Friday Squid Blogging: Woman Throws Squid at Her Boyfriend

This is what passes for news these days.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Posted on December 16, 2016 at 4:52 PM • 219 Comments

Comments

ErrolDecember 16, 2016 5:00 PM

0-days hitting Fedora and Ubuntu open desktops to a world of hurt

If your desktop runs a mainstream release of Linux, chances are you're vulnerable.

http://arstechnica.com/security/2016/12/fedora-and-ubuntu-0days-show-that-hacking-desktop-linux-is-now-a-thing/


How to make Linux more trustworthy

Reproducible builds are a good step, but Red Hat and Ubuntu don't want to join in.

http://arstechnica.co.uk/information-technology/2016/12/how-to-make-linux-more-trustworthy/


For those Windows 10 users out there who want to reduce its privacy impact as much as possible there are new versions of O&O ShutUp10 and Spybot Anti-Beacon which have been released.

https://www.oo-software.com/en/shutup10
https://www.safer-networking.org/spybot-anti-beacon/

WhiskersInMenloDecember 16, 2016 6:07 PM

V2V....
https://www.wirelessdesignmag.com/blog/2016/12/dot-proposal-requires-v2v-tech-all-new-cars
"On Tuesday, the U.S. Department of Transportation (DOT) announced a proposed rule, requiring the inclusion of vehicle-to-vehicle (V2V) communication technology in new cars. This Notice of Proposed Rulemaking would enable a "multitude of new crash-avoidance systems that, once fully deployed, could prevent hundreds of thousands of crashes every year," according to a statement.
.....
"The rule would also integrate extensive privacy and security controls, preventing the technology, which operates on a 75 MHz band of the 5.9 GHz spectrum, from linking any information to individuals. The current proposed design employs a 128-bit encryption, compliant with the National Institute of Standards and Technology (NIST).

"Also on the docket is the NHTSA’s plan to issue guidance for vehicle-to-infrastructure (V2I) communications, which would allow vehicles to "talk" to traffic lights, stop signs, and other roadway infrastructure, reducing congestion and improving safety."


====
I am not fully convinced that this press release is informed. In many ways it does not pass the sniff test.

Since roadway infrastructure already has cameras this seems to have been authored in a state where wacky t-backie is sold.
Crash avoidance commonly involves stopping so any vehicle can be stopped including police vehicles.
Of the hundreds of thousands of accidents this will avoid how many of the 35,092 fatalities in 2015.
How many of the near six million vehicle accidents involve multiple vehicles.

In 2009 -- Of the 7,945 people who died in the past five years in Virginia, Maryland and the District, 58.9 percent were in single-vehicle crashes.
http://www.washingtonpost.com/wp-dyn/content/article/2009/10/13/AR2009101301973.html

If "Stuxnet" taught us anything industrial control hacks are real and can jump air gaps. To deploy RF connected tech has risks that can move vastly faster than interstate highway speed. The EPA discovered way too late the designed tomfoolery to game emissions for millions of _importerd_ vehicles.

In isolation much of the good intentions I like. As a set the risks are serious and ill considered.

On a positive side I would recommend passive radar corner cube radar and IR reflectors be moulded into rear bumpers and side panels. Corner cube reflectors make wood and fiberglass sailing boats visible at distance to the radar of large commercial ships as well as rescue helicopters and ships. Such passive reflectors can allow driver assist devices to see traffic better. Retrofit on truck bumpers and replacement vehicle bumpers could be routine. Tuned arrays of wire on bumper stickers would be inexpensive and could also be part of license plates. Such passive signal enhancements might help a lot more for less money. Tuned wires can be woven into clothing and canes for pedestrians too.

I have already seen evidence that law enforcement ignores electronic emissions from vehicles.
Headlights out of alignment can be detected visibly in a rear view mirror. (Yes light is electromagnetic wave... ;-)
High beams deployed are obvious. Bumped out of alignment lamps are obvious.
Fog lights on wet pavement reflecting up into incoming traffic are obvious yet the glare
risks the pedestrians, oncoming traffic much as high beams do.

/// date... so many fridays ///

Anon22December 16, 2016 6:18 PM

The Talos Secure Workstation just got an extension to the time it has left. It seems to be a few million dollers short on its funding. I rather like the idea of a fully open source computer. It would be nice if it got funded...

we can't let the theorists winDecember 16, 2016 7:19 PM

It really grates that our intelligence agencies have unfettered access to my tax returns and IRS records and know all my foreign business entanglements. Hopefully they won't leak any of it to the Moose lodge where I'm up for election this Monday. The community newsletter is stirring up enough fear, uncertainty and doubt as it is.

ThothDecember 16, 2016 7:47 PM

@Figureitout

I have laid my hands on the Ledger Nano S device (smart card with screen and button attached). Going to include Ledger devices as my future porting target as well. The environment would be GCC for ARM since the Ledger device uses STM32 and ST31 (all ARM Cortex M chips).

Haskell, Rust, Ada et. al. would not be used for now since for practical reasons, the Docker image it comes with are for GNU GCC toolchains and switching up to "highh assurance" languages would require more time. Using verifiers to automate the process of verifying the C codes can be done on GCC toolchains would be an option that can be used.

Are American VPNs Compromised?December 16, 2016 7:47 PM

Summary:
The majority of American based VPN providers allow Google to positively identify customers through their IP Address when creating or log-on to their VPN account. The ‘cover story’ is the VPN service provider is being compensated by using Google ad network.

Anyone can use and ad blocker (like uBlock Origin) to see if Google is present when you log-in at your VPN account. The depreciated Ghostery addon gives a false sense of security by blocking Google Analytics but NOT Google.com. Google will still not let you log-on to your ‘anonymous’ VPN account until all user agent defenses are disabled.

A simple solution is offered.

Google Claim:
“The Google Analytics terms of service, which all Google Analytics customers must adhere to, prohibit sending personally identifiable information (PII) to Google Analytics. PII includes any data that can be used by Google to reasonably identify an individual, including (but not limited to) names, email addresses, or billing information.”
https://support.google.com/analytics/answer/6004245?hl=en

This statement is meaningless as your fixed household IP address is fair game for Google Analytics. This unique number is all Big-Data Google needs to verify your identity. Ironically this is a major reason to use a VPN!

That is, you are paying NOT be tracked, but the worlds largest advertiser and govt agent is simultaneously verifying that you personally use this VPN. How is that for your anonymity?

Does inputting your user VPN name and password in Google’s presence allow for eavesdropping? Man-in-the-middle attacks? How about a 'modified' client VPN software upgrade? In the Land of the Free, its now legal to hack any computer anywhere in the world without restriction. Someone with the resources could insert themselves in-between the customer and the real VPN server without being noticed. All they need is your VPN account name & password. Snowden charts stated that the NSA had cracked 76% of VPN’s in 2012. Hmmm...

Google Analytics Red Herring:
“Website users that don’t want their data reported by the Google Analytics JavaScript can install the Google Analytics opt-out browser add-on. The Google Analytics opt-out browser add-on does not prevent information from being sent to the website itself or to other web analytics services.”

One has to be very naive to allow a proprietary Google add-on into your browser. Also Javascript and third-party cookies must always be enabled (which greatly assist in malware and data-mining)

Even better Google itself admits their add-on is untrustworthy:
“The latest versions of Internet Explorer sometimes load the Google Analytics opt-out add-on AFTER sending data to Google Analytics.” Snicker!
https://support.google.com/analytics/answer/181881

Entire IP Address is being sent to Google for ‘Security Purposes’
The author has verified that the VPN subscribers entire IP address is sent to Google. Their ‘cover’ is its necessary for security of the ‘service’. Imagine not being able to log-on to your own VPN account at the providers VPN website. Its here today folks! The VPN support help states you must have lost you password without telling what REALLY is occurring.
https://support.google.com/analytics/answer/2763052?hl=en&ref_topic=2919631

I’ve been forced to conclude that $40/yr American VPN providers are subsidized by selling your prized personal data under shady pretenses. Google is extremely clever and developed a system allowing everyone a plausible deniability defense. They already admit the their design has flaws, so as to not be penalized. The facts are they can, do and will get your identifying VPN data. Its becomes extremely valuable when people think they are secure.

VPN Client Software
Based upon all these shenanigans I also don’t trust proprietary VPN client software.
The bottom line is no one should trust any VPN provider who partners with Google.

Solution:
From cursory research, only American based VPNs are targeted to serve Google, as the rest of The World rejects intrusive American high-tech.

Most international VPN’s have a large number of servers in the USA and will have nothing to do with Google. Its against their law! Check out the VPN’s main and log-in page to see if Google is present by using an ad-blocker. Its a simple ‘go’ or ‘no-go’ situation. Then read their privacy policy. Further avoid any British based VPN provider.

If your home network is secure (free of smart data-mining devices and Windows) then a DD-WRT operating system equipped modem is best. This method omits local client software as Open VPN is a standard and included within the Linux based DD-WRT operating system. The true, real cost of an honest VPN is about $100/yr.

rDecember 16, 2016 8:51 PM

@Are American VPNs compromised?,

If your home network is secure (free of smart data-mining devices and Windows) then a DD-WRT operating system equipped modem is best.

I think the recommendations are not for dd-wrt but for openwrt or tomato.

I don't think I've seen too many people install dd-wrt past the initial version they flash even then I've seen data on alot of their ... not flavors ... but branches? to actually be out-of-date for a large percentage of the actual devices they support.

I could be wrong, I think what I'm talking about is slightly dated but it's something to be aware of.

rDecember 16, 2016 8:52 PM

It's most certainly a step in the right direction though when thinking about getting away from backdoored-by-default isp provisions.

ab praeceptisDecember 16, 2016 10:57 PM

The Holistic Spy Assassin Messiah

I object in one point. Trump isn't a puppet of the same group. That's your (us-americans) salvation chance and also good for the world.
The divided states of america are factioned since quite a while now. One faction being the one that ran your country since quite many years and who used and abused it like a cow and a pitbull, not at all caring a crap about its population.
The other group, the one whose guy Trump is, isn't nice either. But unlike the first group they want to save your country. They are arch capitalists, too, but they want to save your country and they have understood that strength needs a basis in real economy and in a healthy people. One might call them the ultra-capitalist patriots.


The Holistic Spy Assassin MessiahDecember 16, 2016 11:15 PM

I should mention that I REALLY wanted to troll burn those sons of bitches in that other thread. Yes. Yes. Moderator. I do not disguise my IP. So you may know the bitter truth... Butthole Surfers Dracula.

http://boingboing.net/2016/12/15/bruce-schneiers-four-year-pl.html

For those who wish to talk the real facts, maybe we can discuss there, where I am more free to set my umptillion vampire tentacle wives on my enemies and silence their penniless dissent.

Yes, angry, lesbian and bisexual tentacle wives in an angry uproar. U only wish ur porn could be more sexy then my r33l life...

rDecember 16, 2016 11:25 PM

@Messianic,

I appreciate the invitation, but don't you think a PKI blanketed .js pushing venue is a little on the risque side?

FigureitoutDecember 16, 2016 11:44 PM

Thoth
--Cool, so what's the screen and button used for? Have spent a lot of time working w/ a Cortex M ARM chip. Yeah let's see any of those languages implemented, how dirty the ports would be. Their popularity speaks for itself (Rust has a chance, but it sounds terrible to write code in so far), most of the people who make things happen write in C or below.

See how the big proponents of "safe languages" are mainly whiners wanting someone else to do the work...If something was actually better (to write, and safer) people would move on.

ThothDecember 17, 2016 12:02 AM

@Figureitout

Screen is to display confirmation messages and the button is for input of your keys, PINs and password directly into the device thus not relying on some external PINpad or keyboard. This reduces the surface area of attack.

The setup is the STM32 general purpose CPU in the device handles the button inputs and screen displays and talks to the ST31 smart card chip and all are packed into a tiny plastic casing.

The source codes are mostly open source although some proprietary blobs are still in the midst of being open sourced currently and the Github page is linked below.

I have already setup a Linux VM for my dev environment for Ledger and cloned the repos and finish setting up the environment. Currently playing around with the device.

Links:
- https://www.ledgerwallet.com/products/12-ledger-nano-s
- https://github.com/LedgerHQ/

ThothDecember 17, 2016 12:12 AM

@r

I think the entire NaCL should be ported on that Ledger device. I will just ask them and see if they are interested in porting DJB's NaCL.

ismar duderijaDecember 17, 2016 2:06 AM

@The Holistic Spy Assassin Messiah

I am happy I can still can smell a vigilante from a mile away 😉

Clive RobinsonDecember 17, 2016 3:27 AM

@ Bruce,

Of course it's important news...

Up untill now we have been led to belive "Women are from Venus, and Men from Mars". Now we find this squid pitching dame is from Jupiter, a gas giant with a huge red spot (or is that the boyfriend ;)

65535December 17, 2016 3:53 AM

Hum,

“Mid-November through December 19, 2016

“After the presidential election, the governor of your state prepares seven Certificates of Ascertainment. “As soon as practicable,” after the election results in your state are certified, the governor sends one of the Certificates of Ascertainment to the Archivist. Certificates of Ascertainment should be sent to the Archivist no later than the meeting of the electors in December. However, federal law sets no penalty for missing the deadline. The remaining six Certificates of Ascertainment are held for use at the meeting of the Electors in December.”- archives gov”

https://www.archives.gov/federal-register/electoral-college/key-dates.html

Watch for waves of manipulating. This and many other influential blogs should be filled with political misdirection.

Your mileage may vary… due to K Street “consultants” and others.

I am sure political manipulators will appear on this thread.

Let’s watch but not be swayed… as much as possible [heck, this could be a perfect Political Science lesson].

It is you and your children’s future at stake.

rDecember 17, 2016 4:02 AM

In case anyone is curious.

The panel discusses the end of the lame duck session. What did lawmakers do to you and for you? The guest is the State Election Director, Chris Thomas to discuss the recent vote recount. Rick Pluta, Paul Egan, and Bill Ballenger join senior capitol correspondent Tim Skubick.

(PBS)

My apologies to anyone sincerely curious who finds the lack of HTTPS discouraging, maybe I should write a transcript. ;-)

Daniela Alighieri CarusoDecember 17, 2016 4:51 AM

@ 65535

i like your handle. It reminds me of a song from the '80's.
I laughed when someone replied to you with @Numbers Dude

You asked about implementing PGP with Protonmail. Apologies am not certain it's fully implemented yet, but scanning through the blog I found the following

Protonmail is now the maintainer of OpenPGPjs library

https://protonmail.com/blog/openpgpjs-email-encryption/

An as an aside: join their back end audit
https://protonmail.com/blog/improve-secure-email-service-join-back-end-audit/


@ FigureItOut
@ Ab Praceceptis

my sincere thanks for your, as ever, evocative and thoughtful responses

@ messianic guy who was calling himself something else last week

I'm really sorry for your parlous state of mental health and hope you can stop consuming sugar and all the other things that are no doubt contributing. Get into the sun more. Go for a run and practice empathy. And, no, we don't believe you are who you say you are.


love from Italy

Poppy Z BriteDecember 17, 2016 5:00 AM

@ Clive Robinson

it was hilarious to read your suggestion that the Antipodeans could even be responsible for a breach (exact context I can't recall, elections or something) .
Although I do believe in some states they even have wireless fully up and running

@ All
for your amusement or interest, to stay abreast

Australian court orders to block Pirate bay and other torrent sites. No penalties for using were included in the order

http://www.abc.net.au/news/2016-12-15/federal-court-orders-pirate-bay-blocked-in-australia/8116912

rDecember 17, 2016 5:38 AM

@Clive,

Poo flingers lol

I was thinking pots/pans.

But no, I am being threatened with bodily harm if I don't correct this misleading statement: I have never had anything thrown at me by my wife.

There's always tomorrow.

Bong-Smoking Primitive Monkey-Brained SpookDecember 17, 2016 6:21 AM

@r's wife,

I have never had anything thrown at me by my wife.

I wouldn't let slick r get away with that. Ask him who threw things at him! If he hesitates, then snack him on the head with the pressure cooker.

@r,

There's always tomorrow.

That is a likely probability. Whether you'll be there to witness it is unknown probability, but it's inversely proportional to the density of the pressure cooker and its temperature. I hope it's both hot and heavy you little phu*ker :)

Summ TinguppDecember 17, 2016 7:54 AM

@WhiskersInMenlo

The news rules requiring vehicle connectivity are no surprise at all. Obviously, it's part of the world wide surveillance movement.

I would imagine police all over the world salivating at the chance to stop every car in town dead in it's tracks because of some self defined emergency. Of course, turn by turn tracking by all levels of government will be built in. I note it will be a crime to link any "information to individuals"...i.e. only gov. and the corporation can see the good stuff.

@Are American VPNs Compromised?

I signed up with an alleged highly private VPN, no logs and all that for I think it was...yes, about $40 bucks. First thing I noted was horrible 100% DNS leak. Then, reading my logs showed all traffic was routed though the google user content cdn and thus no doubt getting logged up the kazoo by google, but of course, not the VPN. I would guess the only VPN really safe would be a roll your own.


Speaking of logs: I shouldn't admit it, but I am addicted to reading router logs, network monitor logs, event logs and so on. In times past I sused to watch the graphics for defrag programs looking for inner meaning of all those little boxes shifting around. I know: pathetic! I agree.

However, I must say since Dec 1. when Rule 41 took effect there has been a very significant change in the pattern of logged events. Lots of scanning, some of it from very big corporate office ipa's. Just today my surveillance cams were scanned by an ip in Norway. WTF?

Also, a lot of crap coming from Germany. I am think something very bad is coming soon, if not already launched.

I would suggest offline backup right now. Hide anything sensitive on an encrypted thumb drive in a desk drawer, in particular passwords, something REALLY going on there.

Or, maybe not.

JG4December 17, 2016 8:03 AM


saw some gems today, from the usual fake news sites (the first got an on-the-air apology this week)

http://www.nakedcapitalism.com/2016/12/links-121716.html
...
http://arstechnica.com/tech-policy/2016/12/breaking-prenda-law-copyright-trolls-steele-and-hansmeier-arrested/
...[full spectrum dominance challenged]
http://www.cnbc.com/2016/12/16/china-has-seized-an-unmanned-us-navy-vehicle-in-south-china-sea.html
...[plenty more interesting fake news]

data visualizations can move hidden reality into sight. the years teach what the days never knew. you can see a lot just by looking.

http://www.zerohedge.com/news/2016-12-16/stunning-visualization-flow-international-trade

http://www.zerohedge.com/news/2016-12-16/did-satellites-expose-secret-american-drone-hangar-saudi-desert

see also, some delightful rabid from Karl. questionable document security.

Well Well What Do We Have Here?
http://market-ticker.org/akcs-www?post=231719
If you remember back when the "birther" thing was raging and the alleged long-form "birth certificate" was "released" by the President I did a multi-segment dissection of the computer file (PDF) that contained same.
My conclusion was that it had been manufactured.
I based that analysis on my examination of the data patterns that were allegedly a "scan", along with my more than two decades of experience with scanners, Adobe software and more.
That conclusion said nothing about whether Obama was actually born in the United States; it only went to the issue of whether he had presented a true and complete copy of an archived document that actually existed or whether said "copy" was in fact manufactured -- made up.
To this day I stand by the conclusions I reached.
Now, just yesterday, it was disclosed that Sheriff Joe has found the source document used to produce the so-called "birth certificate.
http://www.fox10phoenix.com/news/arizona-news/223931057-story

No Jo MojoDecember 17, 2016 10:31 AM

Sheriff Joe found two foreign, unnamed experts to support his version of reality. That's nice. He should of asked me, I would do the same for say, @2,500. Anyway, the birther thing is yesterday. Today is Trump. Try to keep up.

AlanSDecember 17, 2016 11:50 AM

@The Holistic Spy Assassin Messiah

As the essay I linked to states:

Instead of handwringing over liberal dead letters, we must come to terms with the fact that we have already been living in a form of deeply destructive authoritarian liberalism for nearly four decades now.

By four decades they mean since Keynesian economics was overthrown during the crises of the 1970s and replaced with Chicago Law and Economics (and associated schools). The latter have hollowed out politics, law and much else besides by re-configuring all social relationships as market or market-type relationships. It's a form of totalitarianism that's the antithesis of liberal social democracy. Trump should be no surprise.


NOYBDecember 17, 2016 12:07 PM

https://www.cyph.com/intro


Insights on cyph much appreciated. Comparisons to Signal would be most valuable.

Has there been a third-party security audit of Cyph?

Yes, Cure53 recently completed their audit of Cyph and concluded that "No major issues in regards to application security or cryptographic implementations could be spotted in spite of a thorough audit." [Complete Cure53 Pentest Report] A postmortem analysis will be posted on our blog soon.

https://www.cyph.com/blog/cure53-audit/

https://cure53.de/pentest-report_cyph.pdf

CallMeLateForSupperDecember 17, 2016 1:23 PM

boingboing reports: "Freedom of the Press releases an automated, self-updating report card grading news-sites on HTTPS"

How cool is that! I zipped over to https://securethe.news/

"Every news site should be secure.
HTTPS encryption enables security, privacy, and prevents censorship. We’re tracking its adoption."

