Schneier on Security

Clive Robinson • August 4, 2018 4:17 PM

@ Ismar,

With regards China and “rare earth metals” have a look back on this blog over a number of years and you will find I was wavibg a flag about it.

The consensus back then was either “not interested” or “you are wrong”. Likwise my warnings on what China was doing in the South China Seas, Oh and Africa.

I’m not claiming that I’ve some rare ability to spot such things early, but the evidence of what China were doing with rare earth metals to get foreign IP into China was painfully obvious to anyone that took more than a few moments to look.

Yes there are other rare earth deposits around the world but the mines got closed years ago, the cost of re-opening them will be high… But the real question is how much IP has China stolen in the mean time? Andwhat it’s worth in jobs and competativeness in international markets.

Oh I also warned that both US politicians and US corporate directors were way way to short sighted with regards the way China thinks and behaves…

Any way I’m glad a more mainstream journal/publication is finally making some warnings about it. It may yet not be to late to resolve the issue but I realy don’t think either the US politicos or US corporate directors are upto it in all honesty, heres to hopibg I’m wrong on this point…

Clive Robinson • August 5, 2018 4:48 AM

@ Ismar,

What is the purpose of this Friday blog that mr Schneier so kindly let us use?

That question has been asked off and on for many years.

@Bruce has an intrest in squid for some reason. As they are fascinating creatures in their own right, it’s hardly supprising that a curious mind would find them not just curious but engagingly so.

Back when the blog was young, the majority of posting was done from peoples work desks (smartphones were not an item to hand back then). The blog was also way more technical then as computer security was a very much smaller field of endevor and altgough starting to be taken seriously was not out of the grass as far as general users and managment were concerned. Oh and Intel was only advertising in “serious” electronics journals and “China rip-off” ment Taiwan not as it currently does the Communist Chinese Mainland. So things do change with time.

People tended to use anonymous handles for a number of reasons partly because it was part of the original “Hacker Ethic”[1], partly because it “leveled the field”[2] and yes alowed women to participate without having to admit being women or being singled out as has happened in other places.

When @Bruce started the Friday Squid page it was a very low bandwidth page and as it came out at the end of the working week, I put the occasional “something for the weekend” joke or link to something wierd but ammusing on it just to get a smile or three from people. @Nick P and myself used to discuss wierd items vaguely related to technology, esspecially when it felt like there was more to the story than you were reading. This developed into linking to other Technology Items that would be of interest to people, some of which @Bruce would later use for a blog page.

It was around this time that “the usuall suspects” had very long discussions on research items, these we tended to do on blog pages that had gone quiet as most people had said what they wanted to on the subject of the page. I even got nominated a couple of times for the longest posts.

However then as now people would drop new links on the latest blog page often in the first few comments which was disruptive because you would have two or more active conversations on the same page. Thus I would point out I usually put such things up on the Friday Squid page and others quickly did likewise.

@Bruce kindly let us get away with it, and as you can see it’s now one of the more popular pages even though it can be quite chaotic at times. But for reasons nobody realy knows it appears to work surprisingly well most of the time.

One rule @Bruce had was “no politics” back in the early days this was easy, there was lots of suitable technology being developed and by and large politicians were keeping their noses very much out of technology.

Things have changed due to the likes of the various IC and LEO entities politicians have had their noses dragged to a new feeding trough. Where they have discovered a trove of money and influance that feathers nests and gives certain of the less desirable of their ilk power they neither deserve or should be alowed.

Thus politics in the non party form was becoming difficult to avoid. Many had hoped that Crypto Wars One had seen the back of the IC and LEO influance. Unfortunatly that was not the case they crept back little by little with a poisoned earth policy coupled with a “Think of the Children” FUD campaign that when coupled with certain terrorist actions had a new rod to beat politicos with. This was the “blaim game” put simply every time something happened out of fear politicians handed over more resources without asking questions through fear they would be blaimed. It got so bad you could think up something totally impractical spin a “but how do we stop the terrorist using it” type tale and get a few millions in tax payer dollars for “research” then make a few promising noises a little later and sell your company for many more millions and become not just rich but an “Industry Name” a few “rinse, wash, repeate” cycles and you could be earning intetest from the likes of Forbes… Which in part is why @Bruce coined the term “Security Theatre”.

It was a turning point where human behaviour and politics could nolonger be ignored they were now too tightly coupled to technology.

