Schneier on Security

Clive Robinson • May 28, 2016 7:50 AM

@ Thoth,

The Oracle -v- Google case has always been one of “being burnt by the devil -v- drowed by the deep blue sea”. That is it did notmatter which side won the result over all would be bad, thus the question of the lesser two evils arose yet again with the attempted balkanisation of software stacks.

You should note that ARS clearly say that the opinions in the Op-Ed were not their’s but that of a Legal Mouth Piece of the unvictorious plaintive Oracle. So there is a degree of sangfroid from her as she can see a likely internal political backlash in Oracle with potentialy her position at stake.

Oracle were upto a quite underhand trick, reminiscent of Microsoft’s attack on FOSS by encoraging SCO to falsely claim infringment by Linux against SCO’s version of Unix derived via Microsoft licencing from Xenix and AT&T’s divested Unix System’s Laboratory which had been bought by Novell and inturn divested to Ray Norder’s Caldera Systems.

As we now know for all MS’s claims of FOSS being “communist” “cancer” they have now to a certain extent embraced it. Thus the question of MS intentions arises, in the past they have “embraced the free and proprietaly extended it” to force market splitting (funniley against Sun’s Java).

Thus Oracle’s manovering with Java has backfired against Google, where as Sun succeeded against Microsoft. Which kind of ask’s question’s of Oracle’s legal staff’s competance…

The simple answer about the case is not only is the deciding line wavey on this issue, there is a pendulum of opinion swinging too and fro as well making the whole thing into a crap shoot. Which we have seen play out in other areas such as the shape of the Apple iPhone and many other features used by market heavy weights to manipulate the market in their favour when faced with more agile competition entrants.

Whilst I would not try to predict how this plays out, the odds are it will not become a black swan issue and will just play out with minor issues down the line. Issues that in all probability will actualy give more conservative behaviour, which in turn will improve the quality of work by making bounderies more distinct and thus less fragile. For example any one else remember Win3 MfC and the hidden calls “competative advantage” tricks, traps and pitfalls and the detrimental behaviour it had on programmers, by making the secretive and generaly bad news to their peers?

Clive Robinson • May 28, 2016 4:05 PM

@ Dan3264,

How well would Chua’s circuit work as a random number generator?

Depends on your definition of “random”. As for “according to wikipedia it never repeates” That is probably not true again depending on what they mean by “never” and “repeats”.

When you measure the voltage at any point in a circuit you have to remember that your instrument has resolution limits and all “real” circuit components contain a resistive component that generates noise. The result is you end up not with an infinitely variable vector but a granular one. Thus the vector is effectivly bound to one of a limited number of amplitudes at any point in direction, and the difference between the previous current and next measurments are likewise granular and limited in the rate of change due to the maximum frequency of the effective oscillator. But even at no change of the vector there will be a noise component added to the oscilator output. In theory –but not of necessity practice– this noise signal will be uncorrelated to the oscilator signal as it’s thermal noise (KTBR noise). However the negative resistance in the circuit that keeps it oscillating is based on semiconductors and these have the effect of being very susceptable to the thermal noise and thus the output signal is not the addition of the two signals but their multiple, which means the oscillator frequency gets changed by the noise in the form of phase advancing and retarding.

The upshot of all this is in practice it does not matter if the circuit does produce a chaotic oscillator with infinitely variable output or not, the multiplication by the KTBR noise will ensure it is. The thing is unlike an ordinary oscillator that tends to either stability or rail smashing with the noise having a very minor effect (except at startup). A chaotic oscillator sufferes from “the butterfly’s wings issue” in that it’s output is very sensitive to the input so it is very sensitive to the KTBR noise.

Which brings us back to the “what you mean by random” issue. The output from the circuit is quite predictable over a short period of time (as are most attractors or chaotic circuits). It’s only after several cycles that it’s sensitivity to initial conditions etc makes it difficult to predict it’s output.

Unfortunately it’s this sensitivity that will enable it to lock to very small signals, thus removing the bulk of what you would consider random… So from that point of view it’s not going to make a very good random source by most definitions.

But there is another issue, “synchronicity”. Put simply if you start two similar pendulums they tend to not swing at their natural frequencies but fall into lockstep at a frequency inbetween. It is very likely that if you built two such circuits and ran them with a common ground or powersupply or within each others effective coupling fields that they would exhibit some form of correlation at their outputs.

I hope that gives you some things to consider before building / relying on such circuits.

