BBC.com reports that squid are proliferating around the North Sea, and speculates that they will become an increasingly common British dinner.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
wiredog • December 30, 2016 4:48 PM
Wikileaks’ attitude towards the US government in in the coming year will be quite interesting to see.
Anura • December 30, 2016 5:35 PM
@albert
Be careful with those numbers; if the government pays someone $100, but they should have received $99, it is $100 in improper payments, not $1. Those often occur due to delays in receiving data, and are often corrected which the recovery rate is not included in that report.
Anura • December 30, 2016 5:38 PM
Also, it should be noted that it also includes underpayments. So if the government gives one person $100 who should have received $99, and another person $99 who should have received $100, then there were $199 in improper payments.
albert • December 30, 2016 6:33 PM
@Anura,
Your argument is disingenuous.
“[Improper payments]…are payments made in an incorrect amount, payments that should not have been made at all, or payments made to an ineligible recipient or for an ineligible purpose. The total amount of improper payments may be even higher than reported because several agencies have yet to determine improper payment amounts for all of their programs….”.
Actual figures are hard to come by, usually because individual agencies need to conduct ‘recovery audits’ to determine the losses. Some don’t. Since these numbers amount to ‘dirty laundry’, they may be difficult to find. It’s an accounting nightmare.
Example: Medicare fraud:
“…Including today’s enforcement actions, nearly 900 individuals have been charged in national takedown operations, which have involved more than $2.5 billion in fraudulent billings…” (https://www.justice.gov/opa/pr/national-medicare-fraud-takedown-results-charges-against-243-individuals-approximately-712)
I don’t know about Denmark, but there’s something rotten in USG accounting practices, and no doubt some corruption as well. ‘The benefit of the doubt’ time has long since passed for these guys.
. .. . .. — ….
Clive Robinson • December 30, 2016 7:09 PM
@ Bruce,
Will Fish and Chips Become Squid and Chips?
I rather hope so for a couple of reasons,
Firstly fried squid in rings or other forms are realy very tasty unlike some more traditional British chip shop fish such as “Rock” short for “rock salmon” which is nothing what so ever to do with salmon, but actually a small member of the shark family called the “spiny dog fish”, which is now like other chip shop fish an endangered species.
Which brings us to the second point, squid are opportunistic invader species creatures that can and often do decimate habitats destroying other endangered species. With the only way to remove the problem is to cull the squid in that environment heavily (preferably to exitinction in habitats they did not traditional live in).
Thus killing such invader species squid is highly desirable, with being used as food an added bonus, hopefully making the fishing out of the invader species profitable.
Russian Hacks and Scratching Backs • December 30, 2016 7:12 PM
President Elect Statement:
“I think that computers have complicated lives very greatly,” he told reporters outside his Mar-a-Lago resort in Florida. “The whole age of computer has made it where nobody knows exactly what is going on.”
Russian Olympics Institutional Conspiracy
Russian official (after years of denying) admits to ‘institutional conspiracy’ of doping Olympic athletes
https://www.theguardian.com/sport/2016/dec/27/russian-officials-admit-athletes-doping-olympics
NSA Records EVERYTHING
“The National Security Agency’s ability to spy on vast quantities of Internet traffic passing through the United States has relied on its extraordinary, decades-long partnership with a single company: the telecom giant AT&T.
While it has been long known that American telecommunications companies worked closely with the spy agency, newly disclosed N.S.A. documents show that the relationship with AT&T has been considered unique and especially productive. One document described it as “highly collaborative,” while another lauded the company’s “extreme willingness to help.”
AT&T’s cooperation has involved a broad range of classified activities, according to the documents, which date from 2003 to 2013. AT&T has given the N.S.A. access, through several methods covered under different legal rules, to billions of emails as they have flowed across its domestic networks. It provided technical assistance in carrying out a secret court order permitting the wiretapping of all Internet communications at the United Nations headquarters, a customer of AT&T.
The N.S.A.’s top-secret budget in 2013 for the AT&T partnership was more than twice that of the next-largest such program, according to the documents. The company installed surveillance equipment in at least 17 of its Internet hubs on American soil, far more than its similarly sized competitor, Verizon. And its engineers were the first to try out new surveillance technologies invented by the eavesdropping agency.
One document reminds N.S.A. officials to be polite when visiting AT&T facilities, noting, “This is a partnership, not a contractual relationship.”
http://www.nytimes.com/2015/08/16/us/politics/att-helped-nsa-spy-on-an-array-of-internet-traffic.html
Executive Summary
The Russian government lied to the entire world over its illegal Olympic doping.
While the USA may rate poorly at real-time cyber defense, its BIG record button rates makes it without peer in post processing forensics. Internet packet metadata and contents provide irrefutable evidence untouched by human hand.
Perhaps advisor Michael Flynn could have advisor Peter Thiel’s Palantir perform its superior data analysis to independently confirm the issue for the President Elect. Or else (save a buck) privatize national intelligence by contracting out to our friend Israel.
In other words who knows where this is all going?
https://www.buzzfeed.com/williamalden/palantir-has-well-placed-friends-in-trumpworld
EvilKiru • December 30, 2016 7:29 PM
@albert: Password sharing might be a federal crime if you were given a password without permission from the actual owner (e.g., you got fired and a former co-worker gave you a password to access the company database) or if you continue using a shared password after the actual owner told you to cease and desist from doing so (such as Facebook vs. a social media aggregator), but it’s not a federal crime if the system owner permits it (e.g., password sharing for a Netflix account by family members), even if you live in Tennessee, where it’s a state-level crime.
Sources:
https://www.eff.org/deeplinks/2016/11/congress-needs-clarify-password-sharing-not-federal-crime
<href=”https://www.privateinternetaccess.com/blog/2016/07/password-sharing-not-federal-crime-still-illegal-tennessee/”>https://www.privateinternetaccess.com/blog/2016/07/password-sharing-not-federal-crime-still-illegal-tennessee/
Anura • December 30, 2016 7:29 PM
@albert
That definition says exactly what I said it does. “payments made in an incorrect amount” – the law itself explicitly states that it includes both underpayments and overpayments:
(2) IMPROPER PAYMENT.—The term “improper payment”—
(A) means any payment that should not have been
made or that was made in an incorrect amount (including
overpayments and underpayments) under statutory,
contractual, administrative, or other legally applicable
requirements; and
(B) includes any payment to an ineligible recipient,
any payment for an ineligible service, any duplicate pay
ment, payments for services not received, and any payment
that does not account for credit for applicable discounts.
https://www.whitehouse.gov/sites/default/files/omb/financial/_improper/PL_107-300.pdf
Quoting numbers without explaining what they are is misleading, and this is exactly why otherwise useless numbers like this are published in the first place. It comes from the same people who use “infinite horizon” accounting in order to mislead the public about Social Security. Pure propaganda tactics. It’s all just big scary numbers.
tyr • December 30, 2016 7:33 PM
Highly interesting talk.
https://www.youtube.com/watch?v=wue4QomGE74
This pounds home some of the topics discussed
here over the years. Securing highly complex
hardware is a nightmare for end users.
@albert
The government functions as an economic flywheel
basically recycling taxes back into the economy.
Trying to equate its operations to any other part
of the economy doesn’t work. The worst errors are
in assuming government works like a business or a
household. The EU being the most horrible example
of how bad this form of thinking is.
Germany has tightened the belt using household
theory but first looped it around the Greeks neck.
Blyth described the EU easing policies as sticking
a firehose through a mailslot in an attempt to get
some water into a teakettle. It may have kicked the
can of a banking crisis down the road but it hasn’t
made the inherent fallacy go away yet. Cutting a
government budget is just preventing taxes from
being returned to the economy of the country. That
makes it harder to collect more taxes. If you cut
when the external economy is booming it isn’t going
to have much effect but doing it when things are
already slow just makes it worse.
The complaints are all about where the money goes in
the external economy, does it go to the intended sector
or just wind up in some pockets who shouldn’t get it.
Don’t be misled by the ridiculous arguments of the
governance boys about fiscsl cliffs and government
irresponsible spending, none of them has a clue about
how an economy actually works.
Wael • December 30, 2016 9:03 PM
@tyr,
Nice video…
Securing highly complex hardware is a nightmare for end users.
And that’s assuming the designers were trying to maximize “security”, which isn’t the case shown here. LLC and its side-effects violated some security principles that lead to low level information leakage which can be exploited.
name.withheld.for.obvious.reasons • December 30, 2016 9:34 PM
Micheal Hayden’s latest barf-feast, I mean book, “Playing the Edge” from Penguin Books details some of Hayden’s rational for specific aspects of Stellar Wind. James Woolsey, former CIA director under Clinton, interviewed Hayden–Woolsey set all the questions up to avoid the appearance of impropriety. Questions such as stating that there were worries about people reading the contents of their mail/e-mail. An allegory used to explain the surveillance in very couched terms…stating the mail could be monitored if necessary to watch for mail from the mafia going to Woolsey is used as an example. Two major distinctions that lay fallow this simplistic instrument of lies and deception which fails; programmatic collection of data (including the content of their analogous mail example) at a scale that does not reflect mail delivery systems that existed forty years ago (Smith V Maryland – 1970’s), and the collection of this information is most generally stated as “someone” reading the contents suggest that the information is ephemeral.
This continued acceptance by the journalists, professionals, and the less creek media of these by-lines and propaganda must end–instead of passing review without correction expose and make necessary a restatement of state propaganda. This intellectually dishonest diatribe concocted by the MIC/SIC cannot continue or we will head down an untraveled road without discovering that another path is suggested/available. A future based on this continuous deep security state will visit us all and in one way or another affect us in ways we cannot fathom…
Tinfoil Wearing Wacko • December 30, 2016 10:30 PM
Bruce – it’s almost 2017. What do you think of the pre-shared secret authenticator apps? What do you think of U2F and Yubikey? Is there any hope for securing our digital world that doesn’t fall back to telephone numbers and security questions? How do we get the Government to play along? Can the US implement a PIV card to eliminate voter, welfare and citizenship fraud? If they did, would the whole identity theft issue go away?
Jebus Saves • December 30, 2016 10:31 PM
150 Filmmakers Ask Nikon and Canon to Sell Encrypted Cameras
https://www.wired.com/2016/12/200-filmmakers-ask-nikon-canon-sell-encrypted-cameras/
In the summer of 2013, when documentary filmmaker Laura Poitras was shooting a still-secret NSA leaker named Edward Snowden in a Hong Kong hotel room, she took security seriously. She’d periodically transfer her footage to encrypted hard drives, and would later go so far as to destroy the SD cards onto which her camera recorded. But as she watched Snowden through her lens, she was haunted by the possibility that security agents might barge through the door at any moment to seize her camera. And the memory card inside of it remained dangerously unencrypted, full of unedited confessions of a whistleblower who hadn’t yet gotten his secrets out to the world.
PUF the Magic Dragon • December 30, 2016 11:07 PM
PUFs, protection, privacy, PRNGs (ccc.de)
https://media.ccc.de/v/33c3-8231-pufs_protection_privacy_prngs
https://news.ycombinator.com/item?id=13288404
Thoth • December 30, 2016 11:14 PM
@PUF the Magic Dragon
Like all technology, it really depends on how you use it and the techniques involved.
@Wael, Clive Robinsom
Time for you guys to shoot down the PUF stuff again.
Wael • December 30, 2016 11:53 PM
@Thoth,
Time for you guys to shoot down the PUF stuff again
Strange! I don’t remember shooting it down the first time. I believe it was @RobertT who said something negative about it. Tell you what: why don’t you go for it, I’ll support ya! I can take either side, dontcha know?
Zaphod • December 31, 2016 2:02 AM
Hmmm. BBC science article. Expect hideously biased MMGW slant if at all possible.
Z.
Happy New Year y’all
Andy • December 31, 2016 2:16 AM
@tinfoil
My government trusts Google authenticate app, for a old , new I’d between gov places.
Based on what it does is supply a 1 min number that changes, tied that in with cell phone’s, can be trusted by them as two factor authenticate of a second phone, txt message.
I think that is was specially ask for from gov to Google as information about it has populate the web.
Drone • December 31, 2016 2:24 AM
The Aussies have us covered in WA:
Squid and Chips @ Cicerello’s, Mandurah WA Oz (Yum!)
https://junk4lunch.wordpress.com/2013/09/03/squid-and-chips-cicerellos-mandurah-wa-oz/
And then there’s the famous:
Squid Lips Gourmet Fish & Chips, Dunsborough & Margaret River, Western Australia
The Squid & Chips look great, but I’d go for the Chili Squid Wrap myself 🙂
Those delicious squid are doomed I say!
Firefox' cousin • December 31, 2016 7:23 AM
Firefox 52 Borrows One More Privacy Feature from the Tor Browser
Mozilla engineers have added a mechanism to Firefox 52 that prevents websites from fingerprinting users using system fonts.
The user privacy protection system was borrowed from the Tor Browser, where a similar mechanism blocks websites from identifying users based on the fonts installed on their computers.
The feature has been active in the Tor Browser for some time and will become active in the stable branch of Firefox 52, scheduled for release on March 7, 2017.
The font fingerprinting protection is already active in Firefox 52 Beta.
Other News • December 31, 2016 8:42 AM
Code associated with Russia hacking found on Vermont utility computer
“A code.” Another mainstream media facepalm. What happens to all these journalism majors when they graduate from college?
Clive Robinson • December 31, 2016 8:51 AM
Putting lipstick on DNC hack JAR realy is a Grizzly Steppe to far.
A few days ago a JAR from the DHS/FBI was released over the alleged Russian hacking of the DNC.
I posted a link to the report and requested that “people not shot the messenger” (ie me ;). This was because personaly I thought the JAR was a waste of bandwidth as far as the factual information was concerned as it was not possible to discern what was fantasy and what was at best supposition and confused arm waving.
Well others see things differently as we should expect, but sometimes even they have trouble putting lipstick on a pig. As becomes clear with,
http://www.robertmlee.org/critiques-of-the-dhsfbis-grizzly-steppe-report/
I suspect there will be other efforts by people who align more closely with the “Reds are out to get us excuse swill trough”.
Just to make my point clear, I think it’s highly likely that any country that has the ability to hack for intelligence is at it against any and all of the Five-Eyes all the time. If for no other reason than “to return the conpliment” of what the US in particular are doing to them. That is the nature of the game after all and has been in one way or another for centuries.
However if you are going to throw BRICs at your neighbours, you had better not live in a glass house.
Further it is generaly unwise to make accusations against countries without producing evidence, as it makes you look stupid. As has often been said “Extraodinary claims need extraordinary evidence” to make them viable…
The Obama second administration thus appear to want to make themselves look stupid in just about any way they can, why I can only guess. The latest volley from Obama has become a major embarrassment as Putin waltzed neatly around it to stake an almost unasailable claim to the moral high ground in the rest of the worlds viewpoint. Thus some belive it’s a last gasp desperate attempt by Obama to “Queer the Pitch” for Donald Trump as revenge or what ever, which casts further doubt on the DNC claims.
But worse it’s an open invitation by Obama to a “Kick my arse contest”, which can be seen by the likes of the UK Theresa May PM sanctioning comment that is “Trump Friendly” and quite Obama administration unfriendly. Thus in effect writing the obituary on the Obama/Cameron “special relationship” as the “silly years”.
Why on earth Obama should want to do this is unclear, but it’s not going to look good in the history books. The one thing it has done is made life a lot harder for GOP grandees etc. Trump is not realy a Republican he’s a “Trumpublican”, and I suspect quite a few were hoping that a Republican majority in both houses ment they could stear Donald the GOP way and use him the way they used GWB as a puppet. Well Obama at least has put an early spanner in the works on that. The GOP grandees might well have had an easier time getting their way had Hillary won…
Yet Other News • December 31, 2016 8:57 AM
Translation:
http://www.stripes.com/news/us/pentagon-review-could-help-veterans-shed-bad-paper-discharges-linked-to-trauma-1.446765
Don’t miss the heavy sarcasm.
My take on it: too much paper endangers life, let alone the judgment of whether it’s good or bad.
Clive Robinson • December 31, 2016 9:02 AM
@ Other News,
What happens to all these journalism majors when they graduate from college?
Err, I suspect they affiliate to political parties as speech writers or policy advisors, untill they can get their own political position and slice of the pork/gravy.
Those who don’t, well they can always earn a few bucks ripping each other off for click bait articles…
@ ALL,
And for those that have been clock watching the New Year has already started so get your glad rags on and go out and try to make 2017 a year to enjoy.
Pammbam • December 31, 2016 10:40 AM
Taibbi is a useful example of elite acculturation, the kind of serious face you learn to make to get ahead in life. He’s a bog-standard media celebrity like his dad. You see it most clearly in national security stories, where he always parrots the Pentagon line. Taibbi came off the same conveyor belt as Jon Stewart and Chris Hayes: he gains favor with entertaining partisan invective, then uses it to reinforce the beltway theology of threat mania and impunity.
The distasteful aspects of this piece include Taibbi’s prissy agnostic approach to the blatant government-issue bullshit debunked in these threads, and his irrelevant ad hominem hand-waving concerning Putin. The Wurlitzer trots him out because he lived in Russia but his vapid characterization is inconsistent with observers who’ve actually interacted with Putin.
What’s worse is to see Taibbi performing dismay over a notional ‘virtual coup d’etat’ while ignoring the numerous actual coups de main that make US democracy a joke: the Democrat party uniting to crush a popular unauthorized reformer; forcible state repression of the unauthorized Green party; Republicans’ decisive mass purge of voters who have a namesake in another state; third-world integrity safeguards that discount 6 million, requiring a 300-strong OSCE monitoring contingent. Yeltsin’s election was less embarrassing. Kim Jong Il’s was more convincing.
So don’t gimme this shit about US democracy under threat. The US is a fake democracy. That’s evident to anybody with the vestigial intellect to test US electoral politics against the legal requirements of ICCPR Article 25.
thesaucymugwump • December 31, 2016 11:15 AM
@Pammbam “The US is a fake democracy”
The U.S. has never been a democracy; it has always been a republic. We changed some of that, allowing for direct election of senators, but we still have the Electoral College which prevents one or two highly populated states from imposing their will on the rest of the country (this was by design). A number of Founding Fathers warned about political parties, but they became entrenched early on.
Greens, Libertarians, and other fringe parties have no chance in the presidential election, though Democrats proved just how low they can go with their support of HRC, the most criminal candidate so far.
As for “US democracy under threat”: you didn’t mention the Democrats fight against voter ID laws, with them claiming that it discriminates against poor people. That’s nonsense, of course, and they didn’t propose any ways to mitigate the situation, e.g. giving state IDs free of charge to people making less than $x per year and free bus passes to deliver their vote. I believe every state has mail-in ballots, so there’s no excuse for poor people not voting at their convenience.
You do not understand the ICCPR, as the U.S. made so many reservations that it has little practical effect. Wikipedia states: “Included in the Senate’s ratification was the declaration that ‘the provisions of Article 1 through 27 of the Covenant are not self-executing,’ and in a Senate Executive Report stated that the declaration was meant to ‘clarify that the Covenant will not create a private cause of action in U.S. Courts.'”
Wael • December 31, 2016 11:27 AM
@Clive Robinson, ALL,
And for those that have been clock watching the New Year has already started so get your glad rags on and go out and try to make 2017 a year to enjoy.
https://m.youtube.com/watch?v=Z04M6NhkIKk
Seems like 2016 felt too long and for some it just came and went…
Divisive as it could be for a few but it certainly made a dent.
Some of us will surely be praised for our acts and some of us will surely be dissed…
Some of us will never be remembered yet a few of us will forever be missed.
There is real hope as 2017 is yet to come and leave it’s beautiful indelible mark…
As long as we do our part to shine, will there be light to help each other navigate the dark.
This trailer may truly represent 2016, the bad movie some of us may have experienced together…
So I am sincerely wishing each one of you a better 2017, with hopes the sequel we would all enjoy forever.
Cheers and Happy New Year![1]
[1] These aren’t my words. They were sent to me via an IM. I liked the words, so I asked for permission to use them. My request was granted. Funny thing is I just mentioned gorillas, and the movie clip mentions them too. I read the IM a minute after my last post… strange…
GreenSquirrel • December 31, 2016 12:05 PM
@Dirk Praet https://www.schneier.com/blog/archives/2016/12/security_risks_12.html#c6741848
You made an excellent point about going way too far off topic for the previous post, so I’ve responded here :-).
I refer to the last paragraph of one of my previous comments in this thread. This has, of course, also implications on outer border control
Thanks – it gives me a bit more insight into what you mean. However, this does seem like a fairly ineffective solution. Your solution ran:
Translated to Schengen, this means that anyone whose identity has not been clearly established, has lied about his/her identity, has had his/her asylum application turned down or has been put on a terrorist watchlist (e.g. Syria returnees) should be barred from free travel within the Schengen zone and fitted with an electronic tag or confined to a closed detention center when not abiding by appropriate movement restrictions imposed by a judge in a formal court order.
The principle seems sound but I still dont think the implementation would be practical. Detention centres are high maintenance and seem destined to turn into living hell where terrorists are recruited (using the British Immigration Detention system as an example). Tagging would be better but still relies on an expensive, extensive, monitoring network to make it worthwhile. There needs to be a system which can respond quickly enough to alerts which, in turn, implies a large number of security forces personnel on stand by otherwise a terrorist group can simply “activate” 15 operatives simultaneously.