Then unfortunatly things got worse a lot lot worse. Criminals had seen that most physical world crimes had an equivalent information world equivalent. For various mainly political reasons Intetnet Crime was quite deliberately ignored by LEO’s in part because solving it had no political benifit for them, it was not on the politicians list of campaign promises or policies. Being “Hard on Crime” was a physical world problem, with new private prisons needing to be filled so that campaign kickbacks would happen Crime Fighting concentrated on those at the bottom of the socioeconomic pyramid, where they had no opportunity to defend themselves, especially when coupled with inherent racism, plee deals and those private prison kick backs, that even judges were putting their hand in the cookie jar for one way or another.

Thus those criminals with above average intelligence started moving to the more or less safe haven of the Internet to commit their various crimes. The only important thing was to keep the individual crimes below the various investigatory bars, thus not get investigated in any given small geographic area. The big advantage for the criminal was that they did not have to be physically present, thus they could run hundreds, thousands or even hundreds of thousands of crimes simultaniously with about the same effort a single physical world crime required. This “army of one” approach actually paid bigger dividends and for less risk…

Thus our politicians were actively encoraging cyber-crime by looking the other way as there were no eye-catching kick-backs to turn their heads to see it.

The Obama Administration was a marked change in previous political behaviour. Basically Barack was a “Cyber nut” thus it got Whitehouse interest. DA’s were actively encoraged to pursue “show trials” against cyber-crime. What happened mostly did not involve real criminals but protesters and cyber crime kept climbing. This was because the LEO’s had taken no interest in solving Cyber-crime thus had no feet on the ground.

Like it or not the Obama Administration pushed politics into the heart of technology, they were now joined in a way they could not be seperated again. Which gave rise to a dark side in politics, where crime and voter encoragment could use the exact same methods.

Since then politics especially party politics has gone down hill and people being people will either ignore it or be vocal about it, but thankfully rarely take physical action. The Internet had become a place where those who were vocal had a new place to shout their views where ever they could.

This was unfortunate, @Bruce has always tried to run this blog as though it was a social event you might hold in your home. That is guests were welcome but there were behaviour conventions you would expect at any civilised social gathering.

Unfortunatly as we know, a good many people think incorrectly that they can be anonymous on the Internet, thus they do not limit their behaviour to social expectations. Others very much at the top of the US technology pyramid who had been present at one or several Obama “fire side chats” realised that there was a great deal of money to be made from fostering anti-social behaviour on the Internet. One such set of people are slowly being uncovered by the investigation into Cambridge Analytica and it’s relations to election rigging. Whilst being somewhat discrete CA has advertised it’s services around the world picking up a large number of clients that most would wish they had not.

Who was the first to use the Internet as a political tool is up for debate, but one thing is certain that CA pushing their services would have started “me to” activities in many places such is the nature of what is seen as “Easy Gain” or “Money for old rope”. There are several names of various US funders that are considered “too right wing even for the GOP” that keep cropping up and even “Mr Facebook” in his sociopathic way realises there is a major storm coming as a result of these online activities he amongst many otherse were turning a blind eye to as long as it brought in hard currancy.

The problem is that such behavious whilst being “one man’s meat” are very much “another man’s poison”. Those exhibiting the behaviours will of course also use places on the Internet where they don’t have to pay, as long as they are putting their message out, they will just as Spamers used to do take any liberty to make a profit no matter how small.

Thus back a few years ago, political comment of a more party or personal orientation, barely at best related to technology or security started to appear. Our host @Bruce could see it was detrimental in many ways both near term and longer term, thus sort as best as possible to limit those behaviours, whilst trying to maintain the blogs basic ethos.

To say it was a struggle is perhaps an understatment of some weight, 2016 for many reasons became a compleate nightmare for many many people, not least because it showed up the many many failings of the representational democracy model and it’s various implementations. Some of these such as electronic voting systems are both technical and security related, likewise the crass mishandeling of voter data by those responsible for maintaining it. As these are just the very top of the tips of ice burgs that occasionally get seen through the fog banks, it’s clear there is a lot more much of it social and party political mixed in as well.

It is increasingly difficult to maintain a divide between technology / security and politics of all forms and I don’t envy anyone that task.

Anyway I hope that has answered you and others questions a bit on the history side of things.