Clive Robinson • May 29, 2016 4:17 AM

A Primer on Internet Structure

A nice little primer on the hidden “in the physical layer” structure of the internet,

http://arstechnica.com/information-technology/2016/05/how-the-internet-works-submarine-cables-data-centres-last-mile/

Importantly from a High Level / State surveillance perspective it shows where the “physical” choke points are where the likes of the FiveEyes+ etc add their data taps. And consiquently why the likes of TOR do not work as well as people think they should.

It also shows you where some nations have probably “mined” cables, such they can easily cut them in times of conflict (see what attacking the South China Seas, Western English Channel and West US seaboard nodes would effect).

Clive Robinson • May 29, 2016 6:21 AM

@ Who?,

This change in law is critical for parts that are not under our control, like firmware.

In Europe and other parts of the world there is already legislation that could be used to do this.

Take a close look at the Waste Electrical and Electronic Equipment (WEEE) directives. There are parts of it consumer electronics manufacturers (especially phones) are either ignoring or quite deliberatly avoiding. It would only take one well aimed court case to bring the mobile phone market to a massive grinding halt, followed by a significant re-evaluation and re-orientation. It’s the sort of shake up everyone –except a tiny few technologists- does not want to happen, thus their fingers are crossed and they look in other directions.

Clive Robinson • May 29, 2016 12:56 PM

@ Grahut,

Marbugh, has a rather interesting University, the oldest in the Western World.

Whilst it is well known for science, it also has a strong “social sciences” repitation as well. Less well known is it’s closely affiliated maths and computer science departments. It also has a curious political dept involved with “middle east” studies.

Could be total coincidence, but then again not. I suspect that quite a few comp sci bods see “easy money” for communications research that is discrete to the point of secret. Especially when it comes to “well healed” government agencies.

As we now know in the US the FBI amongst others were quite happy to throw several million USD at Uni research that was kept oh so discrete…

Clive Robinson • May 30, 2016 6:29 AM

@ Confused,

I don’t have any idea about the intricacies of the economics/mathematics behind this anomaly, but that’s what it seems like: an anomalous event…

I’m not sure anyone has a good grip on the mathmatics of climate dynamics. However it was if you want to call it an anomaly regionaly localised in an area with low population but high overhead flight traffic. The argument was that the contrails of the aircraft caused energy to be reflected back into space and thus not reach the earths surface below (clouds have a similar effect). It’s been part of the argument about engineering solutions to global warming.

A paper[1] published in the Journal Nature by David Travis and his team at the University of Wisconsin made the necessary measurements, crunched the data for a nine day period of the three days befor the groundings, the three days of the groundings and the three days after the groundings.

You can read a more ordinary human friendly piece on the contrail effect,

http://www.pbs.org/wgbh/nova/space/contrail-effect.html

[1] http://facstaff.uww.edu/travisd/pdf/jetcontrailsrecentresearch.pdf

Clive Robinson • May 30, 2016 7:10 AM

@ Sidd,

The figures for the solar energy reaching the earths surface are disputed in many ways.

Whilst we know fairly accurately how much energy from the sun hits the face of the earth facing the sun it’s disputed as to how much of it in a usable form actually gets to the surface and not reflected by water vapour, stored and reradiated at a different frequency a short time later etc. Further the energy usage figures are a bit of a fudge as well as they largely do not include bio-mass consumption that would in time become new foissil fuels due to incineration of waste from food production etc, etc.

Which is why one measure of energy consumption is by changes in green house gasses ratios such as water, carbon dioxide methane etc.

It’s these changes that indicate the excess usage of foissil fuel and bio-mass energy, and why we are consuming it at a rate of around four times greater than the earth is locking it up to become new foissil fuels.

But the real issue is how do we get usable solar energy. less than one percent of the energy from the sun can be captured in a useful form to replace foissil fuel usage. It is either to diffuse or of the wrong wavelength for the likes of PV collection and we can only devote a small area of land away from it’s other uses such as for food production. Which is the problem we need high energy density at the point of collection/convertion to make it viable and we don’t get that with solar energy.

Whilst plants are more effective at utilizing solar energy have a look at what percentage of the worlds usable farm land would be needed to create bio-fuel just to run US SUV’s for a year, then do the math for the rest of the US energy consumption.

