ GustyOlive
“Re. Win 10 updates, intel ME, etc.”
“I have noticed that some posters have recommended using firmware, software or OS that we know to be vulnerable, or downright malicious, so long as you configure a firewall to reign in the data. This is VERY BAD advice. If you want to see how trivial it is for these systems to bypass a firewall (often in automated mode, with no user intervention), have a look at how something like rpcnet (computrace) is designed to systematically detect browsers running in the system and piggyback on port 80 traffic when it is unable to punch straight through a firewall by itself.”
I concur. Piggybacking on well known ports [80 and 443] is easily done. But, so can punching a hole through the firewall. Just ask any high school kid with UltraSurf how easy it is to punch a hole through the school’s firewall – very easy. If a high school kid can do it then a well funded OS maker could do the same with a hidden binary. It’s a real problem.
name.withheld.for.obvious.reasons • October 10, 2015 1:41 PM
3 Clive Robinson, 65535
My take on the OS platform that Microsh.t produces is directly inline with the USG efforts to deliver CALEA features. The architecture appears to be “designed” to also perform DRM, copyright, and other media detection function that can provide ALERTS to the mother ship and possibly rights holders that could effectively act as an automatic criminal prosecutor.
I can see that their, Microsh.t’s, policy supports just such a “feature” where any data snarfed locally can be used as evidence; collecting copies of data files and tagging the owner and issuing warrants for arrest. Legally this flies in the face of the 5th amendment where you are “involuntarily” providing evidence against yourself (legally binding EULA’s must assert waiving your 5th amendment rights in specificity) irrespective of the quality of the evidence (hash values of files may inadvertently produce erroneous results).
I could see file names, hashes, crc, and computed enumerations of local data used to establish evidence of criminal activity. In this process, establishing intent with respect to any type of data stored on a system is never established. In essence, you will need to prove your innocence as opposed to the state having to assert your guilt.
name.withheld.for.obvious.reaons • October 10, 2015 1:46 PM
@ ianf
Based on preliminary research, DSS is really the new and reformulated CIA operating under a whole new set of rules–specifically domestic spying.
65535 • October 10, 2015 2:42 PM
@ name.withheld.for.obvious.reasons
“My take on the OS platform that Microsh.t produces is directly inline with the USG efforts to deliver CALEA features. The architecture appears to be “designed” to also perform DRM, copyright, and other media detection function that can provide ALERTS to the mother ship and possibly rights holders that could effectively act as an automatic criminal prosecutor.”
Yes, is sure looking that way given the up-coming Cyber Intelligence Sharing and Protection Act.
“…[It] supports just such a “feature” where any data snarfed locally can be used as evidence; collecting copies of data files and tagging the owner and issuing warrants for arrest. Legally this flies in the face of the 5th amendment where you are “involuntarily” providing evidence against yourself (legally binding EULA’s must assert waiving your 5th amendment rights in specificity) irrespective of the quality of the evidence (hash values of files may inadvertently produce erroneous results).”
That is an unpleasant thought. I would guess the EU would fine or sue M$. Further, I would think Russia, China [PRC] and IRAN would highly restrict the use of M$ product in their governments and even their population.
ianf • October 10, 2015 3:19 PM
@ name.withheld …
CIA has an official charter, and, when it suits them, plays by the foreign-intel book, or else irritate the FBI & DHS. Any major changes in their mandate couldn’t pass by unannounced. For that reason alone I don’t think that that “Defense Security Service” could be the new black, it sounds more like a DoD Domestic Counterintelligence… but what do we know.
@ 65535
I recall reading quite recently that China forbade Windows 10 for governmental use – presumably on all levels of.
Nick P • October 10, 2015 4:04 PM
@ name.withheld
Regarding the 5th amendment, I just read a nice flow chart that argues otherwise. I’m guessing there’s been court precedents or something that says things aren’t protected once they leave your brain. I figure it’s still a grey area but I won’t act like it’s solid. Data is likely to be treated by the 4th.
Peanuts • October 10, 2015 4:27 PM
Some ban W8 and 10 articles need back porting to address Windows 7 and threats of bans plus one sweet find, a covert data channel missed by benchmarking sites. God bless them but they don’t have a clue and wouldn’t know what a covert data channel is or if the channel ibit them in the ass repeatedly, they would claim it was a bug directed at them.
Russian govt http://www.ibtimes.com/windows-10-could-be-banned-russian-government-workers-after-privacy-concerns-spark-2065183
When the Swiss follow the Chinese and Russians, you know someone has their head up their ass at Microsoft
http://www.theregister.co.uk/2015/08/25/swiss_privacy_watchdog_growls_at_microsoft_and_threatens_to_get_windows_10_banned/
https://www.techinasia.com/china-eliminate-foreign-technology-2020/
Windows 8 was the poc project for Windows 10 so it’s highly likely Windows with implants is on the rocks in China
Russian legal consensus is that W10 and by extension 8 and 7 with the back ported Survailance implants must be banned in legal practices.
http://www.beyondwindows9.com/index.php/topic/22900-russian-lawyers-want-windows-10-banned-in-russia-because-it-spies-on-users/
Windows 8 benchmarking sites miss identify covert Microfoft timing attack data channel introduced and windows seven and 10 threaten been
http://www.geek.com/microsoft/windows-8-may-be-banned-from-benchmarking-site-because-it-cant-cant-keep-time-properly-1567605/
Daniel • October 10, 2015 4:30 PM
@Nick P
That flowchart is misleading. For example, it says that if the questioning is not related to criminal conduct there is no 5th amendment protection. That is literally true. However, if the questioning is not related to criminal conduct then the speaker does not to have to answer in any event.
This is a common error and one the police use quite frequently. They get the person to volunteer information because the person thinks they have an obligation to answer when they really don’t.
Jungle Democracy • October 10, 2015 5:07 PM
1 – Federal agents have tried, and failed, to unlock an iPhone (I assume it is protected with a strong passphrase and NOT a passcode/fingerprint).
Yes, I believe that. I believe that out of N federal agents, 2 or more have tried and failed to unlock an iPhone. Now do I believe that if all N federal agents had sincerely tried they would have all failed to unlock that iPhone. No fucking chance. This is all layers of lies.
AWagoner • October 10, 2015 5:10 PM
Why Phone Fraud Starts With A Silent Call
http://www.npr.org/sections/alltechconsidered/2015/08/24/434313813/why-phone-fraud-starts-with-a-silent-call
Here’s an experience some of us have had. The phone rings. You pick it up and say “Hello. Hello. Helloooo.” But nobody answers.
It turns out there could be someone on the other end of the line: an automated computer system that’s calling your number — and tens of thousands of others — to build a list of humans to target for theft.
…
That initial call you get, with silence on the other end, “[is] essentially the first of the reconnaissance calls that these fraudsters do,” Balasubramaniyan says. “They’re trying to see: Are they getting a human on the other end? You even cough and it knows you’re there.”
Nick P • October 10, 2015 5:29 PM
@ Daniel
Good point. They might include that one as a reminder that they can open with a non-relevant question to get you to start talking. Then, once a line is crossed, you’re in a situation where you’ve volunteered information that would’ve had protection. You also now likely don’t have protection. So, we’re back to simply not talking to the police as you said.
Or it was just a mistake on their part. Could go either way. 😉
ianf • October 10, 2015 6:04 PM
@ AWagoner
“That initial call you get, with silence on the other end, [is] essentially the first of the reconnaissance calls that these fraudsters do […] they’re trying to see: Are they getting a human on the other end? You even cough and it knows you’re there.”
Yes, but is it good to show there’s a human there, or bad it’s but a machine? Clearly, unless one knows what potential crime one might be targeted for—which is an impossibility—there’s no telling. Then there’s that coughing…
rgaff • October 10, 2015 6:47 PM
@ BoppingAround
I would not describe my summary as “a transcript of the video”… it is part transcript of part of the video, mixed with some summary in my own words. It is mostly based off the “10 points” he gives with slides (“well I only have time for 8” and then he gives 7) 🙂
If you’re reading Schneider’s blog, you’ve already spent way way more time here than you’d spend watching the video, so you really don’t have any excuse not to see it, other than you just don’t want to but don’t want to admit it.
Seductive Japanese Tentacles of Singularity • October 10, 2015 6:55 PM
Before anyone asks — yes, this is the name on my passport.
@Skeptical, @anyone who makes these arguments
‘Domestic Warrantless Surveillance is A-OK’/’government mandated, cryptographic backdoors are A-OK’, (paraphrasing, accurately).
As ‘name.withheld’ posted even from the CIA:
At the same time, democratic governance is under siege. For the ninth consecutive year, Freedom House in 2014 reported more declines than gains in the quality of democracy worldwide. Worsening ethno-sectarian and socioeconomic strains are contributing to the trend. So, too, does the rise of a more sophisticated form of authoritarianism that forgoes brute force and heavy-handed propaganda in favor of technology-enabled media manipulation, ubiquitous surveillance, criminalization of dissent, and controlled elections.
Not necessarily in this order, but:
4, et al, ad infinitum… ie, http://arstechnica.com/tech-policy/2015/10/i-showed-leaked-nsa-slides-at-purdue-so-feds-demanded-the-video-be-destroyed/?comments=1&post=29905833 (shows how atrociously automatic, instinctive, unthinking, zombie like they are); DHS Deputy Chief: http://i.crackedcdn.com/phpimages/photoshop/7/8/0/460780_v1.jpg
Look. Even if such a program could work, the technology is far from being “there” yet. Despite trillions spent, there is zero product. That should be a “tell”.
People just want to believe, and then claim their beliefs are rational. So, it is useless arguing with them. But, the short of it is, the more information these guys get, the worse they are at actually being legitimately productive. They are doing nothing but drinking from a firehose and creating more stacks of hay to hide the needle in. Without even knowing what a needle looks like in the first place!
It is science fiction malarky. Only good these systems are for is for subverting democracies.
Nick P • October 10, 2015 8:28 PM
@ All
On history and justification of C programming language: Best System Language Ever or Bad by Design?
There’s a recurring theme where people think the C language’s design is good for systems programming, even today. These people think that someone sat down, thought of every tradeoff, and made the best ones for system programming. They assume it couldn’t have been better because any modification would hurt its goals of performance or portability. This isn’t true in the slightest and totally contradicts real reasons why C is designed the way it is. Matter of fact, the assumptions and reasons behind many of those decisions are so ridiculous on today’s hardware that it would be (is) ridiculous to keep them. Even back then, there were better languages/OS’s that cheap hardware just hadn’t caught up to.
Well, Hacker New’s commenter pjmlp sent me a great video detailing the history of C and C++ languages w/ pics and paper excerpts. The author takes it step-by-step showing what the goals were, what they were using, the problems they encountered, and what changes they made. Thompson and Ritchie actually had little to do with most of C’s key decisions and philosophy: borrowed/stolen from others at Cambridge with little to no credit early on. They kind of went with it from there.
I’ve noted times for highlights for anyone without an hour to spare. I recommend everyone watch 5:29 for a great illustration of what programming used to be and a good laugh. Even DOS on a microcontroller would be more tolerable haha. Video’s data confirms my above write-up with new specifics, except PDP-11 should’ve been PDP-7. I summarize with numbered points after with a conclusion about the C language and UNIX supported by this history.
History and Justification of C
Writing a program for the EDSAC: first, stored-program, digital computer. It was designed in 1949 and as capable as you may imagine. 5:29
Describes features of CPL language, which preceded BCPL that preceded C. They created most of the best features right there in mid-1960’s. Too hard to compile with 60’s hardware & software, though. Didn’t help that they had to queue up on an EDSAC when trying to write compiler because their Titan/Atlas2 hadn’t gotten there yet. 18:05
BCPL specifically designed as result of CPL failure. Due to hardware & language limitations, they only included CPL features easy to compile. Eliminated any checks or structure on programmer with new philosophy of “programmer totally in control.” Introduced rvalues/lvalues, no type system, and working directly with words in memory. 21:05
BCPL -> B -> C. Where B language fit in. Needed to trim more, useful stuff out of BCPL to fit into their PDP plus syntax changes. That’s where B came from. Already had C’s main keywords at that point. 23:50 & 29:10
Note: Interesting that they never mention BCPL in the paper and only include a reference to B (BCPL clone) at bottom. Trying to steal C language design criteria from competition w/out credit? 😉
C and UNIX weren’t actually built for portability. It was an accident of its simplicity. Got ported later. 30:46
Surprising find for me. The ANSI C standard appeared after C++. Unlike popular claim, ANSI C actually borrowed features from C++ rather than vice versa. Some claimed it was a subset of C++ although not everyone goes that far with it. 31:35
History and Justification of C++
Bjourne wrote a simulator in Simula, the first OOP-like language. Also had cooperative multitasking. It was a great experience. 35:00
Simula implementation didn’t scale. Rewrote it in BCPL on… Cambrige CAP secure system (!). Hated BCPL since it had no types, safety, organization, etc. 36:59
Bjourne said: “Upon leaving Cambridge, I swore never again to attack a problem with tools as unsuitable as those I had suffered while designing and implementing the simulator.”
Note: Could’ve been me the times I was stuck with C or, on other end of bad, Java. 🙂
Minimal language requirements for Bjourne were: strong type checking, classes, concurrency, as fast as BCPL, separate compilation of units, high portability. Decent tradeoffs for a minimum language. As it goes away from BCPL philosophy, it’s starting to look much more usable and reliable in practice. 😉 38:00
Bjourne, now at Bell Labs working on UNIX, needed to modify their C language to have Simula classes and concurrency. “C with Classes.” 38:35
What C with Classes looked like (left) vs C at the time (right). The call and return keyword had implications for Aspect-oriented Programming and Design-by-Contract but were removed. 42:18.
C with Classes wasn’t true OOP because no virtual functions. That came with C++ in 1984. 47:00
Bjourne introduced function name and operator overloading but it caused much difficulty. He keeps with C philosophy a bit by asserting “you can write bad programs in any language… shouldn’t reject a useful feature because it’s easily misused.” C++ philosophy gives advanced features plus responsibility for correct usage. 47:48
Added references as sugar syntax for operator overloading plus the commonly-said reason. 49:20
Operator overloading + bitshift operator combined for streamed I/O. Purpose was typesafe I/O. 50:58
How C++ source looked by 1986. 51:38
So, lineage is C as starting point, classes from Simula, ALGOL68 for operator overloading, ALGOL68 for references, ALGOL68 for declaring variables in a block, and one feature from BCPL (“//” comments). Definitely hated BCPL haha. 52:16
Error handling in C was tough. Mainly just exited. Bjourne added exceptions to let user of class decide how to deal with errors. Implemented in 1992. 52:33
Too much data-type related boilerplate so templates were next. 1991. Namespaces to support organizations 1993. The combination was foundation for Standard Template Library and C++ style of programming. 53:59
Influences on these were: exceptions from ML (1973) and CLU (1974); Ada (1980) on templates, namespaces, and exceptions. First STL was also implemented in Ada (!?), tested there until working, and then implemented in C++. Hey, didn’t I suggest doing that with Ada/SPARK and extracting C? History repeats. 😉 55:13
Also, has stuff about modern C++ but I stop here. So, here’s the summary of C and C++ language’s history in a numbered list.
Numbered Summary
Fortran was locked into IBM mainframes and mapped 1-to-1 to their hardware, not Atlas or Titan.
Designed CDL language as a real-world version of ALGOL before their Titan shipped. CDL had all kinds of features supporting robust, maintainable code. Even lambda calculus haha.
Had to use Most Godawful Computer on Earth (EDSAC) to build the CDL compiler.
Queued up behind others with snippets of EDSAC machine code testing pieces of it. Predictably, this didn’t scale to CDL’s size and complexity. Abandoned CDL compiler.
New design goal: trim out anything hard to compile from CDL. Naturally eliminates most features for robust and maintainable programming.
New design goal: give programmer total control to the point that he or she can do arbitrary stuff in memory. Maps better to Most Godawful Computer on Earth.
The result of these was BCPL: a typeless, word-oriented language with few keywords and unrestricted use of memory. Compiler was easy to write on Most Godawful Computer on Earth. Ran fast on it, too.
BCPL author took it with him to MULTICS project, where Ken Thompson and Dennis Ritchie were working. Got used on some portions of it. Thompson apparently liked it.
MULTICS was built but failed in market because of delays, scope, and cost ($7+ mil per unit).
Thompson was limited to a PDP-7 in next job. It couldn’t run MULTICS or PL family plus PDP-7’s OS and tools sucked. He and Ritchie decided to build a bare-bones version of MULTICS, called UNICS, in assembly focusing on simplicity and performance above everything. Stripped out or changed most features benefiting safety/security, maintenance, and consistency.
Around same time, Thompson was trying to get BCPL to work on his similarly-awful PDP-7. Had to trim it further to make it fit. Changed syntax for personal style. That included long-time headaches like going from ALGOL := assignment and = equality to = assignment and == equality. Resulted in B language.
The PDP-11 was byte/character-oriented instead of word-oriented. B didn’t work well. Ritchie added limited typing to it to support these. Some other details. Result was the C language.
Rewrote parts of UNIX in C. Others were too hard.
Those difficulties led to adding struct’s which allowed rest to be re-written in C. Neither C nor UNIX were meant to be portable despite claim of “cross-platform assembler.”
Simplicity of C and UNIX allowed easy porting anyway which started from a year later onward.
K&R adds some types and standard I/O. Remained for years the baseline for portable C.
Bjourne does C w/ Classes to copy Simula’s advantages.
Bjourn adds features from ALGOL68, Ada, CLU, and ML to C w/ Classes to produce C++: a C extension that reduces freedom where sensible and otherwise adds features for more robust, productive programming.
ANSI C standard created a superset of C features, including some from C++. Becomes standard style for C programming. Tons more code written this way.
Conclusion(s)
So, there you have it. They started with a great language (ALGOL60) that inspired Go, etc. Needed something ground in reality, leading to CDL. Hardware and software were so hard to use they stripped it to bare minimum (BCPL). Thompson stripped that to B because his PDP-7 was too limited and added syntax issues due to preference. Ritchie added a little to that to get the PDP-11 to work, resulting in C. Added struct’s to for more complex data structures. Writing the simple, UNIX in C language caused C to flourish as it did. Eventual standard borrowed a bit from C++. All the C code out there resulted.
Hardware eventually got better than EDSAC, PDP-7, or PDP-11. Language and OS decisions created due to its limitations aren’t removed. All of that is extended or worked around instead. UNIX and later C applications have those issues as a result.
Conclusion: the worst aspects of UNIX and C were intention design decisions that had nothing to do with what a good language should look like and everything to do with limitations of an EDSAC, PDP-7, & PDP-11.
Conclusion 2: we should’ve ditched or modified C to look more like ALGOL68 a long time ago. Like Bjourne and Wirth were doing.
