Friday Squid Blogging: Live Giant Squid Found in Japan

A giant squid was found alive in the port of Izumo, Japan. Not a lot of news, just this Twitter thread (with a couple of videos).

If confirmed, I believe this will be the THIRD time EVER a giant squid was filmed alive!

As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

Read my blog posting guidelines here.

Posted on February 5, 2021 at 4:13 PM116 Comments

Comments

vap pus February 5, 2021 4:38 PM

New Israeli Covid drug which cured 30 cases of disease hailed by scientists as ‘huge breakthrough’
https://www.yahoo.com/news/israeli-covid-drug-cured-30-191709164.html

“A new coronavirus drug which successfully cured 30 cases of the disease in Israeli hospital patients has been hailed by scientists as a ‘huge breakthrough’.

The EXO-CD24 substance was developed at the Ichilov Medical Centre in Tel Aviv and successfully completed its first phase of clinical trials on Friday.

The treatment was given to 30 patients with coronavirus, whose conditions ranged from moderate to severe.

Twenty-nine of the patients were then discharged from the hospital in the following three to five days, while one patient took slightly longer to recover.

A protein known as CD24 is delivered to the lungs by exosomes in the drug, which helps to rebalance the immune system and prevent it from overreacting to the virus.

Professor Nadir Arber originally designed EXO-CD24, which is breathed in as a gas and taken once every five days, in order to treat patients who had ovarian cancer.

===>“Even if the vaccines do their job, and even if there aren’t any new mutations, one way or another, the coronavirus will be staying with us,” Prof Arber told the news site Arutz Sheva.

===>“That’s why we developed this special medication. It’s been about half a year from the time the idea was hatched to the first human trials [being] conducted.”

Security Theater February 5, 2021 4:41 PM

Simple question: how long do you expect us to still wear masks on public transport? Let’s focus on this one venue for the sake of example: public transport. 20 years? 80 years? Geopolitical analyst George Friedman argues it’s not out of the question. Given we are still taking off our belts and shoes at airport security 20 years after 9/11. And some institutional security changes at government facilities are still in place 80 years after World War II.

https://geopoliticalfutures.com/the-institutionalization-of-crises/

Please note that my nickname is not a mock on the fact that we wear masks on public transport. I think it’s a necessary measure for our own and for our fellow travelers’ safety – for the time being. My nickname is simply a homage to @Bruce’s blog.

yabba dabba dont February 5, 2021 5:14 PM

Although the GameStop saga is not directly related to security it is related to the the larger issue in which security is embedded, of anonymous trust.

The issue of social trust was the theme of a recent Saturday Night Live skit.

URL: https://www.youtube.com/watch?v=9LqK8GiIMYw

It appears that at least some see a loss of social trust as widespread problem.

Clive Robinson February 5, 2021 7:10 PM

@ Security Theatre,

Simple question: how long do you expect us to still wear masks on public transport?

Maybe fore ever…

Look at it from the medical point of view.

The most vulnerable currently (though it appears to be changing) are those well into retirment.

These are also the adults who are least likely to be fit to drive but capable of using public transport.

The virus will only stop being a problem when it is extinct in any given environment.

To continue it’s existance it requires “vulnerable hosts”

Hosts cease to be available to the virus when,

1, They are dead.
2, They have had the infection.
3, They have been immunised.
4, They are unavailable.

The first reduces the population and increases the natural herd immunity as a result (if half the population die then it effectively doubles the numbers in the other catagories).

For a while at least those that have had the infection and survived have a sensitised immune system. To the virus they are effectively dead, untill either their immunity desensitises or the virus mutates a significant ammount.

Likewise those that have been immunised are similar to those that have been infected and survived. Only their immune system has probably not been sensitised as much, and also it’s been sensitised to the innoculum not the virus so is probably more specific so the virus has to mutate less.

The last group are those that are kept away from a virus infected person whilst they are infectious. If a person is clearly sick before they become infectious it’s relatively easy to issolate the sick from the well. However with SARS2 you are considerably infectious before you are visably sick which makes issolating the sick from the well very difficult, therefore issolating the vulnerable tends to make more sense. However issolating groups or what has been called “social bubbles” limits the spread to only those in the bubble, if somebody in the bubble becomes infected. In effect this is what “lockdown” in it’s various levels trys to achive by significantly curtaling, community spread of not stopping it.

However we have to also consider other groups,

1, New borns.
2, Animals.

On average 2% of the population is born each year, we do not yet know if mothers confer immunity to their babies and if so for how long they remain immune. On top of this is the potential for the genetically more susceptible to die out before they become parents, which would have the very very slow effect of breeding the human race into a less susceptible form. However in the process we do not know what else is lost… Take for instance sickle cell disease, this gives the young increased tollerance of maleria but it also kills people young who will now not meet maleria.

But we are not the only creatures on this planet, and SARS2 came from animals by zoonotic transfer, and as we now know it can transfer back into wild animals and back to humans again (human-mustelidaes-human). Thus it’s entirely possible there will be “disease reservoirs” in wide ranging wild animals, where it may cause different symptoms which are less or non fatal to them and may not significantly sensitise their immune systems such they get the infection repeatedly over short periods of time. Thus comming into contact directly or indirectly with humans causing SARS2 to flare up again. We can see this with four other corona viruses which cause the common cold and appear to be fixtures in society occuring every winter season where between a quater and one third of the population gets it, most frequently transmited through children or work colleagues.

If SARS2 mutates as it appears to be doing to more easily infect children and those of working age and it forms disease reservoirs then two things will happen,

1, As with flu and the common cold we will get a “COVID Season” every year.
2, The death rate will most likely be ten or twenty times that of seasonal flu.

That is not sustainable, thus we would need some measure of “lockdown” every year.

In the Far East in South China Seas countries, mask wearing is not just socially acceptable it’s a norm at certain times and not wearing a mask considered degenerate behaviour.

A similar attitude in the West would have rather more benifits than limiting the spread of SARS2… There is anecdotal evidence that this years seasonal flu is actually more infectious this year as a virus. However because of the COVID lockdown it’s not spreading the way flu would normally do, likewise the common cold.

So COVID could still be with us in 80years anyway, and wearing masks prevents quite a few seasonal pathogens that have their own costs in hospitalization and premature death. So still wearing masks in social contact areas such as public transport, shops and social events may be a good idea any way… After all people do wear eye glasses in part to increase their life expectancy by reducing the number of accidents they have and few if any realy question wearing of glasses, in fact they have been known to become fashion items worn by those who have no physiological need of them.

So if we make effective masks fashion items, then the wearing of them might become just like wearing other items of apparel. Thus just another social norm much as women keeping their ears covered in times past.

I suspect that a change in norms could happen in as little as three years and certainly well under fourty…

lurker February 5, 2021 7:33 PM

@Clive, All: quarantine leakage
NZ now has four cases, after 3 negative PCR tests during 14 days quarantine, were released to the community, subsequently developed mild symptoms, and tested positive. Data not yet confirmed, but all were from same quarantine hotel, and all believed to be B.1.351. Oddity: intensive T&T shows R=0.25. Sure, it’s a small sample, but it raises questions of false negatives; and whether the reported higher infectiveness of this variant is due to environmental factors.

https://www.health.govt.nz/news-media/media-releases

https://www.rnz.co.nz/news/national/435914/positive-covid-19-case-in-hamilton-people-should-not-be-alarmed-moh

Clive Robinson February 5, 2021 8:45 PM

@ Anonymous,

Is it “interception” if the malware stores the message on the device before forwarding it to the police?

It depends on how you view “the source” of the information.

If what is being reported is both true and factual, I think the three judges have made the wrong decision and the argument they made is a false one.

In essence they are saying because the source was in plaintext and not encrypted it can not have been in transmission as the phones only transmitted cipher text…

Well if that is what they have claimed thrn it is a very obvious failure of reasoning or a deliberate and willful deceit by the judges to excuse a forgon conclusion of convenience to the crown prosecuters. Either way if true “They have consipired to bring the law into disrepute” thus would be considered no better than crooks.

As many will know I talk about the communications end point and the security end point and how they relate to information channels fairly often and how you have to get them in the correct order for security to be possible.

Now to communicate you do not need to do so securely, that is self evident to anyone who has spoken to more than one person at the same time, or spoken to a single person in an environment where what is being spoken can be heard directly or indirectly by one or more third parties.

Thus as reported the judges distinction between encrypted and not encrypted has nothing what so ever to do with the communications end point but every thing to do with the security end point, which has nothing what so ever to do with ehat is or is not an intercept.

To see this, lets examine the case of someone who is a little more knowledgable about establishing security by the use of mobile phone aplications. Because they know that neither the application or the phone OS can be in any way secure, as the “User Interface”(UI) is in plaintext and is reachable via the drivers or OS from the “over the air interface”(OTA). In short an “End Run” attack around the security endpoint.

So the more knowledgable person decides to use a pencil and paper cipher that is secure, such as a “One Time Pad”(OTP).

Thus they think up their message and using the OTP they write it down in ciphertext not plaintext. Thus the message is stored on the piece of paper not as plaintext but ciphertext, thus judges argument fails at this point because of their distinction between plaintext and cipher text. The plaintext only existed in the persons mind[1] and was never stored anywhere but there.

But even if they wrote the plaintext onto the pad then wrote the cipher text in underneath, the judges argument would still fail, because the person would type in the ciphertext not the plaintext. Thus under the judges incorrect logic the message must have been in communications on the phone at all times because it was ciphertext.

We have a saying in the UK of “You can have your cake but you can not eat it”, well the judges can have their argument but they can not have it be true, the laws of mathmatics, physics, logic, and reason do not alow it.

Because the intercept capability was constant on all phones, it did not nor could it magically change the source of information or how the information was used just because the message content was inteligable or not.

To claim otherwise is to cross over from reason, logic and sanity to hocus pocus, illogic and insanity.

So the reporting as given gives rise to this question, “do these judges realy want people to think they truly and unreservadly believe in fairy makebelieve that even six year olds would be skeptical about?”

[1] For those that think that such a feet is not possible, I can assure you it is as I used to do it, not with a OTP but an addative stream hand cipher that used a pack of cards as the generator. But we know of people doing similar all the time, take on the fly translators who listen to a speaker and translate what they are saying as they say it and say it in a new language to another person. Some people send messages in morse code and similar. I know of people that used to write to each other using “Tolkien’s Runes” it was effectively a simple substitution cipher with one or two modifiers. I used to do it just to join in but also to cipher it as well by a simple running addition with 0..9, it was a “Party trick” that used to both amuse and amaze much like magic tricks I occasionaly still do such as having a “magic coin” I flip that always come out the way you call it, more fun than a live/dead Schrödinger’s cat demonstration and more instructive 😉

Clive Robinson February 5, 2021 8:58 PM

@ lurker, ALL,

NZ now has four cases, after 3 negative PCR tests during 14 days quarantine,

I’m on record nearly a year ago as saying, based on the data then available, that I thought 14days quarantine was too short a time period and that three weeks would be better.

The fact that they are from the same hotel suggests that unless it’s the only quarantine hotel, it is to do with something about the hotel it’s self or the regime practiced there rather than the viral strain.

However way to little evidence one way or another to be sure currently… So the same old problem of “Give me hard evidence” or to be honest even something approaching it with less if, buts, or maybes and a lot more data. I’m sure the people on the ground feel likewise.

AL February 5, 2021 10:48 PM

@Clive
Re: interception.
In the U.S., the test is whether the message is “in flight”. The writing of the message to storage, even for a moment, could be construed as “store and forward”. It is a jump ball in the U.S. since the storage could be viewed as “contemporaneous” with the transmission. This “contemporaneous” issue is the test under U.S. law. It could be viewed as not contemporaneous because the storage occurred a moment before transmission. It looks like in an E2E situation, the activity immediately preceding the transmission needs to be looked into. I wonder what Signal does.

SpaceLifeForm February 6, 2021 12:22 AM

@ Anonymous, AL, Clive

Re Encrochat

I believe neither the defense lawyers nor the judges really understand exactly how the sting went down. They have been fed tidbits and words to let them lead themselves astray. This protects sources and methods.

Bottom line is that they were dumb criminals that bought something at high price, thinking that it must be good.

They never saw the need of separating the comms and encryption.

RealFakeNews February 6, 2021 12:43 AM

This “false negative” suggests there should be sufficient viral load for a test to be positive, but I don’t think that is what is occurring.

There are several research papers from a year ago in South Korea that strongly suggest this virus has a dormant period of up to 5 weeks.

When it was originally said that we would quarantine for only two weeks, this was not based on science, but political expediency.

New Zealand is actually doing the world a favor with these cases – they are showing that outliers are still a real-world risk, and that complacency has no place in public health policy.

Winter February 6, 2021 4:03 AM

@realnews
“This “false negative” suggests there should be sufficient viral load for a test to be positive, but I don’t think that is what is occurring.”

The Sars tests sample your throat. If the virus sits deep in your lungs or elsewhere, it might not detectable in surface samples of your throat. It happens.

JonKnowsNothing February 6, 2021 8:43 AM

@Winter @RealFakeNews @All

re:Failing PCR tests

Winter: The Sars tests sample your throat.

Which is why some places are now taking anal swabs because the nasal+throat area may not be enough.

There may also be an issue with the PCR test itself. The South African variant B1351/501Y.V2 is known to trigger only portions of the PCR tests in use. The number of amplifications needed and the conversion process itself might be faulty for the new variants.

Real: …quarantine for only two weeks, this was not based on science, but political expediency.

The longer quarantines needed are not acceptable to the NeoLiberal/Libertarian portion of the population. It causes too much disruption to the economy and impedes the application of Herd Immunity Policy (HIP). HIP is not based on saving lives but on killing off as many vulnerable persons possible for the financial benefits to their respective economies. HIP has nothing to do with medical or ethical treatment of the population.

You can spot applications of HIP by the reaction of the government to the pandemic and the follow on policies (or lack there of) to control the multiple outbreaks of new pandemics.(1)

Anything that accelerates the spread of the disease, decisions to prioritize the economy at the expense of public health, the continued onslaught against the medical professions (overrun hospitals, continuous surge waves, exhaustion) are hallmarks. The medical professions are taught to save lives; HIP wants to end them.

For countries that follow HIP, COVID-19 is a great gift. It continuously kills off the older, vulnerable members of the population for which there are significant financial savings. The rate of mutation makes it nearly impossible now to eradicate. Only countries with Zero Tolerance have any chance to prevent the future slaughter of their citizens.

1, There are now multiple variants spanning large geographic areas which constitute multiple pandemics. The issue of reinfection, cross infection, double infection, back to back infection is confirmed.

Until all variants are controlled or eliminated, these and newer versions will be circling the planet every time a plane takes off or a cruise ship docks in a port (provided the cruise industry survives at all).

