Comments

Jim • September 23, 2016 5:29 PM

iOS 10.0.2 has been released with minor audio fixes.
Apple’s advisory doesn’t suggest it fixes the problems below.

https://news.ycombinator.com/item?id=12562849
https://twitter.com/thorsheim/status/779206805230608384

We looked into it, and found out that the new mechanism skips certain security checks, allowing us to try passwords approximately 2500 times faster compared to the old mechanism used in iOS 9 and older.

http://blog.elcomsoft.com/2016/09/ios-10-security-weakness-discovered-backup-passwords-much-easier-to-break/

Ted • September 23, 2016 5:41 PM

Lightweight Cryptography

“Summary: NIST is investigating the need for lightweight cryptographic algorithms. This includes looking at applications that may require lightweight algorithms as well as defining possible use cases.”

[…] “NIST has begun to examine applications in constrained environments to determine whether NIST should develop a lightweight encryption standard. In 2015 NIST held the first workshop on Lightweight Cryptography that included industry, academic and government experts. The second workshop is planned for October 2016.”

https://www.nist.gov/programs-projects/lightweight-cryptography

Anonymous Cow • September 23, 2016 6:19 PM

In the wake of the attack that got KrebsOnSecurity taken offline, people must be thinking about how to defend against an attack if one happens to them. Anyone have promising ideas that they care to share?

z • September 23, 2016 6:24 PM

@Ted

Interesting. I agree that the IoT craze (read: stupidity) is going to require smaller and lighter ciphers than we currently have, but there are so many other problems with those systems that throwing cryptography at them seems a bit like giving a root canal to a patient with arterial bleeding. Still, we have to start somewhere.

Jim N • September 23, 2016 9:09 PM

@ Anonymous Cow

On a positive note, the attack was a pretty effective “free publicity” for Krebs’ site.

DBM • September 23, 2016 10:00 PM

It seems odd, and somewhat peurile, that the Krebs attack was launched, thereby giving away that the attackers had such capabilities. Don’t these guys have the foresight to realize that by launching the attack during quiescent times, others will rise to work out where they are, how they did it, and narrow in on them? …. or perhaps, they actually did us a huge favor by allowing us the time to mitigate such attacks when they really count…

JK • September 23, 2016 11:24 PM

My understanding is that the Krebs attack was in fact repelled, but the hosting company told him they couldn’t afford to continue doing that pro bono. He was offered options but they’re hugely expensive and he understandably didn’t go for them (maybe). So it’s quite a unique situation in that way.

Paranoia destroys ya • September 23, 2016 11:36 PM

Hypothetical question:
There are several issues with the major Presidential candidates where they may be a subject in the National Security briefings provided to those running.

There are questions about Trump’s Russian business relations. Although numerous government computers have been hacked, has it been verified that Hillary’s correspondence has been intercepted though her carelessness?

r • September 24, 2016 1:08 AM

https://news.slashdot.org/story/16/09/23/1522257/probe-of-leaked-us-nsa-hacking-tools-examines-operatives-mistake

This belongs here and in the “more info on the vulnerability equitities process” due to the following statement being so keenly placed in the reuters article:

“It might also have allowed U.S officials to see deeper into rival hacking operations while enabling the NSA itself to continue using the tools for its own operations.

Because the sensors did not detect foreign spies or criminals using the tools on U.S. or allied targets, the NSA did not feel obligated to immediately warn the U.S. manufacturers, an official and one other person familiar with the matter said.”

Clive Robinson • September 24, 2016 2:19 AM

With regards Brian Krebs and the fact that his site os nolonger up.

Brian speaks Russian and chose to use that ability to investigate the underbelly of the Cyber-Crime syndicates there. He became quite a target and suffered a number of attacks including the swatting of his home, being sent drugs in the post and a few others.

It is safe to say he was not popular in certain circles, thus there will nodoubt be some celebrating the fact his site is gone (for now).

As is known to most Americans and by now quite a few other citizens in the world, both US Presidential Candidates are linked to Russia in interesting ways.

It will be interesting to see how long it will be before the attack on Brian Krebs site gets blaimed on the Russian’s and mixed up and mired in with US Politics in some way by the US MSM, looking for the next sensational way to be on target with the current “Russia is all evil” message.

Clive Robinson • September 24, 2016 2:51 AM

@ Ted,

Re: “NIST Lightweight Cryptography”

This is a very very bad idea.

Look at it this way, what will happen is that there will be a downward spiral towards whatever algorithm NIST decide on. Even if the algorithm is good, it will inevitably be broken long before the “End of Life” of many products it will be put in such as Smart meters and implanted medical electronics.

It is also a racing certainty, that if a product could support AES etc, marketing will push for the use of the Lightweight Cryptography instead as it gives back resources for more “features” etc.

Once a few people do this pretty soon all will be doing it for “compatability” or other nonsense excuse and the starters gun on the race for the bottom will have been fired.

A very undesirable side effect will be that PCs and Servers will get the Lightweight Cryptography added into crypto libraries etc. And at some point the algorithms will become added to applications that would otherwise not have had them. Which in turn will open the door to “fall back / downgrade attacks” where out of sight of the user a MITM attack causes the app to run with the weakest algorithm which is likely to be the Lightweight Cryptography…

We have seen this sort of thing happen often enough to be able to predict it…

The sooner this mad idea of IoT is over the better it will be for society in general. This NIST Lightweight Cryptography idea is effectively “pouring fuel on the fire, and making it a pyre”.

Bobby • September 24, 2016 6:13 AM

Regarding the Krebs attacks : It appears to be quite expensive to get protection against such attacks. I am just wondering is it also expensive to launch such an attack for an attacker ? Otherwise if you end up on someones blacklist you are out of business for good.

Just curious….

Gunter Königsmann • September 24, 2016 7:00 AM

There have been infos about the price of a ddos attack on Krebs’s site. But as the attackers almost never use computers they own and therefore use bandwidth the owners of the computers that were hijacked so they can be used as attackers have paid for these attacks aren’t this expensive.

JG4 • September 24, 2016 7:31 AM

from the usual daily compendium

What Makes A Liar Lie? (Clapper Lying About The Russians)
http://tm.durusau.net/?p=71680
…
Do you wonder why Clapper shifted from avoiding a “reactionary mode” of blaming Russia to not only blaming Russia, but claiming a history of Russian interference with United States elections?
I don’t have an email or recorded phone conversation smoking gun, but here’s one possible explanation:
From FiveThirtyEight as of today:
fivethirtyeight-21september2016-460
My prediction: The closer the odds become from FiveThirtyEight, the more frantic and far-fetched the lies from James Clapper will become.
Another DNC leak or two (real ones, not the discarded hard drive kind), and Clapper will be warning of Russian influence in county government and school board elections.
PS: If you don’t think Clapper is intentionally lying, when will you break the story his accounts have lost all connection to a reality shared by others?

Clive Robinson • September 24, 2016 8:48 AM

@ Nick P and the usual suspects,

Further to my comments a week ago about the new Apple A10 chip and the depreciation / demise of Wintel. It appears others are thinking in a similar vein,

http://www.theregister.co.uk/2016/09/22/the_evolution_of_moores_law_suggests_hardware_is_eating_software/

Part of the problem is Intel’s attempt to keep to Moores law prediction by hook or by crook. They have added reams and reams of hardware macros to keep pipelines from stalling in a larger than life memory model. Thus vast power hungry overly complex instruction set and decode hardware, prefetch hardware etc, creating “heat death” limitations.

As I’ve indicated in the past another solution is a minimal CPU with a lot of highly localized memory to get around the bottle neck of the memory busses and distance. One advantage of on chip memory is it creates little heat when compared to the Intel hardware macros. Small changes in the way we develop software will relieve much of the memory bus issues. Thus the Apple aproach for the foreseeable future will pull away from the Wintel solution.

r • September 24, 2016 8:55 AM

@Clive, Thoth,

Yes it’s true, Krebs has been sent a brick of heroin – swatted etc. It is a damn shame the thugs are forcing him to go dark – it’s a shame for us – and it’s a shame for them. They just hit squelch one an open channel, turning it right off.

But who knows? Maybe he will investigate distributed publishing like @Thoth talks about – distributed hash tables etc.

If he went as far as to upload his posts onto torrent bay or i2p we might see him come back in a blaze of glory.

He has more than enough hardcore fans that would support him in the arena.

I look forward to seeing him speaking freely again.

Nick P • September 24, 2016 11:23 AM

@ Clive

Two of us on HN reminded people that it’s essentially the Amiga architecture of hardware accelerators for key functions with CPU directing them. Too ahead of their time. Potential for high-end workstations or ultra-efficient ones as in mobile SoC’s. Or like Roku boxes for medua. Just integrate it with a desktop environment and API with optional offload based on presence of device.

@ All

A Quick History of Digital Communication Before the Internet

Great article on various methods of communication leading up to todag. Includes a privacy-oriented phone that might still have some appeal in a time when people are typing into laptops with blankets over their heads.

albert • September 24, 2016 11:31 AM

“…In recent discussions of whether President Obama should pardon Edward Snowden, it has gone unnoticed that a presidential pardon was once granted to a person who committed an unauthorized disclosure of classified information to the press, effectively erasing his crime….”
When the President Pardoned a Leaker
https://fas.org/blogs/secrecy/2016/09/morison-pardon/

“…Public discussion of the Edward Snowden case has mostly been a dialog of the deaf, with defenders and critics largely talking past each other at increasing volume. But the disagreements became sharper and more interesting over the past week….”
Sorting Through the Snowden Aftermath
https://fas.org/blogs/secrecy/2016/09/snowden-aftermath/

. .. . .. — ….

Clive Robinson • September 24, 2016 12:39 PM

This may be of interest to some,

https://beta.cryptpad.fr/

Apparently it is a zero knowledge encrypted colaberative editor using the blockchain and runs using javascript.

I don’t know if it’s in Bruce’s list of crypto products or not.

Clive Robinson • September 24, 2016 2:16 PM

@,

The problem with FPGA’s is there is a high price to be paid for the flexability. Firstly, they are between 50 and 500 times slower than custom silicon and it’s far from easy to get the best from them even for RTL experts of which there are darn few in circulation. Verilog and VHDL are not very user friendly and Verilog has very real problems when used by those who’s background is software not hardware. In part it’s the “sequential-v-parallel” thinking issue and in part shaking learned and now embedded bad habits.

Then there is the “co-pipe bandwidth” issue. That is FPGA silicon and CPU silicon do not make for cosy bed fellows on the same chip, thus seperate chips will give much higher yields. But… you have to have an interconnect of some sort and this is problematical as you have to put “translation hardware” in at both ends. It makes things far slower than they might otherwise be.

Thus in all honesty I think the FPGA twin-in-chip is actually a bit of a gimic to tide Intel over for a couple of years at most. Further others have the same gimic and the takeup is not exactly stella. Due to lack of “easy FPGA tools” etc.

Thus Intel and others looking at “mainstream” not “niche” markets are going to end up with libraries of standard configurations. Which is not realy going to be competative with tapeout macros that will make high end SoCs for Servers on Chip solutions which the cloud and similar market are looking for.

This where the likes of the ARM cores have an advantage they already have large tapeout libraries and are verymuch standard for SoC chips thus Servers on Chip is a tiny incremental step as Apple is showing almost every year with it’s A10 chip. Likewise Broadcom and other SoC for Coms manufacturers. But ARM has a significant advantage over Intel, that Intel has tried and failed to emulate and that is the “Bang per mW” ARM is a long long way ahead on this mainly because they did not go down the Intel route to get over the bus bandwidth issue. And whilst few care about power when it comes to their home PC it is a very major concerne when it comes to server farms and even companies with a hundred up PC users. ARM can use passive cooling at much higher densities than Intel chips aimed at the server markets. The difference this makes in real estate and running costs dwarfs any price differential on silicon costs as I have a feeling you might be aware of.

The future lies in a halfway house. That is much of the software will become hardware macros that run as parallel tasks. An ARM style CPU with lots of on chip memory or a hardcoded macro can run entire threads autonomously and ultra efficiently. Suitable parallel algorithm design will cut inter chip communications down such that an optimum bus switching system to slow “core RAM” will be a small percentage of the overhead, thus the light speed bus length restrictions will be very much less.

But to get to this level of parallelism will require a slaughter of current code cutters unless they can either retrain out of sequential thinking, or the programing languages become 6th or more generation where the sequential thinking will be at a sufficiently high level that the parallel threads/macros/cores are abstracted out of the programers view. Think of it as a higher level version of *nix shell scripting, where legacy sequential programmers provide the highlevel plumbing and the newer generation parallel programers will provide the parallel algorithms and the hardware macros that implement them efficiently.

Such a system has very significant security advantages as I’ve explained in the past.

In effect computers as we know them currently will cease to exist except for the likes of home and gaming computing, which will move to pads and consoles within a “walled garden” type market. We will end up with massively parallel systems where it will be almost impossible to say where the code you are running actually is as it will be distributed across many hardware macros / cores as required.

The only question that is directly relevant to most of us is when and where will we be within such an ecosystem?

Whilst I’m sure there will be people who disagree with this view, I suspect most will not have stood far enough back “from the coalface” to get a wide enough view of which direction things are heading in and why. Part of that is major industry players don’t want you to see as they are far from ready and in many cases have not yet covered their costs in earlier “wrong direction” investment.

Whilst I don’t think Intel have gone to far down an evolutionary cul der sac to reverse back, previous attempts to do so have in effect been thwarted by Microsoft. Thus the question falls to can the windows cul der sac be escaped. Previous experience with MS Dos to Win3.x backwards compatability was painful for MS and brought much unwelcome bagage with it. Likewise the transition to NT brought further pain and the 16-32 bit “thunking layer” was a “hot knife to the eye” type experience. MS have tried frequently to dispose of legacy problems but have nearly always been thwarted by applications developers and customers for between half and a decade and a half after the change was an obvious requirmentvto tech industry insiders. I could write a long monologue on the ills of managment in application developing organisations, but suffice it to say that Microsoft managment brought much of it upon themselves.

In some respects the issues with forced upgrades to Win10 is very much part of this and aside from the telematics/front-door idiocy it’s a clear indicator that MS is very worried about it’s medium to longterm future. One sure indicator of this will be how MS treats tardy application developers over the next three to five years, I suspect it will not be to long before the “pickup the pace or be left for dead” message gets first strident then enforced with prejudice.

Will it preserve Windows, no not as we currently know it. It will eventually become another rent seaking “walled garden” like the Apple and Alphabet App Stores, where you are tied in to endless rental agrement –think 365– where you will have to pay just to keep your own work / IP or have it forced into the “Hades bit bucket of destruction”.

Clive Robinson • September 24, 2016 2:27 PM

@ Grauhut,

My apologies, my above was to you but, I forgot to add your name at the top.

Feel free to blaim it on my age, the length of my post or other ill I might have 😉

Nick P • September 24, 2016 3:07 PM

@ those into formal stuff

I posted K framework a while back but didnt delve into Matching Logic on same page. Well, I was looking for unrelated stuff when I found a paper that converts Hoare Logic to Matching Logic without much overhead. Posed as alternate way to verify Hoare logic. Following up, I found out it was a bit more.

Slides on K framework, Matching Logic, and C specs for realworld done in 18 months

One interesting section was comparison to separation logic. They not separation logic extends FOL, focuses mainly on heap, and is usually more manual. Matching logic covers more than heap, relies on FOL, and can be easily automated with regular solvers. The spec vs solution examples they give look way simpler than much of what I read. I like especially how they didnt restructure all the C code to pull it off.

On other side, the set theory to Prolog compiler I found made me revisit that side. Specifically, this document by Meyers:

Theory of Programs

Around a year of reading papers using FOL, Coq, or HOL makes how succinct this is still look amazing. It’s based on simple formalism, captures a most programming paradigms, is human-readable, and could be machine-checked with extra work. I think more should be investigating such set theory approaches. Not most but definitely more. Aim for similar heuristic, library, and solver approaches like K and others do.

Ted • September 24, 2016 3:24 PM

@z

Still, we have to start somewhere.