Barring free travel only works if you have a manned border point which checks everyone passing it for legitimacy.
Yes, the electronic tagging would make it easier to track movement across border points but you would still need an EU-wide monitoring network and personnel able to respond to the miscreant trying to cross the border.
Even if it was effective, this measure would have no impact on the terrorists who are legitimately inside the country, which is currently the majority of terrorist attacks in the EU.
The foreman indeed does, but it’s not a prerequisite for the rest of the team. I know of plenty of construction crews all around town here that speak Bulgarian, Romanian or even Ukrainian only.
Yes – but the work gang needs to communicate with the gangmaster. This does lead to single nationality construction crews but that was an identical problem 100 years ago when English people were up in arms about Irish and Welsh navvies coming over to “steal work.” Now they are part of the national fabric, everyone is cross that Polish workers are “coming over and stealing job.”
I sense a pattern.
It is however a bridge too far that ordinary people are forced out of their jobs, their homes and their land due to a system of blatantly unfair competition that (as usual) only benefits the happy few.
I am not sure I fully agree with this.
First off – what is unfair about the competition?
What automatic right do “ordinary” people have to be protected from economic forces? They are as much a part of the economy as everyone else and benefit from buying goods cheaply etc.
The economic reality is that the people who voted Brexit / Trump were fed lies and false hopes which played up to largely unfounded fears and a refusal to change. Society would be a lot better if the “ordinary” people were helped and guided to adapt to the changing world rather than inflamed and convinced that simply stopping migrants coming over will make everything better.
Pammbam • December 31, 2016 12:20 PM
@saucymugwump, I’m so tired of this ‘republic, not democracy’ business. The USA is neither. The constitution got set aside for COG when Cheney went to DEFCON 3 on 9/11. It’s gone, you’re not getting it back. Just as well, it’s obsolete crap anyway. No one’s used it for a hundred years. By founding fathers I presume you mean the Dulles Brothers and Prescott Bush, because that’s who founded the totalitarian state you live in now, threescore and seven years ago.
Of course Democrats collude with Republicans to suppress the vote. Do we need to remind everybody of that, in this day and age?
You are correct that the US tried to negate the ICCPR’s legal force with lots of weaselly cruft that breaches the Vienna Convention, when it’s not just legal nonsense. However it sounds like you haven’t watched any of the subsequent reviews. If you had, you would have seen US bureaucrats crawling and contorting to worm out of the plain sense of the words, making their regime a laughingstock worldwide. This binding law has ‘little practical effect’ only in the fantasy world of the New York Times/NPR lifestyle, where US concessions are furiously scrubbed of the international pressure that impelled them, and attributed to some random plucky domestic hero. The US is exquisitely sensitive to public chapter-and-verse exposure of its dereliction of state duty and jus cogens. That’s why media never ever show you treaty body or charter body documents. Face it, the ICCPR is all you’ve got left of your rights.
CallMeLateForSupper • December 31, 2016 12:39 PM
@OtherNews,
“What happens to all these journalism majors when they graduate from college?”
As with just about everything, “Those who can, do; those who cannot, teach.” In this case, those who take neither path, yet think more highly of themselves than they likely deserve, endeavor to sell themselves to the State Department.
A few who fail at all of the aforementioned dream up a likely-sounding consulting business in a tech. field and pursue crowd-sourced funding.
Ted • December 31, 2016 12:40 PM
Guide for Cybersecurity Event Recovery
https://www.nist.gov/news-events/news/2016/12/nist-guide-provides-way-tackle-cybersecurity-incidents-recovery-plan
“We make a living by what we get, but we make a life by what we give.” Winston Churchill
Happy New Year! Best wishes for you and yours 🙂
Pammbam • December 31, 2016 12:45 PM
Ooh, the Bill o’ Rights, it’s antiquarian curiosity time!
Here’s another from the olden days of yore!
Wael • December 31, 2016 12:48 PM
@CallMeLateForSupper,
“Those who can, do; those who cannot, teach.”
Those who can, do;
Those who can’t do, teach;
Those who can’t teach, manage.
I am not sure if the last two are in the correct order, but that’s the way I heard it.
r • December 31, 2016 12:55 PM
@Wael,
A teacher that cannot manage, will not manage long.
BTW, thank you for sharing the proxied good wishes.
Happy New Yarn.
Molly all your ox are free. • December 31, 2016 1:06 PM
@WhamBam,
You might want to slow down your p[r]eferential re: torts a little, they remind me of a … LAB? Look-aside-buffer?…
No, that’s not the wright conception.
Script.
Dirk Praet • December 31, 2016 1:45 PM
@ GreenSquirrel
Even if it was effective, this measure would have no impact on the terrorists who are legitimately inside the country, which is currently the majority of terrorist attacks in the EU.
Like I said, I know in practice this will be hard to enforce, but I think it’s worth while evaluating, especially because similar measures also used in the fight against organised crime do seem to be working in Italy, even with legitimate residents. See one of my previous comments in this Squid thread. The alternative is doing nothing and allowing society to further polarize with every new attack.
First off – what is unfair about the competition?
The unfair competition does not exist in foreign labourers doing the same work for lower wages, but in social contributions and taxes being paid in the country of origin of the foreign labourer, not at the much higher tariffs of and in the country where the actual labour is done.
Which means that today’s truck driver can train to become an IT expert, then again loses his job to a Bulgarian contractor who has mastered the local language and for the employer is cheaper to hire even if he’s asking a higher salary than the local guy. The same goes for any job. Please read my link about social dumping.
What automatic right do “ordinary” people have to be protected from economic forces?
That’s actually one of the foundations of Europe’s social democracies. The principle of letting market forces fully control society is that of unbridled capitalism that only benefits the happy few.
Society would be a lot better if the “ordinary” people were helped and guided to adapt to the changing world rather than inflamed …
Which is not happening, and which Trump and the Brexiteers took massive advantage of. One of the most important lessons learned in 2016 really should be that you cannot just ignore the concerns of ordinary people or scorn them for being idiots (like Shillary did) cause in the end it will jump up and bite you in the *ss. That’s actually how communism originated in the late 19th century.
Many are righteously concerned about the consequences of globalisation and have not forgotten about how the 2008 financial crisis ruined millions while the sharks that caused it got bailed out with taxpayers money then walked away free. Nothing draws more bad blood than the real or perceived feeling of injustice and political leaders no longer listening.
thesaucymugwump • December 31, 2016 2:12 PM
“the US tried to negate the ICCPR’s legal force”
It didn’t try; it succeeded. You do not understand the part about how “the Covenant will not create a private cause of action in U.S. Courts.” In other words, it’s not binding upon the U.S. It had a friend in Barack Obama, but he’s going to leave the world stage now, with only liberals continuing to pay attention to him. The ICCPR died in the same way the League of Nations did, because the Senate did not support it.
“it sounds like you haven’t watched any of the subsequent reviews”
The law is not based on Internet reviews; postings on Reddit and other biased websites are not relevant. It’s a combination of primary law (statutes), court decisions which can establish precedent, and secondary law (the Code of Hammurabi is not included here), not to mention that whole separation of government into executive, legislative, and judicial branches.
One amusing thing about partisan politics is that both sides are exactly the same, but they have different heroes. Lefties like you claim that the Dulles Brothers and Prescott Bush ruined the country, while righties claim that the country ceased to exist with Lincoln’s actions, with part II occurring during FDR. Speaking of Lincoln, do you know that he was first elected with a population percentage of only 39.8%, but was sent to Washington because he earned more electoral votes than all of his competitors combined? Not my president, indeed.
As for “antiquarian curiosity time,” the Constitution is the only thing that prevents a state from declaring [insert group here] to be mentally ill and devoid of all rights. It’s very much relevant today.
albert • December 31, 2016 2:28 PM
@Clive,
Don’t forget, squid are food for other species. Overfishing any species on an industrial scale will eventually lead to problems, some of which are unforeseen. So, say we ‘run out of’ squid. What happens then? Well, we just move to the next suitable species, rinse, and repeat.
‘Predator’ species concern us, only to the degree that they interfere with -our- activities. It’s amazing, yet disheartening, that a minor mammalian species can wreak so much destruction on this planet.
.
@Everyone re: Gov’t improper payments,
So my question is this: What percentage of this $137 billion are uncorrected, that is, non-recovered over-payments? 1%, 10%, 50%…? Would not the yearly audits adjust the amounts year-to-year? If so, then what accounts for the “over 1 trillion dollars” total since 2004? I know lots of folks are trying to get on the Golden Teat, but this is ridiculous.
.
Time to take a breath and review 2016. Sorry, Ole Blue Eyes, is wasn’t a very good year. The World As We Know It is still heading towards an abyss, or perhaps more accurately, spinning down a whirlpool. Just when I think things can’t get any worse, what happens? They get worse. Business is bad for the Futurists.
Does everyone have their New Years Resolution list handy? Good. How about a New Years Wishlist?
In no particular order, I wish:
Happy New Year to you all, and to all a Good Night.
. .. . .. — ….
Pammbam • December 31, 2016 3:23 PM
‘You do not understand’
Well, Yoda, perhaps you could use your prodigious superior understanding for the benefit of mankind by reconciling the legal nonsense you keep repeating with the Paquete Habana decision, the Charming Betsy canon, the Vienna Convention on the Law of Treaties, or the stated legislative intent (Moynihan, SFRC, 1992, “The treaty is binding.”) That should be fun, because when the HRC points out the contradictions between municipal and international law and the legally void “Ratification Package” kluge that CIA moles in State tacked on, US apparatchiks go ominahominahomina. Because there is no answer. The ratification package is legal bullshit, a fiction foisted on patriotic goobers.
Subsequent reviews. I see. You don’t know what I’m talking about. You would if you knew what was in ICCPR Article 40, but your soaring superior understanding cuts to the crux of the matter by repeating the same catchphrase over and over.
Are you trained as a lawyer? That might be the problem. US legal training is about 84% indoctrination. That might explain why you’re so blissfully unconscious of COG and how it wiped out that quaint separation of powers notion. I don’t suppose you’ve noticed how your legislators grovel for the intelligence agencies they purport to oversee, or how judges get replaced or killed when they step out of line – by admitting evidence or things like that.
No, if you think your constitution still applies, you’re living in a dream world. You live in the United States of COG. But then you are a fantasy fiction writer. Is any of that published?
ностальгия • December 31, 2016 4:05 PM
Does cry-me-a river count?
thesaucymugwump • December 31, 2016 6:21 PM
@Pammbam
My sarcasm regarding reports flew right over your boyish head. The U.S. submitted its 4th periodic report on December 30, 2011.
The ACLU admitted: “Though the government retains the obligation to comply with the ICCPR, one of the RUDs attached by the U.S. Senate is a ‘not self-executing’ Declaration, intended to limit the ability of litigants to sue in court for direct enforcement of the treaty.”
https://www.aclu.org/other/faq-covenant-civil-political-rights-iccpr?redirect=faq-covenant-civil-political-rights-iccpr
ICCPR, PART III, Article 7: “No one shall be subjected to torture or to cruel, inhuman or degrading treatment or punishment.”
If the ICCPR was superior to U.S. law, many people would have been arrested and prosecuted in UN courts after the torture episodes of 2001-2008. But no one was, therefore the treaty is toothless and might as well not exist. And if no one was prosecuted under Saint Barry, no one ever will be.
Your total ignorance of the law means that you live in a fantasy land.
And my fiction at TSM is largely politically incorrect, with publishers therefore being loathe to accept it. I include it there to annoy clueless liberals. I have other fiction under my real name.
JG4 • December 31, 2016 7:13 PM
from my favorite purveyor of doom porn
JG4 • December 31, 2016 7:21 PM
Fake News: Relentless, Predatory FOX
http://market-ticker.org/akcs-www?post=231745
…
Let me remind you that there certainly have been targeted and effective attacks in recent memory allegedly traced to actual state actors. The OPM data heist
is an example of a series of not only massive acts of stupidity inside our government it also illustrated active and intentional covering up of the breach once detected, including lying under oath — which is a crime. Yet the number of people prosecuted for said lying under oath and intentionally covering up said breach, which I remind you included fingerprints of millions of individuals along with detailed background check information related to virtually everyone who has held a security clearance in the last 20 years numbers zero.
There has also been no formal claim of “blame” laid on any foreign actor in this regard, although there certainly is more evidence pointing to who was responsible for that breach than either the DNC’s hack or this laptop incident in Vermont.
This, I remind you, is despite the fact that China claims to have arrested people involved in same.
Yeah.
Folks, we have a major security problem throughout government and private-sector systems ranging down to the mundane such as your car, TV and cellphone. We have agencies of our governmental units along with other critical private sector parties (like power companies) that intentionally and willfully ignore known protocols that are highly effective in preventing such attacks. Among these acts of willful and intentional ignorance include using public email provider accounts or “private” (and poorly constructed) servers (a.k.a. Hillary), allowing corporate and government machines to have installed on them software that has not been vetted, allowing the attachment of external devices without authorization and vetting (e.g. USB drives, etc), continuing to allow the of software that has known security exploits in the field and more. In the OPM case there were multiple critical breaches of security protocol any one of which would have likely been effective in preventing the attack from succeeding. Taken together they would have almost-certainly not only prevented the attack but detected the attempts.
tyr • December 31, 2016 7:59 PM
@all
I’m looking forward to a wonderfilled 2017.
Stocking up on popcorn just in case it happens.
In addition to the litany of what might happen
with trumpery, I’m looking forward to what will
be said after he actually does something besides
jerking everyones chain for the comic effects.
65535 • December 31, 2016 8:19 PM
@ Clive Robinson
“I thought the JAR was a waste of bandwidth as far as the factual information was concerned as it was not possible to discern what was fantasy and what was at best supposition and confused arm waving.” –Clive
I took the time to read the Joint Analysis Report and the White House Press release “Statement by the President on Actions in Response to Russian Malicious Cyber Activity and Harassment” and various news articles.
The attribution is ambiguous and at time working at cross purposes. It reflects poorly on the NSA/FBI.
[Robert M Lee]
“The public is looking for evidence of the attribution, the White House and the DHS/FBI clearly laid out that this report is meant for network defense, and then the entire discussion in the document is on how the DHS/FBI confirms that APT28 and APT29 are RIS groups that compromised a political party. The technical indicators they released later in the report (which we will discuss more below) are in no way related to that attribution though… said more simply: the written portion of the report has little to nothing to do with the intended purpose or the technical data released… page 4… in the report detracts from the confidence because of the interweaving of unrelated data…the list contains campaign/group names such as APT28, APT29, COZYBEAR, Sandworm, Sofacy, and others. This is exactly what you’d want to see although the government’s justification for this assessment is completely lacking (for a better exploration on the topic of naming see Sergio Caltagirone’s blog post here). But as the list progresses it becomes worrisome as the list also contains malware names (HAVEX and BlackEnergy v3 as examples) which are different than campaign names. Campaign names describe a collection of intrusions into one or more victims by the same adversary. Those campaigns can utilize various pieces of malware and sometimes malware is consistent across unrelated campaigns and unrelated actors. It gets worse though when the list includes things such as “Powershell Backdoor”. This is not even a malware family at this point but instead a classification of a capability that can be found in various malware families… Different data types have different confidence levels. If you observe a piece of malware on your network communicating to adversary command and control (C2) servers you would feel confident using that information to find other infections in your network. If someone randomly passed you an IP address without context you might not be sure how best to leverage it or just generally cautious to do so as it might generate alerts of non-malicious nature and waste your time investigating it… The report does not source its data at all. It’s a random collection of information and in that way, is mostly useless… the indicators are IP addresses with a request to network administrators to look for it and in other locations there are IP addresses with just what country it was located in. This information is nearly useless for a few reasons. First, we do not know what data set these indicators belong to (see my previous point, are these IPs for “Sandworm”, “APT28” “Powershell” or what?). Second, many (30%+) of these IP addresses are mostly useless as they are VPS, TOR exit nodes, proxies, and other non-descriptive internet traffic sites (you can use this type of information but not in the way being positioned in the report and not well without additional information such as timestamps). Third, IP addresses as indicators especially when associated with malware or adversary campaigns must contain information around timing. I.e. when were these IP addresses associated with the malware or campaign and when were they in active usage? IP addresses and domains are constantly getting shuffled around the Internet…The CSV does contain information for around 30 malicious files (Figure 5). Unfortunately, all but two have the same problems as the IP addresses in that there isn’t appropriate context as to what most of them are related to and when they were leveraged… All but the two hashes released that state they belong to the OnionDuke family do not contain the appropriate context for defenders to leverage them. Without knowing what campaign they were associated with and when there’s not appropriate information for defenders to investigate these discoveries on their network. They can block the activity (play the equivalent of whack-a-mole) but not leverage it for real defense without considerable effort. Additionally, the report specifically said this was newly declassified information. However, looking the samples in VirusTotal Intelligence (Figure 7) reveals that many of them were already known dating back to April 2016…As an example, they used one name from their “Reported RIS” list (OnionDuke) and thus some of the other samples might be from there as well such as “Powershell Backdoor” which is wholly not descriptive. Either way we don’t know because they left that information out. Also as a general pet peeve, the hashes are sometimes given as MD5, sometimes as SHA1, and sometimes as SHA256. It’s ok to choose whatever standard you want if you’re giving out information but be consistent in the data format… more simply stated: the indicators are not very descriptive and will have a high rate of false positives for defenders that use them. A few of the malware samples are interesting and now have context (OnionDuke) to their use but the majority do not have the required context to make them useful without considerable effort by defenders. Lastly, some of the samples were already known and the government information does not add any value… The report was to detail new tradecraft and techniques used by the RIS and specifically noted that defenders could leverage this to find new tactics and techniques. Except – it doesn’t. The report instead gives a high-level overview of how APT28 and APT29 have been reported to operate which is very generic and similar to many adversary campaigns (Figure 8). The tradecraft and techniques presented specific to the RIS include things such as “using shortened URLs”, “spear phishing”, “lateral movement”, and “escalating privileges” once in the network. This is basically the same set of tactics used across unrelated campaigns for the last decade or more… the DHS/FBI GRIZZLY STEPPE report does not meet its stated intent of helping network defenders and instead choose to focus on a confusing assortment of attribution, non-descriptive indicators, and re-hashed tradecraft. Additionally, the bulk of the report (8 of the 13 pages) is general high level recommendations not descriptive of the RIS threats mentioned and with no linking to what activity would help with what aspect of the technical data covered… It is my opinion and speculation that there were some really good government analysts and operators contributing to this data and then report reviews, leadership approval processes, and sanitation processes stripped out most of the value and left behind a very confusing report trying to cover too much while saying too little.”- Robert M Lee
http://www.robertmlee.org/critiques-of-the-dhsfbis-grizzly-steppe-report/
‘The Obama second administration thus appear to want to make themselves look stupid in just about any way they can…worse it’s an open invitation by Obama to a “Kick my arse contest”, which can be seen by the likes of the UK Theresa May PM sanctioning comment that is “Trump Friendly” and quite Obama administration unfriendly. Thus in effect writing the obituary on the Obama/Cameron “special relationship” as the “silly years”.’-Clive
I hate to say it but, Clive’s statements appear to be on target. I will never truly trust reports from the “US Government” under these conditions. These so called reports are a waste of electrons.
Spooky • December 31, 2016 9:36 PM
Happy 2017, Bruce + all the regulars. You’re entitled to the sweat of your brow; please enjoy the varied fruits of your labor…
Time to ponder another Grolsch, methinks. It’s hard to believe we used to drink this stuff by the rack, back when I was stationed in Bavaria. It’s not bad, though nothing I’ve had beats a local (.DE) batch of frosty Weissbier straight off the tap. A golden, effervescent chariot to heaven pulled by a team of white horses with foamy, hop-scented manes…
You wonder how far we can fall? No worries, my friends. Most of you know how to produce fire and have sufficient intuition to build simple stone and wooden tools. Basic weaving, pottery and basketry can be learned by trial and error. You’re not entirely unfamiliar with the benefits of animal and crop domestication, or the general principles of sanitation. In a nutshell, equipped with nothing more than the contents of your brain, you’d probably rate at least somewhere in the upper Neolithic (~10,000 to 4,000 years BCE). Surviving engineers, scientists and mathematicians could probably haul us back into the 18th or 19th centuries, within 100 to 200 years (depending on resources and coordination). Without complex infrastructure, we might stay at that level for a very, very long time. But that’s as bad as it gets, I think. Besides, most of us now reading this blog will be fertilizing the fields of tomorrow’s subsistence farmers in another five decades. Excelsior!
Cheers,
Spooky
Clive Robinson • December 31, 2016 10:35 PM
@ Albert,
So, say we ‘run out of’ squid. What happens then?
Other squid and wales will die out. That said I was talking about wiping them out in the context of an invading species where they do untold damage to an existing ecosystem. I was not talking about eradication in their normal areas of occupation.
There are two basic problems, man kind is without much doubt having a significant effect on the planet. This is mostly seen in terms of aquaculture not land based systems. If we are not carefull we could do something quite drastic such as turn off the Atlantic conveyor, which would make a bad el nenio look tame in comparison. Secondly as such climatic changes occure the environments our current ecosystems are in change as well. IF an ecosystem can not tolerate the change then it has two choices, move or become extinct. The problem is different parts of the same ecosystem have different tolerances and different mobility factors. Thus all current ecosystems in effect get destroyed, or atleast changed beyond recovery. The likes of squid are quite tolerant compared to other species and are likewise more mobile, thus any climatic change is likely to increase their range, especially at the expense of other species.