Here! Hear! Then I read:

"Sorry, you must have Javascript enabled to view the teaser."
and
"Sorry, you must have Javascript enabled to view the leaderboard."


Just yesterday, in my own surfing, I noted that Washington Post, L.A. Times and Chicago Tribune don't do HTTPS.

65535December 17, 2016 1:57 PM

@ Daniela Alighieri Caruso

“You asked about implementing PGP with Protonmail. Apologies am not certain it's fully implemented yet, but scanning through the blog I found the following
“Protonmail is now the maintainer of OpenPGPjs library

https://protonmail.com/blog/openpgpjs-email-encryption/
“An as an aside: join their back end audit”

https://protonmail.com/blog/improve-secure-email-service-join-back-end-audit/

As you know I am evaluating Protonmail [See my discussion with Sancho_P]. It seems to be fairly secure and usable. The java script is a slight negative. I may join their back end audit if I have the time.

One aspect of secure email is OPSEC. That is a plus for Proton. They allow free and anonymous signup. Once you start to pay for a service then OPSEC breaks down. The trail of “business records” becomes a problem. Sure, there are bitcoin and anonymous debit cards, VPNs but payments to add to the attack surface.

As for email servers, I have clients who use them. They are tighten down MS machines with AD / DS with some sort of front end filters and AV.

The persons trying to connect to said servers must first join AD and accept a self signed cert {Hence, I suspect those are versed in certs and know the owner of the server and trust him/her]. Then the endpoint laptop added to AD with a high security template [during a reboot]. Of course dynamic DNS is required and the clients I work with usually just use A records and don’t use pop3 or IMAP4 [no mx records]. As I understand certain servers go up to a 16,348 bit certs but most use 4096 certs. Some use a reverse lookup zone others don’t. They run like a mini Google type of website for email.

The above is clearly not for everyone. That is why I am testing Proton mail. It seems secure and usable. and, the average Joe/jane can use it. I am sure the NSA can pawn it but the less potent adversary probably can not.

JohnDecember 17, 2016 4:22 PM

I am concerned my IBM Selectric typewriter may have been hacked by Putin in a sort of drive-by infection when he hacked the US Presidential circus -
How do I verify this, I do not have access to X-ray equipment ?

rDecember 17, 2016 4:56 PM

@John,

Just order some uranium ore from scientific american and grab some old photographic paper.

Nick PDecember 17, 2016 6:37 PM

@ Not again

It fell off Hacker News but the Lobsters are enjoying it. Figured it was worth bringing up after seeing the Gilmore article about IPsec. More interesting is the NeverAgain.tech thread where I'm pushing hard on some people that are bigger on pledging than following through. Before that, once again had to counter reproducible build fad that even made it to a talented web developer. Tried to simplify it even further to focus on fact that signed distribution of source compatible with local tooling is all one needs to prevent MITM. Not as hard as they're all making it out to be and interestingly using requirements that go back to the Orange Book era. :)

Still doing my thing where the interesting topics or bullshit pops up.

@ all

Spent the last few days mostly focused on an incrementally-verified bootstrap. Idea being how much of Pascal, C, and/or assembly I can subset for a base compiler that people can verify by eye. Has to be close enough to C in primitive stuff that one can hand-port a C compiler's code to it. Especially tcc or lcc. That starts the initial compilation process that eventually leads to LLVM or GCC binaries.

Also considered the problem of GCC extensions maybe needed to compile GCC & Linux. There's probably source out there for earlier, GCC compilers that were in plainer C or with less extensions. Convert the earliest one into the simple language, turn that into a binary, use it to compile the earliest GCC, use that to compile whichever version adds extensions, repeat until one has extension support necessary for latest GCC, and finish with it. Lets developer avoid a rewrite of whole, non-standard GCC in favor of a rewrite of smaller GCC plus a bunch of compiles & packaging.

65535December 17, 2016 6:58 PM

@ r and Not again

Is there any Anti-virus maker not in bed with their respective governments spyware programs? That is said AV maker actually flags State Sponsored Spyware? I am doubtful.

If Kaspersky does I would be willing to try their product [Kaspersky did catch Stuxnet and duqu … a little late].

This goes to 2013 when EFF and Bruce S. sent a letter the top AV makers asking question which included:

•Have you ever detected the use of software by any government (or state actor) for the purpose of surveillance?

•Have you ever been approached with a request by a government, requesting that the presence of specific software is not detected, or if detected, not notified to the user of your software? And if so, could you provide information on the legal basis of this request, the specific kind of software you were supposed to allow and the period of time which you were supposed to allow this use?

•Have you ever granted such a request? If so, could you provide the same information as in the point mentioned above and the considerations which led to the decision to comply with the request from the government?

•Could you clarify how you would respond to such a request in the future?
Those drafting the letter appeared to be aware of the case of Lavabit, the encrypted e-mail service that shut down rather than comply with a secret court order that demanded the private encryption key protecting users' communications.

"Please let us know if you feel that you cannot, or cannot fully, answer any of the above questions because of legal constraints imposed upon you by any government," the letter stated. "If you feel you cannot answer any of the questions above, please reply 'no response' to this question."

http://arstechnica.com/security/2013/10/dear-av-provider-do-you-enable-nsa-spying-yours-eff/

or

https://www.bof.nl/live/wp-content/uploads/Letter-to-antivirus-companies-.pdf

or

https://www.eff.org/deeplinks/2012/04/open-letter-academics-and-engineers-us-congress

or

https://www.schneier.com/blog/archives/2013/12/how_antivirus_c.html

As I recall the results were disappointing. Only a few companies answered and with somewhat opaque answers.

Trend Micro, F-secure, ESET, Avast, Panda Security and a few others said they were inclusions with TLAs. Thus some people concluded that most American AV companies were in bed with the NSA or had been NSL’d into secrecy. These AV makers let NSA level spyware throught their scans. The question still remains:

Are American Antivirus makers turning a blind eye to state sponsored malware?

rDecember 17, 2016 7:05 PM

@65535,

I don't advocate any anti-virus at this point, the internet isn't fun and games anymore there's too much invitation attached which is why I regrettably left the AVP/Kaspersky usergroup.

There's just too many questions out there, but I do have a great deal of respect for EK.

The Russians took the Av scene just as seriously as the Russian Vx'ers.

I think the American's were more concerned with sales for a very long time but it quickly got to the point where only things like tripwire could give you a fighting chance in hell.

rDecember 17, 2016 7:10 PM

Which, I **might** add was effectively hitting the reset button back to CPAV/MSAV of checksums and file sizes.

Like I just tried to illustrate about ab's firmware argument, if you don't know:

a) the cypher
b) the key
or
c) the entry point

You're not going to get anywhere with an encrypted blob, most firmwares are directly reversible if not discernable due to a lack of actual hardware documentation.

Further more, if you look at the NSA exploits for firmware you will realize they are filling holes with patches and malignancy - it's VERY easy and very common to find large sections of NULs or NOPs within properly aligned images that are preloaded onto devices.

At which point it's just a matter of getting the upper hand, think evil maid.

rDecember 17, 2016 7:14 PM

Upper hand, like "shit rolls downhill."

Execution starts somewhere and if they had it first you're doomed.

rDecember 17, 2016 7:17 PM

Even if there aren't large swathes of alignment and pre-initialized data[s] you can often find places where code reuse and redirection become possible - if the firmware was written en C you'd even likely be able to just reverse the speed optimization and replace it with size optimized code.

Assembly is roughly equal to basic.

ab praeceptisDecember 17, 2016 7:22 PM

Nick P

While I would like to think of an ideal way around e.g. Modula-2 (there exist ->C transpilers) I wouldn't choose that path due to pragmatic reasons, mainly the absence of up-to-date formal tools.

In the end I'd go the C route but a) limiting myself to a sane subset (e.g. no ++/-- pre/post operators), b) strictly implementing formally spec/model'd algorithms and c) heavily annotated and fully verified with separation logic.

Alternatively one could go the Ada route which would offer some nice advantages but which in my minds eye is somewhat of a pita for quite low level code (like bootstrap code).

Note: There is only 1 time domain in that kind of code so spec/model and verif could be done without that additional burden (unlike a kernel) and using well known and established tools like B and verifast.

65535December 17, 2016 7:26 PM

Make that:

Trend Micro, F-secure, ESET, Avast, Panda Security and a few others said they were NOT inclusion with the NSA or other TLAs.

rDecember 17, 2016 7:36 PM

Don't trust a damn thing any one of them say, they're puppets.

There's a couple small things I like about a few of them - Avast is very

If the government controls the high ground then leaving open doors at the bottom of the hill you can see all the comings and goings.

This is the honeypot /Mysterio/ alludes to.

Let me explain my theory, in the 80's and 90's Russia had an environment that was very hacker friendly due to a lack of interference. We didn't have that here until last year with Obama, we have been discriminated against within our own borders - I think the day - and this is saying too much but my hearts in the right place - I think the day that Russia forcibly removed VxHeaven was the day we went to war with information.

Sure, the whole world is freeloading off of the open source world now - but in the 80's and 90's a large majority of unofficial reverse engineers were Argentinian Spanish and Russian.

They could get away with practically anything and they spent countless hours not fuzzing apps remotely but reverse engineering the subsystems we dealt with at a local priviledge escalation level.

Anyways, let me reiterate something I said the other day:

If you do research - they will weaponize it - we have to guard against THAT.

rDecember 17, 2016 7:37 PM

Avast is consumer and feature oriented, imo. Bitdefender is a hell of a startup and quite the performer and Kaspersky is too.

@Mod, don't ban me please?

rDecember 17, 2016 7:41 PM

Ab, and Nick are pushing the solutions - but without being able to reach into the hardware it's moot.

65535December 17, 2016 7:44 PM

@ r

“I don't advocate any anti-virus at this point, the internet isn't fun and games anymore there's too much invitation attached which is why I regrettably left the AVP/Kaspersky usergroup. There's just too many questions out there, but I do have a great deal of respect for EK.”

I agree with you.

I think AV could actually be APT in and of itself. It has the ability to scan all files [in most default setups] this is an invitation to skim data or worse.

Next, a lot of AV suites do SSL stripping… this is a two edged problem. Sure, you want your AV to find encrypted malware – but you also don’t what to give away the keys to your kingdom. This doesn’t even cover the holes punched into firewalls for updates, unwanted ad-ons and CPU cycles expended.

Sadly, I will note this is a tough sell to Small Business customers. They depend on some form of protection and they tend to use MS systems. It is almost a must for Small Business. It is a hard nut to crack.

rDecember 17, 2016 7:45 PM

A homomorphic virtual machine might work as a hardware agnostic solution, but homomorphism is still in it's infancy.

I investigated permutation as a DRM mechanism, I honestly advocate permutation of code signing because in addition to providing the inalterability that signed code provides it also creates a "moving target" that is capable of identifying your closed source binaries leaker through what is essential watermarking.

rDecember 17, 2016 7:46 PM

Permutation over* not of.

Because I've been cracked too many times in the read and rewrite world.

Nick PDecember 17, 2016 7:49 PM

@ ab praeceptis

The goal is for average developer who won't learn formal verification or heavy stuff on compilers. That means it has to be something where the code itself is obviously correct. If I found the design suitable, I could mock-up equivalents in Frama-C, VCC, or SPARK Ada for safety checks. Throw in some static analysis, too. The final product, though, would be a language and toolset that's ultra-easy to understand piece by piece. That compiles the source of the simple, C compiler which handles the rest.

rDecember 17, 2016 7:50 PM

It's a very hard nut to crack, and things are getting more and more hostile every day.

Now we have ransomware and iranian(?) mbr bombs.

The military has ZERO respect for research they took a virtually limitless source of power and turned it into a f***ing bomb for gods sake.

rDecember 17, 2016 8:00 PM

China targeted students with tanks, in America we target them with eavesdropping and inserts.

Other than a loss of life, I really don't see much of a difference where freedom of expression is concerned.

ab praeceptisDecember 17, 2016 8:04 PM

Nick P

Hmm, not bad that approach. So, you mean that normal developers would write the code and verif specialists would then annotate and verify it. Smart.

But: To have something really realiable and well done one will absolutely need formal spec and modelling. I don't know (and don't personally care) but maybe you know some tool that generates code based on spec files. If that tool were foss one might even extend it to do at least some basic verif annotations too. After all, the better spec tools have the necessary info like domains/codomains (-> H3) or loop info (-> invariants) available anyway. With some work (that would be worth the effort if that thing would be used for more than some bootstrap code) one might even generate quite some of the separation logic, in particular as one would be in full control of the generated code.

Thinking about it I'd frankly take the normal programmers out of the cycle and rather have 1 team work on spec/model tool extension and another (smaller) team on the verif annotations that aren't generated automatically.

In case you insist on it I'd suggest Modula-2. Simple enough, much better than C (particularly in not anally paranoid and very experienced hands), some actually useable tools available and there exists a transpiler ->C.

rDecember 17, 2016 8:11 PM

One last thing and I promise I'll leave for a bit from this tirade of mine:

(me)If you do research - they will weaponize it - we have to guard against THAT.

If we're not doing the research someone else is - WE - as human beings have to protect ourselves against that also.

Nick PDecember 17, 2016 8:44 PM

@ r

They didn't patent it but they did do two things:

1. Keep EAL6+ software on export control list classification of munitions. So, they're legally weapons of sort that they might block export of. That's critical issue given high-assurance software is so expensive to build *and certify* that most would depend on the foreign sales. Or not enter high-assurance market at all. My trick is to just not get an official certification at EAL6+: officially at EAL4+ then private one for EAL6+ stuff. Cheaper, too.

2. Have cronies at SAIC form a shell corporation that does nothing but file patent suits on things like encrypted messaging. They're the reason Apple had to change their design. No easy solution for this past not operating in America.

@ ab praeceptis

" So, you mean that normal developers would write the code and verif specialists would then annotate and verify it. Smart."

Probably talented people write the code. Specialists could annotate and verify it. Normal developers would simply read it, assess its likely correctness however they choose, port it to whatever language they choose as it's a common subset, and eventually trust it to do the job.

"But: To have something really realiable and well done one will absolutely need formal spec and modelling."

Wirth and Hansen didn't do this. I don't think it's necessary. The spec can be informal but precise like they did.

"In case you insist on it I'd suggest Modula-2."

Modula-2 is a candidate. I'm also considering Hansen's Edison as it was simpler than C or Modula-2. Tiny.

"P.S. You might want to have (yet another again) look at Tanenbaums ACK."

That one is very interesting. Thanks for the tip.

ab praeceptisDecember 17, 2016 9:19 PM

Nick P

"(me) ... will absolutely need formal spec and modelling."

"(you) Wirth and Hansen didn't do this. I don't think it's necessary. The spec can be informal but precise like they did."

I disagree. Not with the statement per se but with it's applicability. If I got you right, we are talking about a team and not about single and exceptionally gifted people of which there are maybe a couple of dozend a century. Proper (formal) spec will be a necessity. It can be done with an informal spec but one will regret that later and one will not be in a position to make provable statements as to the bootstrappers safety and sanity.

As for using Edison (I'm a P.B. Hansen fan, too) I advise against its use. For one there is next to no tools support and there are extremely few having even heard of it, let alone having any experience. Moreover the real time properties aren't needed and the "very small language" demands a high tribute to be payed. While one might brush aside the absense of switch/case constructs as cosmetic (which still may also translate to "safe"), the absence of subranges is a grave issue.

Finally, as you seem to be (correctly and smartly, I'd add) on a Wirth/Hansen rail, I'd like to remind you that some spec/model tools might be the right compromise here (and that aren't far away from the Wirth/Hansen languages).
As an example I can report from (a not insignificant body of) personal experience that VDM specs can be very comfortably (manually) transformed to e.g. Modula-2 or Ada.
If I'm not mistaken (my practical experience with it is rather limited) there exist B based tools that can generate code. It shouldn't be too difficult to create a Modula-2 generator based on the pattern of existing translators. (I'm mentioning B because it's well established in serious projects, it offers the needed capabilities, and it's said to be rather simple to use. Plus, there exist modern and comfortable tools and even animation engines).

That said, I still think that it would be more useful to cut the middle step out and to create C code (reasonably limited subset) right away. This would offer the additional option to create verif. annotations along with the code. That's btw also how I came to suggest ACK. It was my response to the question how to build such a tool (reading e.g. B spec and generating C (or Modula-2, if you insist) code).

rDecember 17, 2016 9:51 PM

@ab, nick

How do you two feel about the GNU Modula-2 compiler?

It obviously hasn't been verified but what bases do you two recommend for those who are endlessly tired of bandaids and needles?

Clive RobinsonDecember 17, 2016 11:39 PM

@ John,

How do I verify this, I do not have access to X-ray equipment ?

That is just an "Oh So Sixties" soloution... And realy only works against metallic technology, which is such a "US thing" since the U2 fell to earth...

Putin and Co don't like that sort of technology except for toys, they like the "human touch" with X-Ray undetectable ceramics and plastics etc. So you are going to need a portable nuclear reactor or bucket of Californium-252 to use neutrons instead. But you will probably have to drag them across the hot coals, or watetboard them [1] to get them just right techniques the KGB would approve of ;-)

Apparently due to the many and grevious failings of TSA and similar brown/black shirt staff to "spot the obvious" the DHS is looking to use epithermal neutrons to make the obvious, well "more bleed'n obvious"[2]... Thankfully so far nobody has come up with a viable commercial solution...

[1] For imaging you generaly need to slow the neutrons down in various ways, this can be done with water, polythen, or the use of carbon as graphite. The resulting "thermal neutrons" may be not quite right, therefor the graphite may be heated to get a different profile of thermal neutrons termed epithermal neutrons.

[2] That less than subtle and immensely costly bureaucratic insanity that Einstein so neatly described...

The Holistic HaX0r SAMDecember 17, 2016 11:57 PM

@r

@Messianic,I appreciate the invitation, but don't you think a PKI blanketed .js pushing venue is a little on the risque side?

Just noting. It is Cory Doctorow's site. I actually know the guy, having been a peer with him in something. Very brilliant guy. Often quoted here. Science fiction writer and "technologist", as well as leading privacy rights activist. Extremely good at predicting future technology.

FYI, while I reiterate it below, I will state again, I am actually neither for nor against any of these political parties per se.


@ismar duderija

@The Holistic Spy Assassin Messiah I am happy I can still can smell a vigilante from a mile away 😉

Admirable observation, seeing the flame from the words, and recognizing the nature of it.

I do share that manner of fire, but I am no vigilante. Not by the American, english, definition of that word.

I operate within the confines of a very large organization, and operate by powers and authorities entrusted to me.

I am vigilant. I vigilantly stand before the rabbit hole.

I certainly enjoy the sight of those who would approach the rabbit hole with weapons drawn. But, there is nothing I, nor anyone else must actually do from there. The rabbit hole is all gravity. No one can approach it and escape. It does not need anyone to throw people into it. Everyone is compelled towards it.

And, on that, on
Security, security precautions:


I do know how to create new forms of stealthy exploit code and malware. I do know how to find highly critical zero day in very important applications of any variety. I know how to plan out psychological operations that can be enacted with minimal resources in order to provide sufficient, plausbly deniable cover for an operation that might use such tools.

I also know how to create systems of covert communication, which should be taken as a "given" if one is talking about creating functional, stealthy malware designed to match the most critical of vulnerabilities.

And I know the ins and outs of systems designed to protect against just such attacks. Because I have aided in creating exactly such systems.

Believe it or not, it does not matter. Obviously, there is much benefit for not being believed. But, if you think someone can do all of that and not be on anyone's radar, you have to be out of your mind.

Either you already work with the government to begin with, or you get to do so later. Governments do not go without noticing such people who can do such things.

In my case, I have always worked for part of a large organization, and always within the powers and authorities entrusted to me. I see unsolved crimes happen, as does anybody. But, sooner or later, everyone gets caught.

So, my security is very, very different then the security required for someone on their own.

When I see people talking about creating security on their own, and operating on their own, I will admit, I do have some concern there. We all have our potential adversaries. My potential adversaries often are the very same sorts who are your potential adversaries. That is you, who operate on your own.

And you are on your own. This is the number one problem I see. It is rarely a technical problem. Look at the bigger picture first, and always keep the bigger picture in front of you.

Take for instance, this forum. Dangers? Threats? Very likely you are going to have all sorts of nation state organizations siphoning this up. You are going to have some that see the endpoints and connect points. You are very likely going to have people who work for one organization or another. Some will be corporate. Some will work for some city or county or regional policing agency. Some for a federal group. And so on.

Hacking aside, social engineering, is your number one problem. You do not know who I am, you do not know who anyone is. The equations for analysis are not natural to people. They are hard to learn and apply. You always have to be aware of the end game.

What is the end game for you? When you finally find your self getting into a car with someone you met on an online forum? Or maybe that first time you two find a way to exchange emails? Maybe it all started that first time you decided to trust them. And when was that? Years before you close that door on that car?

But to really live that way, is to be really, really alone. And to never be able to trust anyone. Ever.

So, much better idea to step aside, and consider who it is you might be able to belong to, and who you can trust. Legitimate powers and authorities.

@Daniela Alighieri Caruso

And, no, we don't believe you are who you say you are.

