Schneier on Security

Clive Robinson • February 22, 2020 2:08 PM

@ Gadfly,

Does anyone have any comments on mozilla.org’s recently announced “firefox send” file transfer utility which promotes its end-to-end encryption?

I can only give you general indicators. But,

1, Mozilla’s code base is now way to large and complex to be considered secure.

2, The least likely compromise of the system is the crypto algorithm, these tend to be standard and well tested/reviewed.

3, However crypto modes that make the algorithms usable in practice can be easily done incorrectly or have subtal issues. These tend to be standardised, but in the past they have been found to be defective for various reasons

4, The most likely compromise of the actual crypto is through “Keying Material” (KeyMat) issues such as mishandling via poor Key Managment (KeyMan) or poor/predictable/backdoored entropy used for “Key Generation” (KeyGen). Outside of a very few select hardware designs I’ve yet to see a software implementation that addresses both issues in a secure manner.

5, The next most likely compromise of crypto is via “side channel leakage” and other implementation issues. Testing for this can be difficult and complex. AES for instance came “gift wrapped” via NIST probably on the advice of the NSA with side channel leakage of KeyMat. It’s why I always advise that crypto both encrypt and decrypt be done not only “Off-line” but on a fully issolated or “energy gapped” system. Because not doing so leaves you vulnerable to implementation issues you have not found, don’t know about, or have been turned on by an adversary since you tested.

6, But it’s not just crypto compromise you have to consider, there is plaintext compromise as well. The application code will almost certainly be written to use libraries, an OS, and run on FMCE hardware. All of which are known to have hundreds of vulnerabilities each. So why as an attacker compromise the crypto and it’s implementation if you can simply “end run” attack the application and get at the plaintext interface between the application and the actuall user interface of keyboard and screen via IO shims etc. Again even though you can test, you won’t find all the possibilities because you don’t know about them all or they can be turned on or installed via update etc after you have tested. Thus the only way is again through the mitigation of segregation by “energy gapping”.

Thus the simple advice is,

Trust not, thus mitigate.

Which leaves you and fourth party attackers with all the fun of KeyMat especialy KeyGen and KeyMan issues.

But keep a carefull eye on the third party to your communications Mozilla, they could easily have used crypto modes incorrectly that could weaken the communication, or included a rather dumb “negotiation” protocol that a MITM attack could exploit etc etc. That is why “encrypting to file” to get “data at rest” first then sending it by a standard insecure P2P comms system is better than direct on-line communications. Oh and never use anyone elses KeyMat, you and the second party should have an entirely seperate secure side channel to transfer KeyMat. In diplomatic and similar government entities KeyMat is often “hand carried by trusted courier” in a diolomatic pouch etc.

Clive Robinson • February 22, 2020 6:09 PM

@ Anders, ALL,

SARS-2 is not just in feces, it’s also in urine.

This is actually a very important thing to note, due to the way men take a leak in urinals, aerosolisation is guarenteed. So public toilets especially mens in or around transport hubs, shopping malls, places of entertainment will quickly become major disease vectors in their own right.

Oh and the Chinese are trying some on the surface strange drugs. Anti-malarials like chlorquinine and some HIV drugs.

The NSAIDs are out, whilst they do have an antiflamitory propety in essence they work on the hypathalmus and make you feel better but actually inhibit the immune system. Still no mention on anti-histamines yet…

@ SpaceLifeForm,

Incubation up to 28 days.

For the majority it’s allegedly 12.5 days but the range is 2-unknown. That is whilst there have been a couple of cases over 21days with one at 28days it’s actually possible for some one to have the disease and remain asymptomatic for a considerable time, untill the virus has killed enough cells that it destroys part of the bodies basic functioning.

It’s believed that Type I diabetes may result from this type of asymptomatic viral infection.

In many diseases SARS-1 infections in particular, you did not “shed virus” untill syptomatic which is why it was successfully contained and eradicated. SARS-2 which is what gives you COVID-19 is totaly different, it’s believed you become maximally infectious jus a couple of days after infection, and remain infectious as you become symptomatic and right into what you might call the recovery phase. This means that it actually puts a significant strain on the body and thus sequelei are more likely.

That said at around an R₀ ~= 2.6 it’s not as infectious as chickenpox or measles.

But the math does not look good…

60% of the population is expected to come into contact with the disease within a year, of which 20% are going to end up in hospital, of which 17% are going to need oxygen support and 5% critical care support.

So lets assume a 50million population of the medium to large EU nations. Thats a million people needing oxygen treatment over the year. Worse 300,000 critical care patients. So 2732 patients presenting each day over the year with an average 21day stay so 57,000 hospital beds needed or 114 beds per 100,000 in the population.

The UK only has 100,000 beds in General hospitals reduced from 144,000 a decade ago. So whilst we could just about manage the cases over the year, there is not a snowball in hells chance of us managing a peak of 4-7 times those numbers. So if the projections from epidemiological modeling is even close to being accurate –and it has been so far– then people will die needlessly because of political “efficiency drives” aimed at trying to make hospitals more attractive for privatization to forign investors.

Clive Robinson • February 22, 2020 7:46 PM

@ SpaceLifeForm,

Recall my question, ‘logical decision?’

The question is in what context, to see that you have to ask two questions.

1, If they were not brought home what would have happened to them and others?

2, If as they were brought home what will happen to them and others?

If we study what has happened to other passangers “put on the dock” and left to fend for themselves, the answer is effectively going to be,

Go into a Japanese hospital that does not bode well for either them or the Japanese people (they don’t have the resources for their own citizens, a statment made by the Japanese Health Minister before talk of repatriation appeared).