So true. It appears there was a public workshop earlier this year reflecting that same thought. Specifically to invite discussion, not to give root canals 🙂

‘The Food and Drug Administration (FDA) is announcing the following public workshop titled “Moving Forward: Collaborative Approaches to Medical Device Cybersecurity.” FDA, in collaboration with the National Health Information Sharing Analysis Center (NH-ISAC), the Department of Health and Human Services and the Department of Homeland Security, seek to bring together diverse stakeholders to discuss complex challenges in medical device cybersecurity that impact the medical device ecosystem.’

http://www.fda.gov/MedicalDevices/NewsEvents/WorkshopsConferences/ucm474752.htm

Grauhut • September 24, 2016 3:32 PM

@Clive: Never mind, was a great read!

I think we will see Intel focus on the server market where fpgas make a lot of sense, think of software defined networking, network security (inline ddos protection), this kind of need to be updatable hardware stuff. They already offer encryption and video transcoding in hardware. I expect cisco / juniper loadable fpga firmware on the market when these cpus become available.

My Info • September 24, 2016 6:34 PM

@JG4

The Russians have a finger in every pie. Doesn’t anyone remember Anna Chapman and friends who were arrested in NYC? For every cockroach you see, there are 100 others you don’t see, and I don’t care if they’re male or female or how beautiful they think they are; they breed like crazy and the whole U.S. is overrun with them.

They foment Neo-Nazism and have agents provocateurs all over the political spectrum. They’re definitely into our K-12 school systems, local libraries, local law enforcement, fire districts, county jails, etc., not just higher education, health care, labor unions, corporations, and national elections. The Russians aren’t so stupid not to know that all politics is local.

They quickly learn the language of whatever little political sewing circle they find themselves in and find a way to insinuate Putin’s agenda into every aspect of American life.

As far as LGBT go, it’s Holocaust 2.0 and WWIII is fast approaching with Russia. Otherwise we’re doomed along with the Jews, the blacks, the Irish, the angry white men and every other “minority” out there.

Imagine today’s internet: Americans can’t even read the news or order a pair of shoes anymore without some guy named Sergey looking over their shoulder and tabulating all their private information and data for financial and political gain. There has never been anything like it in all of human history.

I’m sorry, this Google GOOG no / stock-split GOOGL Alphabet, Inc. company is the one to watch. NSA – pffft.

Jim N • September 24, 2016 7:59 PM

@ Kim Fat Cow

“Krebs site is online :-)”

He better get a better pipe, not only that he’s been a target of DDoS, but now that the “free publicity” it generated will drive tons more viewers to his blog. :^)

Jim N • September 24, 2016 8:01 PM

@ My Info,

“I’m sorry, this Google GOOG no / stock-split GOOGL Alphabet, Inc. company is the one to watch. NSA – pffft.”

I’m surprised the privacy loving folks here haven’t written anything on Google Allo this week.

r • September 24, 2016 8:07 PM

@My Info,

WTF Is that? A Drum Synthesizer??

You’re kidding right, if the Russians are THAT far into everything then maybe you should shut the border – close your mind – close your eyes. Lock your doors. Load your guns.

What could you have that they want after enjoying their time here not having to change their MAC ?

Demonkrat! Demokrat! Demokrat!

Is that what you see?

Ronnie • September 24, 2016 8:27 PM

Physical security – Bowley lock – a new lock design that is more pick-resistant and more bump-resistant. Company is positioning themselves as a less expensive high-security lock. All things being equal, thieves would opt for the easier target although doesn’t preclude kicking in doors or smashing windows.
https://www.bowleylockcompany.com/

Animation of how the lock mechanism works
https://www.youtube.com/watch?v=jgekjfwphGc

Discussion of (an early version of) the lock
https://www.youtube.com/watch?v=1MnZM8Pkvmw

Probably the biggest barrier to adoption is that the user has to modify their lock/unlock behavior slightly.

tyr • September 24, 2016 8:31 PM

@Clive

M$ didn’t do the world any favours by hijacking the
entire Microcomputer industry into the awful path
of IBM + M$ crap. There was a thriving bunch of
innovation going on in many places which was taken
out as the survivors had to make PC compatible
boards just to stay afloat.

I don’t expect current programming types to make the
leap to parallel unless someone re-invents the
wheel on multiprocessor architecture. That also has
to have a massive hardware redesign to make the
single processor programmer model viable. Stranger
things have happened but I haven’t seen much rational
comp developement take place in a macro sense. It
has been kludge what sorta works and hope to fix it
later. Of course most of society uses that model to
charge forward into an unknown future.

My favourite developer story was the corp that built
an intel based PC with 1 meg of Ram then had to ask
Intel why they could only use 640K of the memory.
They had already done the circuit board fab by the
time they had to ask that.

I can’t wait to see the bloat level achievable with
an OOP parallel language implementation running on
wintel hardware.

Jim N • September 24, 2016 8:39 PM

@ r,

“WTF Is that? A Drum Synthesizer??”

You seem to have some sort of fixation on anything “Russian”-related. Has it not been reported of American involvement in other countries’ general elections? Truth is every country does it to every other. If every country had gone to war over this, we’d have WW3 a dozen times over already.

Vote…

r • September 24, 2016 8:42 PM

@Jim N,

Here, let’s simplify this.

Blame my fixation on Russia on having appearently gone to elementary with them.

Did you miss PE class?

There were Russians there too, and the substitutue librarian… well…

He was a huge fan of Orwell.

I think you missed the point about the drum synthesizer and paranoia.

Jim N • September 24, 2016 9:44 PM

@ r,

“I think you missed the point about the drum synthesizer and paranoia.”

Well, then quit being so paranoid about “Russians”. I don’t care if you “gone to elementary with [Russians]” or studied music in moscow. The tired, old red scare is getting old and tiresome.

neill • September 24, 2016 10:00 PM

@ Clive et al.

we could throw hundreds of cores on one die, and use ‘hypertransport’ do the cache and memory accesses & sync …

there’s an interesting paper from intel about motherboard design (didnt save the link) and the main constraint here is PIN COUNT

we’re at 2000+ already, and noone has the capability to manufacture a 3000, 4000, 5000 count socket (yet), with a motherboard that coud route all tracelines w/o signal failures, or manufacturing problems (and cost increase)

thats what you would need to feed a few hundred cores on a single die, power & data & control etc

so intel does what they can do to increase IPC, cache, cores, AVX, FMA etc whatever they come up with to use existing socket tech and squeeze more FLOPS out of it

im not a big fan but ill give intel a lot of credit for their achievents (and keep x86 code compatibilty)

IMHO itanium is an amazing product, so was everything altivec, but the large scale production cost ultimately decides where this all will go

Differences that count • September 24, 2016 10:05 PM

regular Blockchain vs ‘Editable’ Blockchain

Accenture Patents a Blockchain-Editing Tool vs Accenture Debuts Prototype of ‘Editable’ Blockchain for Enterprise and Permissioned Systems Tool

Duck Duck Gustav • September 24, 2016 10:23 PM

My greatest Appalatian logs to derial from your per pro und pre insistance that those that reflect upon those that reflect yours are prone to para no identity christ with (and without) ease.

The burning effigy in your pants begats but hurt beligerancy believe it or not, wry comments are butt responses to despondents desperately seeking to communicate from the deepest of sour chasm.

Doves my flatulence scare you?

Doo I make myself clear?

Thease and this is thus not a question of would-wind instruments, or percussion sections but a question of a much larger cadense droning on behind minds more closed than my own. Were you lost at the interjection? the introspection? Where is the sign…

You ask I, self and Yousef sir with both certainty and contempt – I ask: is there any certainty in the accusations of PreK Kollaborators?

I, Vince in PE Klass to vind out.

My reflection? (As opposed to your’s)

I am uncertain about whether I was [de]sponding to sour chasm from His Infamous or not I suppose.

What <is> your <slanted> eye doing here?

Duck Duck Gustav • September 24, 2016 10:43 PM

It was the last traditional Windows Patch Tuesday as Microsoft is moving to a new patching release model. In the future, patches will be bundled together and users will no longer be able to pick and choose which updates to install.

Last month a Slashdot reader asked for suggestions on how to handle the new ‘cumulative’ updates — although the most common response was “I run Linux.”

https://tech.slashdot.org/story/16/09/24/228203/tuesday-was-microsofts-last-non-cumulative-patch

Panic in the streets, exploits in the wild, contempt in our hearts, linux in our minds.

Taking the Hint • September 24, 2016 10:54 PM

Google Allo should be deleted and never used, says Edward Snowden

http://www.independent.co.uk/life-style/gadgets-and-tech/news/google-allo-should-be-deleted-and-never-used-says-edward-snowden-a7320861.html
It’s nice to finally see Mr Snowden discuss abuses from American corporations – not just governments.
In this example there is an intimate relationship between Google and The White House. Executive job offers flow both ways. Both Google and Facebook manipulate their clueless products to elect a restful Ms. Clinton. But the Europeans are well aware that USA policy is really authored by ex-Google employees. In fact it’s hard to name a single country that doesn’t resist except for suck-up England.

Duck Duck Gustav • September 24, 2016 11:06 PM

@Hinting A-Round Daft Serection

their clueless products

They are clueless products are not they?

Duck Duck Gustav • September 24, 2016 11:25 PM

Pull up a chair (and an signal line), we interrupt your irregularly scheduled canary thread to bring our notional anathema: Kumbaya.

Everyone, please – in unisom: THE Symphony of Distraction.

https://science.slashdot.org/story/16/09/24/185231/cisco-blamed-a-router-bug-on-cosmic-radiation

Cisco blamed a router bug on cosmic radiation, I suppose this is better than the typical “Act of God” cruft we see from the insurrance companies.

Is this what is going to happen when the proper explanations are all classified and in violation of an NDA?

Hardware is hardwired to accept these risks, we all were just labeled clueless products above – do you accept these risks? did you accept these risks?

Will you accept these risks?

Clive Robinson • September 24, 2016 11:39 PM

@ Ted,

It appears there was a public workshop earlier this year reflecting that same thought.

With the sound of horse hooves fading in the distance, they are finally realising the dual meaning of bolted, and that the one on the stable door should have come first.

It is too little to late, due to US Mrdical Insurance companies the legacy problem is now well dug in on heart related medical electronic implants.

Digging us out of that messy pit is going to be difficult without having to “crack chests” again. And it’s not as though “red flags” have not been raised for quite some time. The most public of which was one of the George “Dubyer” Bush coterie having the remote interface in his pacemaker disabled on “National Security” advice. Apparently there were fears that hackers would jerk him around like a breakdancing ragdoll, and it would not look good for the Secret Service if it got on the CNN news.

Back at the turn of the century CENELEC / CEPT had a bit of a rude awakening as design houses started producing Software Defined Radio kit and the futureologists in the likes of Advanced Micro Devices started talking about “universal transceivers” with single devices going from DC to Microwave and beyond with all communication modes compatability. In effect making a mockery out of half a century of licencing regulation.

Since then things have got very very interesting. For a few hundred dollars you can by the likes of the HackRF One from Great Scott Gadgets that will do from the AM band up to 6Ghz in half duplex that has the usable Zero IF bandwidth of over a MHz. It’s sold as “experimental test equipment” but it can do most analog and digital modes if you have sufficient “back end grunt” via GNU Radio etc, and with a few tweeks and add-ons could become a Cell Site Simulator with Stingray like capabilities.

Thus the previous licencing and regulation and the legislation behind it had relied on “security by obscurity” and that has all been blown out of the water by this “Disruptive Technology” of SDR.

What ever the FDA or other interested entities in Smart Meters and other infrastructure think it had better include very strong crypto that can be upgraded several times in it’s expected service life of a quater of a century. Because anything less will be compleatly and utterly hacked and the attacks made usable by “script kiddies” who will amongst other things make grandpa dance…

THe bottom line is to think otherwise flies in the face of modern history of technology…

Joe K • September 25, 2016 3:35 AM

@JG4

I read the piece about Clapper on the blog you linked to, the one that asked the question “What makes a liar lie?”

And then I read the Wall Street Journal articlette it referred to:

Related questions that sprang to mind are “What makes a reporter fail to report?” and “When is a stenographer’s notepad like Write-Only-Memory”?

The reporter promises us that “Mr. Clapper’s comments were his most explicit to date connecting Russia to the hacking operation,” but when we examine the direct quotes therein, we find nothing explicit about them.

Did Clapper said anything remotely like what that reporter claims? One will search his article in vain for quotes substantiating that Clapper said anything of the kind.

The article does quote Clapper. Apparently, Clapper opened his mouth and said some things, and the reporter wrote some of them down. But only in the reporter’s imagination, and perhaps a suggestible reader’s, do those particular quotes amount to saying that Russians hacked the DNC.

If Damian Paletta, the reporter in question, has other more juicy quotes in his notepad, which actually demonstrate Clapper doing this alleged about-face on his “Calm the fuck down, people” stance, why did he choose not to share them with the public, by putting them in the article? Is the WSJ running low on electronic ink?

A more accurate headline would swap out “U.S. Intelligence Chief” and replace it with “Wall Street Journal Reporter”.

Related: Would you like to know how I knew, way back when, that the Bush administration’s claims about Iraqi WMD were utter bullshit? Because when you searched for potentially substantiating evidence in the news, you came up with the same three bits of pocket lint.

If they had had good evidence, they would not have been showing off the same three bits of pocket trash, over and over.

The same old program seems to be running, once again. Is the American mainstream press a weapon of mass destruction?

Duck Duck Gustav • September 25, 2016 4:43 AM

@Joe K,

The same old program seems to be running, once again. Is the American mainstream press a weapon of mass destruction?

The various hentities of the msm are apparently just clam o-ring, aren’t they?

They only open up that well fed maw wide to let that sand slip out onto our <g>ears.

They’re not the weapon of mass destruction but a cog in the we’ll of the masses distraction.

I argue, that when one hand watches the other: the ugly facade staring back at them with such eager bliss as to count every last second is their own. Reflecting on a ticking bomb.

Likely, they’re only a small peice of the larger Western Minded Dilemna you allude to, one hand counts the minutae and the other hand I’m sure counts the our’s.

Do we really knead seconds?

Duck Duck Gustav • September 25, 2016 5:24 AM

@Curious,

RE: Crapcom

https://it.slashdot.org/story/16/09/25/004250/street-fighter-v-update-installed-hidden-rootkits-on-pcs

Friday Capcom tweeted “We are in the process of rolling back the security measures added to the PC version of Street Fighter V.” This prompted one user to reply, “literal rootkits are the opposite of security measures.”

Not when you’re Sony, Capcom, the NSA, the IDF, the CIA or anyone else acts with imputiny.

I’m very secure in stating that mild observation.

You really don’t have to spin these props up any more than they already are, it’s sad. (where’s that propeller beanie when I need it…)

It’s becoming apparent that an appearence is impatiently more important that being perceived as impotent.

Am I being impolite here? Have I surpassed some quotient?

Please, let me Noe if I am.

Grauhut • September 25, 2016 6:34 AM

@all: Now that KrebsonSecurity is back…

“Someone Is Learning How to Take Down the Internet”
(Bruce)

“Someone has a botnet with capabilities we haven’t seen before,” McKeay said. “We looked at the traffic coming from the attacking systems, and they weren’t just from one region of the world or from a small subset of networks — they were everywhere.”

Now someone learned to take down Akamai. But who?

Possibly the ZeroAccess guys? They could have the capabilities and an open bill with Krebs.

http://arstechnica.com/security/2013/12/microsoft-disrupts-botnet-that-generated-2-7m-per-month-for-operators/

Grauhut • September 25, 2016 7:02 AM

@Jim N: “@Kim Fat Cow “Krebs site is online :-)” He better get a better pipe”

One of the biggest pipes possible now as it seems 🙂

root@home:~$ ping krebsonsecurity.com
PING krebsonsecurity.com (130.211.45.45) 56(84) bytes of data.
64 bytes from 45.45.211.130.bc.googleusercontent.com (130.211.45.45): icmp_seq=1 ttl=56 time=16.6 ms
64 bytes from 45.45.211.130.bc.googleusercontent.com (130.211.45.45): icmp_seq=2 ttl=56 time=15.9 ms
…

Drone • September 25, 2016 7:37 AM

I see Brian Krebs has a new DDoS related post up:

“25 The Democratization of Censorship”

https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/

Excerpting:

“The outage came in the wake of a historically large distributed denial-of-service (DDoS) attack which hurled so much junk traffic at Krebsonsecurity.com that my DDoS protection provider Akamai chose to unmoor my site from its protective harbor… It just so happened that this last siege was nearly twice the size of the next-largest attack they had ever seen before.”