An odd thing to say to someone who is always in disguise.

You would be very surprised to learn who I really am, what I really have done, what I really can do.


@AlanS

The second to last paragraph in that is very powerful.

However, for my own self, I am entirely outside of the political system. I find it foolish that people believe they are in control of their own destinies, much less the world. [I apologize if you are one who believes otherwise, but I am a fool in my own way with this viewpoint I take. Is it not, for instance, the antithesis of the stance of a person who stays abreast of the times?]

I can, for instance, agree with the writer on those observations I cite. But, I can not entirely agree, because I do not pretend to know the answers. And people, and situations, are many sided. It is, then, just words. Words spoken from very, very limited perspectives.

So, what then? It is like music notes. Poetry. It is like seasons, like the wind. Like the beauty of a snowflake, which is here, then gone.

Words read on a stage, in the context of a drama. The same words recited after the show is over, lose the context, and so their weight.

And they were never really what they appeared to be.

The Holistic HaX0rDecember 18, 2016 12:05 AM

@ab praeceptis

I appreciate your response, but do want to avoid specific political conversations, as I am sure you would also agree. Or, that would end up drowning the entire list...

You can see more about my very strange viewpoint of matters, above. Quite frankly, I do not mind stating, that I actually really view there as being a Heaven, and a God.

I do not believe God really allows people to run the world.

I understand, even for people who do believe in some manner of God from deists to whatever, that they typically view God and Heaven as very, very far away.

This is not my perspective. I view the Kingdom among us already. I do not have some need to promote my viewpoint, but you can google, 'yom kippur war angels', if you wish.

I get my paycheck, you get yours.

Certainly, my background and such is impossible to believe, and I am very well aware of that. The banks do believe, however, my paycheck.

DroneDecember 18, 2016 1:49 AM

I heard the squid throwing woman claimed Trump made her do it. I wouldn't be surprised, Trump is making thugs attack veiled Muslim women. I know it's true, all the big news sources said so!

Clive RobinsonDecember 18, 2016 6:03 AM

@ Nick P,

Spent the last few days mostly focused on an incrementally-verified bootstrap.

Been there, done that, got the tee shirt and tasted the dog food :(

Good luck on it, I started by writing my own assembler in BASIC on an Apple][ first, then later reworked it for an IBM PC. I had access to Whitesmiths C[1] using it to get the Tiny C Compiler up and running with my assembler...

You will find both the Plauger books and Dragon book to be essential reads (and still available).

https://en.m.wikipedia.org/wiki/Whitesmiths

rDecember 18, 2016 6:22 AM

I certainly enjoy the sight of those who would approach the rabbit hole with weapons drawn. But, there is nothing I, nor anyone else must actually do from there. The rabbit hole is all gravity. No one can approach it and escape. It does not need anyone to throw people into it. Everyone is compelled towards it.

The gravity of the situation, is that we think of it as a rabbit hole when in all actuality it's really a Foxhole.

Clive RobinsonDecember 18, 2016 6:41 AM

@ r,

... but it [AV] quickly got to the point where only things like tripwire could give you a fighting chance in hell.

I realised that AV was "the wrong way" back in the days of Dr Solomon before people had heard of the Internet, or for that matter seen Local Area Networks outside of Universities (anyone else remember the Cambridge Ring, or Newcastle Connection?).

I had realised that as in all "who dunnits" the serious threat was the "trusted insider" like the Buttler who "guarded the door". Which is all the original AV was...

But the likes of "tripewire" were a longtime in the future back then, I started taking an interest in what we now call "gapping" and "strongly mandated interfaces" and the more interesting EmSec issues not just TEMPEST.

By the time Kim and Spafford brought "tripewire" into the world in 92 and made it a stable product I had realised it likewise was in effect just another "Buttler" and that the problem was not if they abused the trust or not, "they were inside"...

That is the malware had got into the system and the damage was probably done... Back then "Bastion Hosts" and "application wrapper firewalls" were starting to get going and were going somewhere interesting. Unfortunatly the industry "wanted single box appliances" with just a power switch or software application they could "install and forget". That's what they payed for good or bad, and that's what we have got and withit the hamster wheel of sys admin pain.

Like AV before it tripewire is nolonger upto the job by it's self and people seriously need to think where they are going to be alowed to go by the powers that be. Because we left it to late and now we are nolonger masters of our own homes let alone destiny, and must pay tribute to "The Man" or get smited by law, be it civil or criminal, as the man is now corporate as he is federal.

rDecember 18, 2016 6:53 AM

Eh, I agree and understand.

I likely shouldn't have publicly broadcast the revelatory foxhole thing, but you are likely proving that I'm right on that issue.

It seems you saw a foxhole develop in communications, in technology.
Anybody goes in?

NOBUS COMES OUT.

I'm not concerned, I'm a worn out old crow who's tired of living with cannibals.

rDecember 18, 2016 7:05 AM

I'm not sure if we left it too late, we just have very little time left.

I'm one of at least two people in this small town emerica with very early copies of slackware and openbsd and a large stack of commodore 64's to play buck rogers on.

It's not hopeless, but the voices are being lost or silenced because the gravity traps both sound and light.

I'm not worried because I'm not a kid, there are 3 people in this world that know <where I> live - one of them mysterious was OPM.

That's their fault, I tried to stay in touch.

rDecember 18, 2016 7:09 AM

Well gee golly willikers batman,

I guess since OPM happened it's not just 3 people anymore now is it mom?

rDecember 18, 2016 7:17 AM

The point is, as a kid I watched the weapons develop.

As an adult I got to see them realize "oh shit" and they started doing take downs of educational materials. It's very hard to defend one's self from unknowns. especially all the unknown unknowns.

But here, let's stick with what I DO know.

Would you like fries with that?

Clive RobinsonDecember 18, 2016 7:25 AM

@ r,

Ab, and Nick are pushing the solutions - but without being able to reach into the hardware it's moot.

Which is a point I made some time ago on this blog... Have a look for the very many Castle -v- Prison or C-v-P discissions our host was kind enough to alow to happen.

Put simply, after some thought you will realise you can not trust anything below your chosen point in the computing stack including all the way down at the device physics layers.

So you are trying to build your castle --as every man's home is-- on shifting sands. Which has always been "a fools errand" as it can not be reliably done, and you end up forever mitigating problems in your design and not where you should be devoting your effort to. It's the old "Drain the swamp" problem where you are to busy fighting the crocs to actually drain the swap to solve the croc problem once and for all as by removing the water where they hide.

The soloution to the shifting sand and croc problem is don't bother, mitigate instead. If you can not trust what is below, build your castle like a battle ship so it rises to any occasion and the perfidity of what is below nolonger endlessly occupies your time.

There is a very old game about truth, lies, and two guarded doors behind which certain death hides behind one and freedom the other. Appart from this all you know is one guard always lies, the other always tells the truth, and you are alowed but one question before you chose a door to walk through to your fate.

The trick is to ask a question that in effect goes through both guards and you then know the answer will be false because of the lying guard. So you ask either guard "If I was to ask the other guard the way to freedom which door would he point to?".

It is the story behind this ages old riddle and how it gave rise to the idea of electronic voting protocols in the New York Telephone company then NASA that gives rise to how you mitigate the trust issue.

I've talked about it a bit more depth in the past on this blog,

https://www.schneier.com/blog/archives/2014/01/souffletrough_n.html#c3604056

When others have asked for the impossible of a "Trusted Computer".

Invarious futuresDecember 18, 2016 8:31 AM

I think the russians were late to the game, I think having EK so high up in the GRU disadvantaged them. netlux didn't get poked until 2010? Meanwhile we'd been poisoning the global well of the gnu world order for likely many many years.

I grew up reading phrack, codebreakers, 40hex, etc.

Like I said, I'm tired of living with cannibals - crabs as you explained.

Crabs like body lice, or oh so aptly NIT's.

We have a right to education, we have a right to privacy, we have a right to self-determination, we have a right to speech, and I have a right to my beliefs through what is my right to freedom of religion.

God gave us all plants blah blah blah we eat shit for marijuana and your cattle are clucking about the new diazepam patch. It's the leaning tower of piza, the system IS [censored]. ;-)

As for my papers and effects? One can read them and weep, reflect upon this: I draw with lipstick on mirrors. This is not a smear campaign, it's a smudge on your reflection.

Can you hear me now?

I don't worship the dark lord or whatnot even if I opened the cookbook once or twice. <I> work with the poor and disadvantaged - if you don't believe me ask my neighbors - the day care down the street mailed me thank you notes for helping them with their driveway. 5 women out there with 4 yards of aggregate bucketing the base all around? I brought order enthusiasm and my own wheel barrel to help. What's an hour to me if I am doing the right thing? The two men that were there?

Their wife and their mom sent me a SASE, that was more than payment enough I am grateful.

I strive to educate myself and others, and I try to defend what I view as god given rights of others. So I misstep every couple days, I'm still headed in the right direction.

I will always find my own way, bandaids, needles - I'm so tired of patching.

But what do I know? I've spent my adult life working for men who shake your hand and stab you in the back. Who take their stress and poverty out on their workers, their employees, e.g. their bread and butter. I've had military steal $285 dollars for my first car out of a dresser drawer and brag about it. I don't have a problem with the military, I have problems with the types of people they recruit for their image imagine that? Lipstick on a foxhole. I've had the opportunity to work with some amazingly skilled craftsmen over the years and I've learned alot. I've learned I don't want the monkey on your back riding me because you're stupid ass chews vicodin out of a pezz dispencer or smokes crack in a tree. I learned from a man your age that you take care of your help, and you take care of your equipment - and what's your's is what's left. But it seems to me, where I am in life is that humanity stands there with their hands in the cookie jar with the sugar glaze all over their eyes. Dumbfounded that somebody else would have an interest inside of that jar they are clutching. A sugar sarcoma staring at a hungry child. It's not easy out here, and I've all but given up - small business owner who always tries to do the right thing... Well those margin's don't quite cut it do they?

We are all small business owners, e.g. we all have at least 1 employee.

I'm not enthusiastic about the Trumpette's call, but I know well enough not to look a gift horse in the mouth - there will be opportunities to be had with deregulation. You can't keep a good man down, you can put him down - but it had better be with a bullet instead of a bottle.

A note to the enfranchised? I'm one of those spoiled infants - no bottle for me.

JG4December 18, 2016 8:58 AM


@Clive

Thanks for pounding the hardware nail on the head yet again.

Your mention of "epithermal neutrons" made the Windscale disaster spring to mind, even though much of the graphite heating was unintentional. I've probably commented before that most of the nuclear accidents were covered up, including Santa Susanna.

HypocrisyDecember 18, 2016 9:34 AM

@ Clive Robinson,"The trick is to ask a question that in effect goes through both guards and you then know the answer will be false because of the lying guard. So you ask either guard "If I was to ask the other guard the way to freedom which door would he point to?"."

Old enough to remember pre- and post- NAFTA, Clive. Old enough to know hypocrisy

IronCancellerDecember 18, 2016 10:57 AM

I belief it hasn't been mentioned here before, but it's big news in Germany:
ThyssenKrupp was the target of a cyberattack
German news sites have more details (the hack was apparently detected early, but was allowed to continue for some time in order to gather evidence; China seems to be the prime suspect), I didn't find much on the English web.

Nick PDecember 18, 2016 11:16 AM

ab praeceptis

"If I got you right, we are talking about a team and not about single and exceptionally gifted people of which there are maybe a couple of dozend a century. "

Those kind of people have already made specs. I might draw on some of it like the typed assembler or C0 subset of C. In any case, nobody understood or used any of it. That's what happens. It's why I'm avoiding it for this project. It's not as if someone couldnt do a parallel project that uses a starting point with formal semantics and proof.

"For one there is next to no tools support and there are extremely few having even heard of it, let alone having any experience. "

This will be true of any of the lowest-level languages I use. They have to be simple at language & implementation level to degree ordinary programmers without much compiler training can understand it. That means the bottom has to be closer to a macro assembler or other tiny language. P-code, Pascal/Oberon subsets, Modula-2 maybe without safety, Edison, Tcl-like language, HLA... stuff like this. It bootstraps the compiler for something like Modula-2. This exact technique I learned from Wirth: Pascal/P (Pascal -> Pcode -> assembly) and Lilith (Modula-2 -> M-code -> assembly).

"
As an example I can report from (a not insignificant body of) personal experience that VDM specs can be very comfortably (manually) transformed to e.g. Modula-2 or Ada."

"It shouldn't be too difficult to create a Modula-2 generator based on the pattern of existing translators. "

True, but average developer won't understand how that works. That's for separate, formal projects. Generators from formal or high-level specs to low-level code are currently getting takeup in safety-critical with Esterel SCADE in the lead. Atlier-B and Perfect Developer do this stuff, too, but more manual.

"That said, I still think that it would be more useful to cut the middle step out and to create C code (reasonably limited subset) right away."

This will probably happen anyway in the project as one or more people involved will be C coders. Plus C runs on about everything. A C version has to happen. Preferrably one small enough to run through Frama-C, Saturn, etc.

@ r

"How do you two feel about the GNU Modula-2 compiler?"

GNU's compilers are usually overly complicated. I assumed they'd do the same to the Modula-2 compiler. So, I ignored it. In this project, a language like Modula-2 will be viewed side-by-side with the smaller language which will be viewed side-by-side with the assembler. Intermediate language might be eliminated if compiler or interpreter for say Modula-2 proves easy enough to verify by eye in assembly for novices. However, something with just basic blocks, expressions, conditionals, strings, necessary data structures, and function calls would make things easier across the board. Wirth's Pascal-S was most recent example I found where it could do a whole lot with very little that was easy to compile.

One of the reasons I'm avoiding stuff like Modula-2 and did in original post is that this compiler is oriented around C. The goal is to bootstrap C compilers. So, the higher-level language is probably not going to be safe. It probably will use C datatypes & calling conventions for compatibility. It will need to work with pointers directly. The compilers we're compiling are unsafe so the bootstrapping compiler doesn't need to be safer. Most likely, something like Frama-C or SPARK Ada will be used to write the initial code that gets hand-translated into the simpler language with manual verification due to small size & no tooling for simpler language. That lets me get *some* verification of correctness while not getting end-user involved in that complex tooling.

@ Clive Robinson

Yeah, I bet that was fun. You know my early ones were in BASIC, too. I loved how it was fast but didn't crash like the C prototypes. Just had an error that took me to where it happened in debugger. :) In any case, there's a consensus in the modern crowd to no longer recommend the Dragon Book since it was a nightmare for most beginners. I'm not even sure if it's good for a reference since compiler field is so far ahead these days. But some that oppose it for beginners still say it's good to read after you get the topic.

If you want for your recommendation list, here's the ones that got the most positive recommendations from the most programmers on Hacker News:

Modern Compiler Design in C

Note: Out of print but download available. The older folks like this one.

Jack Crenshaw's Tutorial

Note: A few people liked it. I see why as it's incremental, well-explained, and with code. Quick glance says it suffers from focusing too much on parsing instead of code generation. Made sense in 1988 but we can just give them parser generators these days. ;)

Modern Compiler Implementation in C by Andrew Appel

Note: A lot of people liked this. He has them done in ML & Java, too. This is same guy in papers I cite on cutting-edge of verified programs, esp compilers.

Practical Compiler Construction by Holm

Note: Supposed to be read after something like Appel to make knowledge more thorough & learn optimizations.

General note: I left off Wirth's stuff since we're talking about learning C compilers. His has different tradeoffs and design than most C compilers do.

@ Figureitout especially but others too

Reading through compiler recommendations led me to one of Kragen Sitaker's writeups. That's the clever programmer I mentioned in the past who knew about stuff from Cleanroom to Forth to modern stuff he actually uses. On a quest for enlightenment that crosses everything. Did a nice teardown of NonStop architecture from the manuals in about one night. Dude's a trip.

Anyway, Figureitout's Christmas present is Kragen's thought experiment & solution that reminded me of his own projects. That is Stuck in a room with a PC without an OS. Fun read.

Note: I was going to post his bio he shared on his lifelong learning experience as a programmer. There was a series where various, well-known programmers were doing that. Disappeared apparently when my bookmarks got corrupted & can't remember name enough to Google it. (sighs) Everyone keep an eye out for that stuff since I think he had some rare book recommendations in it for tying together various paradigms.

rDecember 18, 2016 12:45 PM

Anyways,

for all my huff and puff all is not lost.

If there's a reasonable secured stratum available for openrisc when it drops it might work.

We just can't go around only drinking half coffee or half tee, it doesn't mix.

Holistic HackerDecember 18, 2016 2:49 PM

@r / @Invarious Futures

on code security:

Despite what I stated, I do not follow much on folks on improving languages and compilers and such to improve code security. A coworker recently offered for me to join such a mailing list, I declined. Yet, from time to time, in years past, I have argued that code should become much more safe out of the box. As it stands, I simply rely on working on what we have. And frankly, a lot of code did become much cleaner out of the box since those days.

Did the US government backdoor all gnu code and such? I strongly doubt it. But, you do not have to have mole writers on board to backdoor code, when you have armies of folks and tens of billions of dollars of other resources to find systematically security vulnerabilities in code. Finding vulnerabilities already extant is effectively the very same thing as putting vulnerabilities there.

That is, either way, you have a backdoor.

I do follow methodologies on writing secure code, however. I do follow methodologies on finding security vulnerabilities.

I might note that I have, my own self, found plenty of memory based security vulnerabilities. However, even from my beginning, I have always loved to focus on finding critical vulnerabilities which usually involve the most topmost layers of applications. These issues are extremely hard to guard against at the level of languages being natively secure. This is not, however, why I like these sorts of security vulnerabilities. Rather, these sorts of security vulnerabilities tend to evade all levels of memory error exploitation protections and discovery methods.

And, further reason, these sorts of security vulnerabilities are extremely difficult for any manner of smart, anti-zero day security system to detect.

These sorts of vulnerabilities tend to effect extremely feature rich, client side code. And as long as these feature rich, client side code systems exist, so will these sorts of vulnerabilities.


I might note, if you ever were able to figure out who I am - I am obscure, despite my work, but that would require piecing together quite a puzzle - you would not be happy to learn all of the places I have worked.

Or all of the applications I have worked on.

I will state I have worked at major corporations, major governmental organizations, and I have also worked on major privacy enhancing systems. Worse still, what is not on my resume is that I have extremely deep ties to major security protection systems. Much of this is peer based. When I go to conferences, I quickly hook up with folks from government, and from such companies, companies which lead the fight against zero day and unknown malware.

That front is where I have always been. Why? Because that is where the most dreadful of foreign based attacks come from. And that is where the most dreadful of domestic based attacks come from.

It is interesting.

That said, yes, everyone prefers to rely on social engineering, even still, and spending such secret technology is highly expensive. As everyone on this list knows.

In terms of where the real attack tools come from, however, I have said this before, and will say it again: there are farms of these extremely advanced tools, and farms of these vulnerability researchers, at many countries, working day and night. These tools deploy, almost invariably, a combination of SAST (automated code review systems), or "whitebox" technology, combined with extremely sophisticated DAST (or automated black box systems). You can research some of that very same technology in the corporate market, by research SAST and IAST technologies.

The main countries know these things, this is not giving away anything. Had I made such posts fifteen years ago, I would have been.

Otherwise, yes, as the exposed Sentry Owl/Eagle/etc projects did reveal, there are expansive undercover programs where there are undercover agents put into key areas in order to supplant those technologies.

And the price for doing this with open source is extremely minimal.

I do believe and support open source, but that is a fault.

And, as people should not lose their minds over these equations, of course, first and foremost are privacy tools targeted.

Because the people who want to use such technology are often the very first and major targets to target.

In fact, we may not know who they are. Where "we" is both me and my friends, and our worst enemies. Everyone on this level of attack understands that those with jewels make elaborate steps to protect those jewels.

Or, to use the very good Le Carre verbiage, "treasure".

All these things said: stay off the radar folks. No one here is an Islamist terrorist. At best, you are talking folks who are over sensitive to outside inspection. Most good folks, just too paranoid. Working on this stuff really does not get you on the radar, but some who are in these areas do put themselves on it. Because of the things they say. Being critical of your government is not enough for anything. No people are more critical of government, then government. You should hear the things people say.


Clive RobinsonDecember 18, 2016 2:56 PM

@ Nick P,

But some that oppose it for beginners still say it's good to read after you get the topic.

It's funny thay should say that, but I've always liked it, in fact the 1988 reprint is sitting at my right elbow as I type this as I was refering to it this afternoon for something I'm typing up.

I had the Holub book, but I made the mistake of loaning it to someone, and it did not come back :-( before they scarpered to Australia... (I know I can get annoying about getting my books back, but to scuttle half way around the world, I ask you ;-)

I also had a book on small C but that was nicked from my desk at a place I was working at many years ago, as was my original K&R book... It just goes to show some work colleagues have less honour than some criminals no wonder Scott Adams calls them "Cow orkers"

As for compiler books becoming "out of date" it Depends on your view point. They obviously worked for the compilers of their day, and thus will still help you get a compiler up and running. Are they uptodate on the latest tricks, no but then for what you aim to do those tricks may well be a bad idea. The KISS principle applies at all times as does the old *nix advice of "First understand, second prototype, third get it to run reliably, then quit whilst you are ahead of the game".