Conclusion 3: C and UNIX should be avoided where possible because they’re Bad by Design for reasons that stopped applying sometime in the 80’s or early 90’s.
However, if you’re device’s hardware is PDP-11 equivalent, then there is a language and OS that is stripped enough to run on it. Might want to consider C and UNIX 1.0 then. 😉
Goertzelator • October 10, 2015 8:57 PM
@AWagoner, my anwering-machine message used to be the IC SIT tone and nothing else. Screen calls with it, and it solves the problem nicely. The people you want calling you know to hang on till you pick up but a lot of robots and call center staff drop the call.
Justin • October 11, 2015 12:12 AM
@ Seductive Japanese Tentacles of Singularity • October 10, 2015 6:55 PM
Before anyone asks — yes, this is the name on my passport.
Oh, I thought that was the name on my passport. Must be a case of identity theft. Otherwise, well, you are making a lot more sense than Nick P, who has never come out on this forum with a viable high-assurance alternative to C and UNIX.
Nick P • October 11, 2015 12:38 AM
@ Justin
I’ve cited many alternatives to C and UNIX that not only were viable: they had academic or commercial success. Just lots of networks effects and demand in the opposite direction. Far as high assurance, that’s really just a process with methods, principles, and supporting tools. Posted plenty on that, too, with almost no uptake despite even NSA validating that approach against high strength attackers and everyone working about HSA’s/NSA attacks. Can apply the approach to many of the viable alternatives that were designed with modular, simple implementations.
Crash-safe.org and Cambrige’s CHERI project are in the lead on the high end with FreeBSD on Cheri. Feel free to download it and run it on a Terasic board. On medium level, there’s GenodeOS, SVA-OS w/ Linux compatibility, JX OS, Muen separation kernel, old EROS code, and even A2 Bluebottle/Oberon if you want one easy to translate to secure form. Plenty of projects with full design detail or code to build on. They publish, we preach to inform the masses, and neither FOSS nor proprietary do shit with them for most part.
So, there’s your deliverables. Use them, improve them, clean slate them… have at it however. Or were you just trolling with no intent to do better than C and UNIX even when offered C or Linux/BSD compatibility? That’s my bet.
Gerard van Vooren • October 11, 2015 3:43 AM
@ ianf,
Since that idea got unnoticed for two weeks, I got the message. Let’s move on.
ianf • October 11, 2015 4:29 AM
@ rgaff, I’ll tell you why this “know thy enemy” lecture isn’t the bee’s knees of US police contact preparedness as you seem to believe.
Misunderestimate me correctly: I do not harbor any illusions of benevolence of American law enforcement, nor do I argue against the “police is not your friend” stance in that 49m “Don’t talk to the police” video, only question general applicability of its message across the board.
The lecture is, clearly, formulated with Homer Simpsons types in mind… all those thinking themselves smarter than everybody else (for which they might as well be remanded in custody indefinitely and on the flimsiest of grounds… if you’d ask me ;-)) Subsequently, plenty of its advice is of the commonsense D’oh? variety. However, contacts with the man happen in different shapes. E.g. if offhandedly asked by an officer whether you’ve seen a commotion, or a blue getaway truck speeding by, would you decline to answer unless accompanied by a lawyer? Even though this could but be a fishing expedition for potential easy marks for that patrolman’s daily collar quota, keeping schtum would give him a defensible probable cause: “wouldn’t answer, ergo has something to hide” & an opportunity to lie his heart out. Because the police own the streets and in the eyes of the law anybody accosted by them for whatever reason becomes chattel until proven innocent (now ponder on this for a mo why do your fellow Americans put up with this?)
So that recommended say-nothing behavior is not a generally applicable tactic … esp. because AT SOME POINT you’ll have to have a dialog with the plod anyway. For instance, would suddenly arrested Michael Friedman have won something by heeding that call? Possibly a vacation on the Rikers Island (the Alcatraz of NYC).
But that’s not primarily why I—an European with several stays in NYC, though no mo—do not share your enthusiasm for James Duane’s p.r.e.s.t.i.s.s.i.m.o logorrhea (before I manage to register one of his deep wisdoms, another two float into my ears [stereo]… but maybe YMDV). Rather, it’s your apparent conviction that, once anyone has watched it through, said person can consider ‘self inoculated against that disease that are American police forces. If not (f)actually being shielded by a knowhow condom of sorts.
Only it isn’t so. Without acute awareness of the prevailing reptilian frontier mentality, and vigilance against random entrapment, you won’t come far; watching that video will make no difference because you won’t be allowed to refresh your memory when you’d best need it. For that reason alone, I get my insights into US jurisprudence and police tactics (and biases confirmed) from procedural novels like these of Scott Turow (and “Bonfire of the Vanities” by Tom Wolfe; not John Grisham so much).
Adrian Colley‘s table of contents for the “Don’t talk to the police” lecture with hot-linked segments.
1:04 The Fifth Amendment
1:50 A Listening Test
2:58 Justice Robert Jackson
3:58 People who really ought to know better
5:17 The uncountable number of different crimes on the books
6:16 Federal Fish Crime
7:38 Advice to a former student facing the IRS
8:31 Reason 1: It cannot help (the hearsay rule)
10:02 Reason 2: What’s the rush? You can admit guilt later.
11:14 Senator Larry Craig
11:48 How proven-innocent people were convicted by confession
13:20 Reason 3: Your innocent mistakes can hang you
14:30 Reason 4: Even the pure truth can help the police to convict you
15:56 The basic function of the Fifth Amendment
17:42 Reason 5: The police’s mistakes can hang you, too
18:15 Pop quiz!
19:00 “You are the kind of people who should never talk to the police under any circumstances for as long as you live.”
19:33 Reason 6: Even the questions can incriminate you
21:33 Reason 7: Telling the truth can give weight to false evidence against you
24:42 Just ask Martha Stewart and Marion Jones
26:22 “God bless the Bill of Rights!”
27:02 “What’s left of equal time”
27:18 Officer George Bruch, Virginia Beach Police Department
27:38 “Everything he said was true”
28:34 “Anybody go above 55 on the Interstate?”
29:28 Every driver does something illegal to justify pulling them over
29:44 “Do you know how fast you were going?” – everyone wants to be honest
30:20 People are stupid
30:46 80% of convictions don’t go to trial because they confess
31:12 Hardened criminals like to tell their story, even to police
31:23 The officer’s edge is the overtime rate motivating him to stay
32:22 The defense attorney’s job is to get to their client before I do
32:30 Example of eliciting confessions of the elements of the offense
33:20 Trying not to admit guilt is like trying to win an Olympic boxing match
34:12 Miranda warning and getting a waiver
35:02 “Before you say anything, let me tell you what I know”
36:00 “Before you start talking to me, let me tell you [what will happen if you lie]”
36:36 The three types of people
39:22 Tricks of the trade: switching off the tape recorder
40:54 If you talk to the police, even on the phone, everything said will be written down
43:12 There are some intelligent criminals, mostly in big office buildings
43:37 The 3 strikes: 1) defense attorney; 2) police witness; 3) confession evidence.
45:30 The recording is usually wiped as soon as the police transcript is written.
46:46 Tricks of the trade: “Write a letter of apology” (yes, we’re allowed to lie)
65535 • October 11, 2015 7:18 AM
@ Peanuts
Wow, great links.
It looks like both Russia and China [PRC] now realize the spying modules built into Win 10 and back ported to Win8/8.1 [and possibly Win 7] and not using them.
If Russia and China are smart enough to ban Win 10 I could see the rest of the EU banning it [except of the UK which likes to spy on its citizens]. This trend should send a chill through M$.
@ ianf
“I recall reading quite recently that China forbade Windows 10 for governmental use – presumably on all levels of.”
You are right. From the above links [from Peanuts] it looks like China will ban all M$ products by 2020. China [PRC] was smart enough to ban Google years ago. It looks like a trend is developing against US made IT spy platforms.
@ Fort Meade
I am waiving at you guys at Fort Meade – all ten thousand of you. Thanks a lot! Next we will be hearing big countries banning Cisco equipment. That’s just great for our economy! I hope you are pleased with yourselves. /
“Fort Meade is a census-designated place (CDP) in Anne Arundel County, Maryland, United States. The population was 9,327 at the 2010 census. It is the home to the National Security Agency and the Defense Information Systems Agency …” -Wikipedia
Jesan Ahmed • October 11, 2015 8:54 AM
I definitely agree with what your saying in your articles .. well done thanks
Jacob • October 11, 2015 8:57 AM
More about the Apple decryption case (Judge Orenstein opinion):
https://www.washingtonpost.com/world/national-security/federal-judge-stokes-debate-about-data-encryption/2015/10/10/c75da20e-6f6f-11e5-9bfe-e59f5e244f92_story.html
Side note: The article claims that Orenstein was part of a group of lower-level judges who a decade ago began what has been called a “magistrates’ revolt,” a movement that has generally required a warrant for cellphone-location data. Their moves increased judicial and public scrutiny of the issue.
We will know soon who prevails.
BoppingAround • October 11, 2015 9:41 AM
rgaff,
I just prefer text to videos. That’s all about it.
Nick P,
Thanks for the highlights.
Curious • October 11, 2015 9:42 AM
“White Hat Hackers Would Have Their Devices Destroyed Under the TPP”
http://motherboard.vice.com/read/white-hat-hackers-would-have-their-devices-destroyed-under-the-tpp
“The finalized copyright chapter of the TPP, leaked on Friday by Wikileaks, reveals that under the agreement, “judicial authorities shall, at least, have the authority to […] order the destruction of devices and products found to be involved in” any activity that circumvents controls that manufacturers build into their software or devices, known as Digital Rights Management (DRM) technology.”
The “any activity” part there in my quote above doesn’t seem to be included in the part that Motherboard quoted themselves, presumably a paraphrase.
“The device-destroying provision appeared in a TPP chapter draft that was leaked in 2014 by Wikileaks. In that draft, the Chilean negotiators attempted to soften the provision with language like, “at their discretion.” However, none of their proposals appear in the final draft—just the firm edict, and a full carve-out for Chile in the form of an option to abide by a previous agreement with the US instead.”
AWagoner • October 11, 2015 10:36 AM
@Goertzelator, using the IC SIT tone sounds to me like a pretty cool solution.
I should try something like that.
ianf • October 11, 2015 10:59 AM
@ 65535 “it looks like China will ban all M$ products by 2020… was smart enough to ban Google years ago.”
Easy on that praise pedal. The Chinese gov is doing the right thing, but WHAT IF not so much out of concern for their networks’ impenetrability, as for its own, net.privacy-hostile, nefarious reasons? It’s not like the ruling elites there are of a democratic mind, or explicitly strive towards such a goal. And Google, et al. are as much for-profit enterprises, as they are tools of American industrial hegemony abroad. Just saying…
(BTW. this is the second misplaced praise that I read today: earlier, I came across this (2nd LIFO comment thread)):
Right, NKVD as a paragon of legality. The Russian Federation should sponsor this wannabe propagandist’s vacation in Crimea, I hear the seaside resorts there could do with some tourists.
cc: rgaff, BoppingAround
Wally • October 11, 2015 11:34 AM
@Andrew
Why is it QR? Define and elaborate please.
Recommend not using more than one object in arguments signature.
Gerard van Vooren • October 11, 2015 11:46 AM
@ ianf,
It’s not like the ruling elites there are of a democratic mind, or explicitly strive towards such a goal.
Sigh. The ruling elites didn’t ask us in our country (NL) whether the government should or should not use open source software. Did they ask you in your country? There is a tool for that, a referendum, but it is hardly ever used and in the political party culture (again in our country) software is not a real topic. So when it comes to democracy, it is hardly there, at least about this topic. I wished the opposite was true and I think the Chinese, when they succeed, deserve respect.
Laurie Engwer • October 11, 2015 11:56 AM
@ 65535
“If Russia and China are smart enough to ban Win 10 I could see the rest of the EU banning it [except of the UK which likes to spy on its citizens]. This trend should send a chill through M$.”
Now that the European Court of Justice has invalidated Safe Harbor and declared that the US does not conform to EU standards of data protection, has this opened the door to a whole whost of class actions against European ISPs or businesses that insist on using MS products (Outlook express, Windows, etc.), thereby knowingly putting the personal data of customers and employees at risk?
That would put some real pressure on MS and other big brother companies to cease their malpractice.
Any lawyers out there who might be able to comment on this?
ianf • October 11, 2015 12:27 PM
@ Jacob, Observer
The Feds probably did image “the device” in toto, but were unable to crack it further. Hence the need to force Apple to do that for them, which, when one considers it closely, really is an admission of their operational impotence (OpImp).
It’ll be funny if the judge rejects their plea with the motivation that the device’s owner should be compelled to “help with the inquiries” first. But what if the Feds do not know who it belonged to, or the owner expired, and they can not admit that in court for operational reasons? Or if the suspect is in custody, only now that water boarding no longer is en vogue, they know not how else to extract the keys? Tricky thing this, being a Federal agent.
Slime Mold with Mustard • October 11, 2015 3:12 PM
@ vas pup
From the article about mass shootings:
“Madfis has argued that the ‘triple privilege of white heterosexual masculinity’…”. There is no reason to pay any attention to people who say such things. My wife (a shrink) concurs.
And:
“…whether someone will commit a mass murder, including access to weapons.”
Can you spot the logical fallacy?
I suppose we do not have mass strangulations , but that is the only possible context for such a statement.
It is the notoriety (among other things) that is driving most of these incidents. The media could help, but it is not in their interest.
rgaff • October 11, 2015 3:36 PM
@ ianf
Thank you for that table of contents! Very useful.
a) when the police COME TO TALK TO YOU (i.e. they’ve specifically sought you out), they would only do such a thing if they already think you’re guilty of something. At this point, you are better off saying nothing in the USA, saying anything… ANYTHING AT ALL… can only serve to give them more reasons to think that. Either they will arrest you, or they won’t, depending on how much they already have or whether it’s more of a hunch. If you mouth off at them, they will usually arrest you, because that’s enough reason right there (it’s called “resisting arrest”… think for a moment how someone could possibly be arrested for resisting arrest, when there was no other reason to arrest them in the first place, and you’ll see the illogical circular reasoning here, but that’s the way it is).
b) if you witness a crime and want the guy caught and put in jail… you could go talk to the police about it… yeah.. but that’s a calculated risk, as you ARE ALWAYS ALSO A SUSPECT being a witness! Would you be better off never calling the cops in the first place and letting the criminals go free? Or talking to the police and possibly going down for something yourself? You have to choose which is the worst evil on a case by case basis.
c) if a cop is just roaming around asking random passers-by questions about something… again, just like above, it’s a calculated risk to stop and talk, he wouldn’t be asking people stuff unless EVERYONE THERE WAS ALREADY A SUSPECT and he was trying to find some information to help pin in it on someone! (either find more info to pin it on someone he already has in mind, or find someone to pin it on… both cases maybe you maybe not, but you are always a suspect by being there)
But since you mainly learn about how the American justice system works by reading novels, I should probably stop trying to explain anything, you’ve made up your mind based on fiction. I live here. I have to deal with this first hand.
@Nick P
At the moment, all those things look more like research projects than something I can just buy and install and tinker with… where would I buy it? You mentioned “a Terasic board”… which one? how do I get started without reading thousands of pages of dense research that’s over my head first? The reasons FOSS hasn’t done anything with it yet is there’s a gap between it and accessibility to the masses, even the smaller masses of powerusers to non-low-level-system-programmers who’d like to learn but don’t know where to start. Someone needs to bridge that gap first. I think it is happening, in the sense that more and more FOSS is getting more and more low level (Novenas to Arduinos are examples)… but it hasn’t gotten to the level you’re talking about yet. There’s still a big gap.
Mifi_Stuff • October 11, 2015 5:01 PM
@Bopping Around
“I think if you are going to use Tor, you had better send all kinds of traffic through it, relevant and irrelevant.
I guess if you encrypt only the important parts it is just as though you have marked them for collection. Put garbage there too.”
Thanks for the response.
It looks like the Torproject wants 250 kilobytes/s both ways to be a relay: https://www.torproject.org/docs/tor-relay-debian.html.en. That could become expensive over a mifi data plan with a gigabyte lasting about 30 minutes, if calculated correctly (1,000,000,000 / 500,000 = 2000 sec or about 33 minutes).
Regardless would the torproject want a relay that was only on for about 30 minutes, for example?
Another (non-Tor) possibility, at least in theory, share the mifi device when in use:
Openwireless.org ==> shared wifi device ==> mifi
https://openwireless.org/
Is there any easy way to put a governor on the shared openwireless bandwidth? Are there likely to be objections from Mifi vendors in these scenarios?
@ Everyone
Regarding a partial list of who uses Tor:
https://www.torproject.org/about/torusers.html.en
Is a takeaway from Snowden that a) Tor should be avoided because of the increased scrutiny it attracts or b) it is better for more people to use Tor as much as possible or to provide Tor relays, when possible?
Mifi_Stuff • October 11, 2015 6:41 PM
Sorry about the typo in the first link in the above post; it should have been:
Clive Robinson • October 11, 2015 7:14 PM
@ rgaff,
At the moment, all those things look more like research projects than something I can just buy and install and tinker with…
The first thing to ask yourself is “Am I sufficiently experianced to tinker safely?” That is if I gave you a secure system could you change it without it becoming insecure?
I’m not trying to be nasty or anything like that, but even those developing those research projects do make mistakes, you have to ask yourself if you would be capable not just of spotting the mistakes but actually correcting them.
I realised quite a few years ago that the number of people who could reliably write secure code is a tiny tiny fraction of those who think they can, who are also a tiny fraction of those writting code. It’s a skill I can easily believe is only in less than one in a million programers, and has a success rate equivalent to that of the worlds fighter pilots that ever become actual flight capable astronauts.
The problem is to get that good you have to spend ~75% of your time learning or between 35-55 thousand hours, examining where other people have gone wrong, then inventing new instances and classes of attack and working out how to solve them.
You also have to take a real engineering approach to developing code atleast as good as those writing flight software for NASA. You also as they say need to work in a “No Blaim Culture” and disect mistakes to such a fine degree that you can come up with reliable rules to prevent all future occurances.
As a hint you are not looking for people that have gone through the usuall School/Collage/University CompScience, you are looking for Safety Critical Engineers who have trained in engineering for aircraft and similar who have an intimate knowledge of complex control systems design, or certain types of scientist or mathematician, “who know how to test”. It’s a mind set skill not to disimilar to Bruce’s “thinking hinky”, but also with the ability to “think evil” in a constructive way.
Now I know you think Nick P bashes C / *nix but, have you thought for a moment that it’s justified?