There’s lots more; read it.

CallMeLateForSupper • September 25, 2016 10:23 AM

@Drone
“There’s lots more; read it.”

Love to… but the site was still unreachable here less than two minutes ago.

Czerno • September 25, 2016 10:28 AM

In news : In a poll today, Swiss voters have approved by a massive majority (66%)a new law authorizing the surveillance of communications and internet by the secret services …

Bad news for Protonmail and similar who used to boast of their made-in-Switzerland anonymity.

Maybe time for us all to examine “onionmail” ( en.onionmail.info ) as advertised by @Ninho on last week’s squiddy …

My Info • September 25, 2016 10:47 AM

@Jim N
“Google Allo,” Snapshot, WhatsApp, etc. are of little interest to privacy advocates until they entrench themselves to the point one becomes a hermit or a witch (or a terrorist) for refusing to use them. Then it’s more like robbing than stealing privacy.

@r
“shut the border – … Lock your doors. Load your guns.”

Those are good ideas.

The Democrats, yes they do have especially a transgender holocaust going on. Identify them, offer them ‘help,’ (in reality nothing but psych meds and ‘conversion therapy’ to try to make them ‘comfortable’ with their originally assigned gender,) and meanwhile work behind the scenes to ship them on cattle cars to concentration camps (or mental hospitals — a favorite trick of Vladimir Putin for his political enemies.)

Psychiatry is getting very, very grisly these days.

The Democratic political aim with gender transition/reassignment therapy is to waste as much of the patient’s time and money as possible and then ultimately refuse, and if possible force the patient into prostitution.

Transgender looking for a ‘real’ job? Sorry, we just got a call from the boiler room. We were told not to hire you. You’re too old. Besides, you can’t use the restroom.

That is the Democratic political machine in action, in case you were so deluded as to think Democrats were ‘tolerant’ or ‘open-minded.’

CallMeLateForSupper • September 25, 2016 11:07 AM

While reading this yesterday,
https://theintercept.com/2016/09/24/a-walking-tour-of-new-yorks-massive-surveillance-network/
and with the attack on Krebs’ site fresh in my mind, the thought occured to me: how many city/county/state/fed-owned cameras contribute bandwith to bots? Think of the profound irony: herding many thousands of individual pieces of Five Eyes’ (and others) surveillance infrastructure into a massive stampede.

“Bloody brilliant!” – Tom Jerico, in the movie “Enigma”

r • September 25, 2016 11:43 AM

@Jim N, My Info

Time to reformulate your plan of attack, both of you have been put out (Dan Rathered) and are likely putting out (read not being put-in).

I almost didn’t bite as I have been warned about you (too) and now you’ve received mine.

Tag, you’re IT – willing merchants of disinformation.

Tomes to me to entomb your ineptitude for all of time to beholden caufielded.

Ted • September 25, 2016 12:46 PM

@Clive Robinson

Even if the algorithm is good, it will inevitably be broken long before the “End of Life” of many products it will be put in such as Smart meters and implanted medical electronics.

You are right, both historically and logically. However, would you say that abandoning the process now would be imprudent, at least for medical devices?

According to Dr. Sarbari Gupta, CISSP, CISA, implantable medical devices (IMDs) are subject to many constraints including device size, cost, power, computational capability, and storage. Does this make lightweight cryptography necessary for those purposes and standards? Granted, being free from the need for advanced medical care would be an alternative.

http://csrc.nist.gov/news_events/cps-workshop/slides/presentation-1_gupta.pdf

Also from the “Postmarket Management of Cybersecurity in Medical Devices, Draft Guidance for Industry and Food and Drug Administration Staff”

Line 770: “Risk Analysis and Threat Modeling”

“FDA recommends that manufacturers conduct cybersecurity risk analyses that include threat modeling for each of their devices and to update those analyses over time. Risk analyses and threat modeling should aim to triage vulnerabilities for timely remediation. Threat modeling is a procedure for optimizing Network/Application/Internet Security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent, or mitigate the effects of, threats to the system. Threat modeling provides traditional risk management and failure mode analysis paradigms, and a framework to assess threats from active adversaries/malicious use. For each vulnerability, a summary report should be produced that concisely summarizes the risk analysis and threat modeling information. Due to the cyclical nature of the analyses, the information should be traceable to related documentation.

http://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM482022.pdf

My Info • September 25, 2016 1:01 PM

@r

— “… both of you have been put out … entomb your ineptitude …”

That is incredibly ugly language — a scarcely concealed death threat with the assumption of its having already been carried out. Rest assured I take it seriously since the failed attempt on my life shortly after my last post.

A large caliber gunshot directed at me when I posted something on a transgender topic to the internet from a mobile device. Not in fact unusual. Happened to me in Chicago a few months ago, too.

Certainly confirms my claims of a holocaust against the transgender.

The internet privacy and security angle is what makes it relevant to this forum.

[N.B. No known relation to @Jim N other than discussion in this thread.]

Laam Venerinde • September 25, 2016 1:45 PM

@Czerno

Once again, the old privacy-v-security spin got going. News full of it here. “In order to combat terrorism, we ourselves have to become terrorists-errrr-aw, forget it”. The whole “Swiss-ensured anonymity/privacy” had reeked rotten to me anyway (see: that Swiss analogue of ECHELON). Too much parties interested in the opposite. And after they killed bank secrecy… Nah. I suspect, the only thing that has changed is legal status – that is, nothing.

Good news for PR men, I guess. Playing the fear and “terrorism” card still works. For the rest of us – did you really expect something else?

Moderator • September 25, 2016 2:02 PM

@My Info: Re your interpretation of @r’s opaque witticism as a “scarcely concealed death threat,” I have reviewed this thread and disagree. Please refrain from further harangues that have nothing to do with security.

Daniel • September 25, 2016 3:16 PM

I can’t figure out which is worse, that Krebs site got knocked off-line or that Google is his new protector. Google censors a great many things, I shudder to think of it as the guardian of free speech.

ab praeceptis • September 25, 2016 4:02 PM

Clive Robinson

(re. your “FPGA” post).

I widely agree regarding major parts. I assume, however, that implementation will happen differently.

You are right in that the tools for FPGAs are way too complicated for most – plus there is a whole lot of FPGA intricacies that are hard to be put into a tool at all.

My take is that (as you said) there will be more and more HW “libraries” for typical routines and purposes. The two ideas that mainly drive that will be a) to have complex blocks (like, for instance, EtherCat) readily available and b) to put (usually time) critical small blocks into HW (typical example: crypto).

FPGAs are but one approach to that, and a clumsy, slow, and burdensome.

My assumption is that the pivot point will change. I think, the fabs will inevitably walk towards a situation in which even single wafers can be reasonably produced and sold; that is basically but a question of them creating their “libraries”.

Another, albeit less relevant and more short term, evolution I assume is “inside bonding”, i.e. offering multiple chips inside one package. This might be attractive for an analgon to what today is many fabless chip houses. Those might, for instance, buy some periphery silicon (without packaging), design some glue HW to connect that periphery functonality to say an arm core and package the whole thing into 1 package.

Customers will love it as it takes away much of the ugly work that is hard for them and because it’s cool and felt as (assumedly) safe (mostly in terms of IP protection) to have your own chip with your own logo on it.
For the backend it’s seductive as it’s largely know-how based (read fabless) and generates attractive products with rather little effort.

One example that strikes me is crypto. On the one hand one very typically has rather primitive little devices for which a cheap 16-bit MCU is damn good enough. On the other hand there are more and more clients who want good crypto even on the interconnection with those simple devices. It would, of course, be attractive if they could buy a mildly more expensive and pin compatible version of their MCU that had some crypto HW acceleration built in.

Gringo • September 25, 2016 5:13 PM

@Czerno

Too bad about Protonmail. I had hoped they could have done better. It has the aroma of hushmail and the failures surrounding that steaming heap.

I don’t know about onionmail, but Sigaint.org appears to have a easier setup and they have been around a lot longer. According to IRC they are the “gold standard” of darkweb email.

CarpetCat • September 25, 2016 6:53 PM

Those of you with Win7 machines might want to check for DiagTrack again. MS snuck it in somehow again. Just a coincidence, but after deleteing it AGAIN, my router spontaneously rebooted about 3 hours later. Ahem, cough cough.

Reading the newspaper, I saw that Hilliary and Co would run out to the nearest store to replace her phones. Always the same place, nearest to the state building. Why attack State Dep security when you can break into the nearest cell phone store?

There was other, more depressing stuff, like rule of law meaningless, etc. But no one seems to care anymore…(perhaps when thouest bellies are not so full, and the nights are oh so cold…) I think I just elipsed myself…

Jim N • September 25, 2016 7:13 PM

@ Taking the Hint,

“It’s nice to finally see Mr Snowden discuss abuses from American corporations – not just governments.”

The hush-hush on these forums around Google is somewhat interesting. Have Google got folks watching/monitoring this? Oh ya, it’s just an extra crawlbot parameter, a self-professed defender of free speech perhaps only when it suits its purpose?

@ Daniel,

“I can’t figure out which is worse, that Krebs site got knocked off-line or that Google is his new protector. Google censors a great many things, I shudder to think of it as the guardian of free speech.”

Reading up on Krebs’ past articles now. It’s interesting.

Nick P • September 25, 2016 7:26 PM

@ Clive Robinson

I disagree with your FPGA analysis a bit. A few points.

“Firstly, they are between 50 and 500 times slower than custom silicon and it’s far from easy to get the best from them even for RTL experts of which there are darn few in circulation.”

Most designs I see at custom silicon are just over 1GHz with max I’ve seen being around 4GHz unless it’s a ludicrously tiny circuit. The top FPGA, Achronix, is 1.5GHz with the cheaper ones being 100-200MHz. So, it’s more like 5-10 times slower for average FPGA. Compared to software, though, those FPGA’s often provide anywhere from a fractional to 50x speedup on the job vs a custom-level CPU.

“Verilog and VHDL are not very user friendly and Verilog has very real problems when used by those who’s background is software not hardware.”

The FPGA’s will primarily be used to accelerate specific algorithms. There’s HLS tools that can do that already. There is a learning curve on the HDL stuff. It’s no as bad as it seems, though, where a lot of people figure it out and on cheap FPGA’s. It will just take some time for the supply side to appear. There’s already a supply side in people that get trained for ASIC’s, do boring grunt work, and want a more interesting job. FPGA’s will be easy for them. This is sort of already happening.

“That is FPGA silicon and CPU silicon do not make for cosy bed fellows on the same chip, thus seperate chips will give much higher yields. But… you have to have an interconnect of some sort and this is problematical as you have to put “translation hardware” in at both ends.”

I’m not sure how true or false this is in practice. We have too little data. There does need to be a translation layer but it might be a simple protocol. Likewise, what’s passed back and forth doesn’t necessarily have to be the raw data: might just be control messages where the raw data comes through the NoC from DDR block. That’s pretty likely. Also, remember almost everything about ASIC design was some grand challenge taking PhD’s to pull off. And they usually come up with a tool for whatever it is. Even if this is difficult, they’ll figure something out given some vendors already synthesize whole NoC’s for their customers.

“Further others have the same gimic and the takeup is not exactly stella. Due to lack of “easy FPGA tools” etc. ”

I think it’s smart rather than a gimmick given FPGA market is already in the billions. Plus, the products adding a CPU onto FPGA fabric were selling well when I looked into them. Adding an FPGA on-chip without the delays of a PCI coprocessor and with a real CPU will provide enormous benefit to HPC and cloud users. A number of them are already doing the semi-custom stuff with Intel and AMD that costs far more. A FPGA means, if higher unit price is OK, then they can get quick deployment from even cheaper developers at cheaper NRE. Quite a few of the customers will have relatively low number of units but need FPGA or ASIC throughput. Tooling is still a problem but I expect fabless companies to be main suppliers like with ASIC’s.

“This where the likes of the ARM cores have an advantage they already have large tapeout libraries and are verymuch standard for SoC chips thus Servers on Chip is a tiny incremental step as Apple is showing almost every year with it’s A10 chip.”

This is true. The combination of better EDA tooling and shuttle runs means it’s actually cheaper than ever to get an ASIC done. The cost of the higher nodes is very significant, though. Apple is barely an example because they have billions. Think more like how most vendors use whatever Qualcomm, etc dictate because they simply can’t afford to do the development. It’s spread across them. Samsung and Apple made enough on their phones to do their own. Some of the VC funded companies that sell to high-priced markets, Cavium being one I often cite, have also come up with some stuff. Adeptiva iterated a few of theirs with extremely, clever management of it all to only cost a few million. All that is still way more than cost of developing same solution on Xilinx or Altera with 500 nodes worth of FPGA’s.

And don’t forget a bit selling point: FPGA’s run multiple designs for multiple or adaptable workloads.

“That is much of the software will become hardware macros that run as parallel tasks. An ARM style CPU with lots of on chip memory or a hardcoded macro can run entire threads autonomously and ultra efficiently. ”

That’s already happening with groups like Cavium. It will continue. It’s the Amiga model revived. 🙂

“But to get to this level of parallelism will require a slaughter of current code cutters unless they can either retrain out of sequential thinking, or the programing languages become 6th or more generation where the sequential thinking will be at a sufficiently high level that the parallel threads/macros/cores are abstracted out of the programers view. ”

Or we just use tools like ParaSail, RapidMind, etc. that essentially do it for them with them following some cookbook-style rules. It will suck for people that can’t use such tools.

Jim N • September 25, 2016 7:27 PM

@ TomTrottier,

“Maybe Krebs could switch to using Youtube?”

Don’t see why not, unless he speaks too much Russian accent to be taken seriously?

I’ve not paid much attention to his site in the past, not sure why, but it looks to be a good read, and unlike some sites he does his own reportings in an original way.

Jim N • September 25, 2016 7:56 PM

@ r,

Depends on the content. 🙂

Does Krebs have a Russian accent? Care to post a video link to a speech of his? I’ll listen to it.

Jim N • September 25, 2016 8:09 PM

@ Moderator

“@My Info: Re your interpretation of @r’s opaque witticism as a “scarcely concealed death threat,” I have reviewed this thread and disagree. Please refrain from further harangues that have nothing to do with security.”

Almost missed that, only because it’s background’d in yellow. Nice of the mod to hop in and clarify. I’ll just go back to reading slashdot since I’m being accused to be a troll here. Not a big deal.

CarpetCat • September 25, 2016 8:15 PM

@In the year 2000…

I wouldn’t worry too much about Intel, et al. Soon, most electronics will be very flexible with organic base parts. Imagine a TV that you could rollup, then threw onto the wall. With power passively provided by heat absorbtion. Or cutting one in half, and having it ‘grow’ two back. Eventually, they can be shrunk down to almost wallet size, growing back to desired size in a few minutes.

I know, it sounds, err, reads too good to be true. But you can trust me, I’m from the future. Why wouldn’t you believe me, you believe everything else you’re told…

ps. Save, bookmark this post. When it all comes true you can come back and wonder with awe.

Clive Robinson • September 25, 2016 9:01 PM

@ Curious,

Off topic I guess:

From my point of view “not at all”, I find it highly relevant to the process of political manipulation through the law courts.

If the FBI and DoJ can use “junk science” that is known to be “junk science” then they have a short term upfront advantage on the “You’re guilty because we say you are” game. Which makes trials “witch hunts” in a “cargo cult” legal system where justice is no where to be seen.

It’s been a standard FBI technique for quite some time. We have seen various FBI led techniques such as the ratios of metals in bullet fragments to provide “hocus pocus” proof that causes the “CSI Response”[1] in juries and more than a few judges[2].

The hard thing to do is not to get caught up in the spectical, drama or fear of being in judgment. Because doing so effects your mentality and you can easily think emotionaly not rationaly. At which point you are nolonger independent but a “play thing” of one side or another.

The reason much of this technobable does not get questioned is that courts are mainly not about justice but process[2]. Actual evidence rarely counts with a jury[1,3] just the quantity of testiment against the defendent or prosecution. Thus a wealthy defendent can buy a great deal of mud to throw at an often unprepared prosecution and sway the jury.