Optimisation rarely gives useful benift other than for your CV, C is a fairly poor excuse for an optimising language any way as it's totally lacking in ways that realy make it the lowest common denominator of the worst machine code languages ever invented. Just ask anyone who has tried to write a serious maths package using it (don't be suprised if they fling garlic and holy water at you whilst trying to stake you out ;)

Much as I like it and it's deficiencies C is like the old joke about asking a farmer for directions and getting the advice of "If I was you I would not start from here".

My advice to anyone who has to optimise for speed or memory is "Not in C", go direct to machine code and save yourself a lot of pain. Likewise if you are embedding an app "loose the C standard library" you realy don't need that load of old... Likewise "cast pointers to void" and for gods sake do your own memory managment especially garbage collection. If you can not do all of that then time to consider a non embedded future. Oh one other thing with embedded, OS less, work with more modern CPUs with memory caches, learn how to use that memory as "extended registers" or as stack can give you both speed and power saving.

rDecember 18, 2016 3:09 PM

@HH Holmes (No offense)

While I value and deeply appreciate your response (mind you potentially engineered confidence building), let me rephrase my foxhole analogy.

Whether or not the intent is to undermine public security from the vacuole of space some of us operate from, if we do not publicize the tunnels we are mining for exploits we stand the risk of undermining the cities built above them to the point of collapse.

Are we reinforcing old shafts?

It's a risk, and it's a little difficult to swallow sometimes.

Anybody in -> NOBUS OUT.

I'm not lobbing accusations I'm trying to wrap my head around a the fog of this war.

Holistic HackerDecember 18, 2016 3:33 PM

@r

On "crazy", and foxholes...

No, not a "foxhole", a rabbit hole. As in Wonderland. If I were a tree and adrenal glands were my fruit, I have produced more adrenaline over the years from being in fight or flight scenarios that I am sure there could be a warehouse full of the toxic chemical enough to give full armies intoxication.

My normal is a two to more level reality, where neither my coworkers nor other peers, nor I, are who we appear to be on the surface. That unreality is the reality we ourselves work with for the most part, and whenever and wherever we engage with anyone else, that unreality is reality to them.

This is how it is, night and day, week after week, year after year, and the decades plow onwards.

If you mean, however, foxhole as in "crazy like a fox", okay. Aleister Crowley was a highly prized British Spy. There is crazy like a fox. One of my good friends, a fellow who works for a foreign, very adversarial government has pictures of himself in a mental institute. He will not hesitate to explain to me how he is the messiah. And he explains this to everyone he has known here.

At some point he or they realized, finally, he was burned, and so that became his repeating article.

Kim Philby was a British agent. All along. This was a terrible fear of the KGB for decades, while he was there. And they were right. I only know this because I am generational. My father, his father, his father. Our mothers. And so on.

He was faking being an incurable alcoholic. And his prized autobiography had all sorts of critical information hidden within it.

If a group of folks came here, today, from a hundred years in the future, everyone would believe they are crazy. If they came here from a thousand years, ten thousand years, a hundred thousand years.... the definitions of crazy have no realm.

Hard to believe, but while there is truth, all the world's conspiracy theorists and all their conspiracy theorists have it wrong. And the truth, they would never be able to believe. Fiction writers have it better then they. Yet, fiction writers and conspiracy theorists all have it so very right in one way: it is all there, somewhere, as severe and dramatic as they imagine, and even far more so, but the details are all very different, and so the substance of what they fear.

One truth is, 'who is your worst enemy', 'your self'. Or where is the monster? In the mirror.

Though, also, very much "no", as there are monsters far, far worse, "out there".

I pointed to Doctorow's site. Doctorow has a great regular show on "you ain't so smart". I never listen to it, but the book is great, and everyone concerned about real security should it read it. They should also read the latest on cognitive behavioral psychology and neuroscience. In terms of the enemy as you. Because our biases are many, and it is critical, first and foremost, in security, to be very well trained on what those biases are.

One very major bias that many folks in highly intellectual fields that have some touch of security fall to, is the bias of believing one is noticed, when one is not.

That is, two are blind, making it through the dark tunnel systems of the future. One knows they are blind, however, and learns to adapt. The other does not. Who ends up surviving, even thriving? Know your own blindness. Learn how it can be your advantage. Don't shoot without a scope, don't shoot in the dark without night vision.

There are very good shows that really teach these subjects to folks. Many, many errors in modern science, but this is one of the truly good fields. What shows? Brain Games. The Brain With David Eagleman.

In the undercover worlds, there often can become severe types of hallucinations and delusions. As not unlike what one finds in extreme "hypnosis", there can become deep levels of feeling "unreality". Even touching that world can make people flip out, once they start to become cognizant of it.

On Russia, Russia are still bad guys. The US has very many problems, but set that aside, and do understand Russia is far worse in many ways.

Nobody is your savior. If you wish to worship mere men, you will certainly be rewarded with what you deserve to be rewarded with.

Communist Russia was extremely bad. You state you go to churches. Maybe bother to pick up some books on just how bad Russia was to Christians. Instead of pretending you care. Books like Wurmbrand's "Tortured for Christ", or "By Their Blood". Or "The Bible Smuggler".

There are so very many others.

Is the US so divine? As the paragraph I pointed out showed, look at the justice system.

However, the wars, yes, they actually have been just. Some say, "you guys have used these wars like you have used the nation". We have. Only we have paid the nation back. Like the Blues Brothers like to say, "We are on a mission from God".

As for painting some foggy government people as your worst enemies, devils incarnate, maybe you should join the Watchtower group, who believe even mailmen work for the devil? Or sober and sane up some?

Many, many faults in the US Government. I do not work for the US Government. I work for their bosses. Though, this would appear as disinformation to anyone who got close. And... as much church as you speak so loudly about going to, you would never really believe God works seamlessly with countless 'humans as angels' interspersed through governments, with rips in jeans, and full ID and computer backgrounds and all. Whenever, wherever. The miracles are far, far away for you, and legendary, even fictional items. Real is the world and all of her oppressions.

You need your scapegoats. Truth, for some reason, does not help.

But, again, my work is very real, as is the paychecks. And my unreal friends and self are more real then real.

The conscious denies and fights, but the subconscious knows.


rDecember 18, 2016 3:53 PM

Okay, maybe I railed too much or too loudly or too inaccurately. I don't think either I framed myself right or you are seeing it wrong? Who knows, maybe you're right about me and I'm not (right). It's a process, understanding.

What I mean by 'crazy' is that's the general consensus. I've embraced it, most people don't consider errant things such as this. Double think.

But foxhole as in crazy? No, I definately meant Viet Cong style tunnels that we wade through and get poached from.

If you are who you are, then you know what I know. And you're right, to a very large extent I can comfortably say that I am still writing you from a public facing address - no interdiction or inspection acquired. Sorry if my eating up NRA style fear mongering is detrimental or misleading.

But yeah, OPM scared the piss out of me - I was denied a security clearance and they still knew where I lived mysterious[+ly]**(see above) 10 years later. Like there's some sort of target on my back. And yeah, I'm angry - the guy who stole my money 5 years later explained that I was rejected because of a warrant I didn't know I had because I was given a ticket for a seatbelt I was wearing and never sent a summons.

Self-reinforcing justification for his all-expenses pair trip for a day at the ski resort.

I'm not "a fan of man." See: Devil's Advocate.

requestingFBIrecordsDecember 18, 2016 3:55 PM

- originally posted on "Giving up on PGP"

Requesting FBI Records

I am posting this here, since probably a lot of spooks, and non-spooks, are reading this thread and in the current Squid since this topic is off-topic.

3 links found using DuckDuckGo

http://www.wikihow.com/Obtain-Your-FBI-File

pdf
http://cldc.org/wp-content/uploads/2014/02/FOIA-Privacy-Instructions.pdf

FBI
interestingly using Tor/Tails I got past the captcha with one try, but got hung up, perhaps because Privacy and Security settings were set to high (perhaps because javascript disabled on all sites).
https://www.fbi.gov/services/records-management/foipa/requesting-fbi-records

Found this link, too
http://www.forensicsciencetechnician.org/six-files-the-us-government-keeps-on-you-and-how-to-obtain-a-copy/

CIA
got some relevant text in addition to a 404 error with Privacy and Security settings set to high
https://www.cia.gov/library/readingroom/Top25PhrasesMonthly.as

Any reason not to pursue such requests?

Differences in obtaining records for a living-self vs. dead relatives (dead 10+, 20+, 30+, 40+, 50+, etc., years)

Any tips for dotting the "i"'s or crossing the "t"'s correctly for getting a relatively complete government response?

Please, if you: "Know Something Say Something"

rDecember 18, 2016 3:59 PM

And he's gd signals, we have people like that controlling the flow of information?

I sure hope the incentives are good.

Holistic HackerDecember 18, 2016 4:16 PM

@r

Regarding "H H Holmes" post. No offense taken. You took the HH from Holistic Hacker, and the Holmes from Sherlock Holmes.

I wrote the above two posts in response to your other posts. And some, if not all, directed to others, as part of a sly audience game.

Then, I posted and saw this one.

Yes, I am engineering confidence. I know all about confidence and faith, belief, trust. So many words, but the human languages are so incomplete and poor. Who here has not studied NLP from Bandler and Grinder? (And who here is not equally familiar with NLP as Natural Language Processing?) Who here does not know what context switching is or reframing, or who has not studied the works Bandler and Grinder worked from, the works of Milton H Erickson? Who here does not recognize the unreality and reality shifting, the metaphoric speak, and the focus on confidence in "hypnosis" as similar concepts from the Bible?

Who here has not put together that trances and the confidence required in extreme somnabulistic trances is not the very same sort of state the apostles found themselves in? And that the primary difference is simply that modern studies and research on these matters are but locked in and powerless because of the primary assumptions underpinning the box of their teaching? That is, all such things are illusions and products of the mind? And so? They are.

This is the only safe way.

As for implying in any way, shape or form, that I am a serial killer like HH Holmes, well. This is a code word of metaphor used before. Not unlike how I used the term "assassin", or bothered to carry the knife metaphor to such extremes and specificities, even though still keeping it as metaphoric.

Difference is I kill elements of the soul, even elements of the identity that people confuse with self and soul. And not flesh.

I, and my ilk, the birds of the sky who flock to 'eat the flesh of the mighty of the earth', which, too, is metaphoric. They are not literally birds. And while the term "flesh" is very real, it is also very metaphoric.

Consider this mind bending: Jesus is shown in revelations as speaking "as many people from many nations". This means, a corporate being. Every single one of those - millions?- were stating from their own self, that "they" are, "the beginning and the end..." Yet, individually, a non-truth, only collectively a truth? Though, near the end, John discovers, even the one he was talking to who appeared as he had seen Jesus transfigured on the mountain appeared, corrected him, and pointed out that he is just an illusion. While, at the same time, the truth spoke forward, in the first person, no less.

Israel is important, not just because in english it means "Is Real", that is, "God is Real", but because all must "struggle with man and God" within their very own selves.

But is such a struggle as the delusion the Japanese and Germans of WWII had it, thinking each is their own selves divine, merely because they wanted to? That is not struggle.

As for governmental authorities, the respect to be paid even to Satan is asked to be high, if Jude and Peter II is to be believed. And Paul elsewhere had pointed out even the Roman centurions and their ilk were "servants of God" who "should be feared because they have the right to use the sword they carry". These are mindbending truths, especially if people are in anyway empathic and studied.

Does any of that mean governments are never wrong? That it is never God siding with rebellions, instead of empires?

Star Wars aside, I like the time when Batman faced some of his fans in Bat dress, trying to playing him. "What gives you the right? What is the difference between you and me?" Batman responds by lowering himself in his multimillion dollar, impossible to create batmobile, saying, "I am not wearing hockey pads".


These things said, as arcanely indirect as the points may be made through out, I might only reply, on this: "I'm not lobbing accusations I'm trying to wrap my head around a the fog of this war."

Who is who? What are your threats? What is the war, really?


One of the things I saw in the thread that was shutdown was someone claiming, "We don't even know who was really behind OPM".

Lie.

Ignorance, rather.

Even China admitted that they knew who were behind OPM. They locked them up and put them on charges.

https://www.washingtonpost.com/world/national-security/chinese-government-has-arrested-hackers-suspected-of-breaching-opm-database/2015/12/02/0295b918-990c-11e5-8917-653b65c809eb_story.html?utm_term=.588a2f3b406c

So, BOTH the US and China say China did it.


As for me, it caught up my wife's information, but my own was pulled. Because I actually ran agents in China and nobody let that information stay at such a terrible organization.

I have worked with FBI, NSA, AF, Army, and so on. And I have worked closely with the DST of the CIA. Enough to know that there was a DST of the CIA. Which means Science and Technology Directorate. Lol.

They are sharp people who are extremely noble and on top of the game.


I have written this often but, "there is no truth, because people believe based on their preferences".

Not my own line. One I had hammered into me in training.


Russia and China are thoroughly penetrated both human and technical intelligence wise.

Nobody will post to the whole world the details of all that.

And it can be said, they can never figure it out. I am not even sure if they could be more paranoid then they already are.


So, yeah, Russia hacked the RNC and DNC. And it does not matter what anyone else thinks. The hammer is going to fall in the four weeks Obama has left.


The President has always been just a figurehead. This is why Obama was no different then Bush on primary issues.

The President is but as a kindergarten token hall monitor, chosen to make the kindergarteners feel involved, confident, at ease.


Trump gives more leeway for some foreign necessities then Clinton would have. Moving the Israeli embassy to Jerusalem will be important. Cutting down climate change discussions and NASA are important. God controls the climate. And we are here.


Not "up in the sky". Amongst and within.


ab praeceptisDecember 18, 2016 5:07 PM

Nick P

Some quick remarks. I didn't even answer the gnu Modula-2 question because it's so obvious (that it should be avoided).

"Good books on compiler construction" - I've gone that route and it made me an engineer who knew how to build such devices. In retrospect I'm advising students to not go that route but to read and grok the reports in the Wirth universe; there is, for instance, one of his students who describes quite well how it works, how he did it and why. Some of those papers support enlightenment.

"Wirth didn't formally specify" - From my POV that's (mostly) untrue. One finds quite much in terms of formal spec, albeit, of course, not in modern spec. semantics but in pure math and in something like makeshift semantics. In fact, Wirth was very conscious of the importance of proper spec (as opposed to committee bla bla).

"Modula-2/ACK" - 1) Do as you please but I'd suggest to rather strip down Modula-2. The ACK is an open invitation ...
2) I love Ada and I'm fluent and experienced in C (although I began many years ago to exclusively treat it as a meta-assembler) but for relatively small low level (in OS terms, not as in "near to the metal") I'd prefer Modula-2 every day and sunday twice. What a beauty and a reliable and timeless one!

Risking to provoke you (in a friendly colleagial manner): Tell me the reason why I should use your bootstrapper over other solutions? You offer no proof. Nick P is a good name - but for critical stuff I want proof and you have none.

Holistic HackerDecember 18, 2016 5:33 PM

@r / requestingFBIrecords

Also, note, on my nick, it is a plug for "Dirk Gentley's Holistic Detective Agency". The latest version. Yes, everyone who is smart should have finished up "Westworld", and be binging this weekend on Season 2 of "The Man in the High Castle"...

And mix up the latest Dirk Gentley with the American version which redgrave also started in of Wilfred. That partly inspired the screenwriter, Max Landis.

"So OPM was much more broad than I think alot of people realize."

Because I said my record was pulled? No. Incorrect conclusion. There are people who act, then there are people who are their roles.

Infrastructure is required for maintaining secrets. In extreme cases, that infrastructure has to not be there, or be in a very different form. That is regular infrastructure has to be bypassed to operate correctly.

But should you take anything at face value, even something as severe as that? No. Should you, however, go crazy and make global announcements about your theoretical suspicions? No. Like Flynn espousing crazy conspiracy theories, because he has been around crazy conspiracy realities. Or Venezula and Iran claiming the earthquake in Haiti was because the US has an earthquake ray gun. Or Bolton suggesting the DNC hack and wikipedia leaks was a false flag operation ultimately by the DNC. Lol.

I mix in wild implausibilities with plausibilities, as safeguards. That means I really, really have to know the difference. Never mind, you can't ever talk to people without knowing the extreme subtleties of 'what is real', 'what is real and can't be believed', 'what evidence is required for extremely implausible truths', and so on. Down the line. Again. Confidence experts. Whether in lying or telling the truth.

And we always deal with people even the most sane and sober as they really are. Schizoid. They have one half of them conscious. Other half "subconscious". The much bigger half. :P

As Erickson said, "I always communicate indirectly, because the patient is indirect".

"Any reason not to pursue such requests?"

Waste of time. Feeds your paranoia.

Kinks, Destroyer... Silly Boy, will destroya, paranoia will destroya

https://www.youtube.com/watch?v=_WJ6FbcWYRU

But yeah, OPM scared the piss out of me - I was denied a security clearance and they still knew where I lived mysterious[+ly]**(see above) 10 years later. Like there's some sort of target on my back. And yeah, I'm angry - the guy who stole my money 5 years later explained that I was rejected because of a warrant I didn't know I had because I was given a ticket for a seatbelt I was wearing and never sent a summons.


Most people who actually work for intelligence agencies don't actually know they work for intelligence agencies.

Secrets and conspiracies are massively hard to keep.

Most people who are effectively agents for intelligence agencies do not know that their "handlers" are actually handlers, that they are case officers.

In fact, the last thing you ever want to do is work directly with someone.


You know the adage from tv, "this is to protect you". It is true.

More often then not, your own self lies to your own self to protect your own self. Family members lie to family members to protect them. And so on, down the line.

Can you get deeper, do more important stuff? Sure. But, start to get your head together. Don't fall under these trifling faults such as blaming some asshole whole stole money from you to "the whole government". Because some bad shit is done, like the horrible crap in the reconstruction efforts of Iraq, don't go and project that to everything else. Or the torturing, and all. Projecting that to everyone. Everywhere. All the time.

In general, just don't judge people. Especially not in dark areas. Chill. Consider you might not actually know everything behind decisions and circumstances, and it is extremely easy to point the finger and condemn when you do not.

And that is like 90% of the very message of Jesus, too. So it is not like you have no excuse there.

I know you are better then that.

As for professional distancing: the date goes like so, "oh hey, you are uber sexy, wanna hook up", you are "okay", then they come back, "oh no, I am sorry, we can't". But, down deep, you know you are worthy. It is the powerful stain of unrequited love...

Or so it does seem to you.

*raised eyebrow*

Not everybody goes in by the front door.

One of the main things I train my kids in is false rejection and condemnation. It is one of my favorite jokes. They ask for something, I angrily deny it. Or I claim they have to go to school over the holidays. On and on and on. They never totally get it, because I am that good. But, it is always a joke. And it desensitizes them to mere appearances. Makes them understand they are understood and loved and accepted and not condemned, not judged. I always break the joke to them.

Like Time Bandits. Return the map! You just have to watch the whole thing to understand.

That is how people are.

Especially when they condemn others, and so... build up an internal infrastructure inside secretly fearing condemnation their own self. By their own standards.

This is also "distancing". I can't say how often I distance with friends, or they with me. I hate you. You are fired. I am quitting. On and on.

It is routine.

One time I was preparing for an overseas gig, and said, "No way will I meet this guy in a third country or even his country". They told me the FBI would handle security and I can trust them. I thought that was crap. They gave me a lengthy test. And then claimed everything was cut off. Yet, oddly, I ended up going not even to a intermediate country, but to the primary one anyway.

I did not even "get it" until months later, at that stage in my career.

Even though I met them there and they told me it was them, from shared secrets.

Another time, a very suspicious guy whom I had confirmed from demanding an email response on his "official" email, suggested I should apply to various agencies. One I applied to had this job description which was exactly what I had been doing for them as a citizen. No response. I did not get until later that the details were so specific, they wrote that specifically for me.

The most important communications are indirect, require inference, inductive and deductive reasoning. Show, not tell. Very critical.

Like the blue men of las vegas.

Not a joke. People are that smart, that good, and such communication really is that important.

It requires planning, it requires resources, it has the danger of not getting through to them (consciously), but it works and works very well. And people really do get this kind of communication subconsciously.

And they can be trained to be able to get it consciously.

By stating stuff like this.


So, you are very talented. I do not know you. I know people like you. I am way above an average communicator. And I have the leeway to be pretty explicit. Also, even if anything I say attracts anyone, my security is rock solid, enough that I might as well be a human honeypot. And my network of folks.

I know your fears, I know your paranoia.

But, get to the groove.

I want to change the world, for the better. Probably, our ideals are not far off. I am probably more willing to do things many would have serious moral problems with. My moral framework is very, very complex. But, I am more a man of principle then that assassin in "no country for old men".

Your average folks in these places are effectively idiots, by your standard. They do not really run or control things. Hard to believe, but when your IQ is tens and tens of points above others, you really do have the capacity to learn how to get things done and rise to the top.