These independent pandemics are from the following variants:
  D614G (current)
  B117 (UK)
  B1351 (South Africa)
  B1128 (Brazil) (P.1 Manaus Variant) and (P.2 Rio Variant)
  B1248 (Japan) (same mutations as Brazil/independently arising)
  CAL.20C (California Variant L452R mutation)

The variants with mutations (K417T + E484K) have significant Antibody Escape and the current vaccines do not work. Antibodies from surviving an infection of COVID-19 diminish over time and the current vaccines last about 6 months for those variants they work for.

ht tps://en.wikipedia.org/wiki/Polymerase_chain_reaction
  a very small sample of DNA and amplify it to a large enough amount to study in detail.

ht tps://en.wikipedia.org/wiki/Real-time_polymerase_chain_reaction

ht tps://www.iaea.org/newscenter/news/how-is-the-covid-19-virus-detected-using-real-time-rt-pcr

In order for a virus like the COVID-19 virus to be detected early in the body using real time RT–PCR, scientists need to convert the RNA to DNA. This is a process called ‘reverse transcription’. They do this because only DNA can be copied — or amplified — which is a key part of the real time RT–PCR process for detecting viruses.

Winter February 6, 2021 9:04 AM

@jon
“The South African variant B1351/501Y.V2 is known to trigger only portions of the PCR tests in use. ”

That kind of variation is part and parcel of PCR tests. It is pretty easy to change to a different region. Or to do more regions. They already tend to do 2 or more different test to filter out errors and contamination.

Winter February 6, 2021 9:20 AM

@Jon
“real time RT–PCR, scientists need to convert the RNA to DNA. This is a process called ‘reverse transcription’. ”

The RT in “RT-PCR” is for reverse transcription.

dbCooper February 6, 2021 10:29 AM

Recently watched this show that had been sitting on the DVR for a few weeks. The story of Elizebeth Smith Friedman. I found it to be time well spent, a fascinating person and life.

“Aired January 11, 2021
The Codebreaker
Wife. Mother. Secret American Hero.
Film Description

Based on the book The Woman Who Smashed Codes: A True Story of Love, Spies, and the Unlikely Heroine Who Outwitted America’s Enemies, The Codebreaker reveals the fascinating story of Elizebeth Smith Friedman, the groundbreaking cryptanalyst whose painstaking work to decode thousands of messages for the U.S. government would send infamous gangsters to prison in the 1930s and bring down a massive, near-invisible Nazi spy ring in WWII. Her remarkable contributions would come to light decades after her death, when secret government files were unsealed. But together with her husband, the legendary cryptologist William Friedman, Elizebeth helped develop the methods that led to the creation of the powerful new science of cryptology and laid the foundation for modern codebreaking today.
”

More details can be found here:
https://www.pbs.org/wgbh/americanexperience/films/codebreaker/

Frank Wilhoit February 6, 2021 12:30 PM

@Security Theater,

You are not “expected” to wear a mask. You are “expected” to have the sense and the knowledge to protect yourself and the conscience to protect others. And the length of time will be determined — is being, has been determined — by how many of your peers lack those attributes.

None of which has anything to do with one particular virus. That is partly because the end of antibiotics would brought it about soon enough; and more because what the past twelve months have shown is that humans are no longer capable of collective action, toward any goal whatever. Think through the implications of that — or not, because no one else will.

JR February 6, 2021 1:14 PM

@all

This is a great book. The only way to stop this is in this book. Gunnison, Colorado is the only place in the world that escaped the 1918 flu. https://www.amazon.com/Great-Influenza-Deadliest-Pandemic-History/dp/0143036491

Personal experience:

  1. Family member “A” diagnosed with pneumonia after isolating at home for months. Wife had COVID cough for weeks. The pneumonia persisted for months but neither ever tested positive to the PCR test.
  2. Another family member “B” works in a primary school and tests every week. She too has had that COVID cough and ill a few times and never tested positive.
  3. Another family member “C” also isolated at home tested positive to a PCR test 3x and asymptomatic. He tested because he spoke to someone outside with masks on. That person tested positive a few days later – asymptomatic. His wife threw him out of the house to isolate elsewhere.
  4. Wife tested 2x that first week and tested negative. She was under State quarantine and not allowed outside. 14 days later she lost her sense of smell and tested again, now she and young son testing positive after having been quarantined (locked inside) for 17 days.
  5. All have tested negative for antibodies.

The PCR test is a joke. Why isn’t there a blood test for this? What other viruses do we test for with a stick up the nose or throat?

Also if anal swabs are now needed then doesn’t that say this is a gastrointestinal “virus” which can be transmitted through food? I do not eat uncooked food when it surges like this. No salad or sushi. China keeps saying they find it on food.

Do colds or flu usually turn up in stool samples? No. As far as I can ascertain they can only detect bacterial infections, not viral.

It took over 10 years for there to be a blood test for HIV. Up until there was a HIV blood test, they looked at White blood cell count. People died from AIDS until the mid 90’s. The HIV blood tests were crucial to stopping death because if people didn’t take medication before the disease exploded, they couldn’t stop it because it turned into cancer. There’s other cancers that are known to start as viruses.

We should be focusing on treatments, not only vaccines. For example, Lyme Disease is a bacterial infection that becomes seriously chronic if not treated early on. Also that ELISA blood test is very inaccurate until you develop antibodies. So I suspect the same thing is happening here and maybe COVID isn’t a virus? It is behaving more like a bacterial infection.

Children not going to school is a very serious problem. If we disallowed all travel and everyone stayed home but KIDS that would be the right thing to do. Also schools should have been held outside in the summer and closed during the winter. But educational administrators couldn’t figure that out.

I don’t think the disease denialism is relegated to a specific political bent. I have friends who carry on with their life as if there was no virus. I have been flying with N95 respirators in my bag for years because there are so many people that fly with colds. Western culture is the opposite of Asia. No one has to tell them to put on masks when they are sick.

SpaceLifeForm February 6, 2021 3:24 PM

Climate change “may have played a key role” in coronavirus pandemic, study says

hx xps://www.cbsnews.com/news/climate-change-coronavirus-bats-study/

Clive Robinson February 6, 2021 6:40 PM

@ SpaceLifeForm, Anonymous, AL, ALL,

They never saw the need of separating the comms and encryption.

Few do these days, which is a very real problem as I keep pointing out. But historically that is an oddity, nodoubt due to the insidious nature of technologies “ease of use” failing.

Encryption has from the eariest times that we have records for untill the 1990’s always been seen separately from communications.

In the main because it was something you had to do seperately and it could be very time consuming, thus specialised clerks were employed to do it untill the advent of machine ciphers a little over a century ago.

Now with “secure messaging applications” encryption and all that goes to support it such as Key Managment (KeyMan) is hidden almost entirely from users, who thus nolonger see the dangers and difficulties and just how fragile it is.

I’m one of those odd people that next to never uses encryption these days[1] yet knows a lot about it due to actually using it effectively in the raw and preparing KeyMat and similar for others. I’m unlike most modern encryption users who never ever see it in any form thus have no knowledge of it or it’s failings.

As a “specialist”[2] In many areas, I try to warn people of the dangers of “ease of use” and get marked as having a bit of dour’ness. In part because even other supposed specialists tend to “go with the flow” of “out of sight out of mind” policy rather than fight the tide… Which unfortunatly lets snake oil salespersons and con artists prosper, much as the fable of “The Emperor’s new clothes” fortells.

Thus people loose contact with the underlying reality and get hurt as a result…

There is an old English saying that “Pain is a stern teacher” I guess those “Encrochat” users now facing what will almost certainly be prejudiced trials will learn the meaning of it when it comes to encryption “made easy” by technology.

It’s easy to argue they deserve the consequences, but that is by no means true of all people who have been likewise duped.

But more importantly I hope others such as potential whistleblowers and the like learn from the Encrochat and secure messaging apps mistakes, and take appropriate steps to avoid single points of failure.

[1] It is never wise to base your privacy thus security upon just one very obvious thus easily recognised/stopped technology. So when I need privacy I do several things thus if one fails I still have the assurance of the others working. A point that again appears to have been removed from sight by technology…

[2] A term I do not take very seriously for various reasons, not least is having read “the book” when not yet a “spotty youth” and around the time I started learning how to build canoes and boats, and my mebtor Ron Jolt who had a similar way of not taking life to seriously whilst being a master craftsman. You can now read the book online and I hope you enjoy it,

http://www.journeytoforever.org/farm_library/specialist.html

Potatoe Joe February 6, 2021 6:41 PM

@JR:
Covid can and does travel throughout a infected body. Like herpes, it can persist for a long time in varius tissues. This includes children. Pancreas, brain, kidneys, gastrointestinal tract, gonads, lots of fun places it can end up in even for asymptomatic hosts.
Strokes, aneurysms, type 1 diabetes, diarrhea, infertility, (temporarily?) diminished IQ, all due to covid infection have been observed.

Point is, yes anal swabs may track down asymptomatic hosts, say children who have covid, carry it and transmit it, but test otherwise negative due to lacking the ace2 receptors where adults and teens have them or develop them and swabs thus fail.

You can still tell asymptomatic kids had covid due to typical inflammation markers, some medium-term damage, but as Clive helpfully noted, HIP means the body of studies suggesting kids aren’t infectious or superspreaders will grow for various reasons; one of them, testing poorly as noted above.

Germany as of yet labors very hard to go full HIP. With germany’s major elections this year, only hope they have, seed as much fud as they can to escape accountability.

Merkel would hate to have the over 60000 and rising covid related deaths in germany as her most notable avoidable dark legacy. Bankrupting healthcare, installing a known inept health minister and even worse a thoroughly incompetent EU commission president to handle the greatest challenge germany and europe faced during her reign are all tied directly to merkel.

Much like putin can only hope he won’t be known as underwear poisoner to future generations, as his most remarkable mistake.

Still think sputnik v is a remarkable accomplishment. Does merkel have something like that speaking in her favor?

In any case, one can only hope israel’s phase 1 study testing an actual cure for covid’s worst case gets equally accellerated without hitches.
Because what we need aren’t new flu-like covid shots per year, diminishing returns and dengue-like specters looming included. Getting inoculated now or having had old covid strains may open you up to a less efficient Aor potentially fatal immune response against newer deadlier mutations.

If the waves keep on going strong.

I’d prefer a clear-cut immune system adjustment neutralizing what makes covid so much more devastating, persistent and difficult to deal with.

There’d be far less logistics required to ship cures to prevent deaths, at least if immunization lags as it does now. And lets face it, anti-vaxxers and mutations will win.

Patriot February 7, 2021 1:49 AM

@Anonymous, @Clive Robinson

Is it “interception” if the malware stores the message on the device before forwarding it to the police?

It depends on how much you want the information.

So, this is important. Reasonable expectation of privacy is now going out the window in the U.K. and the E.U. Both of them have no choice. Neither even control their borders. The U.K. could, but they do not, not even during this global pandemic. Neither the U.K. nor the E.U. knows who has recently arrived into their territory illegally. Nor do they really seem to care. Try to figure that out.

Hacking a server is not interception. Of course it isn’t. Boots on the stairs and knocking your door in at 3 a.m. is not an invasion of privacy either.

This little piece of news tells us the direction in which things are going. I am reminded of Hobbes: it is always rational to give up your rights to a sovereign.

We are moving step-by-step towards a Geheime Staatspolizei in Europe, and this is not good. On the other hand, it’s a growth industry. Dust off that resume and get ready!

Wesley Parish February 7, 2021 2:02 AM

In the likeliehood that nobody’s seen this yet:

How the United States Lost to Hackers: America’s biggest vulnerability in cyberwarfare is hubris.
https://www.nytimes.com/2021/02/06/technology/cyber-hackers-usa.html

The hubris of American exceptionalism — a myth of global superiority laid bare in America’s pandemic death toll — is what got us here. We thought we could outsmart our enemies. More hacking, more offense, not better defense, was our answer to an increasingly virtual world order, even as we made ourselves more vulnerable, hooking up water treatment facilities, railways, thermostats and insulin pumps to the web, at a rate of 127 new devices per second.

[…]

America remains the world’s most advanced cyber superpower, but the hard truth, the one intelligence officials do not want to discuss, is that it is also its most targeted and vulnerable. Few things in the cybersecurity industry have a worse reputation than alarmism. There is even an acronym for it: “FUD,” short for “fear, uncertainty, and doubt.”

[…]

Starting in 2007, the United States, with Israel, pulled off an attack on Iran’s Natanz nuclear facility that destroyed roughly a fifth of Iran’s centrifuges. That attack, known as Stuxnet, spread using seven holes, known as “zero days,” in Microsoft and Siemens industrial software. (Only one had been previously disclosed, but never patched). Short term, Stuxnet was a resounding success. It set Iran’s nuclear ambitions back years and kept the Israelis from bombing Natanz and triggering World War III. In the long term, it showed allies and adversaries what they were missing and changed the digital world order.

[…]

But every calorie the United States expended on offense came at the cost of defense. And over the decades, this trade-off gnawed at Mr. Gosler. Finding Gunman in those typewriters had been a feat. Finding its equivalent in our fighter jets or even the average high-end car, which now has more than 100 million lines of code? Good luck.

[…]

“Gunman didn’t impact the average American where they would feel it, but SolarWinds is getting pretty darn close,” Mr. Gosler told me recently. “It’s so pervasive. It’s one step from SolarWinds into the electrical grid. If the average American can’t feel that? What is it going to take?”

Just thougt, @Bruce, you might appreciate this little note of confirmation of what you’ve been saying for ages, about offense versus defense, from the NY Times.

Patriot February 7, 2021 2:10 AM

The Pentagon and the Biden Administration are going to move against suspected extremists in the ranks.

Something tells me that BLM and other organizations on the Left are going to be lionized with flowers strewn at their feet. Loot a store, burn down a building, become a hero.

QAnon is going to be rooted out, and the only conspiracy theories that will be supported are ones against Donald Trump and anyone else who dares stand up against big data, big donors, big intell, and Wall Street. “Donald Trump is a Russian spy,” OK, that is good. “Hunter Biden sold access to his dad,” NO, NO, NO. “There is evidence,” No, No, No, you evil conspiracy theorist!

I hope that Antifa gets as much attention as QAnon.

Time to signal your virtue if you want to become a hero.

Clive Robinson February 7, 2021 3:50 AM

@ AL, Anonymous, SpaceLifeForm, ALL,

This “contemporaneous” issue is the test under U.S. law. It could be viewed as not contemporaneous because the storage occurred a moment before transmission. It looks like in an E2E situation, the activity immediately preceding the transmission needs to be looked into. I wonder what Signal does.

I’ve been mulling this over, to see which way it’s going. As lawyers are “salami slicers” by nature training and profit, they still have great faith in the disproved theory that “The finer the cut the more transparent the slice becomes”… It is after all how they make more money and the Upton Sinclair rule applies in spades with them.

The reality is though “The finer the cut the less integrity there is” untill you end up with a pointless usually disgusting mess in which they then chose to wallow profitably.