Find their own way home by bus / taxi / plane all the time mixing with other people who have no idea that these people are disease vectors (call it the Cambodian solution from the other cruise ship).

Compared to keep all of the people together get them securely back to the US and put them all in quarantine with healthcare that is not overloaded.

Which brings up the “what of the tested clear” passengers.

Well remember what I said about the RT-PCR test kits and false negatives at low viral concentrations in the swabs?

Also the delays in getting test results, the 14 had already mixed in with the negatives and were on the bus when the results came…

In reality probably another 7-20 passengers were already infected before they got down the ship bording ramp, based on the way the numbers were going up (no doubt we will get reports at some point).

The point being all the passengers were treated as a group as though they were “a danger to society” thus reasonable issolation proceadures on the then available information were carried out for the group.

We will never be able to say for the group of passengers if it was the right thing or the wrong thing to do treating them as a group during transit. However now they are back in the US they can be separately issolated. The question is will the authorities do so? Back when it was “by droplet” individual issolation would have been fairly easy. Now there is good reason to believe the virus can be aerosolised “from both ends” and thus be airborne that’s a whole different level of game. However after the “Anthrax scare” such individualized issolation was built up for quite a number of expected casualties so we know it can be done.

But there is the “use another plane” issue. It’s simple to say but logistically? Totaly different matter, also the plane it’s self had already got an issolated section on board. Why this was has not been indicated, but sounds like contingency planning by someone. Contrary to what some think, passenger aircraft do have seperate air supply/extraction in different “classes” on a plane. Thus first gets lots of fresh air and little or no reserculation, business some, as for economy, you can tell the passengers from there when the get off they look tired irritated and muzzy headed for a reason called “fuel economy”. The point is the pilot has control over the air in these sections. So yes they should have been able to give seperate air, if they had known it was required, but at the time of leaving the ship “officialy” it was still “droplet not airborne”.

So the question as to if a second plane was required did not arise. If it had though, what would have happened to those 14 passengers for the next hours or days? Obviously they were not going to be alowed back on the ship, they could not stay in a hotel etc etc and there was no way you could keep them on the bus. In short they would have been a danger to “others” for quite some period of time.

So I’ve no idea what the CDC was thinking, they should have known it was not practicle or safe to leave the 14 behind in Japan…

So I’m guessing they were “Wallpapering their 455ES”…

But you also need to think about the non clinical asspects such as the diplomatic issues. We know Japan right royally f@@ked up the quarantine on the ship. Trying to leave the 14 behind would have been a golden opportunity for the Japanese to cover up that asspect in the news etc.

But also there is the faux millitary ethos of “leave no man behind” as wel as the “body bag syndrome” that is highly prevelant in the US. If the current administration had left those tested positive passengers behind and even just one died, or even became symptomatic on Japanese soil then that would have had a marked material effect in November you can be absolutly sure of that.

However if they do get seriously sick or die in the US on the army base under good quality care then it will be sad in the same way a cancer death would be. The sentiment would be “everybody did their best”…

On balance I think for all the passengers and US society it was the right thing to do. Likewise for the population of Japan.

I’m sure there will people who will disagree, and I can understand the emotion behind it, but will it have logic as well?

Clive Robinson • February 22, 2020 8:41 PM

@ Anders,

Coronavirus patient re-hospitalized in China’s Chengdu after testing positive again

I’ve kind of been expecting that.

The virus is a single strand of RNA which means minor mutations are possible.

One of the problems that arise with “viruses mutations” is what they do to the human immune system.

If you have had the original disease then you will have antibodies in your system that will attach to it that will cause the white blood cells to destroy the pathogen.

However a mutated virus can triger the antibodies poorly, that is they don’t quite fit. So rather than be destroyed by the white blood cell, they get into the cell and rapidly reproduce, killing the white blood cell.

Thus you will be infective with the new virus and when you become ill it will hit you a lot lot harder than the first infection with the original virus.

It’s what some think is killing the young doctors. That is they caught the original virus before they knew what it was, and being young showed little or minor symptoms like just a mild cold. However the virus has now mutated and when they get the second infection it causes a very server or fatal reaction.

It’s why I mentioned Dengue Feaver earlier, because it’s a “textbook example” of this mutated effect and it’s concequences.

Clive Robinson • February 23, 2020 6:08 AM

@ FA,

No surprise if you consider that this is coming from a ‘social sciences’ department that also produces papers on ‘gender bias’ and similar subjects.

How curious, what has CS at Chicago done to upset you into such a vexed state?

Clive Robinson • February 23, 2020 2:51 PM

@ FA,

What makes you think I am in such a state ?

Your very own paper unrelated words of,

No surprise if you consider that this is coming from a ‘social sciences’ department that also produces papers on ‘gender bias’ and similar subjects.

Afterall you did say them for some reason in the last paragraph of,

https://www.schneier.com/blog/archives/2020/02/friday_squid_bl_717.html#c6806337

But also why post on this squid page, afterall as you also say,

Re. the ‘microphone jammer’ mentioned on the previous squid thread.

If you had posted on that page then logically people would find it simply by “reading down”. But now no. So for readers in the future your appraisal of the authors, the paper and for some reason not entirely apparent other work by the Universities “social sciences” department will go unread.

Clive Robinson • February 23, 2020 7:03 PM

@ Anders, SpaceLifeForm, ALL,

From The Guardian Live Blog,

France should produce more vital goods, such as drugs and electric batteries, as the coronavirus outbreak highlights the danger of relying on imports from China, the country’s finance minister said.