Part of the reason courts are more about process than justice is the repeate offender or obvious offender issue. The innocent and first time offenders do not know the game where as repeate offenders do. Thus the courts more often than not see guilty people standing as defendents for crimes and thus it’s a game of which legal eagle is better on the day and how the defendent “blags it” to the jury. Innocent people come across badly because they do not see it as a game, and they get judged on their lack of acting ability not on their guilt or not.

Making it worse for the innocent more often than not in run of the mill crimes the LEOs are fairly certain who has committed a crime due to what gets called collectively “MO”. Likewise in more serious crimes, like those against targeted individuals not property –or those defending it or who have the misfortune to be in the way/bystanding– the number of suspects are quite limited and often a motive is fairly easily reasoned out. In both cases the police are usually just looking for a “weight of evidence” to obtain a conviction, not to determin either guilt or innocence. Which means that the LEOs tend to have a blinkered view, they look for a likely suspect and once found they drop further looking for suspects and go all out and ignore contrary evidence.

Thus the prosecution on balance don’t get called out on “technobable” and thus it gets through time and time again developing a faux reputation. Then it hit’s an edge case of an actual innocent person getting steam rollered and they go to jail. It’s often only by chance that the case gets re-investigated more thoroughly and where the trouble starts. People build reputations on technobable and thus obtain a false position in life, for many reasons it becomes difficult for them to admit a mistake innocent or not. Those behind them do not like to see what is now also their mistakes aired in public nor do they want to face having civil suit for damages. Thus they fight every which way they can to defend the technobable and maintain the status quo.

The reason this effects security is technobable is often the underlying reasoning for “best practice”. This is due to lacking both reliable metrics, and reliable testing methods. Technobable then gets turned into “best practice tools” that get “marketed aggressively”.

The result of this is that the best practice tools unsurprisingly have a very poor return on investment. This has the knock on effect that all security tools “get tared with the same brush”. Thus those with control of finances see all security investment like buying the Emperor’s Clothes. With the result that a downward spiral happens. There is not the finance available to do the research required to develop metrics and tests, thus technobable is what “wins the race to the bottom”… Just as it always does in a “free market” where the buyer can not be aware.

[1] The “CSI Response” in juries and others standing in lay judgment is caused by the “CSI Effect”. Put simply the various “TV CSI Programs” use Special Effects etc to make Forensic Science look over glamorous and importantly overly capable. The most obvious of these is the “infinite image resolution” nonsense. Put simply they keep zooming in on CCTV footage getting better and better images. This is scientificaly impossible but because it’s an easy story line and looks good on the screen it gets put in. Unfortunately the bulk of viewers just accept it without question –it is entertainment after all– so their expectations of forensics are falsified and cold hard reality gets excluded from their expectations. Thus when they sit in a jury their expectations on the forensic examination of evidence gets a bit of a culture shock, which leaves them prey to any “technobable” the prosecution can get past the judge[2].

[2] Judges are often worse than lay juries when it comes to “evidence”. Judges look for “the little lies” of procedural mistakes not “the big lies” of technobable. This is because to judges a case is about the rules and paperwork more than it is about the actual determination of truth. Thus they are prey to the “Emperor’s new clothes” sales pitch[3]. Further in general judges do not like “expert witnesses” especialy when the get pushed hard on what is in reality their “hearsay” by the various members of the legal proffession trying to “point score”.

[3] The Emperor’s new clothes effect is one that is long known in the gambling and investment games. More accurately called “Talking the talk” or “Telling/selling the tale”. With the stock investment age old advise or warning of “If it sounds to good to be true, then it’s probably not true” thus “walk on by”.

r • September 25, 2016 9:30 PM

@Jim N,

It’s statements like the following that you paint your self into a corner with:

https://www.schneier.com/blog/archives/2016/09/amtrak_security_1.html#c6734821

Stop and frisk is supposed to be a weapons search, not a violation of the 1st or 4th amendments.

You seem to me to be pretty AOK with that, I’m not. So you’re suspect to me as I’m sure if you’re on the other side of the rail yard I’m likely not AOK with you.

Ten Four?

You can accomplish much of “their” necessities without DPI through the use of meta not data.

I think this is sort’ve what’s being said by the FBI about “going dark”, if we cut off their plain-text capabilities they think they have no recourse but to become entirely obtuse and opaque to the civilian courts. I’m not really interested in seeing juriprudence disappear from evidence rooms. At some point it will boil down into accusations by the state and executions there-of. Not my cup of Tee.

https://www.schneier.com/blog/archives/2016/09/friday_squid_bl_545.html#c6734944

WW3 huh? We’re not really playing with fire when they don’t have nukes or subs. It’s considerably much safer to just encorporate our point and clique instability instant abilities. These really aren’t super powers, they’re maligned and repurposed civilian capabilities capably applied and coupled with inculpability that’re honing in (and zeroing out) your angry son with E’s.

They’re not simply smudging out names and places with white-out, there’s blackouts (think the outrage over little miss guided manning). Can you really blame the world for being angry with us at times over things like this? It doesn’t really matter if it’s true or not because time after time it paints a picture that’s bloody as hell.

We have to clean our act up, because you can’t clean up an image smeared on the wall of history in blood.

There’s as of yet, been no real consequences outside of some stern looks from the other side of the river[s]. Fortunately, for us – most of the people with ICBM capabilities operate on the same level as a deterant. Again, THANK GLOD that most of the natives only have bows & arrows.

This is where asymetric war fare comes en to play, I point missiles at you – you point missiles at me – I make threats – you make threats – I shake down one of your friends – you sell my son drugs – somebody flinches – and somebody who’s name isn’t written down in your book of life dies. There ARE moveable parts behind the zine’s that play (Advanced) D&D (&D) (3rd Edition+) while the rest of us stare in horror as they infanticize about mayhen and suits.

I’m not thrilled, I’m concerned.

@KFC,

Did you see this? It’s SFW.

@Clive, Curious

http://www.slate.com/articles/news_and_politics/jurisprudence/2015/04/fbi_s_flawed_forensics_expert_testimony_hair_analysis_bite_marks_fingerprints.html

http://www.bbc.com/news/science-environment-36940475

http://www.cbsnews.com/news/massachusetts-lab-tech-arrested-for-alleged-improper-handling-of-drug-tests/

https://www.bloomberg.com/news/articles/2015-02-02/will-lie-detectors-ever-get-their-day-in-court-again-

Do you feel safe now? Then again, it could be just some liberal media spin spun up to the point of furthering this turbo prop down the runaway.

Hail to the Taxi!

Are you going to stand in front of a train to stop it?

Clive Robinson • September 25, 2016 10:47 PM

@ a b praeceptis, Grauhut,

I widely agree regarding major parts. I assume, however, that implementation will happen differently.

That is to be expected when trying to predict the future even in the near term. In part it’s due to different view points, in part to having different experience thus knowledge of issues. Which is why it’s important to have the conversations.

In part my view is based on what happened with logic chips back last century and in part on the laws of physics. FPGA’s like logic chips offer a large amount of flexibility, but at a price, the speed of light “will brook no arbitrage” thus is a devil that can not be cheated. This puts a finite limit on how fast information can be requested from a distance, even with the impossibility of infinite bandwidth. Which means that the speed information can be processed is ultimately defined by the distance it has to travel, not the bandwidth of the path it takes, even though that can have a very significant effect.

From my point of view Intel’s aproach has been mainly about “bandwidth” not “distance”. The reason for this is unfortunatly the sequential natute of most software.

For those old enough to have actually built CPUs from MSI logic chips a big problem was “delay time” or the length of time it took a signal to get from A to B not just due to gate delays but track and circuit delays. The solution back then as it still is is to “divide and conquer” which we call “pipelining”, where we trade higher through put for longer delays by chopping the signal path into short lengths and inserting registers. However a better solution was to minimise the circuit area which is what VLSI chips gave. Unfortunatly though designers had become fixated on pipelining which means a considerably greater number of gates thus area…

A clue to why this was perhaps not the best way to go was “vector processor super computers”. In essence there was a couple of ways of looking at vector processors, the original idea was a very wide register or array that held more than one value thus multiple calculations were performed simultaniously by the single CPU. Another was to have the array of values feed an array of much simplified ALUs / CPUs. Due to the limitations of the technology of the time they went down the single CPU route. The point that most people did not get taught was those vector arrays had minimal distance to the CPU… If you do the calculations you will realise that a minimal area RISC CPU with very large amounts of very local memory solves a number of issues not least of which is the “heat death” issue.

Intel however first tried to solve the bus bandwidth issue by using a complex instruction set, that also reduced the need for what was at the time very expensive memory. The problem with a CISC CPU is large area and lots of active gates thus heat and distance… All there subsiquent optomisation options were hamstrung by the CISC design. The CPU just got bigger and hotter. Thus very late in the game they tried going back to what was Vector Processing with SMID but it had to be effectively bolted on to the large hot legacy CPU…

To be vaguely poetic about it Intel had a “large hot ugly go nowhere CPU” whilst ARM had a “lean cool elegent go faster CPU” onto which vector processing could be done either way, of which the second is the more flexible option. To get into the same state Intel will have to throw out most of it’s core, but it’s instruction set prevents that.

However even though ARM could get many times the number of CPU cores in the same area as Intel in a much better vector arangment, it will not show the performance gains untill programers change…

Thus the dirty truth is that it is the bulk of programers that have gone to far down an evolutionary cul-der-sac…

The addition of an FPGA alows a lot of sequential code to get squeezed down into parallel hardware for a hundred or so speed improvment, even though FPGA’s are way way slower than the macros for CPU cores and other custom blocks we see in SoCs. Thus in the near future FPGA’s will be one way to go to get around the programer issue. The thing is with a properly designed parallel algorithm tiny RISC CPUs with large amounts of low heat memory with hardware configured in both vector forms on a chip will give the same if not better performance as an FPGA…

Thus we need also look at the “market”, it’s changing and changing fast Wintel is loosing out fast to Android Pads for end users. Wintel is holding on by it’s fingernails on the business desktop and gaming machines. The world is “going cloud” wether we like it or not (and I hate it from a security perspective). The cloud means tens or hundreds of thousands of identical servers in a building all identically configured.

Orders of ten thousand or more makes custom chips more than cost effective. Thus as with logic chips of old I expect FPGAs to be a near term solution for servers and a much longer term solution for high end pads and the like for vertical markets. However I fully expect custom chips to quickly replace FPGAs in server farms as and when they identify what software replacment hardware macros get them the best bang for their buck.

The question then falls to single chip like the current SoCs or multiple chip in single package. The difference will be in the hundred thousand up will be single chip, a couple of thousand up multiple chip in package.

Further I realisticaly expect both to be used on the same motherboard, with FPGA and custom chip in with a standard vector processor chip for the likes of IO.

Hopefully by that time some programers will be “parallel thinking” at the lower intensive levels with sequential programers working in “plumbing” apps in a similar way to *nix shell scripting to make applications.

As I’ve said before the future of computing is parallel from on chip upwards, the real question is where are the sequential “artisan” programers going to go as the parallel “engineers” work their way up the computing stack, sweeping all before them?

ab praeceptis • September 25, 2016 11:55 PM

Clive Robinson

There I disagree with much of what you say. For a start, c isn’t the decisive barrier in that issue. Speed is in the multiple inches per ns (around 12″/ns) which is far out on chip level.

I also feel that you’re mixing up diverse things here (from FPGA to the cloud).

Of course, my perspective is limited but from what I see the usual use cases for FPGA are almost banal things like hiding away IP in a “custom chip”. Another typical scenario is the poor mans ASIC. Another one is to save on pieces on board andoften it is a mixture of those. Speed (as in HW acceleration) actually seems to be a rather rare case.

There are just quite many product classes out there of which even a bigger manufacturer doesn’t produce enough to justify an ASIC. Rule of thumb: If you need millions, go ASIC; if you need just some tens of thousands, however, you are next to bound to go FPGA.

Funny anecdote: I know of companies who dislike FPGAs; they go so far as to exclude third parties offering them FPGA based products. Reason: They take that to mean that that third party isn’t big enough and/or that the given part is somehow makeshift.

Speed? I know of rather rare cases where companies chose FPGAs as a way to speed up things. I think that the “FPGA means speed” story is largely a fairy tale stemming from “real custom HW (read ASICs) we can’t afford, so let’s take the fastest we can afford” scenarios. A typical case is miners of gnu hacking devices.
As soon as a use case reaches tangible quantities you’ll find chip makers to pick up. Just look at intel and aes.

Oh and btw. price is a major factor, too. I know cases where, for instance an Infineon XMC4300 was used when, sometimes later, a desire for PK encryption came up. The idea to go FPGA was floated but short lived. It turned out to be less complicated and much cheaper to use a simple fast arm core as second processor which at the same allowed to put some other load from the main MCU.
In other cases I saw the same game but in the other direction. They switched to a cheap dual core arm and put all the MCU typical connectivity stuff into a cheap arm based MCU.

Another btw: Don’t underestimate the many cases where MCUS are abused for things others put into FPGAs. No new tool-chains needed, no new know-how needed and dirt cheap.

From what I see, Nick P is pretty close to what I experience out there.

Clive Robinson • September 26, 2016 4:57 AM

@ Ted,

However, would you say that abandoning the process now would be imprudent, at least for medical devices?

The last thing I want is for people to abandon security in not just medical products but all long lifetime products with a high replacment cost.

The problem is “talk down” where those with security at heart are poryayed as extravagant market killers by “fast buck” managment protecting eye watering profit margins and any future legal liabibility.

The actual price between what would be regarded as secure algorithms currently and “teen sister diary crypto” is actually less than fifty cents in the BOM. A point that does not get made often enough to refute the “you will kill the market” argument profiteers, who mostly cause an avalanche of market killing activity in the frenetic race for the bottom they create if they do not have a monopoly or cosey cartel.

If you look back on this blog I’ve argued several times for NIST to stop pandering to such behaviour and produce “framework standards” where there are laid down requirments for inplace upgradability with sufficient protections to stop easy cracking/hacking. Such that when the current “secure” implementation is found to be wanting –as they always are– the problem can be corrected without ripping peoples chests open every “patch tuseday” and before some script kiddy senfs the breakdancing of to resus with some poor med tech astride them trying to keep their blood flowing.

The only way this can be done is not with “lightweight” recomendations that the manufactures want but legaly enforcable standards where such managment can be locked up on attempted manslaught or equivalent charges with fines and damages that will put their family etc on the streets and take away any pensions or other assets they might have tried to hide.

Contrary to such legislation and regulation killing a market history shows it actually opens it up to inovation and competition, giving real value to those involved on all sides of the market.

65535 • September 26, 2016 5:54 AM

@ Grauhut

“@all: Now that KrebsonSecurity is back…”

Yes, Krebs on Security is up and has post mentioning Bruce S. and his prior warning about probing the internet for points of weakness. Bruce thought it probably was a nation state actor. Krebs doesn’t think so.

I wonder who is correct. The booter service for hire was run by two men Israel, Israeli citizen named Yarden Bidani who was just about to join the IDF and a guy named Itay Huri. It appears that both men were arrested and quickly released.

‘Alleged vDOS Owners Have Been Arrested And Released’

“Once their names were out in the open, it did not take overly long to find and arrest them. Albeit they were questioned by officials, they have been released on Friday on bond. Authorities also put both men under house arrest…” –The Merkle

http://themerkle.com/alleged-vdos-owners-have-been-arrested-and-released/

Krebs indicates that they harnessed a huge bot net of home routers and Inter of Things such as video cameras and other devices with hardcoded passwords or easy to guess passwords.

When Bruce was exiting BT there was some boards that suggested that all UK citizens including those under BT internet service had backdoored routers with Internet facing shells which GCHQ could/can manipulate.

It was guessed the same is true for modems and routers in the USA, and many other countries who spy on their citizens.

It this huge DNS reflection and amplification attack on Krebs on Security were nation state or backed by a Nation state proxies I would guess Israel would have the know-how and lists of all backdoored internet facing devices and IoT devices with hardcoded passwords. Surely, these devices are now known and probably will be blacklisted.