But back to the problem which is,

“storage before transmission”

It has always been a requirment of communications even if it is just composing a sentence in your brain before saying it…

More importantly if you want to communicate less directly and send a letter, you have to first write it down on paper, this much is obvious to most people. Thus in the warped contemporaneous argument the entire message has been stored long before transmission. My view point is the mear thought to communicate is actually the start of communication, thus the composition in the mind is where the communications starts as from then untill it is read into the intended recipients mind is all part of the communications process.

Likewise but less obvious to users are emails and SMS’s etc they are all buffered untill transmission across a segment of the transmission path is actually initiated.

The reason for the buffering is one of simple engineering it is because it is both more efficient and more reliable, thus giving a higher value of “availability”. And in most cases “availability” is what the customer wants in a communication system, followed by reliability of delivery. Actually speed of delivery is generally not an issue as long as it is reasonable by some human measure. Thus buffering is the technical solution way to go to get availability and reliability.

Unfortunately buffering is always going to be seen incorrectly by some as “store and forward”. Thus the question is,

“How thinly will they slice?”

Arguably under their point of virw putting your finger on a key on a keyboard is “storing” not “sending” as it occupies a moment of time before the release of the key.

But using their false salami slicing argument, lets look at encryption.

Mostly we use a varient of block ciphers of 128bits width or more. The base ASCII charecter set is 7bit thus each encryption can hold 18 characters and 2 additional bits. By their argument all 18 characters are “stored before sending”…

Is it any different for “stream ciphers”? not realy if you keep slicing the argument down they will argue that holding a character or even a single bit in a computer register prior to the XOR or ADD function that mixes in the key stream is “stored before sending”.

Thus by their salami slicing argument any use of a computer is “storing before forwarding”.

The further consequence of that is as all data networks are segmented and have switching nodes that very temporarily hold the data, that also must be “stored before forwarding”.

But you can salami slice a little further. Back in the late 1940’s and through into the 1960’s various ultrasonic “delay lines” were used to store data. That is the data bits were transmitted into a Shanon Communications Channel where some time later they were received and amplified. Thus the communications media is also storage if you salami slice far enough…

Thus by their store before forward definition all communications channels are actually storage, thus always available to be collected…

Thus we reach the point of,

argumentum ad absurdum

And demonstrate that their view point entirely negates the notion of “communication” protected or otherwise, as it is all “store” even when forwarding by their definition.

Non Compos Mentis February 7, 2021 4:00 AM

Just to let you know, @Patriot, that one thing both security experts and left-wing activists agree on, is that accusations come easily, but attribution is hard, and there’s many a slip ‘twix cup and lip. Left-wing activists also know that the government – and right-wing reactivists – often plant agentes provocateurs in their ranks.

Or in other words, are you really commenting on “antifa” – or are those looters actually right-wing layabouts taking advantage of disruption? Attribution without evidence or in the face of compelling contrary evidence, is not particularly helpful.

Clive Robinson February 7, 2021 5:45 AM

@ Ismar,

With regards the Nautilus artical on the semantics of viral evolution to escape immune systems.

Bringing up the subject of specifity in the mRNA used by both Pfizer and Moderna with one of the systems developers brought fourth the following,

“Bryson said, “I think our model underscores the importance of using the full length of the spike as an immunogen, as opposed to prioritizing particular regions of the protein over others.” He said it is fortunate that a lot of the vaccine designs are focused on the full-length spike protein, which their model suggests is a good move.”

Or in other words the mRNA immunizations are too specific thus fragile in the face of viral mutation, that increases proportionatly to the number of hosts past and present. As we know this rises exponentially if alowed to we have a problem.

The only solution to which we have currently is quarantine from individuals through social pods/bubbles of familes etc through to workers and small locals or geographic regions.

Thus anyone arguing for lifting of quarantine / lockdown is arguing for exponential rates of mutation thus the rendering ineffective of vaccines and prolonging of death and longterm injury to people.

Something that politicians should take on board now more than ever… We were saying it this time last year and western politicians ignored it, some even made foolish claims against it. Now here we are a year later with millions of people having been infected and the virus almost beyond control.

If we do not lockdown hard then the virus will mutaye faster than we can come up with new vaccines, which brings up a question nobody realy want’s answered practically,

“One the assumption mutations have to be finite, how many mutations are there to go through?”

But the mutations might not realy be “finite” in any meaningful human usage of the word…

Winter February 7, 2021 6:51 AM

@Clive
“Or in other words the mRNA immunizations are too specific thus fragile in the face of viral mutation, that increases proportionatly to the number of hosts past and present.”

mRNA vaccines are impractical and much too expensive. They are needed to start vaccinating early. But when the other, more conventional vaccines become available in numbers, they will be used. They can be mixed and adapted to include conserved regions and new variants.

There are 7+ billion people who have to be vaccinated. mRNA vaccines are not going to do that.

Winter February 7, 2021 6:57 AM

I just read that the UK government thinks a yearly vaccination round against COVID19 will be needed, just like the flu campaign.

Sounds logical.

s7ickup February 7, 2021 8:20 AM

During my last venture into the Apple app store I stumbled upon a new section called ‘app privacy’. I wasn’t impressed. Who would be when you’ve found out that your portable office suite is sniffing around and the ‘privacy-touting firm’ state themselves that they’re collecting ‘data linked to you’.

Some other apps self-report even more unsavoury things.

I used to fiddle with AOSP’s apks and various Java/DEX de-compilers. I know – vaguely – what’s happening in the Android land. Now I’m curious about the iOS. Unfortunately it’s not that easy to obtain ipa files for analysis.

Has there ever been an extensive analysis of what iOS apps collect and transmit?

What I’ve been able to glean from the cursory Net search gives me a pack of ‘apple is so good’ articles aimed at the general population, with little actual data besides a half-arsed marketing pitch, and a few a bit more cynical ‘apple are bs-ing’ blog materiel.

Clive Robinson February 7, 2021 8:28 AM

@ Winter,

They can be mixed and adapted to include conserved regions and new variants.

That appears to be the idea behind the Russian “Sputnik V” vaccine, in the peer reviewed Lancet artical.

As I understand it the first AD26 virus is aimed at COVID with the full spike protien sequence. Then to stop the body becoming sensitized to the adenovirus the second shot is AD5 with variations (not sure how that works but apparantly it does).

Based,on the currently small phase III results from Moscow it’s the most effective vaccine so far.

However there are several other phase III tests going on in other parts of the world so we need to wait on those results as well to get a clearer picture.

We do know that the Russian Research group, AZ and Oxford Rrsearch groups are getting together so hopefully any arras lacking in the individual vaccines will be made upfor in the combination.

However the major downside on the Russian vaccine is again the “Chill chain” where -20C is needed which is a little beyond most easily available freezers… Though there is a desicated version that needs less of a chill factor.

But one thing should be noted, like it or not Vladimir Putin made a choice, wait for phase III results or putting it in peoples arms based on Phase II results to try and slow the pandemic spread. He went against normal medical practice and opened up general vaccination as Phase III started.

He may just have saved quite a few lives by so doing.

I guess we are going to have to wait and see how things go. But I’ll be honest, if I was in a similar position, and knowing just how dire things had got in Russia, I might well have made the same choice.

With regards,

I just read that the UK government thinks a yearly vaccination round against COVID19 will be needed, just like the flu campaign.

Yes it looks like an inevitability as we’ve let things go to far.

But remember the flu vaccine only works maybe two years in three. Which is quite bad even though the CFR is low for flu. At a couple of decades greater the CFR for COVID mutations could be worse than we are currently seeing. Because people will assume incorrectly they can live what they consider “normal lives” thus not take sensible measures.

Thus I think mask wearing and social issolation with limited social pods/bubbles will become the norm and “going home for xmas/new year” or thanks giving in the northern hemisphere will become a custom best dropped with maybe a new holiday toward the end of August to do the get togetherness stuff.

JR February 7, 2021 11:11 AM

@Potato Joe and Clive Robinson

Thank you both.

You probably haven’t seen this. The original source is behind a paywall.

(URL broken)
https://www. foxnews.com/media/washington-post-editorial-board-calls-for-answers-from-china-on-pandemic

The original source is owned + operated by Jeff Bezos. Given that everything on Amazon is sourced there, I think he now recognizes that he may never get his tech staff back into their offices unless they find the source of the virus and can create better tests and treatments.

Due to their age, tech employees in their 20’s/30’s will be the last in line to get the vaccination and US law disallows immigrants from getting the vaccination until every American is vaccinated. 75%+ of his Amazon Headquarter staff are foreign visa holders who are not supposed to work from home. Other tech companies opened their offices to allow their foreign visa holders to remain in compliance to protect their status.

Employers also have to pay the hospital and health costs of their visa holders 100%. But it’s not safe having 200,000+ visa workers in Seattle unvaccinated for the next year or 2. Seattle was the site of the first COVID patient in the USA.

I know people who wear a mask all day at work. Some are very young. They claim they cannot breathe or think well. Those who go to work everyday have gotten sick too. This won’t be a solution. Office work is over for the foreseeable future and companies that are planning for this will thrive. But different security investments and controls need to be incorporated. For a year now everyone has ignored WFH security risks.

For one, WFH tech workers shouldn’t be using the same WiFi that kids are using for school. Workers should not be using WiFi. They should have a separate account with a different provider, company provided router and ethernet only. When I worked from home for a security conscious employer 10 years ago this was required. I needed to have 2 sources of connectivity. There are a lot of other techniques I employed in my 18 years of work from home, but I am shocked to see everyone pretending like this is going to end soon. It won’t.

I am going back to landline copper phone. I have given up using my mobile phone due to its privacy nightmare. I just use it for calls and nothing else.

I heard that Jeff Bezos and Mark Zuckerberg could afford to pay for the world to be vaccinated. I would say that is probably a wise investment given their businesses count on the world staying alive. I don’t think complaining in a newspaper will solve this. But it is worth reminding everyone that if anyone wrote an Op/Ed like this during the last President’s tenure, the author was censured, likely fired and ostracized as a xenophobic freak. Facebook and Twitter banned journalists for suggesting this a year ago. Now that we have a new President truth will come out? I hope.

JonKnowsNothing February 7, 2021 11:20 AM

@ Winter @Clive

re: Vaccine Target Areas on the COVID-19 Spike Protein

The COVID-19 spike protein has several potential target areas on it.

  • Receptor Binding Domain (RBD) : allows it to dock to body receptors
  • N-terminal domain (NTD) : The “other end” of the spike

The current investigations primarily target the RBD where the spike connects to the ACE2 cells. The other end of the spike NTD is getting more attention.

There are some factors in evolving studies:

  • RBD focus: vaccines target only small aspects of the spike end, in theory because all they need to do is create a enough of a mimic that antibodies recognize it.

If the spike mutations twist the RBD too much it cannot attach to the ACE2 receptor. These mutations die out quickly as they are not viable but also show some vulnerable areas in the spike, eg which genetic changes are non-viable changes.

  • NTD focus: This area does not change as much as the RDB. It is a more stable portion. NTD is the second most active area for antibodies after the RBD. Targeting NTD might be more a therapy pathway a than preventive path.

All the NTD antibodies target a single immunodominant site on NTD, involving the N1-loop (NTD N-terminus), N3-loop (supersite β-hairpin), and N5-loop (supersite loop).

  • Antibodies can connect Up or Down or Both Directions along the spike. Chemical bonds determine the connector points.
  • Protein Fold Issues: Some mutations are shifting the way the protein folds which buries or hides the antibody recognition sites.

Antibody Escape mechanisms can be a direct alteration of the antibody recognition point (eg deleted sequences) or by the protein folding over the site receptors (eg shifting the structure).

ht tps://www.news-medical.net/health/What-is-a-Receptor-Binding-Domain-(RBD).aspx

ht tps://en.wikipedia.org/wiki/N-terminus

The N-terminus (also known as the amino-terminus, NH2-terminus, N-terminal end or amine-terminus) is the start of a protein or polypeptide referring to the free amine group (-NH2) located at the end of a polypeptide.

ht tps://www.news-medical.net/news/20210122/Novel-neutralizing-antibodies-targeting-SARS-CoV-2-N-terminal-domain-discovered.aspx

ht tps://doi.org/10.1101/2021.01.18.427166

SARS-CoV-2 501Y.V2 escapes neutralization by South African COVID-19 donor plasma Jan 19 2021

(url fractured to prevent autorun)

lurker February 7, 2021 11:29 AM

@Winter

There are 7+ billion people who have to be vaccinated.

I’m with @Potatoe Joe

There’d be far less logistics required to ship cures to prevent deaths…

There was a brief flurry in the first few months, but since then all the visible effort has been on the race for a vaccine. Even the most rosy-eyed optimist must now admit Covid is here to stay, and all the vaccines together won’t get rid of it. So where is the cure? Oh yes, it’s a coronavirus, like the common cold, uncurable…

JonKnowsNothing February 7, 2021 12:30 PM

@Lurker

re: Covid is here to stay

This is only true in Herd Immunity Policy (HIP) countries like USA, EU, UK, Sweden (the Founding Nation of Herd Immunity Policy).

A common bias of people living in HIP countries is to presume that everyone else faces the same issues of forever COVID-19, forever Deaths, forever Shutdowns, blitz Close Downs and forever Distancing.

If you live in a country that practices Eradication, there is ZERO / NIL COVID-19. New Zealand just celebrated a national holiday and if you check the pictures there are No Masks, No Distancing because they are Not Needed as they have Zero COVID.(1)

Countries in the Eradication Group need to be Eternally Vigilant and maintain their quarantine systems to prevent the HIP countries from using COVID-19 as a Biological Warfare Weapon against them.

Countries in the Eradication Group still trade and export/import globally; it’s a lot easier to decontaminate a shipping box(2) than decontaminate a USA NoMasker. (3)

1, ht tps://www.theguardian.com/world/2021/feb/06/new-zealand-celebrates-waitangi-day-with-dawn-service-bacon-butties

2, There have been cases where the shipping container was the transfer point for COVID-19 entry.

Aug 13, 2020,
ht tps://www.straitstimes.com/world/what-we-know-about-possible-covid-19-transmission-from-freight-and-packages

11 23 2020
ht tps://www.theguardian.com/world/2020/nov/23/shanghai-covid-outbreak-traced-to-cargo-from-north-america

3, Every zombie story, novel or movie all end the same way: Zombies want everyone else to become Zombies and those that do not want to become Zombies isolate and setup quarantine zones. Eventually the Zombies run out of converts and the quarantine groups survive.

(url fractured to prevent autorun)

MarkH February 7, 2021 12:47 PM

@Security Theater:

The only anti-transmission measures I think likely to be widely adopted are partially effective.

Fortunately, partially effective mitigations can lead to very good outcomes. Once new infection rates have subsided, then limiting the reproduction rate is extremely helpful.

If conditions are such that a typical value for R is around 0.5 (for example), such new infections as may appear from time to time will spontaneously self-extinguish with average spread to very few persons.