The simple answer is from a sensible viewpoint he’s right. C evolved when computers were over a million times more expensive than they are today, you can by for around 1 dollar a SoC microcontroler that has orders more power, speed, memory and capability, than the high end minicomputers of the time.
C got trimed to the bone to fit the available resources, likewise *nix, security as we understand it was never a consideration in their design. Unfortunately the same is true of all the Internet Protocols and just about every other area of computing.
Secure computing is like the old joke, about the lost couple on their honeymoon, they see an old farmer leaning on a gate pull over and ask him for directions. After a few moments though he scratches his head and says “Well if I was you… I would not start from here”.
The thing is most computer design in terms of hardware and software has not been designed from a clean slate, there is always a huge baggage of “legacy issues”. As has been said many times before on this blog security like quality has to be designed in before the project starts, and likewise it has to start at the lowest layers of the computing stack, in our current ways of doing things.
That is you can not have secure code if someone can get in below it and change it. That is why access via DMA makes everything above it insecure. It’s why Intel and other CPUs that can have their microcode changed can subvert any secure software no matter what the software designer does.
One way to try to improve this situation is to augment the MMU such that tagged memory can be used to enforce certain restrictions. The problem is it’s the code running on the CPU that sets up both the MMU and the tagging.
It’s why I started looking at otherways of doing things, such as using a seperate hardware hypervisor to setup the MMU and tagging, thus the hypervisor could be simplified in many ways to make a security implementation less complex.
I further added other tricks such that you could detect untrustworthy behaviour from any point down in the stack and mitigate it. So far academia and research have not yet played “catch up” with memory tagging still waiting to be the next thing that might make it main stream some time in the next ten years or so.
The simple fact is though that we do know how to make quite secure systems, but few if anybody want to spend the money such that there is ever going to be a profit in making such systems. Thus you have to look for something similar that can be adapted…
The problem with the ICT industry is that to “stay afloat” we plug holes in bad designs to keep the “boats” at sea, not design and build better boats. And untill we get out of the “plug the holes” and “bail hard” mind set our boats will continue to flounder at sea at the slightest change from fair weather sailing.
Survival of the Fittest in American High-Tech • October 11, 2015 7:14 PM
Now that Microsoft is getting bad press throughout the World, they have changed their data-mining from CRITICAL updates to OPTIONAL updates. This distinction is important now that the Win 7 & 8 mass surveillance backporting/updates are largely complete.
With the Safe harbor declared illegal, Microsoft is building their defensive strategy.
Now they can state to regulators that citizens are under absolutely no pressure to install these updates, as they are optional only if they choose to! Diabolical?
They falsely labeled their new method of taking personally identifiable data under ‘improved user experience” knowing full-well this would fool the vast numbers of innocent non-technical citizens. Knowing they are on shaky legal standing, they enthusiastically support legal immunity from American lawmakers along with Google and Facebook. The battle Iines are set.
I’m an American software engineer who wants to highlight how ruthless these caste rulers are. They will plead ignorance and cast doubt to hide their monetizing grab for world dominating ruling power, job security and shareholder value. They are setting up an American caste type of Empire similar to England and India.
Ironically both India and America had to go to war to break away from arrogant, ruthless English upper class rulers. Please ensure the basic human rights of freedom and liberty for everyone including us carried-away Americans. Thanks!
Oh my ears and whiskers! I’m late!
@Justin, can you elaborate on your post 9/11 lawyer comment brother?
@seductive, dismissing the Iraq war as an intelligence failure could be construed as an intelligence failure in and of itself. I fail to see the seemingly permanent escalation and near immediate deployment of our military to every corner of the earth to fight the ‘war’ on terror as a failure of intelligence, do you? I see the whole ruse about Saddam’s WMDs more as a hole in one than a blunder. If you really believe that intelligence operations only gather and not seed…
rgaff • October 11, 2015 8:29 PM
@Clive Robinson
“The first thing to ask yourself is “Am I sufficiently experianced to tinker safely?” That is if I gave you a secure system could you change it without it becoming insecure? I’m not trying to be nasty or anything like that,”
Far from considering your response nasty, I was hoping to spark something like this by using the word “tinker”…
This is exactly the large gap I was referring to. FOSS is made of tinkerers, not people who spend 75% of their time studying to be the equivalent of electronic astronauts for decades… And the commercial realm is made of business people who just want to get the minimum done to make a buck. So you end up with about the same gap there too, just for a different reason.
There has to be a bridge of that gap for us to go anywhere. Secure things have to be made more accessible somehow, and us lowly earthlings need to somehow be brought more up to speed at a faster rate. Will there be mistakes? Of course. But a large improvement is a large improvement, then you go from there and look to make another large improvement. It has to be in steps. People don’t just jump into space in a single bound. The laws of nature don’t work that way.
tyr • October 11, 2015 8:51 PM
OT ramblings
I’m continually amazed at the depth of ignorance over
the Rus and the Chinese exhibited on-line. The information
is available if you look. One problem is interpretation,
if you are used to euro centric history narratives which
leave out most of the world in the mad rush to self inflate
the heroic westerners it makes sense. However this is the
21st century, you are not illiterate peasants tugging the
forelock as the great lords ride by. Take a little time to
educate yourselves about the world around you.
The Rus won the space race, they even had a massive celebration
of their winning. The Chinese and Japanese are on their way
to space as well. We in USA have an entrepeneur who wants to
keep us in the race who is mocked for his efforts.
There’s no surprise that M$ products are being dumped by any
sensible government. No sensible person has ever liked their
crap if they knew better. With the magic of TPP poised to
finish crippling the US computer field for innovation there
is no reason to hang onto a system that is nothing but state
sponsored malware.
In the 1400s China sent an admiral around the world to examine
it. He reported back saying there were nothing but diseased
and degenerate primitives not worth trading with. They turned
inward and gave up the project. Now they are looking outward
and we are going to be in interesting times before the dust
settles.
One item that seems to be ignored. The one child per family put
a check on the chinese birthrate. Somewhat later their economy
showed phenomenal growth rates. This is not a coincidence. You
can see the effect in history, every time the population goes
down the next thing you see is a surge that benefits everyone.
Their new citizen ship scores are just the Maoist criticism
sessions moved into the electronic arena. Instead of all the
villagers meeting to hold a confessional self criticism fest
under the watchful eye of the local party official now it is
being done electronically FB style (without the CIA uplink).
@Nick P
In the beginning you had a few smart people struggling with the
limitations of the available techne. The real indictment of the
modern comp boys is in hanging onto some ancient crap because
they are afraid to do real innovation because it might change
something. Failures are supposed to teach you something about
how to succeed next time, they are not supposed to lock you in
to crappy methods just because they are marginally functional.
If you do the latter you become Micro$shaft.
I could have sworn you told us about 8th somewhat less than 4th.
Alien Jerky • October 11, 2015 9:05 PM
Since the weekend is almost over, might as well post a lighter side of the news
http://newsthump.com/2015/10/03/playing-dead-to-be-added-to-us-school-curriculum/
Playing dead to be added to US school curriculum
The act of playing dead is to be added to the school curriculum across the United States.Authorities feel the additional skill will supplement regular academic subjects, providing students of all ages with the best possible opportunity to survive the next inevitable gun massacre.
Think of the savings on Ritalin.
rgaff • October 11, 2015 9:45 PM
@ tyr
“M$ products … there is no reason to hang onto a system that is nothing but state sponsored malware.”
Every technical person I know is dumping them… including a few who were real M$ diehard evangelists before… How long are they hoping to keep grandma on their system when the grandson that keeps fixing it for her doesn’t use it anymore? What are they thinking?
Andrew • October 12, 2015 1:06 AM
@Wally
Just found it funny to double the key length at a cost of one tick. Not sure if there will ever be enough computing power for something like that though. I was curious if anyone sees some obvious flaw, I’m just an amateur.
Joe K • October 12, 2015 1:29 AM
@ianf
What’s SPE, Clive? The only unexplained acronym in the post. I suppose you could have meant Sony
Pictures Entertainment, but then why not simply type SONY?Duck doesn’t know
https://duckduckgo.com/?q=SPE&iax=1&ia=meaningsneither does Jimmy
https://en.wikipedia.org/wiki/SPE
No, ianf. With all respect, Jimmy does know.
Sony Pictures Entertainment. It’s in there (under Orgini(s|z)ations).
Btw, this is not the first acronym/initialism wtf query of yours, directed
at clive, that a simple wikipedia search would not solve.
Best wishes, nonetheless.
Jacob • October 12, 2015 2:20 AM
Scary application to mass analytics:
The Chinese implemented a system whereby your credit rating, an important value affecting your social and economic well-being, is derived from what you buy, what you post online, what your interests and political opinions are and from your association to people who have low credit score.
In essence, the Chinese credit score evaluates, among other things, your supportive role of government objectives.
http://www.cbsnews.com/news/the-scary-concerns-chinas-credit-scores-are-raising/
And the source:
ianf • October 12, 2015 4:49 AM
Regarding @ Gerard‘s
“The ruling elites didn’t ask us in our country (NL) whether the government should or should not use open source software.”
Given that you, a computer-savvy representative of the NL voting public, equates (confuses?) the China govt’s rejection of M$ with adoption of FOSS—and for all the usual fossy, rather than presumably other—reasons, all I can say in regard to that “not-asking” is “WELL DONE!” Because, were that issue to be put up to a referendum, your cherished form of granular direct democracy, the result would be the same: a big meh.
As for “€ 50 or $” – in the future I’d welcome you concluding such “floater ideas” with explicit respond-by-date [UTC] limits or #fuggedaboutit. Moving on…
Clive Robinson • October 12, 2015 5:01 AM
@ Andrew,
When mucking about with ARC4 at the turn of the last century, after getting access to some serious computing horse power, I found that the Sarray size needed to be two bits (ie four times) the output bit size (so 1024 for a byte).
I also found that it was wise to add in a second stream to help remove other deficiencies. I chose to use the lower ten bits of a suitably sized BBS generator.
There are two basic ways you can add in another stream, at the output (not the best way) or in the Sarray value swap in the same way the key value is initially added in.
However unlike the key which rapidly evolves the Sarray it can be done a lot more slowly that is once or twice in the i_ptr cycle.
I chose to do it by matching a ten bit number to the i_ptr. The number was found by putting the output of the BBS through a twenty stage averaging filter, initially seeded by a derivation function on the key[1].
When I’ve a little more time I will have a look through your code and scratch my noggin to see what I can find.
[1] Quite some time later Bart Prenel at the Katholic Uni of Luven published a paper with one of his students using two ARC4 generators, interlocked with each other by this method, you might want to hunt[2] it up and read it.
[2] I’ve got the details in my dead tree cave, but an unfortunate “accident” on a bus has put me back in the hands of the medical profession so I’m away from the cave for a while.
ianf • October 12, 2015 5:09 AM
@ rgaff “Thank you for that table of contents! Very useful.”
“Stick with me, kid, you could do much worse” [pace Bogey(?) to someone]. It was there all the time, if only one bothered to look. Some of the other top-voted comments there aren’t bad either.
“since you mainly learn about how the American justice system works by reading novels, I should probably stop trying to explain anything, you’ve made up your mind based on fiction.
I wasn’t exactly born yesterday, so, apparently that works for me—as opposed of your learned counter proposal of watching police preparedness videos on Youtube (I like the Russian naked ladies cavorting with cats in the hay, asking only for donations for cat food, channel). I still think there’s much more street smarts to be gained from Elmore Leonard’s parsimonious dialogues, and true crime police procedurals, than from grassroots’ depositions of ever so true police brutality, where often the victim knowingly put ‘self in a situation that only could end up one way.
“I live here. I have to deal with this first hand.”
You do, but you don’t absolutely have to, either put up or live there. As with everything else in life, it is a matter of happenstance, choice, and compromise, what you can put up with in exchange for [promises of] other worldly comforts.
Since you’re so hot for the “citizens are the enemy” US police mentality, when was it the last time you wrote your congressman, and everyone else in sight, to e.g. recall the elected officials responsible for oversight of the Police Commissioner in your vicinity, especially for the failure to curb police violence; or to change—or just cap?—their overtime pay system that promotes development of probable causes, and leads to convicting people on trivial, anal-retentive procedural grounds (first said yes, then said no, hence must be lying to the police—which is a crime, with the police the sole arbiter of what has been said and what is the sole & unassailable “truth.”)
Dirk Praet • October 12, 2015 8:07 AM
@ Survival of the Fittest in American High-Tech
Knowing they are on shaky legal standing, they enthusiastically support legal immunity from American lawmakers along with Google and Facebook. The battle Iines are set.
The Business Software Alliance (BSA ; representing Google, Facebook et al) has recently retracted its support for CISA, thus joining Salesforce.com’s CEO who previously had done the same. Dito for other legal initiatives like the Protecting Cyber Networks Act (PCNA) and the National Cybersecurity and Communications Integration Center (NCCIC) Act.
They’re slowly starting to catch on to the fact that overly overt support for USG surveilance initiatives has become highly toxic, especially in non-US markets.
@ tyr
In the 1400s China sent an admiral around the world to examine it. He reported back saying there were nothing but diseased and degenerate primitives not worth trading with.
It’s a well-known fact that many Chinese suffer from a misguided perception of superiority towards other nations and act accordingly in their dealings with them. A couple of years ago, a well-known Belgian painter and friend of mine was invited to Beijing for a lecture and got harassed by some arrogant official demanding he hand over for scrutiny a summary of his speech the next day. The painter refused – as he always improvises anyway – at which point the discussion got out of hand rapidly and finally ended in his now infamous reply to the official “You may think you’re superior, but you’re also much shorter. Get over it.” The lecture went ahead without further incidents.
ianf • October 12, 2015 8:56 AM
@ tyr, rgaff, Dirk Praet
[…] “this is the 21st century, you are not illiterate peasants tugging the forelock as the great lords ride by. Take a little time to educate yourselves about the world around you.”
Yes, Master. I beseech you on my bare knees, however, to think that you’re may be making contradictory claims, and harboring unattainable goals for us, the pedestrian wo | mankind.
“The Rus won the space race, they even had a massive celebration of their winning. The Chinese and Japanese are on their way to space as well.”
Fat good it will do the latter, that won’t benefit us all, at no original outlay to the Occidentals. Like hell the Russians did, won the useless ICBM race at a great cost to their own dreams of empire. Now they’re perpetually stuck at being the also-run #2 world power, soon to be #3.
“We in USA have an entrepreneur who wants to keep us in the race who is mocked for his efforts.”
Turning the logic tables on you for a mo: what for, to schlepp millionaires up the ozone layer, for them to tick off another item on the bucket list? Were it only one way ;-))
“There’s no surprise that M$ products are being dumped by any sensible government. No sensible person has ever liked their crap if they knew better.”
My sentiments are with yours, my cortex tells me something else. At the moment, where commercial and governmental networks in the industrialized countries are concerned, there are NO OTHER OPTIONS to the entrenched Microshaft-Intel duopoly. You & I can shill for FOSS (still on Intel) ’til we’re blue in the face to little avail. EU and China must wake up to the American digital hegemony & come up with turn-key alternatives (assembled in China ;-))
[…] “Now China is looking outward and there are going to be in interesting times before the dust settles.”
Looking outward, esp. investing where we’re not looking: building infrastructure, trade, industrializing the last underdeveloped continent Africa to a degree that the colonialist powers never considered necessary. That will pay big time when there are 4B Africans by the end of the century [26:43].
“One item that seems to be ignored. The one child per family put a check on the chinese birthrate. Somewhat later their economy showed phenomenal growth rates. This is not a coincidence. You can see the effect in history, every time the population goes down the next thing you see is a surge that benefits everyone.”
You’ve got the correlation upside down. The rise in 3rd World living standards is not due to a smaller number of children, or mandated sole one, per family, but that the steadily rising opportunities to earn a living, and general welfare, in itself a consequence of lengthy period of peace, have led to lower fertility rates. Large broods are any poor parents’ sole insurance against starving in old age, so when the state quits fighting for survival, evolves, starts to assume some of those responsibilities, and provides the wives alternatives to hausfrauery, the average number of births per woman goes down.
Observe that the Chinese OCP (=like OLPC, except not—Joe K. knows the ACRNM) was instigated at a time when the country was in economic doldrums, and means had to be found to halt the accelerating demographic projections. It was never as rigid as commonly assumed, and has now been relaxed, yet the Chinese women have not started producing babies in any higher numbers. Because they can see growing old without having to beg for food in the streets.
“Their new citizen ship scores are just the Maoist criticism sessions moved into the electronic arena. Instead of all the villagers meeting to hold a confessional self criticism fest under the watchful eye of the local party official now it is being done electronically FB style (without the CIA uplink).”
Note this one not commonly heard opinion: the Chinese are as much governed by their entrenched Confucian and Mandarin mentality & traditions, as the Russians—of whatever political ideology du jour—are beholden to, and vying for, their Tsarist ones. Blinded by their Domino theories, the Yanks never grokked that Communism was an Imperial wolf in proletarian sheep’s clothes. But that’s a discussion for another time.
@ Dirk: “You may think you’re superior, but you’re also much shorter. Get over it.”
I hope this is apocryphal, because, clearly, that official’s pint size had nothing to do with it, only his fear of being held to account for a gweilo’s lecture; and, anyway, the remark wasn’t entirely devoid of Western Master of the Universe superiority. Because when a Westerner goes to Beijing, still does as Romans do.
Andrew • October 12, 2015 9:24 AM
@Clive Robinson
“I also found that it was wise to add in a second stream to help remove other deficiencies”
I’ve already checked some variants like that but Spritz looks too nice…
“There are two basic ways you can add in another stream…”
I’ve checked randomness of the output and it looks better than the original RC4. Still, good to know that sarray can be used at output.
I also thought of using it as a derivation function but I ended trying to build a sequential memory hard function instead.
I think “scrypt” is trying to hard to protect the original password which affects the tradeoff memory/CPU so in my function I will try to add crypto hash only at the last rounds which already depends on previous. So it will be even more memory intensive… I hope.
Dirk Praet • October 12, 2015 9:35 AM
@ ianf
I hope this is apocryphal, because, clearly, that official’s pint size had nothing to do with it, only his fear of being held to account for a gweilo’s lecture
I would like to believe that most people do appreciate an official just doing his job, but I also firmly support returning sh*t when given. Had the man asked in a polite way, the painter would not have objected. He instead chose to bully him out of some mistaken sense of superiority, only to realise that he was picking on the wrong gweilo. It’s the kind of thing that happens when ignoring common courtesy and respect.
ianf • October 12, 2015 10:45 AM
What a bunch of woollies, the Met Police, that only now, 3 years and £11.1M costs later, has stopped guarding the Ecuadorian Embassy in London, lest the dangerous, alleged rapist Julian Assange escapes to deflower the minds of local posh totty.
