Schneier on Security

Clive Robinson • December 23, 2016 8:34 PM

First off, to all the readers in the Northern Hemisphere, have a happy winter festival, wrap up well and if not living it up large, enjoy the rest. For those in the southern hemisphere, enjoy your summer festival, and it you can send some nice weather “hup narf” I’m sure there are many who would appreciate it.

Secondly remember 2016 is not just a normal leap year, it’s also getting a “Leap Second” so remember to start your New Year count doen at eleven 😉

As is traditional many news outlets are having a round up of the years events. Almost certainly one will be the Internet Fake News stories such as pope on a rope blessings on Mr Trumpeting. As some of you know there are ‘Debunking’ sites like Snopes, who have had a raised profile because of the fake stories.

Well it would appear that what is one of the largest English Language OnLine news sites “The Mail Online” appart from it’s usuall clickbait, questionable content, flashing the flesh and amongst other faux news health scare / medical wonder stories has decided to start protecting it’s market share. Thus has started going after the faux news debunkers, which has been picked up by one of it’s rivals “The Guardian”… Make of it what you will,

https://www.theguardian.com/media/2016/dec/23/why-is-mail-online-going-after-fact-checkers-snopes

Clive Robinson • December 25, 2016 8:19 AM

@ New Guy,

So much chaff to sift, so much assumption about threat capabilities which makes prudent security choices difficult.

Security is as much a state of mind as it is a physical or informational reality, and the weak link will in most cases be yourself when you are tired, busy, annoyed ot in some way not a calm exact follower of checklisted actions.

The first important thing to realise is that the computing stack is very deep, from quantum physics all the way through economics, politics and even philosophy. Thus no individual can hope to master all those levels in bredth or depth.

Thus the two sensible thoughts are segregation and mitigation. That is get the parts you wish to remaine private / secure and issolate them from the general stack and mitigate areas you can not segregate.

Whilst computers are fairly efficient and fast at communication they are almost impossible to secure against even script kiddy levels of attack, if they are ever connected to a communications network without very significant mittigation.

Thus your first thoughts should be on how to build an issolated system and keep it issolated indefinitely.

One such way is a very cheap older netbook and a safe and small printer / scanner that can all be kept locked in a safe when not in use. Where secrecy is important, you need to think about not using plaintext on any computer, and this is where the knowledge of how to make and keep secure paper and pencil based “One Time” ciphers and codes can be of use.

Likewise other traditional “field craft” is actually far more important to computer OpSec than many people realise and it is not knowing these basic things that can give rise to tiny “openings” in your security features, an opponet can drive a wedge into to make a full break.

Personaly I would look at nearly all computer security applications etc, not as real security but simple obfuscation techniques used more to slow down and annoy an opponent rather than stop them.

It’s knowing how to do the serious OpSec mitigations that is what you realy need to understand in depth, if you want to survive an actual hostile attacker rather than am oportunist crook.

Clive Robinson • December 26, 2016 4:15 AM

@ Wael, Figureitout and others,

The unidirectional path in your design must only apply to data and not to control signals.

That is known as a “false premise”…

Ask yourself “Why do I need ‘control signals'” and when you understand that properly you will understand why you do not actually need them.

As a hint consdier the case of data stored on immutable storage such as a CDROM and how it can not have control signals.

Clive Robinson • December 26, 2016 7:07 PM

@ Wael,

The other half… I think we have a miscommunication about the word “control signals” 😉

Not of necessity, remember as with the missnamed “feedback” there are two types of control signals, those that feed forward and those that feed back.

Feed forward signals can go through the data diode without any problem as they rarely have anything other than obvious metadata purposes about the data that is to be sent. Whilst there is a potential for covert channels there is usually a way that this can be reduced or eliminated such as buffering and re-clocking for time based covert channels.

The problem with feed back control signals is that they can be used for covert channels that can reach all the way back transparently to the very heart of a security nexus. Thus the desire to eliminate them. The problem is that outside of simple acknowledgment they are mainly for “errors and exceptions”.

The “errors and exceptions” can be reduced or removed by such things as coding and Forward Error Correction (FEC). Which is how the daya on a CDROM is mainly protected.

Thus you now need to think of cases where you think feed back control signals may still be needed and how you can reduce or eliminate them…

Clive Robinson • December 27, 2016 8:56 AM

@ 65335, Wael,

Where to start…

I guess with the limits the laws of physics give us with regards the conduction, radiation of energy over time and how much energy per bit of information is required to transfer the information a given disyance with an acceptable “Bit Error Rate” (BER).