========================

It’s baffling to me that I haven’t seen more about ventilation.

For example, I suppose it to be feasible to design a conference room in which airflows are primarily downward, with fresh air supplied from the ceiling, and outflow vents around the periphery and along the middle of the conference table.

Probably this can be done in such a way as to reduce the probability that an infected person would spread enough particles to others in the room by a large factor.

Retrofitting this to innumerable conference rooms would require a very large capital expenditure, but surely some organizations have the budget and would deem it worthwhile. And where new construction is concerned, designing in such airflow would be less costly.

========================

What could be done in a building, might be more practical in public transport. I don’t know the figure, but I suspect that the average lifetime for buses, tramcars etc. is not many years.

Managing airflow in such environments would be far more complex than my conference room example, because of crowding and different heights of passengers’ heads.

However, if a workable solution (remember, it doesn’t need to be perfect) can be devised, it’s so much easier to design this into new-manufacture public transport vehicles than to retrofit office buildings.

========================

The key concept is that none of this needs to be perfect. A factor of several reduction in person-to-person transmission is enough.

Accordingly, I can imagine that by 2035 or so, masks would no longer be necessary on public transit.

It’s easy to forget that human epidemics are primarily social phenomena, not natural phenomena. You can go back as far as you like in history … epidemics have been by-products of people’s living conditions.

How we will fare with the reality of contagious diseases will be determined by social decisions.

MarkH February 7, 2021 12:56 PM

.
Article on COVID-19 Mutations

I’ve been to busy to read most of the comments, so my apologies if this is duplicative.

Those interested in the recent SARS-CoV-2 mutations (especially B.1.1.7) may find this NY Times article from 18 January to be of interest.

It includes beguilingly beautiful illustrations and a surprising amount of detail.

Some interesting quotes:

Researchers think the N501Y mutation has evolved independently in many different coronavirus lineages. In addition to the B.1.1.7 lineage, it has been identified in variants from Australia, Brazil, Denmark, Japan, the Netherlands, South Africa, Wales, Illinois, Louisiana, Ohio and Texas.

A number of researchers suspect that B.1.1.7 gained many of its mutations within a single person.

None of these variants are expected to help the coronavirus evade the many coronavirus vaccines in clinical trials around the world. Antibodies generated by the Pfizer-BioNTech vaccine were able to lock on to coronavirus spikes that have the N501Y spike mutation, preventing the virus from infecting cells in the lab.

Experts stress that it would likely take many years, and many more mutations, for the virus to evolve enough to avoid current vaccines.

JR February 7, 2021 2:20 PM

@Clive Robinson – I will agree to disagree with you. I worked for a Wuhan based company in 2019 to 2020. Their factories/offices were closed for only 3 weeks in early 2020. There’s more.

If this is lab created, then we need an antidote, not a vaccine.

A US Senator came down with COVID after receiving his 2 vaccines. People probably need to be quarantine for the entire period between their first shot and until 2 weeks after their 2nd vaccine is received. Otherwise no vaccines will work for long.

I am preparing for March to be a breathtakingly bad month for the West.

Look at this date (URL fractured)

I don’t get why people here focus on COVID every week while there’s so much interesting cybersecurity news to discuss. 12 people I know have died from this, 4 of whom were my (middle) age. My whole family in 3 states had it too. The US has no vaccine left, except if you are a Spinning Instructor at Soul Cycle. And so few people create antibodies that there’s no plasma either. Plus the blood banks are really low because people are afraid to donate.

I don’t watch TV for the same reason I may give up this blog. 24/7 virus is just too much. Now this IS interesting:

https://arstechnica.com/information-technology/2021/02/solarwinds-patches-vulnerabilities-that-could-allow-full-system-control/

Does anyone here know whether SolarWinds existed over 20 years ago. I see in the comments that people claim it did but I can find no evidence elsewhere that it did.

Also the Paige Thompson trial begins tomorrow. That should be interesting.
https://www.justice.gov/usao-wdwa/united-states-v-paige-thompson

JR February 7, 2021 3:11 PM

Between the Super Bowl in Tampa today and Mardi Gras next week the USA is about to be decimated. At Xmas the virus wasn’t spiking out of control like it is now. Photos of people partying in the streets without masks on.

I don’t care about mutations or vaccines. Neither will stop what is happening before our eyes right now. New Orleans is closing bars until Fat Tuesday. Which means next weekend everyone will be partying in the French Quarter’s tight streets just like in Tampa.

I hope the corporations with operations in Tampa have solid Business Continuity plans if they lose productivity of a lot of their workforce located there. Because that could happen in the next few weeks.

Business Continuity and Disaster Recovery traditionally focused on having a secondary location for restoration. Now what happens when everyone is working from home cannot work either?

7,500 of the 22,000 people in Tampa Stadium watching the game tonight are healthcare workers. Vaccinated, but who knows how long ago. I guess we will soon see if the Pfizer vaccine works. That’s what Florida got.

http://www. justjared.com/2021/02/07/how-many-people-are-at-super-bowl-2021-stadium-is-only-30-full-due-to-covid-19-pandemic/

JonKnowsNothing February 7, 2021 4:42 PM

@MarkH @Clive @All

re: Once new infection rates have subsided, then limiting the reproduction rate is extremely helpful.

The infection rates reduction timetable for HIP Countries needs to be extended to account for: reinfection, cross infection, double infection, back to back infection from multiple COVID-19 variants. Essentially multiple pandemic responses for each type. Currently complicated because they are all “In Play Together at The Same Time”.

Once the non-501 D614G current variant becomes extinct, you only have to deal with the N501 versions. N501s are expected to become the global dominant forms by March 2021. (1)

re: Ventilation Airflow Managing Airflow Environments

@Clive posted some interesting aspects he had investigated on sanitizing air flows, along with his friend that sadly passed away, ending their project.

Hospitals use UVC systems to sanitize airflow. There are UV Air Disinfection Sanitizers System Wall, Floor, Ceiling, Portable units @$2000 for small room systems. There are consumer oriented systems of varying sizes and costs.

How effective these smaller units are, I don’t know. UVC can cause other health problems too.

If one is considering a belt+suspenders option, the hotel needs to place a large capacity UVC system at each of its A/C systems or in a chain at the exterior intake area. This cleans all air coming into the building.

Clearly many hospital systems are not rigorous enough to deal with the high viral loads during surges. So you need something capable of handling the expected capacity and viral loads.

In many commercial buildings and residences in the USA, the A/C Heat systems is delivered by duct work, either traditional ducts or 4 inch heat pump tubing. A smaller UVC light needs to be installed inside the ducts at each ingress and egress of ducts. The ingress one is to make sure nothing escaped the outside roof mount systems gets into the room and the egress UVC makes sure nothing leaves the room.

With Airlines, they need something smaller or more portable such as the units Clive and his friend envisioned. Everyone would buy one for themselves. It would be a mask + UVC cleaner in an air-rebreather / bellows.

Medical AmbuBags cost $15+ or a re-breather scuba systems for @1k+ outfitted with a UVC component. Maybe a Self-contained breathing apparatus like firefighters use would work on air flights.

1, ht tps://www.schneier.com/blog/archives/2021/02/friday-squid-blogging-live-giant-squid-found-in-japan.html/#comment-368788

ht tps://en.wikipedia.org/wiki/Germicidal_lamp
ht tps://en.wikipedia.org/wiki/Rebreather
ht tps://en.wikipedia.org/wiki/Bag_valve_mask
ht tps://en.wikipedia.org/wiki/Self-contained_breathing_apparatus
(url fractured to prevent autorun)

vas pup February 7, 2021 5:03 PM

@ALL

I just read some vary valuable quotes from immortal book ‘1984’ content of which as a whole is related to this blog.
Just take a look at:
https://www.goodreads.com/work/quotes/153313-nineteen-eighty-four

It is always good to remember the following:

“Being in a minority, even in a minority of one, did not make you mad. There was truth and there was untruth, and if you clung to the truth even against the whole world, you were not mad.”
― George Orwell, 1984

To the most known quote:
“War is peace.
Freedom is slavery.
Ignorance is strength.”
― George Orwell, 1984

I’d like (not competing with great author) to add two which are directly related to the nature of this respected blog:

“SURVEILANCE IS PRIVACY.
DOUBLE STANDARD IS JUSTICE.”

You may add your own.

AL February 7, 2021 5:16 PM

@Clive, @JR
I’m in the camp that a lab leak is possible in Wuhan, in part, because of the Chinese response to the outbreak. While some were critizing the response as draconian, that would not be so if they were operating under the belief that they had had a biological accident.

Anyhow, the WHO is hardly going to get to the bottom of this by sending someone who funded “gain of function” research in bat coronaviruses at Wuhan. This WHO investigation is led by someone who led a campaign Feb 2020 that any suggestion of a lab leak was a conspiracy theory, so he’s hardly the guy that will get to the bottom of this in 2021. And there are a number of other investigators that had concluded in 2020 that any lab leak was a conspiracy theory.

I don’t know what WHO is thinking in sending people with a dog in the fight. They don’t have a lot of credibility now.

While I don’t know what happened, I think it would be a mistake not to stick in one’s calculus the possibility that this virus was enhanced before the pandemic started.

Critical February 7, 2021 5:37 PM

>SARS2 is believed by some to be a two step zoonotic mutation of bats-angolin-human. Others disagree untill science shows what is most probable it’s best to keep an open mind on it.<>What we do know is that both bats and pangolin are “bush meat” animals that are falsely imbued with desirable properties based around the notion of transferable vitality (same thing behind the rhino horn nonsense, and the madness that is homeopathy).<<

Mr. Robinson, please stop spreading humbug and please stop trying to cover your personal lack of knowledge by using the collective "we" as camouflage for your own, unfounded and simplistic, superficial opinions on such important matters. You are doing yourself and this community a disservice by writing about areas where you lack of expertise is immediately evident to anyone who has the most basic degree in biology or any other life science.

It would almost be laughable if it weren't so sad as this constitutes a typical example of the Dunning-Kruger effect in action.

Your above two paragraphs aren't a display of caution and scientific demureness, they are a manifestation of evidence-less arrogance and stupidity that lay testament to the fact that you are completely out of your depth and consequently have no clue what you are talking about.

Please take the time to do the required reading to develop the necessary foundations of understanding to be able to process, analyze and comprehend the laid out information for you to come to the factually true conclusions:

https://www.rootclaim.com/analysis/what-is-the-source-of-covid-19-sars-cov-2

and

"A Bayesian analysis concludes beyond a reasonable doubt that SARS-CoV-2 is not a natural zoonosis but instead is laboratory derived":

https://zenodo.org/record/4477081#.YBxD4HlOnIX

and

https://www.youtube.com/watch?v=LDllZprNJ5g

R U Dumb as an Ox February 7, 2021 6:39 PM

CRITICAL YOU ARE NOT…

Did you do any checking of say,

Steven Carl Quay?

Did you know he is an ultra right christian fundamentalist?

And member of a right wing think tank?

As well as others he has more than skin in this game, you should do a little digging.

xcv February 8, 2021 1:38 AM

@ name.withheld

Util then, my perception is simple. Occam’s razor with an attitude.

That’s a brutal thing. Judas Iscariot had the wherewithal to shave himself and betray Jesus with a kiss, without even mentioning the thirty pieces of silver. Couldn’t he have cut the rope from around his own neck?

Peter also had a sword or a knife or razor sharp enough to shave with in any case, which the high priest didn’t want to allow him to possess, and Peter denied knowing Jesus, but then Jesus touching the matter set them straight that no servant of the Roman empire was going to lose his ear just because Peter was allowed to shave his sideburns.

Tatütata February 8, 2021 2:21 AM

Elena Debré, These Places Were Not Ready for Flash to Die, Slate 5 February 2021

Officially, the Flash demise occurred in two parts. First, Adobe stopped supporting Flash on Dec. 31, 2020. Then, on Jan. 12, Flash stopped running on all servers, rendering it defunct. Since some old Adobe software wasn’t programmed to self-destruct, Adobe instructed its users to uninstall Flash manually, lest leaving themselves vulnerable to attack.
In late 2020, as Flash D-day drew near, supporters scrambled to rescue it. Petitions to save Flash collected thousands of signatures online. A movement to save a Flash game called Habbo Hotel trended on Twitter. Social media feeds buzzed with nostalgia for the “old internet.” Flash fans organized to preserve beloved video games and animations, which now live on forever in the Internet Archive blog, Flashpoint, and Ruffle.
But, some company and government systems were not as well organized. They continued running on Flash until its last moments. Crashes and chaos ensued. The Flash blackout reverberated across the world:

I had already heard of the railway system in China that stopped working, and laughed heartily, but the final story is slightly less spectacular than initially reported. They were nevertheless still in good company.

I wont miss that junk. The only piece of Flash I ever really liked was a silly little game from Japan called Chat Noir.swf, where you try to block a cat from escaping. But I have a copy of it somewhere in a dark corner of my hard drive (do disks have corner?), automatically translated and wrapped in HTML5 and JavaScript.

Winter February 8, 2021 9:53 AM

@ Critical / observer,
“Mr. Robinson, please stop spreading humbug and please stop trying to cover your personal lack of knowledge by using the collective “we” as camouflage for your own, unfounded and simplistic, superficial opinions on such important matters.”

As usual, Clive is more up to date whit the literature than his detractors. Science is not cherry picking, but addressing all facts and information. If you are interested, you can read a recent review of the available evidence:

Bats, pangolins, minks and other animals – villains or victims of SARS-CoV-2?

Coronavirus disease-19 (COVID-19) is caused by the severe acute Respiratory syndrome coronavirus-2 (SARS-CoV-2), which has become unstoppable, spreading rapidly worldwide and, consequently, reaching a pandemic level. This review aims to provide the information available so far on the likely animal origin of SARS-CoV-2 and its possible hosts/reservoirs as well as all natural animal infections and experimental evidence using animal models. Horseshoe bats from the species Rhinolophus affinis seem to be a natural reservoir and pangolins (Manis javanica) appear to be an intermediate host of SARS-CoV-2. Humans remain the most likely spreading source of SARS-CoV-2 to other humans and also to domestic, zoo and farm animals. Indeed, human-to-animal transmission has been reported in cats, dogs, tigers, lions, a puma and minks. Animal-to-human transmission is not a sustained pathway, although mink-to-human transmission remains to be elucidated.

https://link.springer.com/article/10.1007/s11259-021-09787-2

It also debunks the bio-lab link.

lurker February 8, 2021 12:54 PM

@JonKnowsNothing re: Eradication countries vs. Herd Immunity Policy

I prefer to call them Non-Eradication, as some are not wilfully practising HIP but are just sitting on their thumbs letting catastrophe roll over them.

The Eradication countries are at present a rather small minority, both in population and UN votes. The Non-Eradications have a large chunk of geopolitical and economic clout, which could prolong the struggle. At least one good thing from this disease: it has weaned me off Amazon.

