Schneier on Security

1&1~=Umm • March 9, 2019 5:37 PM

@Bruce:

“Is there anything squids aren’t good for?”

Well… I would probably be banned if I gave a list 😉

On the protiens for plastics side of things few realise these days the connection between cheese and plastic, and the fact they might have buttons on their clothes that with minor differences in processing would have been cheese…

In mammalian milk there is a protien that is tightly wound up and does not form clumps. However the use of an acid, enzime or microorganism causes this protien to unwind and thus clump together. We call the clumped together solid as curd or junket with the remaining liquid called whey which contains sugars and other protiens, which can be used to make a twice or ‘re-cooked’ cheese we call ricotta.

What type of cheese you get depends on the curd which it’s self is dependent on what method you use and the temprature at three stages in the cheese making process (it’s why making cheese with pasturised or ultra heat treated milk is at best difficult).

If you over heat the curd then milk fats get driven out and the resulting protien will with a little work like kneeding bread or stretching pasta lock together in a particular way. Thus the real difference between casin the plastic and mozzarella cheese is the heat and to a lesser extent the amount of acid used.

So I guess the question for @ALL to find the answer for @Bruce is ‘Can squid protein be used to make cheese?’

https://www.wikihow.com/Turn-Milk-to-Stone

1&1~=Umm • March 9, 2019 6:35 PM

@StunGun:

“Interesting attack vector”

Whilst this instance is new, the idea behind it ‘servo positioning’ is not new.

There are devices such as force balance measuring scales that can measure fractional fractions of a percent of a gram. They do this by using the same basic moving coil mechanism as a speaker you would find in your HiFi.

What happens is a small light weight plate replaces the speaker cone and the assembly is tipped through 90degrees such that the coil moves vertically lifting the weighing plate against gravity. Out of sight under the plate is a reflecting surface and an infra red laser configured to work in the same sort of way as a mirror galvanometer. This is used in a feed back loop to keep the plate at a precise hight.

As mass is added to the plate it is attracted by gravity towards the approximate center of the earth. Which pushes the plate downwards, to counter act this the servo mechanism pushes more electrical current through the coil. Thus the current is proportional to the mass of the plate and what’s on it. Current can be very precisly measured in a number of ways.

The problem with such weighing scales is they are sensitive to movment such as tipping and mechanical vibration. This makes the design of the servo loop difficult as sound waves cause the plate to vibrate and thus act like a very linear microphone.

There are quite a few other highly sensitive servo systems around that people are generally not aware of. One of which is that of the Phase Locked Loop used in nearly all technology these days to control the phase thus frequency of an oscillator.

What even few electronic engineers realise these days is various components such as inductors (coils) and capacitors are transducers in their own right and minutely change their values due to mechanical movment or vibration. The result is that the oscillator will change frequency in response. This process is known as ‘microphonics’, and the PLL will try to correct the change in frequency by changing the servo loop voltage on a vari-cap diode.

With suitable filtering components in the servo loop microphonics can be greatly reduced. However the loop voltage contains the correction voltage which is in effect the inverse of the mechanical movment or vibration so is in it’s own right the same signal you would expect from an electret microphone.

You also get a similar effect in some high efficiency power supplies such as those that are ‘series resonant’ some of the coils will suffer from microphonics and the power supply control loop will correct it thus have a voltage or current proportional to the audio signal.

In all cases the hard trick is not bringing the servo loop to the point it behaves like a microphone, although it can be difficult. No the hard trick is getting the loop signal out to some other stage such that it can be not just amplified but also made available remotely.

This is where high speed microcontrolers come into their own. The old fashioned way to build a servo loop was with amplifiers and analog components. These days it’s both cheaper and much more effective to use Digital Signal Processing technology and have communications to other parts of the system by high speed busses. So small changes in the microcontrolers software held in Flash ROM makes the recovery and transmission of the audio signal possible.

Thus from a security asspect the use of a microcontroler to do servo control is a backwards step.

1&1~=Umm • March 10, 2019 7:16 PM

@Bob in OK:

“I first thought was a great parody. Then I shifted to thinking it’s just depressing and real.”

First you need an antidote, to get back the smile factor,

https://m.youtube.com/watch?v=Qo52KfvdUUY

Have you watched the video @Bruce posted a couple of days ago?