It would appear France’s Finance Minister has broken ranks with the 1%er “Vested Interest” ranks.

What he is saying about “should produce more vital goods” is actually a “National Security” issue arising from “Outsourcing” and drive for profit by “efficiency”.

For several years I’ve mentioned on the blog and other places “Outsourcing” is a “National Security Issue” of not just strategic but economic importance. That is outsourcing “de-skills” then stops “technical education” and you enter a dangerous downwards slope of dumbing down the citizens… That History shows with the Spanish and “Conquistador Gold” and more recently “South American Oil Nations” never ever ends well. The money goes or becomes worthless and then the “idle rich” and those who served them as administrators, functionaries, and servants etc do not have any skills to make the essentials that keep them from descending into penury and poverty and all that follows.

I’ve also indicated as well, that “chasing efficiency” is beyond a certain point a “fool’s errand”. Thousands of millennia of evoloution has shown “efficiency beyond a certain point” reducess resiliency, makes living processess fragile and brittle and they almost always fail…

The underlying reason when you think about it is when you make a system more and more efficient you constrain it’s ability to react to change. In essence “slack in the system” sustains you over the “change period”, take out the slack and when change happens you fail.

The SARS-CoV-2 virus that has given us the COVID-19 disease is in eveloutionary terms a “hyperabrupt change” for humans. Even in human terms of near eighty year life times two to three months is sudden change on a societal level.

The flu pandemic of 1917 was devistating but tempered by two basic things,

1, Most economies were domestic.
2, Travel even though global was by todays standards slow.

There was also a third thing, whilst scant, electronic communications in the early 20th century by human standards were the same, thus news traveled as fast.

The result was that the time difference between news and disease arival was much larger, and nations even though at war had slack in their domestic economy that could help them prepare in time.

Some did but most did not, the result was that Medical advice was ignnored by Governments, who instead went on advice from industrialists that found war to profitable to want to change anything… There are various estimates for the total numbers of deaths and as a percentage of various nations and the worlds population. Percentages that perhaps we should think on.

As I’ve pointed out before wealth does not buy you protection from disease when society around you is sick. Because virii and bacteria do not pay deference to wealth, power and status, in fact it tends to kill more of those people because they are older.

Thus lets call it “enlightened self interest” should tell the vested interests and politicians what they should be doing. Which is,

Society before individuality or self.

After all if you have no society to speak of, then what use is wealth or political power? those left will probably blaim you thus if you are around are likely to kill you for the little you have left or as revenge (Which might account for those bunkers some have built, but with travel restrictions they might never reach).

Many industrialised first world nations can not feed even a fraction of their population, similar is true with US States. They depend increasingly on others, who ship food to them. The EU in particular have had several real world warnings about long supply chains the movment of food and infectious disease, and they have basically been ignored. I’m assuming the US has had a few warnings of it’s own over and above exploding high intensity swine farms.

Thus we have a problem that they did not back in 1917 with lower population counts and domestic economies…

To contain the disease spread we have to stop movment of both people and goods. This means we would also stop the movment of food… Which gives an interesting choice between, death by disease, and death by starvation.

But we know right now what governments are going to do. It’s based on the 1906 words of Alfred Henry Lewis[1]

There are only nine meals between mankind and anarchy.

Due to drives in “efficiency” we now have not only a “LEAN”[2] healtcare system we also have a “LEAN” food supply chain. Where LEAN is an ethos based on Kan-Ban and JIT.

A little while ago in the UK Kentucky Fried Chicken changed it’s “logistics” suppliers. They could not get things right food rotted in warehouses and on vehicals, and in outlets that got the wrong orders. Basically any place where it was not was being consumed by customers…

Thus “nine” meals from “anarchy” is more like two or maybe three at best these days. Not because there is not the food but because it won’t get to the mouths of the voters if world transport is stopped.

Politicians do not like even the tinyist hint of anarchy, because history showes politicians being hung up by their toes or being shoved up against a wall for high speed lead poisoning…

Which reminds me March is the start of the “Spring planting season” in many places in the Northern hemisphere, and in China in particular, where agriculture is still very much “human powered”. What do you think China will do? Because not planting will cause the food for multiple hundreds of millions not to be grown…

One way or another “LEAN” is going to give us “lean times ahead”. Evoloution has taught this process over and over but certain people have chosen not to listen what we most need is not just far away, but there is no slack in the system to alow time to make changes…

Thus the Chinese curse of,

May you live in interesting times

Appears to have come home to roost.

[1] For those who have studied “Civics” will know it’a a terse rephrasing given in Cosmopolitan Magazine of the earlier,

“Those of us who are well fed, well garmented and well ordered, ought not to forget that necessity makes frequently the root of crime. It is well for us to recollect that even in our own law-abiding, not to say virtuous cases, the only barrier between us and anarchy is the last nine meals we’ve had. It may be taken as axiomatic that a starving man is never a good citizen.”

From The Denver Post, 17 October 1896 in an investagative journalism piece titled “Further Facts in the Case of Mark Hanna.”

[2] LEAN is based on an idea from Toyota in the 1950’s which embodies Kan-Ban and JIT. The essence is to “Enhance what the customer wants and depreciate what the customer does not want” and thus to renove the “7 Wastes” from what many would call the “process chain”, “Value added chain”, or “Supply Chain”. The big problem is “waste” is subjective even within an organisation and much essential work the customer would never “want” let alone pay for is not waste, as it provides non obvious things such as resiliance, flexability and rapid response to the unexpexted events. LEAN is thus neither a recipe for success or a magic touchstone, and if used correctly could end up costing you more not less. Which means it gets “fudged” by managment consultants and others who do not understand the less obvious but critical or essential parts of a process. This leads to it’s incorrect use to drive down cost or increase profit, and thereby is the problem because almost the first target is “slack” which is incorrectky seen as “waste” but is actually essential for resilience, flexability and rapid response to events.