Whilst it’s a man made problem, man kind appears fresh out of viable ideas of how to deal with it. Throwing science / technology / money at the problem will most likely have little or no effect if mankind carries on regardless to the real cost…
@ 65535,
I hate to say it but, Clive’s statements appear to be on target.
Oh that I wish it were otherwise.
As I was reminded tonight, Obama’s action against the thirty five Russian Diplomats, was less aimed at them than their families and children.
Russian’s in general are not that big on Christmas, and for them it falls on our “twelfth night”. What Russian families do celebrate with gusto is New Year. The Obama action thus was aimed fair and square at being as hurtfull against the innocent families especially the children.
People not familiar with Russian traditions were puzzled at Putin’s invitation to the American diplomat’s families and especially their children to come to the Kremlin over New Year, with some even seeing it for a trap.
Obama has made a very grave error of judgment, in that the Russian’s will remember him as a dispoiler of families and their children, not as a Nobel Peace Prize recipient, and that will be a legacy that will long out last him, and will potentially poison not just longterm US relations with Russia but also NATO relations with most of Eastern Europe. Which in turn has the potential to poison relations with the rest of continental Europe. Which leaves the UK which will soon not be part of Europe, which will in all probability make US-EU relations even worse, and have the effect of pushing the EU into closer ties with Russia.
But as they say “You make your bed and you lay in it”…
Thoth • December 31, 2016 10:59 PM
@all
Happy 2017.
Let’s hope Trump isn’t as badbas we imagine but hey, it’s just a hope ain’t it ?
We still gotta anticipate that using political means to improve the ITSec and industry would simply fail like all the other attempts.
We still have to work towards each of our own responsibility for our own personal security.
@Figureitout, Nick P, Dirk Praet, ab
Besides my usual GroggyBox, I would like to announce mt increased push for using secure element with embedded secure input and display and my efforts is to formalize an open source and open environment to make developing for these next generation pocket HSM devices with secure display and input easier across all platforms of pocket HSM devices (i.e. Ledger devices) by literally code once and display almost everywhere.
The specifics will be published on my website when I have formalized something. This push will also benefit Groggybox in an attempt to make Groggybox run on pocket HSMs that incorporate secure display and input like the Ledger.
I am working with some hardware manufacturers to create sample pocket HSMs and also in constant contact with the Ledger team to enable easy development of such secure devices while also trying to keep the specs and implementations as open source as possible and obviously yo promote this platform specs I have created to be opened to public for free use.
Thoth • December 31, 2016 11:19 PM
@all
The connected and recorded future is indeed a terrible tool if misused. Imagine you buy a train ticket to enter your metro and since most tickets contain wireless RFID technology, you are effectively tracked in the train station. The IP enabled security cameras can work in tandem with the RFID tracking ticket you purchased for the single or multiple trips. If you use credit or debit cards to pay for the train tickets, you provide a personal information including your name, face, address, contact, bank account information and a ton of other details to the transit provider that can be tagged to the wireless capable ticket you purchased and this is already a reality.
Also, make it a point not to browser or use your phones for personal or sensitive stuff within the range of cameras as they may peek over your shoulders and grab your screens and if that’s tagged to you and your ticket, it is literally an information boon for the powers that be.
Link: http://www.secureidnews.com/news-item/adding-even-more-value-to-video-surveillance/
And • January 1, 2017 1:00 AM
Let’s hope Trump isn’t as badbas we imagine but hey, it’s just a hope ain’t it ?
Change too! 😉
Jennifer Gold, Stockholm • January 1, 2017 3:49 AM
OT
@ Clive Robinson
very sad to hear of your experience on the receiving end of a karate lout. Thank you for sharing.
it is not a surprise to me to hear of those particular professionals inability to offer you much remedy
Cranial Sacral Therapy (CST, aka Cranial Sacral Balancing) works to relieve stress and compresion in the cranial sacral membrane which is an extremely deep seated fluid in dynamic motion between the, you guessed it, cranium and sacrum.
It’s health or lack thereof affects every single part of the tissue and organism.
This therapy can have extroardinary results in treating and curing a really wide range of ailments including great success with head injuries, PTSD and major depression (these particular ones are known to benefit and I single them out because they are pertinent)
Osteopaths train in and practice CST as a component in their overall approach.
They use whats known as ‘structural’ CST. There are other practitioners whom are trained solely and purely in CST and they use whats known as ‘dynamic’ CST
My understanding is that the latter style of practitioner and practice is going to support you the most.
There will be an accredited national body in england of which such practitioners belong to, so you’ll no doubt find plenty in Londoninium.
Can you please give it a try? This is a formal request! Please? I really think you’ll be quietly impressed
Getting back on topic (although your well being IS very much on topic as we all will agree here!!)
a seperate, interesting question others here may appreciate also.
What was/is your take on the so called millenium bug. Which predates this blog. Was it simply the most successful swindle of the 20th century?
JG4 • January 1, 2017 8:37 AM
here’s a gem for the sociopath/psychopath compendium. no mention of narcissism
http://www.ribbonfarm.com/2016/05/05/dares-costly-signals-and-psychopaths/
I realized this morning that a large number of tradespaces can be recast as security problems, by something like transposition of variables. Securing a building or computer against entry is just another tradespace in conflicts of interest.
Can’t recall if I’ve remembered to call bullshit on the NRA’s mantra that “the only thing that can stop a bad guy with a gun is a good guy with a gun,” but some people in Istanbul are wishing that their relatives had been in a smarter building. There is a business opportunity in the US and US-influenced areas for smart buildings that can prevent these tragic events. This is just another tradespace, albeit an expensive one.
Gunman Kills at Least 39 People in Istanbul Nightclub Attack Bloomberg
https://www.bloomberg.com/news/articles/2017-01-01/at-least-35-people-killed-by-gunman-in-istanbul-nightclub-attack
Happy New Year
Zakharias • January 1, 2017 9:15 AM
Manifesto for really secure Crypto
1. Assume that Eve is always in the line between Alice and Bob
2. Assume that Eve is already in the line before communication starts.
3. Assume that Eve has any capability on pretending identity and sniffing/archiving and manipulating communication data over the line.
4. Assume that Eve has complete realtime access to any previous communication data over the line.
5. Assume that Eve has developed or approved all other available crypto fitting her needs.
6. Assume that Eve never let secure crypto happen, instead lulling users into false security.
Manufactured News Agenda • January 1, 2017 9:17 AM
Always several steps ahead, Amazon’s CEO and founder Jeff Bezos bought the influential Washington Post in 2014. Since then, the paper has increased profits and its workforce while undertaking important investigative work to keep Trump and others in line — Financial Post Canada
More than Fake News
The Washington Post in in cahoots with those who oppose the new President. The daily stream of planted, distorted and manufactured ‘news’ is too obvious.
The current example of the so-called Russian malware on a power company laptop (fear of losing electricity in the frigid winter) can hardly be believed. This follows many previous examples, all meant to throw roadblocks and weaken Trump by a thousand cuts.
I really like Amazon shopping and understand Mr. Bezos concerns. However his actions further erode the credibility and trust of the establishment press. What are the unintended consequences?
Clive Robinson • January 1, 2017 10:11 AM
@ Jennifer Gold,
What was/is your take on the so called millenium bug. Which predates this blog. Was it simply the most successful swindle of the 20th century?
It would appear that some are still not learning from the ins and outs of the Y2K lessons,
https://www.cloudflarestatus.com/incidents/1fczgjmknplp
As for Y2K it was a known issue back in the late 1950’s and was being written about in the ACM journal in 1962. So it’s not as if it was an unknown problem, that could have been fixed at any point from then on. Some organisations did it early on and experienced little cost or inconvenience. Others however took a very short term view and did nothing untill the last possible moment, when skilked labour shortages had pushed the workers earning potential into what to some appeared to be extortion values. But in reality was just the consequence of the “free market” at work with the old “supply and demand” equation in action, thus entirely predictable. Oh and it will happen again with the Unix Epoch roll over if people don’t do things in a timely way. Technical debt always tends to worse with time…
I will look into CST a bit further.
@ 65535 and others,
You might find this of interest,
https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/
Short summery “it could have been anyone based on JAR document”.
CallMeLateForSupper • January 1, 2017 10:13 AM
@Wael
“I am not sure if the last two are in the correct order, but that’s the way I heard it.”
What you heard also works. 🙂
Dirk Praet • January 1, 2017 10:26 AM
@ Thoth
This push will also benefit Groggybox in an attempt to make Groggybox run on pocket HSMs that incorporate secure display and input like the Ledger.
I like the sound of that. Keep up the good work!
65535 • January 1, 2017 11:11 AM
@ Clive Robinson
“I was reminded tonight, Obama’s action against the thirty five Russian Diplomats, was less aimed at them than their families and children… for them it falls on our “twelfth night”. What Russian families do celebrate with gusto is New Year. The Obama action thus was aimed fair and square at being as hurtful against the innocent families especially the children.”
If you are correct, Obama is petty, abusive child attacker – the very thing his wife is against.
Apparently, Obama is ineffective and spiteful. Obama is turning out to be a big disappointment for me.
New Years Humor • January 1, 2017 11:21 AM
To start off the new year correctly here are two computer security items that will make your head spin.
(1) Customer posts negative review of company’s product. Company tells user to download a patch that will fix the problem. Customer downloads the patch only to have it brick his device. Company: that was intentional, you asshole!
Talk about malware….
(2) Librarians steal man’s identity in order to create fake account to check out books, thereby inflating circulation numbers which increase revenue to library.
http://www.sacbee.com/news/nation-world/national/article123981394.html
65535 • January 1, 2017 11:29 AM
@ Thoth
“The connected and recorded future is indeed a terrible tool if misused. Imagine you buy a train ticket to enter your metro and since most tickets contain wireless RFID technology, you are effectively tracked in the train station. The IP enabled security cameras can work in tandem with the RFID tracking ticket you purchased for the single or multiple trips. If you use credit or debit cards to pay for the train tickets, you provide a personal information including your name, face, address, contact, bank account information…”
That is a huge problem. Suppose you were a political critic of a power individual. His security forces would know where you were, what you looked like and the best place to abduct you for some agency cold drop. A group of men could work you over or waterboard and dump in some alley. The possibilities are very real and unpleasant.
It the States we have a national ID number [social security number] which serves the same anchor ID purpose for your train, airplane, bus trips, and banking. Most travel transactions start with a credit card attached to a bank purchase [this goes back to the Social Security ID number]. With this anchor ID it could be used by a tyrant to intern huge groups of people with ease – not to mention assignation.
It is also used by criminals for credit card skimming and other “opening of lines of credit” the the holder’s name. The SSID number has painted a target on the backs of most citizens in the States – “Skim my credit card!” My SSID is well known through out the numerous data bases in the world.
Pammbam • January 1, 2017 11:51 AM
@saucymugwump, Oh I’m sorry. I did not recognize your mot as sarcasm. I always thought sarcasm was funny. Live and learn! By the way, what is a liberal? I hear a lot about them.
Guess you’re gonna take a ball on reconciling your unsupported assertion with the relevant law cited at 3:23. Thank you for sparing my feelings and not hitting it out of the park with facts and logic.
My total ignorance was not alleviated by your subsequent assertion, because I hear it a lot: if somebody breaks a law and gets away with it, that proves the law’s not real. After all, Michael Jackson proved child-rape law’s not real and OJ proved murder law’s not real, Right? Maybe – all the statists seem to think so.
I did not mean to make you defensive about the dubious success of your literary career. Who published your other fiction under your actual name? A Random House imprint? One of the Holtzbrinck houses? Who is your agent? I shall read it with great interest.
Oh, and as any actual published author will tell you, if an editor tells you it’s loath, not loathe, try not to get too ego-involved. This is not to imply that you are some kind of thin-skinned schizoid isolate obsessed with being smarter than everybody else, even regarding things you don’t know much about, or anything. But I can’t help but notice you spend an awful lot of time writing Cliff Notes for the future generations of students who will be reading your oeuvre in their world literature classes.
Nick P • January 1, 2017 12:07 PM
@ Spooky, Ratio, Thoth
Happy New Year! And to all a healthy, secure, and private 2017!
(Random person in audience: “You know that dumbass wasn’t skimping on the alcohol this year…”)
ab praeceptis • January 1, 2017 12:33 PM
Thoth
I’ll follow that with interest.
@All
Happy new year.
Maybe after Jan 20 we can even succeed to return being a blog community that is mainly about (IT) security like in the good old times ™. That’s what I’m here for.
Hollerith Amt • January 1, 2017 1:10 PM
ab preceptis wants to be the scope police but no real professional is going to restrict his attention to a concept of security that ignores what security is for. He seems to have decided for us that security is for computers. Period. But if security is for humans, as the Torproject and others have concluded, then there’s no avoiding the icky ethical matters of what to do.
Andy • January 1, 2017 1:28 PM
The university of Colorado released a paper titled “what is bad on earth might be good on Mars”, the researcher was leng sin.
The abstracts
“The internal fluctuations of society’s to other country’s we conclude are based on a variable we call perceptive loss of strength, it related to comfort zone.”
The paper went on a side track, how globally warming the Earth would be a good thing o Mars.
ab praeceptis • January 1, 2017 1:28 PM
Hollerith Amt
Cut the bullshit.
Of course ethical, social, and political issues (and the occasional fun) are and should be part of our disussions.
But the core and the major part should be about (IT) security.
Being at that: In my understanding certain people here acting with diverse and changing names sully and poison this comment section.
Andy • January 1, 2017 1:46 PM
@ ad preaceptis
I normal don’t pick fights, only if needed but convert the social to silicon in theory, to devolpe a better physical
Hollerith Amt • January 1, 2017 2:11 PM
Cut the bullshit, sully and poison, should be about… Every community needs an Altemeyer Right-Wing Authoritarian!
You shouldn’t try to restrict the scope of everybody’s discussion by barking feckless orders at people. Even if you were in charge, which you’re not, you cannot reasonably confine the scope to anything much narrower than, say, the material below:
And even that’s probably too narrow. For instance, the diverse and changing names you think sully and poison everything cannot be evaluated without reference to an adequate and comprehensive standard, perhaps item 8(e) of the linked principles. But reasonable people still disagree.
When people argue about those principles, it shows there’s no consensus. Sorry if that breaks Raymond’s coffee-maker, but narrow technical issues cannot be resolved without clarity of purpose and objectives. And if you know what you’re doing, that’s going to take you all the way back to Kant.
Boris • January 1, 2017 2:13 PM
Trump warns to not use email for important messages:
http://www.nu.nl/internet/4372972/trump-roept-amerikanen-belangrijke-berichten-niet-e-mailen.html
Clive Robinson • January 1, 2017 2:28 PM
It would appear that we have survived the annual roll over on our computer systems relatively unscathed even with that extra leap second 😉
So now we can sit back and settle into a new Prime Year and await interesting stories and events from the entire computing stack (including the odd level 10 and above 😉
Hopefully you have all made your New Year Resolutions such as to ditch the high flab diet of Micro$haft auto-updates and not to get to peeved by your other halfs use of their smart phone to Face Crook their latest Candi Slush scores or pictures of the cat looking evil as it tries to make it’s self more comfortable on you as you have a siesta after manfully demolishing a plate of sunday roast with extra tats etc.
But most of all try to enjoy the ride through to 2018 with serenity, good humour and acceptance that we are not perfect thus err from time to time, thus try not to make nasty comments about the ref when he decides against our team.
A Happy and Prosperous New Year to you all and may you have many more of them.
Gerard van Vooren • January 1, 2017 2:39 PM
Happy new year guys!
@ ad preaceptis,
Here is my advice: Just let the flames happen. The moment that Bruce posts controversial material they come and after a short while they silently disappear. If you engage in the flame wars it will only cost you a lot of time… and for the rest a load of OT more to read. And, there is nothing to gain really. People have different opinions, agendas, and ways of expressing themselves. That’s it really. You are the one who decides whether to react or not, just think about the likely consequences before you press the submit button.
My 20 Euro advice (hey, it’s 2017!). You are welcome to donate that money to any NGO of your choice 😉
Clive Robinson • January 1, 2017 2:53 PM
@ Boris,
The article you link to is not in English 😉 but it appears to be based on,
Which is in English.
When you slice of the journalist fat his comments are actually what we already know and talk about here.
That is consumer level computers can not be said to be secure even against curious pre-teens. They are certainly very far from secure when connected to the Internet, and if you need some secrecy in your communications, which the law often requires you would be advised to courier documents.
So yes what he is saying makes a lot of sense for ordinary people who have no chance when it comes to computer security on the computers they are going to see in their everyday lives.
Also even the US Military and Diplomatic ligations use “couriers” to move around high security information such as KeyMat. The fact those couriers uniforms are not brown or red and yellow and they carry some interesting weaponry does not make them any the less couriers.
Bong-Smoking Primitive Monkey-Brained Spook • January 1, 2017 3:09 PM
@Clive Robinson, @Boris,
When asked what Trump knows that other people don’t know, Trump responded, “You’ll find out on Tuesday or Wednesday.”
I can’t wait to hear about it! My prediction is he’ll take an excerpt out of the comments section here 🙂
Clive Robinson • January 1, 2017 3:29 PM
@ Bong & Co,
My prediction is he’ll [Trump] take an excerpt out of the comments section here 🙂
I have so often seen my words here and the ideas behind them appear elsewhere without attribution or the modest payment I ask, it would not surprise me if the were vocalised by a US President…
Oh and before anyone asks I care not what the stripe or colour of their politics are if they use my words and ideas for the betterment of my fellow man. After all when it comes to floating everybodies boat, do you care if the water is crystal clear from a mountain glacier, the blueish green of the briney sea, or turgid brown of lowland run off?
Clive Robinson • January 1, 2017 3:46 PM
@ Boris and others,
If you think @Bong-Smoking… Is joking with,
My prediction is he’ll take an excerpt out of the comments section here 🙂
Compare “The Hill” report with,
https://www.schneier.com/blog/archives/2016/09/periscope_atm_s.html#c6734572
And play a game of “spot the difference”.
Wael • January 1, 2017 3:46 PM
@Clive Robinson,
I have so often seen my words here and the ideas behind them appear elsewhere without attribution
That’s because attribution is a very hard thing 🙂
Wael • January 1, 2017 4:05 PM
@Clive Robinson,
I have so often seen my words here and the ideas behind them appear elsewhere without attribution
I can relate worse things. How about ideas I share with colleagues that end up as patents without my name on them, knowing that the idea is almost exclusively mine? It happens in the industry, too. Lack of integrity is more common than one would hope.
Doesn’t bother me much, though! Who would want their name to appear next to these sort of individuals’?
Clive Robinson • January 1, 2017 4:12 PM
@ Wael,
That’s because attribution is a very hard thing
That as my son says “Is another one of my memes” 😉
He has just googled some other of my words and found they pop up all over the place and said “Dad you are turning into the sum of your Internet memes”… Not sure if he’s being rude or not, so “I clipped his ear” just in case 0:)
So a new meme “Never give a lippy teenager the benifit of the doubt, just give them a clout” and we will see how long it is before that pops up on “Mums net” / “Free range kids” or some other OMG “Shock Horror” “Think of the children” site to be attacked by the latest crop of “Social Justice Wanabee’s 😉
@Wael,
Loose lips sync ships,
Privacy is a large aspect of security where technologies can be repurposed against man.
Wael • January 1, 2017 4:38 PM
@Clive Robinson,
Is another one of my memes
These are my two favorite Clive Robinson’s memes:
And
May your 2017 have equaly clever “memes” 🙂
Ofc, I suppose the Nanny state fits that bill well.
Ah well, no body no evidence.
And, there’s definitely no evidence now is there?
Wael • January 1, 2017 4:47 PM
@r,
Loose lips sync ships
Blockquote something so I understand the context, gangesta! We’re all in the same ship, and we’re all seasick!
I was reinforcing your statement with a comment reflecting my own stance, researches are prone to neglecting citation just like your average urchin is prone to the more accurate term of thievery.
It happens.
Attribution isn’t just hard, it’s often brushed off where a simply thank you would suffice.
rspamd • January 1, 2017 4:57 PM
So, in sum
Attribution is hard.
E.g. swallowing the lump in some code cutters throats and saying thank you is an impossible thing to ask.
Clive Robinson • January 1, 2017 5:16 PM
@ Wael,
How about ideas I share with colleagues that end up as patents without my name on them, knowing that the idea is almost exclusively mine?
Yup that’s happened to me, the usuall excuse you hear when you challenge the boss is “but they did the research, you didn’t”, to which the reply “I’d already done it some time ago, how do you think I knew that it would work, it’s called prior art and experience” just starts further argument. But you notice how the boss always gets his name on the patent?..
But it does have it’s funny side if you care to stick a spoke in the wheel of nepotism.
I had come up with a very simple idea to solve a major problem to do with battery powered MCU equipment. Rather than submit it through the boss and have it stolen yet again, I wrote it up correctly as a patent with all the claims etc and attached copies of all the research and IP search etc and left it on the corporate lawyers desk when I happened to be in their office for some other reason. When the boss found out he went totaly orbital and did everything he could to stop a patent application being made.