I wonder what the true findings of this DDos attack will uncover. Place your bets on:

1] Two proprietors of a booter service in Israel

2] Two booter’s in conjunction with a Nation State

3] Your average disgruntled team of hackers

4] Unknown

Curious • September 26, 2016 9:28 AM

Something apparently went wrong with the most recent update to OpenSSL:

https://www.openssl.org/news/secadv/20160926.txt

“This security update addresses issues that were caused by patches
included in our previous security update, released on 22nd September
2016. Given the Critical severity of one of these flaws we have
chosen to release this advisory immediately to prevent upgrades to the
affected version, rather than delaying in order to provide our usual
public pre-notification.”

Ninho • September 26, 2016 9:59 AM

@Gringo :
“I don’t know about onionmail, but Sigaint.org appears to have a easier setup. ”

Sure, but unlike Onionmail, Sigaint is webmail only, it does not support regular internet mail clients and protocols (pop3/smtp) – at least for free account users.

Onionmail, au contraire, is true internet mail. It does not live in the browser – no webmail access being available, not even as an option. Perso I see this as an advantage – opinions may vary.

For anyone there who’d want to try onionmail under Windows, here is a list of easily available software which I have been satisified with (Win XP 32):
– the Tor client of course (tor.exe)
– thunderbird : we want a mail client which can do Pop3 as well as Smtp WITH Startssl ! MS mail clients WON’t fit the bill. Another possible hit is Clawsmail (which i haven’t tried)
– last but not least, “Sockscap”, from NEC, later Permeo, now abandon?ware, yet easily found on reputable download sites. Need this – or alternatives s.a. Freecaps, or ‘Hummingbird Socks’… to “socksify” the mail client. (Although thunderbird by itself could be configured to ‘talk socks’, this won’t work with onionmail because, as far as I could determine, there is no way to instruct thunderbird to do DNS resolves through the socks proxy).

I won’t offend Bruce’s high profile audience by going down the nitty-gritty details, left as an exercise for the interested… Please test your settings by dropping a test mail to : ninho AT ninho@wc2eyfmw7wrwomf4.onion

Heed that without superimposed encryption (like, GPG), the operator of the onion node hosting the mail server or their evil maid COULD in principle snoop the cleartext : please, leave no personally identifying or sensitive details in your test message !

CallMeLateForSupper • September 26, 2016 10:20 AM

@Drone
“Hmmm, Krebs’ site seems always up for me since I posted the link here.”

I found KrebsOnSecurity[dot]com reachable here sometime yesterday afternoon.

ENHANCE! • September 26, 2016 10:21 AM

@Clive

Thank you for that spot-on analysis of our “justice” system. I would point out that the CSI Effect goes far beyond the general public’s lack of actual forensics knowledge. The vast majority of people in America have been rendered so braindead by “entertainment” that they can’t even comprehend the most elemental concepts of physics. They think tires squeal on dirt and shotguns blow people backwards through the air and explosions make noise in space and that female CIA employees wear low-cut black catsuits (just to name a few). In short, most Americans (including the cops) now live in a fantasyland where a “logistical syllableism by reduced ducttape absurdem” is all it takes to send your ass to the Big House.

Thank God there’s still enough oxygen left in outer space to support those huge fireballs. Too bad it’s not getting to the “brains” on Earth.

Clive Robinson • September 26, 2016 11:55 AM

@ Bruce,

You might find this pre Babage computer “automater” that rights a single line of Latin verse of interest,

http://www.atlasobscura.com/articles/the-strange-victorian-computer-that-generated-latin-verse

It is not however a computer, it’s kind of a cousin to the mechanical odometer disiplay in a car.

The idea behind it is the same as the “Instant minuet kit” designed in the late 1700s, in which you threw dice to select a string of musical phrases that when played gave you a minuet.

This poem system works well in Latin due to the way the language works.

That aside as a curiosity of the ingenuity of the time (no standard parts untill Whitworth many years later) it is a quite interesting item.

Jacob • September 26, 2016 12:10 PM

@ Clive

Wosign CA and its StartCom branch got the ax today from Mozilla and Google. Will not trust any new cert for 1 year, and then must undergo a very rigorous audit to be readmitted.

JG4 • September 26, 2016 1:07 PM

I don’t think that I’ve seen enough discussion of adaptive systems here. I define enough from the point of view of optimality with respect to security. To the extent that you can never define the threat model with perfect accuracy, some feedback mechanism is required to adjust the battle plan in response to contact with the enemy.

https://www.schneier.com/blog/archives/2016/09/friday_squid_bl_545.html#comments…
Big Brother is Watching You Watch

How Hacked Cameras Are Helping Launch The Biggest Attacks The Internet Has Ever Seen Forbes (Lulu)
http://www.forbes.com/sites/thomasbrewster/2016/09/25/brian-krebs-overwatch-ovh-smashed-by-largest-ddos-attacks-ever/

Why the Silencing of KrebsOnSecurity Opens a Troubling Chapter For the Internet Slashdot (furzy)
https://news.slashdot.org/story/16/09/24/028228/why-the-silencing-of-krebsonsecurity-opens-a-troubling-chapter-for-the-internet

Malware Evades Detection with Novel Technique Threatpost (furzy)
https://threatpost.com/malware-evades-detection-with-novel-technique/120787/

r • September 26, 2016 2:49 PM

@Jacob,

The taint is already out thought. 🙁

Somebody said kernel.org was using StartCom and we know WoeSign issued ones for github. Additionally Mozilla was “investigating” whether the Tor Browser Bundle RCE had implications under the non-tor subsystem (firefox, thunderbird). None of this will be remedied in short order with a “fix” imb. It’s just, as we saw with the NSA’s response as to the browser exploit leaks “not a concern” because these holes are closed before “criminals” can get to them. Obviously, they don’t believe dark room development processes in both our local and internation courts to be criminal in nature.

r • September 26, 2016 2:52 PM

@Jacob, All

I think I said this before, but I think that the FBI’s “going dark” problem isn’t about encrypted communication but about back room legislation and a lack of accountability. They’ve already made up their minds and have a branch labeled ‘master’ for the rest of us.

r • September 26, 2016 2:55 PM

If what KFC(?) says is true, you can expect the cycling between apprenticeships to be cover for small movements along the way. Maybe, like I said that’s why OPM isn’t a threat to the normals but a threat to the clandestine movements that happen under the table.

r • September 26, 2016 3:03 PM

Here, look at it this way: I would be willing to bet the FISA Judges almost never get “hangry”.

#1, they’re well, “fed”. (Golf, Brunches, etc)
#2, I don’t Noe if you understood when I said one hand “watches” the other.

I really do mean to ‘coin’ a phrase.

Judges don’t wear white.

Clive Robinson • September 26, 2016 3:37 PM

@ Jacob,

Wosign CA and its StartCom branch got the ax today from Mozilla and Google.

Sometimes the wheels move vert slowly. Atleast it got there this time…

What we realy need is a trust system that works… But then we’ve been saying CA’s don’t work for well over a decade or so now and the reality is all we’ve managed to change is the base algorithm. I know it’s a hard problem, but I’m definitely suspecting “vested interests” have the upper hand.

r • September 26, 2016 8:33 PM

In case anyone asks why professionals other than nerds would use such a system, I wondered myself at one point in time – but it was pointed out to me that being able to use the interoperability microsoft offers between office equipment, windows “phone” and other utilities is a pretty big selling point.

r • September 26, 2016 8:40 PM

Also from Slashdot,

https://science.slashdot.org/story/16/09/26/2128254/researcher-modifies-sieve-of-eratosthenes-to-work-with-less-physical-memory-space

“Now, inspired by combined approaches to the analytical 100-year-old technique called the circle method, Helfgott was able to modify the sieve of Eratosthenes to work with less physical memory space. In mathematical terms: instead of needing a space N, now it is enough to have the cube root of N.”

“Let’s pretend that you are a computer and that to store data in your memory you use sheets of paper. If to calculate the primes between 1 and 1,000,000, you need 200 reams of paper (10,000 sheets), and with the algorithm proposed by Helfgott you will only need one fifth of a ream (about 100 sheets),”

That’s a drastic difference, get ready for some new primes (and maybe new problems).

r • September 26, 2016 9:00 PM

@Clive, CC: Those with legs to stand on

https://science.slashdot.org/comments.pl?sid=9703047&cid=52966265

Currently top post in the Prime thread, “UnknownSoldier”.

Looks like a wanton code-cutter to me, what do you think?

I think the algorythm is pretty self-explanatory, we should have more than enough to reimplement in a ram-limited fpga or cell architecture with only the english provided.

Likely exclusionary (we are seeking primes after all), and we’d be able to figure it out very quickly while visually tracking a “curved” plot for estimates.

Moe J • September 26, 2016 9:31 PM

@r

I think the algorythm is pretty self-explanatory, we should have more than enough to reimplement in a ram-limited fpga or cell architecture with only the english provided.

I have it on good authority, from an uncle in Wyoming, that hand-waving is Italian, not English.

Figureitout • September 26, 2016 10:43 PM

Clive Robinson
The solution back then as it still is is to “divide and conquer” which we call “pipelining”
–Based on how I’ve learned a bit about pipelining, I wouldn’t call it that (how it’s implemented). I’d call it “instruction compressing” or something like that squishing more instructions into different stages of processing. Some of the descriptions of pipelining makes it sound like purely a parallel process, I need to study “4 core” CPU’s and the like more, but I would guess it’s probably dedicated CPU’s for most common instructions, probably still a bottle neck when some kind of control unit sends the machine code to be processed to ALU. That’s the real magic of CPU’s to me now, ALU’s and control units, how to decide what to send to ALU, not the various registers storing things (but you need them).

The only way I’d really want a CISC CPU is for small small ones, my prof made the point well enough, insane complexity and they usually use microcode out of reach to the programmer (there’s your backdoors) and multiple buses for performance. Here Ken S. and Co. say they can monitor the microcode of the Xerox Alto using a logic analyzer, in theory you could do that w/ some modern chips no? http://www.righto.com/2016/09/restoring-ycs-xerox-alto-day-8-it-boots.html

I don’t think Wintel is losing too fast, how do 99% program FPGA’s? With Wintel w/ the massive toolchains that make IDE’s look lean. How about vast majority of all other chips, Wintel again. People don’t bust out their Android desktop to program, and coding on a mobile device isn’t real coding but it’s annoying if the lines are too long and you have to scroll a bunch to side. I’d just do that to review and read code. I think most people get the best work done sitting up (maybe standing) on a laptop or desktop, not squinting at a tiny screen, and a keyboard/mouse. That’d better not change b/c it’d look stupid and would suck.

the real question is where are the sequential “artisan” programers going to go as the parallel “engineers” work their way up the computing stack, sweeping all before them?
–Haha, man quite the prediction. Sounds a little bitter/jealous or something. Let’s get the chips first eh? Let’s see it. I know you won’t be designing them b/c you don’t know how, but where’s the 100 CPU’s working in parallel? Not “pipelining”, truly parallel. How do you deal w/ the bottleneck of sending the instructions to each CPU and put the logic back together? Let’s debug the hardware issues before letting the programmers at it. You think we don’t wanna learn parallel programming either? I’d rather learn that than Rust or Go. Also we’d need the proper tools to track each of the CPU’s, something that can send I guess software interrupts to 100+ CPU chips, halt them and track all those registers (like what, at least 32 for each CPU?).

r • September 26, 2016 11:06 PM

@Moe J,

Point taken, you’re right. So is Ab, for both his direct and indirect statements. I have a firewall to configure and a couple other things to setup I’ll go play with that.

If it’s any consolation Moe, I can’t implement Shamir’s without code cutting; it seems I don’t understand Math or really anything outside of basic simplified logic.

Nick P • September 26, 2016 11:09 PM

@ r

I was hoping it was Hyper-V they were using. Good it was. That’s the one they’re verifying down to C and ASM code. It might end up stronger than say a Xen-based solution. At the least, the security will steadily improve since they’re investing in it.

Curious • September 26, 2016 11:51 PM

The slashdot article mentioned about links to the following article in Scientific American:

“New Take on an Ancient Method Improves Way to Find Prime Numbers”
http://www.scientificamerican.com/article/new-take-on-an-ancient-method-improves-way-to-find-prime-numbers/

“But Helfgott, 38, went even farther back in time and conceived an improved version of the sieve of Eratosthenes, a popular method for finding prime numbers that was formulated circa 240 B.C. Helfgott’s proposed version would reduce the requirement of physical space in computer memory, which in turn would reduce the execution time of programs designed to make that calculation.”

I am no expert, but I can’t help but wonder if this is something the NSA would perhaps already know from beforehand.

Q: Does this piece of news mean that factoring of prime numbers are relatively much faster than what was previously known, and does it matter?

65535 • September 27, 2016 1:01 AM

@ Grauhut

“Add 5] Botnet drone rental service that is angry as hell to have lost a really big wholesale customer”

That is an interesting thought.

You are saying like a really big whole sale customer… say on the nation state actor scale?

Clive Robinson • September 27, 2016 1:45 AM

@ Curious,

Q: Does this piece of news mean that factoring of prime numbers are relatively much faster than what was previously known, and does it matter?

I suspect the answers are No and No.

Grauhut • September 27, 2016 1:46 AM

@65535: No, in the actual Krebs case i thought of vDOS as the customer that got lost.

https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/

And if there is one botnet known to be large enough for the DDOSes seen, than ZeroAccess.

If vDOS was a paying ZeroAccess customer (speculation) and since ZeroAccess has another open bill with Krebs i believe they could be the cause of these record breaking packet floods.

http://krebsonsecurity.com/2013/12/zeroaccess-botnet-down-but-not-out/

Nation states dont rent botnets, they take over. 😉

Grauhut • September 27, 2016 1:51 AM

@r, Nick: A protected browser for enterprise customers only doesnt help the rest of the world not to become trojanized. 😉

“Application Guard will also only be available to users of Windows 10 Enterprise, with administrative control through group policies.”

Rollo May • September 27, 2016 2:01 AM

for w$ndoze users, only a few days left to install the individual security updates of your choice before MacroHard force monthly bulk updates from October that remove all individual choice including options like switching off telemetry

these two FOSS’s might be OF help

autopatcher.net

&
WSUS Offline Update

http://download.wsusoffline.net/

free software allows any update to be installed offline without connecting to the interwebs.

Apparently macrofloppy officially approve of the latter, which is a bit against the mission statement

Curious • September 27, 2016 3:47 AM

I wonder if it is likely/possible to take over someone else’s botnet. 🙂

Admittedly, I am not sure how much sense that question is though, as I don’t rally know how a botnet works.

Curious • September 27, 2016 4:12 AM

Someone on twitter seemed to laud Switzerland for how they came up with the legislation, but I think it is terrible, and probably prone to abuse:

As if wanton monitoring (the tech aspect) and surveillance (the political aspect) in a society isn’t bad enough.

“Switzerland will notify citizens when they have been spied on under new surveillance laws”
http://www.telegraph.co.uk/technology/2016/09/26/switzerland-will-notify-citizens-when-they-have-been-spied-on-un/

Assuming that what is in that article is factually correct, I find the following potentially disturbing:

Under an “obligation to inform the person surveilled”, the SRC, the Swiss intelligence agency, must contact anyone who has been monitored within a month after surveillance ends, giving them details about how and for how long they were watched.

Well, either, the issue at hand is ‘monitoring’, OR, ‘surveillance’, OR both! Because of how both cases can be true as I see it, the legislation as I roughly interpret it, is deeply flawed and probably irresponsible. “Surveillance” as a name might as well become the thing that make any interpretation of an action or intent, into a game of characterization in which distinctions could be made impossible because of how incongruent it would be by being vague in describing something or explaining something.

The SRC must also tell a suspect why they have been monitored,(…)
Already in the next sentence, the confusion is there, but nobody lacking the conscious about the difference would probably care.

Ni3mand • September 27, 2016 6:43 AM

@Curious

I wonder if it is likely/possible to take over someone else’s botnet. 🙂

Most assuredly possible if you happen, for example, to take over the “command and control centre” of the botnet, whatever that might be (a certain IRC channel, shall we say).

Someone on twitter seemed to laud Switzerland for how they came up with the legislation

Right-wingers, why. Quite expectable of them.