The fundemental two laws state that neither energy nor mass can be created but are interchangable (the equivalence is given in Einstein’s equation E=MC^2). And that energy and matter move from an organised to disorganised state by a process called “entropy”. The latter gives us two results, like heat (which it is in effect) energy moves from hot to cold and ultimately ends up as “Background thermal noise” which people often call –incorrectly– “White Noise” at a level called the “Noise Floor”.

Thus no matter how powerful a signal source it will disipate with distance and reduce down to the level of the noise floor becoming steadily more dificult to receive with any accuracy. Because the noise floor is “random in nature” and “only has an average level” it can go up as well as down. Thus any signal starts to be effected by the noise and at some point the random peaks in the noise will render the signal sufficiently ambiguous that a bit of data might be incorectly estimated as a zero when it should be a one or as a one when it should be a zero. Which is where the BER comes from and indicates at what point you can expect a certain average number of random errors. Whilst I can give the formulas or you can look them up, they require a lot of other knowledge to make detailed sense of, but the overall picture is easy to see on an old analogue TV or hear on a simple receiver when they are not tuned into a sufficiently strong signal (it used to be possible to see the “cosmic microwave background” which is a signal still around from moments after the “Big Bang” around 14Billon years ago).

Thus the question of how far a signal will go before it starts comparing in size to the noise floor becomes of interest, and it is one of the fundemental things “TEMPEST technicians” get taught. And the answer is not simple for a couple of reasons. The first is there are two transportation methods, conduction and radiation and the second is they both apply in various ways at the same time depending on the nature of the medium of transportation… But very roughly in the case of sound energy we can get a feel for this in a quiet railway station. The rails act as a conduction medium that also radiates. As a train creates vibration via it’s wheels the sound is conducted away from the source down the length of the rail which then radiates a small fraction of the conducted signal into the air around the rail. Thus being very close to the rail the train can be heared a very considerable distance away. The train also radiates it’s noise signal into the air and this disipates with the square of the distance. Thus what you hear is the sum of the two radiated signals. Thus you usually hear the rails “twitch or sing” long before the train can be heard or even seen, but at some point the signal radiated by the train can be heard above the signal radiated from the rails. The same applies to all forms of energy that get transmitted by conduction or radiation.

The next thing to note is that anything that conducts and radiates energy is also susceptible to any energy that crosses it. That is energy from the wave front gets coupled into the conductor that then has to go some where, either conducted or radiated from the conductor. This is part of the problem with cables inside equipment that although not part of the confidential compartment circuit, can pick up information from the confidential circuit and conduct it away to be radiated outside of the equipment, sometimes at considerable distances. It can also modulate any signals in that conductor that then may well get amplified as part of an intentional communications system. This issue arises quite often on ships, and a few years ago there was a bit of a curffufal over US coastguard vessels not having sufficient TEMPEST mitigation.

There are however other issues, for instance a transducer converts one type of energy to another sometimes very efficiently. One such is the magnetron microwave valve that converts DC power into Microwave energy, however the magnetron frequency is very susceptible to very small changes in the anode supply voltage, thus any noise on that line gets to frequency modulate the magnetron output. Another bidirectional transducer is the moving coil speaker that works just as well as a microphone, and can with the correct two to four wire hybrid circuit act as both simultaneously (a security issue that has recently been brought back up again but goes back to at least the early cold war days and earlier with some telephone ear pieces). Other transducers such as motors/generators and transformers tend to get forgotten about by those not sufficiently clued up about transducers.

Of further interest is the power transfer theorem also called the maximum power transfer theorem, which simply put is about matching the impedance of a generator to a transmission and then to a load. In theory if all are correctly matched then all the power gets delivered to the load and thus radiation from the generator and transmission line is minimized (it’s actually way more complicated than that but it’s a first step). Mismatched lines radiate in various ways and thus they can “illuminate” other systems and either carry or get cross modulated with information. It’s partly on this idea that the Great Seal Bug / Thing worked. Likewise mechanical modifications to typewriters (both of which the CCCP did to the US Ambassadorial Mission.

Whilst all these are well within and explainable by the laws of physics, few engineers or scientists tend to think in these ways.