In there listen to what he says about code quality. He mentiones as the good examples areospace and NASA, the implication is the rest is well… Unfortunatly with a few other infrastructure and lower level exceptions you are going to get a lot of nods about the lack of quality in a lot of code.

To some people including many in the software industry its self, there are only two types of programmers ‘App developers’ and ‘Full Stack developers’, pause for a moment and consider what that actually means. Then have a think about what the ‘full computing stack’ realy is.

If you have to look at apps and web software from a high overview they are realy like the bubbles on a bath of bubble bath. They hide what the bath is realy all about and by and large they are very very short lived. Like all bubbles they burst easily and it’s very easy to make loads and loads more that all realy look the same.

Because of this very short time to live, any profit has to be not just made quickly but reinvested in the building of a new bubble before the existing one bursts, the old economic ‘grow or die’ model. Unfortunatly as the PC Games market is finding, their bubbles are poping faster than people want new ones. I guess because they have got out of that particular bath etc. It’s not just games it’s also applications, some people are still using win XP and Office 95 and won’t change untill some part of their hardware breaks and they are forced to change because of it (unless they find some smart bod who will get it all going in some virtual PC emulator of some form).

Thus the software industry is switching over to ‘cloud computing’ in various ways such as ‘software as a service’ where you subscribe to an application and after a year of use you are still paying a 10% tieth each month on what it would have cost to outright ‘lease’ the software on your own computer.

In effect the pendulum has swung back again, to what was once called ‘thin computing’ and a few swings before that ‘Terminal Server’ and likewise ‘Big Iron computing’. But this time you don’t have ‘the dog leash’ of a network or serial cable tying you down you can be ‘mobile’ and walk under a bus as you work down the street.

The point is the software bubble industry needs very high churn, which means quality is at best superficial and code is far from secure and mostly unstable with of you are unlikey organic grown spaghetti code that gets refactored more often than most people wash their hands let alone take a bath.

Whilst those in the software bubble industry talk as though it is the only game in town it’s not. There bubbles are highly dependent on things that are a lot more solid. They are at or above the notion of the ‘presentation level’ with a whole stack that gets increasingly reliable as you go down it.

If you want to spot the software bubble industry types ask them what language they would recommend beginners learn and it will be ‘webby’ either for the browser or mobile or server such as scripting or interpreter. The reason for scripting or interpreter is the very fast tool chain cycle. This tends to alow single line code and test programing, where as thoughtful design was a real requirment which you had to have if a build took all weekend, and the boss got their hands on the build logs monday morning before their first coffee.

When the expression RAD came into vogue the idea of the method was to ‘script’ a frontend prototype up using unix like command line tools and try it on the users. Then having knocked the buggs out of the specification and other design documents start writing the frontend in C or some other system level language to get a usable execution speed, and bring in what was required of the backend functionality to support it.

These days there are few specification or design docs other than a ‘mission statment and wish list’ for front ends, and that wish list changes faster than the lead in a drag race. The unsexy backend though hardly changes and is now at the point where it’s functionality can not be taken out and stability of the interface is generally reasonably high as is the up time. Thus we have two very different tempos, that just can not meet up without a chunk of translation in the middle, hence the notion of middleware, that does a lot of the business logic.

Oh another way to spot presentation layer developers talk to them about data flows and how they deal if at all with bi-directional data flows especially when it is for down stream events and errors being passed up, which are absolutly essential to stop data loss or corruption to ensure reliability and thus availability, just remember to be ready to duck as the arm waving starts.

The moral is that you need good solid foundations to build a house, good solid structure if it’s to be more than a couple of floors, but all the people who live in it see is little of the architecture but a heck of a lot of interior furnishings. Most people can paint a wall and move old furniture out and new furniture in. But if you wanted to build a new hotel would you consult first an architect, an interior designer or a party planner?

Each has their own expertise in a particular domain but there is a hierarchy and it’s best to select the right person at the right time and for the right reasons.

1&1~=Umm • March 12, 2019 7:23 PM

@Vas Pup:

“US seeks to allay fears over killer robots”

Not unrelated is,

https://www.independent.co.uk/news/world/americas/us-politics/trump-planes-complicated-fly-pilots-boeing-tweet-a8819396.html

For all the ‘Oh silly Donald’ style comments comming back he is basically correct, aircraft flight systems are getting overly complex, but perhaps not complex enough, the electronic version of ‘A little bit of learning…’.