James Jeebus Anklebiter • September 27, 2016 10:17 AM

@Curious

within a month after surveillance ends

Let no one say that Swiss lawyers have no sense of humor.

Jacob • September 27, 2016 11:41 AM

MS just announced the availability of Win Server 2016. They claim that it can run shielded VM which is protected from a malicious admin who has supervisory credentials to the machine.

See 15 min intro video here:
https://sec.ch9.ms/ch9/c198/dbc5b17b-7ba3-4701-93a0-57ebd9d5c198/introductiontoshieldedvirtualmachines_mid.mp4

I fail to understand how one can block a malicious admin from getting into the guts of the machine and grab whatever credentials the VM owner had put in there to protect his stuff.

Nick P • September 27, 2016 11:52 AM

@ Grauhut

“”Application Guard will also only be available to users of Windows 10 Enterprise, with administrative control through group policies.””

Ohhh shiiit! Good catch! Oh, it will help them if they pay out the dough like many Windows hackers I’ve met do. They make the server-style stuff their desktops since they need the extra capabilities. Thing is, most aren’t dropping a few grand a desktop. End result is as you predicted.

Their prior works were interesting, though. Those were Gazelle Browser and Xax for plugins. Maybe should integrate that stuff with Edge, Hyper-V, and POLA tech they have.

Don • September 27, 2016 9:33 PM

@ r

you wrote to Jim N

“So you’re suspect to me as I’m sure if you’re on the other side of the rail yard I’m likely not AOK with you.”

thanks for calling this out. It’s important we know who is who.
Jim N only a week or two ago made it clear that ‘Snowden is a traitor’

It’s important we real live human beings here know he/she feels that way, too

K-K00l • September 27, 2016 9:37 PM

interesting short piece here by Protonmail about the recent yahoo breach

https://protonmail.com/blog/protonmail-security-advisory-regarding-
yahoo-hack/

did it occur to any, this is an possible way to get around the legal issues on warrant canaries (they are outright declared to be illegal in some countries)

Yahoo say on their log in page ‘we were breached by a state level adversary in late 2014 and they compromised everyones password’

What if they mean the NSA?

Paris Sister • September 27, 2016 9:46 PM

Can any one help with sourcing a list of the important individual security updates/patches for Windows pre-10, that it is important we source before October rolls around and we won’t have a choice as to what individually goes in or out?

my updating has been switched off but it’s good to be sure any security related patches are picked up in time. I can’t track down such info.

thanks!!

Nick P • September 27, 2016 10:25 PM

@ Grauhut

Is there any review by expert breakers showing that EMET actually improves things a lot?

@ Clive Robinson

It’s the closest thing to your model in terms of number of simple cores running independent programs. I still challenge you to find one of those that monitor processors on the chip to find what kind of resources that requires. There will be significantly less than 1000 processors after that silicon is spent. It’s still open what the final number or performance will be.

ab praeceptis • September 27, 2016 11:58 PM

Clive Robinson

Thanks for the link to the 1k-core processor.

Unfortunately, it says regrettably little tangible. What’s the width of the bus and the registers, ALU etc.? Or even what’s a core? All in all I take that as a typical “Miracle/major breakthrough at <insert university>” case. Lots of noise, little tangible details.

It is also often assumed, it seems, that parallelizing algorithms somehow magically makes things faster. Well, it doesn’t. I’m thinking, for instance on classical decidability problems I know from static verification. This applies to parallelization, too, to a large degree (plus some more issues). Also, the scientists and engineers at intel and others aren’t idiots. Granted, they are hapered in a major way by the need to stay within the x86 architectural jail cell, but still there are major problems each of which took them many years to achieve progress.

Let’s assume that thing has a mem. bandwith of 25 GB/s. Let’s also – very positively – assume that the internal bus issues are not just linear (which they are certainly not) but even zero cost. Which gives each core 25 MB/s bandwidth – not exactly promising.

To put it bluntly, it might quite often be more attractive to just bring up an array of, say 128, 8 core Arms. Lots of advantages like COTS, well known and understood hardware design, lots of tools both for hw and sw design, lots of companies who could create and produce such a board, ridiculously cheaper. Yes the electricity bill will be higher than with the miracle chip but that will more than easily be offset by other cost factors.

Grauhut • September 28, 2016 1:15 AM

@Nick: EMET is not a sandbox (as in sandboxie) but very useful for enforcing security relevant functions.

http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/

Nothing in the M$ Security world is perfect, but at least they continuously work on it…

“EMET bypasses have been seen in research and past attacks [2, 3, 4, 5, 6, 7, 8]. Generally, Microsoft responds by changing or adding mitigations to defeat any existing bypasses. EMET was designed to raise the cost of exploit development and not as a “fool proof exploit mitigation solution” [1]. Consequently, it is no surprise that attackers who have read/write capabilities within the process space of a protected program can bypass EMET by systematically defeating each mitigation”

https://www.fireeye.com/blog/threat-research/2016/02/using_emet_to_disabl.html

I wonder why it never became part of the os distribution media. 🙂

Slime Mold with Mustard • September 28, 2016 5:52 AM

Bruce gets quoted in this YAHOO article. It seems the DNC hack now extends to phones.

“In a sense, your phone is your office brain,” said Bruce Schneier, a cyber security expert with Resilient, an IBM company, which is not involved in the investigation. “It’s incredibly intimate.”

“Anything that’s on your phone, if your phone is hacked, the hacker can get it.”

Of course, it would not have to be a state level actor if idiots were backing up their phones on networked machines. I outlawed that where I work years ago, but stupidity is an APT.

Curious • September 28, 2016 6:58 AM

Off topic I guess:

Another court in norway has recently declined to start a case, presumably about making it clear if Edward Snowden ultimately faces extradition to USA should he ever visit or considering visiting norway. If local authorities already have somehow made up their mind, they apparently aren’t willing to talk about it.

I can’t help but being a little cynical here, and I guess I would wish that one at least also considered the possibility of local authorities arresting or aiding/allowing the arrest (or worse) of Snowden outside norway (in international waters maybe), or if by allowing local airspace or surface/ocean area beneath the surface to be used for transport of Snowden for whatever reason.

It is expected that the high court will later be solicited for making a judgment of sorts.

One problem seem to be that Snowden risks not getting a fair trial, if he is simply extradited with speed. It has been pointed out, that §5 in the extradition treaty would prohibit extradition on grounds of political crimes, or something like that.

Ninho • September 28, 2016 7:00 AM

Correction/addition to my earlier post with hints about setting up “onionmail” on MS-Windows.

In the above post I stated Thunderbird could not do remote DNS resolution through Tor’s built-in Socks, and suggested using Sockscap (or similar) as a remedy in order to “socksify” thunderbird.

Actually as I have now found, Thunderbird has a preference “network.proxy.socks_remote_dns” accessible in Advanced…Config editor…

That preference could be toggled to “true” and then thunderbird configured to use the local Tor’s Socks v5 proxy, as a simpler alternative to using sockscap or similar socksifier.

Sorry for not mentionning this possibility earlier : to my discharge, I had never used thunderbird before.

Still eager to hear more of your opinions on the Onionmail system ! Not sure whether I have provided this rather extensive explanation page before :

Nick P • September 28, 2016 10:36 AM

@ Grauhut

Remember that Microsoft’s continued billions come from lock-in. Backward compatibility with key apps or features is very important for that. If EMET breaks apps, then that would itself be justification for making it optional. IIRC that happened with No Execute as well.

Wael • September 29, 2016 1:48 AM

@Clive Robinson,

You will probably enjoy reading this,

Hard to predict[1] the future 🙂

[1] Is that redundant?

Clive Robinson • September 29, 2016 5:15 AM

@ Wael,

Hard to predict[1] the future 🙂

Oh I don’t know it depends… For instance if you find you are hanging on by one hand to the end of a rope one hundred or so feet off the ground with nobody around your immediate future is basicaly one of up or down. And if down, then it’s reasonable to assume you won’t be walking away from it if you are any heavier than the average domestic cat…

That sort of situation aside it gets harder, but physics is a harsher mistres than insomnia, and more relentless than the IRS, so the more you know the easier things are to predict. It’s why I don’t believe in “Acts of God” or for the heretics “accidents” only “lack of knowledge / judgment in a timely way”.

But you might have noticed I also hedged my bets with “probably”. The problem is now you being the contrarian you are, you have spiked the odds… 😉

That’s my Get out of Jail Free card and I use it shamelessly 0:)

Clive Robinson • September 29, 2016 5:31 AM

@

To a layperson computer generated text looks good. Is there a Turing-like test for computer generated articles or books?

No and yes.

No because a Turing test is interactive and you are only reading a tract of text.

Yes because there are ways of testing tracts of text to identify the author. Although there are programs that can imitate an authors style, it only goes so far. Things like “humour” and “experience” do come through, partly as style partly as idiosyncratic behaviour.

Some around here have noticed I have a multilayered sense of humour that includes sometimes subtal word play, through to more risque jokes that once “shocked the Moderator” for which I got a yellow card… They have also noticed I have a somewhat eclectic experience thus viewpoint.

I’m told that both are still beyond computer facsimile, however I suspect it will not be long before some bright spark gets close enough to reach the 50:50 mark. Which is rather worrying when you think what that means with respect to fraud.

Curious • September 29, 2016 5:44 AM

From the Wired article that Clive Robinson linked somewhere above:

“Of the first 10 numbers, for example, 40 percent are prime — 2, 3, 5 and 7 — but among 10-digit numbers, only about 4 percent are prime.”

What? Assuming the quoted fact is true. I thought about every third number would be a prime number on average.

I did not expect this (not that I am a scientist or anything), I guess I assumed that the distribution of primes would be more or less equal forever as the numbers grew larger.

Is factoring large prime numbers with speed a hard problem, or is it some convenient illusion for the people in the field of cryptography, believing simply that factoring large primes could maybe be a hard problem?

ab praeceptis • September 29, 2016 6:58 AM

Curious

“Prime number distribution” – Yes, the gap between consecutive prime numbers get indeed larger as the numbers get larger. A widely used and simple (and usually good enough) approximation for that gap is log(N), where N means “all positive Integers up to N”.

“factoring Prime numbers” – Possibly a misunderstanding but: Prime numbers can’t be factored; that’s their very definition (“A prime number is any positive integer which can be divided only by itself and 1”).

ab praeceptis • September 29, 2016 7:02 AM

Curious

Apologies, I forgot to mention something that might be relevant for you: In the first part I should have written “the average gap” because it’s indeed an average. In fact, there are relatively many (even immensely big) prime numbers very close to each other while others are “lightyears” apart.

Clive Robinson • September 29, 2016 8:42 AM

@ Curious,

With regards the density of primes falling have a think how the basic sieve of Eratosthenes works,

You first find the first prime which is two and strike out every multiple of it. Which halves the numbers from that prime upwards.

You then find the next non struck out number (ie three) which thins the numbers above further.

You loop around finding 5,7,11,13… Each time you thin out the numbers above. So logicaly the number density is lower above each prime than below it.

However there is some fun involved.

If you multiply the primes you find by each other forming a prime factorial then there is a high probability that the number either side of this even number is prime… Which gives you the “Twin Primes”. But if you draw a number line and plot the primes you will see a pattern that is if you take 30 it has the twin primes 29,31 if you count down from if you count up from 30 thirty where you find primes will fall in the same place as those primes starting from the first primes. Where primes are not found is because they have been struck out by larger primes. That is if you imagine each prime is a wave that crosses the number line at a multiple of it’s self to infinity you will see why there are Twin Primes etc.

The unanswered question is are there an infinite number of twin primes… Sofar the belief without proof is yes.

https://en.m.wikipedia.org/wiki/Sieve_of_Eratosthenes

JG$ • September 29, 2016 10:09 AM

stumbled into this:

http://www.safelogic.com/info/dispersive-technologies-secret-weapon-for-fips-140-2/

I am not endorsing it or them, but wonder if they have anything worthwhile and whether it is in the master compendium.

For the record, pointing out the Nazi origins of VW was a cheap shot, but also a useful reminder of history. IBM had a thriving business in punchcards for tracing ancestry, Bush I’s grandfather was sanctioned for investing with the Nazis (at least a tenuous tie to Zyklon B) and numerous US political and corporate leaders openly admired Hitler and his successes. There is plenty of blame to go around and using slave labor where required by law is a lesser crime than many others.

Ted • September 29, 2016 12:29 PM

“Recently, the Internet Security Alliance (ISA) released Social Contract 3.0: Implementing a Market-Based Model for Cybersecurity at its 15th Anniversary Conference. Written by experts from a variety of industries, including Utilidata CEO Scott DePasquale, the book seeks to provide a systemic framework for collaborative action on cybersecurity, integrating public policy and economics.”

“Mr. Scott DePasquale, also an ISA board member, authored the chapter focused on ‘Cybersecurity in the Power Utility Sector’, addressing the challenges associated with protecting an electric grid that is increasingly connected and difficult to defend.”

““The hack of Ukraine’s power grid that resulted in a blackout affecting 225,000 customers was a game changing attack that sets a threatening precedent for the security of the U.S. power grid.” said DePasquale.”

“Recommendations to mitigate risks within the power utility sector include, among others, enhanced information sharing between utilities and the Federal Government, reforming the clearance attainment process for private sector executives, and encouraging public-private collaboration to manage the risks that can be posed by the introduction of third-party vendors.”

http://www.businesswire.com/news/home/20160928005931/en/Internet-Security-Alliance-Releases-Cybersecurity-Framework-Government

Ratio • September 29, 2016 10:41 PM

@ab praeceptis,

Prime numbers can’t be factored; that’s their very definition (“A prime number is any positive integer which can be divided only by itself and 1”).

Again? The number also has to be greater than 1 for it to be prime.

Figureitout • September 29, 2016 10:54 PM

RE: kilocore
–Wow, all independent clocks, and memories; and so low power. Well the hardware’s here (though bet there’s still plenty hardware bugs lurking, especially when you try to use it more). Still don’t get the beginning fetching instructions, how that’d be parallel, probably some hard-coded logic that fetches bits from ROM, then how that all stays synced so true parallel operations can happen. Being introduced to branch prediction, (thought there’d be a lot of bugs there) maybe we can do something similar w/ predicting how much CPU’s are needed for fastest operation (but probably costly to calculate that, most likely need a memory read-write-read, doing that constantly and each processor reading that one spot or multiple spots copied simultaneously to be little faster). To program, the paradigm shift is programmer must calculate how much CPU’s they need, even though some dynamic mapping seems possible (avoiding damaged processors would be a very nifty feature).

I want to make a few of my own single core processors and ISA’s etc. Can’t wait to do multiple cores!

Wael • September 30, 2016 1:31 AM

“True” AND “True” = “True”

Therefore:

which can be divided only by itself and 1″ implies that 1 is not a prime.

Does not imply 1 isn’t a prime because the “and” in the quoted block holds true for “1” and “itself”, which happens to be a 1. The “and” does not imply “1 != itself”, so that condition isn’t excluded.

Wael • September 30, 2016 1:59 AM

@Clive Robinson,

physics is a harsher mistres than insomnia

Then you don’t know insomnia. I’m sure you know physics, though!

The problem is now you being the contrarian you are, you have spiked the odds… 😉

Keeps you on your toes 🙂

But you might have noticed I also hedged my bets with “probably”.

I have noticed! I also noticed that I also frequently use the words: ‘probably’, ‘perhaps’, and ‘maybe’ — they are my out of jail cards too after lessons learned in the past. My eyes are dilated and aren’t feeling too well, so I’m skipping the links… I don’t feel like taking a vacation at an “eye-candy timeshare” 😉

Wael • September 30, 2016 2:02 AM

@IanashA_titocIh,

Is there a Turing-like test for computer generated articles or books?

Read the article. Not sure such a test exists. Actually, I’m not even sure I understand the question 🙂

ab praeceptis • September 30, 2016 3:14 AM

Wael

This is getting ridiculous. What I wrote was not a logical proposition but an explanation for someone not firm in math. “and” has more meanings than the strictly logical one. For normal people it typically means “one as well as the other” or “both”, and the two not being the same. To make a cake one needs butter and flour, i.e. both (which are not the same). Context is important in communication. If, however, two eggs are need one doesn’t say “an egg and an egg” but “two eggs”.

