Comments

vas pup • May 28, 2021 5:54 PM

US soldiers ‘revealed locations of nuclear weapons in Europe by posting details on online flashcards,’ report claims

https://www.yahoo.com/news/us-soldiers-revealed-locations-nuclear-171839382.html

“American soldiers have mistakenly revealed the exact locations of US nuclear weapons in Europe by uploading details as part of revision exercises that were publicly available to view, a report claims.

An investigation by Bellingcat alleges that soldiers attempting to learn intricate security protocols uploaded a multitude of sensitive information to the internet, including not only the bases at which the weapons are held, but in which exact vaults they are stored.

The presence of US nuclear weapons in Europe acted as a deterrent to the Soviet Union during the Cold War and also meant European countries would not need to develop their own.

==>“These bombs are stored at six US and European bases – Kleine Brogel in Belgium, Büchel in Germany, Aviano and Ghedi-Torre in Italy, Volkel in The Netherlands, and Incirlik in Turkey,” one line read, according to the Belgian newspaper De Morgen.”

Read the whole article asap before post deleted.

Jonathan Wilson • May 28, 2021 6:36 PM

It should be pointed out that the bitcoin mine was only illegal because they were stealing electricity, not because they were mining bitcoin.

JonKnowsNothing • May 28, 2021 9:54 PM

@Clive @All

MSM report about a “harmless” undocumented channel in Apple’s M1 CPU. It’s claimed the existence of a two way un-monitored pathway is “harmless”.

It doesn’t sound that benign, especially when the Apple Dev’s say they didn’t know about it.

Anything that provides a hidden communication path, will surely find a solution requiring such a hidden channel.

[Hector] Martin said that the flaw is mainly harmless because it can’t be used to infect a Mac and it can’t be used by exploits or malware to steal or tamper with data stored on a machine.

The flaw can be abused only by two or more malicious apps that have already been installed on a Mac through means unrelated to the M1 flaw.

…

“It can only be used as a communication channel between two colluding (malicious) applications.”

…

There is no way to patch or fix the bug in existing chips.

…

it was a bug that even Apple developers hadn’t known about.

===

ht tps://arstechnica.com/gadgets/2021/05/apples-m1-chip-has-a-security-bug-but-dont-worry-its-mostly-harmless/

(url fractured to prevent autorun)

Weather • May 28, 2021 11:39 PM

@all
Ran a 23 unique char pass , got back 22 with a range of 77 chars, needs improve it pretty basic at the moment, would like to scale up to the whole byte range but that will tale to long.
Release it now or perfect it?

SpaceLifeForm • May 29, 2021 12:19 AM

@ JonKnowsNothing

Silicon Turtles.

It’s only harmless until it is instrumented.

BlackHat – I know how I would do it in order to leak.

WhiteHat – There is way more to look for.

echo • May 29, 2021 2:24 AM

@vas pup

The presence of US nuclear weapons in Europe acted as a deterrent to the Soviet Union during the Cold War and also meant European countries would not need to develop their own.

The geo-politics and trade and anti-proliferation stuff is messy and then there was the behind closed doors one sided trade agreement negotiations as well as tax dodging tech companies throwing their weight around not to mention assorted verbal diarrhoea from some quarters.

As for the Russian question I think more productive long-term work can be done via the Council of Ministers more than NATO. Harmonisation and-descalation and if not integration bit normalisation can happen via the European Court of Human Rights. The Russians would have to remove their constitutional barrier to extradition at some point but this is achievable within the next 10-20 tears. (That one sided UK-US extradition treaty has to go.)

There’s a lot of “performative” military about and it is a way to keep scruffy oiks out of trouble and off the dole.

As for “the bomb” I think we need to go all in on the green technology and economy. It requires a different focus and tone and isn’t incompatible with existing security frameworks and position papers and priorities. In advanced nations population is dropping. This is not a bad thing and as much an opportunity as anything. Healthcare and welfare systems are part of solutions to many economic and social problems. It also avoids a lot of horrifying scenarious where “the bomb” is the least of our worries and more a blessing than a curse.

See also: Plato’s unwritten teachings, Carl von Clausewitz unfinished works, and similar.

Georg • May 29, 2021 2:29 AM

Hi Bruce, glad you enjoyed the research article on giant squids 🙂 And thanks again for your time & advice!