But there is another problem and that is losses due to energy transmission. It does not matter how you do it moving energy is very inefficient overall and where solar energy would be exploitable is vast distances from where it would be consumed and depending on how you mrasure it anything upto 50% of the collected/converted energy would be lost to transmission over it’s usable life time. It’s why Chinese made PV pannel usage in germany shows a greater carbon footprint overall than burning coal dug out of the ground in Germany and used in high efficiency CHP systems…

Clive Robinson • May 31, 2016 3:48 AM

@ Guessing,

It makes a certain amount of sense to me, but I still have difficulties reconciling that with other research…

From my perspective, the best solution is to stop producing the green house gasses in the quantities we are. And if possible look at natural solutions to resolve the current excess as quickly as we can.

However there is a thorn in the issue not just of what “natural” may be but what other effects it might actually have. Part of the problem is people not differentiating between “Global Warming” and “Climate Change”. The latter is what will kill us, the former is just one of many ways our early demise might happen.

The next issue is one of time and tipping points. As the climate changes, species of flora and fauna migrate, and those that can not migrate in time or at all either die out or mutate. Thus at some point you can not go back to what you had before, you have crossed a tipping point, whether that is good or bad is something of a viewpoint, personally I’m siding with bad. The secondary issue is that there are very many species that are intetconnected and they all have different tipping points, which will not show up immediately that they have been crossed.

It’s why some people talk about “climate engineering” and as far as I’m aware the first example of this was “cloud seeding” to promote rain fall. Whilst it can drop rain where there are clouds, it does have a “Robbing Peter to pay Paul” effect which means it can be used as a denial device on others. Thus you have an extention to “water rights” which historically have been responsible for bitter and bloody conflict and genocide. Thus climate engineering can be weaponised to effect entire countries. At the very least robbing Peter gives Peter cause for complaint if not litigate because it is nolonger “An act of God” but man.

So Climate Engineering of which aircraft contrails could be considered part of, is both contentious in it’s primary goal and has unknown side effects both directly and indirectly.

But as others have indicated the industrialized nations appear addicted to cheap energy and certain types of “Keeping up with the Jones’s” life styles. Life styles that certainly can not be supported long term not even for a few percent of the worlds population. Part of this problem is the ethos of “ownership” over “stewardship” that of “personal good” over “societal good” which boils down to the ideas of the need in some to convey to others in a very visable way what they believe is their “status” in life. Even when it’s not those who consider themselves prejudiced against will see it that way, such is the human condition in some (consider it a variation of Dunning-Krugger effect).

We see this already with the political brinkmanship of “development” where some nations demand the right to pollute, because others have done so before and gained an advantage by it. Thus they want parrity of pollution on a historic past, even knowing now what was not back then the harm it does.

Personaly, I do not think we will resolve any issues politically and I’m not in favour of the various types of colapse. The notion of imposing a “one child” policy has significant consequences in that as life expectancy increases you have only one child supporting two parents and four grandparents, which is what they are seeing in China. And it’s not supportable either by individuals or the state. Some argue that it’s not possible to support even a steady state of the same number of births as deaths, due to not just increasing life expectancy but also education. That is the gain from extended education does not counter over a shoryened working life the loss in economically productive activity in the majority of people. Thus the only solution is to exyend the working life, but that does not work either as the nature of work has changed and manual, unskilled and semi skilled work is rapidly depreciating as technology improves, and the economists golden rule of “increased productivity” is mindlessly chased.

Thus we appear stuck with an insoluable problem of an increasing population, limited resources and polution that is killing us via it’s environmental and climate impact. Historically we know what is going to happen in the broad brush strokes history teaches, we’ve seen it in Europe for centuries, and it’s a stark choice between endless wars or expansionism into unpopulated resource rich environments… But It only works when there is somewhere to move to and some way of getting there, whilst you still have the excess capacity to do it rather than go for the genocide by war crime route.

Which in the mean time leaves us with the “what to do here” issue, unfortunately politicians always want big dramatic and frankly not going to work or have worse downstream problems methods as they can be seen to be doing rather than actually doing. They have been encoraged in this sort of stupidity by the likes of the World Bank, because they see developed nations winning twice. That is a poor nation borrows from the World Bank to give the money to first world companies, the poor nation then has to pay the bank interest etc, so they end up getting poorer whilst the first world gets richer high fives all around in the first world…

But… there is a problem as the first world creates these problems in the third world those problems come back to bite the first world via climate change, giving rise to new diseases etc and the side effects of the induced climate change. That is we can not keep throwing our rubbish over the fence into our neighbours garden and not expect trouble one way or another. Thus we need to sort out our own mess and then help the neighbours so they don’t make the same mistake.