[1] This was when a Hacker ment somebody who was skilled in practical problem solving ways, and like NASA’s “Steely eyed Missile Man” was a badge of honour and respect. It had no connection to criminal activity back then as the computer crime that we see today had not yet happened, what there was back then was “white collar fraud” in financial institutions, which was condemed by just about everybody alike. Much as in early CB culture a person would “pick a handle” to be known by, often it might be a variation on a nick name, mine certainly was, but it was usually unique and memorable oh and often less than eight charecters long. Also back then your skill set almost always included high proficiency with wire wrap tools, side cutters and soldering irons as well as shoulders like an American football player due to the use of KSR and ASR TTY devices, there was certainly no “keyboard on your lap” operating unless you wanted to go to hospital for reconstructive surgery. Oh the reason for the short handles, RAM and EPROM back then was still up in the significant fractions of 1USD/KByte even on 8bit machines so there were real storage costs, and 10MByte hard drives, well lets just say people earned less in a year than they cost, even floppy drives that were then 8″ cost more than a months take home pay.

[2] This was at a time when the cartoon picture of a black labrador with a paw on a mouse had the caption “On the Internet nobody knows you’re a dog” was still fresh.

Clive Robinson • August 5, 2018 12:04 PM

@Bruce and Those living in the UK.

As you may or may not know a number of banks are starting to send out forms asking where people want their PPI refunds payed to, and it can be in the thousands of pounds.

Well atleast one major UK banking group uses the return address of “PO Box 140 Normanton WF6 1YA”.

A little bird told me that scammers are trying to get at the “where to send the payment forms”.

I was told the scamers pretend to be a Debt Councilling advice service and use scarry language to frighten people into not opening the envelope. They do however have links to a fake Debt Managment Company, who will make all your problems go away…

Well I was a little sceptical so I thought I’d give it a try. So I put the return address into Google and low and behold this is the top link given,

http://dontpaywonga.co.uk/p-o-box-140-normanton-dont-pay-them-back-read-this/

It is as described to me by my little bird. However I have not followed the links on the page to the Debt Managment company as they look very suspicious as they are. Oh and the company “Wonga” is as far as I am aware nothing to do with the return address[1]

So if you do get a letter that you don’t recognise and you do decide to check the return address (generally wise advice) check not just the first few that come up but a few further down as well.

And if in the UK and you are being harrased by debt collectors, keep a diary of the harassment and visit your local Citizens Advice Bureau or your local councilor / MPs open sesions, they will atleat point you in the direction of legitimate advice and help. It often turns out people do not owe any money (people who left EE Mobile Phones, health clubs and many online services for instance) or the debt collection service are behaving illegaly.

Oh and the usuall advice “Never give Personal Information to those who do not have an absolute legal requirment to have it, then think twice”, after all “Genie’s are easier to keep in a bottle than it is to put them back, once they have got out”.

[1] Wonga are however one of the 1000%+ pay day loan companies that have a reputation for dodgy behaviour and appear that they are close to bankruptcy,

https://www.theguardian.com/business/2018/aug/04/wonga-investors-stump-up-10m-to-save-payday-lender-from-going-bust

Clive Robinson • August 8, 2018 9:38 PM

@ echo,

Listening to the blurb was interesting as the SAS is predominately a physical exercise but the basic protocol is flexible in lots of ways.

It used to be called “basic selection” and even for the “part time forces” varients of the special forces it was tough going.

Yes you could cheat the tests in various ways, but then at the end of the day who would you actually be cheating?

All the first part of basic selection is about is weeding out those who either do not have the physical ability, or do not have the pressence of mind to apply the ability in testing circumstances, or are just unlucky and break a bone or similar due to inattention.

For instance you could have the ability to do an hour long 40cm rise step test in full kit, but could you put in the same level of performance with having to map read your way around a very foggy Welsh mountain range[1] knowing full well that there are 600ft drops from knife edge pathways?

How about the same level of performance but over a rapid timed 15mile route up over down and back up and over again the mountin that at just under three thousand feet is the tallest point south of Snowdonia[2]?

Trust me when I say that the physical level is realy the easy bit, it’s the keeping your mind not only sharp but focused in sometimes quite appaling weather (it killed some soldiers three years back in weather not that much cooler than present).

But… the dance[1] is done after a week of other quite grueling physical and mental tests, where your best friend is a large container of Radox or similar bath salts to get the crap out of your muscles when you get the chance to soak in a very hot bath.

The places the special forces have used for basic selection are fairly well known and have been for something like fifty years[2]. If you fancy taking a walk up there for the view I would thoroughly recommend it. If you are a little more adventurous you can actually walk over what is in effect seven peaks in a day of walking and it’s not as tough as the contour lines on the map suggest, if you pick your route with care[3]. The last time I was up there I humped up around 35lb of radio equipment and worked “HF Portable” “just for the craic” as they say across the water.