Apparently the Swedes didn’t want to take over the bill, and keep delaying progress in his case until its statute of limitations runs out – as had already all the other sexual molestations charges brought against him.
Good tactic, @Julian, wait them out until the Exchequer runs dry, beat them at their own game. I hear you celebrated with a Domino’s Pizza – may be a local franchise, but remember where the seed capital came from, and profits are going. Next time order from Hungryhouse (they do halal chicken & vegetarian, too; deliver 24/7 within your SW1 radius NO QUESTIONS ASKED).
More Colors than a Chameleon • October 12, 2015 11:35 AM
Dirk Praet
“@ Survival of the Fittest in American High-Tech
The Business Software Alliance (BSA ; representing Google, Facebook et al) has recently retracted its support for CISA, thus joining Salesforce.com’s CEO who previously had done the same. Dito for other legal initiatives like the Protecting Cyber Networks Act (PCNA) and the National Cybersecurity and Communications Integration Center (NCCIC) Act.
American High-Tech whistles whichever way the wind blows. I searched the BSA website and found no dated mention of retracting their complete support for the CISA. Now since Safe Harbor became unexpectedly illegal they are changing their tune. Read the recent BSA press release with valid link buddy!
BSA Press Release AUGUST 3, 2015
BSA | The Software Alliance Applauds Senate for Taking Up Information Sharing Legislation
WASHINGTON — AUGUST 3, 2015 — BSA | The Software Alliance SUPPORTS the Senate leadership’s decision to consider the Cybersecurity Information Sharing Act of 2015 (CISA) before the August recess.
“The Senate was wise to make CISA a priority before recess. Voluntary information sharing is one of the most effective ways to defend against the countless cyber threats and intrusions that computer systems face on a daily basis,” said Victoria Espinel, President and CEO of BSA | The Software Alliance.
“It is important to advance legislation that removes the legal barriers that discourage information sharing between the public and privates sectors while protecting consumer privacy, and that’s a critical balance to reach,” Espinel added. “We look forward to working with Senators to advance legislation that accomplishes these goals,” she said.
BSA previously sent a letter to Senate leadership urging them to take action on the Cybersecurity Information Sharing Act.
http://www.bsa.org/news-and-events/news/2015/august/en08032015cisa
ianf • October 12, 2015 12:26 PM
Another one of these compound replies that I’m so famous for.
“Skeptical’s borborygmi are lies. His rales are lies. Even his flatus is false.”
What about his sucks? Still, you’re my wo/man… 3 new words in one comment, and so appropriate for the subject. Only… who ARE you, Dr. Hannibal Lecter in disguise?
borborygmus [noun]
pl. borborygmi / technical
rale [noun] (usually rales) / medicine
flatus [noun] / formal
The act of playing dead to be added to school curriculum across the United States… “authorities providing students of all ages with the best possible opportunity to survive the next inevitable gun massacre.”
Wish it was as simple as savings on Ritalin. If this is for real, I can’t think of a sadder corroboration of the Americans essentially being pagan worshippers of Moloch, with the school massacres the sacrifices it demands.
Why, Joe K., thank you for the criticism (honest), the Attention Whore in me is tickled pinko.
You say that “Jimmy knows what SPE stands for,” only on the day I asked, Jimmy was, and still is confused about it. Also Duck was nonplussed… it’s like playing a multiple choice quiz game with a computer.
This could rest there, but then do ask yourself, what’s with using an acronym that, though apparently well known to the issuer, is neither common, nor directly visible IN TWO ONLINE THESAURI that I looked? How deep is this reader supposed to dive in to decipher what shouldn’t been encoded in the first place.
This forum is at times dense with ACRNMs, which is fine by me when the context is of such technical nature that I would not grok it anyway (I know where my competence ends, and incompetence begins). But when the topic is, as here, of a general nature, why put up with it?
Wael • October 12, 2015 1:45 PM
@Nick P,
On history and justification of C programming…
You iput in a lot of effort in this, much appreciated. Here is my thinking…
We need to distinguish between applications developers, system developers, and embedded system developers. For an applications developer, a different language than “C” would make sense. For systems/embedded development, “C/C++” would be ok, in my view. The reason is systems developers deal with hardware details such as registers, interrupt lines, physical memory, … Systems developers need to have an understanding of the low level hardware components, and the requirement is they know what they are doing.
For an applications programming language that can work with platform abstractions, “C” has proven to be a not so safe language. And to make the language more safe, some control needs to be removed from the developer (for example the removal of pointers from Java.) To aspire for an all purpose secure programming language suitable for everything makes us look like hypocrites with double standards. How would you feel about governments taking away control from citizens for their safety? It’s the same argument and we need to be consistent 🙂
Gerard van Vooren • October 12, 2015 2:22 PM
@ Wael,
For an applications developer, a different language than “C” would make sense. For
systems/embedded development, “C/C++” would be ok, in my view.
When it comes to systems/embedded development, Ada would be “more ok” in my view.
Nick P • October 12, 2015 3:14 PM
@ All
re physical separation of WiFi
Found this OSS project that puts ESP8266 to use for OSS WiFi. The ESP8266 might be useful in physical separation for cost reasons: it’s only $2 at aliexpress.com. Harder to argue against. Make it the Black transport module of a Red-Black design.
Dirk Praet • October 12, 2015 3:33 PM
@ More Colors than a Chameleon
I searched the BSA website and found no dated mention of retracting their complete support for the CISA.
While all you had to do was click on the link I provided in the word “retracted” in my previous post.
Nick P • October 12, 2015 5:40 PM
Finally with some time to respond. 🙂
Note: I have a short version of my C analysis on Pastebin.com for anyone that needs a pasteable rebuttal to future comments about C. 😉
@ rgaff
It’s more along downloading and using one of the available tools rather than reading thousands of pages. Turning stuff in papers into working, secure code might take a lot more reading and practice. 😉 I’m not asking the average person to do the latter so much as the former when option presents itself.
GenodeOS is already in semi-usable form. JX OS could be used for custom, single purpose appliances with source and demo available. A2 Bluebottle/Oberon is in running condition and can be easily modified. A number of vendors straight-up sell microkernel or separation kernel based solutions including some board packages for desktops or servers. Dell Secure Consolidated Solution is an example for INTEGRITY-178B on Dell Optiplex.
Far as R&D grade stuff, CHERI has hardware and software available for download. Runs on Terasic DE4 for needed muscle. EROS project should still have source code, papers, networking, and GUI stuff online for resurrecting it. You can use SVA or SafeCode with OSS tools of your choice, esp OS’s. One can also call people up to see if they’ll send you the source for various projects.
So, plenty of opportunities outside pure C and UNIX with ranging skillset and maturity. Plenty of [F]OSS hackers more than capable of picking those up and polishing them. Not quite happening, though, so the riskier tools stay more usable than lower risk tools.
@ Clive Robinson
“The simple answer is from a sensible viewpoint he’s right. C evolved when computers were over a million times more expensive than they are today, you can by for around 1 dollar a SoC microcontroler that has orders more power, speed, memory and capability, than the high end minicomputers of the time.”
Your quote actually leads to a way to re-create the situaiton today. You start with a person whose never heard of LISP macro’s, DSL’s, parser generators, etc. This person just uses Java. Then, you force the person to implement Java on the computer you give them: a 2.55MHz processor with little cache and 256KB of RAM. The person must start with assembler, be able to write drivers with the Java variant, have little delay and leave as much memory for user as possible. The person would have to eliminate one good feature of Java after another just to squeeze it in. The result would probably look something like this or this.
And nobody would think it was a “good language” that should be used for system programming. They’d think it may or may not be a good tradeoff for those contraints to be used only in those constraints. In a better device, they’d probably dump that crap and use (even build) something better. 😉
@ tyr
” The real indictment of the modern comp boys is in hanging onto some ancient crap because they are afraid to do real innovation because it might change
something.”
Exactly. That’s despite them blasting the likes of Microsoft for a lack of innovation or keeping old stuff around. (rolls eyes)
“Failures are supposed to teach you something about how to succeed next time, they are not supposed to lock you in to crappy methods just because they are marginally functional. If you do the latter you become Micro$shaft.”
That’s actually a good point. Then you used the same reference as me lol.
“I could have sworn you told us about 8th somewhat less than 4th.”
I believed, with a cursory glance, that Forth’s issues would carry onto Eigth. This would make it not worth the time due to (a) Forth-like issues and (b) that Forth’s failed to gain any traction all this time. A nice write-up on the problem with Forth is here. It has more issues but that was a no-go for me.
@ Wael
My discussion is only focused on systems or embedded programmers. You can certainly make that stuff in C or C++. Although, note that I’m mainly arguing against C and its style of programming as C++ is an improvement on it. I actually recognize it as an alternative to C if one is using it with C++ style of programming. So the question is “Are C’s design choices worthwhile compared to other systems languages?”
We first have to look at other system languages. They’ve included ALGOL68 (esp ALGOL68C or ALGOL68S), IBM’s PL/S, Pascal/P, Modula-2, Oberon, Ada, and SRC’s Modula-3. That’s sticking with pre-1990, imperative languages used for operating system implementation or similarly low-level. The thing they all had in common is being more like ALGOL68 than an assembler. They tended to support safe-by-default (esp Wirth’s and Ada), better integration of large programs, smarter tradeoffs between safety/performance, and easier for humans to review.
Modula-3 was a good contender as a C replacement. The Wikipedia page notes these were core to the language: modules, explicit marking of unsafe code, generics, automatic garbage collection (optionally manual), strong typing, objects, exceptions, and threads. It also had a basic, standard library which was mathematically verified to not have certain bugs. SPIN OS team extended it with type-safe linking plus reported it was an “ideal” language for system programming due to ability to prevent errors while making high-performance, low-level code. Turn GC and safety off while using a subset to get something as lean (and unsafe) as C.
So, whether back in the 90’s or today, the question is whether C languages features/tradeoffs make sense vs other systems languages. I think others were better with acceptable efficiency back in the 80’s. Our OS’s and servers would’ve been easier to extend and have fewer errors any of the others been the implementation language. All the work put into C compilers since then means they’ll always be faster overall. Yet, there exist languages today that can be used for system programming with better attributes than C across the board. Even assemblers are safer than C nowdays. 😉
@ Gerard
Ada is still my baseline, too, when discussing the topic. It continues to evolve, as well. Ganssle even demo’d its use on ARM Cortex microcontrollers. More than efficient enough to handle whatever a desktop, smartphone, or server does. 🙂
Joe K • October 12, 2015 5:44 PM
@ianf
Good of you to respond so affably to my peevish noises.
This forum is at times dense with ACRNMs, which is fine by me when
the context is of such technical nature that I would not grok it
anyway (I know where my competence ends, and incompetence
begins). But when the topic is, as here, of a general nature, why
put up with it?
You know, asking questions is cool.
Carry on, you gracious charmer, you.
Tables Turned: Wall St Flees Chinese Data-Mining • October 12, 2015 6:00 PM
Anonymous high frequency traders would need to report their personal details, strategies, server location and source of funding three days before executing trades. The exchange would also introduce daily net buying quotas. One result is foreign investors have been withdrawing funds from China amid increased government intervention.
Without the speculators magnifying instantaneous price differences, the Chinese stock market is stabilizing as price swings on the Shanghai Composite Index have eased from their peak in August, with 10-day volatility plunging by more than half as turnover dried up. The benchmark index climbed 3.4 percent to 3,290.62 at the 11:30 a.m. break on Monday, extending its rebound to 12 percent from an August low.
No more 1,000 point drops in minutes in China. Now the average worker can invest and still sleep at night.
Oh the Ironies:
No one else invests more in data-mining than Wall St
No one dislikes being data-mined more than Wall St
The bottom line is another American high-tech sector has been seriously blacklisted. The trend will continue. Can speculators short themselves (Wall St)?
http://www.bloomberg.com/news/articles/2015-10-12/china-seeks-more-control-over-algo-trades-in-latest-market-curbs
Jonathan Wilson • October 12, 2015 6:43 PM
Why is it that despite specifically opting NOT to install KB30335583 (the “please upgrade this Windows 7 PC to Windows 10” nasty nagware update) and setting it to “hidden” multiple times, it keeps being unhidden and marked as “must install”?
For the last time Microsoft, I DON’T WANT Windows 10 on this PC so STOP trying to push it on me.
Nate • October 12, 2015 6:49 PM
The discussion about C and other unsafe languages and comparisons of safe languages with ‘the government taking away your freedom’ makes me think…
Programmers seem to be attached to C in a similar way, with similar deep passions and with similar tragic results as good, conservative, freedom-loving Americans are to certain handheld personal defense systems.
Every month we hear multiple reports of mass buffer-overrun exploits that injure countless innocent bystanders. Every time someone comments that ‘this sort of thing simply doesn’t happen in safe languages’, and every time a vast sobbing cry rises up from Hacker News and Slashdot:
‘But I NEED the ability to access raw memory at the byte level! It’s a fundamental human freedom! No compiler could possibly understand me! All those other people, those (brr) dumb USERS, they shouldn’t have unsafe languages! But I’m different. I’m a CODER. I know how to not make mistakes! I’m smart enough, tough enough and gosh darnit, people like me! Now hold my beer and watch this l33t hack! It’s totally disruptive!
‘Burn the LAN and crash the bus, but you can’t take my C++!’
ianf • October 12, 2015 6:58 PM
@ Joe K
If I didn’t know better, I’d say you’re trying to seduce me.
Where’s the ring?
Curious • October 13, 2015 2:22 AM
Hackaday website has an article (“The USB killer”) about someone with a special USB stick that damages the mainboard after insertion, and apparently makes a laptop unbootable in a video.
I am inclined to think that GCHQ and the like probably have something like that lying around already.
Clive Robinson • October 13, 2015 4:20 AM
@ Curious,
The USB killer has been around for a little while, and I think it’s been mentioned here before.
The thing is it’s just one of many “Do and Die” things that have been around since computers first existed, be it hardware or software or both.
I remember the “Peek to Explode” issue of an early 8bit home computer and likewise early hard drives where turning on all the electromechanical parts together took out smaller voltage regulators due to surge currents.
Many of the hardware problems were down to cost savings and people trying to hide their methods from competitors. As for the software “Well what do you expect” with a mixture of poor programming skills, general lack of engineering knowledge, and chip manufactures trying to keep things hidden for marketing reasons. Then there are ill thought out protocols, often from lack of knowledge and engineering acumen. And not forgetting pride of place standards from international bodies with multiple “cats fighting in a bag” industry competitors sitting on the committees, doing things that have ended in law suits further down the line or anti-competitive leading to monopolistic behaviour.
Some days I wake up thinking it’s a miracle anything works at all.
As for GCHQ et al, they might have “Plugin and rewrite firmware” devices, but not “Plugin and Die” non data destroying devices, as that is “in your face” vandalism not “Secret Squirrel” sneaky data theft.
If you wanted to be real real nasty, it’s not that hard to put self loading code on a USB device that then hides in the firm ware that slowly encrypts all your hard drive in a way you don’t see, then at some point in the future throws away the decryption key and pops up a ransomware demand or fakes a repeated hard drive failure… At which point a sensible person throws the entire computer in the crusher.
ianf • October 13, 2015 5:48 AM
@ Clive “Some days I wake up thinking it’s a miracle anything works at all.”
I know the feeling, it never leaves me (“the magic of complexity” pace R. Dawkins). Microcode firmware driving hardware is mind boggling. I remember once reading in (Dr. Dobbs’ Journal?), of someone writing a hard disk controller driver. Don’t remember why, but the reasoning was like… well, there’s the platter, the write/read head, the timing specs, the segmentation… how hard could it be? I was impressed. Then I met a guy who wrote modem firmware for a living, and thought it easy-peasy. That was quite a leap from young Bill Gates’ writing assembler code for the telex-tape optical loader with his & Paul Allen’s 24kB BASIC on it, on his knee in flight to Albuquerque, NM, to sell it to the IMSAI 8080 fellow. ~10 years later, I rewrote a disk-based TELETEXT simulator to work off 32K RAM, because I only had 20 >1K pages to demo. Had to add display slowing routine to emulate 9600baud serial line-by-line delivery. Guess if I was surprised that it worked right away even though I rewrote it at night before the trade fair in a hotel far away from home! Simple stuff, but oh so satisfying!
Sancho_P • October 13, 2015 5:57 AM
@Jonthan Wilson
”… I DON’T WANT Windows 10 on this PC”
Me too, but my trouble is: Where I live you can’t buy a PC without Mi$o or Pear.
Probably I could build it from scratch without OS but then it will cost 30% more.
Welcome to liberty, free choice – and capitalism.
@Moderator: Yes, some times I get (preview OK):
unused
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator, webmaster@schneier.com and inform them of the time the error occurred, and anything you might have done that may have caused the error.
More information about this error may be available in the server error log.
Clive Robinson • October 13, 2015 6:03 AM
Flight MH17 Technical report released
The BBC late morning news had a flash over to the official release of the Malaysia flight shot down by missile last year over Russia/Ukraine.
The report gives an area for shooting down the plane that covers all three areas. Unsurprisingly Russia claim their technical resources investigation put it in the Ukraine whilst the Ukrainians claim Russia/breakaway area. The Russians have changed their story three times and now claim that their analysis shows it was an old missile system (for which no evidence has been provided) that Russia no longer uses or has, further implying it was neither Russia or the breakaway militia that fired the missile.
Unless there is further evidence such as a serial number by which the missile can be traced back and the Russians and Ukrainians can demonstrate reliably who had the missile at the time it is unlikely that direct attribution will ever be possible for what is and remains the most serious war crime this century in the European area.
CallMeLateForSupper • October 13, 2015 7:45 AM
@Sancho_P
“… my trouble is: Where I live you can’t buy a PC without Mi$o or Pear.”
I’ve heard that complaint – and various flavors of it – many times over ~20 years, and now a new generation perpetuates the mantra. It just won’t die. (sigh)
Look… go purchase your ‘puter. You don’t have to use the frickin’ M$ stuff. Take a deep breath; wipe the HD; install a real OS.
Clive Robinson • October 13, 2015 8:45 AM
Why US Ex-Pats are becoming Ex-Citizens
The way the US tax it’s citizens who live and work abroad is not just unique, it’s discriminatory.
Worse for those US Citizens working and living abroad because of the US Gov behaviour, they are being steadily forced to either give up US Citizenship or go back to the US as they find they can not get bank accounts or existing accounts get closed, in ways where they effectivly lose the money or some significant proportion.
