Schneier on Security

Clive Robinson • March 13, 2021 4:14 AM

@ JonKnowsNothing, Anders, Etienne, SpaceLifeForm, All,

The picture of the melted cladding looks a lot like the melted cladding on the Grenfell Tower.

It’s hard to tell these days with the way they build buildings what is an already built building with added cladding to resolve structural failings, one that has had cladding added as a “face lift” or new builds where all they put up is “steel work” support structure that is reinforced concrete with what looks like cladding being the exteria finish behind which no loadbearing insulation and internal finishing are added.

It’s important too know for several reasons but the most important is the “chimney effect”.

In times past people faced off solid brick walls with “weather boarding” what this did was not just keep the wind, rain and sunshine from damaging the brickwork it also provided an “updraft effect” between the cladding and the wall that sucked moisture out of the solid brick walls making them drier and thus less able to conduct heat. The gap also provided a form of insulation it’s self. Such boarding was often made with ceeder as it did not need to be lime washed etc.

The problem is such houses burnt rather quickly and dramatically and were difficult to put out. So solid walls got replaced with cavity walls where the chimney effect did not realy exist. However cavity walls became bad news when people started injecting “cloased cell foam” into the cavity because of amongst other things it trapped the condensation into the house hence a plague of “black spot” mould which is very dificult to get rid off. So the trend switched back to cladding but more high tech…

The first mistake people make is not understanding what is and is not flamable. Even diamonds given the right conditions will burn as will most metals. To see this hold a small piece of “steel wool” in a pair of pliers and just put an ordinary lighter under the bulk of the wool to see steel burn. Basicall any molecule that can form an oxide will burn, even some oxides will burn (Carbon monoxide or “town gas” being the most widely known).

Essentially any unoxidized molecule is a fuel for an appropriate oxidizer and sufficient energy to get over the “entropy hump” then watch out as the energy release can be extreme, which is why “thermic lances” can go through concrete and rebar relatively easily and thermite can be “fun” as well as capable of welding railway/road rails together.

Thus few things are actually “fire proof” most are at best “fire retardant to a temprature point”. All you need is an oxidizer and sufficient energy a runaway process can start.

Which is why the design of chimneys used to be an art. We know from high school science that less dense gas rises above more dense gases it is after all why party balloons float. We should also know that as a gas is heated it normally becomes less dense as the molecules vibrate and speed up more (which is what transferes the energy from one point to another). We should also know that even molecules have inertia. So put that together and you can see that as the tenprature differential between gas in the chimney and ambiant increases more work is done on the gas in the chimney, and the chimney becomes a thermal engine rapidly pulling ambiant air with oxygen in it at the bottom over any hot fuel. It can if you get it right act like a jet engine and sound like a rocket engine hence the name “rocket stoves”. What many do not realise is that as the temprature rises, other molecules in turn become viable fuel and not “smoke” thus wood burnt in a rocket stove or similar design becomes way more efficient and releases even more energy so you get a runaway process. As a rough rule of thumb the taller a chimney the greater the velocity of the “updraft” thus the faster oxygen is brought in and the greater the energy release. It’s a similar process that makes hurricanes and typhoons with the chimney forming from the vortex effect of rapidly turning air creating lower pressure inside than out and the warm ocean water providing the initial energy to start, and then sustain it.

If you want a lab experiment to demonstrate this all you need is a lit candle and a large enough diameter glass tube. As you put the tube over the candle the flame grows not just in size but intensity. It’s an important effect as “oil” usually burns with a dull flame and a lot of unburnt hydrocarbons we call “smoke”. Add the glass tube and the flame burns much brighter and hotter consuming the unburnt hydrocarbons releasing more energy of which a small but increasing fraction is visable light.

But you do not actually need a fire to see this in action a thin walled black painted pipe of sufficient dimensions will with sunlight on it cause the air inside to rise. Thus the likes of “effluant storage tanks” will have the smell and potentially explosive gasses drawn off.

And it does not need to be a pipe as such. What happened in part at Grenfell tower, was “contractors” stored rubish and other flamable materials at the bottom of an open stair well. Which they might not have realised was exactly the same thing you do with wood in a fire place. That is the floor was the grate and the stair well the chimney…

Outside the gap between the clading and the wall became another chimney… Once started the thermal energy went up crossing the entropy humps of more and more materials and the process became run away and the only way to stop it was to rob the combustion of temprature. The material that has a very high thermal capacity and even greater “phase change” energy requirment to become “raw steam” is water…

So I suspect from the intensity and near vertical burning of the data center, one of the first things they will be looking for is “the chimney” that made things not normally flamable to get hot enough to burn…

Which will also involve examining for the initial “ignition source” and energy supply.