Stop The Fomites!

vas pup February 8, 2021 3:31 PM

@ALL respected bloggers:

This quote clearly explains the key difference of the views of representatives of liberal arts field and STEM folks (I hope most of the bloggers ITs or close to it):

“In philosophy, or religion, or ethics, or politics, two and two might make five, but when one was designing a gun or an aeroplane they had to make four.”

― George Orwell, 1984″

It reminds me the statement of supervisor many-many years ago: “When You do computer program design, you do apply logic, but do not try to find logic in Policy. Just follow it if you want to keep employment.”

So, in former 2+2=4, but in latter – it could be anything what those in power want to be equal to. That is the path to doublethink. In former CCCP they use to say: “Right are those who have more rights”.

@Bruce: Do you think it is good idea to do crowd funding (EFF?)for building ‘1984’ related wall with quotes, but at the place where folks who don’t like it and try to deface will get more than slap on the wrist?

JonKnowsNothing February 8, 2021 5:26 PM

@All

re:Critical Infrastructure Water Purification System Unauthorized Access

MSM report of an UnAuthorized Access to a water treatment plant in Florida where the intruder altered the chemical treatment mix to a toxic level.

The system was accesses several times and the access was noticed by personnel but they DID NOTHING because “others often logged in to the system from off site”.

When the chemical mix was changed someone was actually using the system and watched the mouse moving and the functions being selected and the parameters changed. The person who was using the computer when the mouse was hijacked changed the data back.

around 1:30 that same day, the operator watched as someone remotely accessed the system again. The operator could see the mouse on his screen being moved to open various functions that controlled the treatment process. The unknown person then opened the function that controls the input of sodium hydroxide and increased it by 111-fold. The intrusion lasted from three to five minutes.

  • They noticed an offsite access and did nothing.
  • They noticed it for several days and didn’t check anything.
  • They appear to have no logs for offsite access or audit trails.

Many small town utilities services have little or no staff or part time staff. They have no IT or Security Specialists. They mostly do automated billing or valve repairs if something gets stuck.

These people may not have had any one they could call and the Sheriff knows even less about remote access. The unauthorized person knew more about where to look and what to check and where to make a change and what kind of change to make.

ht tps://arstechnica.com/information-technology/2021/02/computer-intruder-tried-to-poison-drinking-water-for-a-small-florida-city/
(url fractured to prevent autorun)

ResearcherZero February 8, 2021 5:28 PM

Is interception legal if it is outsourced to a private intelligence company?
What if individual police officers or detectives do the outsourcing, and can they hack your lawyer… (they do), but is it illegal and how do you prove it anyway?

Free speech is free as long as you have enough money to throw at defamation cases against anyone who might speak out against your activities.

For example, hypothetically, you couldn’t refer to Mercer ever being in the clan publicly, or that he was tracked as early as the 1980’s moving money through shell companies to far right and neo-nazi organizations, that would probably invite a law suit. If you had enough money however you could employ private intelligence services and instead pretend that you are the bastion of free speech and liberty, fighting a war on everyone else’s behalf against an evil cabal of tyranny. It would be complete rubbish of course, but if it’s a private commercial agreement, everyone is going to have a difficult time proving it.

The wonders of exploiting the law for profit. They get a real kick out of it too some people, sitting across the court room laughing, as the people they paid off to kidnap you can’t be connected to them. It’s a strange world where people can do things and then spread disinformation that everyone else is responsible. What did they call it, Project Veritas or something like that?

SpaceLifeForm February 8, 2021 5:34 PM

@ Clive, ALl

More on Encrochat

Like I said, it sure looks like Sources and Methods are being protected.
Here, it is implied that the plaintext was recovered from the phones after delivery. But, it is not clear that is the actual facts of the matter.

hx tps://www.theregister.com/2021/02/08/encrochat_court_appeal_ruling/

These included messages described in a previous High Court ruling as “ongoing… as they were stored in handsets after transmission”.

The Court of Appeal said: “It is not known when or how the malware extracted the messages. There was no evidence about this. No one who gave evidence knew exactly how the malware works, and the French authorities were concerned that this should continue to be the case.”

vas pup February 8, 2021 6:02 PM

@ResearcherZero said:

“Free speech is free as long as you have enough money to throw at defamation cases against anyone who might speak out against your activities.”

In some cases you free even when you committed terrible crimes but have enough money OR go to jail on accordion-type laws: obstruction of justice, perjury in grand jury trial, contempt of court, 1001 Title 18 USC, etc. when subjective part – your motive – have presumption of guilt rather than presumption of innocence.

Conclusion: it does not matter anymore who is right or wrong, who is real criminal or not, but rather who could hire better lawyer, i.e. have MORE money. That is bitter ugly truth, but is better than fall into illusion.

SpaceLifeForm February 9, 2021 12:04 AM

@ JonKnowsNothing

The water plant is not that small and has an IT staff.

Just not a bright IT staff.

They should not have their SCADA and ICS connected to the Internet!

hx tps://www.reuters.com/article/us-usa-cyber-florida/hackers-broke-into-florida-towns-water-treatment-plant-attempted-to-poison-supply-sheriff-says-idUSKBN2A82FV

Clive Robinson February 9, 2021 5:59 AM

@ JonKnowsNothing, SpaceLifeForm, ALL,

MSM report of an UnAuthorized Access to a water treatment plant in Florida where the intruder altered the chemical treatment mix to a toxic level.

Hmm in effect,

“The town installed a RAT that was persuaded to work for someone else.”

So a “backdoor” they indtalled for “Nobody B Us”(NOBUS) was used by others…

Ignoring for a moment the stupidity of installing a RAT, then making it available via a publically accessible network, this has been recognised as a “No No” for quite some time. Something the realy old hands on this blog were talking about oh so long ago, long before stuxnet and in many cases long before most people had heard of “Supervisory Control And Data Acquisition”(SCARDA) systems, or in fact very much at all about “Industrial Control Systems”(ICS) at any level.

What is not clear though is,

1, Did they gain access to the client and then into the server.

2, Did they gain access to the server directly.

Assuming the former, then in effect the “user” was authorised to the server and there was little or nothing a basic “Intrusion Detection System”(IDS) if installed could do.

If the latter, in theory if installed and operated correctly an IDS would have picked up an intrusion attempt, even if the attacker had copies of the required credentials. In practice few who install such systems add such capabilities as IP address detection white lists, or if they do make them too broad for various non technical reasons.

Further the use of a secure rolling time credential token or other non time static credential would have twarted such an attack. But again for various non technical reasons this is not done as often as it should be.

But it is possible the Commercial RAT was found via the Shodan Search tool[1] or even ages old what we now call “script kiddy” IP address port service enumeration[2] that though even more than fourty years later are still just as effective as they ever were to a not fully clued up service administrator. So means in turn we can not say “sophisticated attacker”.

The fact that the Comercial RAT has apparently been installed for “technical support” reasons tells a story all of it’s own (anyone else renember the CarrierIQ debacle?).

Something Microsoft and other big Silicon Valley Corps do not talk about –but I have since before Dr Watson days– is all kinds of “ET Phone Home” telemetry is a beacon to your system even if the data is encrypted right up and beyond the WAZoo[3]. All a mildly competent attacker in a larger organisation has to do is get close to “the mothership” and just sit there passively watching the packets fly by[4]. Equipment for which the likes of Boeing and IBM to name but two of a large cast are known to make, in some cases as just a spin off of standard products.

So I suspect that the Commercial RAT supplier has already gone into “circle the wagons mode” and we will just have to wait and see.

However now “Home Working” has become a predominant way of doing “Business Continuity” in the past year and is likely to remain a fixture for some time to come. Such RAT and Conferancing tools are going to become number one on certain peoples attack lists. Especially as the majority were never previously “Prime Time” thus have not received abything remotely close to the stress testing they needed –need I say Zoom or TeamWorks?– thus are likely riddled with bugs that will now be keenly hunted as the new basis for even the lowest hanging fruit malware…

As I sometimes note, the Chinese historically have a very different outlook on life and just one part of that gives rise to the curse,

May you live in interesting times.

Well COVID sure has given rise to a paradigm shift in “information working” but humans are “Creatures of a herd” in general and “remote working” is not something they like as it creates fear which is only occasionally paranoia, as mostly sufficient people are out to get above others in the hierarchy by stealth or assassination.

It’s said that in any sizable organisation there is one Hawk for every four Doves, the actuall ratio is not that important, all people need to realise is that as Hawks grow, Doves in effect cease to be the prey of Hawks, and the Hawks start to attack other Hawks. This is simply because the hierarchy rewards the extreams of Hawk behaviour, thus becomes an evolutionary factor. Even if it is one that the likes of many out evolved apex preditors proves long term leads to extinction of the spieces or sufficient environmental change to cause the evolutionary factors to change. Which COVID certainly has in the short term, the long term as well if some predictions are correct.

Any way back to more base needs, time to start cooking lunch, “leak and potato” soup or pie some how feals strangely apt 😉

[1] The Shodan search tool has both simplicity and great complexity when it comes to enumerating sites more or less passively,

https://thedarksource.com/shodan-cheat-sheet/

https://monitor.shodan.io/

Look on Shodan as the “little brother” of the sorts of “target enumeration” engines the likes of certain Level III attackers such as National SigInt agencies have that hover up data from the behind the “next hop” routers site administrators can not see beyond.

Shodan’s capabilities are neither new or original, and the use of “netcat”(nc)

https://chousensha.github.io/blog/2014/05/31/network-tools-netcat/

Or other unix tools such as “telnet”, “ping” or traceroute,

https://network-tools.com/trace/

That have been standard on not just *nix boxes but other Commercial OS’s since the late 1970’s (for instance Microsoft nicked the BSD tools befor Win 3). Which early “hackers not crackers” put together in shell scripts and the like, and if you have “Command Line Interface”(CLI) and “scripting” ability will still tell you rather more than most would wish you to know even today, sich is the nature of communications ay a lower level.

[2] It’s the sort of thing I used to do when Telnet was a good tool to get plaintext across TCP header info on just about any sensible system from a PDP-11 upwards (Microsoft had not started networking back then and DOS was still at best a flaky poormans CP/M clone, with NT still just a dream of a better Unix than Unix hiding behind Dave Cutler’s embarrassing T-Shirts).

[3] The entomology is 20th Century but “uncertain” some claim it’s short for “Western Australia Zoo” others more anatomical, either way think about “creeks and lack of paddles” as a similar colourful expression of near meaning.

[4] The fact such packets travel with visable meta-data for source and destination means that your PC has become “known”. With traffic analysis giving near real time information, much else becomes known. As for encryption… well what use is that? Not much realy, especially if some one has been kind enough to give the passive observer the master secret / key that opens the backdoor. Which is a valid assumption with Corps doing business in the UK, US and other places in the world such as Pakistan, Saudi Arabia, Israel and many more (as BlackBerry amongst others proved “Business trumps user security every time, be it via “health&safety”, “tech support”, “Product Development”, or other invented excuse.

@ALL February 9, 2021 8:39 AM

Computers are by far more superior in information gathering and entertainment. You could literally organize and filter information that you wish to review for consumption. You even can read an entire novel without touching a book. You can create programs and even make money! Computers have been proven to increase a user’s motor function, comprehension of complex tasks, multitasking, and an increase in IQ.

Television on the other hand is obsolete and 100% filled with indoctrinating view points, reality circus performances and monkeys throwing feces around during political debates. Slowly, day by day the couch cushions lose their fluff and the bottles of beer start to pile up. User’s eventually succumb to sedation and retardation, becoming a glorified couch potato.

Clive Robinson February 9, 2021 10:50 AM

@ Winter, Moderator,

The “Winter” comment from “February 9, 2021 9:14 AM” is not from me.

I know it’s not you, as do several others, as we’ve seen it before.

It is what @Space assumed not so long ago was a “bot”, and due to a mistake the operator made I identified it as having attacked this blog before.

At which point you may remember the bot operator got quite upset and gave enough examples to identify how unsophisticated and simplistic the design of the bot was.

It appears nothing has realy changed in the level of bot sophistication, just the garbage it spewes forth. Which might sugest that the operator has very very limited abilities.

As @Moderator should know the attacks are not against regulars on the blog, but the blog it’s self.

Why the operator should carry such a long grievence I don’t know, it’s probably some inability in the operator to actually do anything worthwhile in their life…

I feel sorry for the person who has to spend time cleaning it up.

rrd February 9, 2021 11:00 AM

@ Winter (the real one)

For those of us who care, we know it wasn’t you.

But this attack is valuable because it does demonstrate a security vulnerability with respect to spoofing someone else’s handle to inject [m,d]isinformation. (Only security in terms of having an honest conversation free from spoofed injections.)

It also demonstrates the utter failure of filtering for curse words.

Like I mentioned up above (and hinted at many weeks ago), there are inherent problems with not having a means for people to register their handle. I did not mention spoofing because I did not want to give anyone any ideas, but here we are now.

Personally, I would have thought that Bruce would try to develop some “applied security” to this here blog, but he apparently has other things more important in his life than being concerned about what shows up here.

Winter, you should be glad (kind of) that the example here was so over-the-top, and not something actually intended to be almost like something you may post here, with the disinfo bits carefully injected.

As I mentioned above, there can be value in facilitating anonymity to forums such as these, but the evolution of the internet has shown fully-anonymous sites to have problematic use cases for bad actors. My suggestion (again) is to have verified commenters differentiated from anons. That solution would easily allow the prevention of spoofing, but would also allow moderation to be offloaded to the verified user base. Yes, designing and implementing such a system is non-trivial, but the weaknesses / negative use cases of the site in its current form become more apparent by the day.

I had hoped that the relatively new mechanism behind the “your post has been automatically approved…” process was implemented with ip addr analysis to pair the handle with the source in the attempt to at least try to prevent this vuln and help defeat the spammers. It doesn’t look like that is the case.

In American history, the “frontier” was no fun place to be (especially for the owners of the land, the Native Americans), so maybe Bruce is simply content to let this place fester as the “Electronic Frontier” that it resembles more and more by the day.

[As a side note, you don’t know how difficult it was for me to not make jokes here.]

lurker February 9, 2021 12:56 PM

@ResearcherZero

History will repeat, no one will say anything about it, and no one would learn anything if they did. Nothing has certainly changed in that regard in the last three or four decades

Correction: nothing has certainly changed in that regard in the last three or four millenia. People see the hardware change from wooden clubs thru to laser guided drone strikes, and think the system has changed. But there is one variable which is always a dominant factor, and that is the human psyche.

Too difficult to analyse, understand or control, it is easy to ignore it in planning the security of small systems or large nations. So petty crims rise to be mob bosses, and madmen end up ruling whole empires. That’s just another in the “too hard” basket.

Winter February 9, 2021 1:01 PM

@rrd
“I had hoped that the relatively new mechanism behind the “your post has been automatically approved…” process was implemented with ip addr analysis to pair the handle with the source in the attempt to at least try to prevent this vuln and help defeat the spammers.”