Which is the polar opposite of what American Exceptionalism is all about, and the earlier machinations of European nations we call Conquest and Empire…

Thus when you hear about “climate engineering” lift the curtain and see what the technology is, how it’s to be paid for and importantly what other environment and climate effects it will have directly or indirectly.

And as far as technology is concerned you can not beat entropy, you can not solve a heat polution problem by burning more energy…

Clive Robinson • June 1, 2016 4:11 AM

@ tyr,

You might even learn how to fix a toe…: ^ )

Befor or after they have taken target practice at it 😉

As the old saying has it “What aint broke don’t need fixing, so learning not to break it comes before learning how to fix it”.

The problem as was once described as “Only rental cars do sixty in second gear” and is down to the difference between ownership and stewardship outlook on life by the driver. If your ethos in life is ownership, then you will drive a rental badly as you don’t own it, thus it’s somebody elses problem to fix when you break it. If your ethos in life is stewardship, you don’t drive a rental badly because you know if you do one way or another you are going to pay for any breakage you make.

It’s that ability to see beyond the immediate cost that is important, that is that dodging an upfront cost does not mean it does not have to be paid. It only moves the cost in time where it rapidly becomes more expensive, either to you, your descendants or society.

Either not having or not wanting to have the ability to see beyond the immediate cost is what gives some people the notion of “cut and run” and other “short term thinking” behaviours –which are so very bad for society in general– are exceptable.

Worse as I’ve pointed out in the past, is it encorages ever more wastefull behaviour and can give rise to “bubbles”. The trick is simple, when you get the power to initiate a project, you make it grandiose. All projects will succeed in their early stages with little knowledge or effort. Thus you cut and run at the end of that point and leave the project in other peoples hands (to sort out the mess you have created). If the project succeeds, you then claim it was through your vision and ground work, if the project fails it’s due to the incompetance of those that took over from you… this means you never have blaim to your name and your CV will shine… If you can also sell the grandiose reasoning more widely and get “buy in” from others you become a consultant or worse a guru and so an incredibly wasteful bubble forms… Thus you can work your way up well past your Peter Principle limit[1] where any Dunning-Kruger[2] problems you have would normaly have been apparent to others and thus stopped you don’t get recognised. It also enables you to avoid the Dilbert Principle[3] thus you continue to be a significant and increasing societal problem as the bubble expands.

[1] Peter Principle from the early 1970’s :- A person rises in a hierarchy to their point of incompetence.

[2] Dunning-Kruger effect from 1999 :- a cognitive bias in a person where either a relatively unskilled person suffers an illusory superiority, or where a relatively skilled person depreciates their own abilities in comparison to others.

[3] Dilbert Principle from 1995 :- Scott Adams cartoon character Dogbert observes “leadership is nature’s way of removing morons from the productive flow”[4].

[4] The Dilbert Principle is a rework of the old saw of “Those who can do, those who can’t lead”, which occasional has the humourous adjoiner of “those who can’t do or lead, teach badly”.

Clive Robinson • June 1, 2016 10:10 AM

@ Nick P,

You’ve often thought US Bankers were the biggest crooks in the world…

Well it looks like those in London are, but best of all New Zealand is planning to enter the corruption game at the highest levels as well,

http://www.independent.co.uk/voices/when-a-mafia-expert-tells-us-britain-is-the-most-corrupt-country-in-the-world-its-time-to-start-a7057686.html

I can not say I’m surprised London used to be the terrorist cross roads of the world in the 1980s and 90s, then 9/11 caused them to move on. Then the UK Gov had this wonderful idea to give the big accountanting firms their number one xmas wish, of what are now called Limited Liability Partnerships… which have been shifting more money in and out of slush and bribery funds than just about any other financial instruments.

Clive Robinson • June 1, 2016 11:58 PM

@ r,

It’s not just Jeff bezos, it’s Elon Musk and quite a few others including a large chunk of NASA, and that’s just inside the US.

The problem in doing it currentlt is Earth’s gravity well, it costs to much to build rockets as “one offs”. Ultimately the solution will be something along the lines of Arthur C. Clark’s “Space Elevator” –see his book “Fountain’s of Paradise”– but it’s a chicken and egg issue. We will not get cheap space transport, untill there is a good reason to have people go into space other than for science and tourism, the WASP politicians see little vote earning potential in it and most commercial organisations with share holders don’t see the profit in it. Both are very short term views, that neither Russia or China share currently.