Whilst the UPS is potentially the cause, I’ve seen way too little information to say if it was a battery based UPS or a full diesel Gen-Set UPS, I suspect from the function of the building it is more likely the latter, especially if there was building work going on as the materials around the building suggest.

Clive Robinson • March 13, 2021 2:58 PM

@ Shaun,

In the wrong hands, and they always end up in the wrong hands, they act as force multipliers for our enemies.

You are conflating two rather different ideas there, and thus you are confusing a situation and wotse not dealingvwith it objectively.

The first thing you have to remember is,

Mankind designs technology in opposition to entropy and it’s a race that mankind will eventualy loose.

So things decay and mankind seaks not just to halt the decay but actually reverse things such that mankind makes headway against the relentless march that entropy is. The results are three fold,

1, We get what we call technology at a price.
2, We use a lot of energy frome finite sources in the process.
3 Thus we hasten the colapse of not just technology but mankind.

But the thing about technology os it either works or it does not work. It has no ability to conceptualize Good/Bad other than by rules we build in to the technology.

More simply technology is “agnostic to use” it does what it is both designed to do and constrained by those that put rules and limitations in as well as those that point it in any given direction.

In the main rules and limitations increase the complexity of technology thus as a general rule they are left out or minimised. But almost always such rules have over riddens such that a controling human can take over.

Thus the use of technology is not governed by the hand that holds it, the finger that rests on the button because they indirectly are under the control of the “directing mind”.

There for it is the Directing mind thet defines Good/bad, friend/enemy asset/detriment.

Those who chose to Accumulate power are aware that they need power to increase the power. They have got[1].

Thus they have two basic questions

1, How to get initial power.
2, How to increase that power.

The answer to both questions always involves some form of technology, from the thrown rock to the nuclear bomb.

Because technology over time follows the yogurt recipe effect in that technology begets technology. From this it is seen that better technology gives an increase in power even if it is only making it more efficient. Whilst not entirely true the basic viewpoint that arises amongst those seeking power is “best tech wins”…

Thus a side effect is to think that if you deny others technology you will automatically win. But this can be seen from the yogurt recipe effect to be self defeating, which is what happened woth European religion, it held back technology and knowledge as best it could thus slowing societal change to the point that it was quite small across the then average adult lifetime of three decades. With those in power enjoying adult life times of near six decades you can see why they fairly fervently believed in controling knowledge and hording it.

Whilst the status of long adult life time over short is now considerably less than it once was in any given society it still exists (see maximum expected average life time difference between afluent West London, and deprived East London of 82years and 56years respectively).

Thus there are still good reasons why the chasing of power to gain affluence thus longer life, thus the chasing and hording of technology exists.

The problem for those seeking power id that usually they do not have either the temperament or inclination to develop technology. Thus they use the power they have accrued to obtain technology in one way or another.

Just half a life time ago in the early 1980’s the development of leading edge technology was still in the hands of those with political power (defence etc spending). Though the ending of WWII and the massive technological leaps it brought to those in power, gave victory, it also started to escape from Government control. Because technology which is mainly agnostic to use in that period had developed outside of actual weapons and had in that period become supprisingly less conflict biased and more applicable to development of society. This was seen in both personal transport and personal electronics. The very expensive thermionic tubes of prior to WWII had ceased to exit, with mass production making them smaller, lighter, more robust and more importantly many many times improved in performance. This in of it’s self spured forward further technology development in the 1950’s with the transistor, which about a decade later was in many affluent teanager and younger hands (mine being just one of many pairs). By the 1970’s inyegrated circuits or “chips” were rapidly developing half way through that decade computer chips became sufficiently available that “hobbiests” could build their own computers, mechanical terminals were being replaced by VDU’s and in the mid to late part of the 1970’s home computers had started to sell well (see history of Apple ][). The early 1980’s was the time of the home 8bit computers the mid 1980’s were the start of true 16bit office computers on desks and 32bit Personal Computers (PC) were around at the start of the 1990’s. This enabled electronics engineers to do personaly at home in a few weeks what just a couple of decades before required several years by well funded teams and a lot of equipment that cost more than even a proffessional earned in a year. Technology had escaped the hands of Governments. Now you can by $1 microcontrolers with more computing power than minicomputers costing the equivalent of 10 million times as much. In the process kind of proving economists wrong about deflation effects.