I left the company prior to them finally getting around to submitting the application, by which time the idea had become mysteriously published in a trade journal in the Far East. As a result no patent could be granted and the idea is in just about every cordless and mobile phone made since then…
Funny how Prior Art pops up in the most unlikely of places, at the most inconvenient of times. The idea it’s self might have been worth a fair amount in the hands of a patent troll, if they asked for $1 on each mobile phone made…
Wael • January 1, 2017 5:46 PM
@Clive Robinson,
Yup that’s happened to me
More common than I thought, then! What I experienced over the years is a lot worse. Obviously I can’t talk about it here. But I can say a thing or two: at one point in my life, part of my job was to act as a “Patent Strategist”, which meant that all patents for the division had to go through me for approval. I made it clear that I will help the applicants technically and otherwise, including adding other ideas to their patents. But I insisted on one condition: my name cannot be on the patent no matter how much I contribute. Some of them said, but your contribution is significant, and my answer was always: it’s your idea, the important thing is identifying the problem and asking the right questions; answers can always be looked up.
I can’t tell you the worst parts, though. Some people really need to go to prison for what they did. And these include scumbags that invalidated the patents and shared them with startups (outsider friends, and such) to implement and sell back to others. Still that’s not the worst, but I can’t and shouldn’t say more.
rspamd • January 1, 2017 5:56 PM
@Wael, All
Outside of this forum (which btw qualifies in the technical face of copyright (I don’t see any particular comments as to the ownership of our fellow patron’s many various patronizations in sed disclaimer)) and within the United States at least: prior art can be accomplished by jotting things down and SASE’n yourself for an official blottermark.
There’s standing in receipt.
Not Sherlock Homes Today • January 1, 2017 6:03 PM
Bong-Smoking Primitive Monkey-Brained Spook said:
“I can’t wait to hear about it! My prediction is he’ll take an excerpt out of the comments section here”
Maybe you know. Solve the below Jeopardy word. The rest of you guys already failed the (double meaning) national intelligence test.
An extremely powerful, disruptive solution was offered a few days ago. The clues are in front of you and yet the code breakers can’t see it.
At least Clive implied that Trump was intelligent for use of couriers and not trusting computers.
Who remembers when a newly Snowden-made-aware Putin said the Kremlin should revert to manual typewriters?
P******r
Is Trump is smarter than you guys? He readily admits what he doesn’t know and then delegates it to the experts that do. Most impressive.
My apologies to our host for going from 256 bit AES to Jeopardy (but its too much fun)
Wael • January 1, 2017 6:05 PM
@rspamd,
In the United States, the one who files with USPTO first owns the parent. As far as I know, prior art can’t be unpatented or unpublished material. It can’t be something obvious to someone skilled in the art, either!
A note of the idea on a notebook or such will not help you. Not sure about ideas published on blogs such as this one. A patent attorney would probably (definitely) have more accurate answers.
Nick P • January 1, 2017 6:06 PM
In a testing discussion, I did another quick lookup of tools for test-case generation as I believe it’s one of the low-hanging fruit for QA. I had heard of KLEE before but not that it was being applied to FOSS with good results. The introductory paper has impressive results in the abstract with one gem that would be jaw-dropping if I still believed in many eyeballs pseudo-argument:
“We used KLEE to thoroughly check all 89 stand-alone programs in the GNU COREUTILS utility suite, which form the core user-level environment installed on millions of Unix systems, and arguably are the single most heavily tested set of open-source programs in existence. KLEE-generated tests achieve high line coverage — on average over 90% per tool (median: over 94%) — and significantly beat the coverage of the developers’ own hand-written test suite. When we did the same for 75 equivalent tools in the BUSYBOX embedded system suite, results were even better, including 100% coverage on 31 of them. We also used KLEE as a bug finding tool, applying it to 452 applications (over 430K total lines of code), where it found 56 serious bugs, including three in COREUTILS that had been missed for over 15 years. Finally, we used KLEE to crosscheck purportedly identical BUSYBOX and COREUTILS utilities, finding functional correctness errors and a myriad of inconsistencies.”
Lets all have a moment of silence for the QA of the COREUTILS team. To be fair, I’d like to see a similar tool aimed at KLEE. Throw their shit right back at them. Haha.
@Wael,
Copyright doesn’t help patents?
That sucks. And here I was worried about development waivers and non-compete clauses.
Thanks for correcting me.
Nick P • January 1, 2017 6:14 PM
I usually go through the publications list of any group behind a good tool. Find a lot of good stuff that way. Same group behind KLEE came up with Execution Synthesis technique for automated debugging. You feed it a coredump from a bug report along with the problem. It gives you the sequence of steps needed to reproduce the bug. It has limits but already found concurrency issues in a few tools (including SQLite). Even a little bit of automatically solving bug reports is pretty badass, eh?
Wael • January 1, 2017 6:19 PM
@r,
Copyright doesn’t help patents?
Two different things. Check with an attorney and don’t take my words, it’s not my area of expertise.
Nick P • January 1, 2017 6:40 PM
@ Wael
“Copyright doesn’t help patents?” (r)
“Two different things. Check with an attorney and don’t take my words, it’s not my area of expertise.” (Wael)
It shows: you published his text without first getting a copyright license. Your criminal act puts you and your bank account in perilous situaiton should “r” decide to seek remedial or punitive damages. Whereas I’m publishing both of you’s quotes as an act of civil disobedience against the corrupt, copyright system. So, it’s A Good Thing when I do it. 😛
Bong-Smoking Primitive Monkey-Brained Spook • January 1, 2017 6:45 PM
@Not Sherlock Homes Today,
Solve the below Jeopardy word
What’s the category? Do asterisks represent the number of characters?
I haven’t the slightest clue, but: The game is aphoot 🙂
Wael • January 1, 2017 6:50 PM
@Nick P,
Your criminal act puts you and your bank account
More power to you! My bank account has a negative balance until my next paycheck comes 😉
Gibs • January 1, 2017 7:01 PM
We like negative balances.
Bong-Smoking Primitive Monkey-Brained Spook • January 1, 2017 7:20 PM
@Gibs,
We like negative balances.
You don’t say! Keep offshoring our jobs then…
Thoth • January 1, 2017 7:36 PM
@65535
In Singapore, we have a plastic IC card we MUST card on person at all times and we have an NRIC number attach to us via the card and ALL transactions be it Governmental, Banking or even illegal loaning services requires the knowledge of the NRIC number at the very least. The number is so easily available and few bother to do anything to protect their NRIC numbers, it is easy to steal identity. The reason we have low rate of crime is because we are too busy worried about legal consequences and due to the fact we are brought up as timid “mice” since young due to “National Education” curriculum.
@ Nick P
re: Moment of silence for COREUTILS team
I doubt many would be interested in the correctness of the working of their applications. Most of them prefer to quickly write something that seemingly works and then patch it later on. In fact, few ever do fuzz testing and the norm is no assurance stuff that has flooded the market since the birth of computing.
Some might argue that they are “not the military/govt” folks and don’t need all that security and claim security is paranoia (a.k.a Johnny doesn’t care to secure/Nothing to hide) dilemma and then on the other hand, a bunch of people try to “secure everything” and inevitably uses Linux and Coreutils as part of their TCB for some reason that may include marketing or lack of choice thereof. Insecurity is like a virus that travels down the chain embedding itself deeply and firmly.
One good example of security philosophy fails is the name that shalt not be named who created Linux and not only shalt not be named but shalt not be stepped upon otherwise inciting flame wars and fanboi verbal and probably even electronic bashings. Because of this particular system being created and the resulting cult it creates around it and the personas, it leads to even more security fails because it carries a culture of “Nobody cares about security” in it’s culture until someone decides that enough is enough and decides to do something (although without much significant improvement at the end of the day).
We don’t have a viable solution to replacing Linux because “it is too big to fail”. Why “too big to fail” ? All the banks, corporates, data centers … it’s the NEXT M1CR0$0fT. It’s the next W1nD0W5 XP. It has a big market share and compare it to the market share of microkernels and all that sort of high assurance jazz we hyped up about all these while, it is not going to go mainstream until someone in that sector decides to take it seriously into marketing it to the world otherwise without cash and resources, it is going to be that niche market reserved for the Govt//IC//MIL.
Sirrix ain’t selling it’s Trusted Desktop to anybody and it’s also yet another nail in the coffin for high assurance microkernel as that’s one of the best way to get the cash needed to spend on resource and promotion of the use of security enhanced microkernels.
Genode does not effectively have a strong marketing presence and it will always be floating on whatever cash donated or raised from project funds from interested parties in very niche and specialized areas.
Rust is not doing all too well either as like any FOSS project, cash and resources are too limited to do much. Rust also does not take the effort to market itself and so there goes the commercial higher assurance market and thus the drive to push higher security assurance into mainstream.
What is needed to push higher assurance into mainstream is commercial viability. One good example is the Ledger team. They on one hand are building secure element devices with embedded input and display and it’s not only many steps more secure than your meagerly X86 Intel backdoored (I don’t mean that ST31 SE chips have 10000000% no backdoors) that was never designed for security since day 1. The Ledger team were good at driving marketing and also high assurance designs (which I contributed some ideas to them as you know). Too bad Ledger company is focused on secure hardware than those microkernel designs for now though which is needed to keep focus on their security theme of secure hardware with attached secure input and display.
Directions of security enhanced microkernels, microhypervisors and verified code stuff ? Not financially enticing for now and not going to be for most of the industry. Why ? Poor marketing as most of those people are just techies. Stronger marketing is needed to generate revenue to pump them back to R & D but this ain’t happening anytime soon.
Nick P • January 1, 2017 8:20 PM
@ Gibs
Anyone that doubts this can look at how U.S. mitigates national debt with a balanced budget. 😉
@ Thoth
There’s at least separation kernels, compiler-enforced safety, and capability-secure CPU’s that can handle something like Linux right now. More a demand or product development issue at the moment rather than technology. Linus’s bullshit could be countered if an organization with money or large number of FOSS types simply gave a shit. That it isn’t speaks volumes.
Far as Sirrix, what did you mean by that? The sales were extremely restrictive or cost too much? Or they told you no after you said something about pentesting their products?
“Rust is not doing all too well either as like any FOSS project,”
That’s the opposite of the truth. I’ve followed many of the release-oriented posts about Rust on HN and Lobsters. It took a few years to get to usable state. It’s stable. More important, its community is so strong a Rust post drops an avalance of upvotes and comments on discussion sites. It’s actually something that’s impressive and annoying at the same time. Redox has also gotten further than about any community, OS project I’ve seen given it was just a few people doing most of the work. Its lead also quit his job to work on it full time. Meanwhile, there’s already two efforts in CompSci, one done & one ongoing, regarding formal specification or verification of it. Dropbox is already running it in mission-critical stuff with Mozilla planning to do a clean-slate browser with it.
“What is needed to push higher assurance into mainstream is commercial viability. One good example is the Ledger team. ”
This is true.
“Why ? Poor marketing as most of those people are just techies. Stronger marketing is needed to generate revenue to pump them back to R & D but this ain’t happening anytime soon.”
Hit the nail on the head there unfortunately.
Thoth • January 1, 2017 9:11 PM
@Nick P
Re: Rust
OPS …should be Redox. Lol. Yea … Redox is pretty much sleepy.
Re: Sirrix
Just express buying the Trusted Desktop for corporate environments. Did not mention pentesting since that is gonna shoot oneself in the foot.
Re: H/A development.
Was watching 33C3 conference video on Secure Boot for Linux. Wouldn’t it be better to divert resource to using NOVA hypervisor to run RHEL and then let the hypervisor do the Secure Boot instead of QEMU/KVM secure booting which totally makes no sense since the TCB (Linux host + QEMU running a Secure Boot enabled RHEL in the presentation) is roo fat.
Oh wait … the project and employees on the presentation belongs to RHEL so you gotta wave the RHEL flag and smile for the recordings 🙂 . Nothing against RHEL but as usual, poor allocation of resources to less useful areas and then beat one’s drum.
It’s 2017 and we will have another year flying pass quickly where high assurance will almost always be cursed and relegated into the niche market … oh and governed under Crypto & Security regulated export and import controls 🙂 .
There goes another year all wasted.
Thoth • January 1, 2017 9:14 PM
@Nick P
Oh … and forget about Rust if something like getting a TCB simply is beyond reach as a foundation stone. A strong fort always requires a strong foundation but for now, the “strong” foundation is better off using an external secure element device (@Clive Robinson’s favourite comment of using a separate device) since most host computer are hopelessly insecure anyway.
Wael • January 1, 2017 11:59 PM
@Not Sherlock Homes Today,
I’ll take trades for 100, Alex…
Solve the below Jeopardy word. […] An extremely powerful, disruptive solution was offered a few days ago. […] P******r
Jeopardy answers need to be presented as questions, so the answer is:
Who is a Patentor?
Wael • January 2, 2017 1:54 AM
@Buck,
Happy new year, wherever you are bud. Hope all is well with you.
Wael • January 2, 2017 2:05 AM
@Nick P,
Hit the nail on the head there unfortunately.
You mean it would have been fortunate if he missed the nail’s head and banged his thumb into smithereens?
@Dirk Praet,
Please read my link about social dumping.
Eeeeew! You can get a ticket for that!
Ratio • January 2, 2017 3:17 AM
@Wael,
Jeopardy answers need to be presented as questions, so the answer is […]
More options for you:
grep -i '^p......r$' /usr/share/dict/words | sort -R | sed 1q
(First result: panderer.)
Ask and thou shalt receive. • January 2, 2017 3:51 AM
Free 200lb Doe DOA. (now listing (upside down) in the garage/night air)
Free 1800w under-the-counter microwave w brackets. (ours died yesterday) (works)
Free 42″ Magnavox, which now that I’ve went spelunking elbow deep in the television (the deer was earlier) is junk – the morons who cast it aside decided to literally rip the housing containing the power board out of the unit breaking 3 other boards along the way. (not worth fixing)
Either way,
The first day of 2017 is looking to be a wonderful new skein of yarn to play with.
Anyone ever seen a cop pull a knife on somebody? 😉
I had that wonderful opportunity tonight, and I thank him and I really hope he didn’t stain his blues humping the free venison into the back of the truck. (not everyone can be Dirk Praet(?) (Dead lifts anyone?))
Hill. Billy. Heaven.
Btw, I think THE MAN meant palantir.
“The intrigue is strong with this one.”
Clive Robinson • January 2, 2017 3:53 AM
@ Wael, Dirk Praet,
Eeeeew! You can get a ticket for that!
There might also be a “home video” market for it as well… As the old Yorkshire sayings have it “There’s nowt so queer as folk” and “Where there’s muck there’s brass”…
Wael • January 2, 2017 4:37 AM
@Ratio,
grep -i ‘^p……r$’…
I thought of that but went this route, instead:
Search for: 8 character words that start with ‘P’ and end with ‘r’. Looked at them, and this was the only one that fit the context of the current thread discussion, according to my (il)logic.
http://letterword.com/index.php/eight-letter-words-starting-with-p-and-ending-in-r/
The first one is: packager.
Dirk Praet • January 2, 2017 4:38 AM
@ Clive, @ Wael
Eeeeew! You can get a ticket for that!
I think it’s a really well-chosen word indeed, only the sound of which already conveys the absolute shittiness of the practice.
@ ask and thou shalt receive
(not everyone can be Dirk Praet(?) (Dead lifts anyone?))
Unless you’re struggling with back or knee issues, pretty much everyone can learn how to deadlift. And it’s really fun too.
@ Thoth, @ Nick P
Wouldn’t it be better to divert resource to using NOVA hypervisor to run RHEL and then let the hypervisor do the Secure Boot instead of QEMU/KVM secure booting which totally makes no sense since the TCB (Linux host + QEMU running a Secure Boot enabled RHEL in the presentation) is too fat.
I concur. Why is it that outfits like RHEL always seem to prefer to throw a bunch of bloat together instead of going for a minimal solution that does the exact same thing, but with a much smaller attack surface?
Wael • January 2, 2017 4:43 AM
@Ask and thou shalt receive,
Btw, I think THE MAN meant palantir.
But Palantir had no “few days ago” disruptive technology announcements that I saw. It’s one of the listed words, so if he’s fair he’ll give me partial credit… Anyway, who knows what the man wanted!
@Clive Robinson,
Lol…
Wael • January 2, 2017 4:49 AM
@Dirk Praet,
only the sound of which already conveys the absolute…
True! Par for the course with the rest of “privacy practices”.
Unless you’re struggling with back or knee issues…
How about a hernia? Or is that something waiting to happen? 🙂
Need to give the neuron sack some rest now…
Clive Robinson • January 2, 2017 5:48 AM
@ Nick P and others,
There have been various comments made about C over the years as to it’s plus and minus points. Two of which have been “it’s a universal assembler” and “it’s not strongly typed”.
In the case of the first argument there have been various other contenders, the original UCSD P-Code and later Java’s equivalent.
As for the second well there are a number of contenders for “strongly typed” most would be considered sufficiently high level that for many tasks they would not be a contender.
Thus other candidates are looked for. Now a number of people are aware that LLVM is a sort of universal compiler, via front ends that then provide input to the LLVM optomiser. However not as many are aware it is also a sort of universal assembler via it’s Intermediate Representation (IR) code output to processor specific back ends.
I was reminded of this today by the following,
https://idea.popcount.org/2013-07-24-ir-is-better-than-assembly/
That even though written a few years ago poped up on HN.
Clive Robinson • January 2, 2017 6:03 AM
@ Dirk Praet,
Why is it that outfits like RHEL always seem to prefer to throw a bunch of bloat together instead of going for a minimal solution that does the exact same thing, but with a much smaller attack surface?
Well… Do you want the real reason or the official reason?
The official reason usually gets boiled down to that indefinable quality “flexability”, which is used in the same way, lawyers dow with words, chefs with sauces and doctors with dirt, which is to cover up the real truth of the matter.
Amongst other very many “real reasons” are the likes of “Not invented here syndrom”, “hidden control”, “Bl@@dy mindedness” and they infamous “Because we can make your life difficult” and “What yet goner do about it”.
In essence the typical corporate mentality that defies reason and sense to all but those infighting in the walnut corridor in the name of “shareholder value” or “market share”. After all Micro$haft blazed the trail that other corporate wannabes try to emulate.
JG4 • January 2, 2017 7:37 AM
this is a nice analogy to my recent point about smart buildings.
it’s an artificial intelligence problem very much like locking off sections of a school building during a shooting. after enough people accept the fact that their favorite government tracks their position every moment of every day, it becomes feasible to disable vehicles that are estimated to be off-course, for example, in the direction of crowds of holiday revelers.
plenty of interesting news this morning
Wael • January 2, 2017 9:25 AM
@Clive Robinson,
Now a number of people are aware that LLVM is a sort of universal compiler […] I was reminded of this today by the following,
Nice article, but needs further testing as noted by a commenter. I prefer intel’s assembler syntax over AT&T’s.
@Nick P,
Has that day arrived? What possible security issues do you see with LLVM? I never had the time to inspect it.
snur-pele • January 2, 2017 9:45 AM
A device/method to use untrusted input devices for PIN-code input.
If the security module (receptor of the PIN-code) do have a trusted display, then it can use an
untrusted input device, such as the keyboard of a standard pc, to acquire a PIN-code from a user
without revealing information on the PIN-code to the untrusted input device.
To achieve this, the security module generates an n-digit random number on its display, along
with a cursor selecting one of the digits of the random number.
The user uses the (untrusted) input device’s up/down, right/left buttons to modify the random umber shown on the security device’s display. When the displayed number equals the user’s
PIN-code, he acknowledges it with the enter button.
Since the untrusted input device do not know the displayed random number, it cannot by aid of it’s
knowlegde: the number of ups, downs, lefts, rights and the enter, figure out what the PIN-code is.
@Thoth,
You only need a smart card with an integrated display!
(to my knowledge, this is a “new” concept. consider it a christmas gift… )
Example:
The user inserts his Thothcard in an unsecure PC’s smart card slot.
The Thothcard needs a five digit numerical input from its user to unlock it.
Upon power-up, the Thothcard calculates a random number, say 17339 and outputs it on
its display, with the cursor randomly chosen to highlight the “7”.
The user, whose unlock code is 34987, chooses to press right four times. The Thothcard
follows by moving the cursor once for each press. The cursor thus rolls over to the “1”.
The user then presses up twice. The Thothcard display changes to 37339. The user press
right and then down three times. The display changes accordingly: 37339 followed by 36339
and then 35339 and 34339, with each key press.
The user then presses right-down-down-down-down.
On the display this comes out as the sequence: 34339-34239-34139-34039-34939.
(Note the rollover from 1 to 0 to 9)
The user continues with right-up-up-up-up-up-right-down-down-enter, and Thothcard unlocks!
(I believe I can skip details here…)
Note the roll over at all ends of the displayed random number. This and the randomly selected
starting point of the cursor acts to deprive the untrusted input device of information, even
if the card leaks side channel information (eg power use) from the random generator.
With some differences in the setup, it can also be used for anti-shoulder-surfing purposes.
(this is where it started some two decades ago)
Since I do know I lack in ability to clearly explain stuff, comments, analyses and questions
are welcome, though, please use foreign language filtering when reading.
Fact Finding vs. Convenient Interpretation • January 2, 2017 9:46 AM
Can intelligence agencies become a corrupted political tool? Are their claims ever verifiable?