Any views on the recent attempts to censor Sci-Hub?

echo • May 29, 2021 4:03 AM

@Georg

Any views on the recent attempts to censor Sci-Hub?

I’ve never had a problem getting a research paper by asking the papers authors direct. The papers I tend to request have relevance to European Convention fundamental rights so withholding papers is an iffy exercise in any case.

I do know the peer review process and publication isn’t a cost free exercise. At the same time if it’s a fight between someone’s profit and fundamental rights I’m just going to steal it if I have to. There’s probably an argument for big universities or lawyers or whoever to pay a subscription as “the price of doing business” or an effective tax but for everyone else and the public not even one off fees are justifiable. When fundamental rights becomes a matter of how much money you have they are no longer rights.

“Patent thickets” are another bone of contention as is the cost of obtaining patents…

I suspect most academics especially those in off the beaten track areas are more than keen to share their academic papers. I’m not especially interested in a sub species of beetle myself but some people are. I imagine being locked in a lab with peeling paint and flickering flourescent light or with your arm up a random hole of a rotting tree can be a bit onerous and a moment in the sun goes down well.

If all else fails there’s always the “But what about Africa” argument. That’s always a good one to get people bikeshedding and unlocking budgets.

I’ve done a bit of legal archeaology with Common Law in Africa. It’s a bit of a black hole and I’ve never read an academic apper in any subject I am interested in coming out of Africa. I suspect the fact people might acquire death sentences for publishing them may have something to do with it. This is something for all the Alt-Right types complaining about “no platforming” and “silencing” and “cancel culture” to think about not to mention the UK “regime” attempting to force through “academic freedom of speech” law which runs counter to human rights and equality law and gives a platform to racists and sexists and eugenicists while those same types of people they want to enable are busy executing anyone with a different worldview in the more murky corners of the world.

The Germans produce some good academic papers on systemic issues which interest me.

I can’t think fo a single academic paper I’ve actually read which wasn’t European or US in origin although I have read reports from other places. Latin America produces some good stuff.

I’ve even gone digging into Saudi Arabian law of all places. Chinese law? Ugh. That’s a bit of a mess and depends on who you ask and who you are. I’ve never even heard of an academic paper in anything I’m interested in coming out of China.

Cyber Hodza • May 29, 2021 4:27 AM

@echo – Nice to see how much AI has progressed but still not as human sounding as it can be. The last 10-5% gap maybe never be breached and I , for one, see that is a good thing

Anonymous • May 29, 2021 4:57 AM

@echo:

I’ve never even heard of an academic paper in anything I’m interested
in coming out of China.

I found one in my field. It was interesting, not earth_shattering, but useful in a practical sort of way. Some novel ideas applied to stabilising electricity distribution systems.

Although it was actually a paper I’d written myself (with co-workers) a few years earlier and published in IEEE.

I wasn’t sure whether to be flattered or annoyed. In the end I just shrugged. Perhaps I should have written to the authors for a signed reprint; I could have stocked it with all my other reprints.

Clive Robinson • May 29, 2021 5:15 AM

@ JonKnowsNothing, SpaceLifeForm, ALL,

With regards “Apple breaks the ARM Spec and Opens up a Hardware bug”

The finder of the bug has given it a name and a website,

https://m1racles.com

But you really should read it all.

It has one factual error that is immediately obvious,

“Covert channels can’t leak data from uncooperative apps or systems.

Actually, that one’s worth repeating: Covert channels are completely useless unless your system is already compromised.”

That applies to a limited subset of covert channels. Also “already compromised” is at best ambiguous as a statment.

The reason is,

“How far down the computing stack you implement your covert channel, and what your intended channel medium is”

For instance I could[1] arange I/O on a SoC such that addressing a particular register unrelated to say BlueTooth just happens to “blip” the power control circuitry for BlueTooth causing it to transmit a short blip of carrier with a funny shaped envelope of AM modulation on it (for Ham’s think “CW Whine” in old tube/valve transmitters).

If the register I select is “security oriented” then accessing the register causes a blip on the BlueTooth TX, leaking information “off of the chip” to any near by receiver that is setup to look for the blip via a matched filter or similar.

Which brings up the question of what is the difference between a “covert channel” and a “side channel” and it’s one of those “All cats are grey at twilight” answers. Some will say it’s the difference between “accidental and deliberate” but that avoids two points,

1, At a sufficiently low level in the hardware stack you can not tell.
2, If you are creating something covertly, then you will try your best to make it look accidental.