And get with others of your kind. Who can recognize folks, like their own selves, who don't have IQ of 100 or 120. Where 70 is retard level. But of 150 and above. And cooler then feeling like they literally need to join Mensa to find those of like capacities. :-)

Heheheheh.

Chill. Smoke some pot. Get drunk. Watch some movies. Better yet! Porn and masturbation!

Everyone may think you aren't uber talented and that can isolate and alienate you. Because you are!

And complete morons don't really run things, lol. They find people like you.


tyrDecember 18, 2016 8:22 PM


@Nick P., Clive, and the usual suspects

Thanks for remaining voices of sanity in the tower
of babel. Likewise Thanks to Bruce for remaining
sane amongst the hail of emo angst every post seems
to trigget. You may be fallible unlike those here
who know everything (makes them qualified to be
critics).

I have a secure computer, the bad news it started as
a commercial offering and was partially hand built
and modified. It lacks all sorts of amenities like
a mouse, colour graphics, lower case descenders for
the printer. No internet capability let alone web.

The good news it is a TRS-80 Model I.

Back in the day having a program that actually ran
the same way every time was considered a triumph of
the human spirit over the limitations of hardware.

The portability of C cross platforms gave it a clear
advantage over the proprietary junk of walled gardens.
Does it have faults because of the limited memory of
ancient iron. Of course it does. Can it be fixed ??
Nobody knows until they try to. Bitching about things
never fixed anything in recorded human history. All
it does is contribute to the background noises.

Sarcasm mode on:

I can't tell you how glad I am that Fakebook and its
slimy little loon Zuckerberg have decided to save
us all from 'fake news' on the Net. Be still my
heart, a saviour has arrived through the darkness!!

Sarcasm mode off:

AlanSDecember 18, 2016 10:05 PM

@The Holistic HaX0r SAM

I find it foolish that people believe they are in control of their own destinies, much less the world.
But that was Hayek's point: that all planning was futile and that politics had to be replaced by the market. This idea itself turned into a grand plan run by economists! The role of the state became that of imposing market relationships everywhere. In due course the Chicago economists, in their wisdom, decided that monopoly, which had been a major target of regulation before the 1980s, wasn't really a problem in a market system at all. As a result we've had deregulation and ever-growing corporations and financial institutions. Then, when the inevitable happened in 2008, the economists declared a "state of exception" to save their glorious market system from falling apart under the weight of its own contradictions. Neoliberal planning turns out to be about as effective as communist planning. Expect more Schmittian "states of exception" under Trump.

Clive RobinsonDecember 18, 2016 11:51 PM

@ AlanS,

But that was Hayek's point: that all planning was futile and that politics had to be replaced by the market.

Hayek had two problems in life, the first was he did not grok what engineers understand, the second he lost control of his own words to the point they became meaningless in the hands of others.

Most engineers get to understand that in real life only three numbers make any real kind of sense, zero, one and approaching infinity, and any other number has to be "held in place".

That is in one view there can be nothing of something, something unique and any number of things, depending on how and why you measure. Importantly they all sit on a line and time takes things to zero whilst gain takes things to infinity, thus any other value changes continuously unless it is measured and feedback applied.

What those who worship at their temple of Hayek appear to have understood incorrectly is that feedback is neither perfect or for that matter single source. Any engineer who has started a large DC Motor "off load" or likewise a diesel motor understands what a runaway process is, any engineer who has tried to build an autonomous control system or regulator for them understands why you can not control by prediction only by continuous measurment and comparison. Further that engineer quickly finds that the gain of such regulation has to be right as well, otherwise things are to sluggish or dangerously fast, hence you have to "criticaly damp" your control loop dynamicaly otherwise the likes of inertia and load change will cause significant problems.

Our economy is the result of not one simple machine that maths finds hard to describe, but millions many of which fight each other in complex ways. Engineers know from experience with power grids and the like how you can deal with such a bag of snakes, and they know it can never be optimal or even close to efficient, you can get lucky once in a while, just the same as you can get very unlucky, it's the nature of probability.

The problem is people want to be winners not loosers and they want to win big. Politicians know they are only as good as their last win, business executives only as good as their last quater. The only way you can keep wining big is by cheating the process, and eventually the process stretched beyond norms either breaks or snaps back suddenly. When this happens with society the results are not nice.

But the politicians do not want to listen to engineers, no they listen to the shysters, shucksters, pan handlers and cheaters, who trade luck as skill by illusion.

Sadly those who do not know the art of the con and the laws of probability buy into this creating further instability in the system.

But we see others calling themselves engineers trying the same game. How many times have you heard the expression "Best Practice", remember every time you hear it it's because somebody is either deluding themselves or gulling somebody else...

Economists are not scientists by definition, likewise they are not engineers, as for being mathematicians, ask a real one what he thinks of economists.

Economists do well because they are "useful idiots" like court jesters they are there to make the hand that feeds them feel better about it's self, and likewise make others like the hand thus do the hands bidding.

As long as people either do not know that, forget it or ignore it they become food for the hand to be used abused and sacrificed.

As for communism well that was just another way of playing the same game of gulling the masses for the benifit of the few. Only they made a mistake, they did not appeal to the masses self delusion of greed the "land of milk and honey" idyll described as "streets paved with gold" that gives the "Great American Dream".

One big clue to what goes on is "The protestant work ethic" it is seductive sounding but contains a trap for those who do not realise it is there. The more productive you are the less your labour is worth. That is in general it is those who do most get the least, it's those that use smart words who profit from such labours by others.

I could go on but there are nodoubt libiterians thinking I'm of their ilk but will shout I'm a "Communist" or worse, to protect their own world view...

One last word though, beware those who demand solutions but care not the means by which they are reached. It's why we have the snoopers charter which will spread like a cancer through the body of society. If we are lucky when it falls it will be peacefully like East Germany, but history and probability suggests otherwise.

FigureitoutDecember 19, 2016 12:24 AM

Daniela Alighieri Caruso
--Italy eh? They had the best pizza of course, and Rome was my favorite city I visited in Europe. So many mopeds lol. Insane they let whoever walk among Roman ruins.

Nick P
--Thanks entertaining read but don't really like Forth. Still a ways away before I attempt a compiler (if ever). Even making my own processor, love to see how it's done but I'm too spoiled w/ modern compilers and processors, just being able to do a 4-function calculator in hardware would be a decent project, designed from CPU level up. Rather skip that w/ a compiler and MCU. I got pissed that the PIC16f18855 didn't really have much of a compare instruction (just a BTFSS and BTFSC, bit test skip if set or clear; then next instruction is jumped over if true, simple but sucks, so porting a damn if-statement in C to inline asm didn't work for me on first try even though it should've, that and finding the right register was slightly tricky). Having to write code in octal where I'm mostly guessing...don't wanna do it.

I've got mostly my dream on my surfing desktop, RasPi w/ linux, screen, wifi, wireless USB keyboard. It's down right now though since I've had 2 bad shutdowns w/ power blips. All I need is a solution for small blips in power, going to do something real similar to this: https://hackaday.io/project/9461-lifepo4weredpi , just shutdown until power returns, then I'd have to put tcpdump command in startup script.

All my little gadgets I'd make like that would be fun to make, but suck to use.

Holistic HackerDecember 19, 2016 12:38 AM

@Dr. Holmes, Houes of Horror

Right, I mentioned the serial killer about two paragraphs down, after pointing out why he used that nick for me, as a play on words. Could have been subconscious on his part. If so, that would have been strange.

@AlanS

But that was Hayek's point: that all planning was futile and that politics had to be replaced by the market. This idea itself turned into a grand plan run by economists!

Not what I meant, but I can see the confusion.

. Then, when the inevitable happened in 2008, the economists declared a "state of exception" to save their glorious market system from falling apart under the weight of its own contradictions. Neoliberal planning turns out to be about as effective as communist planning. Expect more Schmittian "states of exception" under Trump.

Right.

What I meant is I am an architect. I am a planner, and take that seriously. It is an art. It is something I always practice. I have accomplished impossible things, even.

I consider accuracy important.

I consider confidence I have in my knowledge important.

So, I do not speak as if I am confident on subjects I know nothing about. I do not make empty promises. I believe in achieving objectives.

So, you can imagine my disdain in this situation.

I do not have the answers to all of the many very complex problems out there. I would not even begin to tackle these problems. Even though I have an encyclopedic mind.

I have studied monopolies, so I understand how they can be bad. I have studied the economic collapses of 2006 and 2008. I have studied real estate finance and related fields. I mean college, books, documentaries, articles.

So, I certainly do have confidence that you are correct in your conclusions.


You are also a planner and architect, very probably. Of some kind.

Which would be why you also do not like seeing what you take so seriously and appreciate the power of, being treated as if it were a wad of used toilet paper.


Actually, while I am not much an Ayn Rand fan (and I am aware some of these folks used some of her ideas to justify their throwing away of regulations), I do find myself feeling the sorts of feelings in these situations as the Gary Cooper architect of the Fountainhead felt.


Free and open market does not mean lawless chaos. Free society does not mean anarchy.

A free society is not free if Jack can take away the freedom of Jill or Joe.


These are guises people put on ideas, where the motives are obvious. They are greedy. They want it now. YOLO, as they say. They are renters on the planet, and their life is but a flash.

They have no wisdom.

Others work with them, getting ahead by doing very bad things, for which they find recompense.

That is really why they get paid so much. Because they are willing to do those cutthroat things.

They think they deserve it.

They feel like they have a right to money if they trade their soul for it. But, they don't even have that right.

Holistic HackerDecember 19, 2016 12:46 AM

@Clive Robinson

Excellent post, Clive.

The problem is people want to be winners not loosers and they want to win big. Politicians know they are only as good as their last win, business executives only as good as their last quater. The only way you can keep wining big is by cheating the process, and eventually the process stretched beyond norms either breaks or snaps back suddenly. When this happens with society the results are not nice.
But the politicians do not want to listen to engineers, no they listen to the shysters, shucksters, pan handlers and cheaters, who trade luck as skill by illusion.
Sadly those who do not know the art of the con and the laws of probability buy into this creating further instability in the system.

And, on this:

As for communism well that was just another way of playing the same game of gulling the masses for the benifit of the few. Only they made a mistake, they did not appeal to the masses self delusion of greed the "land of milk and honey" idyll described as "streets paved with gold" that gives the "Great American Dream".

It is all the same thing. This is what is always happening. People have been buying the lying promises of the "elites" since time immemorial.

Big fan of archaeology. Love to look at the Ozymandias' and their works of the world. Peru. Bolivia. Turkey. Greece. Egypt. Iraq. England. Cambodia. Mexico. Costa Rica.

But what you see, is just this. Where you start to see humankind creating these monuments, these cities. These incredible structures. Is that truly the birth of the modern world, our age?

When some elites were able to persuade the masses to become their effective slaves.


I am not so cynical. I think there is much more to the world, and more importantly the future.

But, at the core of it, I certainly am cynical.

People will always operate in this way, until there is fundamental change to their lifespan and the scarcity of their critical resources.


Holistic HackerDecember 19, 2016 1:22 AM

@Lee Wei

What if the inference was on your part?

Considering there are 120 posts above, how could I possibly correctly infer on what you are talking about?

Much less, how could I have correctly inferred the poster I was responding was switching his nick and even writing style. (Likely switching from handset to computer when doing so.)

HH. Holistic Hacker.

As I said, he may not have consciously realized this. But, the coincidence of naming me H.H. anything when I was using a nick that was H.H is rather high.

And while one might argue he did not consciously consider this, I would certainly point out that it is certain he did subconsciously consider this.

If you wish to consider the outlaying possibility, that his mind just randomly jumped to picturing me as one of the world's most insidious of serial killers, well.

Stuff happens.

People do have odd habits of thinking odd things about me.

ThothDecember 19, 2016 5:40 AM

@Figureitout

re: Hackaday Battery Pack for RPi

That's really a bonus for a HSM you have there. Imagine if you have a STM32F series (supports crypto accelerator) and store a master key in SRAM and hook some separate STM32F board to the RPi's GPIO connectors and use the battery to power the STM32F SRAM. If an attacker tries to be funny, the SRAM backed key would ensure it's not there anymore.

Also, I would avoid using the RPi as the main HSM but as a power supply and General Purpose CPU for the fact that the latest RPis have wireless connectivity stuff integrated into the opaque Broadcom chipset whereas the STM32F has the datasheet out in the open readily available for open source and open hardware projects.

This effectively turns the RPi + portable battery pack + STM32F into a HSM unit where you can load applications on the RPi as a wireless HSM of sort although it sounds rather .. weird :D .

Spies Hiding Behind Advertising Cover StoryDecember 19, 2016 6:31 AM

Someone is spinning tall-tails hoping readers will forget the important post titled “Are American VPNs Compromised?

The ‘cover story’ is American VPN service provider are being compensated by using Google’s ad network.
Then who is compensating Google?? Who is REALLY ‘hiding in plain sight’? Who are the mysterious owners of these VPNs? LOL!

This perfect cover story now being implemented/exploited/piggybacked/exploding exponentially by the Chinese against clueless Americans. Cheap TVs and unlocked smart phones are already sending snooping (personalized LOL! )data back to the motherland. Russia is notably absent.

It’s All Related
They public has the right to know who is ‘hiding behind advertising cover story’. Its now gotten out-of-hand with China’s entry.
It seems as if the President Elect knows this and is already taking corrective action but (of course) under a different pretense. In the meantime there is an unprecedented number of electronics deals at Amazon. Be smart and only buy ‘non-smart’ devices.

ThothDecember 19, 2016 6:36 AM

@Spies Hiding Behind Advertising Cover Story

If you are still surprised that any of those VPN Service Providers are honest, you are really missing so much stuff.

If you still trust any of those crap VPN services, you gotta wake up if you haven't.

All VPN Service Providers MUST be considered COMPROMISED. Be it a Swiss or Icelandic provider, it's all gone ... it's all down the drain already.

Stop sleeping ......

CuriousDecember 19, 2016 6:38 AM

NIST has a deadline for submissions they are soliciting for re post quantum crypto, being 30. Nov 2017.

"POST-QUANTUM CRYPTO PROJECT"
http://csrc.nist.gov/groups/ST/post-quantum-crypto/index.html

"NEWS -- December 15, 2016: The National Institute of Standards and Technology (NIST) is now accepting submissions for quantum-resistant public-key cryptographic algorithms. The deadline for submission is November 30, 2017. Please see the Post-Quantum Cryptography Standardization menu at left for the complete submission requirements and evaluation criteria."

zgDecember 19, 2016 7:42 AM

Who among us has not cast a squid in anger? I say “He that is without sin among you, let him cast the first squid.” And so it was written.

Clive RobinsonDecember 19, 2016 9:41 AM

@ Figureitout,

I got pissed that the PIC16f18855 didn't really have much of a compare instruction (just a BTFSS and BTFSC, bit test skip if set or clear; then next instruction is jumped over if true, simple but sucks, so porting a damn if-statement in C to inline asm didn't work for me on first try even though it should've, that and finding the right register was slightly tricky). Having to write code in octal where I'm mostly guessing...don't wanna do it.

Perhaps it's better to answer these problems in the order you are supposed to use the silverware at a fancy dinner (ie out to in) thus saving "the meat of the problem till last.

The Peripheral Interface Controler (PIC) microcontrolers started life a very long time ago and were originally 4bit controlers if memory serves me correctly. They split pointer movment into relative and absolute branches and jumps respectively as did many micro controlers. However turning the branches into "skip" instructions vastly simplified both the ALU/register set logic and the instruction control set (draw out an RTL flow chart to see why ;)

One of the many problems with C is it's older than single chip microcontrolers by quite a few years. The likes of GEC and other mainframe systems was that bus widths were even multiples of 3 bits such as 9/12/18/24/36, which ment support for Octal was desirable back then, and still hangs around like the "ghost of Xmas past". You do not need to use Octal but it's even empedded in the IAx86 architecture which has octal built into the form of it's machine code[1]... So like it or lump it Octal needs to be used at lower levels as you get close to the metal.

Finding the right register in the PIC16 family should not generaly be an issue if you know two things, the compiler "calling convention" and what memory bank page you should have setup. Both of which should be well documented with your compiler info.

As for getting the "if" etc to work you need to think backwards... Mostly "we test to branch" not "test to skip". The skip in effect inverts the logic. Which can cause problems with comparison operations.

So when you load a value and subtract immediate to do the compare you have to watch out as the traditional "Branch if less than $xx" gets inverted to "Skip if greater than or equal to $xx". Which means you need to change the value of $xx by one if there is no 'greater or equal" instruction.

Such things are real "bounce it of the wall" anoyances for those moving from higher level languages down to Restricted Instruction Set Architectures (R-ISA). Where you might only have eight ALU instructions and two or three status flag tests --on zero, carry and sign-- and only a jump but no call/return...

You do however fairly quickly get used to it, and as an assembler level programmer, you can very quickly get pissed that C has no flags register signals passed up, which means you have to jump through an extra hoop or two just to find out if an addition has overflowed, that can realy make long integer maths a right royal inefficient pain. To make it worse it carries forward into all other maths functions as at the end of the day ALU's only do positive integers and fake the rest by building Abstract Data Types on top of the positive integers...


[1] http://www.dabo.de/ccc99/www.camp.ccc.de/radio/help.txt

Holistic WackerDecember 19, 2016 10:05 AM

@Holistic Wacker

Freud is call your symptoms 'case of basket'? Magical mushrooms maybe cause permanent injury?

Before spin more nutjob yarn of triple-agent ultra-spy status (Snowden^3), can confirm us NSA backdooring of Intel ME is reality?

PS 'Masters of Universe' strategy failing to OTP, steg and forum post give glory to spook sockpuppet on NY (Propornot) Times. IQ 200+ no require.

Mr Robinson note it before. Die and carbon paper defeat spy tool box, exploit bonanza, rootkit, deep state and quant compute, no problem. Paper paper, never data.

Man in Black keyboard warrior is powerless. What is message? What is key? What is receiver? Is message there? What value porn collection on drive?

You talk of Rabbit Hole is remind me:

“But I don’t want to go among mad people," Alice remarked. "Oh, you can’t help that," said the Cat: "we’re all mad here. I’m mad. You’re mad." "How do you know I’m mad?" said Alice. "You must be," said the Cat, "or you wouldn’t have come here.”

markDecember 19, 2016 11:23 AM

Well, at least I'm not in danger of that: I have a deal: I don't eat calimari, and giant kraken don't eat me.

Works for me.

Oh, btw, fark.com, which has a tag for every story, has one FLORIDA, for what do you expect to happen down there...?

Clive RobinsonDecember 19, 2016 12:03 PM

@ CallMeLateForSupper,

Back a couple of weeks ago, you mentioned you were once the owner of a pinto,

https://www.schneier.com/blog/archives/2016/12/www_malware_hid.html#c6740061

And that you had put it behind you.

Out of curiosity, did you know that somebody tried to make it "fly like a bird" or atleast a Cesner?

https://en.m.wikipedia.org/wiki/AVE_Mizar

Sadly he crashed and burned, which is why a model was used in the James Bond film, apparently you can nolonger say Oh Oh (6+1) as it's copyrighted to the nines ;-)

Elmer FUDDecember 19, 2016 12:15 PM

I really get the feeling that some of those amoung us are considerably adverse to refering the international governmental data mining and exploit hoarding habits as being anything other than foxhole digging and weapon emplacements.

I think the immediate return to the rabbit hole concept displays either a large amount of inflexibility or a party line, while I'm not averse myself to using defensive emplacements I still think it's a good idea to call it for what it is.

Elmer FUDDecember 19, 2016 12:34 PM

The rabbit hole concept isn't big enough for:

NIST, Heartbleed, Juniper?

You're not going to be putting that rabbit away on us.

It's inescapable.

Clive RobinsonDecember 19, 2016 4:31 PM

@ Ouch,

Tor blocked in Turkey as government cracks down on VPN use

Whilst it is news, it's not a surprise in the slightest. The current political leadership has done a number of things in recent times that we would normaly condemn.

But despite their blind eye to IS oil etc, they are currently "A friend of the West" so whilst we do not condone we do not condemn, and so the wheel turns. As human rights get thrown to the winds and the sense of revenge it engenders will give rise to more radicalism, but then that's a given, and a problem for future politicians etc to exploit.

But of course "blocking Tor" was not part of the consideration in it's specification. Even if you moved ports and addresses the traffic remains conspicuous, and thus traceable...

Clive RobinsonDecember 19, 2016 5:36 PM

Is Deep Learning for you?

To many "Deep Learning" is the next instantiation of the "Big Data" hard sell by hardware suppliers and numaratie consultants.

Whilst this view can be forgiven as even gurus in the domain pander to it, it's not what is reality.

This article starts as a bit of a polemic but then gets interesting,

http://www.fast.ai/2016/11/17/not-all-the-same/

Importantly it makes some valid points in the last few paragraphs.

Such as,

    It['s] generally far better to take a domain expert within your organization and teach them deep learning, than it is to take a deep learning expert and throw them into your organization. Deep learning PhD graduates are very unlikely to have the wide range of relevent experiences that you value in your most effective employees...

And

    in these days of the false “deep learning exclusivity” meme, it means searching for those unicorn deep learning experts, often including paying vastly inflated sums for failing deep learning startups.