You can get an overview from,

https://www.scribd.com/document/247354401/Mark-Eaton-Uncovering-Lean-pdf

Clive Robinson • February 24, 2020 8:01 AM

@ SpaceLifeForm, ALL,

If you want to be stupid, and listen to the lying, paid-by-government disinformation folk, that have come out of the woodwork, go ahead.

Lying and disinformation from the Government and even NGO’s is to be expected.

For some strange reason way too many people think that paying their taxes entitles them to something, when things go abnormally…

The simple fact is politicians are more venal and greedy than most others and thus they see the tax take as theirs to do with what they wish. In the main that is to buy votes and feather their nests. However they also have to appear to have morals and look after society… Which is obviously a contradiction…

The way this contradiction is resolved is to “hollow things out” that society needs to pay off those who look after them.

The result is that most things society needs to remain cohesive are not just brittle but actually cracking up at normal times.

Thus the last thing the politicians want is what they would call “panic”. But if you look at it “behaving logically” would be a better way of looking at it.

For instance you have probably realised by now that “self issolation” is a probable reality in our near future.

This means having sufficient “independent” supples of “Food, water, energy” and even sewarage disposal.

I’ve already given estimates of the minimum you need in terms of ready to consume Food and Water, which is 1kg of food and 2kg of water per person per day for tgirty to ninty days.

By ready to consume I do not mean beans, rice, noodles and other effectively dehydrated foods because that will add another 1-2kgs of water. So what you gain one way you loose the other.

Also those dehydrated foods generally need to be cooked as well so that impacts your energy requirments[1].

Which if you’ve not been stocking up since I first mentioned “Pantry Living” means you have to go out and do a very large shop… Which people will notice in several ways, possibly to your detriment.

Due to “shareholder value” and other reasons just about everything these days has the “Just In Time” (JIT) mantra applied to it. Which can as we see be bad news around public holiday time, when it looks like Easter is going to be sunny anything “barbeque” vanishes from store shelves etc.

Now consider I go into your local store and buy up all the tins of corned beef, ham, chicken, sausages and other protein foods. That is I buy what would normally be a years supply for a couple of families in one go. The store due to JIT probably has next to no reserve stock, nor does the chains warehouse or for that matter the suppliers warehouse or factory.

Whilst you might get away with it others will notice and the smarter ones put two and two together and they likewise buy-up. It takes about 1-3% of people to do this before the store is empty or they start to whack the prices up or in otherways “ration-back” or atleast try to because thanks to JIT there is nothing in the “chain of supply”.

Empty shop shelves start “panic buying” this creates panic in other areas, soon crime starts to happen and “Hell has arived in a cart”.

But as the situation gets worse Government will start “eminent domain” activities, they will go to the head of the supply chain and take what they require. We’ve already seen this happening with medications. I went to get a standard repeate prescription one of which is a broad spectrum antibiotic. Guess what “shortages” and maybe, just maybe the pharmacist might get them in by the end of this week…

Thus the government and NGO’s will lie their venal hearts out telling you everything’s OK when your hospitals are stacking body bags in the corridors. By which time self-issolation will not be getting you anywhere.

But people notice things in otherways which is why you don’t want to be cooking even instant noddles let alone beans and rice. The smell of cooking is supprisingly noticable to a hungry person, hungery people become desperate people and desperate people don’t care what they do. This has been well known for longer than any of us have been alive.

Some will remember you unloading the ton and a half of food and water that is ninety days supply for a family, it’s kind of difficult not to be noticed… Guess where they are going to “borrow a cup of sugar” from. They will also tell others…

What do you do? Remember the Police will not be a “thin blue line” they will be tiny dots in a few places trying to shoot those looting stores and warehouses, whilst they still have amunition… Oh and don’t think they won’t be doing any looting, they will, only they will call it “collecting evidence”… So any disturbance around your door will get your food supplies taken in evidence that you are a looter or some such… History shows just how nasty an occupying force with empty bellies behave, and in times of panic the “guard labour” be they wearing blue or green will be an occupying force.

It is after all when you get down to it the nasty brutish behaviour of survival, but these days with the tools of force multiplication…

Hopefully it won’t get that bad, but I’m not a betting man. But don’t worry your smarter Politicians and 1%ers will have set up new power bases else where[2] with the spoils of “eminent domain” so that they can reestablish society, but only when it’s safe to come out, and that might be for a lot longer than ninety days. Till then you, I and the rest of us are very much at the mercy of those who see us as targets of opportunity.

Thus the reason they will lie, lie and lie again, because the longer they keep the cork in the bottle the longer they have to stock up and the less time the majority have to prepare or take independent action. Remember in their view you are “just a vote” or “just a product” thus “disposable”.

[1] Though you can limit the energy required by “hay box cooking” and using “vacuum flasks” for storing black coffee, tea and low sodium bouillon.

[2] In the 1960’s in the UK there were quite a number of “secret bunkers” known officially as “Regional Command Centers” a group of people broke into a number of them and found “top secret” documents in filing cabinets. These documents had only one reason to be secret, they detailed quite extensively how the “privileged” would survive at the expense of everyone else at times of “National Emergancy”. Amongst the documents were discussions on controling the population with what the military call “chemical weapons” and I don’t mean “irritants” like CS gas and Pepper Spray, we are talking about debilitants that we now call “incapacitating agents” like “choking agents” and worse as long as they were “non-persistant”. Though even “persistant agents” were considered for certain functions[3] in towns and cities.