In effect the US Government regards it’s Ex-Pats as being criminals unless they can prove otherwise, the proof however is often virtualy impossible or impossible to obtain due to the demands the US Gov places on not just the Ex-Pat but their employer, bank as well as the national authorities of the country the Ex-Pat is working or living in…
Effectivly the US Gov is running a system as despotic as those the US Gov regularly “rails against” for “unamerican” behaviour…
An Ex-US Gov emoloyee has written on the subject in a WSJ article,
ianf • October 13, 2015 9:09 AM
Re: “Flight MH17 Technical report released”
I’m watching the BBC Impact (daytime commentary filler) & news headlines on and off. #MH17 is the main topic, repetitive-ad-nauseam. Invited ballistics, ordnance, other technical experts do not mince words where the missile trajectory begun: in the separatist area, fired ahead of the incoming aircraft, a repeat of shooting down of a Ukrainian military plane 4 days earlier (18 dead if I recall correctly).
@ Clive […] “Unless there is further evidence such as a serial number by which the missile can be traced back and the Russians and Ukrainians can demonstrate reliably who had the missile at the time it is unlikely that direct attribution will ever be possible […]”
There’s another, if slight, possibility of corroboration of the events. Whoever pressed the launch button, and his 2-3 man crew, can hardly have been left alive after the Oops! truth became known… “died on the battlefield in defense of Vladimir Putin’s Imperial Ego.” But their comrades know who done it, and can’t all be exterminated to keep the lid on. They also left families behind, mothers. Perhaps it’s too much to expect heroic whistle blowing from babushki, but the Russians once engaged in samizdat, and thus potential f.o.r.c.e.fu.l posthumous testimony of some relative’s shouldn’t be ruled out.
Dirk Praet • October 13, 2015 9:16 AM
@ Clive
Unless there is further evidence such as a serial number by which the missile can be traced back and the Russians and Ukrainians can demonstrate reliably who had the missile at the time it is unlikely that direct attribution will ever be possible…
Same feeling over here, although I’ve followed the affair closely. None of the stuff I’ve read or seen on TV provides any conclusive evidence. Applying Occam’s razor, however, I still think the Russian rebels did it. I personally believe the Ukrainians are too disorganised to effectively mount a false flag operation of this magnitude without some idiot bragging about in the local pub. It’s more likely some overzealous rebel squad after a couple of wodka’s decided now was as a good a time as ever to test drive their new shiny BUK missile system and confused MH17 for a Ukrainian plane.
But whoever did it, Malaysia airlines and the flight controllers are at least partially to blame too. They knew very well there was a civil war going on in that region and should have avoided/closed that airspace.
Nick P • October 13, 2015 10:23 AM
@ Gerard
“The main difference between Ada and Modula3 is that Ada has a fully supported GCC front-end (GNAT). They both have the Pascal look and feel.”
I’d add that it has more safety features and heavier language. The reason I thought Modula-3 was a nice C replacement was that it had the nice features with, as you said, a Pascal-like feel to programming. The Ada langauge is harder to use because some features are there to make code self-documenting & even avoid syntax errors. The upfront, mental investment in each module can be large. Proven to work in practice for sure but I’m mentioning that so people don’t get blind-sided by it.
“While C was designed as a portable high level assembler, Ada was specifically designed to be used on both embedded devices (it’s roughly as fast as C) and in the large, and because it was designed for the military it had to be safe and (most of all) readable. So it is more “bureaucratic” but that has its reasons and, to me, it is not a burden.”
Good description. Only gripe is on C as my recent research shows it wasn’t meant to be portable and wasn’t even really designed. One guy chopped features off CPL to fit it into an ESDAC. What could compile, that’s only criteria, was BCPL. B was BCPL squeezed & twisted into a PDP-7. C was a B changed to work on a PDP-11 while still mostly BCPL. It just got ported by others later because it’s barely a language & therefore easy to port. Details here.
Now, saying it’s about equivalent to a cross-platform assembler in practice or that people use it that way is fine. That’s accurate. I think killing the myth that it was designed for that… or anything else… may help in showing why people should ditch it. ALGOL68, Modula-3, Ada… these systems languages were designed by pro’s to reflect real-world needs with proven track record. C is a BCPL clone that wasn’t designed at all: just what parts of CPL could compile at the time with a few changes. Framing it like that makes its flaws unjustifiable on any modern device.
Nick P • October 13, 2015 10:26 AM
@ Clive, Wael, Gerard
Here’s a quick laugh for you related to OpenSSL and the theme of software maintenance. Yeah, you already know where this is going… Bad as it is, whatever you guessed was probably true at some point haha. Loved dude’s presentation and finish.
ianf • October 13, 2015 10:40 AM
@ Dirk “more likely some overzealous rebel squad after a couple of wodkas decided now was as a good a time as ever to test drive their new shiny BUK missile system and confused MH17 for a Ukrainian plane.”
Yes, and no (pick one or other). Not as disorganized as this. The separatists have downed 3 or 4 Ukrainian military planes in the weeks and days before. The Buk-2 missile launchers are equipped with radar, but probably not one very precise one. Most probably then, once a military decision had been taken to down another plane, the squad leader misread the electronic footprint of #MH17’s Boeing to be that of yet another Ukrainian Air Force’s one, a “viable” target to hunt down acc. to his “worldview.”
“Malaysia airlines and the flight controllers are at least partially to blame too. They knew very well there was a civil war going on in that region and should have avoided/closed that airspace.”
If anyone is to shoulder the blame for non-prevention, it ought to be the Ukrainian and the European IATA(?) bodies (air transport overseers) for not declaring the area out of bounds. The Malaysians did everything by the book; had there been a whiff of putting themselves in Putin’s way, they’d have altered the flight path. Remember, however, that air corridors aren’t empty, but filled with scheduled flights. Changing that prior to departure might have forced MH17 to wait for a slot, with cascading consequences elsewhere.
ianf • October 13, 2015 11:27 AM
May I recommend the ongoing vibrant discussion over qualities of Lisp over at Phil Greenspun’s blog [28 comments and counting] Clojure: If Lisp is so great, why do we keep needing new variants?
[My only, and very shallow, experience here is of the Emacs Lisp].
Joe K • October 13, 2015 12:01 PM
@ianf “Where’s the ring?”
The One Ring?
Fearing the worst, I hope for the best.
Gerard van Vooren • October 13, 2015 1:07 PM
@ Nick P,
I was talking in general about Ada and Modula3. In the past I have searched for Modula3 compilers but didn’t find one that worked “out of the box” while the Ada compiler (GNAT) is fully supported. In short (correct me if I am wrong) it looks like Modula3 is a dead language.
Curious • October 13, 2015 1:39 PM
I am not the best to present this type of stuff.
Something about a typo in the source code for OpenSSL code that didn’t compile or something, that by the looks of it, was eventually fixed for deprecated cipher (DES), but removed in LibreSSL :
https://marc.info/?l=openbsd-tech&m=144472550016118&w=2
ianf • October 13, 2015 1:50 PM
@ Joe K., This one, silly, but I’d settle for a Token Ring.
Wael • October 13, 2015 2:09 PM
@Nick P,
Here’s a quick laugh
Nice! “Debian bad” 🙂
There is your open source security. Bugs are sitting for 11 years (or 30 in other cases) for review and no one found them for this long?
Lazy Camel • October 13, 2015 2:55 PM
Windows 8.1 Computer (clean install)
All updates installed minus Windows 10 spyware patches.
Said patches are ‘hidden’.
Windows update runs (check only), any hidden ’10’ patches at time in future appear again…as not hidden.
Others seen?
Nick P • October 13, 2015 3:10 PM
@ Gerard
You’re totally right about that. It had some traction for a while but everyone stayed on C++ and Java bandwagon. That killed it. Go’s picking up where it & Oberon’s left off with an application focus. That Ada is alive, has a mature compiler, is proven in embedded, and continues to get updates are an advantage over the Wirth languages. I venture further to say that Ada lasting this long in still usable form means it’s a better choice than Go or Rust for longevity. Enterprises worry about future-proofing new code and maintaining old code. Ada’s already been down that route with no [public] sign of stopping. And way easier to maintain/extend than COBOL or C that came before it. 🙂
Btw, what do you think about the argument that it’s a good choice for future-proofing? There is the risk of AdaCore going away but a small firm could pick up the GPL stuff. Defence and safety-critical industry alone should keep AdaCore alive for the duration of their products. That’s often 10+ years.
@ Wael
“There is your open source security. Bugs are sitting for 11 years (or 30 in other cases) for review and no one found them for this long?”
Didn’t you hear? Open-source gives you “many eyes” to look at stuff (eg cat videos) other than the source code vs the “few to zero eyes” that closed-source claims. Personally, I never could figure out why projects argue about who has more people ignoring the source code. I thought it was how many competent, trustworthy reviewers dug in and what was done with that information. But, hey, I’m one of those idiots on the Internet spouting nonsense. 😉
ianf • October 13, 2015 3:34 PM
OT #MH17 cockpit modeling question
Those of you who’ve seen it on the news: apparently it took 3 months to physically dress a Boeing 777 airframe with original recovered fragments of the front segment—cockpit + business class—of the downed flight MH17. As all parts have been green-screened (captured sans background), then entered into a graphic database, this would allow reconstruction as a fully virtual, scaleable, immersive-VR model. Yet the investigators chose to do it IRL.
Clive Robinson • October 13, 2015 4:25 PM
@ ianf,
Yet the investigators chose to do it IRL.
I suspect the reason is “evidenciary” level of acceptance by the judiciary.
In that there is the usual “This is the way we’ve always done it” combined with the fact that a VR rendition has no chain of custody, could easily be forged, etc.
If somebody challenged the “evidence” it would be extremely difficult to say that the physical reconstruction had been tampered with, unlike a VR.
However I suspect that they used both VR and real life. That is as the pieces were found and collected they were photographed and number tagged. The resulting DB then enabled them to more quickly build a VR construction that could then significantly speed up the actual physical reconstruction. If it all fitted together they would then know both the VR and physical reconstruction correlated and that the VR model was an accurate model on which “what if” questions could be tested.
All in all it’s a very sad set of circumstances that caused so many innocent people to be killed.
What I can not understand is the “political reasoning” that effectively forced civilian air traffic into a war zone where several aircraft had already been shot down. Either the aircraft should have been re-routed or not flown. If preventative measures could be done for an Icelandic volcano why could it not be done for a far more dangerous war zone.
It’s the question I want answered most of all, preferably with people named and shamed, so similar will never happen again.
Dirk Praet • October 13, 2015 8:42 PM
@ Nick P, @ Clive, @ Wael, @ Gerard, @ Curious
Here’s a quick laugh for you related to OpenSSL and the theme of software maintenance. Yeah, you already know where this is going
Oops. Then again, it’s the kind of thing everyone has come to expect from OpenSSL. Why the OpenBSD crew started the LibreSSL fork and Amazon came up with s2n. Which is definitely not the kind of thing you can expect with proprietary software.
@ Wael
Nice! “Debian bad” 🙂
Let’s just say it s*cks less than certain other distributions do. I kinda get why the TAILS guys chose Debian over others, but they really should have gone for PC-/FreeBSD. I’ve recently found several bugs in TAILS, some of which only minor nuisances, but at least one causing an infinite loop at boot time and which prevents a system with a persistent volume to ever get past the login/greeter screen.
@ Nick P.
I get your feelings about C and C++. Unfortunately they’re still quite ubiquitous in FOSS code, and in the end I’m feeling much more comfortable woking with those than hacking some folks’s Ruby or Python code. Over the last couple of days, I’ve been toying about with several Python-based Tahoe-LAFS backup procedures on TAILS, and they’re a full-blown nightmare. It is beyond me why people develop stuff of about 100kb that comes with a dependency hell of 100+mb in additional modules. Looking for alternatives, I found a third one that even required Mono, so that one went out of the window too.
@ Gerard
We’re number 1 and you guys are out. It’s BEAUTIFUL! (background: sardonic Vincent Price laughter)
Nick P • October 13, 2015 9:34 PM
@ Dirk
“I get your feelings about C and C++. Unfortunately they’re still quite ubiquitous in FOSS code, and in the end I’m feeling much more comfortable woking with those than hacking some folks’s Ruby or Python code.”
No doubt and it will be necessary to deal with it. There’s several strategies:
a. Rewriting it incrementally in a safer language.
b. Rewriting it incrementally in a safer, C-like language.
c. Apply compiler transformations to automatically make it safe[r] while taking the hit.
d. Applying software to totally isolate it from the rest.
e. Applying hardware to isolate it from the rest.
f. Applying hardware and/or modifications to source to protect from attack using a range of established methods.
I’ve encouraged using (b), (c), and (d) wholesale on everything we have as an interem solution with (d) being my main, prior method and recommendation. There’s a number of solutions for that which aren’t academic toys. There’s academic and some commercial tech to take that to (e) and (f) but takes hardware development. (a) requires understanding source quite thoroughly compared to even (b). The easy, most risky route is to ignore (a)-(f) and just try to code up good C. That’s neither ideal nor pragmatic (see CVE list) but the most popular.
In any case, that there’s a lot of software written in a language as awful as C doesn’t justify writing the next project in it: too many better languages available that even have C integration for libs you may need. Ada is a top contender as it’s battle-tested w/ full tool support. I’m watching Rust and Julia since they might be the replacement once they mature. Just hard to justify C unless you’re working within a C application or kernel’s source. That’s the legacy effect where it makes sense to default on C.
Plus, the safe-C techniques and static analysis tools have come quite a way. Anyone that settles on C should follow coding style that makes it easy to analyse while documenting the expected behavior. Then, a whole range of tools can be applied then or in the future. The current trend for most projects seems to be to make manual and automated analysis as hard as possible in the future. 😉
“, I’ve been toying about with several Python-based Tahoe-LAFS backup procedures on TAILS, and they’re a full-blown nightmare. It is beyond me why people develop stuff of about 100kb that comes with a dependency hell of 100+mb in additional modules.”
Yeah… that trend has been disturbing. My goto explanation on it is here. Seems to be an inevitable result from a combination of the bazaar development and fact that most 3GL’s (esp C language) aren’t very suited for it. You get all kinds of feature creep from various use cases, lots of copy/paste instead of true components, and the “components” are like full-blown applications themselves. Back when more active, I just combined the minimalist, self-contained libraries to solve problems because it was impossible to understand and assess the others. Where would I even begin to trim those without spending countless hours preventing a break?
In the long-term, functional programming and loosely-coupled integration are probably the solution to that. Near-term, they’re using OOP, SOA, micro-services, message passing, etc. On most code, though, it seems to be straight forward “include whole library per 3rd party function.” I really don’t have a solution except to say I avoid as much of that crap as possible or just use most field-proven monoliths I can find (eg my desktop stuff).
It’s not going away if you’re using a Linux. Glad you mentioned PC-BSD as I keep meaning to try it. Are the wireless and graphics drivers robust on it? Those were my main problem areas for Linux for years.
“@ Gerard
We’re number 1 and you guys are out. It’s BEAUTIFUL! (background: sardonic Vincent Price laughter)”
I might be misinterpreting this. If you’re talking his Ada posts, he’s actually right with all the analysis and empirical tests I’ve seen backing that. They put most languages through the paces back in the 80’s-90’s with Ada coming out ahead and C almost always on bottom in metrics that count. So, it as a default for safe/secure, systems programming has evidence on its side. The history of C I posted just makes that make even more sense. 😉
Figureitout • October 13, 2015 9:44 PM
Nick P
These people think that someone sat down, thought of every tradeoff
–Man lol, that’s bullsht b/c that’s impossible. You and I know for damn sure neither of us could’ve created C, and Ken Thompson came up w/ an attack that *could poison quite a bit of future computing. The internet didn’t exist when it was made, right? So a huge swath of attacks wiped out there, that didn’t exist yet. Are you saying current designers need to predict the future now too (besides not being vaguely aware of it)? Debuggers didn’t exist really either, had to solely toggle lines and more difficult analysis methods (that are crucial and need to be known).
You could’ve started developing in some of the languages you preach (well not like Modula3, which you now admit is a bit of a “dead” language, wtf?–Why recommend dead languages?) and come up w/ guides to setting up toolchain “correctly”. But instead you want more of a flame-bait on language (the generated logic is all that matters, well and electrical characteristics).
Again I’ll state, “no hard feelings” or whatever.
Request for comment: High level design considerations for: Tamper-Resistant Physical Intrusion Detection
Please excuse some scattered thoughts, I don’t want to ramble.
Anyone reading the blog and keeping up w/ security events of past few years may be thinking something like I do…I need to completely revamp my systems from top-to-bottom and instill some strong separation/isolation.
First step after you recover from the shockwave of not feeling safe anywhere, is you need a somewhat safe place to work, the best attack is spying/tampering w/ defenses being erected. The defense fails before it’s even ready…At the least, you need to know if someone who hasn’t told you has meandered in your workspace.
Using what I have at hand, I hope to give an easily built and modular system (using different initial detectors and hopefully better crypto of future) that logs detections into multiple internal EEPROMs (sort of a mesh network of sensors) and on the “serial monitor” for Arduino. Purpose of using Arduino and other chips that’ve been busted open (thanks to all the library creaters, basically making a playground for higher level design) is to maximize ease of use and ability to get. It’s probably one of the greatest tools ever made so far for prototyping (haven’t succeeded yet in protocol debugging w/ it). Another cool thing is making a programmer w/ Arduino…kind of like compiling a compiler…it will give some comfort at least generating your own build, unless Ken Thompson did a build and distributed it.
Main Components:
-2X Arduino Uno
-2X nnRF24L01+ transceiver
-2X 5V powersupplies
-Power failure module (maybe this http://rletech.com/our-products/power-and-ground-monitoring-systems/power-fail-monitor/ )
-Battery backup part (w/ convienent connectors made already)
-Radar w/ a switch (can’t talk about this much, so may switch to an open one…or this one I have that does IR and MW radar, just another channel that needs to be defeated)
-Perf/Breadboard
-Epoxy (brand not decided yet, and if I want to do that since I may need to change keys programmably…)
-RF24 library ( https://github.com/tmrh20/RF24 )
-These libraries ( https://github.com/gctechspace/ACS/tree/aes-crc/libraries )
I’ve got the radar switch working, I was originally thinking the little FS1000A modules but they’re just much less to work w/, nRF24 is just…better. They can still be used, and I wrote them off on first test even w/ no antenna connected. But I need 2x transceivers for checking each other for tampering and if necessary initiate erasal, I eagerly await while they’re on their way via mail. They are breadboardable modules w/ SMA connector so I can hookup a 2.4GHz yagi antenna and greatly extend perimeter.
End-to-end encryption w/ AES-128 (assuming implementation works, I wasn’t sure how to encrypt the RF comms) and I want to look into encrypting the payload first w/ something like XTEA or other tiny ciphers, but making sure each side can decrypt is a challenge. Further encrypting the payload may be even better if it can be transformed into a short range chat program (w/ Arduino serial monitor I think that’s very doable, but that’ll be an addon) as a backup to internet/GSM compromise for mostly urban areas or business/university campuses.