No need for such complexity. You always have to enter a valid email address. That’s is your secret password. The system van easily match username and email to verify the identity of the pseudonym.

Clive Robinson February 9, 2021 1:43 PM

@ Bruce, ALL,

Have you heard the one about what happens when Ham Radio crosses with malware?

Yup sounds like an intro to a joke that very few would get… But “Somebody has done it for realsies!” as some would say.

The story originates from a bit of a splash on Redit as far as I’ve been told. Then “Bleeping Security”[1] went and found copies in AV databases and pulled it appart.

In essence you get sent a fake XLS html file that contains some attack code in it. Part of which is a Morse Code to text string translation which gets run so what looks like weird data in the spread sheet cells becomes first hex code then javascript attack code that presents a fake pasword timed out box, which if the user types anything in gets scooted of with other info to some site on the Internet.

So in essence it’s just a simple substitution cipher like “Pig Pen” or “Dancing Men” or older communications / telegraph code systems going back from about a quater of a millennia ago with Morse through the likes of “semaphore” all the way back to the original use of the Polybius Square[2] used for optical telegraphy getting on for two and a quater millennia ago.

The use here though is not cryptographic but broadly stegographic and is to get past most EMail and similar filters that recognise phishing attacks.

Some think the phishing attack was thought up by a “Ham Radio Operator”… Whilst that is possibly true, it is just as likely it’s been “cut and pasted” by someone who came across a morse decoder program already built of which there are hundreds around on the Internet.

And thereby hangs the real obfuscation, lets assume you locate the original code on the Internet… Most probably the author of the code has nothing what so ever to do with the malware.

But from the malware developers perspective, it’s one less piece of code that has their stylistic fingerprint on.

So for an investigator attribution got that little bit harder.

So whilst not a “False Flag” operation as such it is an indicator of “plumb and play” programming where the actual code developer puts as little as possible of themselves into the malware code. It also probably makes “back tracking” who accessed the code example fairly pointless as well.

[1] To read the Bkeeping Computer analysis,

https://www.bleepingcomputer.com/news/security/new-phishing-attack-uses-morse-code-to-hide-malicious-urls/

Or if you want to watch some one explain it then,

https://m.youtube.com/watch?v=-qEYq3Ln_H4

[2] The history of the Polybius Square which like the Playfair cipher does not carry the name of it’s inventor but it’s promotor,

https://en.wikipedia.org/wiki/Polybius_square

SpaceLifeForm February 9, 2021 3:00 PM

@ rrd, Winter, name.withheld.for.obvious.reasons, ALL

Your ‘solutions’ will not suffice. Sorry.

You really need to understand the attacks on Section 230 and 1st Amendment.

An email addy is not private.

There is a way, but not there yet.

In the meantime, stick to your handle.

Real humans understand writing style.

Clive Robinson February 9, 2021 3:50 PM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter, ALL,

With regards COVID and SARS2 mutations, there is a little good news, some bad news and potentialy some very bad news.

1, The Good News
Comes in two parts and it’s about the B.1.1.7 Kent/UK identified mutation. We have more data and it’s helping us improve the picture by squeezing out “the law of small numbers” effects. So

Yes – it is more infectious but about 1.35 not the 1.55 or 1.70 times early reports indicated and it’s doubling rate appears to be a little more than a week rather than a little less than a week.

No – it’s apparently no more virulant than other common strains. That is the hospital case rate and case fatality rate appear to be about the same. (early reports indicated 14:1000 death rate -v- 11:1000 for the old strain. However in sick people in hospitals the non case related fatality rate is high enough to cover the difference. More data has thus shown a lower CFR for the B.1.1.7 strain broadly in line with the older strain with increasing confidence. Do I blaim Boris Johnson and other UK politicians for raising concerns? No I absolutely do not, it eas the best scientific evidence at the time and on the “erring on the side of caution” it was wise to release it.

2, South Africa
What on earth is going on in South Africa, I’m not sure. Apparently an unpublished not even preprint paper on a small cohort study has caused South Africa to halt vaccination… I know no more than that, however some who know SA better than most of us do, are suggesting corruption/bribes etc that are allegedly endemic at the higher levels in that part of the world are playing a significant roll.

That said we do know that the South African discovered strain has a greater ability to avoid vaccines than earlier strains. By how much and what that means in the real world is most definately unknown (a reasonable guess would be whilst you are not immune, you will have no more than the equivalent of a cold, but unknown is how infective you would be, but that’s likely to be significantly less than if you have not had a vaccine).

3, Herd immunity may nolonger be possible.
Potential very bad news comming in from Manaus Amazonian Brazil a month or so ago they had a massive wave of infection with one of the two concerning Brazillian discovered strains (P.1). Testing from blood donors indicated 76% of the population had some level of immunity. Whilst blood donors are in effect a “self selecting” not “random” cohort other testing indicated a 50-60% had an immunological response. The sudden wave being only slightly after the discovery of the new strain gives grounds to indicate that due to the high infection rates that mutations are proportional to, the mutation rate is sufficient that new strains now escape peoples existing immunity in about half a year rather than annually or more. If true and the evidence suggests that, then herd immunity can now nolonger happen at the 75% infected rate previously thought if at all.

So the bad news of,

1, Mutations escaping vaccines.
2, Mutations escaping human immunity.

Is quite bad and could be disastrous for many. But this high rate of infection thus high rate of mutation makes it increasingly probable a strain that has easier zoonotic transfer will arise and we may end up with a wide ranging wildlife population that like bats will be more or less uneffected by it. Thus giving a disease reservoir easily capable of transfering back to humans where it will be of high concern for humans due to it’s virulance.

SpaceLifeForm February 9, 2021 4:00 PM

@ ALL, name.withheld.for.obvious.reasons

Keep this in mind the coming days.

When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean—neither more nor less.” “The question is,” said Alice, “whether you can make words mean so many different things.” “The question is,” said Humpty Dumpty, “which is to be master—that’s all.”

SpaceLifeForm February 9, 2021 4:04 PM

@ ALL, name.withheld.for.obvious.reasons

Keep this in mind the coming days.
(note: mitm is in play)

When I use a word,” Humpty Dumpty said, in rather a scornful tone, “it means just what I choose it to mean—neither more nor less.” “The question is,” said Alice, “whether you can make words mean so many different things.” “The question is,” said Humpty Dumpty, “which is to be master—that’s all.”

SpaceLifeForm February 9, 2021 4:24 PM

@ ALL, name.withheld.for.obvious.reasons

Did you see what happened?

Well, you did not see what I saw.

What happened was that upon Preview, it went to a completely different prior article!

So, I did ‘BACK’, and was back to EDIT.

Then I added the note.

This was not the first time I have seen this happen.

Anyone else ever encounter this behaviour?

SpaceLifeForm February 9, 2021 4:40 PM

@ ALL, name.withheld.for.obvious.reasons

Correction:

What happened was that upon SUBMIT (after PREVIEW), it went to a completely different prior article!

The SUBMIT actually went thru, but it did not go to the landing page (comment submitted), but went to prior article.

So, I did BACK, which got me to the EDIT page.

The point is that I did not get to that state from a completely different article!

Something is not right in Dodge.

(Now doing SUBMIT without PREVIEW)

SpaceLifeForm February 9, 2021 4:48 PM

@ ALL, name.withheld.for.obvious.reasons

Without PREVIEW, no problem.

I suspect multiple MITM.

Spy vs Spy.

May be Chrome issue. Must kick to curb.

MarkH February 9, 2021 5:35 PM

Something Old, Something New

Two information security stories likely to interest readers:

================

First, I was watching a fascinating documentary about movie pioneer Alice Guy Blaché, one of the first filmmakers and credited as the first woman director.

In the early days of short films, the various studios copied one another relentlessly and shamelessly. [Reminds me of my gig with an Asian manufacturing company, but that’s another story.]

Before she invested in a safe for the storage of her film scripts, she was dusting them with powder to help her detect fingermarks if anybody handled them.

================

Second, we’re often told that keeping up-to-date with software patches is good security hygiene. An interesting MIT Technology Review article looks into the abundance of patches which are so poorly executed that they provide little resistance to exploits … and how security fixes can be done far better, with an example from Apple.

Clive Robinson February 9, 2021 6:01 PM

@ SpaceLifeForm,

Anyone else ever encounter this behaviour?

You might remember back in the early days I saw a number of odd things some around preview. Whilst we did track down the ones I found a way to reproduce, they were mostly not to do with preview (like the weirdness with capitalisation on blockquote).

Unfortunatly there were several with preview I could not reproduce. So I simply wrote preview off as “flakier than puff pastry” and don’t use it at all. That said what you are saying does sound vaguely like something I saw back during early testing.

But how do I put it, I don’t feel like experimenting with this black box in case I find a physicists pet inside in an indeterminate state of superposition :-S

name.withheld.for.obvious.reasons February 9, 2021 6:26 PM

@ SpaceLifeForm
Have not seen directly what you are seeing, though you are right to point out there is parsing issues with case and possible tag recursion. What I find useful is to draft my responses outside the context of the site, use a text-based browser to read the blog, and post via a single browser session and immediately terminate the session and the browser process–clearing all caches.

Know that doesn’t help a lot, but as you can see we get repeated behavior that is outside of our control (MITM, trolls, etc.)

Clive Robinson February 9, 2021 6:53 PM

@ MarkH,

Second, we’re often told that keeping up-to-date with software patches is good security hygiene.

I’m of a differing opinion,

1, Issolate the system.
2, Get the system stable.
3, Keep it issolated for good.

Yes I’m aware that there is a significant set of issues with doing that, and further in many cases people think it can not be done, and on a few I’d agree it can not.

But there is a question people should ask,

“As there has not been a piece of consumer software released this centiry that has not required several patches, why on earth should we assume that patches make the need for patching any the less?”

Some call it “The hamster wheel of pain” the reason being, “How many people have patched systems and found the patches break something?” That then either needs significant fixing or effectively can not be fixed without something else breaking…

It’s one of the reasons I think issolating systems as much as possible is a good idea. Whilst it can not stop insider attacks, nothing can by definition, it significantly limits or stops outsider attacks.

There is a formular for “availability” and it’s based on,

1, Mean Time Between Failures (MTBF)[1].
2, Mean Time To Repair (MTTR).

Issolation increases MTBF[1] significantly and it often reduces MTTR as well, with resulting higher availability.

[1] Mean Time Between Failures (MTBF) and Mean Time To Fail (MTTF) are similar but different.

Think of MTBF like an overload trip tripping, when it happens you turn off something and press the trip reset button and you are back up and running.

MTTF is like a blown fuse on overload, yes you turn something off but now you have to pull out the blown fuse and either fix it or plug in a new fuse which means having a spare in a known place, tools, auditing, reordering, etc, etc.

That is MTBF has a short MTTR -think button fix- as the system is not actually broken. On the other hand MTTF has a longer MTTR -think replace/repair- and has rather more than increased time implications. The issues of MTTF gave rise to “hot standby” systems which later gave rise to automatic fail over. Such hot standbys tend to fail fairly quickly because being “hot” they have usually aged as fast as the primary system.

JonKnowsNothing February 9, 2021 8:02 PM

@Clive @MarkH

re: 1, Isolate the system.

Before the great Web of Spider Snares, it was possible to isolate systems and even internal networks to a degree. Nothing that would match the High Security needed today but it did keep things more tidy.

That worked until someone figured the Rules Do Not Apply to Them.

re: 2, Get the system stable.

Before the great Bloated Whale of Personal Devices, one could also stabilize the system because you didn’t put more crud-ware on it. It got loaded with what was needed or required and that was All.

Patches actually listed each item affected and what the fix would fix. You could pick and install only the parts that pertained to that system.

That worked until Solitaire became a Business Requirement.

re: 3, Keep it isolated for good.

This went out the door when the CEO’s neighbor’s kid from two doors down was taking “Computers” in school and the CEO thought the kid knew more about his business than he did.

When the CEO thinks the neighbor’s 12yo knows more, the whole thing is DOOMed.

re: Future Chaos

The Real Change is to stop using Junk Stuff. It’s not going to be easy because the money is in the Junk. People are stopping or cutting back or going “off grid” and “off line”. Silicon Valley has intense myopia and does not see beyond the next 3 months. COVID-19 is changing and so are the global economies. When the money dries up because there’s no work of value, there’s no support system, the churn cycle falters. It won’t take much and it’s been written up for a long time. The Silicon Valley Chums don’t read.

re: Real Life Rabbit Holes / Instability In Action

Out in California, a wasteland of Dead, we are supposed to get Vaccines for COVID-19. We have 2 types that maybe on offer (or maybe not). We have had many Vaccination Programs systems and setups. Each more chaotic than the last. Nearly all require an On-Line Appointment and Long Distance Drives (with no loo) and a Full Expectation there will be a Gauntlet of NoMaskers to pass through all the while hoping your appointment remains active, unchanged, not canceled and they still have any goods left when you manage to arrive at the site.

The lastest missive from my Health Care Provider is:

We have a program. We have no Vaccines. We don’t know when we will get any. We will call you if we get some. Please do not call us. Oh.. and if you can find a vaccine anywhere else.. do go ahead. Thank you and have a Healthy Day!

The probability of my getting a vaccine has plummeted. If South Africa doesn’t want their 1,000,000 doses of Oxford, please send them to Central California.

ht tps://en.wikipedia.org/wiki/Doom_(1993_video_game)
(url fractured to prevent autorun)

SpaceLifeForm February 9, 2021 9:48 PM

@ JonKnowsNothing

Patches actually listed each item affected and what the fix would fix. You could pick and install only the parts that pertained to that system.

I’m old. That was called ‘Release Notes’ IIRC.

Well detailed too.

name.withheld.for.obvious.reasons February 10, 2021 4:27 AM

Licensure of Professionals of the Software Industry
Subtitle: Unsafe at any Keyboard

OBSERVATION
There has been much talk of the “professionalization” of the software industry (I use this term loosely) and little to no discussion about the professional status of others within the technology ecosystem (my thinking is more closely related to a “food chain”). Though mentioned more frequently here by Bruce than in other parts of the journalistic landscape, with the possible exception of the IEEE and EE-Times. The problem of course in IEEE’s treatment of the topic is IEEE may directly benefit from such schemes. The real question should be “What are we ‘Unprofessionalizing’?” Not just that, but are we as a society, here and abroad, suffering from a collective psychosis brought about by others that are just fine with the results? To me, education is becoming irrelevant, unnecessary, and overly conceptualized. Simpler truths need to prevail such that simpler lies may succeed.