But if you feel brave and want to have a go at the fan dance, there is a public version you can have a go at that is nearly the same route. And yes some disabled people have compleated the course including amputees.

I would still go up there today, but officially according to the Doctors I’m supposed to have a “guardian” just in case I “do the usual”. My son is not adverse to the idea as he’s developed an interest in SOTA as it’s now called. But others are not keen at all on us doing it…

[1] Officially “Exercise High Walk” it was more commonly called the “Fan Dance”[2]

[2] The mountain range is in South Wales / Brecon Beacons national park, and the “big one”, Pen-y-Fan at a little under three thousand feet is the lump of interest. There are several routes up but one being only 18″ wide for much of the way is perhaps the fastest. But if you don’t like the idea of looking down at sheep that look as small as match heads I’d take the more normal route.

[3] Back last century whilst still in my thirties, I did the seven peaks in the early morning through to early afternoon one Saturday, got back to London for a party and danced through the Saturday evening and into the morning. I awoke later that sunday and found I could hardly move and my legs were as though made of oak trees. I hobbled about like a criple for three days whilst the crap cleared out of my muscles. Then atlast I could get back to jogging the eight miles to work again. Thus I would recommend people “warm down” properly if they are going to daft things 😉

Clive Robinson • August 8, 2018 11:09 PM

@ echo,

… because they imply, even if this wasn’t the intent, that somebody who doesn’t talk about more technical engineering issues or has the right kind of academic qualification or professional certification is thrown in with the herd of yahoos.

Taking it in reverse, I’ve kind of made it clear in the past that it is the industry as it is currently managed where the fault lies. The “yahoos” if you like are the “bells and whistles today, stability and security some time never time” advocates that have shapped the industry the way it is. At the end of the day you do what the man who cuts your pay check says or he’ll stop cutting yours…

As for the issue of accademic qualifications etc I again blaim the industry. Most CS courses do not teach the fundementals well enough that they actually become the basis of transferable skills. In the UK certainly outside of a very few unis Industry dictates via “sponsorship” etc what gets taught after the first year. In essence they get taught what the industry thinks it wants, not what it actually needs. Much of the focus is thus on particular tool chains, and library interfaces not on general methods. In many cases students do not get taught what would be regarded as “basic engineering techniques” that those training in engineering disiplines usually do such as basic testing techniques.

I could go on but in general it’s not the students fault. They get taught by what would be mathmeticians if they could get into that faculty, to specifications from business managers who get told what is required by those trying to play for the marketing department.

I’ve previously noted that the term “software engineering” should be dropped, because CS courses do not teach engineering in any form an engineer trained in electronics, areospace, etc would recognize. Heck I know “surveyors” that take more of an engineering aproach to the way they work than many in the software insustry.

I guess what you call “more technical engineering issues” I call investigative research. It’s something the curiously inclined gravitate towards. As I posted just a day or so ago the “usuall suspects” were of all levels from just starting out in their training to grizzeled old gits with 1960’s pony tails, beards and even sandles I guess if that’s the mental picture of an aging nerd of “guru” status you have.

As for being sexist, no, unless people “self declare” we tend to follow the idea of mind of indeterminate gender. Not to be PC or whatever the modern equivalent is these days, but because it’s the mind and what it thinks that appears as the words here, not anything related to gender (unless some one talks about gender issues).

As for “the old days” yes they were quite technical, but the reason as I have also pointed out was those of a political ilk had not thrust their snouts into the potential money trough computer security was becoming.

Personally I would like to see way more capable minds commenting on this blog as more points of view means more discussion thus more thinking. Importantly a persons point of view is based on their life experiences, as is their thinking process with regards the language they speak. Thus I want more perspectives and different thought processes here, which means I do not want the echo chamber effect of SWAM [1]. But it also means I’m not interested in mono thinking and parroting, because originality of thought is what makes me think, consider and evaluate.

The problem I have with saying “we need more women” is it’s like saying we need more vegans or people born under Sagittarius etc. There is no real correlation between them and the itch to be curious about the world around you or in that part of it computer security is expanding into.

Thus the question it should raise is “how do we make computer security more interesting to women / vegans / sagittarians etc. Because just pushing women through a door to make up an arbitary head count in the room serves nobody well, and is only going to cause resentment.

Yes I can understand why women might want to head in the opposit direction at high speed when it comes to mainly male environments, and I object as strongly to the behaviour of some in such monosex environments as those that feel they are in effect treated as “the enemy” or far worse.