Unfortunately tecunology in the process crossed another line that of “connectivity” back in the 1980’s we had dial up lines and payed by the minute to connect to bulletin-boards. Thus you did a lot of stuff off line and tried to make it efficient to send with thought, care, compression and error correcting upload software. Thus people were not just uploading random thought. Now connectivity has massive bandwidth and is as far as mostvare concerned continuously connected. Thus every near meaningless thought sight or sound gets uploaded. Governments through technologists who talked to engineers could see this comming and the one thing they had learned from WWII was listening in on peoples communications had real power to change outcomes. Even when you could not listen into peoples communications just seeing who communicated with who for how long, when, how urgently and what changes gave even more power if managed properly. That is in what we now call “traffic analysis” the potential for real power, real control came to the greedy ears and eyes of the power hungry. Thus the technology agnostic to use that had droped so much in cost ment the dreams of past tyrants and dictators could be not just put in place, bit actually in a way that saved money by making traditional investigators redundant.

So we have reached a point where real human skills are being lost to faux skills of algorithms and the majority of the pipulation is actually seeing their real status and fortunes diminish day by day. Thus the times of the Baronies and their surfs are returning…

There are many problems with this one of which which few are considering currently but realy realy should be is “lost skills”. New technologies require skills that are often built up over a life time of working at the leading edge of technology, if your work force are unskilled then they can not develop new technology. The result is that whilst the new Barons will have status for their life time, their children will lose it because they will have lost any technological lead they had back as little as three decades ago…

It’s just one of the reasons I have been going on about out sourcing. Those who seek power are generally short term thinkers thus to them “A cent today is more important than a dollar a year from now” the trouble is that cent is not earned behind it is the loss of the potential that makes the dollar, they give that potential to those who give them the cent in return… Ask yourself who is getting the real deal, the outsourcer with his cent or the person who gave him the cent getting a dollars worth of technology knowledge and processes? In the UK we call such stupidity as “The drunk selling the family silver for another drink”. We’ve seen what happens history has it documented well, but the outsourcers never majored in understanding histories down sides. Those that seek power likewise so they do not see the trap… Whilst others you call the “enemy” do.

[1] This effect is sometimes called “The yogurt recipe effect” from the fact that,

Yogurt = yogurt + warm milk over time.

Clive Robinson • March 13, 2021 5:37 PM

@ SpaceLifeForm, ALL,

So, how did Veloxity communicate with MSRC?

What we need is a real time line. Which I expect will “come out in the wash”, however I can not see one of the players in this little game “doing their washing in public” if at all.

Why because there is a big steaming load in this saga and nobody wants it either flying off the fan at them or admitting they’ve been splattered from head to toe…

Clive Robinson • March 13, 2021 5:42 PM

@ SpaceLifeForm, ALL,

To attack your freedom.

Not just your freedom but your very existance and soul.

Lack of transparancy, means things are hidden. As with wood piles generally where you can not see something nasty lurkes waiting to bite.

Clive Robinson • March 14, 2021 1:55 AM

@ SpaceLifeForm,

Re #comment-370763

Unusual to put it mildly.

As,for “pi day” it’s also “mother’s day” in the UK[1] which do you think is going to win on points?

So go half way and eat Apple Pie in the US[2] today and make that otherwise meaningless phrase have real meaning[3].

Mind you some in the US already have marked morhers day this year under the Code of Virginia Commonwealth : Title 2.2, Section 2.2 3303. Which also gives it more food for thought.

[1] In the UK the religious calander for Easter and associated dates such as “Lent” and the Fourth Sunday in Lent which is “Mothering Sunday” are based on the phases of the moon. Which is why it’s traditional for some to give Daffodils as they are usually in bloom then sometimes above snow.

[2] As for mothers day in the US it’s not the phases of the moon that dictate it, just the vaguries of that extra day or two each year that makes the week rotate on the calendar, as it’s just “the second sunday in May” so Pi day is never going to coincide with Mother’s day in the US…

[3] A statment usually so obvious, it is effective pointless to say. But also so ubiquitous it’s also devoid of real meaning thus ironicaly it is used as not just an example but a class clasifier of meaningless managment speak proclamations. So we get XXX is just a “Mothehood and Apple Pie statment”.