Whilst the US President did not say in his tweet that he wanted the Boeing 737 Max 8 grounded pending investigation results, other US politicians certainly are,

https://www.businessinsider.com/lawmakers-urge-faa-ground-boeing-737-max-8s-after-deadly-ethiopian-lion-air-crashes-2019-3?op=1&r=US&IR=T

Whilst other Countries have issued tempory flight bans, the Chinese civilian aviation authority has apparently directed on Monday that the planes to be “‘grounded indefinitely'”. It said the order was “‘taken in line with the management principle of zero tolerance for security risks.'”

Which might be a valid point of view as well. Because it is thought by some in the industry that the Ethiopian aircraft ET-AVJ which was a new 737 Max 8 delivered Nov last year and had about 1200 hours flight time total, actually flew it’s self into the ground. In a similar manner to that of a Lion Airlines Max 8 that flew into the sea in Indonesia less than five months ago.

What has been said is that because the auto-pilot has an obscure and not correctly documented anti-stall feature rather than just a more traditional stall warning, it is thought that the pilots were to busy fighting the auto-pilot to take the right corrective actions.

From a Bloomberg report[1],

“‘The FAA and Boeing have been finalizing a software fix for an obscure anti-stall measure created for the 737 Max that came to light with the Indonesia tragedy. The Maneuvering Characteristics Augmentation System, or MCAS, triggered by an erroneous sensor reading, had baffled pilots by pushing the Lion Air plane downward dozens of times before it crashed.'”

“‘The Lion Air tragedy in Indonesia, like the Ethiopian Airlines crash, occurred shortly after takeoff. Data from the Indonesian jet’s flight recorder showed that an errant sensor had signaled that the plane was in danger of stalling, causing the MCAS software to push the aircraft’s nose downward.'”

And,

“‘The pilots on the Lion Air jet counteracted the movement repeatedly, but the cycle repeated itself more than two dozen times before the plane entered its final dive. The accident inflamed controversy over pilot training for the 737 Max, since Boeing hadn’t flagged the anti-stall feature in training materials or most flight crew manuals.'”

That is, it is being speculated that the 737 Max 8 auto pilot anti-stall had put the aircraft into a nose down attitude very shortly after take off and thus unsurprisingly the aircraft went down not up or leveled off.

Ethiopian Airlines who generally have a good reputation for professionalism in the industry have reported that the black boxes and flight data recorders etc have been recovered, so hopefully we will know the cause fairly soon.

[1] I’m aware that Bloomberg have a bit of a reputation issue with technology and China in particular here and in other places, so treat it with due caution,

https://www.bloomberg.com/news/articles/2019-03-10/ethiopian-airlines-flight-to-nairobi-crashes-after-takeoff

Especially as the reporting on China’s actions have down graded in the report (see 4th paragraph that has been editorialy adjusted post original publishing).

1&1~=Umm • March 12, 2019 11:20 PM

@Bong-Smoking Primitive Monkey-Brained Spook:

“Thou canst not every day give me thy heart”

‘Yet I would not have all yet.
He that hath all can have no more.’

An interesting choice and +5 for knowing the poem well enough.

For some reason as the clock ticks down this keeps comming to mind from the same author,

If a clod be washed away by the sea,
Europe is the less.

1&1~=Umm • March 13, 2019 8:09 PM

@Sherman Jerrold:

“who(m?)”

Ahh another ‘oxford comma’ type problem, to scratch the head over.

To many ‘Whom’ is just the posh version of ‘who’, and yes they do appear interchangeable. But technically not the usage is importantly dictated by a rule…

The rule –according to my little book,– is effectively,

“‘Who and whom are both interrogative pronouns, the difference between them is that, who denotes the subjective case, and whom denotes the objective case.'”

With two helpful examples of,

“‘Who are you looking at?’ (subjective) or ‘Whom did you give it to?’ (objective).”

Which I must admit tends to reinforce the idea of common-v-posh 😉

Now if that rule makes sufficient sense to you that you can be definitive about it, please come back and let the rest of us know, myself included… 😉

Yup I know me-v-myself… When will it ever end 🙁