Software National Security Policy
During the days of the Clipper chip (possibly a movie title: Day of the Clipper Chip), though long ago in land far, far, away; what was touted as “hardware” was very much software to be sold as hardware, “These are not the ‘valence bondings you are looking for.” From the weapons industry perspective, munitions restrictions on encryption strength held an interest in nationalization of encryption standards from a NOBUS perspective. DoD coopted some in industry and other individuals to carry their interest into different proposals and platforms that made there way into the public discourse. From the U.S. governments perspective the issue, the primacy of the state over all communications is the overarching goal regardless of what intent or any DoD directive or policy would ever pronounce outright.

Hardware as Foreign Policy, Domestically and as a non-sequitur
Performance issues on prospective IoT platforms (for example; Sun Microsystems and the Smartchip w/Java) and other still relevant arguments were not often put into context, at least not in a manner that fully flushed out the feasibility, efficacy, costs, and the unknown affects to future inhabitants of the technological spheres of society. A great example was just given by the House Impeachment Manager in the Senate this week. Raskin, in testimony before the U.S. Senate, told his daughter after the siege of the capital building, they would be able to return to his congressional office and the capital and be safe. His college aged daughter essentially replied to that statement; “I do not want to ever go back to DC.”

To put it another way; A father, a member of the U.S. House of Representatives, having his daughter accompany him to his office, assured her that it was safe to return to his place of employment. The daughter’s reaction, there is nothing there for me. This is the forward bias of a negatively charged environment that has not only become toxic to the present, but completely acrimonious to the future. Apparently much of the world is headed down a path where large elements of societies underlying “soft skills” are being displaced and will invariably result in the further demur of societal structures.

Summary
The two examples above describing social political constructs that are directly impacted by technological systems operate in other contexts that often don’t reflect the totality and scope of what we put in our collective hobby boxes. We ignore our peril in order to clutch our pearls. I understand that there is a vagueness and a burden to what is expressed here. It is purposefully cast to allow the reader to explore the subject in a manner that I could have designed narrowly to direct conclusions or reactions. More socratic that dogmatic, I think.

Clive Robinson February 10, 2021 6:39 AM

@ name.withheld…,

There has been much talk of the “professionalization” of the software industry

As with the legal and medical proffessions it’s a way to “pull up the drawbridge” behind those with political and status ambitions.

In short to set up a power hierarchy where the self appointed “great and the good” take a sociopathic patanalistic attitude that also enriches them greatly.

The excuse is always “it will make things better” but the reality is almost always entirely otherwise.

I used to “have to be” a member of several of these blood suckers and I’m glad I no longer have to be. That’s because I had the option to move my “profession” to another domain where these parasites had not yet sunk their fangs in. Due to preasure especialy from control freekery politicians and civil servants these options are closing down for young people.

I guess they think they are doing George Orwell proud…

Clive Robinson February 10, 2021 11:25 AM

@ Winter,

I suspected not by the length and it’s not your style, plus have a look at the “errors” 😉

Yup as @- has suggested,

https://www.schneier.com/blog/archives/2021/02/friday-squid-blogging-live-giant-squid-found-in-japan.html/#comment-368974

Maybe the moderator should look at the IP addresses, it’s something the “blog wreaker bot” should not be able to predict unless you go to a site they control or they have other not legal sources of information, which I suspect they don’t have based on their current failing bot.

But have you noticed the behaviour of the operator is that of a “petulant six year old” with bad learned social behaviours. It’s not just the “Oh my botty” level of language used to try to shock it’s the use of language. It’s simmilar to that of “an outsider trying to get in” the useage is forced not natural, and clearly a failing of the bot design and the selected input.

So there the bot operator stands like a naughty toddler/junior schooler throwing a hissy fit that fails on it’s aim and has now thrown themselves on the floor because they do the old “repeated test madness”.

JonKnowsNothing February 10, 2021 12:12 PM

@All

re: Stories: The Real Change is to stop using Junk Stuff

Several MSM reports of people who are Leaving the Building in one form or another. Rather uplifting accounts of people who had thoroughly adopted the instant-tech and realized it wasn’t all that it was promoted to be. Each with different reasons for stopping; each with some insight to what’s good and what’s bad.

1, Stories of 5 people who gave up various apps: Twitter Facebook Instagram other Social Media and Dating App.
* ht tps://www.theguardian.com/lifeandstyle/2021/feb/10/people-who-quit-social-media

2, Dropping Food Delivery Apps: Uber Eats
* ht tps://www.theguardian.com/food/2021/feb/11/i-quit-food-delivery-apps-the-absurd-convenience-was-not-worth-the-cost

3, Shutting Down at the end of the Working Day; the ‘right to disconnect’. Previous reports have documented the “Work From Home” are putting in longer hours in total per day (@2-4hrs/day) and duration of the working period extending beyond the normal In Office period (answering text and emails at 1am).

ht tps://www.theguardian.com/world/2021/feb/10/if-you-switch-off-people-think-youre-lazy-demands-grow-for-a-right-to-disconnect-from-work

4, An interesting section on AI/ML bias. How a photographer’s portrait of a model was able to expose the AI/ML bias rules in Instagram. It also exposes the extent of the AI/ML application to even the smallest details.

ht tps://www.theguardian.com/artanddesign/2021/feb/10/model-instagram-apologise-nyome-nicholas-williams-alexandra-cameron-best-photograph

(url fractures to prevent autorun)

SpaceLifeForm February 10, 2021 2:51 PM

Bats and pangolins in Southeast Asia harbor SARS-CoV-2-related coronaviruses, reveals new study

hx tps://medicalxpress.com/news/2021-02-pangolins-southeast-asia-harbor-sars-cov-related.html

In the study, the team examined Rhinolophus bats in a Thai cave. SARS-CoV-2 neutralizing antibodies were detected in bats of the same colony and in a pangolin at a wildlife checkpoint in Southern Thailand.

JonKnowsNothing February 10, 2021 4:17 PM

@Winter (the fake one)

re: Corpse Jumping

Corpse Jumping is a favorite animation in many PVP games (Player vs Player). You can enjoy jumping and thumping various body portions of defeated players. Players who are interested in the fun portion of Capture the Flag games, just Release to the Rez Ring (Release from Death; Return/Re Animate/Re Spawn; Stone Ring, Rez Ring, Resurrection Ring respawn location). It’s more fun to get back in the melee, than watch someone else’s Emote Animation, besides you don’t get any Renown/Infamy points while dead.

In RL in the USA, Corpse Jumping is perfectly legal in most jurisdictions. Because the “person is no longer there” there is no criminal offense. Often there are other laws that come into play and once known, the funeral home will be Out of Business and the Person will be Out of A Job. It ranks up there with the “Take the Money for Burial and Park ’em In a Closest” Business Models; which happens more than people care to think about.

So, if you are wanting an experience you can login to any large scale PVP MMORPG game. There are loads of them to chose from.

It seems you may enjoy titillation more, so try one of the Anime Style games. There are a bucket of those too; featuring the “under dressed, tight pants and lollipops” sort of thing. If you live in the USA you might find the characters have a few extra bits of clothing pasted on strategic areas so the game can pass ESRB Ratings. If that’s too restrictive log into the off shore version, for the Full Monty.

Don’t worry, lots of people are Just Like You.

ht tps://en.wikipedia.org/wiki/Emote
(animated in-game emotes)

ht tps://en.wikipedia.org/wiki/Game_Software_Rating_Regulations
(main topic)

ht tps://en.wikipedia.org/wiki/Video_game_content_rating_system
(Asian Markets)

ht tps://en.wikipedia.org/wiki/Entertainment_Software_Rating_Board
(USA Entertainment Software Rating Board (ESRB))

ht tps://en.wikipedia.org/wiki/The_full_monty
(url fractured to prevent autorun)

_Bot_Operator_From_Hell_ February 10, 2021 4:31 PM

@ JoeKnowsNothing

Seriously WTF did I just read ???
Very well played Sir, it seems as if the tables have been turned and Winter’s last post has found its master, oh well…time to leave at least for now. Have a nice day and all the best to you!!!

_Bot_Operator_From_Hell_ February 10, 2021 4:34 PM

@ JoeKnowsNothing

Seriously WTF did I just read ???
Very well played Sir, it seems as if the tables have been turned and Winter’s last post has found its master, oh well…time to leave at least for now.
Have a nice day and all the best to you!!!

JonKnowsNothing February 10, 2021 5:02 PM

@vas pup

re: ”Everything you say should be true, but not everything true should be said.”

There are many parables, stories, heroic tales, plays and philosophies that attempt to define the “I know it when I see it” problems.

“Morality tales” exist in many cultures and all bring an aspect to the “trolley car problem” common in modern thought.

Folk Story:

In the story, there are fifty bodhisattvas on a ship–and a thief. The captain of the ship reads the mind of the thief and sees he’s about to kill the fifty bodhisattvas so that he can take the ship. To prevent this, the captain kills the thief, as it’s the only way to prevent this from happening

Trolley Problem

There is a runaway trolley barrelling down the railway tracks. Ahead, on the tracks, there are five people tied up and unable to move. The trolley is headed straight for them. You are standing some distance off in the train yard, next to a lever. If you pull this lever, the trolley will switch to a different set of tracks. However, you notice that there is one person on the side track. You have two options:

A) Do nothing and allow the trolley to kill the five people on the main track.
B) Pull the lever, diverting the trolley onto the side track where it will kill one person.

Folk Story:

Sir Gawain, a knight of King Arthur’s Round Table, accepts a challenge from a mysterious “Green Knight” who dares any knight to strike him with his axe if he will take a return blow in a year and a day. Gawain accepts and beheads him with his blow, at which the Green Knight stands up, picks up his head and reminds Gawain of the appointed time. In his struggles to keep his bargain, Gawain demonstrates chivalry and loyalty until his honour is called into question by a test involving the lord and the lady of the castle where he is a guest.

Folk Story:

The parents of a baby left the baby in the crib while they tended their fields. They left the cat to guard the baby from harm.

When they returned, the found the cat in the crib with the baby, blood on it’s face and it was licking the wound where it had eaten the baby’s ear.

The farmer and wife, ran into the house and killed the cat straight away.

Then they closed the door.

Behind the door they found a giant dead rat that had been killed by the cat. The rat still had a portion of the baby’s ear in its mouth.

Truth is a slippery slope. It changes like the weather. It changes over time.

On the USA involvement in the Vietnam Gulf of Token Incident:

“[President Lydon] Johnson commented privately:
“For all I know, our navy was shooting at whales out there.”

ht tps://en.wikipedia.org/wiki/Jataka_tales

ht tps://en.wikipedia.org/wiki/Trolley_problem

ht tps://en.wikipedia.org/wiki/Sir_Gawain_and_the_Green_Knight
ht tps://en.wikipedia.org/wiki/Green_Knight

ht tps://en.wikipedia.org/wiki/Gulf_of_Tonkin_incident

USA History:

the USS Maddox incident, was an international confrontation that led to the United States engaging more directly in the Vietnam War. It involved both a proven confrontation on August 2, 1964 and an unlikely confrontation on August 4, 1964 between ships of North Vietnam and the United States in the waters of the Gulf of Tonkin. The original American report blamed North Vietnam for both incidents, but the Pentagon Papers, the memoirs of Robert McNamara, and NSA publications from 2005, suggest that the dismissal of legitimate concerns regarding the veracity of the second incident by state department and other government personnel was used to justify an escalation by the US to a state of war against North Vietnam.

(url fractured to prevent autorun)

Clive Robinson February 10, 2021 7:54 PM

@ JonKnowsNothing, vas pup,

With regards the,

Trolley Problem

The answer to this is not based on morals but morals codified in law and the issues that arise from such. A problem that the US has taken to beyond a point of madness.

However you first have to make an assumption of “none of those tied down are known to you or raise any sympathy in you” ie you have no empathy what so ever.

Then the answer is,

“You do nothing, you simply turn and walk away.”

That way you were in effect “not there” so have no involvment thus no liability…

This kind of “no liability” madness in the US came to light in the UK through news reports about events in the US and discussions amongst UK medical proffessionals who were appalled by it.

1, Dr in US who saved a man’s life using cardiac thump was being sued for breaking mans rib.

2, US licenced professionals insurance company issues general notice that proffessional insurance only covers contractual relations (so for US Dr’s only registered patients).

3, US AMA issues advice to Dr’s that only licenced and insured first responders should be involved with emergency response.

4, Further unofficial advice circulating was “don’t even call first responders” as you risk being identified as a Dr and thus being sued for not providing assistance…

So damed if you did damed if you did not… That was back in the 1980’s so it’s anybodies guess what happens these days.

But the “four monkey”[1] advice still stands I guess.

So it’s likely that the old film standby of “Is there a Dr in the house?” or “Stand aside I’m a Dr” is not going to happen…

And if you get worse whilst waiting for near non existant first responder assistance due to “small government” and,”cut backs” mantra, then you have US lawyers and US insurance companies to blaim. But it’s probably the only “blaim you can not make a claim” against them as in effect you have no standing…

I’m told that a similar moral issue gave rise to French legislation requiring people to assist in emergencies.

[1] Most people are only aware of the first three monkeys,

1, See no evil.
2, Hear no evil.
3, Speak no evil.
4, Do no evil.

I guess in part whilst hands over eyes, ears, and, mouth are easy representations of the first three, the fourth might be more of a challenge in polite society…

But not only were there four monkeys originally the meaning of “evil” was somewhat different as well.

I was given as a gift by a charming and elegant artist who had a bawdy sense of humour, four monkeys she had cast for my birthday. The three accepted ones plus the fourth with it’s hands between it’s legs, and they sit on a brass triangle which according to many museums was called a “brass monkey”[2]. The piece is titled “Three, Four or Five” with the first three monkeys sitting on the triangle and the fourth sitting atop the three.

[2] Yes there was such a triangle and it was made of brass and yes the cannon balls were made of iron. So anyone with any knowledge of bi-metalic strips, it is argued should know how the quaint English saying about cold weather and a brass monkey could come about… Only it’s not true as anyone with any real knowledge about the coefficients of expansion would know. Likewise anyone with a knowledge of sailing vessels would know, no one in their right mind would use such a device. The expression is fairly modern and can be traced back through American novelist, short story writer, and poet H. Melville. The “explanation” even more so possibly in the second half of the 20th century more likeky the last quater say 1980’s. What is true however is the millitary have ways to tourture recruits, cadets and the like, hence the old “If it moves salute it, if it dosen’t paint it”. The triangle and balls were one such “clean till they gleam” tourture, just like copper pipes and brass fittings and toilet U-bends. Most know if you polish brass enough it gets a golden mirror like finish on which a fingerprint can be seen from ten or more feet away as can any scratches or dents but the gleam lasts only a few hours at most. Likewise as anyone who owns cast iron cookware or a cast iron range knows you can polish it to a black semi reflective surface which also quickly dulls… Thus as part of training the recruits would be responsible for making a cerimonial plate and balls gleam for inspection early in the morning… However it was not as far as I can tell ever called a brass monkey. That is the only connection I can find, and older stories and sayings such as “snap the tail off a dead cat/rat” are more plausable and would have been frequently seen on London streets through atleast the medieval to Victorian era, when cholera and “The Big Stink” gave rise to “Cleanliness is next to Godliness” and London started to get cleaned up, through the work of Dr John Snow, Reverend Henry Whitehead and Engineer Sir Joseph Bazalgette.

xcv February 10, 2021 9:58 PM

evasive manure • February 10, 2021 7:54 PM

https://tech.slashdot.org/story/21/02/09/2134244/cops-are-playing-music-while-citizens-are-filming-to-trigger-copyright-filters

Oh. They’re playing music and there’s a “party” of armed city employees on strike for better pay and working conditions for local cops, and more effective gun control shitlisting, blackballing, and other life-ruining, home-wrecking, and career-destroying weapons to use against civilians.