The advent of very low power microcircuits have allowed not just battery less operation (like RFIDs NFC etc) it has further extended the cat and mouse game between red and blue teams into the time domain. That is devices can now “store and forward”. Without going into details a bug can be powered by more than one illumination source or the source can be modulated to send data to the bug (see the way RFIDs etc work). Thus the bug can be in a low power mode where they simply record, compress and store digitally audio or other information in a confidential zone. Then be switched to a higher power mode to “burst mode” transmit the data to a data collection point that can then in turn forward the data over say Mobile Broadband.

For obvious reasons bugs that do not radiate signals are not that easy to find by conventional means…

There is as part of entropy a requirement that not only do you not get “something for nothing” you will always have to lose energy in going from the disorganised to organised state. So no 100% efficiency or “perpetual motion machines”. Also the energy used to do work can not be destroyed to it has to go somewhere, eventually as the ultimate form of pollution “heat”. That is an active device will always be at a slightly warmer temperature than it’s environment. So in theory could be found by a sufficiently sensitive thermal imaging device. However the few millionth parts of a watt that modern circuits can operate on is generally insufficient to pick up beyond a very short distance. That’s not to say that thermal imaging is a wash out for bug detecting, on the contrary it can work quite well. Put simply you get the environment to a steady state temperature, then rapidly change it. As different materials have different thermal characteristics a bug can quickly develop several degrees difference in it’s temperature to it’s surrounding environment. A series of images taken at regular intervals until the environment reaches a new thermal equilibrium will when enhanced with appropriate software techniques show all areas where there are differences in thermal characteristics. This includes the likes of “pin hole acoustic wave guides” that lead to microphones etc mounted on the other side of walls.

But this is not the only technique that can be used, transmission systems to transducers have characteristic impedences that are frequency selective. Thus if illuminated of frequency reflected energy will come back at the illumination source. Similarly a focused system, which is why you get the “red eye effect” in photos taken with cameras with built in flash units. This technique works with nearly all transducers and their feed in transmission lines.

Thus you have the likes of “time domain reflectometery”. Where a very fast rising edge contains energy in nearly all frequencies. Thus any mismatch will cause energy to “bounce back” with the time delay giving a range and phasing information a direction. Thus an environment can be mapped to produce a 3D image of otherwise invisible transmission lines / transducers.

A few years ago although the sensing head systems were available, computing power for DSP type activities was not sufficient for the task.

And it’s the increase in computing power that is making not just bugging but bug detecting technology viable, and we are entering the stage of the game that ECM systems did for missiles etc. in the 80s and 90s.

Clive Robinson • December 29, 2016 2:58 PM

US-Cert Report on DNC Hack.

https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296.pdf

Oh and please do not shoot the message bearer or get upset by the report. I’m keeping my views quiet so that others can come to their own conclusion.

Oh and Pres Obama has decided that some 35 Russian Diplomats are “person non grata” and is expelling them from the US…

http://www.reuters.com/article/us-usa-russia-cyber-idUSKBN14I1TY

Clive Robinson • December 30, 2016 9:08 AM

@ ab praeceptis,

Many I know hope that he will continue to beat up merkel.

That does not surprise me in the slightest… She is after all being blaimed for the influx of refugees in Europe and the attendent economic migrants and if others are to be believed “sleeper terrorists”.

Further she has presided over the effective destruction of what were concidered by many Germans and other Europeans as sacrosanct laws to protect both privacy in the home and in communications against the rise again of a Police State. Many of whom also see the black hand of the US signals agencies not just for spying but raining down death and destruction via drone on people in foreign nations from German soil. Thus providing a fertile breeding ground for the disafected and now displaced to become terrorists who “Mummy” is inviting in and turning Germany into yet another ethnic sink hole that is seen on the outskirts of Paris, and in large areas of Belgium.

Thus we have seen a movment to the right of political opinion.

Whilst Mummy may be supported by German MSM it needs to be pointed out that so was Hillary Clinton and it did not do her any good. Thus it might be that such obvious spining by German MSM will count against Mummy with the German electorate.

The simple fact is that many MSM owners can nolonger deliver on their promises to gain political largesse for themselves or rheir friends. Thus they are nolonger “King Makers” or “Power Brokers” in fact some are begining to look like lead kippers, with falling readership and marketing income. Some are singing the MSM “swan song” in expectation that it will become dead, and buried in a timely fashion.