[3] Chemical weapons are often derived from chemicals investigated for commercial use for “pest control” and “cleaning products”. Thus stocking up on these chemicals is not immediately suspicious, nor is spraying them around streets for “bio-security” and “pest control”. However it’s increadibly easy to mix different “cleaning products” to get the release of “choking agents”, even XKCD has a cartoon about the dangers of mixing cleaning products. Some even work as “oxygen generators” which might be usefull to know. Likewise “pest control” chemicals give you many interesting “phosphate” compounds that can easily be used for longer term “irritants” through “choking agents” and others to what many would call “nerve agents”. Many of these would produce pneumonia like symptoms and respitory distress, which untrained people might consider to be COVID19…

Clive Robinson • February 24, 2020 3:38 PM

@ Anders, SpaxeLifeForm,

Real chance that from there it could
spread over all the Europa 🙁

I rather think it’s here already, and it won’t be possible to contain it because the European Council of Ministers won’t act in time.

Some say Europe has been overrun by refugees and terrorists from the Middle East, whilst I don’t thibk we have exactly been “overrun” the fact many have made it across or around the Mediterranean and all the way to Germany, Norway, France and the UK without papers etc tells you just how porous the European boarders are. Part of this is the Europen “Free Travel Zone” which the Council of Ministers see as a fundemental piller of the European ideal extended from the original “Free trade agreement”.

Thus because it was “not needed” boarder controls and all that go with it were got rid of.

Now we suddenly need it back, there is nothing there and nothing else to fall back on.

People will either “run to home” as the woman who lied about her travelling to get back into the USA or they will “run to healthcare” or what else they see as advantageous.

One of the things learned about the French camps at Sangate was that when people have an idea in their head of where they want to go, then only death will stop them trying and trying again and again.

The logical consequence of this is not what you realy want to think about. But in essence it will be the old East/West German boarder with it’s guard towers and snipers, kill zones and anti-personnel devices designed like a cross of an old style cannon and shrapnel grenade. I’m unfortunately not just old enough to remember “The Wall” –I actually have a chunk of it at home– I wore the green at the hight of the cold war and was taught in some detail about “the boarder” as the regiment I was in had both a “drop in” and “stay behind” roles. It’s one of those things you wish you had never come to know, because it’s to hard to forget.

I think it safe to now say what we’ve been hinting at for the past month, we have a pandemic, it’s out of control and Governments are in denial even to themselves (Dutch, Iranian). The only way to contain the SARS-CoV-2 virus and stop COVID-19 disease spreading is to contain it, and we should have stopped cross boarder travel a month ago.

But as I’ve pointed out stopping travel means stopping shipment not just of immediate needs like food and energy but longer term needs like goods that keep what is now not a local or country economy but a world economy…

What ever happens it will not be existential but it will very probably feel like for many next year. But worse case is the possiblity it will be like that for a generation or two to come.

Mad as I might sound, it’s things like this that make me wish we had got off this rock three or more decades ago… Whilst I can see good science as to why pandemics are happening and will happen more frequently, at the end of the day way to many will take a religious view. We’ve seen this already in Iran, and to be honest thinking that way will not solve the problem, science on the other hand might, but sooner rather than later there is going to be a pandemic even science will not be able to stop and there will be either no or few places to hide as everyone will try and go where they think they are safest or surounded by there loved ones and the disease will go with them where ever they go.

Clive Robinson • February 25, 2020 8:59 AM

@ Anders, SpaceLifeForm, ALL,

Live map

It’s the one I commented on from the Jonhs Hopkins site what feels like an eternity ago.

I mentioned that the graph needed a bit of work on it and I guess great minds think alike, because they have added a logrithmic display.

If you look at the logrithmic display it becomes clear that whist China still has new cases the line is heading back down.

However for the otherparts of the world it’s a near straight line going upwards… This means the rest of the world cases are increasing exponentially. Just by eye you can see how quickly that is going to cross the decending Chinese line…

Which should tell people why I’ve been quite annoyed with the lack of movment by WHO and many Governments.

On the upside the UK Gov has done one thing I’ve said is necessary, that is they have issolated the repatriated Diamond Princess passangers in what sounds like individual quarantine, such that they don’t infect each other.

Hopefully they have covered all the potential infection routes. However they are still talking 14 days quarantine… I’ve said from basic maths that I think that is insufficient and it should be twice as long. Sadly the evidence my view point has validity still continues to build.

I know it might sound cruel to keep people individually issolated for four weeks, but thinking about both the individual and society it makes sense. Most can work out why it might be so for society but have a harder time when it comes to individuals. Look at it this way we now know that there is a 5-7% risk they will become positive on a RT-PCR test after 14days, we also know their chance of survival depends a lot on prompt medical attention (the same as it does for sepsis), for various reasons they have some of the best medical practicians in the required disciplines looking after their cases. Thus their chance of successful recovery with minimum sequela or risk of reoccurance.

Clive Robinson • February 25, 2020 4:50 PM

@ SpaceLifeForm, passing_by, myliit, MarkH,

A notifier must have the username and password combinations in order to do the checking.

In most –well nearly all– cases yes you would need the username and password.

However there is a way to get around the issue depending on if it’s a *nix box or not. But it’s nearly a couple of decades since I last had reason to do it.

You can set up a *nix box login user account so that it’s “shell” is a text based program or runs a shell script. Some “Mail Delivery Agents provide a text interface and some can authenticate by UID not username and password (which is a known security risk if NFS etc is in use).