Clive Robinson • March 14, 2021 5:34 AM

@ urbanmonk, ALL

With regards,

https://www.brusselstimes.com/news/belgium-all-news/159039/cracking-of-encrypted-text-messaging-service-sky-ecc-app-dealt-major-blow-to-organised-crime/

There is little evidence thus a lot of speculation that you woyld expect in an information vaccum.

What we do know is that Sky ECC deny the claim,

https://www.vice.com/en/article/epd3km/sky-ecc-hacked-fake-app

Oh and the US Gov has decided to issue indictments of criminal charges against Sky ECC personnel,

https://www.vice.com/en/article/4adzdj/sky-secure-global-indictment

But whilst the Belgian authorities claim to have “cracked” the application they have not said how.

Thus my first guess is that if the application did do end to end encryption securely (which is douvtfull) then the authorities somehow did an “end run” around the application encryption and such and probably got access to the User Interface or a plaintext file store or equivalent on the mobile phone.

But I’d be suspicious of any claims of “end to end encryption” when a company charges very large subscription fees and talks about it’s own secure network. To function such a network would need meta-data and thus would require “link encryption” for that. Would developers keep the link encryption entirely seperate from any end to end encryption, I suspect not. Because I suspect the reuse of components which is way to big a draw to developers gave rise to a code library and thus componebts would be optomised and shared etc.

But the big failing of all these applications as I repeatedly point out is,

The “Security end point” being on the same device as the “Open communications end point” means that in practice the “Security end point” occures before the “Open communications end point” thus can not ever be secure as “end run attacks” will always be available.

Put more simply the encryption that secures the message contents, needs not only to be propperly end to end, it also needs to be done off of the device with the Open communications. The fact that no “secure messaging app” does this means they are all insecure. Someyhing I realy wish people would wake upto…

Take the Vice/Motherboard articles, they all ask “whistleblowers” to contact them via “OTR”… So they do not understand the irony let alone the security.

Whilst having “crooks” get caught is something most would think is good it’s not in many ways…

The reality is that people are not thinking it through, instead they are reacting to a polititions “dog whistle” or “Think of the children” type emotional knee jerk. Look at it this way, what you might think of as a “Whistleblower” or similar is usually seen by those in authority especially crooked politicians as “crooks”… Thus the breaking of all these supposadly “secure apps” will follow the old,

“First they came for the…”

Quotation[1] and if people ignore this and do not stop it then they will find out the hard way the implications towards the end of the quote of,

“Then they came for me…”.

Privacy is without any doubt a “Social Good” the fact a limited number chose to use a “Social Good” to hide their bad, does not in any way stop it from being not just a “Social Good” but a very necessary one to protect the health and well being of society and ALL that live in it.

[1] https://genius.com/Martin-niemoller-first-they-came-annotated

Clive Robinson • March 16, 2021 11:04 AM

@ MarkH,

Did somebody just say panopticon?

That I don’t know but something tells me a few might start hanging around street corners and whistling “Va Pensiero”

https://m.youtube.com/watch?v=u5V-xBVqjUc

From Verdi’s Nabucco[1], the legend of which has endured.

[1] https://www.theguardian.com/music/2013/oct/07/verdi-the-revolutionary-separate-fact-from-fiction

Clive Robinson • March 16, 2021 5:49 PM

@ Spinning Wheel,

New coronavirus variant found in France is undetectable by PCR tests:

Do you know what this does for your evidence-less statment of,

Thanks Wuhan Lab for experimenting with coronaviruses and killing millions of people.

Specifically your claim of,

They have not found a single animal in the wild native to China that has covid 19.

Time to put up or shut up.

Either you have scientifically verifiable evidence or you have nothing.

The fact that a tiny few US blow hards will lie any which way they can to keep war like tension between the US and,

China, Iran, North Korea, and Russia

Has been going on for so many years now, that the US citizens are being bled white by the money being poured into certain vested interests pockets.

The fact you refuse to even think that in fact it’s the US politico appointees and executive with people like Bolton etc who were formenting as much xenophobic nonsense as they could is actually quite worrying.

The only sensible thing for any nation to do in the face of such xenophobia is to “not engage” in anyway, pure and simple.

The fact you chose to read that in your own mind as a sign of guilt is I would suggest a problem at your end.

Produce real evidence or stop being another xenopobic “idiot” “moron” tilting at windmills.

Oh and by the way, nobody has said it has to be a “wild animal native to China”

In fact the first creature suggested was not.