It’s something that scares not just politicians but the 1%of the 1% of the 1% elite who try to remain hidden and used the MSM as one of their fronts/shields. Which might also account for the perfect storm various entities have been trying to brew up over the Intetnet and the various “Red under the bed” boggiemen, such that they can try to regain the propaganda initiative, by eliminating those “off mesage” and their associates in various ways.

Clive Robinson • December 30, 2016 11:06 AM

@ Wael,

Can you imagine a whale mating with a nuclear sub? Lol!

What about the poor sea men?

Clive Robinson • December 30, 2016 5:45 PM

@ El Nino,

Likely some American house plant to begin with no?

Who knows, but I would be suspicious of anything that came out of the NYTimes,

@ snur-pele,

hmm, maybe overall security is strengthened by using an external cd-writer on the networked computer, to be attached only when in use? Ideas, Anyone?

We’ve discussed it before on this blog in the past. The one thing you have to remember is that CDROMs and the like are dificult to destroy effectivly due to both daya density and the way they were designed.

The destruction of CDROMs securely means that you have to destroy the track and the pitting chemical in it in their entirety. Most methods are hazardous to health, and can take considerable effort and time. Likewise memory sticks / thumb drives are very dificult to destroy beyond recovery (which is why they tend to be used in flight data recorders / black boxes these days).

Thus another transfer method is to be prefered, preferably one where it is difficult for covert data to be transfered. One method is to use printers and scanners with easily destroyed beyond recovery printed paper as the actual transfer medium.

OCR software will these days read in printed information fairly reliably. Thus printing out the cipher text in hexadecimal strings pre-appended with an address and ended with a CRC checksum[1] should provide reliable data transfer.

The destruction of the paper is generaly not to difficult as all it needs is an ashtray / metal bin a match and holding the burning page such that it compleatly burns. Paper can also be made more flamable by the use of the likes of soluble nitrates etc. An old method was to make up a solution of Potassium permanganate KMnO4, which is a strong oxidizing agent and paint the paper with it, when dry the paper would once lit remain lit and would burn to a very fine ash, without needing to be held.

A more up market method of transfer is by serial data via a diode, pump or sluice[2] with an instrumented interface. If you search this blog you will find Tin Foil Chat (TFC) being discussed, this has the potential to become rather more than just a data diode segregated system.

[1] Many years ago standards for transfering hexadecimal information in this for for PROM programers etc were designed on such was the “Motorola S-Record format”, https://en.m.wikipedia.org/wiki/SREC_(file_format)

[2] Whilst many people know what a data diode is, less appear to know what a data pump or sluice is. In essence a pump is a data diode that also has the ability to only pass certain data types/classifications through. However like a diode a pump has covert time channel issues. A sluice however has a store and forward mechanism which reduces or disrupts the covert time channel to render it ineffectual.

Clive Robinson • December 30, 2016 11:25 PM

@ Wael, Figureitout,

A Data Diode sounds like a building block component.

That is exactly what it is, in that at the end of the day it is signal wise effectivly a “drop in replacment” for a cable with all but two wires cut (Source_tx to Sink_rx and Source_SigGnd to Sink_SigGnd).

What it offers over and above such a cable is “galvanic issolation” which can be very desirable electrical safety wise as it removes issues with “neutral/ground offsets” that can cause equipment failure, fire or death. It also stops the effects of “ground loops”.

Also as a secondary effect of the safety the only energy crossing the “galvanic issolation” is photons in a sealed optical transmission line. Which can if designed correctly stops a number of “TEMPEST / EmSec” issues (but by no means all).

As I pointed out a little while ago my chosen method for an actuall product would be the physical layers of TOSLINK as the parts are almost “Standard off the shelf” and widely used for galvanic issolation in the recording industry in studio equipment.

What such a “building block component” does not offer is anything other than physical layer galvanic issolation. That is it does nothing to stop “time based covert channels”. These can be stopped by adding a “re-clocker” circuit as an additional “building block component” in the signal path.

In this way you would build your basic optical data diode up into a more complex device such as a Secure Data Pump / Sluice that works through the lower layers of the data comms stack upto the equivalent of the presentation layer providing TEMPEST / EmSec / information security at each layer if designed correctly.

Clive Robinson • December 31, 2016 12:05 AM

@ Dirk Praet,

Which means that we are actually stuck with this *sshole who now at the expense of the taxpayer needs to be provided for and monitored 24/7 for fear that sooner or later he pulls a similar stunt over here.

Whilst there are many “Cons” to this there are some “Pros” one of which is that you know, where he is and that he is also neutralized.