A propos context: What some here pick on was said in the context of friendly helping out someone with an explanation. More precisely, the context was an answer to the question wether it’s expensive to factor large prime numbers. My answer was a friendly and hopefully helpful reply and not a vital statement in a master thesis in math.

Curious • September 30, 2016 3:45 AM

It just dawned on me that, hacking cars, would be truly terrible if deployed as a stationary point in front of the car (and maybe being remote controlled to select a particular vehicle). Because the short range between the car and the equipment used to hack a car at speed where the car would be especially vulnerable if the driver looses control of the vehicle. Fairly obvious, but this thought didn’t strike me until I saw some news clip about the danger of a car’s computer(s) being hacked into.

Ratio • September 30, 2016 3:49 AM

@ab praeceptis,

A prime number is any positive integer which can be divided only by itself and 1

The last bit (which can be divided only by itself and 1) does not exclude 1, because the definition doesn’t require the divisors to be distinct.

[Oh, right, @Wael already told you that…]

For completeness, a precise definition would mention that a prime number has no positive divisors but 1 and the number itself (otherwise there would be no primes at all).

Ratio • September 30, 2016 4:56 AM

@ab praeceptis,

[Dunno how I missed this earlier…]

This is getting ridiculous. What I wrote was not a logical proposition but an explanation for someone not firm in math.

And someone like that doesn’t deserve a correct explanation? Besides, we’re not talking advanced math here; little kids learn this stuff.

What some here pick on was said in the context of friendly helping out someone with an explanation.

Last time you used the same definition to point out mistakes people make for lack of precision (and not exactly by using the definition as an example of this phenomenon either).

Both times you presented your definition as a definition, not as a somewhat simplified or imprecise explanation.

When I remarked that the number has to be greater than 1 to be prime, you said that is implied by the wording of your definition. You didn’t see the problem, at all. And why would you? You used that same definition last time when the context was precisely… rigor.

Wael • September 30, 2016 5:02 AM

@ab praeceptis,

This is getting ridiculous

Yep. My comment wasn’t about primes — it was about the logical statement you used.

For normal people it typically means “one as well as the other” or “both”

There is no such thing as “normal people”. There is a thing called precise mathematical definitions. If we deviate from that, we ask for trouble. This happened a while back here when we talked about “random variables”.

A proper definition such as the one on Wikipedia is a good one. There is a reason 1 is specifically excluded. A mention of the fundamental theory of mathematics should suffice to explain why 1 isn’t considered a prime (nor a composite) number.

Context is important in communication

Not in this case. Try that statement on a math exam. Eggs?

Ratio • September 30, 2016 5:37 AM

@Wael,

A mention of the fundamental theory of mathematics should suffice to explain why 1 isn’t considered a prime (nor a composite) number.

The fundamental theorem of arithmetic.

Not to say that I wouldn’t love to hear anything you have on this fundamental theory of mathematics you mention! 😉

Czerno • September 30, 2016 7:00 AM

Sheesh ! The “Allowed HTML” tags for italics at least do NOT work as advertised on this blog !

PLEASE MODERATOR remove the preceding wasted essay!

Whether “1” is considered a “prime number”, or not, is a matter of ‘definitions’ (and so-called ‘axioms’) – and fundamentally a choice made for convenience of the developments of a theory. It does not matter which definition is adopted, provided one is consistently holding to one’s, and then it is best if one adheres to a common definition if possible, in order to facilitate communication inter mathematicians.

The usual, modern definition of a prime (whole, positive) number does indeed exclude the “number” one, and does so explicitly (i.e., it’s not a fact one has to prove true, aka a theorem, instead it’s part of the definition). But such has not been always the case !

Formerly, like in the 18th and 19th centuries, the preferred definition included ‘one’ in the primes.

Back to Euclides – the father and master of the science of numbers (arithmetic) as well as figures (geometry) – according to HIS definitions, ‘one’ is not a prime number, but for reasons DIFFERENT that it is not prime according to a modern student of math. Namely, according to Euclides’ definitions, the MONAD, aka unity, ‘one’ is NOT A NUMBER. Numbers, according to the Ancients, started at ‘two’. Of course this choice of definitions does NOT make Euclides’ arithmetic less rigorous, because he has stated his definitions carefully and consistently adheres to them.

However it does make the exposition more laborious, because oftentimes Euclides has to state (and prove) essentially what we would consider ‘the same’ theorem twice, as two propositions, once for ‘numbers’ and a second time for the ‘monad’. This is of course the reason the modern definition of ‘whole’ numbers includes 1 (and zero, which was not considered a number before late in the middle ages).

Clive Robinson • September 30, 2016 7:22 AM

@ Ratio, Wael,

The simple answer is “it’s axiomatic”, “convention” or because it does not break other mathmatical conventions or theorems[1].

Further one devides all “natural numbers”, where as primes only divide their multiples. Which of course is based on the assumption that “natural numbers” are the object “counting numbers” thus does not include “0”.

However, there are two common conventions for the set of natural numbers.

The first or traditional convention that zero is not in the set of positive integers {1,2,3,…} and goes back long before the idea of zero. The second is zero is in the set of non-negative integers {0,1,2,…} which only came about in the nineteenth century.

However just to rub salt in things, any computer scientist can tell you that there are actually two zero values with simple signed bit numbers. Those who play with hardware can tell you of other zero values…

[1] One such is the “Theorem of Arithmetic”, which states that all integers greater than 1 can be expressed as a unique product of prime numbers.

JG4 • September 30, 2016 8:50 AM

I rather fancy the appellation JG$, but it was just a typo. Another typo was where I accidentally linked this blog, rather than nakedcapitalism for the morning newsbeat

http://www.nakedcapitalism.com/2016/09/links-93016.html
…
Big Brother is Watching You Watch

Hackers Infect Army of Cameras, DVRs for Massive Internet Attacks Wall Street Journal
http://www.wsj.com/articles/hackers-infect-army-of-cameras-dvrs-for-massive-internet-attacks-1475179428

Yahoo says hack of 500 million users “state-sponsored,” but a security firm calls bullshit Boing Boing (resilc)
http://boingboing.net/2016/09/29/yahoo-says-huge-hack-was-sta.html

Amazon Algorithm Makes Decision about WOLF STREET, Hilarity Ensues Wolf Street (EM)
http://wolfstreet.com/2016/09/19/amazon-associate-program-algorithm-makes-decision-hilarity-ensues/

Sancho_P • September 30, 2016 10:45 AM

@Clive Robinson, re “cars that kill people”
https://medium.com/%40lux_capital/why-we-should-adopt-driverless-cars-that-kill-people-9284f325ced0

An interesting smokescreen, probably written by AI? 🙂
No, the article is spot on but unfortunately not only sticks to the term “driverless car” but also seems to favorite the meaning.
This is a disaster.
That’s not because cars sometimes kill people (this might be an advantage),
it’s because eliminating the driver will dramatically increase social unrest
by shifting lowest income to shareholders and decrease transportation costs.
Going completely into the wrong direction.

We may talk about driver assisted cars, but we need the responsible driver.
Mankind is built to work. People need work. Even paying people to stay at home (unconditional basic income) would topple our society.

Wael • September 30, 2016 5:25 PM

@Ratio,

For completeness, a precise definition would mention that a prime number has no positive divisors but 1 and the number itself

Ratio? You still need to exclude “1”, my friend. Why is it so hard to stay pleasant these days? 😉

ab praeceptis • September 30, 2016 9:33 PM

Czerno

Indeed. We don’t like definitions that are, to exaggerate somewhat for the sake of clarity, valid for any x ∈ {335..14728}. We strongly prefer the universe to be something like N.

And still allows for lots of “fun”. Depending on the system one works with N may start with 0 or with 1 but there is usually “companion N”. For a N starting with 0, the companion N might be something like N+ (meaning N starting with 1) or N0 (meaning an “extended” N including 0).

Moreover it was an arbitrary context interpretation of a certain group here (that strongly objected to be called a group) with the clear intention of going against someone hey dislike.

Fact is that my statement was made in the context fo a friendly response to a question by someone who asked how expensive factoring large primes is. There was every reason to assume that a simple explanation was required.

The wikipedia knowledge level also shows by a certain posters supersmart remark that the divisor must be ∈ N+, too. I wish him good luck finding a number ∈ N+ that has no positive factor but a negative one and hence brings up the question whether it’s to be considered prime or not.

You bring up a valid and interesting point re 18th/19th century (in which after all the very foundations for much of todays math were built) considering 1 a prime number.
I find that interesting mainly for two reasons:

Many today (wikipedia dogmata age) forget that an axiom isn’t the analogon of a proof but of a conjecture. It comes down to saying “let’s agree to furtheron …”. Second, an maybe more importantly, the whole “precision” fuzz about prime definition is largely arbitrary, both theoretically and practically. Theoretically because, if 1 were prime, so what? That wouldn’t change the primeness of any other prime. Practically because 1 being prime or not is irrelevant for all practical purposes; after all any real action (e.g. crypto) is in the large primes.

And indeed and certainly not coincidentially one of the discursive hot spots re 1 being prime or not happend to be around the discussions around set theory with one preferred opinion that 0 should be analogous to the empty set (i.a. for reasons of set power).

tyr • October 1, 2016 2:34 AM

I’m surprised there are so many platonists
in the math sense here. Godel should have
converted your certainties to tendencies
a few years ago.

@Clive

Is that a call for Butlerian Jihad or just
another attempt to muddy things up with a
law writing commitee on AI ?

The way people ‘think’ about themselves has
always been wrong in the past and shows no
signs of suddenly stumbling onto eternal
truths. You can always tell any argument is
wrong by this indicator though “it would be
the end of society as we know it”. Every
time that chestnut is dragged out you know
their fears are vaporware or CYA.

The gene sequencer may have destroyed vitalism
decisively but advocates of humans are some
way magically different just returns in a new
load of BS (belief system).

Any comments on the handing over MANPADs to
the moderate Syrian rebels ? I can’t think of
a better way to make us all secure !!!

Clive Robinson • October 1, 2016 8:58 AM

@ tyr,

MANPADS to Syria

The aim of the US idea to send MAN Portable Air Defence Systems to Syria is “not too” that is it’s a poker stakes bid opener.

The advantage that Syria + Russia have over the “freedom fighters” is unrestricted air warfare. Syrian pilots just have to fly above small arms range and drop barrels of scrap iron wrapped around explosives out the back of helicopters on civilians to go home and get a hero’s welcome and medal. Much like US/UK Drone pilots do just down the road. The difference is that the Syrian way is dirt cheap and currently fairly safe.

The US figure that if the “freedom fighters” were to get their hands on MANPADS in sufficient numbers then the Syrian pilots will desert, and the Russian people will remember the chopping off of Russian pilots testicals by the Afghan wives who then pushed them down the pilots throats to stop them screaming as they died as emasculated fools in searing agony. Thus repeating the “Russian Vietnam”, which would turn many Russians against “the war of fools” in Syria.

Thus Syria has to fear the loss of it’s only viable way at getting at the “freedom fighters” and those UN and others giving them humanitarian aid, thus stopping Syria’s siege tactics of “starve to death” being effective. And Putin has to face a possible back lash from it’s people.

But ask the question of if Putin cares? Well Turkey’s Erdigon got pissed with Russian Pilot behavior and shot down one plane, and aside from the usual “mouthing off” from Russia, they did change their behaviour.

Russia are also at a bit of a disadvantage currently because of the shooting down of the civilian passenger jet by trigger happy idiots in the Crimea. For all the Russian bluster and denial the evidence is very far from circumstantial, and unlike the Cold War days the Russian’s nolonger control the MSM spigot.

So from that aspect now is a good time for the US to raise the stakes, and make the Russian people start to put preasure on Putin.

But there is also A less obvious consideration which is China… It’s no secret that they are gearing up for conflict and part of this is due to oil from ISIS controled territory going out to Turkey and a sausage string of tankers to the South China seas.

Further it’s suspected that Russia and China are reforming old alliances in the face of what they see is weakening US Imperialism, and the US armed services going in the wrong direction technicaly (mega expensive carrier groups might fly the flag but with cheap drones / missiles with three to five times the range of the US aircraft or launched from subs the carrier groups are seen as sitting ducks)…

So there is an interesting set of problems the US is trying to negotiate their way through. The threat of taking Syria’s only advantage away, making Russia look vulnerable and China worry about oil and other energy resources, is from that perspective atleast worth using as an opening bid.

But… The Western fear of the past is “arming ISIS”, but that is to a certain extent not a simple issue to deal with.

In WASP nations we have the notion of “macho”, which is also called “biggin it up” or sometimes “respect”. Often those who don’t get the defrence they think they are due try to get it by material means. Which can be wealth, weapons etc.

Well supprise supprise in many parts of the Middle East people are given deference and authority by the power of the weapons they control. But a man with an RPG launcher is given little regard if he has no RPGs as it’s in effect not a powerful weapon but little more than a stick. This mentality plays out at some social activities, the man who can fire his AK47 many many times in the air is obviously a person of greater status thus deference.

So consider a MANPADS, it is a very powerfull weapon and earns it’s holder much deterrence and thus authority. If he uses it to try to shoot down a helicopter or plane then he is left with an empty fiberglass tube… Thus in using it the weapon looses all status thus power it had… Thus to quite a few people in the Middle East actually using such a powerfull weapon is virtually unthinkable…

So Putin having had a bid from the US can do one of three things, withdraw the vulnerable aircraft, decide that he can survive the backlash at home or just call the US’s bluff.

It’s almost certain that Putin will call the US bluff even if he knows the US is actually putting MANPADS into the area. He will wait untill they actually get used, not against Syrian but Russian forces. He will then play the “dodge game” untill there is a significant number of MANPADS deployed. Part of the dodge game would be to use Syrian forces as “cannon fodder” advance troops, so that Russian forces will face a depleated opposition etc.

It’s a dirty game but that is what it’s all about…

JG4 • October 2, 2016 9:01 AM

@Clive

I thought that the entire point of the Benghazi mission (staffed by “Ambassador” Stevens and his crew of “contractors”) was to buy up the MANPADS that previously had been distributed in Libya for redeployment to Syria. A further part of the very dark backstory was that some fraction of the MANPADS that were transshipped to Syria by way of Turkey leaked into Afghanistan and Iraq, where they were used to shoot down US aircraft. I am hoping that the next round of Wikileaks (aka “October surprise”) reveals what I already assume, which is that Hillary Klinton was neck deep in it and is dead to rights. Handing out these weapons to terrorists is a blatant violation of international law and US law. The current refugee crisis then is largely Clinton’s fault, as well as her coconspirators. I am confused why the Obama administration left Stevens to twist in the wind, but maybe he and the cash were bait for some elaborate intelligence operation. I’m not that excited about Donald Trump driving the bus, but up until last night, I had assumed that it was the more favorable outcome – the lesser of two evils as it were. Then, for the very first time, I contemplated the possibility that Hillary Clinton might do less damage to the US between 2017 and 2021 than Trump. That possibility never had entered my mind before, until I read Ben Hunt’s brilliant discussion in terms of game theory:

http://www.zerohedge.com/news/2016-10-01/virtue-signaling-or-why-clinton-trouble

I’m interested in voting with my feet, but Switzerland is too expensive. Are there any countries not run by war criminals that are affordable?

Slime Mold with Mustard • October 2, 2016 11:09 AM

@ JG4

You may find the following DIA cables of interest.
They are PDF and suffer serious black highlighter issues, but are really worth it.

This helps us understand Steven’s mission,

https://www.judicialwatch.org/wp-content/uploads/2015/05/Pgs.-1-3-2-3-from-JW-v-DOD-and-State-14-812-DOD-Release-2015-04-10-final-version1.pdf

This gives us the larger thinking:

https://www.judicialwatch.org/wp-content/uploads/2015/05/Pg.-291-Pgs.-287-293-JW-v-DOD-and-State-14-812-DOD-Release-2015-04-10-final-version11.pdf

I especially call your attention to paragraph 8 and the fact that it was written in 2012.