As we now have good reason to believe the NSA fritzed the NIST AES competition so that what was presumably a side channel (chache hit timing) would become a covert channel[2].

But some people are going to ask why these two bits? And not say a byte or word?

Well Only Apple or possibly ARM can say for sure.

However two bits are all that are needed to do “buffer control” used for messaging.

Imagine you have a byte register in which you want to transfer information. You write a value into it but how do you know the other process has read it before you write the next byte that might even have the same value? The simple answer is you set a flag when you write to the buffer and the other process clears it when it reads from the buffer. You then have the issue of how do you stop coincident writes with reads? Simple you set a “lock bit” before you change anything, then you clear the lock bit so the other process can read or write which ever it is doing.

Back in the late 1970’s the use of two 8bit latches and two D-type layches (7474) was a “letterbox” between two seperate CPU’s for high speed data transfer without the expense and realestate of DMA hardware. Most IBM PC’s came fitted with an almost identical system ro talk to printers (see Centronics interface) likewise various parallel instrumentation busses.

It’s a quick and easy hack you would add if you wanted to “instrument up” a logic circuit for “In Circuit Emulation”(ICE) or a “test harness”.

So I suspect that only half the “secret” has been discovered so far… Or Apple engineers bodged the “tidy up”.

I guess we are going to have to wait and see what gets said if anything and if it’s “Truth or Spin”…

[1] Whilst this example sounds contrived, similar has actually happened accidently. The register concerned enabled a hardware circuit that “sucked power” as it reset latches etc and due to power supply routing it dipped the power to down stream circuits which caused modulation of an IO line used for serial communications…

[2] If you think about “cache” issues that leaked AES information directly onto the network interface via time delays you can see that covert channels can be fun to stop…

echo • May 29, 2021 6:50 AM

@Anonymous

I found one in my field. It was interesting, not earth_shattering, but useful in a practical sort of way. Some novel ideas applied to stabilising electricity distribution systems.

Although it was actually a paper I’d written myself (with co-workers) a few years earlier and published in IEEE.

I wasn’t sure whether to be flattered or annoyed. In the end I just shrugged. Perhaps I should have written to the authors for a signed reprint; I could have stocked it with all my other reprints.

It’s a curious one. People rip off other people all the time even in the West. I have “done stuff” which has been ripped off and I’ve even lawyers try to rip my stuff off. Chinese cut-and-paste does seem a bit over the top though.

It’s funny reading of a Western food industry manufacturer who turned their back on one machine only to discover the Chinese manufacturing an identical copy down to the embossing on the case. They no longer send the whole machine to trade fairs now only the empty case. The Russians are a bit better with their KopyKatski school of design. At least they try to make it their own and look original. I’m not sure what the solutions are to this but I think a more respectful and co-operative attitude would help as would less secrecy. There’s a value in a genuine market where each player has space to do their own thing and is allowed to do so. It’s more fertile ground for original ideas to develop. Plurality and diversity are a good thing and where there is enough tolerance and exchange there isn’t the need for a hyper level of authoritarianism or samey environments.

Within the EU it’s been discovered £702 billion has been spent by regressive lobbyists from all the usual suspects with half coming from the US and Russia. ($81 million from the US and $186 million from Russia.) They are setting up offices concentrating around the power nodes in the political network as a direct assault on the EU and member states but also the UN, OSCE [the Organization for Security and Co-operation in Europe], Council of Europe, and the courts.

You can see how this story ends if they get their way.

Formalized Form EULA • May 29, 2021 8:16 AM

Easter Egg Drops,

https://www.ft.com/content/4169ea4b-d6d7-4a2e-bc91-480550c2f539

Not too smart, but what you gotta do i guess. Considering the whole floating point of esoteric currencies this is much more manageable now from a fungible stand point.

@echo, vas pup, Ismar

I don’t think there’s a ‘happy medium’ until we’re on our backs instead of just on our back foot. Everyday that goes by is an ever more pressing full spectrum bullying campaign from my standpoint on this side of the pond. What one frenemy doesn’t do, the other is actively exploiting. Full scale political and economic Ad Hominemem.

But I’m just some guppy, opinions don’t matter.

Winter • May 29, 2021 10:00 AM

@echo
“I do know the peer review process and publication isn’t a cost free exercise.”

Peer review and scientific editing is done by unpaid volunteers. The publication costs are not that high as Elsevier made almost 1B euro profits on it.