Back when I did this last PAM was all the rage and you could use a “ticket based access”. In essense you did a Single Sign On (SSO) and connect to the *nix box account via the SSO ticket based Plugable Authentication Module (PAM).

So you do an SSO somewhere and it passes ticket based authority to log you into a *nix account that then runs a script or program on the *nix box that gets the mail from the MDA via the account User ID (UID).

You can thus make several diferent accounts have the same UID or directory and thus have shared Email access on a rotor etc for a “help desk Email account”.

Yes it’s a cludge and it depends on you being able to get a user account on the MDA machine, which is most unlikely these days.

Clive Robinson • February 26, 2020 2:25 AM

@ A Trip Down Memory Lane,

It would help make your post both more interesting and noticable if you mentioned a bit more about PCIleech.

Which is it’s a DMA attack device that can read the bottom 4Gbyte of memory from RAM of just about any Windows, Linux or Mac box, and I suspect some other computers as well that have USB3 ports or other accessable busses.

For instance mentioning that it’s developer “Ulf Frisk” found a jaw droping security fail in Microsoft’s Jan 2018 Windows 7 security patch might attract peoples attention,

https://www.bleepingcomputer.com/news/microsoft/meltdown-patch-opened-bigger-security-hole-on-windows-7/

The PCIleech hardware devices by the way are fairly easily and innocently available as Development boards originally for the USB3380 chipset but more recently for FPGA’s,

https://github.com/ufrisk/pcileech-fpga

Whilst it can be a quite useful security tool for both Black and White hats proving yet again the “agnostic to use” issue, it can also be used by hardware developers and embedded system developers in one of the ways the old “ICE” devices of years gone by did (mid 1980’s onward for the IaX86 chips).

Clive Robinson • February 26, 2020 8:08 PM

@ vas pup,

Met Police chief defends facial recognition from ‘ill-informed’ critics.

I would not trust Cressida Dick with the key to the cupboard we keep the wild bird food in. She is without doubt incompetant at anything other than political schmoozing and brown-nosing.

The rank and file police officers do not trust her or her selected appointees and many would be quite happy not to say ecstatic to see here go, preferably with ignominy.

Thus as she is pulling a “Think of the Children” rhetoric to discredit people who are actually more informed than she is, and she is doinging it so piss-poorly is realy not surprising. For her to call people who have actually looked into the social harms such technology brings “ill-informed” shows just where her brains or lack there of are… Thus I shall say that,

I consider Cressida Dick’s juvenile name calling a badge of Honour and will wear it with pride.

Clive Robinson • February 27, 2020 4:49 AM

@ Lurker,

All you need is a spin doctor to make that look good on the Nine o’clock News.

Yes, I can see some saying it would free up oportunities for the young that the “baby boomers” are blocking… And there would be all those death duties to collect…

But at the end of the day it would still be the same level of political nonsense. After all who but a politician would take a “warning to the future” and turn it into a “working strategy”, poor old George Orwell must be spinning in his grave…

Any way as the old joke has it,

“Tea’s over back on your heads”…

Clive Robinson • February 27, 2020 5:43 AM

@ myliit,

With regards the NYT,

But privately, they [current Trump allies] say he [Trump] has been reluctant to give in to what he has called an “alarmist” view of the virus’s potential to cause damage as he warily watches the effect of the outbreak on the stock market.

To quote someone libertarian / economist somewhere “The Stock-market knows best”. Or atleast in this case they do.

Trump in his policies has made the stock-market not just jittery but also increasingly fragile.

Most analysts know that for all Trump’s bluster the US economy is to tightly dependent on China for Trump to be able to unwind that Gordian Knot in anything less than a couple of decades.

What is thus scaring the stock-market is “spring”. For all China’s apparent technical sophistication it is still an agrarian nation that feeds not just it’s own citizens but other nations citizens.

Much of China’s food is grown not by machines and chemical conglomerates but by individuals. China already had a serious issue with Swine Fever killing something like half the animal protien source in the nation, and the ever present avian flu doing damage there as well.

If China misses “spring planting” the effects will be felt world wide and those that live in the houses of straw economies like the US will probably be some of the first to feel “The huff and the puff at the door” of the “Wolf of Wallstreet types”.

It will be interesting to see what happens in Europe… The agrarian south feels betrayed by the industrial north and COVID-19 is more likely to spread in the north than the south (disease loves close quaters living). The north can not “feed it’s self” thus is reliant on higher tech trade to buy food from the south. If that higher tech trade falters or tanks then those in the south are likely to see “pay back time” it could all get very nasty quite quickly.

Thus yes I can see why the Stock-market should start running to safe havens etc, and no doubt the precious metals markets are going to see brisk business…

As Trumps entire Empire is at the “house of straw” end of the Stock-Market, I’m not surprised he’s acting in a highly self interested way…

As for Mike “TIM” Pence, well it would help if people could see him honestly… But the little track record he has got does not exactly inspire any kind of hope for the average American. From the world view he wraps himself in the bible and then beats it hard, such behaviour is parochial at best. I’m guessing he is going to do likewise for the flag and be too busy running around glad handing to do anything of any real use. I suspect that as Pence has obvious aspirations, Trump has given him the job as a quite deliberate “poisoned chalice”, any way we shall see what he does, or more correctly is “alowed to do”.

Clive Robinson • February 27, 2020 4:48 PM

@ Anders,

Strange…Africa is still mostly untouched…
Any idea why?

It is there, people have the symptoms, but they don’t have the test kits to make definate diagnosis.

Thus politics kick in for all the usual reason, and “Blind eyes get put to telescopes as trouble comes over the horizon”.