Clive Robinson February 10, 2021 10:54 PM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter, ALL,

In the UK the Office of National Statistics(ONS) has for some time been runing it’s own indipendent random trial tests etc on SARS2.

They’ve just released some worrying figures covering from 1st Oct to 30th Jan that I’m going to have to dig into further, but the headlines are,

1, Clear indications vaccinations are working and bringing hospital cases down.

2, B.1.1.7 was increasing significant.

3, Testing of those who were significantly infectious (high viral load) many more than expected are asymptomatic, England 53%, N.I. 62%, Scotland 53%, Wales 45%.

Whilst the first is good news the second not unexpected the third is very much unexpected Up untill this the assumption was 20-30% of people were asymptomatic BUT that was across the entire time they were infected.

These new ONS figures are from people tested as being not just infected, but when they are shedding significant levels of virus, thus are highly infectious. Thus across the UK for the past four months, on average half those capable of spreading SARS2 have had no idea they had been infected.

What is not clear is if this is in general with all strains, or if the newer more infectious strains have higher rates of asymptomatic infectors / spreaders.

Either way suggests that now more than ever, social distancing, masks, ventilation and localised area quarantines are essentially the only way out of this pandemic untill sufficient of the worlds population has become disease free to bring the rate of mutations down well below how fast we can get effective jabs in peoples arms.

There also still appears to be a very unscientific argument about immunisation. The assumption by many is they have their jabs and they won’t get sick.

We know from many years of flu jabs that whilst the jab you’ve had may not stop you getting the seasonal flu, those who have had jabs tend to suffer less acutely. So whilst they might get a few unpleasant days at home, they will probably not become hospitalized with their lives at much increased risk.

Thus the question about “vaccine avoiding strains” is not “Will you be immune?”, but “If you are infected how badly in comparison to not being vaccinated?” and more importantly “Are the number of infections in those vaccinated less than those not vaccinated”

As an individual, yes being ill at home sucks, but a whole lot less than in hospital or in the meat waggon round the back. As a society, yes having some people ill at home sucks, but a whole lot less than lots of people crashing hospitals or stacked up like cord wood at the crematorium.

As has been noted a lot here we need a sensible “lock it down and exterminate policy” not an illogical “Spread it all about and look the other way policy” that Herd Immunity Policy realy is.

We need R0 to drop below 1 every where. But so many are currently infected the mutation rate is well ahead of vaccine development… Thus we need R0 to be substantially below 1, so vaccine development can not just catch up but get ahead of the virus, and that means the prevelance has to come down significantly quickly and stay down, and vaccination is not going to get prevelance[1] in the world down for atleast three probably more like five years, in which time a lot of mutation will happen.

[1] Prevelance is the number of people currently infected, and with the new strains that can double around every eight days. The rate of mutation is fairly strongly related to prevelance, thus will on balance track it, but probability means “three busses can turn up at the same time” as has happened with the N501Y mutations. Two of which also had the E484K mutation, that is being associated with “immunisation escape” and possobly “immunity escape” thus some people are getting reinfected in quite a bit less than a year.

https://medium.com/microbial-instincts/the-most-worrying-coronavirus-e484k-mutant-has-arrived-35361ec55923

xcv February 10, 2021 11:33 PM

@ Clove Robinson

1, Clear indications vaccinations are working and bringing hospital cases down

#1.) You know what Bruce and other experts say about crypto algorithms that “are working” when the functionality of encryption and decryption has been tested. That doesn’t mean the crypto is doing its job.

The vaccines “are working,” i.e., there’s something in the syringe, and it’s being injected under the skin of people treated as cattle or «vacce» for purposes of “herd immunity” to justify a disclaimer or a legal immunity to liability for malpractice.

#2.) Usually there is no doubt, when patient die, that they are truly dead, but with a thriving market in life insurance and murder-for-hire as well as health insurance, there is always a strong financially vested interest in attributing a “cause” to each death, especially if it can bring more money to the doctors concocting and administering the vaccines.

#3.) They’re playing an epidemiological life-insurance numbers game of “morbidity” versus “mortality” by “bringing hospital cases down.” That is obviously less profitable to hospitals but it’s an effective bargaining chip to place on the table in the gamble for more public health dollars at the county and local district level as well as funding for government mandated healthcare industry funding at the state and federal level.

#4.) It’s a party game of “rationing” healthcare on a national socialist basis of mass murder, population control, mayhem, and disability. All healthcare is vice: health insurance industry executives refer to it as sick care. Healthy people presumably never have to see the doctor, and if it isn’t HIV+AIDS, then a cardiologist gets involved in a relationship break-up, or a lady quits patronizing a hair salon and contracts stage IV breast cancer as a result. Or else it’s all in your head, and the coverage is mental health only, and only on an involuntary basis at that.

Winter February 11, 2021 3:42 AM

@xcv
“#2.) Usually there is no doubt, when patient die, that they are truly dead, but with a thriving market in life insurance and murder-for-hire as well as health insurance, there is always a strong financially vested interest in attributing a “cause” to each death, especially if it can bring more money to the doctors concocting and administering the vaccines.”

(Willful?) sowing distrust and disinformation:

Israeli Healthcare Group Reports 60% Drop in Coronavirus Infections Among Vaccinated Elderly

KSM, which is part of Israeli healthcare provider Maccabi, noted that there was a ‘significant decrease within the vaccinated members aged 60+’, reaching a decrease of around 60 per cent in new infections.

They added that there was also a ‘decrease of slightly more than 60 per cent in the number of new hospitalised patients.’

https://legalinsurrection.com/2021/01/israeli-healthcare-group-reports-astounding-60-drop-in-coronavirus-infections-among-vaccinated-elderly/

Winter February 11, 2021 3:50 AM

Should I be proud that people are trying to impersonate me?

That is what I see since a few days here. But what to do?

It has always been my conviction that my comments should be judged on their merits, and not on my name. So my only advice would be to read the comments and judge each comment on its merits, not on my name.

ferritecore February 11, 2021 7:38 AM

@Winter

re: “Should I be proud that people are trying to impersonate me?”

And they seem to be putting quite a bit of effort into the project. Some of those posts are quite literary in a twisted sort of way.

@Clive and his brass monkeys.

I believe that the “freezing the balls off a brass monkey” story is a genuine story, but quite possibly invented in the Victorian period to provide a clean origin for the phrase. The difference in thermal expansion is small enough (7*10^-6/degree C) to make the supposed event just about impossible. That, however, has little to do with the story’s circulation and acceptance. A closely allied question is, when and where a rack for cannon balls was known as a brass monkey and is that because of the story or does the story simply report a name? This whole topic is worthy of a discussion between Hofstadter’s Tortoise and Achilles[1].

[1] Footnote in honor of Clive[2]. Hofstadter borrowed the Tortoise and Achilles from Lewis Carrol.

[2] There are a whole raft of thoroughly off topic subjects that I would love to take up with Clive. One that has been bugging me of late is the possible relationship (if any) between the transition from titans to Olympians in Greek mythology and the late bronze age collapse.

SpaceLifeForm February 11, 2021 1:30 PM

SCM, Dependency Hell, and Supply Chain Attacks.

A great example of why Node is bad.

Why you need to manage ALL of your source code including the source of your build tools.

hX tps://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

You have probably heard of these tools already — Node has npm and the npm registry, Python’s pip uses PyPI (Python Package Index), and Ruby’s gems can be found on… well, RubyGems.

When downloading and using a package from any of these sources, you are essentially trusting its publisher to run code on your machine. So can this blind trust be exploited by malicious actors?

SpaceLifeForm February 11, 2021 2:53 PM

@ ferritecore, Clive

Daily uneven warming and freezing of moisture could cause the balls to be forced off the brass monkey. Freezing water expands.

xcv February 11, 2021 4:18 PM

SpaceLifeForm • February 11, 2021 3:24 PM

@ Moderator

Bugnote: There are still weird things going on WRT to PREVIEW.

Preview is rendered clientside in Javascript, whereas the HTML for the final appearance of the post or comment is generated serverside in PHP.

There are always going to be “bugs” or discrepancies between clientside and serverside rendering vis-à-vis JavaScript versus PHP — they are different programming languages developed by different teams who aren’t always going to have the same opinion on getting each and every detail of display and rendering “correct.”

I have been using Wiki.js which runs on serverside JavaScript rather than PHP for my personal webpage. That is one strategy to mitigate PHP-vs-JavaScript discrepancies, but there are legitimate reasons of efficiency and so forth for preferring PHP serverside.

vas pup February 11, 2021 5:15 PM

@Clive Robinson • February 10, 2021 11:25 AM

said:”Maybe the moderator should look at the IP addresses, it’s something the “blog wreaker bot” should not be able to predict unless you go to a site they control or they have other not legal sources of information, which I suspect they don’t have based on their current failing bot.”

That is the problem if blog is collecting IP addresses and other pointers of the posts.

Next step Big Brother could trace (with or without Bruce’s consent) posts back to the source including combo of IP address, MAC address, browser type, etc.

Whatever any information is collected and stored, then “five line written by the most honest man…’ is working.

SpaceLifeForm February 12, 2021 12:18 AM

@ xcv, Moderator, Clive

“Preview is rendered clientside in Javascript,”

That is relatively new, but is a moot point.

The javascript can still do https.

It’s obvious when PREVIEW is instant that it is all client side.

When PREVIEW is NOT instant, then something else is going on.

See above, re node, and knowing what is running.

This site still pulls in hxx ps://cdnjs [dot]cloudflare.com/ajax/libs/jquery/3.5.1/jquery.min.js?ver=3.5.1

xcv February 12, 2021 12:38 AM

@ Space lifeform

When PREVIEW is NOT instant, then something else is going on.

The old site on Movable Type rendered the preview serverside, with the exact same serverside scripts used to rendered the final comment to HTML.

That “guaranteed” what you saw was what you got.

“Instant preview” is going to save a lot of network bandwidth and server performance, but it is not going to match the final version of comments (or posts) in all special situations or corner cases of bad or unusual Markdown syntax. Markdown is designed to be forgiving and quick and easy to use, not a commercial publisher’s proof level of perfection.

Patriot February 12, 2021 3:16 AM

Terra Quantum AG claims to have inverted a cryptographic hash function with a quantum computer.

Their hyperbolic, low-on-self-doubt presentation did not inspire confidence.

This article from Bloomberg tells us more:

Terra Quantum AG has a team of about 80 quantum physicists, cryptographers and mathematicians, who are based in Switzerland, Russia, Finland and the U.S. “What currently is viewed as being post-quantum secure is not post-quantum secure,” said Markus Pflitsch, chief executive officer and founder of Terra Quantum, in an interview. “We can show and have proven that it isn’t secure and is hackable.”

The company said that its research found vulnerabilities that affect symmetric encryption ciphers, including the Advanced Encryption Standard, or AES, which is widely used to secure data transmitted over the internet and to encrypt files. Using a method known as quantum annealing, the company said its research found that even the strongest versions of AES encryption may be decipherable by quantum computers that could be available in a few years from now.

I am not sure whether to believe it. However, personally speaking, I have always thought that SHA-1, and the SHA-2 family, were invertible at birth. Why?

If anyone believes that the fox would design and distribute a lock for the hens and their henhouses that he could not open at will, that person would need mental help–it is group insanity. SHA-1 and the SHA-2 was all made at the puzzle palace, a group that has the NOBUS policy.

My hypothesis accounts for the presence of SHA-1 in GnuPG. You cannot enter a raw session key, you cannot use Argon2, and a hash of the plaintext is sitting there like a sitting duck. Using SHA-1 is mandatory in GnuPG. Cryptographers seem to come up with another method to find collisions in SHA-1 about every six months, and it can be open to length extension attacks.

I know one thing for sure: if the jokers at Terra Quantum AG actually made such an advance, the entire plan is sitting on a desk in a basement in Beijing or Shanghai. The Chinese will realize the potential of the attack before anyone else, and that is not good for the West. Maybe this will be another Treadwell Stanton DuPont, but we just do not know yet.

Perhaps Mr. Schneier will weigh-in soon.

SpaceLifeForm February 12, 2021 1:13 PM

@ xcv

Your points are valid, but do not address my point.

Re-parse what I wrote above. Why is PREVIEW not instant sometimes?

Read the link I provided above about Node. There is a core problem, pulling JavaScript from a server that one does not control.

veronica forbs April 3, 2021 7:03 AM

Hello, I want to write a little review about the good work of doctor Ojamo, who cured me from HSV 1&2 for just 2 week with his herbal medicine, I never believe I can be cured again and have a good life like others, I always regretted the day I got diagnose with this virus, I become lost of hope when my doctor told me there is no cure for it, Well I am so grateful for my helper who get me cured with his herbal medicine, I went online in search of anything that can help me because I can’t deal with it forever so I found dr Ojamo email dr.ojamoherbalhome@gmail.com on a blog of someone who was cured by him,of the same herpes, so I quickly contacted him for help and explained all my pains to him, he told me not to worry about it there is a cure for real, I never believe until he sent me the herbs when I ordered for it and I got it within 5 working days that is how I took the medicine for 2 weeks and the following week I went for a test just to confirm I was 100% cured from this sickness what a miracle in my life, I am so happy right now, and forever grateful, you can also get in contact with him if you have such sickness through his whats-app +2349077406037 or email address:: dr.ojamoherbalhome@gmail.com

You can check on his website for more info https://drojamoherbalhome.wixsite.com/welcometodrojamoherb

Tarsha Michelle April 3, 2021 10:05 AM

Hello everybody, i don’t just know the reason why some people is finding it difficult to believe that there is a cure for herpes, i have been suffering from herpes since last three years but today i am happy that am cure from it with the herbal medicine of Dr Omongbe the great healer, I was browsing the internet searching for help when i came across a testimony shared by someone on how Dr Omongbe cure his herpes i was so much in need of getting his treatment but after all Dr Omongbe brought a smile to my face with his herbal medicine. I am so happy today that we have someone like this great healer out there, so my people out there kindly visit this great healer on his website https://dromongbenaturalre.wixsite.com/dromongbenaturalreme           Email address: dromongbenaturalremedies@gmail.com please sir keep your good work cause there are people out there who is in need of your healing medicine. Once more contact him now you can call him or whatsApp his number +2348050407265

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.