Keeping initialization vector pseudo random at least will be a challenge. ( http://stackoverflow.com/questions/8041451/good-aes-initialization-vector-practice/8041580#8041580 )
Main threat is attacking initial detector, or my endpoint and/or toolchain programming the chips; I can’t…can’t think of a way to comprehensively defeat those attacks. But still, I think airgapped microcontrollers are generally still fairly strong, otherwise stoplight controllers would be attacked daily, and when’s the last time you heard of a stoplight controller being attacked?–Even though it’s simple.
I want a tamper detect switch (apparently some google thing had one on a screw) that sends out self-destruct command to all paired devices and erases EEPROM, and shutsdown. A “heartbeat” of sorts may be necessary but highly unwanted.
Think I’ll be protected from Travis Goodspeed’s attack, but the initial preamble is another problem I don’t know how to secure (either a long repeating pattern that needs to be manually changed on a schedule or somehow encrypt it…): http://travisgoodspeed.blogspot.com/2011/02/promiscuity-is-nrf24l01s-duty.html
More operation details will be provided in code and final write up, I don’t want to ramble too much when I think the gist is clear. Timeline will be awhile unfortunately (school…oh and work to have money for food). Feel free to tear apart and even call me names, if you can clearly spell out technically, how to defeat this setup easily or why it’s a fail from the start.
Nick P • October 13, 2015 10:43 PM
@ Figureitout
“Man lol, that’s bullsh*t b/c that’s impossible.”
Whether I word it well or not, anyone reading should get the translation: considering the day-to-day needs of a programmer, issues he/she runs into, and language constructs that handle both the most. ALGOL60 had already done quite a bit of that. It was starting point for CPL. So, it could be done and was done. But…
“You and I know for damn sure neither of us could’ve created C”
…CPL didn’t run on that 50’s computer. So, they literally carved off features until they had something that would compile. Then used that. Anyone can take a good language and trim it until it’s barely above assemlby. You and I not only could’ve done that: we’ve both done far more than that in our private projects and due diligence in our projects. Resulting BCPL’s core features and philosophy became C’s with all credit for that given to C. The first C was just a BCPL/B mod to run on a PDP-11. Added structs for some organization and that was that.
For real fun, look up what Wirth and Jurg did encountering the same problem in Lilith system. The result was readable, safer, consistent, efficient, easy-to-compile, and reliable. Each improvement building on that took undergrads rather than the best low-level programmers around. Language and design strategy were the reason.
“Why recommend dead languages?”
B was a dead language. Worked fine with C’s name on it. Turns out recommending or extending specific features of a dead language might sometimes create a live one with a future. 😉
” But instead you want more of a flame-bait on language (the generated logic is all that matters, well and electrical characteristics).”
By that standard, you should be using hand-wired everything with machine code. You’re full of it, though, as usual on that topic. Abstraction certainly matters. You will eventually use a HLL if you’re not already. The question is whether we should use a HLL designed with good tradeoffs for HLL’s (eg Ada, Wirth’s, even C++) or the result of a HLL (BCPL, C) that was trimmed to fit on a EDSAC and later PDP-11. Far from flame bait, I think it’s reasonable to claim we should avoid (in 2015) relying on a language designed solely to work in an EDSAC and PDP-11 because it couldn’t run a real 60’s era language. Especially when many in between there and now have efficiently solved problems with much better safety, maintenance, and so on.
If any are live, we should use them. If any are dead, we should consider ressurecting them or integrating their concepts with the live ones. Good news is there’s mainstream work in that area. Bad news is some people keep acting like C’s problems are (a) acceptable vs alternatives or (b) result of a design or brilliance rather than chopping good languages (eg CPL) to fit on bad hardware author had. That keeps it going with more momentum than a BCPL variant deserves in a world with many deserving successors to ALGOL68.
Figureitout • October 13, 2015 11:46 PM
Nick P
ALGOL60 had already done quite a bit of that.
–Code proving that? Why did it prove that?
Anyone can take a good language and trim it until it’s barely above assemlby
–Doubt it.
we’ve both done far more than that in our private projects
–Yeah well, we don’t talk about that anymore, eh? You have your cards up the sleeves, I have mine.
B was a dead language.
–You’re right, and C is alive and kicking ass; still. Those talented enough to work completely around it (generally they all use some C to compile something though) can and will, those that can’t, use it b/c they don’t understand computers.
By that standard, you should be using hand-wired everything with machine code.
–No, C is a very high level language. Anyway next languages I want to learn are Python and Rust, Python gets converted to C and Rust looks like a modified C (which is nice); guess they learned from superior design to usable computing constructs. (smirky smiley face)
ianf • October 14, 2015 12:10 AM
RE: #MH17 @ Clive “can not understand the “political reasoning” that effectively forced civilian air traffic into a war zone where several aircraft had already been shot down. Either the aircraft should have been re-routed or not flown.”
I remember it being brought up by some commentator at the time of “the accident,” and the (potentially now time-embellished) answer that overflying the region was deemed safe because range of the longest-reach SAMs etc on the ground was well below the ceiling of the scheduled civilian overflights. Nobody took the creeping fog of war into consideration (pace Robert McNamara), nor had any knowledge of the Russian-supplied Buk-2s in the area. If the NATO knew it beforehand, but didn’t share that intel with the civilians, then some uniforms there are guilty of dereliction of duty. Then let go scot-free.
“If preventative measures could be done for an Icelandic volcano why could it not be done for a far more dangerous war zone.”
It’s logical, but there’s always the prior-case instance of the 1982 BA9 flight, when the reason for the fine volcano ash-caused failure of all 4 engines mid flight “was not immediately apparent to the crew or air traffic control”.
“It’s the question I want answered most of all, preferably with people named and shamed, so similar will never happen again.”
Even if the criminal enquiry comes up with some air traffic safety overseers’ names, it’s not a given they’ll end up other than reprimanded and fired, then resettled under new identities due to the murder of once-Swiss air traffic controller Peter Nielsen. [BTW. that’s quite a career path of the murderer becoming a minister in a provincial Russian homeland.]
Wael • October 14, 2015 1:39 AM
@Dirk Praet,
Let’s just say it s*cks less than certain other distributions do.
It certainly does. It was one of the first distros I used in the early 90s. I graduated to FreeBSD a while back, even though I haven’t been on BSD for quite sometime now.
Clive Robinson • October 14, 2015 2:56 AM
@ Wael,
I graduated to FreeBSD a while back, even though I haven’t been on BSD for quite sometime now.
Which begs the question “What ya using?”.
@ Dirk Praet,
I remember the flight from a documentary, it was quite odd the collision happened over Germany, between a Russian aircraft and a US aircraft, but even though the ATC was a private company in Switzerland, a court decided it was Germany’s liability…
The Swiss ATC company were breaking all sorts of rules and guidelines and whilst there should have been more controlers working only one was awake and manning two consoles with a large number of important safety systems off line for maintainance.
Further the Internationally set rules for air collision avoidance was ambiguous as to if ATC or electronic anti collision systems should take primacy in instructing pilot actions. Worse this had a year and a half before nearly caused another mid air collision and a formal request that the ambiguity be removed from the International rules had not been acted upon…
All in all it was presented as though the accident was thus in effect a fore gone conclusion with culpability a plenty to be shared around at international levels as well as with the private ATC company.
As for the argument about limited hight surface to air missiles not being a worry so don’t divert aircraft… It was an active war zone with it fairly clear that a major super power was actively involved in supplying weapons and highly trained personnel to escalate hostility…
Thus it would appear an International Organisation was found wanting yet again for it’s inactivity, thus endangering passengers lives possibly due to commercial pressure becoming political pressure from nation states. I remember such behaviour kicking in with the Icelandic volcano, and being disgusted by it at the time.
Curious • October 14, 2015 3:00 AM
@Lazy Camel
Yes, I believe I’ve seen at least one patch that was initially set to “hidden”, reappeared on the next “check updates”.
Curious • October 14, 2015 3:55 AM
“California governor says no to RFIDs in driver’s licenses”
http://arstechnica.com/tech-policy/2015/10/california-governor-says-no-to-rfids-in-drivers-licenses/
As the article points out, the use of these special types of driver licenses were to be voluntary, however it was assumed that implementing this would effectively lead to widespread use.
Dirk Praet • October 14, 2015 6:58 AM
@ Nick P.
In any case, that there’s a lot of software written in a language as awful as C doesn’t justify writing the next project in it…
Most certainly so. But what to choose from when developing on COTS platforms? There’s so many different programming languages out there and pretty much zero standardisation making it virtually impossible to keep up, especially because everyone is trying to push his own stuff. Mozilla is a ferm supporter of Rust, whereas Google is pushing Go(lang) and Dart. MSFT is firmly invested in C#, Java and Flash for unknown reasons just refuse to die and even Javascript keeps gaining track. The now more mature Python and Ruby/RoR have become quite popular for FOSS projects and in devops circles, whereas SQL is the de facto standard for everything database related. I’m still seeing a lot of Perl too.
Ultimately, this inflation of programming environments and their required runtimes and dependencies are a huge attack surface on any general purpose Linux machine. And unfortunately, we’re seeing the same on projects like PC-BSD.
Glad you mentioned PC-BSD as I keep meaning to try it. Are the wireless and graphics drivers robust on it?
They’re getting there. 3D hardware accelerated graphics are still a bit of an issue with the proprietary Nvidia/ATI cards, but wifi works pretty much out of the box. If it doesn’t for some obscure chipset, just plug in a supported USB wifi dongle.
I might be misinterpreting this. If you’re talking his Ada posts…
I wasn’t. Yesterday, The Netherlands for the first time in 32 years failed to qualify for next year’s European soccer championship, whereas Belgium did and, even more, by defeating Israel, for the first time in history made it to #1 on the FIFA’s national team ranking list, overtaking soccer superpowers Germany and Argentina. So yes, time to gloat 😎
Wael • October 14, 2015 7:24 AM
@Clive Robinson,
Which begs the question “What ya using?”.
Was using MacOS when I had my Mac which was stolen a while back if you remember. I had a FreeBSD virtual machine on it. Never got to replace it… Waiting for the new one to come out. I still use MacOS on a desktop for personal use but never had the time to build a nice FreeBSD machine. Most of the time I’m on an iPad mini. That’s why I can reply to posts at any time (gives people the impression I’m always awake)
Clive Robinson • October 14, 2015 8:28 AM
@ Wael,
That’s why I can reply to posts at any time (gives people the impression I’m always awake)
Hmm you know that can be read several ways 0:)
You might be one of the first recorded cases of “sleep prodding” a tablet reported, after all somebody has to be first B-)
More seriously I used to be a very light sleeper and would wake several times during the night with good ideas, that I used to jot down in a good old fashioned paper notebook. Which of course needed a light to be turned on, which is a really good way to make you squeeze grumpy, and kill the romance in the relationship only slightly slower than the pet ferret escaping from her cage and climbing into the bed, or very noisily scratching the paint off of the closed door. The only faster way I found to kill the romance was to be liked by her parents…
Gerard van Vooren • October 14, 2015 11:50 AM
@ Dirk Praet,
In any case, that there’s a lot of software written in a language as awful as C doesn’t
justify writing the next project in it…Most certainly so. But what to choose from when developing on COTS platforms? There’s so
many different programming languages out there and pretty much zero standardisation making
it virtually impossible to keep up, especially because everyone is trying to push his own
stuff.
Ada is fully standardized and because it has a GCC front end the compiled code runs on every GCC supported (COTS) platform. It has C FFI and can be a drop in replacement of C on these platforms also because it lacks GC and it can be used for RT programming.
Mozilla is a ferm supporter of Rust, whereas Google is pushing Go(lang) and Dart. MSFT is
firmly invested in C#, Java and Flash for unknown reasons just refuse to die and even
Javascript keeps gaining track. The now more mature Python and Ruby/RoR have become quite
popular for FOSS projects and in devops circles, whereas SQL is the de facto standard for
everything database related. I’m still seeing a lot of Perl too.
Different things. Rust aims to be a C/C++ competitor, Go is perfect for writing servers, and Dart and JS are for web programming. C# is mostly tied to Windows, Java is in the same area as Go. Python and Ruby are mostly used for scripting (ducks).
Yesterday, The Netherlands for the first time in 32 years failed to qualify for next
year’s European soccer championship, whereas Belgium did and, even more, by defeating
Israel, for the first time in history made it to #1 on the FIFA’s national team ranking
list, overtaking soccer superpowers Germany and Argentina. So yes, time to gloat 😎
You Belgians can have your 15 minutes of fame. “Our” fame lasted 32 years. Anyway, I am glad I don’t like soccer at all. But it is a conspiracy. The MH17 report came out the same day of that soccer match and now the talk of the town is about losing that stupid match.
(Don’t take everything serious what I write down)
ianf • October 14, 2015 12:38 PM
@ Wael on an iPad mini
Do you use a physical keyboard (if one to be recommended—which?), and/or a table stand (lean-in; ditto); or by holding it up in an easy chair or a sofa (lean back)? No need to recommend the sofa—already there.
I’m asking b/c I also got one a year ago thinking it’d be an improvement over reading/ writing on an iPhone, but found it practically unusable… too heavy for #2, and the keyboard I got doesn’t really invite touch typing. Also can’t find a “non-industrial” stand that’d SECURELY elevate it 30cm above the table, to come within my focal range… I rigged something up but it’s a dog. I know no people with iPads nearby (only some with Kindles, and they’re generally content with them), so can not try out other keyboards.
But even with that solved, there are aspects of iOS7 (need to update ;-)) that make it unusable: for instance, the Reader(ability) function in MobSafari on which I rely, and which on the iPhone defaults to a nice serif Palatino, on the mini renders in sans-serif Helvetica wannabe. ?WHY? Only SIR Jony Ive, fuck you very much knows. Also, the iOS screen controls in Mail, Photo, etc., that work well on the smartphone, feel under-dimensioned on the tablet.
Wael • October 14, 2015 2:43 PM
@ianf,
Do you use a physical keyboard
I did once upon a time. Didn’t work too well for me. I do see a lot of people using an iPad mini with a thin BT keyboard that also works as a stand. They use it for meeting minutes, emails, browsing, and other office apps such as keynote, etc… I mainly got the iPad to use when I am relaxing or sitting in positions where a keyboard wouldn’t be “comfortable” to use. If you need a keyboard then get a MacBook Air 🙂
Oh, I got the iPad with a SIM (LTE) so I’m always connected — and this is coming from someone who talks about “air-gaps” (not to be confused with a MacBook Air ;)) or as @Clive Robinson cleverly called it “Energy gapping”, forgetting that human interaction with the device also transfers energy, and cosmic sub atomic particles will certainly jump the energy gap and your body as well 🙂
Wael • October 14, 2015 2:45 PM
@Clive Robinson,
You might be one of the first recorded cases of “sleep prodding” a tablet reported, after all somebody has to be first B-)
Be careful! Last time you gave me attributes I ended up spawning a sockpuppet (RIP)!
Clive Robinson • October 14, 2015 3:02 PM
@ ianf, Wael,
SECURELY elevate it 30cm above the table, to come within my focal range… I rigged something up but it’s a dog
Yup those canines can be a both a benifit and a pain. I guess it’s not a pug or Chihuahua as they are only about 15cms, jack russels around 20cm and yorkies about 23cm. Not sure what dog is a foot high though 😉
More seriously I’ve tried netbooks, pads tablets and smart phones. For typing in text on this and other blogs I’ve found only a smart phone is convenient in bed, on the sofa, sitting in a train or bus and “strap hanging”. My experiance really tells me pads and tablets are to big or inconvenient for most places, and best used with a fully detachable keyboard with proper tactile keys that is preferably USB not Bluetooth. The big problem with netbooks is you end up with hunched sholders and neck strain, unless you are considerably more diminuative than a rugby player [1] which I’m not. Which also brings up another issue, on screen keyboards little hands might be able to touch type on them on tablets, –I’ve actually seen a coder with one of the larger Apple offerings have it on his briefcase on his lap on a train and put in a fair turn of speed– but my hands are actually quite a bit bigger than most smart phone screen keyboards and as @ Figureitout will no doubt confirm I’ve had to apologize about the fact I can hit six or eight keys with one finger press after accidentally typing “sexurity” rather than security. Thus I have to “hunt and peck” with the very tip of one finger which is not as fast as I would like.
I actually miss the old Psion organiser 3 I used to have, you could hold it in two hands one at either end and type surprisingly quickly with two thumbs. I used to write a lot of text for reports etc on it and pull off the text into WordStar on a DOS PC and just do the spell checking and rudimentary formatting [2]. I know it sounds strange but I’m old enough to see “Windoze and Orifice” as a distinctly retrograde step (raw text and Latex being a better option).
As for “coding” at one point I had my own custom WordStar dictionaries with all the assembler instructions in them, it was a quick way to save on time, in those late evenings when the brain was still active but the fingers numb and the eyes bleary.
What I would like to try if someone ever comes out with it in a usable form is a sort of half transparent VR headset or up rated Google Glasses, where you can have a keyboard superimposed on any suitable surface and likewise a screen such that you could almost touch type on the air whilst also viewing the equivalent of a 15in screen.
[1] In my younger days when I used to have pretensions of being a “sporty type” and amoungst other things play rugby, most players were smaller than me, and unfortunatly for many not as fast either. At 6’6″ few were as tall and at 258lb most a lot lighter back then. My lady friend of the time used to find it mildly amusing that the measurment round my thigh in inches was the same as her rather nice posterior and that she could easily walk under my outstreched arm without ducking. However what hurt was the price of custom built cycles that I used to have to buy to keep in trim, the food to maintain the bulk and most expensive the tailored trousers and jackets (though Dutch shops of the time did have off the peg that fit).
[2] Maybe it’s me but I find that way to many people waste considerable time on “beautifying text” almost as a displacment activity. Rather than actually concentrating on getting a clear message across in ways people can meaningfully understand. There is a statistic that indicates I might be right in that paper driven office efficiency was greatest back in 1973 at the hight of “typing pools” filled with foot operated Dictaphones and IBM Selectric typewriters and 80-90WPM typists and file clarks that knew what was where and who should and should not have access.
Benni • October 14, 2015 3:06 PM
After it was revealed that the United States have radar bugs in Germany, which they monitor from an antenna on the roof of their embassy in Berlin, the Germans said that they would not do such things themselves. Merkel said, spying among friends is untenable.
We have a user called skeptical on this forum, who wrote on this blog that the germans would have similar installations.
However, BND president Schindler claimed: “Signals intelligence is not collected from the german embassy in Washington”. German politicians said that BND spying on the US would be an outlandish idea because the BND gets its orders from the german chancellory and the US are not in BND’s official target list: http://www.dw.com/de/spionieren-die-deutschen-in-washington/a-17195263
Skeptical somewhere wrote on this blog that the BND president had just excluded one single building….