The way forward is to bring the cost of launches down. Oddly perhaps the first step is not having humans and their life support systems on board, secondly to make rockets re-usable, then use hybrid flight systems. But it also means making payloads lighter and more efficient as well, which means we need new engineering solutions. But those payloads also need to ultimately be part of “self replicating” systems which means the “robots” need to be small and simple and near universal in nature.

Lot’s of people are working the individual parts of the problem but you rarely get to hear about it.

Elon Musk, knows full well that his re-usable rockets are a short term soloution to the problem, His ideas on re-working manufacturing/production will knock a hugh chunk of costs not just out of car production but rocket and aircraft production. Richard Branson likewise knows that his particular hybrid launch system is not realy of much use other than to get people a glimpse into space, but not orbit. But what both Elon and Richard know, is that their solutions are pragmatic stepping stones to make profit to re-invest into the next step. Because they realise what the politico’s don’t which is neither the chicken or the egg came first, they evolved from something else through lots of little changes.

But if you wan’t a glimpse of where the technology will go next have a look at the likes of Skylon. One view of it, is it beats the likes of Concord into the ground in terms of fast transport. It could get you from New Mexico to Australia in less than a couple of hours, and that is something people would be more than prepared to pay for. It would also be as near fully reusable as current large jet aircraft are. Making changes to it to get payloads up into very low orbit would not be difficult.

But there is a problem, which is we have “craped on the door step”, there is so much man made junk up in space, we first need to send in a clean up squad. The question thus arises of how to do it either economically or at a profit. The answer may well be micro sats with ion motors and electrical pendulums to lift the junk into higher orbits where it can be either recycled in some way or pushed into a safe place etc.

Thus we could have low earth orbit in use sufficiently profitably within the next five years that getting to the astroids or moon in a similar profitable way could be a decade or two away.

The one thing that is certain is that putting a man somewhere as a “political stunt” can be counter productive to doing it as a “profitable venture”. And whilst the former is glamorous and inspires youth, it’s the latter that makes it happen for all mankind.

But a thought for you, NASA is looking very seriously into the space elevator business for entirely pragmatic reasons. One asspect of which is high efficiency high density energy storage systems. Because whilst it takes a lot of energy to get up Earth’s gravity well the opposite is also true, you get a lot of that energy back coming down. Thus you could have the space elevator run almost like a pendulum. The sort of batteries you would want for this would also be rather usefull for running homes “off grid” in many parts of the world. It is thus a piece of “space science” that will get a lot of “spin off” before it even leaves the ground. Oh and you can bet “dollars to doughnuts” Elon Musk has got his eye very much on that one as well. But again that is a pragmatic step to more efficient energy transmission, electrified railway systems are more efficient than carrying fuel, engines, generators and motors, even though getting the power to them by third rail or overhead cantenary is quite inefficient due to IR losses. It would make the elevators into space a lot more efficient. But oddly enough people are already looking to use any such more efficient energy transmission for inclined railway systems for fast energy generation. Imagine a long incline with a very large mass train on it the potential energy is likewise large, converting that to kinetic energy is easy you take the break off, converting that to high voltage electrical energy is again well understood and developed technology. And trial energy storage systems based on this are already being built as prototypes. If the energy transmission can be made very efficient then such systems could be built into tall buildings to deal with energy surges etc. Oh and a similar mechanical battery is one that is being looked at for “hundred year storage” for security locks on nuclear waste storage facilities. So what other odd applications can you think of?

Clive Robinson • June 2, 2016 3:22 AM

@ not_convinced,

I don’t think agree with your views on the populational energy carrrying capacity of the Earth.

OK but in what way do you not agree with them and why?

Oh and remember, people seldom do what is good for them longterm, you can see that from the top four causes of premature death. Politico’s get told how to remedy those top four yet the fail to take any action repeatedly, so you have to ask yourself why they don’t.

Probably the most good for themselves and others people could take is to use their legs more. That is “take the stairs”, “walk / cycle 40mins or more a day” and don’t take the car within a mile of where you go shopping.

Whilst it sounds easy, and mostly is, it’s not convenient, even when you show people they could save upto 20% of their take home pay, and increase their life expectancy by more than ten years, they still go for convenience 90% of the time.

Their choice, but unfortunately it’s not just their loss.