“Islamic State” – made in the USA. Thanks, Hillary.
http://www.salon.com/2016/03/02/even_critics_understate_how_catastrophically_bad_the_hillary_clinton_led_nato_bombing_of_libya_was/

Ratio • October 3, 2016 2:40 AM

@Czerno,

Formerly, like in the 18th and 19th centuries, the preferred definition [of primes numbers] included ‘one’ in the primes.

No, it didn’t. Yes, there were definitions that meant 1 was the smallest prime. (Even weirder, even 3 has been used as the smallest prime.) But saying that those definitions were somehow preferred is nonsense. The article What is the Smallest Prime? by Caldwell and Xiong (available from the Prime Pages’ FAQ) has details.

Namely, according to Euclides’ definitions, the MONAD, aka unity, ‘one’ is NOT A NUMBER. Numbers, according to the Ancients, started at ‘two’. Of course this choice of definitions does NOT make Euclides’ arithmetic less rigorous, because he has stated his definitions carefully and consistently adheres to them.

He didn’t consider unit (1) a number (see the first definitions in Book 7 of Elements), but what he means by that is a bit more subtle than what it sounds like. It’s still a number in the sense we use the word now, except it’s one so special that he treats it as apart from the others in some ways. But in his proof asserting there are infinitely many prime numbers (Proposition 20 of Book 9) he still uses the equivalent of the expression lcm(p1p2p3…pn) + 1. What does it mean to sum a number and unit?

(And yes, unless operations on numbers and the unit, as opposed to operations on numbers alone, are carefully defined somewhere in Elements, this does make it a bit less rigorous.)

However it does make the exposition more laborious, because oftentimes Euclides has to state (and prove) essentially what we would consider ‘the same’ theorem twice, as two propositions, once for ‘numbers’ and a second time for the ‘monad’. This is of course the reason the modern definition of ‘whole’ numbers includes 1 (and zero, which was not considered a number before late in the middle ages).

I have seen no indication of this. Could you point me to an example? (A scanned version of Heath’s English translation of Elements is available in three parts on Archive.org: introduction, Books 1 and 2, Books 3 to 9, and Books 10 to 13.)

@Wael,

For completeness, a precise definition would mention that a prime number has no positive divisors but 1 and the number itself

Ratio? You still need to exclude “1”, my friend. Why is it so hard to stay pleasant these days? 😉

Heh. 🙂 Yes, the word “also” was implied in that sentence, and maybe should have been explicit. (Then again, reading the comment that way means it’s incoherent: the parenthetical remark otherwise there would be no primes at all is false since -1 would now be a perfectly legitimate prime.)

@ab praeceptis,

Moreover it was an arbitrary context interpretation of a certain group here (that strongly objected to be called a group) with the clear intention of going against someone hey dislike.

Oh, give it a rest already!

Fact is that my statement was made in the context fo a friendly response to a question by someone who asked how expensive factoring large primes is. There was every reason to assume that a simple explanation was required.

Except you never told @Curious how expensive factoring large primes is in your answer in two parts: part one, part two. Plus what I said before.

The wikipedia knowledge level also shows by a certain posters supersmart remark that the divisor must be ∈ N+, too. I wish him good luck finding a number ∈ N+ that has no positive factor but a negative one and hence brings up the question whether it’s to be considered prime or not.

Consider the number 2. Is it a prime? You apparently think so. But its divisors are 1, 2, -1, and -2. Do you see the problem now? That’s what I was talking about.

Wael • October 3, 2016 3:03 AM

@Ratio,

Heh. 🙂 Yes, the word “also” was implied in that sentence

Clearly discussing “primes” is more expensive than factoring their products, i.e. Quantum-Cryptography-immune :/)

Ratio • October 3, 2016 3:06 AM

@Wael,

This is not quite right:

(Then again, reading the comment that way means it’s incoherent: the parenthetical remark otherwise there would be no primes at all is false since -1 would now be a perfectly legitimate prime.)

The no positive divisors but 1 and the number itself implies that the number itself is positive in any reasonable reading, I’d think. So scratch that.

ab praeceptis • October 3, 2016 5:42 AM

Ratio

“Except you never told @Curious how expensive factoring large primes is”

BS! If there weren’t other reasons that alone would be reason enough to ignore your attempts.

JG4 • October 3, 2016 6:03 AM

@Slime Mold – Thanks for the helpful input. Somewhere I have a handful of good newsclips, but nothing that leaves Hillary Klinton dead to rights.

I like the bit at the end about anti-Clinton people getting themselves in a lather about the pending Wikileak:

http://www.zerohedge.com/news/2016-10-02/wikileaks-cancels-highly-anticipated-tuesday-announcement-due-security-concerns

see also:

http://www.zerohedge.com/news/2016-10-02/new-report-exposes-orwellian-tools-law-enforcement-use-spy-activists-social-media

It will be ironic if I end up regretting that Hillary Klinton was so crooked that she put a more dangerous character in the driver’s seat, because I have been hoping that she gets caught and goes to prison for a long time.

Ratio • October 3, 2016 6:33 AM

@ab praeceptis,

“Except you never told @Curious how expensive factoring large primes is”

BS! If there weren’t other reasons that alone would be reason enough to ignore your attempts.

So provide a link to where on this page you told @Curious how expensive factoring large primes is, by which @Curious obviously meant “how hard it is to factor large numbers into primes”.

Between @Curious asking the question and me remarking that a number has to be greater than 1 to be prime you made two comments (one, two). One would guess if what you claimed happened did in fact happen, that would have been when.

When did you answer the question?

ab praeceptis • October 3, 2016 7:35 AM

Ratio

I did by explaining that primes can’t be factored. You are arbitrarily interpreting his question so as to fit your intentions.

Here is what he asked, I quote: “Is factoring large prime numbers with speed a hard problem, or is it some convenient illusion for the people in the field of cryptography, believing simply that factoring large primes could maybe be a hard problem?” (setting parts to bold is mine).

In his question the object of “factoring” was twice “large primes”/”large prime numbers”.

Curious • October 3, 2016 8:11 AM

I wish I never made that comment earlier, as it isn’t obvious to me what the benefit of using prime numbers are for applications of crypto.

I simply assumed that if there are relatively fewer and fewer prime numbers the larger a number sequence become, then maybe that would be bad for crypto.

ab praeceptis • October 3, 2016 9:40 AM

Curious

Every number is divisable. Some special ones (primes) are divisable by only themselves and 1. Most numbers, however, are divisble by more numbers; one could say that they are “composed numbers” in that they are the result of one or more multiplications (of primes, but don’t care for the moment).

So, 12, for example, seen from this perspective is “composed”, namely by 6 and 2 (6 * 2 = 12) but also by 3 and by 4 (3 * 4 = 12). But, and that’s important, both 4 and 6 are “composed” numbers, too, namely 6 = 3 * 2 and 4 = 2 * 2. Factorization is about the “final” components of which a number is composed which aren’t divisable any more (other than by 1 or themselves). For 12 that’s 2 and 3 (12 = 2 * 2 * 3). Those “final components” which aren’t divisable anymore (other than by themselves and 1) are called prime factors.

While this process of finding the primes of which a number is composed is simple with small nubers it qickly becomes extremely expensive with larger numbers because first one must find (often intermediate) components at all (like 6, an “intermediate component) and then the components of which those are composed (e.g. 2 and 3).
This is a more or less exponential process which means that it’s close to NP (given that the verification is a simple process), or in other, more mundane words “it’s extremely complicated and processor expensive enough not to be feasible in reasonable time”).

Moreover there are (for any large number) many potential candidates of components. This is easy to see when I ask you for the prime factors of 718829471638409. Given a number is sufficiently large, there is a very high number of candidates (roughly nearly as many candidates as the number itself) and, it’s also not reasonably (or not at all) feasible to keep lookup tables.

It’s however not a quasi random process nor a process that is of strictly linear high complexity because there are some smart approaches that often help to simplify a problem. To offer a very trivial example: If a number ends in 0 or in 5 than it’s obviously divisable by 5. Even simpler, any even number > 2 is divisable by 2, etc.

But even with those simplifications (some of which are not at all simple at first sight) one usually ends up by massive trial and error. A typical process would be to try for divisability by, say the first 100 primes.

To make it “worse” there is a very strong tendency for the number of components to increase along with the size of the number, i.e. a number with 5000 digits is highly likely to have more factors than a number with, say, 500 digits.

Understanding this it should become evident that factorization of very large numbers is a problem that is very expensive to solve as there are only so many simplification “tricks”. The decisive point is till today there is no way to simply check whether a large number is prime; there is no “formula” to tell of primeness.

Important sidenote: That in itself would be quite worthless for crypto if the problem of factorization would meet a second requirement, namely that of being what I mentioned in the context of “NP”. This is that one direction, namely the direction the opponent has to take, is extremely expensive while the other direction, often called verification, is very simple. Factoring a 5000 digit number, for instance, is very expensive; verifying, however, if the solution (the factors found) is correct is quite simple and cheap. That is a pattern you will very often find in crypto.

Moreover (but that is to be taken with a caveat because that statement is closely linked to the status quo of common processors and might change) multiplication (which is needed for trying for primeness) is one of the more expensive operations on common processors.

Regarding your last sentence: No, quite the contrary. It is advantageous for crypto that the relative density of primes gets lower when the numbers get large (because a low prime density in a given number range means a low hit rate).

Disclaimer for super-smart, wikipedia-savvy, picky people looking for something, anything to “prove” that I say wrong things: The above is not meant for math in university. It’s meant to be simple enough to help less experienced people getting a rough understanding of the problem domain.

David • October 3, 2016 1:28 PM

The people at blackboxvoting.org seem to believe that double-precision variables in voting computer software are part of an evil plot to make undetectable changes in election results. One would hope they’d have some experienced programmers on staff, but apparently not.

Clive Robinson • October 3, 2016 2:21 PM

@ Curious,

I suspect the question you are realy trying to ask is about factoring the product of –multiplying– two large primes PQ, as used bt the RSA public key algorithm.

The answer as @ab praeceptis is at pains to point out is a hard one. Part of the problem is that even quite large primes are not realy that scarce, thus the number of PQ products is actually quite high (there are two formula you can combine to give an approximate number).

Thus the odds of two people sharing just one prime “if and only if” (iff) the primes are properly randomly selected should be vanishingly small. The problem is as various scans of the Internet has shown it’s not in practice. That is it’s been found that between ten and thirty percent of PQ pairs on the likes of “Internet Appliances” have a common prime… Which is a bit of a problem as there is a very fast algorithm to find that there are common primes without the pain of factoring out any of the PQ pairs…

Thus the likes of the NSA can find which PQ pairs are going to produce the best set to factor. Having do one pair, the remaining PQ pairs are very rapidly factored giving a list of prime candidates to find other primes with. It is in effect a cascade process where each step produces less primes.

The reason this and other short cuts work is that the random selection process is anything but in many systems. Especially the likes of Embedded computer systems.

In effect their random number generation “lacks entropy” at startup and there is not ssufficient time between firat power up and the selection of prime candidates for the PQ pair. Thr NSA amoungst many other signals inteligence agencies will know this and will have characterized the random numbers used in such products to significantly reduce the number of candidates for factoring guesses.

There is also something called cryptovirology investigated by Adam Young and his thesis supervisor Moti Yung.

Amongst other things they developed something they called kleptogtaphy, which works on another trick that whilst simple takes more typing than you looking the details up ( http://www.cryptovirology.com/cryptovfiles/research.html )

In essence a program that makes the PQ pairs for RSA certificates can be backdoored such that you can hide information that can be used to vastly reduce the factorisation work load.

So whilst factoring of a properly generated PQ pair is significantly hard and resource expensive, there are quite a number of tricks that could be easily hidden in closed source software. Which kind of makes the factoring point moot.

Ratio • October 3, 2016 7:23 PM

@ab praeceptis,

You are arbitrarily interpreting his question so as to fit your intentions.

That must be why @Curious said the following immediately after your comment: Ugh, I guess I should have used the phrase “prime factorization” instead. 😐.

And thank you for the profound insight into my being. I had not realized what my intentions really are. Now I know.

ab praeceptis • October 3, 2016 9:45 PM

Ratio

a) You were wrong but persistent (to avoid saying annoying).

b) While you tried to hunt me down using whatever “interpretation” was necessary and bluntly ignoring the context, I tried to contribute, to help someone understand; based on what I could see I did this under the assumption that simplicity was more important then math perfection. It seems my perception was confirmed and about right.

If one has to choose between someone who wants to help, even if not perfectly (but simple to understand) and someone who abuses questions for his private war, then I’m very cool about the choice most would pick.

Finally, one should ask the question whether it’s any good for the community if some lurk waiting to quite personally attack others who merely try to contribute. My guess is that quite many will think twice and hesitate to contribute, knowing that some lurks to attack them.

As you can see I have again explained something to someone. So you didn’t succeed in muting me. Why don’t you just play old pal games with Wael or someone.

Ratio • October 3, 2016 11:27 PM

@ab praeceptis,

a) You were wrong but persistent (to avoid saying annoying).

Yeah, that’s what happened. It’s not like the whole thing is above on this very page or anything. (Prime numbers have to be greater than 1, the divisors have to be positive, what @Curious wanted to know: you’ve been shown wrong over and over.)

b) While you tried to hunt me down using whatever “interpretation” was necessary and bluntly ignoring the context, I tried to contribute, to help someone understand; based on what I could see I did this under the assumption that simplicity was more important then math perfection. It seems my perception was confirmed and about right.

You seem to have missed that the interpretation that @Curious wanted to know how hard prime factorization is has since been confirmed by the person who’d know best: @Curious.

Earlier claimed that the definition excluded 1 from being a prime and mocked the idea that the divisors under consideration have to be positive. Now you claim you assumed that simplicity was more important then math perfection.

See also:

If one has to choose between someone who wants to help, even if not perfectly (but simple to understand) and someone who abuses questions for his private war, then I’m very cool about the choice most would pick.

So even you agree that there were blemishes after all. But when that’s pointed out to you your reaction is one of denial, ridicule, theories of persecution, ad hominem, and whatever else distracts from the facts. Just in this comment you talk about hunt me down, private war, personally attack, didn’t succeed in muting me.

Finally, one should ask the question whether it’s any good for the community if some lurk waiting to quite personally attack others who merely try to contribute. My guess is that quite many will think twice and hesitate to contribute, knowing that some lurks to attack them.

Seeing a comment that says one of your comments may be less than 100% factually correct is quite the devastating experience. </sarcasm>

I have not attacked your person. I have not ascribed motives to you. I have made no comment on your level of expertise or your qualifications. I have made no comment on how smart or dumb you are. All that is your MO.

And that’s fine. I don’t mind (others might). But if your incessant accusations of non-existent personal attacks on you by me or others don’t stop now, I will ask the moderator to make it stop.

Wael • October 3, 2016 11:51 PM

@ab praeceptis,

Why don’t you just play old pal games with…

You haven’t changed! Easier to say “I was wrong” and move on, rather than making issues personal and subjective.

r • October 4, 2016 4:39 PM

@David,

double-precision variables in voting computer software are part of an evil plot to make undetectable changes in election results. One would hope they’d have some experienced programmers on staff,

Experience isn’t the problem, it’s an accute sense of inexperience that is missing.

General contractors are the problem, I’m doing myself a disservice here but it’s true. What does some self-taught .net programmer who went to school for 2 years and got an MBA and a cert in VBA know about the darker side of mathematics?

Have they even seen the under-handed-c contests?

Plain sight can go a very very long way.

robyn rihanna • March 24, 2019 10:08 PM

I love Black Friday. Six years ago, I moved to the Texas. I was unfamiliar with the area. I didn’t know anyone. I was fine with this, for the most part, because I was there to engage in meaningful work as an educator. But then the holidays hit.I can recall the smells, sights, sounds, and emotions that accompanied each occasion — starting with Thanksgiving. But that year, I didn’t have the money to make it home. I was longing for a sense of home and family. Luckily, a friend of mine reached out to me.She asked me if I needed a place to celebrate. Spending Thanksgiving with Vickie’s family has come to mean so much to me. After all of the Thanksgiving feast has been consumed, tables cleared, coffee served… there is a momentary calm. And then we bust out the newspapers and go scrounging for the best Black Friday deals. Their family kitchen table is a mess of “Best Buy 25% off”, “Buy One Get 3 Free”, and “Today ONLY” advertisements.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.