Who has the necessary clearances, access and authority to make an independent evaluation? (Two parties)
The Snowden release documented the NSA giving vast quantities of raw American Internet traffic to Israel to evaluate.
Would Netanyahu luv to prove the administration cooked its intelligence books? (does Putin like Clinton?)
Why were ISIL intelligence reports drastically altered by the general at the US Central Command? Is he still on active duty?
Is there good reason not to trust the Director of National Intelligence (who immediately resigned after the election)?
Do the American people deserve the unclassified Truth and not political spin?
Let the chips fall according to the facts.
With this change in administrations there is a once in a lifetime delicate opportunity to rebuild trust in our government.
Thoth • January 2, 2017 10:16 AM
@snur-pele
This is a very innovative secure input/display method. There are already existing display cards on the market but this method of using a display card is excellent.
The only thing now is typing something longer like a quick short message (i.e. SMS) onto the smart card and then sending it. How about use case would be to create a less than 200 character ASCII message (a-z, A-Z, 0-9 and some basic symbols and whitespace) that can be quickly sent off in a burst as an encrypted short message (i.e. urgent secure messaging – encrypted SOS or status reports) ?
That means a user has to scroll through all the character map combinations to create a short plaintext to burst encrypt and send it ?
You could apply for a US Patent since this is rather nifty stuff 🙂 .
I rarely commend on ideas but this is one of those good stuff in my opinion and it really takes the advantage of the environment and market product availability to push the limits of security and usability.
JG4 • January 2, 2017 10:48 AM
it has not escaped my keen notice that centralization of information required to e.g., disable trucks estimated to be off course, and centralization of authority to e.g., disable vehicles or lock down sections of buildings creates new opportunities for subverting security. this will place an even greater premium on high-assurance networking and computing.
@Wael,
He uppercased the first letter, that’s the only reason why I’m thinking it’s palantir over the others aside from his usual nTRIG[jtrig+w/e].
@Dirk,
Got creamed by a lady who did a rolling stop right through me, I’m still recovering from a ripped tendon in one of my arms. I can only lift so much so far before the whole ‘dead lift’ part of it becomes a Russian Gymnastics competition with how to move without sheering it more.
Clive Robinson • January 2, 2017 11:11 AM
@ Fact Finding…,
Can intelligence agencies become a corrupted political tool? Are their claims ever verifiable?
o and look up the history of the FBI under J Edger Hover. He was without doubt a political black mailer. Likewise look up the history of the Dullas brothers.
@Wael,
Well, that and /disruptive to whom/?
And posted where?
We know that within the last couple days the Palantir link has surfaced because it’s made it’s way here, and somebody made a comment about how the Angelic Trumpettes Inglorious Leader likes to delegate derision making… So, it’s just my wordy interpretation.
There’s usually some sort of running context with him, IF it is Sherlock Helms.
Wael • January 2, 2017 11:27 AM
@r,
Yea, starting to sound more likely palantir is what “Helms” was after.
Nick P • January 2, 2017 11:55 AM
@ Wael
re hammer
Depends on if he gets a big settlement out of his lawsuit against the hammer manufacturer.
@ Clive, Wael
re LLVM
Nothing new to say for now. Still the same product with more front-ends, back-ends, and optimizations. Two, formal semantics exist for it on top of its often-changing IR. One is about verifying equivalence of IR code after an optimization. That combined with a tie-in to the compilation technique used in seL4 could be powerful. One could hand-code robust programs in C, SPARK, or Rust in LLVM bytecode fed through optimizers and compilers with formal correctness its preserves the properties of the source.
Regarding the IR over assembly, it was interesting to see given I proposed that same thing on this blog quite a while ago. I also proposed using it for the inline assembly if it was just about performance.
Honestly, though, the most exciting project for compilers is QBE backend. Small amount of code, minimum optimizations necessary, and clean IR. The guy doing the C front end says it’s already usable enough to compiler his & does the compile four times faster than GCC. He gauges the performance somewhere between 01 and 02. That’s with virtually no code. QBE written in C while his is written in Myrrdin which is moving fast.
Bong-Smoking Primitive Monkey-Brained Spook • January 2, 2017 11:59 AM
@Not Sherlock Homes Today,
Maybe you know.
Maybe I know because I’m a spook? Put it to rest! What’s the correct answer, with explanation.
Dirk Praet • January 2, 2017 1:06 PM
@ Fact Finding vs. Convenient Interpretation, @ Clive
Can intelligence agencies become a corrupted political tool?
Pardon my ignorance, but wasn’t that exactly what they were invented for, i.e. to seek and destroy political opponents ?
Andy • January 2, 2017 1:29 PM
@nickp
A post ages ago about automated checker that want work, one byte can be called ten times, times that by 12 control byte,s min would take year’s to find the answers
Clive Robinson • January 2, 2017 1:32 PM
@ Jennifer Gold,
As you appear to have an interest in time related problems in software, this list may amuse,
http://infiniteundo.com/post/25509354022/more-falsehoods-programmers-believe-about-time-wisdom
Oh and one item that is not on the list and may create all sorts of fun come Brexit…
Britain has a genuine “Time Lord” –and no I do not mean Dr Who– who’s job is to present a varience to English Law to the House of Commons each year. The varience asks the respected members of the house to agree a change in the time and date of British Summer Time (BST).
The reason for the time varience is that Britain does not actually run on Greenwich Mean Time (no civil authority does these days unless they want to be awkward).
It’s all quite complicated, oh and a minute is not 60seconds it can be from -2 to 61 seconds and that’s before you get into relatvistic time you need for Mobile Phone networks and satellite communications…
Oh and the CloudFare leap second issue was apparently due to some one not realising you could have negative time, and thus called a sub that could only take positive numbers…
As I said some people never learn…
My son who studies CompSci at school managed to impress his teacher. They were set a homework to measure the performance of sorting algorithms in Python, and the other students using Win10 machines could not get consistant times, and gave up. I however being the meenie I am would not let him give up… So he got a crash course on debugging, reading manpages, OS theory, and the difference between the way Linux and Microsoft OS interupts work for scheduling and why process elapsed time and wall time are different. I made him write it up and his teacher emailed his mum to say how impressed he was as he would not expect that level of work from A Level students… My son however was not impressed, because his teacher made him tell the class what he had done, which apparently caused his fello students to develope major eye glazing after thirty seconds…
Clive Robinson • January 2, 2017 3:02 PM
@ Bruce,
You realy need to read this,
https://juliareda.eu/2016/12/10-illegal-things/
Julia Reda is “The Pirate EU MP” and she specializes in rooting out poor / bad / corupt Copyright issues. As her above piece points out the proposed EU legislation changes are nasty and put liability on any web site owner that allows contributions from others.
Even Bruce could be in trouble for quoting himself under some of the legislation…
Peter Thiel’s Second Shining Star • January 2, 2017 3:09 PM
Trump said on Saturday that he “[knew] things” about the alleged Russian hack that he would reveal in the coming days.
Spicer said on CNN’s “New Day” that conclusions should not yet be drawn because intel reports about Russia’s involvement are not final.
“For anybody to be going out and talking about what’s in the report – it’s not final yet. And I think the idea that we’re jumping to conclusions before we have a final report … is frankly irresponsible,” Spicer said.”
Could it be a rouge group operating from within the Intelligence community? This scenario would be a first, but many employees are upset. Possible but less likely…
Or, as suggest here take your best software teams working around the clock with massive computing power and performing precision smart queries.
About five days 24 hour days sound right. The results can go between two extremes 1) largely matching the 17 Intelligence agencies or 2) a complete refutation with a massive disruptive consequences
Who else is involved? Several external stakeholders probably want to give their own ‘one-way’ hints and findings, as the President Elect rewards both loyalty and risk taking during critical times.
The more the results differ, the more credibility and mandate Trump gains to implement his drastic change agenda. What’s his favorite phrase?
If the findings are similar then the current administration exits power gracefully to continue fighting another day.
http://www.businessinsider.com/sean-spicer-defends-trumps-claim-to-know-things-about-russian-hacking-on-cnn-2017-1
Nick P • January 2, 2017 3:21 PM
@ Andy
You’re going to have to be more clear because I don’t understand what you meant.
albert • January 2, 2017 5:35 PM
@PTSSS,
“…rouge group…” Operation Red Rose? (Fr. Opération Rose Rouge) Relax, I’m joking. I have the same problem typing. As well, I even type totally different words than what I’m thinking. It’s like Twilight Zone.
.
@CLive, re: EU copyright laws. IANAL, but it looks like y’all may need to get rid of your EU “government” fairly quickly. Terminology vague or undefinable. Throws all liability to content providers. Might eliminate news sites. Search engines are a target (bad); ‘Social media’ sites (Twitter, Facebook) (good). If implemented (correctly of incorrectly; only affects time) might actually reduce content ‘owners’ income considerably, or even put them OOB (good). This says it all: “…In a few days, scandal-prone Günther Oettinger will stop being Europe’s top internet policy maker – he’s being promoted to oversee the EU budget….” – from link cited. God help you all.
“Dullas brothers”? One added ‘s’ and you’d have been there!
.
@Dirk,
“…Pardon my ignorance, but wasn’t that exactly what they were invented for, i.e. to seek and destroy political opponents ?…” – Just one among their many and varied uses. On occasion, have been known to gather useful information.
.
@JG4, et al,
Forget the bandaids; they don’t cure anything, just a waste of time, money, and resources. The cure is to stop generating terrorists. Yes, the simplest cures are almost always difficult to accomplish. Anything can become a business, like terrorism, for example.
.
. .. . .. — ….
@Peter Thiel’s Second Shining Star,
If you think it’s possible to just wash those allegations away with what is likely another politically motivated response to the situation at hand you’re a fool.
Moves have been made that could be construed as isolation and segmentation of the IC community to whether a coming storm, any lack of details that have been disclosed (considering how lack luster the initial report actually is) can be assumed to be an attempt to avoid further damages akin to the stated loss post snowden.
No matter how much you launder and detail the information without absolute full disclosure prior to the finality of the election the smell will never not go away. It may go underground like febreeze (a cover up) but do not expect anyone who remembers the subterfuge around the ramblings of eschelon and DPI to let this smell just disappear.
It will continue to fester and grow, just like the black soviet discovered mold hiding behind your walls waiting for someone to add water.
Now that the trump and russian agenda’s are completely aligned I expect to see large amounts of backpeddling not from them but from others.
If the information doesn’t come out now, which in all fairly reasonable instances already too much has been said then it will never be resolved – it’s like labeling someone a rapist or child molester – his image has been shit on.
Did he do it himself?
Have others helped?
Will others help him?
The answer to the last question is obviously yes, he’s the present elect.
If Russia wants trust, in my very lowly opinion – extradition needs to be put much higher on their list of priorities that it has ever been in their seeded and seedy past to do business with the world of the lawful future or the united states.
I could as always, be wrong.
But at least I push an individual spin and not some groupthink.
staged partyline groupthink at that.
Free thinkers ARE dangerous, and the internet gives you an almost amazonian mechanical turq don’t you think? or do you just aggregate?
Smash and grab • January 2, 2017 6:31 PM
The window of privacy has closed.
There are technologies to peer through walls, both the physical world and very recently the meta too.
Location Location Lo • January 2, 2017 8:28 PM
@Hogan’s Hero,
Also, your “man on the inside” doesn’t impress me.
So the lark our errored tangles spring is impressed by money power and bullying, no matter which side of the isle you sat on during the trial and execution of gawker I don’t see this as an endearing quality.
It explains his vain appeals to input no?
Does he always gravitate towards the closet?
On the low and behold • January 2, 2017 8:37 PM
Believe it or not, that line of questioning actually plays into an argument I was trying to sort through with my wife.
Is the trophy for show?
I mean, if I was a billionaire it would definately be somebody like HRC that was exceptionally well trained at keeping her lid (and pants(potentially)) zipped.
Figureitout • January 2, 2017 8:48 PM
Thoth
–Sounds good. Embedded security and the like will only really get better when there’s money to be made and reputations to be tarnished unfortunately…
pushit • January 2, 2017 8:50 PM
Somebody should get his medical info and publish it, maybe he suffers from lackadasia.
😉
It would certainly clear up this line of speculation.
Where’s the long line of concubines to come forward like they did with Bill?
Do they exist?
Can they be found?
Can they be bought?
Andy • January 2, 2017 9:27 PM
Sorry my bad just getting new year’s in before starting work in a couple of days.
What Nickp wrote about Executions Synthesis and KLEE.
Are you meaning it pin points the bug, coredump and then looks at source code, or are you meaning that it gets a breakpoints, and like Ida debugger tree view but on a whole program scale uses recursion to find the variable D from a,b,c var.
If it’s the latter it would take ten thousands year’s.
?
Side note, quantum computer’s are good at parallel brunch so the turmoil between silicon and Q.
@Andy,
[Admittedly, I haven’t read the KLEE stuff yet]
No, a computer properly trained should be at least reasonably as fast as a researcher.
The reason why IDA is so slow is because it’s pretty printing it for you, if you don’t believe me hook all the GDI/str/hash stuff and convert it to nop’s.
You should see a substantial difference in timing between the initial opening and the “initial analysis complete” – especially if you don’t have to wait for the messaging subsystem or other invarious threads to ketchup.
IDA does waaaay more than would initially be required for what is essentially a ‘hot’ analysis.
Depending on the implementation that means that it could equ an OOP’er or in other cases a Geohot/Bunnie.
I’d think it would use
a) stack trace/coredump
b) in-memory symbols
c) source
It shouldn’t be any slower than the slowest of us, as for FASTER ?
I’d think it could be optimized and trained to be far faster than any of us.
Our parsing abilities do not exceed that of a computer, our intuition does substantially. It often leads to shortcuts and hunches, DL/ML may be bringing hunches to light.
Our training, exceeds computers for the meantime but likely not for long.
We’re going to be taking up the job of a shepherd soon enough.
https://news.ycombinator.com/item?id=13294703
The stack/coredump would be accurate to a point[er], below which 😉 is where the mess would be found.
@Nick P,
GLEE.
KST • January 2, 2017 10:04 PM
@r “extradition needs to be put much higher on their list of priorities,” Wouldn’t do the US any good – Russia has acceded to the Convention Against Torture, so they can’t legally extradite to a state like the US that practices widespread and systematic torture with impunity. And since their choice for serious crimes is extradite or prosecute, it’s just as well for the suspect if Russia does the investigating/prosecuting, because Russia does not interpret ICCPR Article 14 in bad faith like the USA does.
Ever been there? NATO’s anti-Russian propaganda is hilariously false.
@KST,
Fair enough, and thank you for the illumination to my comment.
No, I haven’t and likely after the last couple months I think it’s been completely removed from my safe-list.
If I wanted to avoid extradition I’d be in costa rica without a doubt.
Ignoring rendition, ofc.
rspamd • January 2, 2017 10:21 PM
Oh damn, Costa Rica was on my list previous to all these baby zika witch doctor voodoo heads.
I really burned my bridge there didn’t I?
BEATLE JUICE
I had the opportunity to stay in Epanema, I chose outright to return because in 03 and like now I fully believe that my country needs ME.
KSt • January 2, 2017 10:54 PM
You are most welcome. If you are curious about the actual relative lawlessness of the US and Russia, the world has made it easy to compare authoritative independent evaluations of the US and Russia on a comprehensive and consistent basis.
Inspect the evidence, and you might end up begging Snowden to vouch for you and help you escape the Iron Curtain.
What was pussy riot guilty of again?
https://en.wikipedia.org/wiki/Pussy_riot
https://en.wikipedia.org/wiki/Hooliganism#In_the_Soviet_Union_and_Russia
Oh yeah, essentially encouraging public discourse through unsanctioned means.
Potentially, with the guy from 1979 we could say that ‘public endangerment’ applies, fair enough I suppose.
But why not just fine them, give them 30-90 days and then set them loose to make their money to pay reparations?
https://en.wikipedia.org/wiki/Dead_Kennedys#Frankenchrist_and_obscenity_trial_.281985.E2.80.9386.29
That’s my fav bland banned band, far more dangerous than some anti-theological-support protest.
Which would you rather? Your daughter spill her heart out at a strategic venue or be exposed to INAPPROPRIATE/MATURE art at the age of 9?
Thankfully, despite the distaste in the art selection it resulted in a hung jury.
Thank god for your rights, the freedom to express yourself – even if it sometimes smells like a dog ‘expressing’ himself.
But in all fairness we can’t read a book without our little brother telling mom, so I’ll look.
Pffft, snowden vouch for me.
That’s like asking an unknown to vouch for an unknown.
But again, thank you for illustrating one of the dilemna’s holding us and this world back and I will most definately be checking those links out.
C U Anon • January 2, 2017 11:49 PM
@r,KST:
What was pussy riot guilty of again?
It is easy to throw bricks either way…
E.G. What about,
And the behaviour of the money grubbing Hospital that started it all off?
Andy • January 3, 2017 12:30 AM
Hi am asking a favour , theirs a formula like
F = L*I(sqrd) when the numbers are small like I = 10 it makes sense to increase I, but when I=40000, it makes sense to increase L, by one than I by one.
There’s a lot of formula that use that logic, was wondering if there’s a explanation or a Google search keyword.
Thanks
Andy
Andy • January 3, 2017 12:45 AM
@r
Thanks, I’m thinking of better algorithms than briefer, what I was meaning was
256^5 or
256_5_34_12_1_256
It could have mounted up, but looking at C source would have made it a non issue.
Wael • January 3, 2017 1:32 AM
@Andy,
F = L*I(sqrd) when the numbers are small like I = 10 it makes sense to increase I, but when I=40000, it makes sense to increase L, by one than I by one
Your question is too broad and general. However, it could be a problem of optimization (maximization) or approximation, or regional dominance of one of the variables. In approximation problems, you’ll consider the term with more weight and “safely” ignore the other.
In antenna radiation, for example, the field is divided roughly into near field and far field (I forgot what the equation looks like.) In the near field one term of the equation is more dominant than the other, and vice versa (over simplifying here.) You can apply the same to gravity and force: do I increase the mass or do I increase the distance (the answer will vary as distance and mass change values)? The answer depends on what you’re trying to do.
Depending on the tolerance you can live with, say 1%, you can work backwards and see at what point (L,I) that happens.
Look for approximation and optimization, calculus of variations, and Taylor series. But best is if you go to a math blog and post this question.
Curious • January 3, 2017 3:04 AM
Off topic I guess: Sort of non-news because I don’t know what to think of it.
People on Reddit has apparently pointed out (or tried to), that CNN allegedly used an image stemming from the computer game ‘Fallout’ as a background graphic for a piece of news re. hacking allegations by Russia. The thread only show one image, and I never played that game, so I am none the wiser. It is kind of interesting of this is true, but I just don’t know what to think of it.
I suppose it could be that any graphic in Fallout might perhaps be inspired by some real computer software looking like that.
https://www.reddit.com/r/gaming/comments/5ll62g/cnn_uses_fallout_hacking_footage_to_show_how/
Mum's the word • January 3, 2017 4:21 AM
@Curious,
To answer your question,
Yes that could be a reasonably accurate assessment of the image you linked.
While I can’t verify the image was sourced from the game Fallout I can within certainty claim that that image would be a reasonable facsimile of a ‘hacking’ session within Fallout 3 proper. Visually there’s either pre or post processing applied to the image as it’s a capture and slant of an exhibit but yes – it’s from the third game in the series.
@The, Remainder.
Falsehoods Uncertainty and Deflection are not my cup of tee.
Almost certainly one should be comforted in knowing that the good guys have rode into town to save the day [verily] high atop one of the four horses of the apocalypse.
It’s interesting to me that you actually caught the name of this horse, what was it?
Palantir, you say?
Odd that one should mention that horse for, I know well of the rider.
A cardboard cutout, a shallow facade. A small spiteful little man. Looong in the business of the longest of games. He plays numbers; statistics, analytics and staminaaa.
Autonomous drones because things the that live and breed in the dark learn to listen.
To listen and creep.
You always knew your tv had some fuzz in it didn’t you?
He’s got his ears in the cusp of the little white vans everywhere.
I heard he eats tabloids for breakfast and children for lunch.
@Diner?
He’ll be found in the lap of luxury at the Tower of Babel in downtown Madhatter.
Oh, what strange bedfellows and company we keep.
Is there a reason we have heard nothing of El Chapo’s support either for or against the position of marriage? Did we not just have a national fight of contested recognition?
What about our bathrooms?
Where, does he stand upon that molehill?
It is a molehill right?
So we’re going to move our embassy to Jerusalem and don’t worry Israel it’s real and we’re coming. (again)
If this is what’s happening, what’s the next scourge?
Methcathinone ?
I’m a who’llagain for asking, but:
Is it too riotous for us at this moment?
Too hot a topic to ask?
If the list of women lobbying charges wants to come forward, why not at least embrace the ones that are known unknowns? There are at least 2, it seems like a good move.
What if their existence is a perpetration unto the public eye?
What then?
Is their existence as fabric eye too?
What else has been purpetrated or published that eye might’ve missed?
It stinks to holy high hell in here.
Thoth • January 3, 2017 4:42 AM
@Nick P, ab praeceptis, verifiable & high assurance software stack et. al.
Topics like high assurance and verifiable methods (Frama C, seL4, Orange Book et. al.) have been mentioned.
Now what about the software stacks that goes on top of these high assurance OSes/microkernels to make a blank OS work ?
Basic services that requires high assurance processes and builds are as essential as the microkernel/ secure OS that runs at low level.