After all if you deported him you lose control of him. Thus a third party over which you have no control could simply release him (which in effect happened with the French operatives over the bombing of the Green Peace ship in New Zealand). Then they or other third parties could give him a new identity (this has happened in the past, it’s also what the French Foreign Legion did/does as standard). Thus alow him to return to your country under a different name as a free person to do whatever he wished at a later date.

Thus you have to weigh the cost of keeping the “individual” in longterm incarceration under your control against the cost of all measures required to keep him out should a third party not keep him under the same level of control in their country.

The financial low cost is rather than deprive him of liberty, is deprive him of life. However whilst that may once have been an acceptable solution it nolonger is. And it’s not just the cost of moral high ground you are looking at, potentially you might be looking at making him a martyr. The consequence of which could be that his name is used as a radicalisation flag to produce ten or more terrorists who are compleatly unknown to your authorities and become just more “disposable DNA”.

There are other arguments that can be made, one of which is “The Trump Final Solution” of barring entry to entire race/ethnic groups and deporting by force those already in the country. Because the idea is not uniquely Trump’s we have an idea of what the cost of such measures will be. For instance in the Trump -v- Mexico just one cost will be the price of building, maintaining and guarding several thousand miles of fence/wall, which would be eue wateringly expensive and as Israel are finding out not very effective.

And before you ask, no I have no soloutions to offer that would not irreparably damage my soul and many of those of any nation that carried out such solutions (something the US is going to have to come to terms with over indiscriminate drone attacks etc of the “Obama / Clinton years”).

Clive Robinson • December 31, 2016 6:01 AM

@ furloin,

Seperate the guy from the rest of the population but in a way where he is only seperated physically. Then tell him to grow his own food and care for himself or die by his own lazyness.

Firstly how do you stop the martyr rescue issue where by a third party sends in slightly more intelligent DNA than that which is disposable?

Secondly how do you stop the guy making gun powder and weapons, how to make them is not exactly a secret nor particularly difficult.

Whilst secret detention centers do exist and people do get “disappeared” into them, often the secret is difficult to maintain for various reasons.

For instance it has been rumoured for some time that the US has Ultra Secure “Special Administrative Measures” Issolation Centers much worse than the alledged most secure US prison ADX Florence in Fremont Country, Colorado. Such places where people effectivly become “disappeared” and effectively compleatly issolated in a Panopticon Cell, with as close to zero human contact as is possible, where punishments are compleatly arbitary and involve total control of the prisoners environment. It’s been further said that atleast one such Federal unit is built entirely underground.

I can not say if it is true or not but we know about special Super Max facilities like an ADX in Colorado from UN Special Rapporteur on Torture reports on it which Amnesty International has published details on,

https://www.amnestyusa.org/research/reports/entombed-isolation-in-the-us-federal-prison-system

There is also the testimony of a prisoner who has been kept in worse conditions for many years,

http://solitarywatch.com/2011/05/05/americas-most-isolatd-federal-prisoner-describes-10220-days-in-extreme-solitary-confinement/

We also know it has become clear that some US police forces have run illegal detention and interrogation facilities such as one run by Chicargo’s PD under a mayor who was once a close associate of President Obama,

https://www.theguardian.com/us-news/2015/oct/19/homan-square-chicago-police-disappeared-thousands

So it is very difficult to believe any US Gov statements that an “underground disappeared” facility either does not exist nor was designed and constructed. If such a place does exist or was planned then it’s likely that at some point tangible information will leak out.

Because we also know that other supposadly civilised countries like Israel have “disappeared” facilities and prisoners without real names, because the information has leaked out,

https://en.wikipedia.org/wiki/Death_of_Ben_Zygier

So if it is hard to maintain secrecy then reprisals etc by third parties become a real issue.

There are many reports on just how inventive prisoners can become, and atleast one early Super-Max in Texas has had an escape. More modern Super-Max designs are aimed at providing the prisoners with as close to zero information about where there cell is within the facility thus reducing their chance at escape. The downside is the cost of such establishments not just financialy but in societal terms as well. You thus have to consider the aspect of unnatural deaths. Did a prisoner commit suicide or were they coerced / neglected / tortured / murdered. Thus the main imperative is to keep the body alive, as is known with Gitmo, this can and has involved barbaric practices worse than recognised forms of torture to force feed inmates. In at least five known cases what is gratuitous sexual assult has been carried out on detainiees that has no factual medical basis,

http://boingboing.net/2014/12/15/physicians-anal-feeding.html

And the CIA supposed “Medical Practitioners” who recommended/attended are obviously not of any repute (if they even exist in reality outside of the report).