Which brings us to the question of how to dissuade what is objectional behaviour from those inside the environment to those currently outside?

In part it’s a catch22 issue, we need a significant prescence to make it an accepted norm of the environment, where all in effect, not just word have equall status.

I’m open to all suggestions that don’t involve overt or covert compulsion or other method that will cause resentment or even 180 discrimination, that is they need above all else to be fair and equitable to all. As the statue of Justice on the courts at the Old Baily indicates often the best solution is to be blind.

I do not know how many women on this blog there are, and generally I don’t want to know, because I don’t want myself or others to be biased.

However it is difficult to keep things hidden, as an example certain typing mistakes indicate that some people may well be left handed, certain turns of phrase what geographical region they are in, have spent time in, or their formative years in. Judging people is part of what makes us human and has and still is a survival trait.

The skill is being able to divorce that judgment process from the point of view and reasoning process the individual demonstrates.

[1] For those unfamiliar with it, SWAM stands for “Stale White And Male”. A complaint that came about through comment about politicians and the makup of their parties…

Clive Robinson • August 9, 2018 9:55 AM

@ Wael,

The argument put forward by some –without real knowledge– is that Lenovo were “in on the secret” that Uncle Sam was not as it was a Chinese company…

However I likewise have no knowledge, so when some one who verifiably works for Lenovo in the US says it did not leave the secret did not leave the US, it falls to a balance of credibility.

Which kind of makes Lenovos person fractionaly ahead on “knowledge” of the matter. However I still have no evidence of their reliability or those around then.

So the jury is definitely not even at the consideration stage.

Clive Robinson • August 10, 2018 10:47 AM

@ echo,

I don’t know about this space force thing. It seems like an ego thing and I cannot see how it helps with social and economic issues.

Part of the problem is that people get to feel quite unclean when they realise that “what is good for making war” is actually of more use “building the economy”.

It does not matter if it’s art, artisanal, engineering, or science, war is so often an enabler that we don’t realise what then follows would probably not have happened without the conflict.

In war often the most vital place to take and hold is “the high ground” it generaly improves everything for those on high whilst being quite detrimental to those on the low ground. At it’s simplest you can see further the higher you are thus you can see much much further and thus have greater knowledge.

Economics is likewise about better or more extensive knowledge. Knowing what tommorows weather is going to be helps many people in many ways. So knowing the likely weather for next week has much greater utility. Likewise movment of other things such as fire and pests like locusts, wasps and other insects can be predicted almost as well as weather. Which also includes the “ultimate pest” mankind be they marauders, migrants, or just the displaced.

The list goes on and on, space is in effect the ultimate high ground not just to observe, but deploy forces under your control. It works for both war and economics, which means you gain both political and economic power over those not on such high ground.

Space is also belive it or not “a vital resource” and is becoming more so by the hour. Looking at the history of “rights” for water and grazing and the repeated conflicts they caused should give most a reason to “pause for thought”.

As I’ve noted several times in the past the next “resource wars” will be about energy. It’s fairly clear the US and China has decided to “button up” the second and third worlds inherant resources and prevent them developing independent reliable alternatives such as nuclear energy etc. The name of the game is the same as with drugs pushers “Make them dependent, then bleed them dry before you turn them into vasals to be exploited as less than slaves”.

In effect the problem with “green energy” is it is “unreliable” and many of the raw resources required are now much as oil was in the 1970s a source of “political control”. Research has got to the point where we know that collecting energy in space and using EM systems to transport it is within a lifetime of development.

Controling space in effect gives the same sort of control but of a much much larger sphere of influance as does the Russian supply of gas to various Eastern European countries.

For those who were adults in the 1980’s Margaret Thatcher publically made it clear why the UK could nolonger hold on to Hong Kong. Both the water and energy supply came from the Chinese Mainland, and they frequently “turned the tap off” to make a political point. Thus they could turn it off long enough to reduce the over populated area to panic if not death, with little more effort than pressing a button.

It’s this level of political control on earth that the control of space would give a nation in just a few generations time.

But it goes further, the earth has finite physical resources, there are vast disks of resource rich rocks just floating in space waiting to be exploited by robotic systems, likewise controlling what is in effect “the gateway” again would give immense political control.

These are the sort of stakes neo-cons and the like salivate over. Likewise the larger Corporates. Imagine if you will the likes of Facebook or Google not only controling your information supply but that of energy and raw resources. Have you any idea what rent they would seek off of such power? Now ask yourself why they are getting heavily into autonomous vehicals both for the road and sky, and how quickly they would do the same for space?