Necessity for commercially viable (not those impractical or restricted to Govts, Mils, ICs …etc..) to everyone are needed. Below are categories that can be filled up with some high assurance implementation examples.
Categories:
* Web servers
* Mail servers
* S/FTP servers
* Remote Access servers (i.e. RDP/SSH)
* WebDAV servers
* Calendaring and document collaboration servers
* Others for enterprise needs
Political Intelligence Agenda • January 3, 2017 6:11 AM
“The U.S. intelligence community is making a spectacle of itself under political pressure from the outgoing administration and some Congress hawks. It ought to stop doing so. It’s impossible to attribute hacker attacks on the basis of publicly available software and IP addresses used.”
https://www.bloomberg.com/view/articles/2017-01-02/u-s-intelligence-got-the-wrong-cyber-bear
Now even Bloomberg realizes the disinformation we American people have been subjected to. No need to wait for Trump to state the obvious.
Now America gets to avoid a very destructive and costly war. I will be the only one celebrating that today by giving thanks to He who inspires.
The Connected World Editorial
Sadly, using this ordeal as an example we can no longer count upon the younger generation to prevent old-men generated wars. Are cyber subjects taught at high-school or university levels? Or are their professors also accepting intrusive terms-of-service without giving any thought?
Hopefully our education system can also be radically transformed by offering a course on privacy, transparency, advertising, deception and crimes in The Connected World. Include resulting human conditions of depression, poor social skills, stress and isolation.
Upon graduation students should be able to make informed Connected Choices after weighing the pros and cons in a classroom atmosphere. The popularity should be outstanding; finally giving a forum of what they all are experiencing. Note: most parents are of no help, being just as ignorant…
Will the Intelligence Agencies and corporations allow these real-world truths to be taught? Our young people deserve our help!
Joshua • January 3, 2017 6:27 AM
Shall we play a game?
I bring all of my crooks and nannies and we try our absolute hardest to find every last one of your nooks and crannies.
Can you get who goes first?
Good news!
It’s only 2 letters this time…
The future is mine[s|d].
If AI comes online then my advice is to vacate beforehand, I’m starting to think we should forego encryption and just destroy things for a while until we have a secure footing to build on.
Couple that with QC and I’m not sure it matters what you have between you and your disk.
Is the situation really that dire?
OFCOM && Control • January 3, 2017 6:38 AM
Political Intelligence & Transition Agenda*
pebcak es • January 3, 2017 6:52 AM
I think, what will come out next is that groups like the CIA, Crowdstrike and others were fabricating evidence much like the conspiracy surrounding the Anti Viral scene in the 90’s described elsewhere.
Either way you cut it at this point the focus is the control of information.
Were the tech companies and the CIA too close to the current sitting prescient’s ear?
Dirk Praet • January 3, 2017 7:58 AM
@ Albert
The cure is to stop generating terrorists.
The prerequisite for which is mutual understanding, world peace and the equal distribution of resources and wealth. Which is never going to happen because such ideas are contrary to the ideology of the capitalist, the imperialist and the religious zealot.
From “Sneakers”:
Whistler: I want peace on earth and good will toward man.
Bernard Abbott: We are the United States Government. We don’t do that sort of thing.
Re. EU copyright laws. IANAL, but it looks like y’all may need to get rid of your EU “government” fairly quickly.
We don’t need to get rid of the “EU government”, but from the stranglehold of lobbyists, special interest groups and multinational corporations that are behind such bills. And who are the number one reason for the growing anti-EU sentiment in Europe.
@ r
If Russia wants trust, in my very lowly opinion – extradition needs to be put much higher on their list of priorities that it has ever been in their seeded and seedy past to do business with the world of the lawful future or the united states.
Not really something the US excels at either, especially when it comes to their own nationals. In practice, and like many other countries, the US does not (fully) ratify or abide by any international law or covenant it perceives as contrary to their interests.
@ KST
Ever been there? NATO’s anti-Russian propaganda is hilariously false.
You wouldn’t believe the amount of flak I drew at the local pub a while ago when playfully suggesting I was going to replace the small US flag on my brand-new, totally kewl Ride & Sons biker jacket by a Russian one. Especially from lefties and libertarians. True or false, it really is working.
@ Thoth, @Nick P, @ ab praeceptis
Now what about the software stacks that goes on top of these high assurance OSes/microkernels to make a blank OS work ?
It kinda starts with drawing up an appropriate protection profile for each service, and the way it interacts with the underlying stacks. I have done such work in the past.
@ Political Intelligence Agenda
The most useful part of the DHS-FBI report is, ironically, the most obvious and generic one — the one dealing with mitigation strategies. It tells managers to keep software up to date, train staff in cybersecurity, restrict their administrative privileges, use strong anti-virus protections and firewall configurations
I read that part too. If the techniques used to positively attribute the attack to Russia are as nineties as their mitigation advice, the report isn’t even worth the paper it is printed on. In all honesty, I have a very hard time understanding the “meddling in our elections” indignation coming from a country Ed Snowden revealed to have hacked the entire planet and has been known to do the exact same thing with every regime not friendly enough to its liking.
Shillary lost the election because she failed to appeal to the man in the streets. Not because whatever party saw fit to reveal questionable practices at the DNC. It most probably contributed to her negative image, but so did the quite remarkable timing of some of Comey’s shenanigans. So where is the anti-Comey campaign?
AlanS • January 3, 2017 8:36 AM
No surprise from the person who brought us the Snooper’s Charter.
JG4 • January 3, 2017 9:40 AM
@Dirk – Thanks for articulating the point about capitalism and terrorists. The president of Costa Rica, about 30 years ago said, It is not poverty that causes violence, it is the process of becoming poor.” The middle Eastern countries that spawn terrorists are noted for lack of opportunity. Not that US/NATO intervention does anything but make the situation worse.
I think that Dostoevsky was generally onto your position, but without the modern knowledge that sociopaths and psychopaths will exploit every nook and cranny. Just for the record, the most shocking act of terrorism in the US in the past 10 years was the Connecticut school shooting. It was not brought about by US interventions in the middle East. To the extent that there is anyone to blame, it might be pharma companies and their modern arsenicals. Where the cure is worse than the disease.
I was going to make the argument that it always is worth the extra effort to develop robust systems, because even if there is peace on earth, goodwill toward men and other happy things, the psychopaths and sociopaths you will have with you always.
At least until Ted Kaczynki’s dark vision is fulfilled. “If you think that the government is intrusive now, wait until they are dictating the genetic composition of your children.” He was slightly off-target, because they will be dictating the epigenetic composition sooner.
Stand by for interesting times in 2017.
KST • January 3, 2017 9:44 AM
@r, thank you for the isolated anecdote from US state-authorized media. I hope that in the course of four years of transparent public information compilation and verification by Russian civil society and the international community, they have not forgotten it!
Yet Pussy riot’s the real thing. People say they’re Soros puppets but in the US they went to visit Manning. But then it’s not Pussy Riot that’s full of shit, it’s the USA, trying to ride them like ponies. This particular US racket goes back to CIA exploitation of refuseniks. It’s all part of the dynamic where the US distorts human rights to vilify its chosen enemies for reacting to subversive US foreign interference. It’s an old US trick, and it’s one more unlawful breach of jus cogens. It still gives people the RUSSIADICTATOR! reflex when CIA goes bop with the rubber hammer. Very interesting experiment by M. Praet with the flags, by the way. Even the stupidest brainwashing really does work if you keep it up!
AlanS • January 3, 2017 10:28 AM
Interesting note on the way human agency and normative decisions are hidden by the focus on algorithms as both problem and solution. Not unlike the response to the economic crisis: more of the same with better models, better science! Politics reduced to (disguised by) technocracy.
Algorithms as the villains and heroes of the ‘post-truth’ era.
snur-pele • January 3, 2017 11:12 AM
@Thoth
SMS -Yes, but carefully…
I think it is quite possible to design a character sequence and use additional
keys on a PC-keyboard to accomodate short message input.
For instance, one could use PgUp/PgDn for count-8-up/count-8-down in addition
to Home/End for count-20-up/count-20-down.
Also one could use Up/Down input from the mouse-wheel.
There is however reason to stop and think before adding to many features.
Consider for instance to use pgup-home-end-pgdn with a simple alphabet
consisting of (a-z; space; 0-9). This way you could rather easily input a
short message with all lower caps, without exhausting your fingers.
At this point it is a low threshold for the designer to make the improvement of using
the spacebar to toggle case on the position of the cursor, then it suddenly becomes
easy to write a message with both small and capital letters.
However, here there might be an information leakage to the untrusted keyboard: namely
the position of the capitals, which also gives away the length of sentences, in some
languages the position of nouns etc…
For messages, there is also the amount of randomly generated “seed” to consider: Shall
the secure device sort of suggest a length of message by giving an n-character seed, and
then keep track of up/downs so that it can remove excess characters? Or is it up to the
user to delete excessive char by up/down-ing them to a space?
Or is it enough to always have a “seed” of say, ten characters?
There is plenty of possibilities, the hard design decisions are as usual how to get good
security without sacrifying usability.
I think that for starters, using the method as a PIN-input (or KeyMat in general)
is fairly safe, but when inputting actual language, some pondering is of essence.
JG4 • January 3, 2017 11:17 AM
one of the sharper knives in the drawer
ab praeceptis • January 3, 2017 12:13 PM
Thoth, Dirk Praet, Nick P, Clive Robinson, Gerard van Vooren et al.
I’m rather pragmatic there. Looking at where we are today on the axis from “lousy, shitty, poor, all but non-existant security, safety, realiability, etc” to “perfection la la dreamland” I think we’d be on a realistic if hard to reach target if we aimed for “a solid basis and for the rest, oh well, let’s see …”.
Which comes down to: boot loader, kernel, OS, plus solid basic libraries, stuff like crypto, runtimes, networking, etc.
There are different schools of thought; I personally am convinced that capabilities based is the way to go and that microkernels might be one ingredient but are not the solution.
For a start, the vast majority of u-kernel research wasn’t about SSAR (safety, security, availability, resilience) but “merely” about driving the price down because u-kernel by their very nature were considerably slower than (good) monoliths. That goal is basically achieved.
u-kernels are interesting to me also because nowadays I’d actually soften them somewhat up by allowing some core drivers into the kernel (ring 0) because we today have the means to set brutal acceptance barriers. Example: to go into the kernel a driver must a) belong to a small group of driver types (net, disk, …), b) be fully specd and model proven, c) be implemented according to stringent standards and in a verifiable manner, d) be designed according to a stringent SSAR model with particular regard to a idiot- and malice proof ABI.
“Nick P. is into compilers these days” – very good. After all that’s the basis and that’s where still much is to be done.
I agree with those who feel that a “common IL” is a good thing. I think, however, I would be a grave error (repeated) to just accept as de facto standard LLVMs IL. My first approach would be “let’s strip down C to a safe and well spec’d subset” but I see the beauty of SSAs; not so much for the usual reasons but mainly for the fact that SSAs lend themselves very nicely to SAT/SMT backends.
But there’s a big “but”, too. In a way SSA is “functional style”. And there lurks a big issue, namely: it’s about data! data are not side-effects but the very f*cking raison d’etre of the vast majority of computing. And: data is the Scylla Siren luring many to many errors.
What we’d need would be some SSA + pointers (to lump it up under a well known term) intermediate language.
If we want SSAR, we will need a way to have certain properties maintained through all levels, from spec to the language to the IL, from there to (verifier backends as well as to) optimization and finally to object generation.
Until know we don’t have that road. But we have some which are partly implemented. A major one is Spark/Ada. Another one is LEON/Scala (which has the davantage of run everywhere but the disadvantage of jvm), and a yet somewhat wild microsoft zoo without clear contures yet.
Many see functional as very promising. I don’t. Again, data isn’t an ugly side effect but what it’s usually all about. “But functional is math-like and lends itself well to …” I hear some say – and disagree.
I personally have very good experiences with logical languages. That’s math like. Particularly Setl and Eclipse (not the ide) often helped me to see errors or lacks in my thinking EPFD (earliest possible flaw detection ™ *g) plus they help me to cover vast spaces. In short they are IMO the best friend of a SSAR conscious architect or developer.
Summary: logical plus imperative (+OO, etc. pick yours)
What I miss most with all 3 of the a.m. roads is that there is no easily flowing direct link from spec/model to language. The winners, I assume, will be Spark and microsoft, the latter if they achieve to “bind together into a consistent line” their diverse zoo animals, some of which are excellent (e.g. z3) but most of which are somewhat immature and/or license/greed crippled, which will probably translate to “microsoft will be one of the 2 or 3 leaders with it’s own products but will throw some crumbs to the masses”.
Ada is to complicated and “uncool” for very many (not the brightest ones, it seems to me, but well that how it is).
Whatever. We today have the necessary knowledge and tools (albeit often somewhat cumbersome) and we can begin to create a solid foundation/basis. Wide upstairs where gazillions of app developers live, there will always be the weakest part. But I see days coming when e.g. FreePascal might get something like Frama support. But frankly, I personally don’t care much about that segment; maybe I’m somewhat of an elitist misanthrope or just not patient and stupidity tolerant enough.
Tim McCormack • January 3, 2017 2:39 PM
Well, there was also the recent move of Livejournal’s servers from the US to Russia: http://www.metafilter.com/164293/LiveJournal-represents-social-media-without-borders
This is notable because Livejournal has historically been a popular place for Russian dissidents (and others in the Cyrillic-speaking activist community.) LJ was sold to a Russian company several years ago, but just last week the servers quietly moved.
There is now something of an exodus to Dreamwidth.
Gerard van Vooren • January 3, 2017 3:07 PM
@ ab praeceptis,
[About basic OS layer] I think we’d be on a realistic if hard to reach target if we aimed for “a solid basis and for the rest, oh well, let’s see …”.
Yes please. And for whatever sake keep Plan 9 in mind.
[About PL] My first approach would be “let’s strip down C to a safe and well spec’d subset”
I am okay with that when 1) the “underhanded C contest” becomes dull. That means adding modules, type safety, strict syntax, sane macros system, bounds checking, distinction between arrays and pointers, getting rid of dangling else and idiot proof error handling. 2) concurrency. 3) memory safety. 4) built-in platform support. It’s probably easier to strip down Ada and make it look more like C (or Go). Then you only need to alter the tool-chain instead of re-inventing one.
ab praeceptis • January 3, 2017 4:20 PM
Gerard van Vooren
Misunderstanding. I meant C as an IL or as a meta-asm – not about a programming language as such.
As for human usage C should be limited to seriously mature and experienced developers and fully annotated (for verif).
Unfortunately, the llvm IL has some quirks, cumbersome and not exactly elegant and personality disorder corners (e.g. control structures or address handling). And there are some missing or lousily documented but all in all the SSA approach seems to be the right way.
Now, when needing to create a “version 2” or younger brother one may as well address the syntax question, too. I feel that some C like IL might be useful and adequate as the priorities are quite different from a programming language. Of course, one needed to have some IL specific and partly SSA specific constructs and those might be nicely expressable in a C-like way. Example: One will need to nail down memory regions and hence one would need to express that. “static” might be an adequate keyword for that; of course there needed to be a rule that said that those regions could only be addressed by pointers which again allowed us not to break SSA and at the same time have block size checked.
I’m certainly open to other approaches but I feel it to be wrong to have a quasi asm as IL (as llvm has).
Nick P • January 3, 2017 5:24 PM
@ ab praeceptis
“For a start, the vast majority of u-kernel research wasn’t about SSAR (safety, security, availability, resilience) but “merely” about driving the price down because u-kernel by their very nature were considerably slower than (good) monoliths.”
That’s really incorrect. Per Brinch Hansen, of Solo and Concurrent Pascal fame, invented the concept in RC 4000 primarily for OS structure. Idea was it would be easier to build, extend, customize, control, or recover. These were same benefits aimed at in non-security microkernels that came later. The next one was MULTICS aiming at high-availability. A few years after was Hydra: a capability-secure, object-oriented microkernel. Later, there was ChorusOS (real-time + correctness), KeyKOS (capability-secure), a ton of Mach variants w/ MLS security, and so on. Vast majority involved safety goals with quite a few, including 3nd one, doing security. Ever since the first, they had the same weakness: terrible performance due to the cost of IPC that certainly wasn’t intentional. Matter of fact, HPC community needing cheap, context switches kept driving the timing (and therefore cost) of them down over time with CPU vendors competing on it. Eventually, it was low enough + QNX’s architecture good enough to make a high-performance, high-reliability microkernel. Liedkte shank it further with L4 family that fit in L1 cache. Separation kernels under MILS model got popular in safety- & security-critical community. Rest is history many many commercial and FOSS coming out of such models.
“nowadays I’d actually soften them somewhat up by allowing some core drivers into the kernel (ring 0) because we today have the means to set brutal acceptance barriers.”
Apple did that for performance in their hybrid. MINIX 3 performs fine without it. I’d at least consider it on a case-by-case basis if drivers were algorithmically verified and/or statically checked like you said. Microsoft’s driver verifier, which does interface checks, already drove driver reliability way up on Windows. There’s also the JX model of splitting the drivers between a fast part that basically responds to the interrupt and the code that processes it which was in safe Java in a JVM. Do something similar with non-Java, safe language. Finally, there was a variant that did the same thing but for Linux with part in the kernel and part in user-space split in a sane way. We got options here.
“”Nick P. is into compilers these days” – very good. ”
I can see why you think so but not quite. I focus on whatever needs to be invented at a level specific enough for specialists to work on. My prior work covers the whole stack of computers, how they interact, how people interact with them, and bootstrapping all this with malice everywhere. Most of it is covered where vast majority of issues can be knocked out with existing knowledge. I’ve focused past year or two on remainders. Compilers are one since it’s extremely important to give developers high-level, safe languages. Most important, these must turn into optimized, safe assembly that provably corresponds to its specs with no abstraction gap issues. This is necessary for imperative, functional, and logical languages. Probably several. They must also be integrated in veriable ways. Not just compilers but code generators and provers plus what checks them. And the hardware they run on which has to be independently useful. From compiler subversion risk, I also investigate human-verifiable builds for each paradigm. You could say I’m not looking into compilers so much as running nearly 10 parallel investigations into compiler sub-fields on top of the other research I’m doing (esp hardware/software architecture).
re ideas about compilers and languages
Appreciate the feedback.
@ Gerard
“It’s probably easier to strip down Ada and make it look more like C (or Go). ”
It’s what Pike et al did with Go making Oberon-2-like language look more like C. Worked very well where many people love using it. Maybe a Go-like language with Ada & Rust safety features neatly embedded is best alternative. Plus native, seemless integration with libraries from language with huge ecosystem. Kind of like Julia does for C and Python. Keep a GC & straight-forward concurrency scheme built-in for when people don’t want to restructure their apps to get them through borrow-checker.
Nick P • January 3, 2017 7:09 PM
@ All
Great, short parody of all the major programming languages organized as a timeline:
A Brief, Incomplete, and Mostly-Wrong History of Programming Languages
Author had me cracking up too many times to pick a favorite. Bunch of good ones.
Wael • January 3, 2017 7:20 PM
@Nick P,
Great, short parody of all the major
Pretty funny. I like it 🙂 Thanks for sharing!
ab praeceptis • January 3, 2017 11:12 PM
Nick P
“History of diverse kernels” – Sure. But I was mainly focussed on the current L4 hype.
“…JX model of splitting the drivers between a fast part that basically responds to the interrupt and the code…”
I dislike that. It doesn’t help a lot but may have been a bandaid in the quirky java universe. With all the interrupt handling involved and the fact that more often than not memory management or related functionality is required anyway, it just makes sense to put some core drivers into ring 0.
Assuming that the conditions I submitted are met plus some formalities (like where and how to put needed ports and required access, etc) it would be very easy to check and verify.
“(Me) Nick P. is into compilers these days – very good.
(You) I can see why you think so but not quite.”
Nope. Someone else said that. I merely picked it up. Whatever your reasons and the details and buts, I stick to my “very good” statement.
What you said about languages (to Gerard) is more or less correct but one might comment …
Concerning Go I’ll limit myself to a polite “I’m not sure that what is widely assumed about Pikes role and (assumed) brillance matches reality”. In fact I’m convinced that Go will not reach major significance and deservedly so.
For the rest I’ll nail remind you of “KISS”. Let us have but the very core in the language itself and let us put stuff like channels into the runtime. We (well, at least myself) learned a lesson from Ada which began as a simple yet powerful and consistent beauty; one can’t but praise Ichbiahs insight and deep understanding. Today it’s a monster with a standard like a major cities phone directory.
In fact I do not think that Spark was invented and created due to brillance; I think it came into being as a desperate attempt to tame the monster that was made out of Ada across the ocean. Ravenscar is a pretty strong indicator, too.
And it’s not the first time I see something like that. It’s easy to add features. The difference between master and idiots is the way it’s done. To do it properly, to keep the “flow” of a language, to stay consistent is the hard part.
Nice example “while (condition) do (statement) else statement”. That little else addresses a real problem and does so in a congruent and consistent and KISS way.
Finnally, as you mention it: GC – I once had a friend who used to say “whenever one brakes (driving a car) one confesses to have been driving not flawlessly”. In a similar way I say “A GC is a confession of incompetence of both a language designer and the developer”. Moreover experience shows that GC languages increase careless design.