Clive Robinson • February 27, 2020 6:19 PM

@ SpaceLifeForm,

Insanity. Has to be intentional.

Did you think I was joking the other day when I said Governments had been doing calculations?

Trust me there are quite a few lunatics in power that see this world pandemic as an “opportunity” to be exploited not prevented.

If you’ve not stocked up yet as I’ve been saying for the past month, then I would get out there and do so… Mind you ninety days of food and water might not be enough…

From what I’m hearing supply chains are already being diverted to unlabled warehouses on industrial estates in the UK that were unoccupied just a week or so ago. So somebody is “stocking up”… Even though the official message is “every things fine, we’ve got it under control”…

Oh one piece of advice only buy what you realy like to eat in the way of cans of food, you never know what “crap” will be brought to your door if a full on quarantine –like those in China and now starting in South Korea– are put in place. Oh and stock up on chocolate and sweets and chilli and other spices, bullion, coffee, tea, importantly lemon juice you will need these extras for a lift in the depressing times of which there may be many. Oh and don’t forget “powdered milk” not “Non dairy creamer” when mixed with water powdered milk can be used on your breakfast flakes etc where as Non dairy creamer is just “yuck” with anything other than coffee and hot chocolate. Powdered milk can also be used in sauces to make dull food more edible[1] and tomato juice into a much nicer soup etc etc non dairy creamer not a chance.

From a health point of view vitimin D and C tablets will help combat “being indoors” and help your immune system keep up to the best it can be. Oh and get lots of pedal bin liners and boxes of tissues, every room should have an office style trash bin into which the used tissues can be put in. Don’t bother with “alcohol hand sanitizers” they are not that usefull even when 75%. Hard soap and hot water, or cold water with a small quantity of bleach in it. As liquid house hold bleach does not keep go get yourself a tub or two of Calcium Hypochlorite “pool shock” and a couple of house plant sprayers/misters. You make up about a litre of liquid bleach at a time the just add a few drops to the water you use (the CDC has a guidence note up on it’s website). Seperate toiletries and towles for each person, do laundry on the hotest wash the clothes will alow, towles and cotten/linen bedding should be 90C wash (don’t use beding with synthetic fibers). Understand how to isolate family members who become sick or have any kind of symptoms, like mild temprature or slightly raised heart rate, if you can get a “Peripheral Pulse Oxitometer” blood presure meter and IR thermometer then do so and esure you have spare batteries, take stats morning, before meals, and before bed daily and keep a record, these might be the only sign that younger members of the household are infected. If you have children only hard/wipe down toys and in their bedrooms only. Computers etc should be wiped down between user. Nobody shares cups or utensils, no tasting of food during cooking all pots pans and dishes should be covered and wiped down with mild bleach solution before each use. Bathroom/toilet, both solid and liquid human ways carries the virus and will aerosolise. So spray with mister and mild bleach solition before and wipe down with tissues and dispose of into bin, spray again after use, and let air dry. Any misses should be wiped up and the area sprayed with a stronger solution, toilet should be flushed before spray down and a couple of “high sprays” into the air so mist falls down would not go amiss.

[1] A secret from the catering industry, boil/simmer meat to cook it and keep the juices. You can them make five or six different dishes easily by puting a sauce on the meat. This is what Indian restaurants do as standard, they cook the meat seperatly and make up a large pot of “masala sauce” you put a third of the spices in oil in a pan on high heat, when it just starts to smoke turn heat down put in a portion of cooked meat stir to brown add rest of spices and a ladle or two of the masala and let simmer whilst stiring, add in coconut cream or ground almonds or both if it’s a korma other things if not, tip into serving dish. So you also need to know how to make a basic sauce for other dishes. Put oil and flour, into a sauce pan heat to make a rue –either white or brown–, whisk in any spices and whisk in about a pint of fluid. Milk to make a white sauce, meat juices and a stock cube if other sauces, let simmer whilst stiring to thicken add cooked onion or other herbs/spices. Your taste buds will thank you for learning this basic trick, it also helps make meat go further which on “rations” could be a blessing. Also look up how to make “soda bread” you can make it with minimal touching unlike ordinary bread that needs kneeding. You don’t need butter to eat it, adding sugar and dried fruit and nuts makes a passable substitute for cake as eggs are unlikely to be available.

Clive Robinson • February 27, 2020 7:37 PM

@ MarkH, ALL,

I was warning about Africa an the Chinese take over[1] years ago on this blog, but it appeard that zero people were interested or cared.

Put simply there are three areas of raw resources that are of interest. China it’s self, Russia is the wealthiest nation in the world in terms of raw resources and Africa (south America is the US back garden in which their dogs run free).

Only Africa was available to “influance”, which is exactly what China has done amongst other things[2]. Now the question is what sort of future have these African leaders signed themselves and their people up for…

Some would say “A deal with the devil” others have different ideas. All I know is that I am unlikely to be alive in thirty years or so to find out.

[1] What is noticable is that China is “exporting” in a “dependent way” for instance all equipment needs Chinese only spares. All Infrastructure and plant is run, maintained and managed by Chinese personnel, with mabuals etc in Chinese. Medical improvments are via Chinese Drs etc. Even higher level education is in effect there for the Chinese not the local inhabitants.

In effect China is exporting their middle classes to Africa displacing or prevebting any African nations they are “helping” developing their own middle classes… We know from the way the British ran their Empire in thr mid Victorian to post WW I that you can control a nation almost entirely with just a thousand well placed individuals. Back then it was “administrators” these days you have to include engineers, Doctors and Educators, but that’s still not a lot of people if you do it right. So as little as five thousand Chinese people could end up controling an African nation, thus where it’s natural resources go… But I’ve kind of poinyed this out in the past but nobbody appeared to consider it the major security threat it is.