Which means there is a scarcity of people with domain knowledge, that currently high price consultants are filling "badly". Which begs the question of what do you need to know, and how do you get the training.

Well according to the authors,

    We are currently in the middle of teaching 100 students deep learning from scratch, with the only prerequisite being one year of programming experience. This will be turned into a MOOC shortly after the in-person class finishes. We’re in the 4th week of the course, and already the students are building world-class image recognition models in Python.

It might well be worth getting onto the MOOC, because even if your love is security, Deep Learning is going to hit all aspects of security with quite a large thump of money on the table...

rDecember 19, 2016 5:45 PM

@Clive,

I agree 100%, I think we have no choice but to make the move and soon. Even low level app-developers will be partially supplanted by 'AI assisted' tools soon.

Any knowledge in this area will allow one to (hopefully) quickly adjust to upcoming trends.

I think ML and DL are the progression of emulation proper, I'm a noob though.

Holistic HackerDecember 19, 2016 5:45 PM

@Clive Robinson

DHS is hacking state governments reports the states. I am sorry, but I can imagine the IT security personnel at these state's to be utter crap. DHS probably was running Nexpose on them, to ensure they did not have vulnerabilities.

The security of the state's actually does fall under DHS jurisdiction.

But, yes, these stories are all highly amusing. I am absolutely delighted that Obama has crazily promised to retaliate, 'either something explicit and well seen or something hidden', lol, and there is the effective timeline there of about four weeks. Meanwhile, Trump could not be more pro-Russia, coming into office following that. These are the guys who invented Stuxnet. (Utterly ruthless: https://youtu.be/lTo0Q8cU410?t=1m10s )

They could decimate Russia's gas business by hacking.

It would be much more fun though to dox Putin, the SVR, FSB, GRU. And play it up like North Korea or someone did it.

Someone could say the US can't do that.

Though, the FBI was running LulzSec when Stratfor was doxed and embassies around the world were hacked by them. Embassies are not attractive targets for the FBI, are they. There wasn't some disinformation campaign involved in that Stratfor dump, was there? Impossible to believe, but it is possible. It is also possible the US Government, like Russia and China, might use the guise of criminal hackers for plausible deniability.

In fact, I would have to wonder how much of these sorts of tactics the US did not invent.

Further, not to ask you to put your conspiracy theorist hat firmly on, but the US government not only invented the internet, but the leaders of the full disclosure movement came from US defense contractors such as BBN.

Not just the rock stars like Mudge and Weld Pond, but on the other side of things, more day to day hackers like Dave Aitel and Jamie Butler and Charlie Miller.


On the angel investors, yeah, yuck. Can't stand that area of software. So incredibly full of shit, all over the place.

@Holistic Wacker

Freud is call your symptoms 'case of basket'? Magical mushrooms maybe cause permanent injury?
Before spin more nutjob yarn of triple-agent ultra-spy status (Snowden^3), can confirm us NSA backdooring of Intel ME is reality?


Freud was a failure as a psychiatrist. As a theorist, he popularized concepts which others had come up with. None of his patients showed improvement. And today, we have ample real scientific evidence that reliving early life traumas increases the strength of those traumas, rather then reduces their derogatory affect.

I wrote that I did not and do not work for the US Government.

There is not much to such jobs. Counterintelligence mind games. It takes an enormous amount of extremely focused time to find extremely hard to find security vulnerabilities which are remote and give root or system privileges. It is the same for creating custom stealthy exploit code and malware. Then, there is an enormous amount of time and homework required for selecting targets, and properly using the attack tools, to find what you want.

Governments have a team for each of those roles, and there are more roles. One of the more crucial roles are the planners.

Still, at the end of the day, having a critical vulnerability in just about everyone's browser or smartphone probably would be a pretty nice little fun tool to have in your pocket.

Like Trump said once, "that is power".

But, Snowden did not find security vulnerabilities.

Still, he was a hacker, proficient at social engineering skills, and he did good planning for his operation, and well carried it off.


Now that Trump is coming onboard, however, who is best buddies with Putin, however, Snowden has to watch out. Because Trump has stated Snowden should get the death penalty.

As for "foxholes", people do not understand these things.

Even in computer security, how many really understand the power of being able to find and have for your own self security vulnerabilities? Or that actually going and trying to find these and sticking to it until you do?

When resumes are in play, I rate hackers by their vulnerabilities.

Architects and engineer type hackers are harder to rate.

If you don't have those notches on your gun for security vulnerabilities, to me, you aren't really in the game.

Clive RobinsonDecember 19, 2016 7:06 PM

@ r,

I think ML and DL are the progression of emulation proper, I'm a noob though.

As far as ML/DL is concerned, it appears most are "noob grade" and those who are not make Rocket Scientists appear to be "the bloke down t'pub" you share a pint or two with.

@ Holistic Hacker,

DHS is hacking state governments reports the states. I am sorry, but I can imagine the IT security personnel at these state's to be utter crap. DHS probably was running Nexpose on them, to ensure they did not have vulnerabilities.

Whilst it is well known "GS does not pay, so talent stays away" especially in a skills shortage we apparently have. It would still be considered "bad form" not to inform the personnel you are about to scan / pentest. If for no other reason than not to waste other resources and cause attribution issues.

It also in theory stops or makes apparent others hacking the DHS and using their systems as relay points.

As I said this looks like something worth watching for the entertainment value alone.

But... it is going to get people talking about the attribution conundrum, which will help spike certain political, MIC or IC interests. Which on balance is probably a good thing all things considered, as it reduces the likely collateral damage, as various IC entities and cyber criminals --is there a difference?-- go about their reprehensibly reckless activities.

Why "reprehensibly reckless" well the history of espionage in the real world shows it has suffered badly from "over reaction". This in turn gave rise to certain "rules of the game" which involves the likes of "Official Cover" or "Diplomatic Protection" and in turn limits on activities. Well in the virtual world the first problem you trip over is "locality" or more precisely "non locality of actor and action". That means I can steal your data from any point on the globe, and through any other point on the globe I chose. Thus I fear no consequences as my cut out relays make fall guys of other possibly innocent parties, who then suffer the "over reaction" to my actions. With a little thought it becomes clear that without restraint by the actors, this is going to end badly, very badly. Knowing this as all IC entities should it makes their lack of restraint not just risky but reckless and reprehensibly so.

As an example North Korea and the SPE hack. Some have claimed that the NSA were in the NK computers and that's how they know it was the NKs. Well logic dictates if you are in somebody elses computers, so could somebody else be as well. Therefor all that has been proved was these supposadly ultra smart uber hackers under a restaurant in China did not have good computer security... Which is a little at odds with them being uber hackers. It also proves that it was more than possible that a third party was in those computers using them as a relay point or for a false flag attack. Which of course makes the NSA prime suspects, which means their word should be treated with caution...

Now don't assume as others have said I'm defending the NKs because I'm not. All I'm saying is the supposed evidence if it actually exists is at best "fruit of the poisoned vine" and would thus be not admissible as evidence in a criminal case. Thus I contend that it is not evidence or proof, thus should not be bandied around as though it is.

What it does prove though is atribution is hard, very hard and thus threatening to go kinetic is very very far from being a good idea. It's also very probably a "War Crime" as the US Government well knows but does not want the US citizens to realise... But the Bush Hague Invasion plan / legislation is a bit of a give away...

https://www.hrw.org/news/2002/08/03/us-hague-invasion-act-becomes-law

Don't rock the bloat.December 19, 2016 7:19 PM

@The White Rabbit,

I wrote up another huge peace, @Clive covered most of it so I'll just say one thing:

All things are not equal, I rate people by their ingenuity.

/Proof/ is dead but he will live on.
Stay ahead of /The Game/.

And...

https://en.wikipedia.org/wiki/Apollo_Robbins

We CANNOT invalide other's contributions.

rDecember 19, 2016 8:04 PM

One of the parts I omitted was the resume response,

For as long as these interlocked increments have been happening, some of us quit while we were still a head enough to count - e.g. collateral damage and not a trophy priority target or just some fresh 'Mark' on the wall.

No matter where we each stand on Ed or Ed's ward, when we work together we contribute there's no escaping it. Vietnam was hard on our souls, after last night I'm seeing far more parallels than just foxholes in the sand.

Not having any sort of resume, is a unicorn in and of itself.

rDecember 19, 2016 8:21 PM

A resume in this country, often meant that one was an international terrorist.

Don't ever think that I sympathize with authortarianism when what I do sympathize with is hardship and accomplishments.

Nick PDecember 19, 2016 8:42 PM

@ Clive Robinson

I posted it here before. It's one of the best I've seen. Today, I ran into two repos for it via Lobsters with one finished and one in progress. The author of the second one has a clean-looking assembler in Scheme, too. As in the actual assembler rather than just assembly.

gordoDecember 19, 2016 9:04 PM

Not news, but rather cinema:

Public Enemy, The (1931) -- (Movie Clip) Not Before Breakfast, Dear
http://www.tcm.com/mediaroom/video/245286/Public-Enemy-The-Movie-Clip-Not-Before-Breakfast-Dear.html [02:30]

... or pop music:

Tattooed love boys (1980, The Pretenders) -- (1981 Music Concert Video) Another human interest story ....
https://www.youtube.com/watch?v=hQ2TVOjnhHM [03:48)

... or tabloid talk show:

Jerry Springer Official - Top 5 Cakes in Face
https://www.youtube.com/watch?v=w0VQ1CAWX0I [01:58]

... or docudrama:

Social Network, The (2010) -- (Movie clip) Facemash social network
https://www.youtube.com/watch?v=VSKoVsHs_Ko [02:59]

... or fake news:

FACEBOOK HAS BAD NEWS FOR CNN & NBC NO MORE FAKE NEWS YouTube
https://www.youtube.com/watch?v=ZZ0KHOvwgZc [03:54]

... I digress.

rDecember 19, 2016 10:20 PM

In b4 it's published apparently. (on an interesting side note)

December 20, 2016 -- 00:21 GMT (16:21 PST)

rDecember 19, 2016 10:24 PM

Nevermind,

It's not news and I was wrong about the time. ;-)

The above is related to prior knowledge of contents, case closed.

I'll see myself out.

FigureitoutDecember 20, 2016 12:36 AM

Thoth
--Yeah a daughterboard on the Pi. I would only trust the simplest of MCU's and protocols in hardware so chip would have to be mostly backdoored in hardware. I was thinking of a project similar to that, but w/ that atmel chip, more of just a node authenticator though in a wireless network.

But yeah I don't take it too seriously (if I was really serious, I'd port something like tcpdump to an MCU behind a lan tap w/ tcp/ip etc. w/ a large storage of some kind). Someone hacks my pi, really not a big deal. If infection in broadcom chip, can just pitch or use for something stupid. Just the filesystem, I nuke the sd card. Still hacked w/ same sd card I religate it to nonimportant backup storage, get new sd card. Keep getting popped w/ new cards, stop putting online and look at shoring up my network and how I'm flashing sd card (malware getting loaded from another offline pc?).

Clive Robinson
--Well may be nicer from hardware standpoint but sucks to code for. I know C can get annoying in assembly, I like one or the other, not mixing usually. Didn't need to set the memory bank, was already done. Just needed to modify ANSELA and TRISA registers. I wasn't getting labels to work in inline asm, so I stopped at that point. Could probably use "goto" in C and it'd work. Can't get a "while(1)" loop working then either, which is just an always branch back. I deleted my code b/c I was pissed, but it was something like:

while(1){
asm("begin:");
asm("btfsc PORTA, 6); //something not right here,in C it's PORTAbits.RA6
asm("goto else");
asm("movlw 0x8f"); //move literal
asm("movwf PORTA"); //1000 1111, 4 LED's and relay
asm("goto begin");
asm("else:");
asm("movlw 0"); //keep everything off
asm("movwf PORTA");
}

Simple code that's just reading some digital input, and will turn on 4 led's and a relay if cap touch button pressed. The labels didn't work so I only have 4 lines of inline asm now, and I think it's same as compiler makes lol, no bytes saved. I've seen in MIPS where something like a move is 3 instructions when you can just do an add instruction w/ zero to set a register in 1 instruction, didn't see that in PIC's. I've mainly got I could add an IR receiver as well, just look for a "1" so any button press would work, and spit out via serial port as well. Boring though, and I have no chance against a few people that wrote OS's...I need more KB's to do interesting things mostly.

Holistic HackerDecember 20, 2016 12:49 AM

@Clive Robinson

Yes, it is difficult to attribute, and I have noticed that actually makes through to a more general public. But, I have seen situations where attribution is performed not just by technical intelligence of a variety of forms, but also human intelligence. And I also saw a lot of the folks saying, "We don't know for sure" were folks who knew we did know for sure. They just didn't want the other side to let them know.

(Well, I would imagine they would have known, as I am talking about Howard Schmidt. Maybe they did not. )

OTOH, I know someone who would only direct connect clearly out of the way systems unlikely to be monitored, and then create elaborate proxy chains before doing anything serious. They would not leave these systems up for too long, and they would always use secure wipe on them.

When you are bouncing across many jurisdictions, there can be piecework data, but there will be gaps.

One positive of Britain's move is that they might have more reliable forensic data. But, that is for their nation only. I do not agree with their strategy.

This said, just because telecoms and such say they do not keep data does not really mean they do not keep data.

There can be a lot of points of circumstantial evidence in these cases, though. And couple that with people on that side telling you they are doing this, that is a lot more proof then what anyone saw in the Gulf of Tonkin.

It is entertainment.

It has the potential to be very unpleasant entertainment, however.

One thing about working in this area is it is like being in the front passenger seat next to a very bad driver. You have a really good view for the crash, when it comes.

But, maybe it is more like an airplane first row seat, or movie theater.

It has definitely been interesting so far, and certainly can get much more interesting.

Daniela Alighieri CarusoDecember 20, 2016 12:55 AM

@ Holistic Hacker / Messianic Guy / Dark flying thing with nappies / whatever your name is today

As Jung and many others before him said: it is important to name things.
(I feel @ tyr in his/her wisdom would appreciate this too)
So I will. You are incoherent. You are mentally unstable. You turn up every couple of months under a different name, and spout all sorts of stuff about being a secret operative blah blah. Stuff about shape shifting reptilians and elite bloodlines is usually quick to follow.
Now, the holes in your narrative are as gaping as those in your psyche.
The most glaring, is that the last thing anyone professing to be 'in disguise doing secret work' would do, is repeatedly boast about it in a public forum at regular intervals.
(I just wonder where you go in between? An institution?)
And there's many others - eg your comment about how you practice in knife fighting every day week month and decade, and how it's only important to 'know just a few moves and practice them over and over, same too in martial arts.' Well, guess what. You think it sounds wise but NO authentic practitioner of martial art or military style unarmed combat techniques would EVER aspire to such a thing or teach or claim the benefits thereof. Such an attitude betrays a fundamental ignorance of the nature of martial combat. It is entirely contrary to the essence and function of it. Simplicity/ complexity is not the point either but I digress. Your advice is worse than useless. Bruce Lee would be appalled.
Anyway. I am just sorry for you. My advice: and it is good advice:
Stop putting poisons into your body. Take an indefinite break from 'playing internets'. Stop masturbating (the literal kind) as it drains your life force and essence and literally contributes to mental instability from a physiological persepective. Take zinc supplements and commit to the study and practicing of yoga daily, including yogic hygiene and yogic lifestyle.

PS you may wish to watch the movie Shutter Island. You like TV - I think you'll find this feature film sums you up quite effectively
Good luck
@ Moderator
Keep an eye on this fellow?

FigureitoutDecember 20, 2016 1:21 AM

Daniela Alighieri Caruso
--Yeah it's just a troll, and best thing to do w/ those is to just steer clear and ignore. Pretty easy to spot his obnoxious writing style and scroll on by to the next comment. Surprised the Moderator's let him be for all this time. Puts out a ton of troll bait, never contributes constructively to the community here (the wise join the defensive side, b/c you will always get hacked by someone else up-and-coming), never gets technical. That's the biggest red flag, lots of talk, no walk. Focus on bettering yourself and others, not stooping to his level.

Daniela Alighieri CarusoDecember 20, 2016 1:34 AM

@ Figure It Out
you are right. Appreciate your insights. Against my better instincts to respond but I had the urge to name it, not least because some folk were getting pulled in even, @ Clive and @ r were getting involved. Occasionally a community requires individuals taking responsiblity to vocalise, to maintain harmony. As William Blake said, never did the eagle waste so much time as when he sought to learn [pizza making] from the crow . Glad you preferred Rome :-) not my number one though.

Clive RobinsonDecember 20, 2016 2:45 AM

@ Figureitout,

I need more KB's to do interesting things mostly

Careful your beging to sound dangerously like a M$ developer with their "just a few more GByte lament" ;-)

As a general rule I don't directly read status inputs from real world switches etc due to contact bounce. I generally get a time based interupt to do key debounce. Though it would appear initialy more dificult and waste memory space and CPU cycles it generaly saves memory space as you don't need to put the code endlessly in your program logic loops and the CPU cycles comes down if it's part of a more general timer interupt doing your clock, tone, serial bit banging etc.

The downside is of course you end up writing your own "mini BIOS", but it's very reusable code and once you get it right just a matter of a day or so to rebuild for a new device if you have a good data sheet (which is getting less and less the case these days). It also makes your program logic code easier and likewise more reusable. So in the long run does save you quite a lot of time and effort. It also helps you get your thinking sorted out so although the actuall machine code may not be transferable to a new CPU ISA the actual logic etc is, which again saves time.

As I've mentioned before my coding style is write it for clarity first using minimal instruction types common to most CPUs (thus ADD not MAD, use byte reads and bit masks not bit test instructions). Then tighten up the code where required using device/family specific instructions. Only going into tricks like page zero RAM jump tables if absolutly required. It makes the code maintainable not just for others but myself as well, and ups the reusability factor.

Clive RobinsonDecember 20, 2016 3:04 AM

@ Figureitout,

I forgot to address,

I wasn't getting labels to work in inline asm, so I stopped at that point.

That is often problematic and is down to who wrote the compiler. Direct inline assembler is usually considered to be linear code without loops etc. When you include loops you are looking at code blocks that are all in one assembler objects and should be effectivly called not inlined instruction by instruction. You need to get deep into the compiler documentation to see how the C level lables get translated into machine code addresses. It's something you might want to avoid on your first few projects, as it's arcane knowledge and your time would be better spent getting your general assembler skills up.

Wesley ParishDecember 20, 2016 3:24 AM

@Bruce

News from the Pop culture front. I've just seen Independence Day for the very first time - I didn't have time to see it way back when it first came out, so I watched it on the minute screen courtesy of DVD and PC ...

I strongly suspect, as a result of seeing it, that it was a major part of the planning for 9/11/2001. It has the destruction of major cities, in this case New York, New York, and Washington DC. It has a suicide bomber who sacrifices his life and his aircraft to blow up the enemy's spacecraft, and a couple of unlikely heroes who almost become suicide bombers.

In other words, Al Qaeda was watching US popular culture very very closely.

If the Establishment wished to prevent such attacks, perhaps they should've sent the Pound after the executives of 20th Century Fox ...

(Of course it deserves all the harsh criticism it received at the time as essentially a wish-fulfillment fantasy ... )

The Threat from Unlocked, Unmodified Phones & VPNsDecember 20, 2016 3:56 AM

Name any country and the issues being caused by inexpensive (½ price) smart phones are similar.
Here we shall focus on data-mining, national security, profits mixed with irony & humor.

First the carrier perspective. Lets use America but substitute your own country.

Unlocked phones are fine IF they are purchased directly from the carrier. These particular unlocked phones have modified root software allowing AT&T or Verizon to still data-mine the customer. Business as usual.

Unlocked phones purchased from retail outlets like Costco probably still contain the added bonus of carrier added software. The kiosks are rented within the store and authorized by the carrier.

However there is a huge new unsettling trend where consumers buy unlocked phones directly like from Google, Apple and Amazon. Of the three, unlocked, unmodified phones from Amazon are apparently a threat to the carrier (and the US government). Explanation to follow.

Worst Case Scenario
If the consumer is security conscious they will install their VPN client software on their smart phone. This configuration reduces the local carrier to well... to just being a carrier. They can no longer simply scoop up customer data communications. Och!

This scenario also reveals why scooping up VPN usernames and passwords have become even more valuable. (See Are American VPNs Compromised?) People in stable careers ‘loosing control’ resort to desperate measures, but at risk being ‘outed’ with too obvious cover stories...

It is important to note even installing security app like Signal in a carrier modified phone offer limited security because the keystrokes can still be recorded before encryption and sent anywhere (even using the VPN server).

Actually even the unlocked phones firmware is typically modified by the Chinese manufacture but probably beyond the easy reach of your local and national security organizations.

Populism-Honesty-Transparency
Now we can deduce the REAL reason why both Amazon and China are a threat. To wit: Amazon is already falsely accused of being uncompetitive and a monopoly. The floated 35% tariffs would only hurt consumers.

Pretty remarkable for a populist president? His very base strongly supports the efficiency, honesty, low prices, wide selection of products and great customer service. A combination only available through Amazon.
Can governments and corporations instead come clean and state their livelihood is dependent upon invading citizens privacy?
Or continue to live under deception, flawed logic and manipulation?