And now comes this:
Even if it is not in the target list of BND, according to the magazine DER Spiegel, BND illegally spied on a large scale on embassies and other institutions of European partners and the United States of America…..
And now the BND folks have the German parliament investigating them….
tyr • October 14, 2015 3:08 PM
http://blog.slaks.net/2015-10-13/web-authentication-arms-race-a-tale-of-two-security-experts/
Its all about who do you trust and why you should.
MH17
Last I heard it was Ukrainian ATC who changed their altitude into
a warzone. That gave both sides of the conflict a free shot at
MH17. You’d think nation state politics could find better ways
to dick wave without shooting down innocents.
FIFA
So does that make Brazil super duper ?
ADA
I have Pyles book, got it when ADA was the coming language. I never
could figure out how the error recovery chain was supposed to power
up again after a shutdown under software control. I assume that
was dumped as too ambitious as wiser heads prevailed.
Wael • October 14, 2015 3:50 PM
Holly crap! Benni and Rolf on the same page! I’d pay to watch a debate between the two (you know, hanging Germany’s dirty laundry in front of us)
Tale of the tape:
On the right: Benni (the whistle blower) hails from Germany. Blacklisted, zero losses[1]
On the left: Herr Rolf (the snitch) Webber. Also hails from Germany… zero losses too![1]
Ladies and Gentlemen… For the hundreds of bloggers on this site and for the quarter million bashful and silent people around the world… Let’s get ready…
Someone’s “O” must go!
[1] This is just marketing crap. The had better days (they both suffered some losses) 🙂
Benni • October 14, 2015 4:27 PM
The question is, what is the point of bugging someone who knows he is being bugged?
According to Snowden documents Spiegel has seen, BND is on NSA’s target list too:
At BND, they created, by the way, a new group policy in lotus notes… And suddenly, the emails got deleted even if BND was forbidden to delete anything…..
https://netzpolitik.org/2015/live-blog-aus-dem-geheimdienst-untersuchungsausschuss-2/
Here are more liveblogs from the NSA investigation commission, but they nowadays tend to be really long. To read them, one would need an hour or more…
BoppingAround • October 14, 2015 4:47 PM
Clive Robinson,
Maybe it’s me but I find that way to many people waste considerable time on
“beautifying text” almost as a displacment activity
Certainly not only you. A number of teachers, professors and other people in
similar professions do frequently complain about the amount of useless eye-candy
put onto presentations by their students.
But then there are people who nearly demand such embellishments, valuing form
over substance.
Clive Robinson • October 14, 2015 5:56 PM
@ Bruce, and others,
This is the first in a series of articles you are really going to want to keep an eye on for a whole host of reasons, including the fact that it will effect this blog amongst many other issues,
ianf • October 15, 2015 1:17 AM
@ Clive
Your link renders only 3 paras (on iPhone) with a pointer to CIS Daphne Keller’s blog posts and a practically invisible link to its original publication at
This delivers a detailed summary/ commentary on said deliberations (which I’ve yet to read). Summing it up after a first perusal of legalistic mumbo-jumbo, among that author’s premises appears to be equating “Internet” with “American entrenchment of & defense of its sphere of influence in running the Internet;” and another one
At the core of the issue, as Keller notes, the worlds of “privacy protection” and “free speech/ intermediary liability protection” are two separate worlds — and people on both sides don’t seem to realize just how much the two can and do overlap. […]
seems to imply that the hallowed American free speech also covers governmental and others snooping on what we in Europe call privacy: if everyone has that right, then corporations and public bodies must enjoy it, too (and “enjoy” they do.) Or something [my lawyer insists on attaching this disclaimer so I can’t be held to account for decisively stating an opinion based on a quick reading of an intermediary commentator’s commentary of an original blog post by a credited author. So there, happy?]. Good luck in educating us in US Free Speech Hegemon’s ways & means… the slaves are rising.
rgaff • October 15, 2015 2:58 AM
@ ianf
Apparently some people equate “free speech” with a requirement that you must freely incriminate yourself and freely submit to searches of all your personal effects by everyone all the time. Maybe free prison sentences for everyone too, the joys. Sounds like Hitler was a real proponent of this “free speech” thing when you put it that way…
One way to never run afoul of privacy laws is to simply not collect any personal information in the first place, I would assume? (using the real dictionary definition of “collect” of course, not the special NSA version)
Clive Robinson • October 15, 2015 3:52 AM
@ ianf,
Re wrong link a thousand poxes on Googles Chrome… I’m in the process of migrating from one very old Android smartphone to a not quite as old one –hence forth known as the new phone–, and after a factory reset it is refusing to load various software including FireFox for some reason and thus death by a thousand Chrome UI and other “total fails”.
As for the actual article bear withit the EU are updating their privacy legislation and the US Gov is going to find it’s self in the position of being on the receiving end of legislation that applies across it’s entire jurisdiction weather it likes it or not.
It is unclear what the result will be but “Balkanisation of the Internet” is a distinct possibility, along with quite a high likelihood that physical peering will now be done outside of the FiveEyes territory thus removing a very major covert IC advantage they had. It might even force a “Great Firewall of Europe” approach with US companies finding their business models declared illegal and thus banned/blocked. It could also result in some US website owner / operators finding that their freedom to travel is curtailed under fear of arrest / deportation.
There is a great deal of petty mindedness in Europe when it comes to making political points (see current French School Meals behaviour where pork free meals will no longer be an option all in the name of secularism).
The US is detested and loathed by a very significant number of people in Europe. Many politically powerful have the view it’s time the US had it’s wings clipped. For instance the issue of refugees and migrants in Continental Europe is blamed on the UK and US. Which is further stirred up by news about the deaths of what are clearly south american refugees being deported by the US, what is without doubt an illegal act and would be roundly condemned by the US if European countries were to do the same to middle eastern refugees.
Then there is the spying, then the trade agreements, drones, etc etc, the US is far from popular in continental Europe and you will be hard pressed to find anyone who is politically aware who does not think the US is two faced, arrogant and has shot it’s bolt, into it’s own foot. Thus the idea of “pay back time” is an easy sell to those quite happy to jump on it for the political mileage.
As for stories about “The Madness of King Obama” they might be stories, but people find them easy on the ear especially when it comes to political gossip. And as can be seen by the Manning Trove such gossip has a habit of developing a life of it’s own and becoming influential on policy…
ianf • October 15, 2015 4:49 AM
How right you are, rgaff in that “one way to never run afoul of privacy laws is to simply not collect any personal information in the first place.”
I remember a friend, librarian @ BPL, once telling me that, in the wake of some Patriot Act interpretation or other, they had to forgo keeping records of their customers’ title lending histories for fear of being legally obliged to comply with future requests for same. Effectively they’d end up being enlisted in the directionless Orwellian “war on terror” which equates any borrowed book with a potential bullet. This may sound like nothing much, but imagine if some budding Einstein begins her education among their stacks, and future biographers and historians of science will be unable to decipher the road that has led her to THE Wi$dØm because there is no record of what lectures led her there!
Winter • October 15, 2015 5:12 AM
No change in US law, no data transfer deals – German state DPA
Look for non-US alternatives, say Schleswig-Holstein officials
http://www.theregister.co.uk/2015/10/15/data_protection_safe_harbor_schrems_facebook/
Last week, open source CEO Rafael Laguna explained that no business using US infrastructure is now safe from being sued by its European customers.
“When a customer sues me, I go to court and find that agreement isn’t worth a dime. Google cannot guarantee what they’re guaranteeing,” OpenXchange’s Laguna told us.
Curious • October 15, 2015 5:46 AM
Off topic: Re, drones.
It wouldn’t surprise me (I’m no expert though) if rushed legistlation re. drones in US, end up being subject to unforseen consequences in some near future for novel aircraft, if such stuff as below are to be thought of as drones, and not aircraft. Admittedly, I have no knowledge how stuff are classified.
rgaff • October 15, 2015 12:29 PM
@Nick P:
I’d like to thank you for your pointers about products like GenodeOS earlier. That one in particular not only seems to have a good chance at being useful in the near term, but also has quite a good amount of educational material on the web site that is presented in terms even a normal ordinary person can understand.
The hardware solutions you mentioned like CHERI also look good, but not quite ready for prime time to this extent yet (and I’m not spending that much for mere experiments right now). They will be the future once they mature more, I hope…
Please don’t be discouraged just because few seem to care… many do they just don’t know about these kinds of things. So don’t give up spreading the word!
Benni • October 15, 2015 4:05 PM
Intercept has documents from a new whistleblower describing Obama’s drone program
https://theintercept.com/drone-papers
One learns, for example that the drones do not monitor the content but only the metadata, and the operators often learn that they killed the mother of the target, or someone else using the target’s phone
and there is this interview with a drone pilot at the NSA investigation comission. He says that the US government has offered him 190.000$ if he would return to the US and did not make this speech:
He says that the drones need the mobile number and then they look after the IMEI. The drones would not monitor the content but only the metadata. With his sentence “We kill based on metadata”, Hayden would have meant that they only used metadata as the reason for a kill decision.
Asked, if a drone could get its commands from another country than Germany, he says that every drone must receive its signals over Germany, but they are building a new relay in Italy. Satellite connections would be slow and unreliable.
He says that he knows if drones get their signals via satellites, then these satellites are owned by CNN (which certainly gives a new meaning of “embedded journalist”).
He says the drone program has just one aim, to save cost.
“98% of the flights were surveillance, 2% war. An F16 can fly for 4-5hours, then debriefings, everytime, there is something. With drones, somebody sits for 12 hours, six days a week, in an isolated box, watching people, woman who wash their clothes, men laying bombs and then embrace their children, how people have sex on the roof, this is unlovely.”
Then the drone pilot is asked where the US government gets its target data from that is feeded into the search parameters of the drones. He says he does not know, he always thought they would collect this themselves. And then there is this question:
Hahn: “We have learned, that after a certain point, BND delivered faked geodata to the US. Was this known to you?”
Bryant: “No, I know nothing of this. This is new for me”
Hahn: “If you did not know anything of that, could it be that they are targeting the wrong people?”
Bryant: “If this is the case, then yes. Is a problem with the system. It depends on trust. We have seen that there is no reason for trust.”
The taliban probably do this too…
Simply switch the phone on and throw it on the roof of some enemy house at night… Out of stupidity, American drones only collect metadata. They do not get the content of the transmission or who is calling, so the drones can not know who is using that phone…..
Joe K • October 15, 2015 4:29 PM
Clive’s reminiscences of rugby days reminds me of a passage from
Flann O’Brien’s At Swim-Two-Birds.
A brief excerpt:
Recount then for the love of God, said Conin, the Tale of the Enchanted
Fort of the Sally Tree or give shanachy’s tidings of the Little Brawl
at Allen.They go above me and around me and through me, said Finn. It is true
that I cannot make them.Oh then, said Conan, the story of the Churl in the Puce Great-coat.
Evil story for telling, that, said Finn, and though itself I can make
it, it is surely true that I will not recount it. It is a crooked and
dishonourable story that tells how Finn spoke honey-words and
peace-words to a stranger who came seeking the high-rule and the
high-rent of this kingdom and saying that he would play the sorrow of
death and small-life on the lot of us in one single day if his wish was
not given. Surely I have never heard (nor have I seen) a man come with
high-deed the like of that to Erin that there was not found for him a
man of his own equality. Who has heard honey-talk from Finn before
strangers, Finn that is wind-quick, Finn that is a better man than God?
Or who has seen the like of Finn or seen the living semblance of him
standing in the world, Finn that could best God at ball-throw or
wrestling or pig-trailing or at the honeyed discourse of sweet Irish
with jewels and gold for bards, or at the listening of distant harpers
in a black hole at evening? Or where is the living human man who could
beat Finn at the making of generous cheese, at the spearing of ganders,
at the magic of thumb-suck, at the shaving of hog-hair, or at the
unleashing of long hounds from a golden thong in the full chase,
sweet-fingered corn-yellow Finn, Finn that could carry an armed host
from Almha to Slieve Luachra in the craw of his gut-hung knickers.
Benni • October 15, 2015 5:01 PM
BND has, in hundreds of cases, tapped the phones of american politicians:
Especially American foreign and defense ministers, and senators. BND’s interest on the Americans only grew during the Iraq war under Georg. W. Bush.
After Merkel’s word, spying on friends is untenable, BND temporarily stopped this and tried to delete the selectors. They also ordered not to use such intercepts. In march 2015, BND president relaxed this order. Now intercepts from friends can be used again…..
John Galt IV • October 15, 2015 5:13 PM
in the afternoon news feed, a couple of gems
https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
https://weakdh.org/imperfect-forward-secrecy.pdf
from the usual spot
http://www.nakedcapitalism.com/2015/10/200pm-water-cooler-10152015.html
ianf • October 15, 2015 5:16 PM
@ benni […] “Out of stupidity, American drones only collect metadata. They do not get the content of the transmission or who is calling, so the drones can not know who is using that phone.”
Not stupidity, p.o.s.s.i.b.i.l.i.t.y. First of all they are VERBOTEN HALT! to listen to the content of conversations, exactly what Hayden said ;-)) But even if they weren’t, where do you suppose they could get instantaneous concurrent translations and target evaluations from eavesdropped conversations conducted in umpteen regional dialects of truly foreign tongues like Dari and Pashto?
Benni • October 15, 2015 5:39 PM
@ianf: weaponized drones are not deployed in the US. They use FBI airplanes for domestic metadata collection.
So on foreign ground, there is nothing that would prevent the drone operators legally to listen to the conversations. They even could get an authorization to decrypt all this from the governments in Afghanistan and other countries they are working in, if they are saying they are after taliban or the IS.
The translations are usually done by software, which transcribes it first to a text file and then translates. For this kind of translations, CIA had acquired many employees of the former BND front company learnout and hauspy long ago.
And yes, this translation is done almost instantaneous. And it is certainly sufficient to detect who is on the phone, after they follow somebody for one week….
The only reason they do not look at the content data before pressing the kill button is that they are stupid and lazy.
rgaff • October 15, 2015 6:27 PM
No, it’s cause US Government is to lazy to read the transcripts of the calls of the taliban, but they’ll filter and search the transcripts of all Americans, and read any that match certain keywords…. (yeah, don’t kid yourself, when Obama said “nobody is listening to your calls” he meant only with literal ears, reading all the transcripts of your calls is ok by him…)
Sancho_P • October 15, 2015 6:42 PM
@CallMeLateForSupper
”You don’t have to use the frickin’ M$ stuff. Take a deep breath; wipe the HD; install a real OS.”
Um, and in more than 20 years nobody told you how poor that arguing is?
You should avoid that in public.
Look, I already did that several times in my life ( – not the new generation).
Yes, I’ve paid Bill Gates for something that I didn’t want,
and instead I’m using software for nada, written by enthusiasts (I confess: Fan of R. Stallman).
Probably I’m old fashioned but I feel bad by paying legal criminals who laugh at the people fighting for freedom and working for free.
In capitalism you could vote with your bucks, in a totalitarian system you can’t.
Benni • October 15, 2015 7:16 PM
@rgaff:
“No, it’s cause US Government is to lazy to read the transcripts of the calls of the taliban,”
Indeed, it could be that their analysts are too busy since they are working on something else. For example, they probably read the content of surveillance data that BND delivers to them at its site in Bad Aibling. How did a BND spook reveal recently at the german parliament during the interrogation:
https://netzpolitik.org/2015/live-blog-aus-dem-geheimdienst-untersuchungsausschuss-2/
“We once had “bomb” in our selector list, but this was a mistake since it also collected every use of the word “sexbomb”….
ianf • October 15, 2015 7:21 PM
@ Wael got the iPad mini with a SIM (LTE) so he’s always connected — despite talking of “air-gaps”
That’s OK, over here those models can only be gotten from a mobile carrier, and one has to sign, or transfer, a contract, so a truly anonymous ownership is not possible (not sure if newer factory unlocked iPhones can be bought for cash in Apple stores [cameras!]). Let’s see if you can find logick holes in this my reasoning:
Assume I’ve set up an unattributable tablet to be used apart from my otherwise public net.presence. The air-gaping is important, but, for a truly secure scenario, I also need to think of space- and time-gaping.
Specifically, even if the device
Needless to say, before I even start using the mobile device, I’d have already
Lastly, the need to
Any… thoughtlets?
Benni • October 15, 2015 7:37 PM
The BND agent who was responsible of acquiring data from refugees says she can’t remember whether BND delivered phone numbers to NSA. The NSA investigation commission came close to make her pay money for this wrong statement or to lock her up. They decided to invite her a second time…
interesting is that she claims her front company would have been closed soon after it was revealed by the press that the phone numbers could lead to drone kills. And she says that CIA agents are not allowed anymore to interrogate refugees personally on behalf of the BND.
Then, she is asked whether BND continues to interrogate refugees by other front companies. This question is interrupted by a lawyer, who claims that this would be outside the scope of the NSA investigation commission….
So one has to assume that BND continues to interrogate refugees and gives the phone numbers to the Americans, just under another program name…..
Like in this stupid Bourne movie: “Operation threadstone was closed long ago. blackbriar is a similar program that was created after threadstone……”
By the way, if you are in Afghanistan, 12 years old and male, you are a legitimate drone target, according to the drone pilot at the German parliament.
Benni • October 15, 2015 8:42 PM
On friday, the german parliament will pass a law that will force telecommunication companies to collect and save metadata of all their clients.
Only metadata? Well, Deutsche Telekom, Vodafone, Telefónica say that unfortunately there does not exist a solution that could remove the content from SMS data, so they save all SMS content together with metadata….
http://www.n-tv.de/politik/Vorratsdatenspeicherung-erfasst-SMS-Inhalte-article16149326.html
CarpetFish • October 15, 2015 9:14 PM
@Benni
What happened? I had such high hopes for Deustchland. The commissions, the hearings, the investigations! And now the law changes, just like the USA here comes the ex post facto….
Wael • October 15, 2015 10:52 PM
@ianf,
Assume I’ve set up an unattributable tablet […] Any thoughtlets?
Thoughtlets, eh? Good thing you inserted a ‘t’ before the ‘s’ and removed the additional ‘s’ at the end… 😉 Had this sentence come from @Clive Robinson, I would have thought he misspelled the “word”. Anyway here goes…
First of all, what’s your objective of such level of “privacy”? If it were me, I would only go to this level of protection if I’m working on a project so disruptive that I want to make sure no one steals the idea and implements it before I do (which has happened to me half a dozen times at least — yup, I’m humble; I’m the most humble person in this quadrant of the world ;)) I believe no matter what you do you’ll get caught if you become a target or a “person of interest”, hence my previous advice of “avoid being a target”. Easy to say, hard to do, right? But to improve your chances of hiding in the background noise, you’ll need to add the following to your “logic”:
These are just a few “OPSEC” procedures, and I am sure we can add at least a 100 more — don’t quiz me 😉
At the end of the day, you’ll get busted if you do something that threatens national security (like surfing for porn.) You’ll also need to factor-in the unadvertised device capabilities, and this isn’t an exhaustive list, even though I enumerated them in a “funny” manner (for those of you who have have a slight sense of humor.)[2]
What in the world are you trying to hide? We live in a world that is “free”; the ultimate freedom: you are free to say whatever you want, and governments are free to do whatever they want to you. What are you scared of?