[2] Oh and it’s China that is pushing Africa into it’s last surviving wildernesses where these other zooinotic “spillovers” occur…

Clive Robinson • February 28, 2020 7:30 PM

@ Anders,

Let’s light tomorrow some candles to remember the already passed away persons and let’s hope this monster could be contained (but i doubt it).

They are mainly the innocent victims of “Mankinds folly”, for this monster, is a monster of our own creating.

It’s not as though we do not know about the dangers of “zooinotic spillover”, such diseases have increased steadily over the past thirty years or so, from virtually unknown outside of a tiny or small region to repeated serious threats against mankind in general.

It’s hard to reason against the self interested and unscientific “rabble rousers” with their faux claims of “Hand of God against wicked men” argument some preachers have already come up with. Likewise the “Gaia argument” it’s “Nature fighting back to survive whilst it still can”, or the “conspiracy theory” that says “It must be a man made bio-weapon that’s escaped / been released”…

We have to accept that peobability plays a part, and sometimes simple stupidity does unleash a course of events that look like they do have design behind them. Even though they fall easily within the expected range of mutations of a given coronavirus, of which there are very many in the animal kingdom[1] but thankfull very few that effect humans.

The simple fact is we know that “bush meat” like cannibalism carries risks from pathogens like bacteria, virii and prion proteins (CJD etc).

@ SpaceLifeForm,

WHO confirms a Dog infected in Hong Kong.

What little I’ve seen about it does not realy make sense. The quotes say the dog is the pet of someone who has COVID-19 and it was tested and found to be “weakly infected” what ever that is supposed to mean. But Hong Kong’s senior veterinary officer indicates that the dog is not in danger or a danger to humans.

Whilst many animals have their own coronavirus diseases they tend to have different symptoms[1] and whilst highly infectious in the particular species in general they do not spillover to other species (which is what SARS-CoV-2 appears to have done by random mutarion).

The reasons for cats and dogs apparently dying might well be related to the activities of the authorities such as street spraying, or people attacking them out of fear[2]. It could also be that they have just became more noticable because the streets were not getting the usual refuse collections due to lock down issues.

What we are not seeing is any scientific evidence “yet”. So whilst balance of probability suggests not, it has not been ruled out either. Cats and dogs do have their own versions of coronavirus but it’s pathology is quite different[1] to what we are seeing with SARS-CoV-2. So it is possible that depending on the specificity of the particular testing method Cainine Coronavirus Disease (CCD) could be causing a PCR test for SARS-CoV-2 to responed.

But this should not realy be news to anyone who as ever had a pet. Cats for instance have their own version of the flu –feline calicivirus / herpesvirus–, and when you first take your pet cat to a vet one of the first questions that comes up is “vaccination”. Because in cats the outcome of feline influenza is much more serious than influenza viruses tend to be in humans.

All pathogens that cause disease have two things in common,

1, They mutate.
2, They are opportunistic.

Thus although rare they can cross species for hosts and they can have significantly different effects from species to species (RNA being single strand mutates much more readily than double stranded DNA).

In this respect pathogens are like some natural poisons such as alkakoids, designed by mutation and natural selection to be more effective against certain living creatures than others. The alkaloid poison that most often causes heartache in pet owners is found in chocolate (Theobromine). Due to differences in mamal metabolisms whilst humans would need to eat more than twenty pounds of chocolate for there to be a reasonable chance for it to kill them, for a small dog however just an ounce of some chocolates can be fatal. Vets see the family dog get brought in with what is often called “Chocolate poisoning” because a youngster in the house “has been nice to fido” at Christmass or Easter, it can be very dificult to treat, thus fatalities are common and vet bills high. However Theobromine poisoning can occur with other food stuffs it’s present in tea, coffee and certain soda drinks that have vascular plant extracts for flavoring etc[3].

[1] In many animals coronaviruses effect not the respiratory system but the digestive tract, causing the likes of diarrhea that are generaly not as fatal. They do however tend to be highly infectious such as Canine Coronavirus Disease (CCD), passed via animal waste products,

https://www.petmd.com/dog/conditions/digestive/c_dg_canine_coronavirus_infection

[2] Cats and dogs to a lesser extent have been “demonized” down the centuries as being evil for various reasons across many cultures. In Spain for instance cats used to be put in baskets that were set on fire and hoisted aloft over crowds of people so the cats cries of pain and fear could be used as an example of driving out devils…

[3] Theobromine is just one of thousands of alkaloids, many of which have “toxilogical disadvantages” to common plant predators such as insects, other plants (phytotoxic) as well as anti-fungal properties. But some can cross the blood-brain barrier and can have effects on mammals, in humans both theobromine and caffeine have some stimulant effects, but are still toxic. As alkaloids accumulate at different rates due to differing species metabolisms the “Lethal Dose at which 50% die” (LD₅₀ varies significantly. Which is why a number of governments with “wild dog” “pest issues” have researched into using a variation of chocolate as a way to decrease the canid population, because most creatures that are particularly susceptable –cat family– do not have taste receptors for sweetness so don’t eat such a poison.

Clive Robinson • February 29, 2020 7:52 PM

@ Wael,

I hope I find you in good health if not good chear, and with a little luck well rested?

I don’t know if you saw @Thoths new product or not but he’s got it to market which is no mean feat for a security related hardware product these days.

Are you still in contact with @Nick P, if so tell him I hope he is well and prospering.