The main point of contention is that universities pay for the research, pay for the writing, do the volunteer peer review and scientific editing, pay for the subscriptions and then have to pay copyrights for using the materials in class. And the publishers make huge profits.

Meanwhile, researchers and universities outside of the rich countries cannot pay the huge subscription costs for accessing the published research. Such access is necessary to even be able to publish, study, or get a PhD.

Luckily, many funding agencies are starting to require all funded research to be published Open Access. Here the author pays for the publishing and the reader does not have to.

All yore basis • May 29, 2021 10:02 AM

“Days Before a Report, Chinese Hackers Removed Malware From Infected Networks”

https://m.slashdot.org/story/385988
https://therecord.media/days-before-a-report-chinese-hackers-removed-malware-from-infected-networks/
https://therecord.media/chinese-hackers-use-new-pulse-secure-vpn-zero-day-to-breach-us-defense-contractors/

https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html

https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html

Ignorant US redneck • May 29, 2021 12:25 PM

@ All your basis

Once again Mandiant slams the barn door after the sheep were sheared.

All yore basis • May 29, 2021 3:02 PM

/*
Surface Urea • May 29, 2021 12:10 PM

https://news.ycombinator.com/item?id=27326268

https://krebsonsecurity.com/2021/05/using-fake-reviews-to-find-dangerous-extensions/

IT stinks, go krebs!
*/

I’m being politely nudged, am I calling shenanigans or are they?

@rednuc,

Anyways… yeah I saw mandiant was #included.

It’s a shame someone must’ve CC’d all their friends prior to the eviction notice lol.

Hence the Surface Urea of the manly krebs post, it’s all intertwined.

We cast our nets too far and too wide, now others pull at the edges of the tapestry from beyond the seeming prevail of our horizons. All bets are off, go fish.

vas pup • May 29, 2021 4:17 PM

@echo – Thank you for post related to bombs in Europe.
I agree with you on many points.
I just curious how Germany demolished nuclear power stations and switch to clear energy and keep warehouse of nuclear bombs on its land at the same time.

vas pup • May 29, 2021 4:22 PM

The age of killer robots may have already begun
https://news.yahoo.com/age-killer-robots-may-already-173054831.html

“A drone that can select and engage targets on its own attacked soldiers during a civil conflict in Libya.

Why it matters: If confirmed, it would likely represent the first-known case of a machine-learning-based autonomous weapon being used to kill, potentially heralding a dangerous new era in warfare.

=>How it works: The Kargu is a loitering drone that uses computer vision to select and engage targets without a connection between the drone and its operator, giving it “a true ‘fire, forget and find’ capability,” the UN report notes.

The bottom line: Humanitarian organizations and many AI experts have called for a global ban on lethal autonomous weapons, but a number of countries — including the U.S. — have stood in the way.”

Clive Robinson • May 29, 2021 4:36 PM

@ All yore basis, Ignorant US redneck,

It’s a shame someone must’ve CC’d all their friends prior to the eviction notice lol.

Aside from the “cleanup” before handing the keys back, they appear to have stayed within the terms of the Obama-Xi agreement, and not exfiltrated commercial or propriety information.

So the question arises as to what the two groups did get out of their work, and can it be used to meet objectives in another way (such as finding potential targets for “honey traps” or similar).

We might find out but I suspect not.

I guess the real question as always is why the prolific connection to the Internet?

Look at it this way, why do the R&D team need Internet access, likewise Human Resources?

What part of their job description require their work computers be connected?

“What’s the business case for this computer to be accessable from aby external network?”

Is almost the first question I ask, and I’ve learnt to stand atleast four feet away due to all the arm waving like a windmill in a storm… (Hey I’m not Don Quixote and I see no reason to get the lance in amongst such whirling).

The upshot is I’ve yet to hear a solid case for most of the computers in organisations being connected to any kind of communications network outside of the organisation.

When you boil it down it generally appears to be a case of mythical productivity improvment, for which nobody has produced any objective testing…

What I can say is some organisations such as Telcos take not just logical seperation, but hard segregation seriously, and they appear to suffer no loss in productivity, in fact the opposite.

Some years ago now I did contract work for a large pension managment company. Back then they took both organisational seperation and trading floor / back office segregation very seriously and did not suffer the more usual woes. From what I’m told these days everyone has Internet access and the ICT staff are not able to keep up with the nasties that cross the threshold all to easily.