Putting America First
The new Congress should legislate American corporations get first dibs to data-mine over ‘their own’ citizens. Or follow the lead and keep American data within American borders...

Merry Christmas and Happy Hanukkah

Clive RobinsonDecember 20, 2016 4:12 AM

@ Wesley Parish,

If the Establishment wished to prevent such attacks, perhaps they should've sent the Pound after the executives of 20th Century Fox ...

Remember what happened to SPE and what came out... I suspect the same if not worse of 20th Century Fox... So they probably need a good dose of public shaming all the way up to the very top...

But actually speaking of the Entertainment, there was also a Plane into US Gov story in one of Tom Clancy's "Jack Ryan" books.

And if you go back further you have a Robert Redford film about a small part of the CIA reading books for usable plot lines, then all but him getting assassinated as one of the plots is to close to a hidden group within the CIA...

Oh and even further out, certain SciFi writers acting as advisors to "Ronnie Ray-Gun" and claiming it was their ideas that brought down the iron curtain...

You could say that art is not a mirror of life, but two mirrors infinitely reflecting life to art and back again. The hard part being to seperate art and life, to know what is real and what not...

CuriousDecember 20, 2016 4:20 AM

Off topic: US Congressman Trey Gowdy on twitter with probably unintended comedy:

"Free speech is the ability to speak truth to power without consequences."

With Chomsky's notion of power already knowing the truth, one can also interpret this sentence, as free speech having no impact on power. :)

IanashA_TitocIhDecember 20, 2016 9:33 AM

Thoth & others

From Thoth above "All VPN Service Providers MUST be considered COMPROMISED. Be it a Swiss or Icelandic provider, it's all gone ... it's all down the drain already.

Stop sleeping ......"

Although anecdotal, Tails is reporting to me more frequently something like 'can't check for Tails updates; reboot and try again later.'

How about the OnionBrowser for iOS (from iTunes), instead of VPNs, with all the baggage, and/or risk, that using Tor entails?

Should the layperson give up on VPNs and/or Tor? It seems that the way the world is going using Tor, when and where possible, is reasonable resistance to the way the world is going.

https://itunes.apple.com/us/app/onion-browser/id519296448?mt=8


Clive & others

From Clive above "Like AV before it tripewire is nolonger upto the job by it's self and people seriously need to think where they are going to be alowed to go by the powers that be. Because we left it to late and now we are nolonger masters of our own homes let alone destiny, and must pay tribute to "The Man" or get smited by law, be it civil or criminal, as the man is now corporate as he is federal."

Might an "untampered" live cd or live dvd be of service to minimize persistent malware? Or, pros and cons of using Live DVDs. Where can things go wrong with Live DVDs? Let's assume a good download or at least one can download from https sites, use pgp, Gpg4win, or Gpgtools to verify signatures, or at least confirm sha1 or sha256 hashes from multiple places to help minimize risk.

I have spent some time with some live DVDs:

1) https://en.wikipedia.org/wiki/Lightweight_Portable_Security

DoD offering that offers Flash in its deluxe version. Relatively, infrequent updates. Documentation and ease of use good. Haven't tried using anything Tor related with it. Can't verify iso downloads with gpg (lps or others). Sometime back, on a lps version I could get to work as VirtualBox guest, I recall LittleSnitch reporting lps wanting to make an outgoing connection.


2) https://en.wikipedia.org/wiki/Knoppix

More frequent updates. Like a Swiss army knife. May be possible to run a Tor relay in it, but I haven't figured out how. Regular Tor browsing requires a little tweaking. I think Clive might still like Knoppix.

I assume booting: "knoppix testcd" is of limited usefullness in detecting interdiction.


3) https://en.wikipedia.org/wiki/Tails_%28operating_system%29

Monthly updates. Use unsafe browser to avoid Tor browsing. Tails joins the Tor network by default on startup, however; I don't know to stop this. Don't forget privacy and security settings; right click the green onion in privacy and security settings when using the Tor Browser.

Erroll

Thanks for the above links on 0days in Linux.

Clive RobinsonDecember 20, 2016 11:47 AM

@ IanashA_Titoclh,

Might an "untampered" live cd or live dvd be of service to minimize persistent malware?

It's funny you should mention Live CD / DVD as I mentioned them a few days ago on this very blog.

To restate it, not so long ago many computing Magazines carried Live CDs on their front covers. For various reasons these were not likely to be tampered with by State Level Attackers because the risk of it getting picked up would be way way to high. Thus you could just randomly go somewhere walk into a newsagent and get a "good copy" of a live CD, with little or no effort or apparent "evasive fildcraft" being involved.

Likewise you used to get full blown distributions both in Live CD and in "full source code" in many books in bookshops.

This however is nolonger the case and getting a live CD means doing a "download" in most cases... As we know nearly a decade ago the NSA, GCHQ and probably other SigInt agencies had tricks where they just got a packet to your computer faster than the web site you were trying to download from. This means they can get to the next upstream node from you and control everything you receive across the wire... As long as you stick with home or workplace download they can own you by substituting what they want... But downloading elsewhere is not as easy by a long way as just buying a magazine from a random cornor shop etc. You need to find an Internet cafe that will alow you to do the nasty with their bandwidth, which means they are likely only to alow you to do it when it's quiet. Which means drop in ask, go away and come back at a later time. Which gives the SigInt agencies a considerable window of opportunity to get their act in gear.

Yes there are a few other details to do with code signing but Stuxnet told us these are not a problem for the SigInt agencies to deal with via placed insider or black bag job...

So if you were a person of sufficient interest they could get at your download, and there is little most non technical people can do about it.

But there is another issue, that of logic errors or bugs that can be used as attack vectors. A decade and a half ago Flash ROM was only just starting to be put in SoC IO chips etc. Which ment that when you turned the power off on the machine you use the Live CD in, it was reasonably certain any malware was flushed. Not so now it can be hidden in the many many Flash ROMs in a modern PC such as the Optical drive or hard drive chip set, the actual BIOS (remember what Lenovo did with their low end laptops) and even the charge control chip in the battery pack...

It's why I talk about real physical seperation using two or more computers via guards, slucies, pumps and data diodes these days. As well as using good quality paper and pencil codes and ciphers. So that "plaintext" is never on any of your computers.

Yes there are other issues about end run attacks, which I have mentioned before, but won't this time... It suffices to say that technology is rapidly pushing in the direction that favours State Level Activities as they are "early adopters" these days. As Bruce has noted PhD level today script level attacks the week after next by ad agencies etc (see rapid development of audio attacks from BadBIOS to your smart phone and ads).

IanashA_TitocIhDecember 20, 2016 1:29 PM

btw currently I am having troubles running current versions of Knoppix and Tails in recent versions of VirtualBox (both 5.0.30 & 5.1.10, perhaps). Older versions of Tails and Knoppix still boot in VirtualBox. As usual, no guest additions installed. Help would be appreciated.

@Clive and others

My SOP for downloads is use Tor and not use Tor, Windows machines, OSX machines, Tails, Knoppix, lps, etc., at least at times, and libraries, coffee shops, home, shared PCs, others' PCs, etc., and compare values.

For example, with Tails I might download the new Tails iso to ram, and do a command line signature check. Also verify signatures with gpg4win on Windows machines and on OSX machines with gpgtools. Then I might compare sha1 and sha256 values amongst isos (sha1 since I still use fciv.exe). In addition, I might download additional signature files using free wifi as I travel around, using my presumably compromised laptop (and Tor and not-Tor), and again compare sha1 and sha256 values for newly downloaded signatures (both Tor and non-Tor). Of course, I don't recommend my SOP. In other, words I may be sitting there doing nothing, drinking coffee, reading magazines or books, trying to be sociable when curious people show up or bother to look at videos.

The hardware is a kicker. If I leave my Apple charger at home it's vulnerable. If I take it with me, it's vulnerable. Firmwware- oh well life is full of risks. I also use non-Apple hardware. Maybe if people keep there old hardware in 5 or 10 years they might be able to run forensics on it or open-firmware on it

Nick PDecember 20, 2016 2:30 PM

@ tyr

Lol. Yeah we appear to have the DOS trolls back on the blog. I figured it was going to be some ancient PC you were talking about. Far as improving it, look up SymbOS on Amstrad that Ive posted prior. That develop added some memory but otherwise did all that with a Z80 I think.

MarkDecember 20, 2016 2:45 PM

@White Rabbit,

I am not in charge of a super massive second coming event.

Oh, but you are.
For the Apostle's Paul and Paulette, you represent a de-escalation with their own nation.

Resurrection of the un-believers.

A homecoming celebration during the exodus.

MarkDecember 20, 2016 3:15 PM

@Clive,

The optical drives are very OLD targets, be leary of using DVD-R[W] CD-R[W] drives where ancient pyramid builders constructed region "free" codes.

It took me a long time to track down SATA DVD-ROMS, even ATAPI ones were hard to track but I salvage a large % of my HW from others. A risk, granted considering the habits of some but I find it hard for myself to drink from the same well as the others.

Both financially, and aesthetically - chasing that horse

Sourcing those old live-cd's is the hardest aspect, I scower second hand stores for jellybeans and while attaching them to the internet is a bad idea they provide tools for a bastionized bastard. Uncompromised md5sum, sha1sum and gnupg.

A strap for your boots, so you don't waste time lacing them up and down every time you go to put one of your waders on.

Imagine that dban is backdoored, do you trust your wipe? Does your wife double check that you went from front to back?

And it could be, all for naught. Doubly so, but what else should we be doing in the Weaponized World of Wonders?

Deny ourselves our vice? our passion? our ferver?

We could always re-adjust ourselves, remake ourselves into Nick P's image as best that we can. But why type-squat in other's domains? Chains are only as strong as their weakest link, and domain-knowledge is hard won and a hard one

Curiousity is a terrible thing to waste, it one of the two self-oriented motivators we have.

The other? is greed.

I am here to learn protections and mitigations, so I can enjoy the little free-time that I have left on this world.

ThothDecember 20, 2016 7:34 PM

@Curious

The US Govt, Legislature and so on are hopelessly stupid. Sure, here's some strong encryption but no backdoors and the Feds can break in when needed ???? Not sure how a cipher would look like. Maybe a 16-bit block size cipher with 1024 bytes key length ? Not gonna work.

FigureitoutDecember 20, 2016 8:48 PM

Daniela Alighieri Caruso
--Yeah I like communities that self-regulate. Yeah, Rome and Sardinia is all I've been to, mi scusi I can't speak Italian so I'd have to stay in heavy tourist areas. :p

Clive Robinson
--I said KB, not GB. Can't even store bunch of useful lookup tables, or have a lot of driver code. Try to get all the features of a modern PC in a KB (BIOS and cdrom, audio, usb, hdmi, sd card, ethernet, etc.), impossible.

Yeah, I haven't seen a need for debounce. Normally you can tell right away you need it. And I don't have space for proper engineering best practices.

You say use byte reads and bit masks (what do you do w/ masked bits then?). Still not sure how to do some conditional instruction.

OK to the rest.

IanashA_TitocIh
--That's good opsec, about what can mostly be done these days besides going back in time.

Clive RobinsonDecember 20, 2016 11:49 PM

@ Figureitout,

I said KB, not GB

I know, but it's not what you said but the way it came across, so I pulled your leg a little 0:)

With regards,

You say use byte reads and bit masks (what do you do w/ masked bits then?).

Well you might do the following, Move the port byte value into the Accumulator then AND with the "and bit mask" of 00000100b / 04h.

If the bit value is zero then the whole byte result is zero and the "zero flag" will be set. If the bit is set then the "zero flag" will be clear. Either way you can then use "BRanch on Zero" (BRZ) or "Branch on Not Zero" (BNZ), depending on what you want to do. If you think in terms of branching not skipping then if you would "branch on zero" to use in a PIC you would "skip on Not zero" followed by a jump to where you would have branched to.

In some PIC chips you have an instruction that alows you to test a bit in a byte of RAM and "Skip/Branch" without effecting the contents of the Accumulator or other data registers which is not only a lot faster, it saves quite a bit of ROM space as well as you don't have to shuffle data bytes into other registers or RAM used as scratch/temp memory.

AND masks are also known as "setting masks" whilst OR masks are the logical inversion of AND masks and also known as "clearing masks".

That is for reading in data AND masks have the "bit of interest" set and all others clear whilst OR masks have the "bit of interest" clear and all other bits set. Thus to confuse you more if you OR with the AND mask it sets the "bit of intetest" for writing out and if you AND with the OR mask it clears the bit for writing out...

Whilst it is long winded to think of using bit masks, it applies to nearly all CPUs and is a "generic" "lowest common denominator", where as "specific" bit tests don't and aren't. Therefor translating the long form from "generic" to "specific" is relatively painless where as moving a specific CPU bit test to another CPU is far less simple and has other side effects (such as requiring other temp memory and changing the program logic flow etc). Thus the designers of C went the generic lowest common denominator route for easy portability for good reason.

Interestingly hand coding using CPU specific bit test and similar instructions can often make upto a 50% reduction in code space, which as it also eliminates tempory storage thus external bus cycles can give a speed advantage of four or more times...

But I still say "code for simplicity" with the "generic way" then only recode to "specific" where necessary to not hit resource limits. That way your code stays maintainable and mainly generic thus portable.

FigureitoutDecember 21, 2016 12:47 AM

Clive Robinson
--You've pulled my leg enough eh? >:p You're not so playful when I pull yours...

Is that across all PICs? What is the accumulator, whatever? W? Looks like there's a ton of accumulators. On 68HC12, there was 2, A and B. That's such a nice chip for assembly, it's CISC though.

And the datasheet said there was no BRZ or BNZ instructions for this particular chip (I'm using only what I have in my "lab")...so I was stuck w/ stupid bit test, I need my "beq" or "bne" instructions to code in asm; in MIPS it's all in one instruction, doing the compare. ARM there's a lot of conditional instructions. I thought you were doing a compare w/ just bit masks and byte reads; think you need hardware. Based off what I just learned I can imagine a hardware "arbitration" circuit that could be used to test 2 values for equality (it compares if one is lower than the other, the higher value "wins" and gets control of a bus), the final 2 results would go to an AND gate (if it reaches the end, it's "1's" or true all the way down) and that would set a flag or bit in some register if true. Another way that's used is to subtract the 2 values, if equal to zero, they're equal. Must use less gates so that gets used.

Yeah, that's a common feature in a lot of chips to not effect register contents eh? That has to be documented if otherwise (preferably in bold, to get attention).

It would take a lot of initial effort to write portable assembly; but in any random project you run into edge cases and things you don't expect, waffling over the perfect solution...not going to do that probably, going to make some hacks at the worst case. Pretty much every code base I look at has "hacks", quite a few are honest and comment "this is a hack".

ab praeceptisDecember 21, 2016 1:53 AM

Holistic Hacker

"Take a tight grip, because you are talking to the main [quoted profanity deleted by moderator] in charge of all of this.

It will not be pretty."

Should I be afraid of you?

ab praeceptisDecember 21, 2016 4:50 AM

Moderator

Thank you. I'd like to suggest that you generally take a harder stance against sock puppets. After all, this is not 4chan but a professional blog (unless I'm mistaken).

I can understand perfectly well that there can come up special situations in which one might want to act anonymous. But as a common rule this blog would profit from people using just one screen name.

Funnily, the ratio between hot air and useful contributions is significantly different when looking at those using alsways the same name and those who write under who know how many different names. Yet another reason for a stricter policy, it seems.

Clive RobinsonDecember 21, 2016 5:12 AM

@ Figureitout,

The "results register" from the ALU goes under several names, genetically it's called the Accumulator, but yes in some PICs it's the W --working?-- register. Oh and in some CPUs it's any and all of the registers including the Program Counter. Likewise Branch if zero is a generic name for a test on the zero flag in the results / flags register. In a generic processor you generally expect a carry flag, a sign flag and a zero flag as a minimum you even get parity in some and if the CPU does BCD arithmetic other flags.

These flags exist as part of the feedback mechanism into the instruction decode / execute mechanism but are important above the RTL to the microcode layer and at the ISA level as well. For some reason unknown, the designers of C dod not pull them up into the language, which makes life dofficult when you build ADTs over and above the bus wide unsigned integer (which you will find when you try making your own long integers on a byte wide CPU).

There are two ways to do a compare and they both boil down to doing an add of the two bus wide integers but one with 'complemented bits' so is the equivalent of subtracting one from the other. The difference between the subtract and compare is generally the result is not written to the accumulator/working register, and just the flags are updated. Likewise there are instructions that affect the contents of registers that do not effect the state of the flags register. You need to look at each CPU ISA data sheet for that information.

Which means actually understanding what the chip designers mean with the way they present their information. Intel for instance are notoriously bad at it for some reason, and I have doubts that there are more than a thousand or so people world wide who have read Intel's current ISA data sheets and taken it all onboard to the point they know exactly from memory what each and every instruction does and how. I'm betting that there are probably more people that can do that with ARM products. But with each generation of chip I suspect the % of software people who do goes down.

Which starts all sorts of "forgoton / elitist" knowledge questions that are not just philosophical. Especialy with the "Binary Blob" microcode patches for the likes of Intel and AMD chips, and the fact they realy don't publish paper data sheets any longer. All of which raise the "SigInt agency" questions with the Managment Engines that nobody wants to answer.

One thing that does help when you are starting out with a new "wierd" CPU ISA is to play "paper computer" where you write down the instructions you think you need to use and step through instruction by instruction with the data sheet filling in the flags etc as you go. Thankfully these days most debuggers will single step through and display the flags and register contents for you so it's "virtual paper computers" ;-)

But as with anything "start small and build up" improving your chops as you go.

As for the PIC16f18855 I'd have to "construct the data sheet", you might have noticed how MicroChip have "build your own" data sheets, by having generic chapters and what are the equivalent of errata sheets from the standard model for each CPU in PDFs. I'm old fashioned and still prefere actuall books that have been proof read by somebody who knows whats in the chip.

ab praeceptisDecember 21, 2016 5:59 AM

Clive Robinson

Ah, I see someone who actually wrote assembler and for more than one cpu.

Small addendum: It gets even uglier. In some cpus move instructions set the zero flag, in others they don't.

Addendum 2 (for better understanding for less expeirenced readers): the explicit and implicit ops (like the cmp and jx family) can be regarded as after-the-fact ops, i.e. they work on the the outcome of the last op.

So, in some cpus one might say "mov [some addresses content] to [some register]" followed by, say, "jump if not zero" while in others an explicit compare would be needed.

As Clive mentioned those books got ever thicker. The last one I had open next to me and well used was in the 90ies.

JG4December 21, 2016 10:05 AM


Clive recently pounded this nail on the head as well

https://www.theguardian.com/books/2016/dec/16/police-memoirs-officers-crime-pay-rereading
...
You like smoking dope, have no particular educational qualifications, have designed your own knuckledusters, threatened to kill your dad with a knife and your gang has overturned a car with a rival gang inside it – so what do you choose as a career? The police, of course. This is what we learned from An Inspector Recalls by Graham Satchwell (The History Press), one of a batch of increasingly frank police memoirs; the genre goes back two centuries and provides an invaluable prism through which we can see how and by whom our laws are enforced.

Nick PDecember 21, 2016 10:13 AM

NetBricks - Network, Function Virtualization (NFV) with Rust

Reminds me of similar benefits in language-based protection in Singularity and JX operating systems. I've been pushing for OSS groups to apply Rust similarly to see what happens. Performance of this one is nice. I still doubt this will be end of story as driver isolation by itself is worth separate processes and overflow checking is probably not on here. I also wonder just how much input validation happens for the packet headers.

ModeratorDecember 21, 2016 10:19 AM

@ab praeceptis, @D.A. Caruso, @all: Self-regulation is good, and also helps the moderator. Please do not hesitate to call out trollishness, especially personal slurs and threats. (Profanity is easy enough to catch.) We don't require registration, and don't prevent visitors from varying input into the "Name" field when they submit comments, but we also don't welcome sockpuppeteers who use multiple screen names in order to prolong an argument. So, if name-switching appears to be part of a pattern of rude and disruptive behavior, please feel free to point that out.

FigureitoutDecember 21, 2016 1:31 PM

Moderator
--Thanks, I wouldn't mind as much if he contributed some interesting attacks, something testable and technically accurate. Instead it's just general bloviating then provactive statements where he's either under drugs or has some mental disorder (or just trolling b/c he has no life, I don't know).

ab praeceptis
--I have written for more than 1. MIPS, wrote a cache testing program where we had to write to memory "randomly". I just learned asm this past spring. Better than some of that supreme worthless whining that we hear from you.

Addenum to your addenum, yeah in AVR they do it right w/ "sei" instruction (set global interrupt flag), that sets it to 1 and turns on. Cli clears int. flag. On 68HC12 it's other way around, stupid, unintuitive and annoying...

Clive Robinson
--Ok, I like that term better, "results reg.". My idea of a bus arbitration circuit used as a comparator breaks down unless it can break out anytime if there's a zero, which would complicate the circuit. I suppose if you could write certain parts to a register and then subtract. Bleh dumb, just subtracting and checking for zero is much simpler.