[1] Pray silently and make sure you are wearing a tinfoil hat, or better yet wear a freakin’ salad bowl just to be sure. Also make sure your disguise doesn’t make you look like the person in the picture! He looks “Libyan”, and probably fits a “profile” — choose your disguise wisely, this is a critical part of applying the principle “avoid being a target”!
[2] Pay close attention to this list; it isn’t a joke. For example, if you pair your “fort-Knox-super-secure” device to a BT headset that you previously paired with your “other” device, then you’re screwed. Apply this logic to the rest of the list.
Wael • October 15, 2015 11:38 PM
@Benni,
Vodafone, Telefónica say that unfortunately there does not exist a solution that could remove the content from SMS data, so they save all SMS content together with metadata….
Oh man! That statement pegged the bovine excrement meter! One only has to look at the phone bill to see the “metadata” which doesn’t contain the body of SMSs!!!
Figureitout • October 16, 2015 12:38 AM
Clive Robinson
I’ve had to apologize about the fact I can hit six or eight keys with one finger press
–Yep I said you were typing w/ your “third arm”; there’s your dirty joke for ya, happy ya british c*nt? Salty enough for ya? :p But seriously you said it was some kind of “OCD-ish” behavior meant to deter frequency analysis even if they got the plaintext perhaps or a layer just above it, a usual first method of cryptanalysis taught/learned. It’ll catch you if you get lazy I suppose…(aka living a normal life not worrying about frequency analysis…).
So you can’t see any immediate holes w/ my physical intrusion setup besides the obvious ones no one has solved (ahem if it was a new target and you didn’t know what surveillance they had) that it would catch basically a known attacker (you suspect something and set a trap basically). I spotted errors already that I said wrong but it’ll be fixed and then come the unexpected bugs.
Something else to chew on if you’re bored. Simple RF shield idea, so you have the chip on a board w/ external ground planes on each side that act as a shield, then cover the wifi SoC w/ 1 square metal piece that has holes on its corners, but then a separate one that again has holes in its corners that are opposite of the inner layer, that cover opposite corners of the first one. Then some little piece on top made of plastic or some insulator that makes a little area for the shields to not touch but both have basically perpendicular angles and if their both grounded the only way in is higher frequency, right?
Or backwards from the antenna, an LED was supposed to be a diode but takes in ~1.3V at a very low current on a little LED flashlight. It’d be a waste of my time trying to solve such a hard problem…if that’s a legitimate attack that can be stopped.
Benni • October 16, 2015 6:33 AM
@wael: yes telekom says that the content would be masked for employees. But for sms the content is sent in the same string as the metadata. So they save both.
The scary thing is: telekom has a daughter called t-mobile in the us. If telekom says a technical solution for separating meta and content data in smd does not exist the “metadata” means probably sms content in the united states too.
I do not recall if anybody has asked nsa what they mean when they say they collect “metadata” of sms
Wael • October 16, 2015 6:39 AM
@Benni,
“metadata” means probably sms content in the united states too.
Metadata = source + destination + time + 160 characters 🙂
Benni • October 16, 2015 11:11 AM
@Wael: That indeed would explain strange things like this:
http://www.heise.de/ct/ausgabe/2013-16-Wie-digitale-Kommunikation-belauscht-wird-2317919.html
Canadian marketing guy, muslim and of Morrocan descent, sends to his colleagues an sms. He tells them that they should “blow up their competition”. His coworkers recieved the sms when they went to an exhibition in the united states…
The next day, Canadian police stormed the house of the sender, accusing him of being a terrorist..
That makes only sense if “metadata” in US/NSA terminology includes sms content….
Note that Obama said “nobody is listening to your calls”. He did not say “nobody is reading, transcribing, translating, saving… your sms”… Probably they deduced that reading transcripts of all phonecalls would be too much for them and sms are deemed sufficient to find people who want to meet and lay a bomb….
rgaff • October 16, 2015 11:28 AM
In the US, “metadata” also includes a FULL TEXT TRANSCRIPT of the phone call content…. remember, they promised they’re not “listening” to it, they didn’t say anything about “reading” it…
CallMeLateForSupper • October 16, 2015 11:57 AM
@Sancho_P
@CallMeLateForSupper
”You don’t have to use the frickin’ M$ stuff. Take a deep breath; wipe
the HD; install a real OS.”
“Um, and in more than 20 years nobody told you how poor that arguing is?”
Oh yes, I certainly got push-back, nearly every time. A few persons eventually swallowed their fears and let go of the M$ “anchor”. My argument was and is, if there is an alternative to a thing you hate, why not try the alternative?
I abandoned[1] Windows a-wayyyy back when it was a 16-bit DOS shell (v3.2), because it was unstable, handled RAM poorly, did not support large disk partitions, and was not pre-emptive (yada-yada… plus other reasons).
Hello, OS/2 v3.0, in 1994. I still like and use OS/2 today. But that OS/2 does not support networking, so…
In ~2005 I built a second machine and installed eCommStation (post-IBM OS/2), which did support networking. Eventually the hit-or-miss driver support became a problem that I could not ignore, so…
In ~2008 I bought a new HD and installed Mandriva, a Linux. Since that time I have lived with several versions of Mageia (Mandriva successor), Kubunto and Ubuntu. And I boot Tails (from DVD) whenever the urge to be disruptive and contrary overpowers me.
When something doesn’t work out, try something else that might. When a thing does work, hang on to it like grim death.
[1] Not strictly true. I fire up the game Myst every 2-3 years.
Wael • October 16, 2015 12:05 PM
@Benni, @rgaff,
He did not say “nobody is reading, transcribing, translating, saving… your sms”
Politicians speak a different language. I wouldn’t put it past them to hire a person called “Nobody” then claim that “Nobody” is reading SMS and listening to phone calls — every one else is reading and listening, but “Nobody” isn’t 😉 I think slick Bill Clinton made some advancement in this field that were quickly learnt and adopted.
CallMeLateForSupper • October 16, 2015 12:52 PM
@Wael
“[…] I wouldn’t put it past them to hire a person called ‘Nobody’ then claim that ‘Nobody’ is reading SMS and listening to phone calls…”
Unless I am mistaken, “Who” is the poor schmuck who reads SMS. 😉
@all
(Hat tip to Clive) “As I have said previously in this blog and elsewhere”: Words matter; punctuation matters; syntax matters.
I’d like to thank you all for your kind attention… but I won’t. Lunch dishes beckon from yon sink.
rgaff • October 16, 2015 1:07 PM
Who’s on first? 🙂
Wael • October 16, 2015 1:27 PM
@CallMeLateForSupper,
Words matter; punctuation matter…
Right! Capitalization also matters (for example ‘god vs. ‘God’.) Your name can be understood in many ways, which one is it?
PS: Punctuation is not my strongest point. But I remember that “(xxxx.)” is correct and “(xxxx).” Is incorrect. The period marking the end of the sentence should come before the closing parentheses.)
And who’s the sorry bastard who listens, transcribes, and translates phone calls?
tyr • October 16, 2015 5:10 PM
@Wael
I’ll continue to do this one wrong, but add a corrected
version to soothe your sensibilities. Actually I should
dump the paren’ed enclusions (adopt a more linear style)
but that would ruin the stream of consciousness with its
divergences. On the other hand if you read earlier werkes
in anglish ye’ll lack a care about setch matters of high
import. Silly strictures only make sense to those who
police such things. Software on the other hand dislikes
misplaced parens and will do strange things because of
such disgressions from the one true path.
Wael • October 16, 2015 5:51 PM
@tyr,
No worries, I’m guilty of the same. Come to think of it, I don’t think any statement I wrote here is unassailable by a high school English grammar teacher (including this double negative.) Also, parentheses aren’t needed. They say any statement can be properly constructed without the use of parentheses. Parentheses make statements less “eloquent” (but I use them nonetheless.)
On a related subject, I’m curious what type of device you are using to post here. Your posts contain extraneous line breaks on my iPhone, but look ok on my iPad. Are you copying and pasting from an editor? Or are you using some sort of steganography? 🙂
And my opinion is the rule about the period and closing parentheses looks wrong. Certainly “).” looks a lot better than “.)”, but who am I to say?
Nick P • October 16, 2015 6:49 PM
@ Wael
“Come to think of it, I don’t think any statement I wrote here is unassailable by a high school English grammar teacher (including this double negative.)”
Exactly! Too many non-English-speaking, grammar nazi’s these days…
Sancho_P • October 16, 2015 7:14 PM
@CallMeLateForSupper
Well, you may still dream of the good old times, but sorry, they are gone.
Reality is different.
Modern machines (I bought two this week) won’t even boot anything else as M$fia without changing BIOS settings.
Think of the average user trying to boot Linux from CD / DVD.
Add a couple of months and changing BIOS to “other” may be impossible with main stream / standard PCs.
So when people push back “nearly every time” check if your thinking might be incomplete.
Now reformed bong chugging hersuit primate • October 17, 2015 9:28 AM
Wael…
Above you wrote “I wrote here” in archetypal Amerinish, it would be an improvement to have instead written “I have written here”.
Though the question which arises from this observation is, “Are you aware of why?”.
CallMeLateForSupper • October 17, 2015 2:10 PM
@Sancho_P
“So when people push back “nearly every time” check if your thinking might be incomplete.”
Noted.
Wael • October 17, 2015 11:20 PM
@Now reformed bong chugging hersuit primate,
Above you wrote “I wrote here” […] an improvement to have instead written “I have written here” […] Are you aware of why?
Depends on what I meant. In this case you are correct and the difference is: past vs. past perfect
ianf • October 18, 2015 8:00 AM
Teaching old dogs new tricks
@ Clive, talking ergonomics (cc: Wael)
tablets are best used with a fully detachable keyboard with proper tactile keys that is preferably USB not Bluetooth.
There are now 2 wired keyboards for the iPad (30 pin + 8 pin Lightning—internally USB?), neither available for inspection over [my] counter:
• Logitech [US$59], designed for classroom use, hence presumably somewhat robust…
• the more interesting of the two, but priced out of this world aluminum Apple-keyboard-like one, [US$69, but $120 when shipped to EU] [4m video: youtu.be/ikuzxJvw6FQ].
I will wait for the (alas BT, I presume) Apple Smart iPad Pro keyboard to appear later this year, then decide. The fact that the UK page mentions only US layout probably means that it can be remapped in the Settings. Wonder if the wired ones talk to iOS directly, or via a driver (hence also a remapping) app.
The big problem with netbooks is you end up with hunched sholders and neck strain
That’s what I’m trying to prevent with my DIY high-rise stand for the iPad. Maybe it’d be easier to just get a stuffed dog in a flea market, and mount an iPad holder in its gap? (Also a conversation piece unlike present Meccano-like set.) I can’t believe I’m the only one who’d like to have a tablet WHERE I CAN SEE THE TEXT, not where statistics-based product specifiers say I should be able to.
[…] rudimentary formatting. I see “Windoze and Orifice” as a distinctly retrograde step (raw text and Latex being a better option).
For writing down, composing text, absolutely. But please do not confuse barebones HTML screen formatting for the web with what was once called “desktop publishing” – the go-wild rich-text excesses. Fortunately, that passed. Provided we’re talking of the same thing, that which both your “beautifying text”, and BoppingAround‘s “embellishments” laments cover.
If taken to its logical conclusion, one way to read it, however, is that you’d be quite happy with, if not overjoyedwithlinguacontinuaorthewayrealmenthatismonksinmedevalabbeysusedtowritetheirHolyBooksbeforeinterpunctionwasinvented. NowReadThatInSomewhaEmbellishedStare: overjoyedwithlinguacontinuaorthewayrealmenthatismonksinmedievalabbeysusedtowritetheirHolyBooksbeforeinterpunctionwasinvented.
I was going to dump a stack of references to info-ergonomic studies of legibility of text on you, but then I realized that the freshest of them were >20y old, and thus automatically suspect… sigh of the times.
What I am talking about is recognizing the need to vary otherwise by and large monotonous screen text for wider readership (it’s a fine art to do this right, easily overdone).
You may find plain text
easy to read and optimal
because you wrote it, but,
if the intent is to convey it
to unknown other readers,
you’d better make sure
that it’s not yet another
graphically & spatially
indistinguishable text
column (YAG&SITC).
Wael • October 18, 2015 12:54 PM
@ianf,
I will wait for the (alas BT, I presume) Apple Smart iPad Pro keyboard to appear later this year, then decide.
Not Bluetooth, it uses a “smart connector” that’s available on the iPad pro. So you’ll need to save more money!
ianf • October 19, 2015 6:27 AM
@ Wael,
… would only go to this level of protection if I’m working on a project so disruptive that I want to make sure no one steals the idea and implements it before I do (which has happened to me half a dozen times at least)
For the sake of this discussion, assume I have THE KEY to dethrone PDF as a screen medium (NOT the finite print page size description ditto for which it’s been designed), and Adobe folks are sweating hard in their Depends. Because they (must have) evaluated it years ago, but then suppressed it for PDF-saturation reasons.
[…] To improve your chances of hiding in the background noise, you’ll need to add the following to your “logic”
1. Whomever you correspond with needs to be at the same security/trust level
I’m a lone-wolf dabbler in that, the unattributed device is to keep up with available research (often research about research) in the field without attracting undue potential attention (I know for a fact that there are honeypot papers in obscure scientific repositories). For that reason alone I’d be rotating accesses from a number of iPad browsers, all of which (I hope) maintain their own cookies – or else wipe them in toto after some sessions for a blank slate state (am I a poet or am I not a poet is the question).
2. You need to add a few levels of indirection between the device you purchase and yourself.
Have not attempted it, but there are quite a few eBay/equiv. ads of type “for sale: shrink-wrapped item X, unwanted prize in a lottery.” For delivery mano-al-mano in a shopping mall or similar safe crowded place. Main problem where iPads are concerned, is they’re usually the lowest-spec models, and it still could be a scam. So buying barely used one that works (and is cheaper still) might be a better option PROVIDED I can surreptitiously cover the front-facing camera during the buy phase (having practiced close-up inspection of a live unit, I know how to do it in controlled circumstances ;-)).
3. You need to disable services and unneeded sensors on the device to reduce the chances of “sensor finger printing”
Does an iPad in Airplane mode & no BT, used for reading offline PDFs and ebooks, still leak (or saves up for shedding later) some device information? Of course I’d stay away from the fingerprint login, and stuff cotton wool in its sensory orifices.
What in the world are you trying to hide? What are you scared of?
It was all hypothetical, remember? DIY OPSEC rules. Else I could tell you, but then you’d have to carry the burden of knowledge, too—not a bargain! Better you stay ignorant (you’ll thank me later).
Pray silently and (…) wear a freakin’ salad bowl just to be sure.
Atheists do not pray, we know that prayer doesn’t work. And a salad bowl on head could easily be mistaken for a colander, which is the prescribed sacred headdress of the FSM religion – neither that me bowl of tea!
RE: iPad Pro Smart Keyboard hardware connector
Bugger that, first they copycat the MS Surface cover-keyboard combo… Steve Jobs must be livid, berating self for letting things go this far, the present lot clearly being unable to bend reality to his wishes. Then they make it specific for just this latest model, which is of a bigger screen size than their two smallest MacBooks—how long will they now live. Let’s hope follows it up with an 8 pin Lightning unit as well.
ianf • October 19, 2015 8:07 AM
@ Benni […] “The only reason [US military drone operators] do not look at the content data before pressing the kill button is that they are stupid and lazy.”
From this I infer, that you’re in agreement with the USAAF doctrine of remote executions-by-drone, and that your main beef with that is the ineffectiveness of it, human “collateral damage” rather than the intended targets, all due to the armchair pilots’ laziness AND stupidity (not even either–or, both!)
The translations [from regional dialects of Dari, Pashto, Whathaveu] are usually done by software, which transcribes it first to a text file and then translates… it is done almost instantaneously. And it is certainly sufficient to detect who is on the phone, after they follow somebody for one week….
One of us is dreaming… of arabic-and-iranian-dialect-voice-to-software-decoding-to-transcription-to-machine-translation-to-print-to-humint-evaluation-in-near-real-time, all thanks to your “ex-BND front company learnout and hauspy” linguistic übercompetence.
Listen carefully, I shall only repeat it once, while there now are millions of native speakers from these areas in Western countries, you think they all flock to, or are welcomed by, the CIA’s etc Language Intel Labs? There are never enough school teachers of these marginal languages for 2nd gen. emigrant children in Europe, don’t tell me that that’s because they’ve all been scoped by the ICs to work as telephone-intercept Mechanical Turks.
Wael • October 19, 2015 12:02 PM
@ianf,
Of course I’d stay away from the fingerprint login
Device fingerprinting has nothing to do with “biometrics”. It’s technology that allows characterization and identification of devices based on unique properties of the device or any of its sensors. There is also research on user identification through walking style, typing style, etc.., several topics in this area were brought up on this blog.
Athiests don’t pray? Put them under the proper level of stress and calamity and they will! I have seen it first hand 😉 no comments on the”colander” headgear. Just amusing!
tyr • October 22, 2015 9:25 PM
OT:
This one is about AI speculations.
http://www.reasoned.org/dir/lit/matter_and_memory.pdf
At about page 11 I began thinking that is why most
current AI research needs to read this. A machine
version of intelligence would be a react on the basis
of current environmental inputs. By adding a specific
selection of memories to a Brooks Heresy model mind
you can get a lot further towards imitating what a
meat mind does.
external input >modular block function >next stage
^
block storage memories past
This gives you a basic bio emulator block that you
can use to build your capability depending on what you
want to achieve. One other nice advantage, since we’re
not using meat, the block memory storage can be
re-programmed from an external port which isn’t part
of the system. We have to have it all internalized or
laboriously learned to change.
I have a sneaking suspicion this is the correct model
for a nerve cell but haven’t run across a specific tie
of memory internal to the nerve cells yet. The alternatives
are far too woo-woo for my likes.
Some have said the brain is a radio that picks up signals
from elsewhere. Until I see the elsewhere evidence that
doesn’t make the cut… : ^ )
tyr • October 22, 2015 9:32 PM
Shift the single up caret to the center.
WYSIWYG made a lot of sense in the stone age
of comp whizzery !!
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Matt • October 8, 2015 5:33 PM
Today is Thursday, Bruce.