Whilst I can understand “home working” at a time like this, I’ve always been supprised that “Business Continuity Plans” did not consider it as a viable option. Yet had elaborate plans for alternative work sites including down to first aid kits in staff transport and caffine free tea/coffee and water coolers…

This lack of “plan ahead” for “home working” has cost many businesses big and some will not recover, but others have become so insecure due to lack of planing ahead that their chances of not having intruders in their networks seems slight.

And lets be honest, most of the colabarative working applications were not realy “stress tested” or “security tested” either.

I get the feeling that this past year has been such a target rich environment, there has been way to few attackers to take advantage of “the bounty on offer”…

So those businesses that have not had an intruder so far, is not down to any skill in the business, but just the probability of attack is in reality so very small currently.

It’s possibly why “Ransomware” has been on the up but proportionately other forms of attack have been less.

Though speaking of Mandient they have just published a warning that attacks on small green energy systems, building plant, Industrial Control Systems (ICS) and other Operational Technology(OT) systems are likewise on the up buring this past year of lockdown etc,

https://www.securityweek.com/ot-systems-increasingly-targeted-unsophisticated-hackers-mandiant

echo • May 29, 2021 4:49 PM

@Winter

The main point of contention is that universities pay for the research, pay for the writing, do the volunteer peer review and scientific editing, pay for the subscriptions and then have to pay copyrights for using the materials in class. And the publishers make huge profits.

I’m familiar with this. Not everything is directly financial (as you observe) but that if I’m going to steal something even if I have to get kenetic about it there is a matter of respect and politeness. Not that I would necessarily be polite to them on other occassions but I do have my rules.

I won’t go on about economic arrangements and all the ins and outs of this but the formal versus informal labour as well as who and who isn’t remunerated and how is a discussion. There are security contexts for this whether of a technical and linear nature but also direct and indirect security issues as per the EPF (European Parliamentary Forum) report I mentioned. Teh wOMeN’z iSSuEs don’t normally feature in teeth gritting gravel voiced duck and roll lock and load Go! Go! Go! discussions about security but they do relate to power structures and attitudes and who makes bank on or off the books.

https://www.epfweb.org/node/610
Modern-day Crusaders in Europe.
Publication type: Intelligence Brief | Post date: 24/06/2020

Continuing my European theme the Australian Terry of “Terry Talks Movies” fame has a good retrospective of the Eurospy genre. I really like Terry and his shows on movies. They’re more intelligent and agreeable to my tastes than what passes for modern mass media review shows. I was reminded of Eurospy when watching an after show post-mortem of The Blacklist by “Matt and Jess” who mentioned The Bureau (original title: Le Bureau des Légendes) a French political thriller television series which revolving around the lives of agents of the DGSE (General Directorate of External Security). According to Terry, interestingly, Eurospy pre-dates the James Bond films, Fleming novels, and even the birth of Sean Connery! I don’t know if I can watch half the Eurospy movies. The sexism back then then would make your hair curl. But the styles are nice. Much better than modern high street one size fits all bland.

Eurospy: The Forgotten Movie Genre.
https://www.youtube.com/watch?v=yksnGrTGkbg

ThanksToGoogle • May 29, 2021 7:53 PM

(This is BTW how you can both claim that “we added privacy controls” and at the same time minimize their use.)

Google reportedly made it difficult for smartphone users to find privacy settings

https://www.msn.com/en-us/news/technology/google-reportedly-made-it-difficult-for-smartphone-users-to-find-privacy-settings/ar-AAKw2W1

Unredacted documents in Arizona’s lawsuit against Google show that company executives and engineers were aware that the search giant had made it hard for smartphone users to keep location information private, Insider reported.

The documents suggest that Google collected location data even after users had turned off location sharing…

Curious • May 30, 2021 4:52 AM

Re. Apple M1 flaw article.

The article I saw about it:
https://www.tomshardware.com/uk/news/m1racles-covert-channel-vulnerability-apple-m1-chip

I couldn’t help but wonder, that that you might want as a bad guy from an idea of there being this plausible flaw on a system, is to have a goal of being able to construe a opportunity for claiming some kind of plausible deniability, and even hiding the existence of other methods that maybe are used to compromise the privacy of someone, or somebody’s data/information on a computer/comms system, or someones backup or someones key management setup for a client.