The US supposadly holds it’s self as the moral guardian of the world, does this sort of behaviour sound moral in a civilized society?

Clive Robinson • December 31, 2016 9:25 AM

@ Figureitout,

Also your TOSLINK thing, if you provided enough info to build, we could evaluate it, but as usual you don’t and expect others to figure things out themselves.

A little harsh, when you consider quite a bit of info on using TOSLINK and off the shelf modules are easily available…

For instance in a quick google this came at the top of the first page,

http://irnas.eu/goodenoughcnc/2015/06/05/optical-cnc-control-toslink

A quick read of it should be enough to give a reasonable engineer most of the information required to get a prototype up and running. That they can then use to develop their own code and hardware to be compatible with.

There is also the old “You can give a man a fish, and he will feed his family for a day, teach him to fish and he will feed his family every day” argument. Yes I could give you a fish, but then you become dependent on hand outs, if however I tell you what makes good tackle, you can then make your own choices peculiar to your own needs, not mine or somebody elses.

I gave reasons as to why I thought the use of TOSLINK would be a good idea as a general product that would have a market in other areas thus provide security cover. You chose to say you were doing stuff for your use only and had no interest. So you are now changing your tune and blaiming me for not providing information you had already said you had no interest in…

Thus sending out mixed messages for reasons of your own…

Clive Robinson • January 2, 2017 10:42 PM

@ Sancho_P,

Interesting statement, but I doubt it.

All physical components are “non ideal” and have resistance as well as capacitive and inductive impedence. Worse the also have coupling effects as well, all befor you get into their nonlinear behaviour.

Note that they have both capacitive and inductive impedence as well as resistance. Which means they are also “damped resonant circuits” as well with both series and parallel resonance and just for fun will have changes in effective reactancr with frequency so a capacitor will look at some frequencies to actually be an inductance…

One easy way to work out the parasitic values is with a Q-Bridge or Vector analyser / S-Parameter test set if you are more wealthy.

Often what look like “RF Caps” will be found to have very low resonant frequencies, especially when in circuit. You can with a little skill and a Grid Dip Oscillator find resonant peaks or dips in the tens of MHz. Which can be at quite a significantly lower frequency to what you would expect from a quick calculation.

Oh and for those reading along, when using multiple capacitors for decoupling, it’s usually best to put not the lowest value or physically smallest cap next to the device being decoupled, but the one with the highest self resonant frequency… This is because different capacitor manufacturing methods have significantly different parasitic values. The problem of course is knowing in advance which cap is going to have the highest self resonant frequency…

Oh and remember those three terminal voltage regulators you oh so commonly see, they can make realy good power oscillators / jammers, giving a couple of very unclean watts of power at 50MHz. Likewise some of those audio power amps, can wipe out from the long wave band through medium wave and up into the low HF marine band, whilst still giving you “high fidelity”.

EMC is important not just a TLA.

Clive Robinson • January 2, 2017 11:16 PM

@ Figureitout,

I’m not fine w/ bad hardware designs that cause errors that are then “problems to be fixed in software”.

That’s another bitter pill you have to swallow these days. Managment see hardware engineering time as ten to twenty times more expensive than software. So much hardware design is “manufactures recomended circuit and layout” running linked in binary blobs.

And the reason for this sorry state of affairs is the fact that few software people even know what an engineering process is these days. As you’ve probably noticed there is a lot of “Cut-n-Paste from the Web then guess” software development these days. You can after all hide many many sins in a binary, that somebody else has to maintain because the programmer knows when to “Cut-n-Run” to stay ahead of the game…

It’s why IoT is “pre-destined” to be not just a compleate security nightmare but also unreliable to the point it will crash a lot and sometimes burn your house down, in just the same way some cars brakes and mobile phones do currently.

With regards,

… want to try hacking those clickers we were forced to buy for school…

I think I missed the story behind that.

In the UK there was an initiative to give every child in a particular school year their own BBC micro PCB. Only a lot of schools decided to keep them as a general resource for the school. Thus the whole point behind the initiative that kids would play with them in their own time went straight out the window. Now they get told “You have twenty minutes to type in the following program and then hand the PCB back in…”. So computing by writting your times tables, we all know how much fun there is in that…