The simple fact is after more than a year there is no independent evidence that any one has put forward. What little evidence claimed there is, does not make it to viable circumstantial evidence.

In fact some scientists doubt not just that it was,

1, A bio-weapon.

Bit also

2, A lab based development.

That is they say that on balance of probability it’s origin was natural, not cooked up. And the biggest argument in that is the way the virus it’s self behaves.

So maybe you should be asking why a certain few in the US Government with known war like behaviours are trying to say otherwise?

Till someone comes up with credible evidence, I’m otherwise sticking to the non political scientific consensus not the politically inspired and persued “It was the butler wot dunit”.

Clive Robinson • March 17, 2021 1:49 AM

@ Anders,

Radiological images confirm ‘COVID-19 can cause the body to attack itself’

“Colour me unsurprised” I’ve kind of been expecting an auto-immune response or similar for quite some time, even before “Long COVID” became a name for similar.

What seems like many years ago now the term “yuppie flu” came about. In part because of a nastier than average flu and in part due to the machismo “work through it” attitude prevelant at the time.

I myself thinking back then I was young and invincible used to “burn through flu” by vigorous exercise… Yes six months of hell later my Dr was going to add me to the list of “yuppie flu” sufferers. In a way I was lucky in that my symptoms started to clear up, but it was a long road, and also the first signs of the very odd collection of chronic illnesses I’ve now got.

So cause and effect or coincidence? I don’t know, but I’d urge everyone that gets a viral illness to treat it with rather more seriousness than we have done in the past. When the Dr says rest, they are not kindly giving you a few days “sicky” they may be adding years to your healthy life.

Clive Robinson • March 18, 2021 6:28 AM

@ Winter, ALL,

Vaccinations with AstraZenica are currently suspended in many countries due to possible serious adverse effects.

The information so far made available does not make sense because,

1, The story appears to be driven by a certain US MSM outlet.

2, It’s claimed to be a general thrombotic effect.

3, The rate given per vaccination given is well below the expected average over the same time period within the general population without vaccination.

4, The expected death rate per day of not vacinating far far exceeds this less than average thrombosis embolism risk.

5, It’s been said but there are no figures released that the mRNA jabs are showing higher incidence of thrombotic events than the Astra Zenica vaccine.

6, European Governments are still blocking the export of the AZ vaccine to keep it for themselves.

That is on the information made public so far (2,3) you could argue that the Oxford AZ vaccine is actualy reducing general thrombotic risk. But more importantly (4) it is very significantky reducing the fatality risk by thrombosis which is one of the major causes of death with COVID.

Further why would EU countries still be using Pfizer etc (5) and still be putting blocks on the export (6) of legaly ordered and paid for AZ Vaccine to countries outside of the EU?

Which means one of two things,

A, Somebody is trying to create a “tempest in a teapot” story for some political reason (which the Italian Health Minister has indicated).

B, What ever the thrombotic risk may be the much lower than normal events suggests it is not a general risk but of a very specific much rarer nature, such that it is probably a very low occurance adverse drug or environmental factor reaction, or possibly occurs only in those that have had COVID or are suffering from it with low or no real symptoms.

I’ve had both thrombotic incidents causing DVT’s, and the embolisms/strokes of them breaking up via PE’s, CE’s and TIA’s as I’ve mentioned in the past, to this date they still do not know what caused mine, and the list of things they went through was long (it’s why the general risk is 10 in a million per month in Europe and worse in other parts of the world). It’s why they have me jacked up on blood thiners of various types, which now appear to have caused further issues with my heart (currently under investigation). I’ve had my first shot of Oxford AZ and as promised I would reveal any symptoms I’ve had, which is as I’ve said so far a mild ache at the injection site on the Wednesday PM following the Saturday AM injection.

Whilst the European Medicines Agency (EMA) had made an OK to Carry on Using pronouncment on AZ already,

https://www.bbc.co.uk/news/health-56411561

It appears they will be having talks with The WHO and making another anouncment today.

So “watch this space”.

Oh one snipit that has been said but I’ve not found conformation on is that the thrombosis sufferers are all women of middle age or slightly younger (HealthCare workers? EU is only down to 70’s at best for general population vaccination).

If that is true, it might be a very rare adverse reaction to hormone based medications, which in the past have been noted for rare thrombotic issues. Such events are sufficiently rare that the odds of them showing up during Phase II & III testing would be vanishingly small.