Yeah hopefully ARM keeps gaining strength, and I don't need to get into Intel datasheets (or lack thereof...). I wanna help disabling the IME, and some secret keys that prevent me loading whatever software I want on my machine, my chip.

Yeah I love being able to step thru programs or when they show compiled asm (but I don't trust it sometimes, they fail or are glitchy of course occasionally, or I don't trust the starting points).

I'm just going to need to get a better PIC for asm, think they mean for this to be a C chip. PIC24f... looks good, much more to work with. Compare instructions too, w/ imm. value and reg. to reg.

I prefer having a PDF of datasheets these days (like textbooks in paper), can find what you need much faster assuming a table of contents and "ctrl+f" searching (oh yeah, the PIC16f18855 didn't have table of contents for 666 page datasheet which baffles the mind...no coincidence it's length is 666 b/c it's evil lol).

Clive RobinsonDecember 21, 2016 3:12 PM

@ AlanS,

You beat me to the punch on the ECJ rulling (it's reasoning is actually quite sensible).

However the old buzzards feathers have been ruffled --the snoopers charter was her totaly mindless idea to start with-- and thus she is going to appeal. Which is almost as stupid as her charter in the first place. I hope they get it done and dusted befor March due to Article 50 concerns, as that will then open the door to people to lodge cases against the UK Government, that will still be binding long after Brexit.

On another note,

@ Bruce,

In Kingston high security Crown Court South West London today, four men were found guilty of stealing from ATMs at petrol stations and the like. They got what appear to be fairly stiff sentences of 10-11 years each.

Stiff untill you find out how they got the cash safes open... Put simply they pumped in flamable gas into the ATM then using an electrical igniter blew the ATM up almost compleatly. Bearing in mind ATMs are in public places on major pedestrian walk ways, it's amazing that nobody was hurt by flying glass and metal etc. It is this rather than the theft they got the stiff sentences for.

Clive RobinsonDecember 21, 2016 4:08 PM

@ Figureitout,

PIC24f... looks good, much more to work with. Compare instructions too...

But it has no "software interupt" which makes developing an OS or BIOS that much harder (you can fake it by causing internal hardware to immediatly raise an interupt).

For a similar price range and IO look at the MicroChip devices built on a MIPS core and gives full 32bit with lots of RAM/ROM, so much so there is a port of an early BSD *nix[1].

One nice thing MicroChip do is put their MCUs onto header PCBs so you can plug them into their development Explorer 16 / 32 board ( http://www.edn-europe.com/news/microchip-uprates-development-board-16-bit-and-32-bit-pics )

[1] One day I'm going to pull out the old punch tapes and listings of an early *nix for the PDP11/70 I've kept since the early 1980's and actually get it up and running on a 16bit or 32bit microcontroller, but I need to clear out at least six months of full and free time to do it, and find a working eight hole tape reader...

AlanSDecember 21, 2016 5:55 PM

@Clive

The old buzzard is as crazy as a loon on this matter, A50/Brexit, and much else. She appears to use secrecy and authoritarianism to cover up for the fact that she has no clue what she's doing and has limited skills as a politician. And I suspect she's making few friends in her own party, never mind the EU27, Scotland, NI, Gibraltar, .... It won't end well. At some point the knives will come out and the Tories will do what the Tories do best but probably not before much damage has been done. And it's hard to see a replacement waiting in the wings that will be any better. God save us all from the British ruling classes.

Jack Parson's MotorcycleDecember 21, 2016 8:19 PM

Noam Chomsky - The Alien perspective on humanity
https://www.youtube.com/watch?v=h0qdbsE3Jqo

Tilo asks Noam to pretend to be an alien for a moment. An alien who looks down on Earth. What does he witness? Chomsky explains what the objective observer from out of space would see: What is humanity up to in the 21st century? Will it be our final century? Are we going to survive? What existential dangers are we facing? What's the most dangerous organization in human history?

Tilo and "Alien Chomsky" also talk about the American Empire: Is it going to last? Is America the exception to the rule of Empires always falling? What about Obama's drone program? Is Obama a terrorist? Is Germany part of a terrorist organization? Is Martin Luther King still right about his government?


Thanks to more than a thousand supporters who helped produce this episode with Noam Chomsky! You are all being credited at the end of the episode.

ab praeceptisDecember 21, 2016 8:47 PM

Figureitout

Apologies, if my post made you think that I took you to be clueless or without experience. But actually I said ... nothing ... nothing at all to or about you.
I merely responded grinningly to a post of Clive Robinson as it reminded me of my own days with assemblers and ever thicker processor manuals (I could be wrong but I vaguely remember some resident ASM manual for 386 (m)ASM that could be popped up when needed and I found it useful as things got ever more complicated; but I still kept my intel (printed) manual open anyway).

Clive was also right in wondering why C missed certain not at all unimportant operators/features. My guess is that they saw the presumably increasing difficulties with lots of architectures. After all in those days the field was still rather open and usually a new processor also got a new high (or "high") level language.

In the end I shrugged and didn't bring it up for a simple reason: C compilers rather soon (in my age, i.e. the mid eighties and later) began to offer inline assemblers and such intricacies like the one mentioned by Clive Robinsons were just a #define away. Normally one wouldn't care but for time critical routines one could take advantage of the capabilities of a given architecture from C if one wanted. That may not sound as much but it was indeed very valuable because formertimes asm optimizations meant linking in object files which meant that quite often the calling overhead would eat away what asm code had created in advantages. That was the real beauty of inline asm: one could quite arbitrarily "jump" into asm and write a little asm code inmidst of a C function without any overhead.

WaelDecember 21, 2016 9:44 PM

@Jack Parson's Motorcycle,

Noam Chomsky - The Alien perspective on humanity

Thanks for sharing! If you trust us... well, it's your problem ;)

FigureitoutDecember 21, 2016 10:49 PM

Clive Robinson
--What?! Why not include that...? Ok well that's a pretty standard feature, that's what's used for debugging software eh? To single step programs. Yeah a 32 bit would be good.

ab praeceptis
--Certainly sounded like it. Ok nevermind. Yeah I see inline asm to this day, looked cool, wanted to try it (want to do more than 4 lines).

name.withheld.for.obvious.reasonsDecember 22, 2016 12:21 AM

@ Clive Robinson,

As your participation within the context of Schneier's blog space represents a balanced and thoughtful participant willing to provide thoughtful responses, your observations are appreciated by many. As of late, the tenor and character expressed here seems to have made a marked departure from historic discourse, not just technical or rational basis but a less deliberate expression (though could be thought deliberate). The level of friction, introduced as rational thought within the discourse, debate, or argumentative treatise appears to historic writings as the lessor. The present, anecdotally, represents a line in the succession of progress turning away from progress and heading towards...

Two things, just recognizing that blogging in this sphere (philosophical and geometric) makes more work than most would enjoin. Kudos to ya...

The other, a request (formal hypothesis is not required), or more a question; Are you seeing the same thing across these spheres??? Feel free to define the scope and flavor of "spheres".

Daniela Alighieri CarusoDecember 22, 2016 1:44 AM

@ Moderator
> Self-regulation is good, and also helps the moderator

thank you for your feedback and reminder that we don't need to be long suffering of time wasters. It's a patient and respectful tribe here, to a fault - it is equally valid to speak up in a disciplined fashion. I feel I should have been more restrained in fact.

I value this blog and especially the commentators, as a valuable resource that wants to make the world a better place. We need to nurture this as a garden and remove weeds immediately . Nice biodynamic ecosystem you've built here, Bruce :-) Yep, this metaphor works


@ IanashA_TitocIh
nice OpSec with your maintenance of OS's as FigureItOut also pointed out - do you find it hard to keep up for long periods? Didn't quite follow your point about being at coffee lounges and people joining you to look at pictures. I take it Qubes and OpenBSD are premier choices for many folk here, Knoppix will be worth a try

FWIW, someone I know hasn't been able to update Tor recently either (not Tails though, just Tor package). This is a recent development, with same error message you described. Not happened before. An ominous sign?


JG4December 22, 2016 6:30 AM


their test of harm is not sufficiently stringent

Yahoo email scan shows U.S. spy push to recast constitutional privacy
http://www.reuters.com/article/us-yahoo-nsa-fourth-amendment-analysis-idUSKBN14A25F
...
The unifying idea, they said, is to move the focus of U.S. courts away from what makes something a distinct search and toward what is "reasonable" overall.
The basis of the argument for change is that people are making much more digital data available about themselves to businesses, and that data can contain clues that would lead to authorities disrupting attacks in the United States or on U.S. interests abroad.
While it might technically count as a search if an automated program trawls through all the data, the thinking goes, there is no unreasonable harm unless a human being looks at the result of that search and orders more intrusive measures or an arrest, which even then could be reasonable.

CallMeLateForSupperDecember 22, 2016 7:03 AM

Snowden tweeted: "Big: EU's highest court (ECJ) declares UK's mandatory logging of everyone's communications to be unlawful."

So the "Pry Minister" (I like that) must fall back and regroup (and likely retrench). I sense a summoning of ISPs to the Round Table for a little heart-to-heart with GCHQ - all voluntary and highly secret, of course - by which the former may be gently leaned upon by the latter to *voluntarily* log everyone's communications ... as a token of their deep patriotism.

Gag me with a spoon.

Meanwhile, yankee spooks tune in, for the entertainment and to offer plums of wisdom regarding means by which their Partners[TM] might squirm past this latest roadblock to getting what they want.

JG4December 22, 2016 7:05 AM


I've seen some creepy devices on restaurant tables. There should be a business opportunity to sell the 2% of people who care about such things a camera and microphone defeat kit that can be semi-permanently installed on these devices.

Norman Bates 2.0: Starwood and Wynn are excited to hide a camera and microphone in your hotel room
https://pando.com/2016/12/21/norman-bates-20-starwood-and-wynn-are-excited-put-camera-and-microphone-your-hotel-room/9ab671d8583160e09c2559978472273b66ee8d17/
...
Tink aims to have one million Handy devices operational in hotel rooms - one million cameras pointing at one million beds - by the end of 2017. But they’ll have to move fast: They have some serious competition in the fast-growing “creepily spying on hotel guests” category.

TedDecember 22, 2016 11:27 AM

NTIA’s vulnerability disclosure meetings gave rise to three working groups. One of those working groups focuses on awareness and adoption. One is focused on security disclosure for safety-critical industries. One addresses what happens when a disclosure affects multiple parties.

The first working group sent out a survey to researchers and vendors and has compiled this recently released report “Vulnerability Disclosure Attitudes and Actions.”

The report summarizes 414 researcher responses, representing researchers from over 50 countries. The report also summarizes 285 vendor responses. Appendix B is the Researcher Survey and Appendix C is the Technology Provider and Operator Survey.

https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-cybersecurity-vulnerabilities

JG4December 22, 2016 2:07 PM


http://www.nakedcapitalism.com/2016/12/200pm-water-cooler-12222016.html
...
Internet of Shit
https://twitter.com/internetofshit/status/811549827871940609
‏@internetofshit Internet of Shit Retweeted Brad Sams
can't even make this up
...
Brad Sams
https://twitter.com/bdsams/status/811323647860342784
‏@bdsams
Apple's new Airpods...if you dont have an internet connection like on a plane, subway, etc, they can't control the volume.
1:33 PM - 20 Dec 2016
...
The Bezzle, Internet of Shit (II). Clive writes:
Nest got cold feet when its community forum sometimes didn’t act like the corporate drones we were supposed to be, refused to drink every last drop of their Kool-Aid and had the temerity to heap criticism on buggy software and point out when products shipped with advertised features missing. So they suspended their community pending a “relaunch”. Now they have kicked the relaunch into long grass. Nothing too unusual there, I think though indicative perhaps of a trend that’s accelerating — business has always hated labor, but now they increasingly hate their customers too. Especially if they start to make outrageous, unreasonable demands like “please can we have products that work reliably?”

MrAsbestosPantsDecember 22, 2016 3:05 PM

Congress Calls Edward Snowden a Liar in New Report
http://www.nbcnews.com/news/us-news/congress-calls-edward-snowden-liar-new-report-n699121

From the article...

A scathing report by the House Intelligence Committee, backed by liberal Democrats and conservative Republicans, concludes that Edward Snowden was a disgruntled, serial liar who leaked for petty reasons, put American soldiers at risk and remains in continuing contact with Russian intelligence services.

The 37-page review, filled with redactions of classified material, does not accuse Snowden of being a spy, but it seeks to poke holes in nearly every aspect of his account of why he gave reporters reams of classified documents he obtained as a contractor — and trusted insider — with the National Security Agency.

Snowden immediately began denouncing the report on Twitter from his home in Russia, saying its core claims were made "without evidence" and that it established nothing worse than he might have been hard to work with.

His lawyer, Ben Wizner, told NBC News he considers the report "a failed attempt to discredit Edward Snowden, whose actions led to the most significant intelligence reforms in a generation."

mozDecember 22, 2016 6:29 PM

More on the trojans for Android artillery apps.

Apparent original source:
https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/

Reuters:
http://www.reuters.com/article/us-cyber-ukraine-idUSKBN14B0CU

The register:
http://www.theregister.co.uk/2016/12/22/android_malware_tracked_ukrainian_artillery/


Key quotes (crowdstrike):

"The original application enabled artillery forces to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces reducing targeting time from minutes to under 15 seconds"

"Open source reporting indicates that Ukrainian artillery forces have lost over 50% of their weapons in the 2 years of conflict and over 80% of D-30 howitzers, the highest percentage of loss of any other artillery pieces in Ukraine’s arsenal."

@Deliberate Act of Moar!

Very interesting attack. Actual "cyberwar" as opposed to putting nasty messages on web sites. Definite proof that Clive is right about avoiding mobiles (at least if you are in a fighting unit). If true this clearly shows that insecurity in Android devices actually killed people.

At the same time, I actually find the idea that Android devices are making more effective targeting for Soviet era artillery interesting too. If you don't use something like this you are clearly losing out. What's the use of a secure artillery unit which only hits where the targets moved from several minutes ago? Most people would probably take the risk in return for the obvious immediate benefit.

C3PODecember 23, 2016 1:36 AM

RE: the very expensive enquiry on Snowden - surely they could have just bought Greenwalds book no place to hide - contains actual real research by someone who is required to get their facts straight, for a job. answers all those tired old refrains straight out.

Much more reliable! How cheap and easy that would have been?! and many book websites have free shipping! maybe we should write a letter to congress, for next time.


Clive RobinsonDecember 23, 2016 6:29 AM

@ name.withheld,

Are you seeing the same thing across these spheres??? Feel free to define the scope and flavor of "spheres".

Yes, it appears technical blogs of quality are dying out, and the quality of those around is diminishing and becoming more political, not just in the "national representatives / government" sense, but in the personal as well.

In the pre 9/11 days Bruce's news letter etc was pure crypto tech 90% of the time. Since then the crypto has been somewhat less and diminishing with time. I suspect Bruce saw the writing on the wall and started in on the more human side of security a little after Ross J Anderson started looking at security economics. Sadly these days it's "Politics with every thing, and a coruption sauce".

Technology mean while has started butting up against the laws of physics and devices are seeing speed of light issues along with the problem with heat. Thus CISC advantages have gone, along with many of the execution pipline tricks. Thus we are now heading out irreversibly onto multi and parallel processing that few code cutters are realy up to.

The flip side is gizzmos and gadgets sitting on ever cheaper to implement and use communications. And this is the "real evil" underlying our rapidly diminishing security. Most people including many gurus do not get the implications, thus we get people lauding things as hopless as smart phones with "signal" on top. Imagine if you will signal is a blind folded elephant riding a unicycle on top of a little stand with a nose arround it's neck. You know the inevitable is going to happen "real soon now". Thus you watch with a sickened fasination hoping that the freak show will end befor elephant burgers are served at the dog stand by the big top entrance.

ThothDecember 23, 2016 6:54 AM

@Clive Robinson

"And this is the "real evil" underlying our rapidly diminishing security."

I just recently looked through an open source smart card security applet and I can immediately point out 3 to 4 ways to attack the "secure" smart card applet :( .

Even in the field of higher assurance security (HSMs, smart cards and the likes) there are a diminishing amount of people who can really be given the task to "code securely" (a.k.a defensive coding). I have stumbled upon many "security" applications and applets and all it takes is 10 minutes of scrolling through the source codes and I can start to create a good amount of attack vectors. Oh, and the security applet I recently reviewed only took me 5 to 10 minutes to come up with at least 3 security critical attack vectors. I have not reported the vulnerabilities to the owner yet though.

"Most people including many gurus do not get the implications, thus we get people lauding things as hopless as smart phones with "signal" on top. "

That's one bold move there :) . +1.

I noticed that too many people are looking at trends instead of proper conclusions from structured analysis of circumstances and resources. Just because an app offers "Perfect Forward Secrecy with Triple ECDH Ratchet With Curve25519" mambo jumbo and the wave of the magic wand thingy would be secure and yes rightly it maybe secure but does it fit the scenario and the use case otherwise it's useless. Also, the correct platform and many other things (i.e. chip type, security architecture, OS architecture, ciphers ....) every layer have to be analysed and thought through carefully but these day, I call these security applications a One-Way Ticket To Doom :) .

Most people blindly follow just because others said so ... not gonna work in the eyes of nation state attackers and hackers. They target everything and anything whether it is endorsed by whoever it is or used by whichever agency.

"You know the inevitable is going to happen "real soon now"."

We do not need to wait any longer as it's already here. One good example is IoT devices and many of them comes with some Hardware Crypto + TRNG mambo jumbo in the ARM CPU's spec sheet but I am pretty sure those who use it are not going to use it properly and those who don't use it are not going to bother anyway. Security is very difficult to get right and most experts inevitably trip over bad security due to carelessness or ignorance despite being experts. So, with all the ARM with embedded crypto magic sauce, why are we still seeing IoT devices being pwned everyday ? It's pretty obvious that the problem lies with the people who develop these stuff and don't put enough thought and effort into it. They just layer multiple layers of "golden sticker standards - FIPS/CC" and all the marketing crap with no real substance at all. No wonder @ab praeceptis have been going on a "shaming streak" trying to make fun of security gone bad (i.e. the FIPS/CC golden sticker thingy).

Anyway, security theater is here to stay and everyone's part of this security theater with little substance but lots of noise.

CallMeLateForSupperDecember 23, 2016 9:51 AM

@Clive
No, I had not heard of the Pinto + Skymaster lash-up. Tnx for the heads-up! The Wiki was a walk through two periods in my misspent youth that were separated by only four months.

"... total aircraft without passengers or fuel was already slightly over the certified gross weight of a Skymaster..."

My immediate reaction to seeing the Wiki photo was, "Uh-oh". Being somewhat familiar with the plane[1] and very familiar with the car, I doubted that the pusher prop alone would supply sufficient power for anything approaching stable flight, much less take-off. The Pinto engine, though small, was not light; my 1600cc engine was cast iron, and then there was the tranny. (ISTR the 2.0-liter engine was aluminum.) The Wiki says the car engine assisted during take-off. That fact doesn't mitigate my doubts; I wouldn't go up in the thing.


[1] The 20th TASS (Tactical Air Support Squadron) was based at Da Nang Air Base, South Viet Nam. Its O-2 Skymaster (militarized Cessna Super Skymaster) and OV-10 Bronco aircraft and their FAC (forward air controller) pilots provided CAS (close air support) for army & marines on the ground. My outfit and the 20th TASS's maint. troops shared a hangar, and I spent mucho free time with those guys, picking their brains. A close friend of my parents - who I knew well - was an O-2 FAC (with 20th TASS, ironically) two years before I arrived.

CuriousDecember 23, 2016 10:00 AM

Off topic:

Hrm. Running 'Microsoft Windows Malicious Software Removal Tool Dec. 2016' manually, indicates 90+ "infections" on OS partition while running. At the end. Zero infections listed.

CallMeLateForSupperDecember 23, 2016 10:45 AM

@Curious
"...one can also interpret this sentence, as free speech having no impact on power."

Yep-pir!. Good catch.

(I would suggest replacing "impact" with "influence" as it is more to the point.)

rDecember 23, 2016 11:40 AM

RE: Invitations to your Open House

@Curious,

Yeah no, I think I'll have to decline - it seems you've already got a bunch of rabblerowsers at your place and I'd hate to get blamed for breaking something.

Side note,

That's nothing, I've seen upwards of 14,000 in the past.

Including like 100~ active strains in the above instance.

Different era sure, but you get the picture.

People are funny, they will click on or download nearly anything.

That's why you have to be careful whom you invite into your castle, they normally RSVP friends.

FigureitoutDecember 23, 2016 11:13 PM

Clive Robinson
--Yeah for the most part. See a bit of that unneccesarily complex code, I have to deal w/ it now and not too happy about that. The evil part of "coding for job security" is all the pain it causes in maintenance after the offender has long moved on. That's never going to change in a dog-eat-dog world.

I had some thoughts of that sometimes, but think you're getting spooked w/ mostly nothing lol. There's no way you would know anyway if the mind-reading shape-shifting aliens that have infiltrated the planet were actually messing w/ you. :p

Happy holidays everyone!

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of IBM Resilient.