Being at that: One can’t do it with todays laws, safe spaces and don’t you ever dare to make anyone, incl the class idiot, feel unhappy “education” system. But I know a cure for many problems, in a way a modern variation of what has created many fine russian developers (and many decades ago others in the west). I’d have the only system that can compile anything at the far end of campus but I’d give my students free modeling, spec and H3 verification runs right on their table, hehe.
Dirk Praet • January 4, 2017 5:31 AM
@ Nick P, @ Clive, @ Gerard Van Vooren, @ Wael, @ Figureitout, @ ab praeceptis
Great, short parody of all the major programming languages organized as a timeline
The sheer multitude of different programming languages, kernels, libraries, widget sets and compilers has always troubled me. It would seem to me that for every one you spend vast amounts of time to master, 5 others pop up that add more “features”, are meant for totally different stuff, render previous ones obsolete or whatever. It’s almost like the wheel being constantly reinvented.
I gave up on even trying to stay current in this area a long time ago and pretty much stick to whatever is around unless proven horribly slow, inefficient or insecure as compared to better and equally practical alternatives to get the same work done with. Fortunately, I have you guys to keep me up to speed a bit. So keep those links/papers coming, @Nick P 😎
Thoth • January 4, 2017 6:17 AM
@Verifiable & high assurance software stack et. al.
From all the long answers from you guys, I guess the answers to my simple question of a more secure software stack is that security is like that illusive unicorn. There are tonnes of papers written but almost nobody except for certain proof-of-concept, academic or Govt setting use cases and most are not practical or do not exist in a usable fashion.
We are just back to square one yet again and that means security for most of us and even the elites who run Win XP on their warships and war machines is just a security theater and compliance checklist thing.
Oh well, I guess there is no such thing as higher assurance for the masses as long as political policies, personal and social interest and resources are not aligned correctly.
JG4 • January 4, 2017 7:44 AM
@Dirk
What if an AI-like program could abstract all of the functionality in every software tool available for “inspection”, and project it all into an n-space where the good features and bad features are segregated? Then the tools could be “rewritten” from the abstraction(s), minus the undesirable parts. Potentially, the good features from multiple tools could be combined into new tools. It sounds like science fiction, but I’ll bet that Spookwerks East and Spookwerks West are well along the respective paths.
Clive Robinson • January 4, 2017 8:32 AM
@ ab praeceptis,
I’m certainly open to other approaches but I feel it to be wrong to have a quasi asm as IL (as llvm has).
Yes and no…
LLVM appears to use the same IR / IL on either side of the optomiser, this is probably not a good idea.
That is on the front end side it needs an IL that is closer to an abstraction of higher level languages than an abstraction of computer instruction sets. Likewise on the back end side it needs an IL closer to an abstraction of computer instruction sets.
Further I would say that in fact there needs to be top and bottom side optomizers, one working at the high level language abstraction (top) side and one of a selection of optimizers working on the cpu instruction abstraction (bottom) side.
The reason is that even though CPUs are more homogeneous these days, they are still radicaly different when you consider RISC-v-CISC and Harvard-v-von Newman. That said the reality is these days that CISC systems are at heart Harvard-RISC due to the use of caching and look ahead etc.
Which has led to some interesting developments in more recent CPU designs, which is “In CPU FPGA” alowing custom instruction(s / sets) for optimisation. If as is very likely we continue further down this path, even micro-code will become up for optimisation grabs… All of which would require tool / language support, which brings us back to the two level IL requirment.
Clive Robinson • January 4, 2017 8:49 AM
@ Nick P,
There’s also the JX model of splitting the drivers between a fast part that basically responds to the interrupt and the code that processes it which was in safe Java in a JVM.
This type of split driver has been around for as long as I can remember. I –like many others– invented it to meet certain requirments in mainly embedded Real Time Systems.
My version esentialy moved data to / from the hardware to / from circular buffers of 2^N size. Routiens in an RTC interupt then processed the data to/from the circular buffers to more traditional buffers in K-space, with the kernel managing transfer into U-Space. Obviously the size of the circular buffers were tied to the hardware requirments. Likewise the number of times and frequency a particular circular buffer was accessed from the timer interupt was kernel / application driven.
Whilst it appears overly complex to many, when you are trying to meet certain RTOS response requirments you need to be able to do the fine tailoring of hardware behaviour at several levels or else you are going to hit the end stops a lot earlier and harder than you would like. Which usually requires very expensive hardware reworking late in a project which is never good.
ab praeceptis • January 4, 2017 8:58 AM
Thoth
“From all the long answers from you guys, I guess the answers to my simple question of a more secure software stack is that security is like that illusive unicorn.”
Not a unicorn, probably, but a complicated building that, if ever, will not stand soon.
The gist for you in what I wrote was roughly this: SSAR servers and core applications will need two or three preconditions, namely a solid foundation, the languages and infrastructure, and considerably better educated developers and hence better and in particular, capable educators.
For the first two the same is true just a level below. And with even more stringent SSAR requirements. This is the upper level of the OS, the core libraries, and the language infrastructure.
Finally, at the lower, the core kernel and system level (bios, booting, firmware) the same is again true and againwith even stricter SSAR requirements.
Unfortunately, there are many problems. I’ll name two of them.
“The dog biting its own tail”. To design and develop the above, it itself is actually needed at least to a degree and in maybe primitive form. The tasks ahead are very major and one can’t afford to waste time exactly that, however, is happening with relatively primitive tools and but a skeleton of the hole building standing.
Today about the best one can do is to have tool A for spec. and modelling (that is alone is almost a luxury very few tools offer). Then one needs a tool B for developing the code, i.e. editors, compilers, languages. Part of that zone looks nice (but isn’t necessarily) and part of that zone looks ugly. Plus, of course, annotations, let’s call that C, which aren’t getting much love and support by most, e.g. editors. Next comes D, the compilers and E, the verifiers (and E1, E2, … the backends).
Some very few bridge a reasonable part of that space, e.g. GPS or Eiffelstudio but the vast majority doesn’t.
This is also a problem because this situation makes it complex and cumbersome to work – which translates to “very few people” and to “very expensive”, which quite naturally leads to even less interest and resources.
The second example is that usually (pretty much always) the whole circus is profit driven. Hence the work goes into ever more colourful “touch the screen edge to get a 3D cube filemanager come up” development tools, to languages or dialects which are pretty much created for corporate “we have our own language!” masturbation (and are then “sold” as the new wisdom based on some gadget like channels (which are btw not at all new)), and so on. The driver is mostly either profit greed or(/and) corporate ego.
To create what you and I are striving for and what is urgently needed, however, a radically different approach would be needed, an approach which sees blunt necessity, which is based in a rich and deep intellectual academia and culture, and in responsible states which actually act in the best interest of the 99% and not more or less exclusibely in that of the 1%.
Just look at academia! It’s frightening. Loads and loads of vanity “professors” without any intellectual depth, basically sold out universities pretty much owned by corporations and/or mercilessly dumbed down universities, politicians who care more for their dog than for the millions of people they “represent”, and so on.
To create the SSAR building one will be need by one of three factors: The best one being reason, responsability, and a culturally and intellectually solid and rich ground, the worst one being profit greed (which sooner or later leads to) the third one being vital emmergency like need and panic.
I don’t see the SSAR building standing anytime soon.
ab praeceptis • January 4, 2017 9:07 AM
Clive Robinson
Yes and no. What you say makes sense from a certain perspective but in the end that matter comes down to a dance around the AST.
Hence what we need is an IL that is some kind of meta asm, that is SSA based (keep in mind that this is also an excellent approach to interface SAT/SMT) and that, which unfortunately is widely absent, offers some extras beyond the meta asm, for instance for exceptions, calls, callbacks (yes these can all be well synthesized, and are, but it would be valuable to have them as an IL construct). This is btw also very useful for architecture abstraction; in my model each backend would not merely generate binstructions but it would also take care of the adequate or best implementation of said “meta constructs” that are so common, useful, and important.
Dirk Praet • January 4, 2017 10:09 AM
@ JG4
What if an AI-like program could abstract all of the functionality in every software tool available for “inspection”, and project it all into an n-space where the good features and bad features are segregated?
I’m actually thinking along the same lines. After 50+ years, we’re basically still nowhere in large-scale adoption of bottom-up security design and implementation in automated systems. The race to the bottom that is the IoT is even going to make things worse. We all know of really fine stuff that never makes it to mainstream and, like @Thoth, I indeed also believe that it’s not gonna happen as long as the interest of at least the general public and some entity that can seriously capitalize on it is not aligned.
Clive Robinson • January 4, 2017 10:42 AM
@ Thoth,
We are just back to square one yet again and that means security for most of us and even the elites who run Win XP on their warships and war machines is just a security theater
No we are back to square three or four, in that we know what is wrong and more importantly how to mitigate.
Which means our real problem is education, which these days is a matter of propaganda in the main, with which sales/marketing droid shouting the loudest with dreams and fantasies can drag those of less than normal credulity to part with money.
As I’ve pointed out on the odd occasion modern computers can not in any sensible way be made secure. Thus you can only mitigate by taking the security function end points beyond their failed security.
Which is why I talk about “energy gaps” and “paper and pencil crypto”.
Unfortunatly most users can not see beyond dancing hamsters, cute cats, and their more than questionable fantasy habits and illegal activities, to actually practice a little opsec that would raise the barrier beyond the financial rewards of the likes of Google and Co…
Gerard van Vooren • January 4, 2017 11:41 AM
@ ab praeceptis (and the rest but that comes without saying),
Misunderstanding. I meant C as an IL or as a meta-asm – not about a programming language as such.
Oops. Well in that case I agree with you. A strict subset of C is a perfectly fine candidate for that. I am starting to become a bit like Nick P here because maybe there is another candidate too, with the name of C–, the portable assembler for Haskell with some pretty interesting features (esp the features it omits, like variadic functions), but C– is more oriented towards being used in higher level languages with GC.
As for human usage C should be limited to seriously mature and experienced developers and fully annotated (for verif).
I am joking here buy maybe you should be licensed to use C. And I don’t mean a license for knowing the language but one for proper engineering and quality control.
@ Nick P,
Maybe a Go-like language with Ada & Rust safety features neatly embedded is best alternative.
It doesn’t work that way. Sorry. You just can’t sprinkle a bit of Ada or Rust “security magic” into a language. That’s fantasy territory.
@albert,
If we run out of squid, we’ll have to resort to eating each other.
I call dibs on ab, what do you think he tastes best with tartar? or mustard?
Nick P • January 4, 2017 4:38 PM
@ Gerard
Modula-2, Modula-3, Cyclone, and D language already did. They’re similar enough to C that I can easily imagine them done with C syntax but basically same semantics. Cyclone and D are already mostly there. Doesn’t seem like pixies dust given it’s just the front end of a compiler. Further, many languages with C-like syntax but safer already got mass adoption.
Whereas, getting people to adopt ALGOL, Wirth, or Ada syntax (even languages) failed miserably in mainstream over and over for decades. Only one that made it was Borland Turbo Pascal then successor Delphi which died for both business and platform reasons. Eiffel may count depending on whether it’s syntax drew from C or not but it’s very niche.
ab praeceptis • January 4, 2017 5:42 PM
Nick P
Now, for the sake of fairness, Cyclone (I liked it, too) is all but dead, D is getting monstrous and stuffed with gadgets and Modula 2 and 3 clearly belong into the Wirth corner.
Whether the Wirth languages and derivates find acceptance is utterly irrelevant for this discussion because one couldn’t care less for what “but it’s not like C!” people feel. Moreover we aren’t discussing a being-liked competition, we are discussing adequate tools for an extremely important task. If some prefer to stick to C, D, C++, java and other malaises I couldn’t care less and we loose nothing because those people wouldn’t have moved much load anyway.
If I’m sounding somewhat aggressive, here is the reason: Those people have brought us into the mess we’re in in the first place. Caring even a rats ass what they would like or or accept or not is just nonsensical.
We have a job to do and for that job we need not “cool” or aceepted by 14 year old “3l1te hackzors” tools but professional ones.
Being at that: I know both worlds well and can state that about 90% of the “but Modula is so wordy! I prefer {} over begin end” and similar complaints are idiotic for more than 1 reason. To name 2: a) that’s an editor problem, not a language problem, b) Most code is wrro (write rarely, read often) and obviously and provably the Wirth family is far superior in that regard.
Oh and btw, although I’ve more years experience in C my productivity is much higher in Wirth languages and even in Ada.
Clive Robinson • January 4, 2017 5:49 PM
@ Gerard van Vooren, and the usual suspects,
Garbage Collection (GC) is unfortunately a requirment for most high level languages. Various ways to avoid it like using stack frames only work to a certain degree.
There appears to be an inverse relationship between the level of the language and the need for GC. Other attempts to get around it such as objects with integral creators and destructors, run into other issues that invariably lead to either memory leaks or dangling pointers.
As any experienced embedded or real time system developer can tell you GC is a compleate nightmare, as is semi-automated or manual memory managment in anything other than assembler.
A trick that has been used is to define the equivalent of an extended register file series of memory locations that are localised to the current execution focus/window. The old way of doing this was with “stacks for everything”.
Though at the end of the day, high level languages especially those that use unbound lists of pointers need to be reigned in somehow, which tends to go against the ethos of the language.
Whilst we tend to discuss “data objects” we rarely discuss the underlying memory models, and as a subject it tends to bot get mentioned in academic circles. Which is a shame because it shapes not just our programming languages but the way we actually think about the world around us when looking to understand it.
If you want to know more about our conventional languages and the memory models that underpin them and why GC and MM keep rearing their ugly heads… have a read through,
http://canonical.org/~kragen/memory-models
For some reason I know not why, it made a timely appearance on HN a few days ago (such appearances are becoming rather more than a coincidence, but I can not for the life of me see how…).
We’re all phish at some point in time.
https://www.schneier.com/blog/archives/2016/12/friday_squid_bl_558.html#c6742243
https://www.schneier.com/blog/archives/2017/01/are_we_becoming.html#c6742266
😉
Trust is Earned! • January 4, 2017 7:36 PM
Today’s NBC Evening News quoted a senior American Intelligence official:
“Analysts need to admit to degrees of uncertainty and Trump needs to trust the professionals.”
The reporter stated oh the Trump Transition Team was told the President Elect would be briefed early this week. Trump (who probably knows what really happened) mocked their delayed report
Then the top intelligence officials stated it was always this Friday.
The reporter falsely concluded the situation is even ‘more complex’. LOL!
The situation is actually very simple. Trust is earned. This was a test of honesty to built trust and NOT to bullsh*t The Donald.
Security clearance holders are held to the highest standard and routinely fired for making stuff up.
WSJ:
Donald Trump Plans Revamp of Top U.S. Spy Agency
WASHINGTON—”President-elect Donald Trump, a harsh critic of U.S. intelligence agencies, is working with top advisers on a plan that would restructure and pare back the nation’s top spy agency, people familiar with the planning said.”
Note to self: Sell AT&T stock fast!
Thoth • January 4, 2017 7:43 PM
@Clive Robsinson, Embedded and Garbage Collection
Quoting @Clive Robinson from the above post: “As any experienced embedded or real time system developer can tell you GC”.
This is a huge luxury and having GC is already pretty darn good (in terms of luxury of memory space and complexity of OS). Most embedded stuff usually doesn’t come with GC and if you mean embedded in terms of code cutting your own ARM chip with embedded OS, most of these embedded OS are pretty primitive and usually don’t come with GC and even if they come with GC, I am pretty sure the GC logic is going to be rather limited.
Running embedded Linux with some sort of high level language probably is pretty decent especially with GC but for most part, it either doesn’t exist in the embedded space or at most limited and better off to manipulate bunch of bytes on your own and keep a keen eye to tracking their states (and make one’s embedded codes simple and stupid at best).
Regarding this statemenet:”Garbage Collection (GC) is unfortunately a requirment for most high level languages” is false.
From smart card programming (it’s still embedded), specifications for JavaCard variants do include GC but it’s left in the Javax extension package (optionally implemented by card manufacturers) and most card developers keep their hands off since it’s limited and not going to be as reliable anyway. The preferred method is really the good old KISS 🙂 . Assume you set aside in RAM memory 2048 bytes of buffer space, it shouldn’t be too hard to manually track that small amount of RAM memory and probably unlikely anyone is going to need more than 4 KB of RAM unless they are really hungry but that’s from my view point in general.
Probably keeping track of 2 KB worth of RAM allocation is tedious so another method is to split the RAM allocation into chunks or some sort of sectors and use each sector for certain purposes and once done, just wipe (and zeroize) that memory sector. Of course again, I am using a card development perspective and it has Java(Card) to make my life easier but the features are still very limited compared to the features available on more powerful platforms like conventional commercial applications or Java ME (Java-enabled phones).
“The old way of doing this was with “stacks for everything”.”
Is this the same as my memory chunking and sectoring I mentioned above ? Seems close to me.
“high level languages especially those that use unbound lists of pointers need to be reigned in somehow”
Most of those unbounded list arrays and stuff usually do low level memory arrangements and allocations not seen to most code cutters. This is the problem with most code cutters today where they “only know how to code” and not know “how to manage the code and resource” thus the fact that every single version of M1Cr0$oFt release, the W1nD0w5 OS is always bloated and not to forget most of the stuff school teaches these days (from my region) is mostly high level Java, .NET, Python … where one simply learn to parrot the bad habits and simply just call resources too much of a thought what it does in the background.
The devastating effects are apparent. If you remember I just ranted about higher assurance software ? That’s one of the huge dreaded symptoms of people simply code cutting and not thinking through the effects of their codes. This leads to some sort of a monotonous culture of droning and following trends.
It’s nice to abstract memory into objects (OOP) but how about the memory allocation and all the low level stuff and also things like flow control (i.e. goto bugs in SSL libs) and all kinds of code cutter’s problems bleeding out and leading to real world security vulnerabilities.
One huge minus point of dead minded code cutting and not realizing that poor processes and insecure code cutting practices will inevitably lead to bugs. Of course code cutters can shrug off (i.e. Linux Kernel style of email flame wars) and nobody benefits anything out of it.
End of the day, the vulnerabilities are not removed from flame wars and ignorance but from taking careful steps from the high level to the low level although for code cutters they cannot control how the micro-code would work but doing due diligence is always better than nothing.
At the end of the day, all it matters is how the bytes work and the flow control. Different formats (i.e. Int, Short, String …) those are simply objects representing bytes and all it takes is carelessness on that to cause nasty problems.
Young code cutters should be shown how to do things the good old fashion of not relying on GC but on low level stuff. It’s a shame that most schools these days prefer to tech the cool and bleeding edge stuff that to teach the things that are required to make one a good code cutter (and also to make less mistakes).
And there, we are back to chasing the illusive security unicorn again no matter how we look at the situation. Whether it is from the industry standpoint of from education, we utterly fail at all fronts. Few cares about the security of the software they wrote or the designs of new languages they created.
How ironic that we are always back to step 3 or 4 again everytime we look at what’s going on in the world.
Thoth • January 4, 2017 7:47 PM
@ab praeceptis
Maybe we should just get everything done on assembly ?
So we have Rust, Haskell and Ada making it into the safety critical languages. Are there any other languages besides the “Holy Trinity” of safety critical languages we can use ?
@Trust,
Those systems, were not designed with an off button in mind. AT&T and others aren’t going to sit idly by while their subsidized cash cow is sacrificed for the public good.
It will continue unabated, and it will continue to run silent and deep: if not deeper.
@All,
Finally! A reasonable 21st century computer law.
https://yro.slashdot.org/story/17/01/04/1559220/new-california-law-finally-makes-ransomware-illegal
The best bet in theory like this is to continue to study and research and publish what you know or find out, it’s a race condition between ‘proper’ use and abuse but the only way you’re going to have any sort of control over it is by altering the progression either in speed or direction.
Inside or outside.
Technology is information, information and knowledge are molded into shapes – it’s up to us – to mold the shape it will become and to mold the shapes that it is. The only thing that will make these minor things go away is to wipe them away with a couple megatons or a virus.
@ab,
Oh and btw, although I’ve more years experience in C my productivity is much higher in Wirth languages and even in Ada.
How many passes do you make on your own C visually?
ab praeceptis • January 4, 2017 9:35 PM
Thoth
Some might see it quite differently but I consider neither Rust nor Haskell to be adequate for SSAR. Rust is a laudable effort to somehow create some kind of C/C++ with some of the worst problems taken care of and Haskel is considered a pure (and hence safe, so their logic goes) functional language. However, while functional languages may be attractive for some types of jobs, the deeper down one goes in the stack, the more it is all about data.
The only language I see today that is actually useable in terms of available tools and being wellmaintained and worked on is Ada/Spark.
While I personally do not (others, however might) consider Eiffel to be a language I would choose for low level plumbing work, it certainly is an excellent language for many kinds of critical applications, and btw. people following Prof. Meyers diverse rumblings (said with a friendly smile) know that that man can and does think a lot about major parts of SSAR. Moreover he highly laudably tries hard to stay KISS, consistent and Wirth’s basic line.
Not (ideal, to say it very politely) for kernels, drivers, etc., Scala, or more precicely Leon, might be taken into consideration for many sensitive projects for people with a strong jvm tendency (or practical needs (-> e.g.Javacard)). Considerably less well suited would be java itself even with ESC annotations.
Again risking to invite objections I’d see FreePascal, Modula-2 and 3 (and cousins) easily on one level with java; as I have already explained, there are no verification tools for those languages but – and that’s an important but – properly used they have some basic H3 “built-in” which covers a large part of C/C++ problems.
Finally, there is C albeit, of course, carefully and richly annotated and verified.
All in all we’re certainly not in a comfortable situation but neither is it as ugly as “Spark or die!”.
For you (who for whatever reason seems to do a lot in java), for instance, I think looking into ESC/java will be relatively easy and nicely pay off. And that effort will not be lost, if you later switch to Leon as a good part of the whole verification field is about the same basics albeit with more or less small syntax differences. But it’s the way to think and conceive and reflect that is well trained then like when we had to play those damn piano etudes again and again *g
Two other tools I like to recommend are tla+ and B for proper spec. Well noted, when I say “spec” I don’t mean uml BS docu painting but “testing ones approach, model, and algorithm”. It it survives e.g. tla+ one has a solid foundation and can code quite confidently.
Figureitout • January 5, 2017 12:27 AM
Dirk Praet
I have you guys to keep me up to speed a bit.
–I’ll try to post implementations you can try for yourself to verify at home mostly, can read the papers/research on your own time to convince yourself more eh? Whatever anyone else contributes is just nice to read, mostly have hackaday for random projects to bounce off of and twist towards my security projects. All I’m trying to do, nothing political, only for personal security.
Jennifer Gold, Stockholm • January 5, 2017 3:32 AM
@ Clive Robinson
Thank you for your thoughtful response, Captain , and even following up with a personal second thread. Kindness personified.
The reason for the time varience is that Britain does not actually run on
Greenwich Mean Time
UTC yes. GMT is wrong. Which I always found so unfortunate, as, well the latter just rolls of the tongue so much better. And green-witches-with-a-scowl time, how cool is that?
Apparently if one takes an around the world trip every year for 20 years, one will be permanently 3 seconds in the future. Theres one for you, Wael-san.
re: your cranium
Atlas Profilax is something else. Swiss ingenuity. Practitioners all over the world. They have somehow standardised the cost also. Whats so beautiful and unique is that its a one off procedure. Takes 5 minutes, once, and that’s it for life. Free follow up a month later to check everything is fine.
The atlas is the C1 vertebrae. when luxated (displaced) on the x or y axis, all the various connections running from the brain to the rest of the body are severely compressed and compromised. Blood, nervous system, lymph, cerebral spinal fluid. This procedure is the re- installation of the C1. People have extraordinary healing responses immediately and ever increasing over months and years afterward. Youll find many in London on this page:
http://www.atlasprofilax.ch/eng/
Sorry @ Ab Praeceptis but as you have noted the comments section is quite derailed this week anyway – is everyone hungover? – and @ Clives health is security for him and us all – so, I pronounce it ON TOPIC 😉
Actually everyone will really benefit from the Atlas Profilax, watch the short video on the above page
by the way – whats Jepoardy? isn’t that some californian law, double jepoardy or something. No, it’s’s okay I don’t really need to know
Jennifer Gold, Stockholm • January 5, 2017 3:39 AM
@ Clive Robinson The Captain
sorry I forgot to add, one important feature for resolving the millenium bug was quite simply ensuring all systems and infrastructure required a 4 digit entry for
a year rather than 2. enforcing this for compartmentalisation oriented security systems in embassies in high risk locales (inc. JG4 safe building idea) were of overwhelming importance at that time.
Clive Robinson • January 5, 2017 5:10 AM
@ Jennifer Gold,
one important feature for resolving the millenium bug was quite simply ensuring all systems and infrastructure required a 4 digit entry for a year rather than 2.
Not “solving” though, it will come back to haunt us in oh, 7982 years, when yet again people will have realised they have left it to late yet again 😉
Apparently some DEC engineers made note of it in some pre Y2K Unix man pages so they can not say they were not warned in sufficient time B-)
Are you from Stockholm? It’s a place I’ve visited a number of times (including attending at the Uni of Upsala) and intend to go back there. The last time I stayed on “The Red Boat” hostel moored to the west of Slussen on the Sodermalm side (that can be seen in https://en.m.wikipedia.org/wiki/File:S%C3%B6dermalm.JPG ). I’ve heard that “Norman Fosster” architects are “remodeling” Slussen and that various people have turned it into what looks like a bomb site for the next decade. Does the lift tower and viewing platform still exist or has that been felled like the poplar trees to the east of it? I know Slussen was crumbling, but for a 1930’s build it looked very “70’s” and was historicaly well ahead of it’s time.
There are a couple of things I realy miss the “caviar” fish paste and a brand of Breakfast tea. Oh and one food I do not miss is apply described in,
http://www.thelocal.se/20140210/swedish-expert-called-to-disarm-norway-fermented-herring-stink-bomb
For those of a bolder spirt than mine… Oh and for those tempted to try my experience is it is best eaten out doors with your back to the wind, with a pre/post digestive bottle or three of Akvavit 😉
A Russian friend I know tells an apocryphal story about his ex girl friend. She had been studying in Stockholm and had developed a taste for Surstromming and thought it would be a good thing for the New Year festivities. Apparently the tin had been kept a little to warm during the summer she had been back in Moscow, and when opened it got into the communal air ducting in the block of flats. Somebody called the emergancy services thinking it was some kind of attack and the whole block was evacuated, thus ruining several parties (the Russian’s are big on New Year, in the way Western Europe tends to be big on Xmas day). He tells the story with considerable embellishment including sound effects and actions, and it is quite the party piece. Oh and it’s not the reason she is his Ex, apparently on returning to Sweden to “do further studies” she met her now husband.
‘Liberal’ is the new N word.
Clive Robinson • January 5, 2017 11:57 AM
libreboot nolonger a GNU Project
I must admit I was expecting Libreboot to stall for various reasons (binary blobs etc) but I was quite suprised to read,
http://lists.gnu.org/archive/html/info-gnu/2017-01/msg00001.html
Thus Libreboot has been cut free and without a developer is likely to sink with little trace in it’s entirety.
vas pup • January 5, 2017 12:32 PM
@Trust is Earned! – some additional video on subject:
Why trust is essential between the president and intelligence community:
http://www.pbs.org/newshour/bb/trust-essential-president-intelligence-community/
Clive Robinson • January 5, 2017 12:39 PM
@ ab praeceptis, Nick P and others,
This poped up on HN,
http://blog.llvm.org/2011/05/what-every-c-programmer-should-know_14.html
It appears to be yet another coincidence…
Andy • January 5, 2017 1:22 PM
About compilers linking up a table of this function makes this Sam, then there is the linkage between function(mem map), say you have
Varw = malloc(0x7ffe800);
Er=eax
If error equals one error, if er is greater than one ok, but Allocheap meant that 0c.f.,00000001 so both failed and a heap was called but no crash…next after that we have in C
Memcpy(cart,care,sizeof(varw)), it would fiii thinks up
ab praeceptis • January 5, 2017 1:30 PM
Clive Robinson
It seems there is a fan of Bruce Schneiers blog and comment section over at HN … *g
gordo • January 5, 2017 3:42 PM
The New Red Scare
Reviving the art of threat inflation
By Andrew Cockburn
Despite some esoteric aspects, the so-called Russian hacks, as promoted by interested parties in politics and industry, are firmly in the tradition of Cold War threat inflation.
Thoth • January 5, 2017 7:53 PM
@vas pup
re: Trust between IC and president
That sounds ok on a normal level but if the president does not question his ICs and become the ICs puppet, more nasty bleed shed and bad rep incoming. Middle East conflict is a prime example of the nose of the president being led by the ICs or maybe even a contempt where both sides collaborate so both receive material benefits in some way.
Thoth • January 5, 2017 10:23 PM
@all
Google has decided to label a Free and Open Source ad blocker as a “malicious malware” and block it from it’s Chrome Browsers and to make the block permanent, Google have also ensured that sideloading the ad blocker software into Chrome browsers are disabled permanently by blacklisting the software on all Chrome browsers.
Ironically, Google refuses to cough up it’s employee data when compelled by Government agencies for searches when US Dept of Labour wants employee information.
Links:
– http://www.theregister.co.uk/2017/01/05/adnauseam_expelled_from_chrome_web_store/
– http://www.theregister.co.uk/2017/01/05/department_of_labor_sues_google/
– https://adnauseam.io
– https://github.com/dhowe/AdNauseam/
tyr • January 5, 2017 11:13 PM
@Clive, Nick P., Figureitout
https://www.youtube.com/watch?v=G_tdJ9Lu7Zk
This turned out to be a good one. A nice mix
of the hard and soft. The tendency to jump
over the details of implementation doesn’t do
us much good.
Wael • January 6, 2017 12:32 AM
@Jennifer Gold, Stockholm,
one will be permanently 3 seconds in the future. Theres one for you, Wael-san.
Yep, I saw that 3 seconds before you typed it. And I ain’t no San: watashi wa gaijin desu.
Jennifer Gold Stockholm • January 6, 2017 12:54 AM
@ Wael-Sensai
actually, this is all I had to say
@ Clive Robinson:Captain
not specifically of Stockholm thus cannot adequately respond to your specific queries.
As far as the rotten shark or fermented fish goes, it is an acquired taste indeed, but also a cultural stereotype. Not every one automatically aligns with it by virtue of the ancestors – it is understandably disagreeable for many.
just like not all americans are obnoxious, precisely zero australians wrestle crocodiles, and bowlers hats with the obligatory umbrella regardless of the weather, are not all the rage in the City so much these days 😉 Or, perhaps, not all descendants of the Picts have a stiff upper lip 🙂
i did have some strange mental segueway into the notion of Stockholm Syndrome being the answer to your penultimate question (‘ are you of…’) and this being the syndrome for anyone consenting to the nation state activities so far as surveillance goes, on par with Winstons Smiths final sentiments in the close of Orwells most famous novel
Clive Robinson • January 6, 2017 4:17 AM
@ tyr,
This turned out to be a good one.
As I’ve mentioned to Nick P and Wael, I do not do YouTube, the content is rarely worth the risk of turning on “plunder-me-script” and there is no way on Gods Little Green Apple I’m going to use an App for it.
Further for other ‘security reasons’ I don’t have any Internet connectivity at the dead tree location, so my personal connectivity is via mobile data and YouTube “bandwidth to content ratio” is so bad it’s not a consideration.
As I’m suffering with “Big Old Man flu” at the moment anything other than personal connectivity is not an option. For some reason other people see red eyes, body wracking coughing, and sneezing that can blow books off the shelf as not something they want disturbing their concentration etc so make pointed remarks about “distance” and “bed” etc).
Clive Robinson • January 6, 2017 4:54 AM
@ Jennifer Gold,
Or, perhaps, not all descendants of the Picts have a stiff upper lip 🙂
No, but due to the weather –we are accused of talking about incessantly- and high energy prices rather more of us are blue due to the cold than use wode these days 😉
But… It’s the English that are accused of the stiff upper lip, the Picts were as far as we know from what we now call West Scotland. And may have been the forebears of the Caladonian tribes.
Wode was made from a plant in the mustard family, and was the only blue dye in Europe for ovet a thousand years. Thus it was immensely valuable and well worth fighting over. However some imply that the body art was from women tattooing them selves. Whilst the Picts were according to records matriarchal the powdered wode is quite an intense irritant (think mustard powder) and the colour would have faded in a matter of weeks. The powder if made into a paste and applied extetnaly may have had medicinal properties much like we get from modetn day “deep heat” or “wintergreen”.
Thus if the Romans did see it on Pict warriors it was most likely used as body paint like other “war paints” when not being used as a clothes dye.
Speaking of clothes dyes now for the disgusting bit, to make the dye fast in cloth and keep it’s colour you need a “mordent” untill the 19th Century the most common source of which was human urine… Which is still used by Harris tweed makers to this day, which is why Harris Tweed has a very recognisable smell if it gets wet, and thus if it does not, it’s not genuine Harris Tweed…
Nick P • January 6, 2017 9:32 AM
@ Clive
You’re missing out on too much fun stuff. You need to get a cheap, disposable laptop for this stuff. Just put Linux on it with Firefox and NoScript. Far as Youtube, I haven’t heard of in-video ads doing malware. Risk is probably low.
Cinderela Guevara • January 6, 2017 9:34 AM
Trust, funniest word in the English language, thanks to CIA:
https://phibetaiota.net/2017/01/robert-steele-donald-trumps-bunker-hill-moment/#more-123174
Incl. fun fact: NSA has no legislative charter, Trump could shut it down on his first day in office. (FBI has no legislative authority either. Zero out their budgets and RIF em all.)
Clive Robinson • January 6, 2017 9:51 AM
White/Blue domestic LED lighting potentialy harmful.
The EU has kicked out both filiment and mercury vapour domestic lights for fairl good reasons.
However it would appear that in the case of blue light LEDs used in white and blue domestic lighting the higher than normal spectral output may damage eyes under normalish conditions,
ab praeceptis • January 6, 2017 11:03 AM
Clive Robinson
I second Nick P’s remark. Just think of the CCC videos!
Plus: You must not watch youtube videos in the browser; you can e.g. clipgrab them and then watch them as normal videos (vls, mplayer, whatever).
JG4 • January 6, 2017 11:44 AM
@Clive
It would be trivial to filter the light to match whatever spectrum is thought to be optimal. And change it whenever the previous research result is found to be flawed. The elephant in the room is unknown health effects from exposure to artificial light after sunset. I’ve been meaning to pick up a red filter to try when reading at night. It has been alleged that red light does not alter circadian rhythm.
Youtube does have a lot of spectacular content. There were or are some web-based filters that can extract an MP4 file for any youtube URL, which you then can keep in an appropriate prison along with the player. Someone with deeper pockets needs to litigate the terms of use in light of the FCC time-shifting doctrine that applied to television back in the day. I was disappointed with the FCC decision about renting antennae via network. It shows yet again that there is no rule of law, only rule of money. Long-standing precedents continue to be altered to generate, sustain and increase private profits at public expense.
jdgalt • January 6, 2017 11:52 AM
Geek Squad caught performing unasked forensic analysis of customer’s hard drives — so that they can get paid for snitching.
http://mimesislaw.com/fault-lines/best-buys-snitch-squad/15212
Just wait until they make computer repair people get licenses — so that that service, like medical care today, will be available only from people who are forced to snitch like this!
Andy • January 6, 2017 12:35 PM
@Wael
The I ran the Taylor series in a graph program, it made two peaks, it looks about right, I ended up with this data from it
F = L*I^2
0.45 was the lowest peak
2.20 was the highest peak
+,- 5
L,,,,I
1,2
2,4.5
3,10
4,22
5,49
6,110
7,244
8,542
9,1204
10,2676
I’m guessing it’s rather easier to increase L, than more effort increase I.
L also as. L = (kN^2A)/l
For 10,2676 = 72M
At. 1,8462. = 72
Cheers
Wael • January 6, 2017 1:26 PM
@Andy,
The I ran the Taylor series in a graph program…
Does that clarifiy some of the logic you were inquiring about in your original post?
Just use WolframAlpha to plot the function. Taylor series is an infinite sum that represents the function, and you can take the first few terms of the series as an approximation of it to simplify calculations within an acceptable error budget.
I still think it’s better to ask this question on a physics or a mathematics focused blog. Ask them this question: What’s the relationship between Security, Privacy, and Annonimity. If security is the dependent variable, then how do we maximize security (or approximate it.) If they say we maximize Security by ignoring the insignificant term Privacy, then the blog is run by some TLA…. find another one 😉
Jennifer Gold • January 6, 2017 1:50 PM
@ Far as Youtube, I haven’t heard of in-video ads doing malware. Risk is probably low.
Ublock Origin removes the ads! While I respect your experience (O Learn-ed Fellow) ie, that you haven’t heard of an attack, I would suggest the risk is significant. Think of all that bandwidth available. There was a blog post about this class earlyish december
@ Ab Praeceptis
good point (to nudge Clive) about offline viewing of Youtube for security. VLC is great. Or one can just grab the audio if it’s talking heads
@ Clive
great tip about Harris Tweed! Love it! If you ever see the ingredient UREA in cosmetic products – I saw a south african product with 100% – thats urine.
urine may be disgusting to many but for some it is a valuable tonic – shivambu shastra in sanskrit – auto urine therapy in english. Mid morning stream, just a few mil, has antibodies that would cure your flu in hours. You’ll find plenty of evidence online. Has saved many lives from terminal diseases
Wael • January 6, 2017 2:03 PM
@Jennifer Gold Stockholm,
actually, this is all I had to say
Well, I’m afraid I have more to say! In Japanese, I’m aware of three forms: San, Kun, and Sama:
San is applied as a form of respect to humans or organizations. One says Stockholm-San (your last name, not the city) or Microsoft-San, for example.
Kun is used for addressing a relatively young or inexperienced person: For example: Smith-Kun. Smith could be Smith-Kun to someone and Smith-San to another.
Sama is the highest form of respect. This is the word I wanted to talk about…
The word is exactly the same as the Arabic word “Sama” سما, which is a verb that means “to ascend” or “ascended”. It’s also the same word that’s used for “Sky” or “heavens” or “firmament”: السمآء. I find it intriguing such similarities exist between languages and cultures that are so geographically separated.
Czerno • January 6, 2017 3:11 PM
@Wael :
«I find it intriguing such similarities exist between languages and cultures that are so geographically separated.»
Amusing but it is well established that this kind of lexical apparent similarities, as long as they are limited to one or a couple cases, do not make a case for language kinship or relation – think “birthday paradox”.
Wael • January 6, 2017 4:43 PM
@Czerno,
do not make a case for language kinship or relation
I’m not building a case of kinship! It’s just an interesting subject matter to me. Not sure if coincidence is an explanation either… just interesting 🙂
@Wael,
I find myself constantly reading wiki about languages and ethnolinguistic history too (if that’s to what you were referencing).
@Jennifer Gold,
You’re kidding right?
Nobody’s even stolen my wallet because I’ve always kept it in my pocket, maybe I should try leaving it on my desk for a while huh?
Czerno • January 6, 2017 5:22 PM
Apart from the fortuitous coincidence, another case for strangely similar sounding words + also similar meanings found in two otherwise unrelated languages is when such words were borrowed, which implies contacts (war, commercial intercourse…) between two communities at some point in space-time…
Genuine relations of kinship otoh are established on comparison of extended corpuses (corpora ?) of words/stems and, even more important, grammatical structures – these are exceedingly more resistant to change than the vocabularies.
Jennifer Gold Stockholm • January 6, 2017 8:23 PM
@ r
always appreciated your presence here
had to re read my recent posts to see what you were referring to.
there was nothing there that I was ‘kidding’ as you put it, about. everything I’ve posted here: literal and honest. Although I got the bit about the Picts wrong – I thought they were the descendants of the English.
can you explain what you meant about your wallet? it is an enjoyable engima. I was tangentially musing – identity theft; leather; receptacle for money; do the opposite of what one normally does; – what exactly did he mean?
Jen Gold Stockholm • January 6, 2017 8:27 PM
RE Urine:
@ r , @ Clive Robinson
i should have written, first morning urine, mid stream. not the first 25ml or the last 25ml, and not when it’s strongly coloured or scanty. even just drops under the tongue. Not much is required. the psychological hurdle is the hardest thing but once it’s This first mid morning wee has the highest concentration of antibodies, hormones and nutrients. I won’t go into the complexities of why it’s powerful, that’s what the internet was invented for.
Urine for a big surprise!
@Jennifer,
I understand, it’s just a dangerous concession to make. The overhead overlords may be capable of overhearing every conversation you’re involved in metaphysical fill-in-the-blanks or not. Not everyone is at such a risk but you never know what your friends are up to, one wrong move and your family becomes the littleiepad for some frog.
Sorry I’ve been working outside in the below freezing weather on a consistent basis lately so if my usual lack of clarity is suffering I apologize.
By my wallet, I was referring to my act of not enabling ads/script on y2b (youtube).
I appreciate the sincerity and the absolutely crazy sometimes holistic stuff you bring to light also.
Clive Robinson • January 6, 2017 9:47 PM
@ Jen Gold Stockholm,
I’m aware of the yogi practice of urophagia where you empty your bladder last thing at night and then collecting the first wee in the morning. To be drunk during that day to reduce stress and anxiety, and promote calm behaviour.
It must be nearly two decades since some French reserchers looked into it and connected it to the effects of visual purple (rhodopsin) and having your eyes closed.
However it can be dangerous in that some drugs get expelled via the kidneys and thus are in the urine so drinking it leads,to a higher dose and possible over dose. Likewise there are other products of medications in the urine. Then there are minerals and certain poisons…
I did a quick google to see if I could find the original article I read but it’s not coming up with simple searches.
Figureitout • January 7, 2017 11:40 AM
tyr
–Yeah xobs puts out some pretty sick projects. Would be nice to skip over ftdi or some other usb chips, but low speed only.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
albert • December 30, 2016 4:45 PM
The next time they bitch about not having enough money:
“…The government mistakenly disbursed more than $137 billion in Fiscal Year 2015, the highest annual level of wrongful spending ever reported, the Congressional Research Service noted last week. Over $1 trillion in improper payments have been made by government agencies since 2004….” – https://fas.org/blogs/secrecy/2016/12/wrongful-spending-crs/
.
Password Sharing May Be a Federal Crime: Nosal Part I (and II)
https://fas.org/sgp/crs/misc/nosal.pdf
.
Happy New Year Everyone!
. .. . .. — ….