Imo, the way Apple’s legal representative acted in US congress in relation to a hearing about accessing one particular iPhone (I think it was), laying themselves so to speak flat on the back, and apparently insisting on helping congress in a seperate session and presumably off the record, doesn’t make me want to trust Apple in the first place as a company.

Curious • May 30, 2021 6:02 AM

@Vas Pup

Somehow, I find a storage site in Turkey for nuclear weapons to be implausible. Just sounds off to me, but ofc, I am no expert.

I’ve always wondered if, Israel (nearby Turkey), presumably denying having nuclear weapons, if not fielding their own nuclear weapons, maybe they could be either, leasing, or storing their stuff in places noone would expect, like, a US base in Turkey, but this is ofc just crazy speculation based on ignorance on my part.

I vaguely remember an idea someone had for oil tankers. I think it was, once the oil had left port, if simply exchanging ownership papers, I think the general idea was that oil could be transferred elsewhere as swiftly as signing with the stoke of a pen, moving the oil elsewhere and other than some expected destination. Presumably there is no oil inspection police having as some kind of rigorous oversight task, and I guess also none for nuclear weapons.

Figurative Leaf • May 30, 2021 7:54 AM

@Phallus,

You’re right of course about 21st century experts, I’m sure I classify as one of them, but to reinforce your point about the known unknown of our current state of COVID vs immunological response and vaccines…

https://www.ft.com/content/f76eb802-ec05-4461-9956-b250115d0577

“Scientists claim to have solved Covid vaccine blood-clot puzzle”

There’s also lots of unknowns about cross reactive antibodies labeled ‘pre-pandemic’, in some cases I don’t think we have a known ‘in the wild’ causative agent.

Likely, in my book: the safest thing may be to just keep wearing masks as a personal choice for the meantime.

@all,

I like the love sharing, but who did you guys piss off? This is way past break-in period for some misadventure in guerilla advertising.

Clive Robinson • May 30, 2021 7:59 AM

@ Curious, vas pup,

I’ve always wondered if, Israel (nearby Turkey), presumably denying having nuclear weapons, if not fielding their own nuclear weapons, maybe they could be either, leasing, or storing

Of course Israel has nuclear weapons, any doubt about that was removed decades ago.

The reason the Israeli govrnment lies about it is due to US legislation…

Basically Israel only survives in it’s current state with the assistance of a very large amount of US Resources that Republican politicians do just about every thing they can to ensure that the Israeli Government gets the US resources.

If Israel admitted to the nukes or the politicians stopped looking in the other direction over the evidence then under US legislation those resources would have to stop.

There is no way that variois US Entities want that to happen, as they actively want Israel to carry on with it’s behaviours in the Middle East as they serve the US interests especially those of some in the State Dept very very well on the “divide and conquer” principle.

So the fact that Israel has nukes is very usefull to US Policy, but also Israel denying them despite the evidence is very usefull to US Policy.

Look at it this way without the US Resources, then Israel would not be able to maintain it’s current policy towards the rest of the Middle East, thus would have to come to some sort of peace agreement, which the US State Dept and other US Entities realy realy do not want.

People are asking questions about the rockets and Iron Dome that are curently in the news… One question is,

“Why did those firing their rockets at Israel offer a cease fire, just as Israel’s Iron Dome was about to run out of it’s missiles?”

The answer is simple it’s actually economic warfare.

The rockets being mass produced are very very cheap and in most cases don’t even have war heads, they are also aimed to cause minimal damage if they do get through Israel’s Iron Dome. The reason is that as long as they fire rockets but the citizens of Israel which includes, Arabs, jews and others, as well as those of Christian, Jewish, Muslim, and other faiths remain unharmed then world opinion tends to be against the Israeli Government and IDF.

So they fire rockets that cost next to nothing but those missiles in the Iron Dome are expensive, very expensive in comparison, and often several get fired for each rocket they launch towards Israel.

Lets just say Israel are reliant on others for their Iron Dome missiles and the financial cost is wracking up faster than the Israeli economy can support. Thus the pain of the Iron Dome is being transfered back to others, which has knock on effects including on US Fiscal policy…

What some Republican politicians call “idiot rag heads” or worse, are running circles around the IDF, Israeli Govetnment Policy and US Government Policy.

It’s a war of attrition that neither the Israeli or US Governments can win without stepping up the murder etc of innocents in the areas around Israel and pilitically they realy do not want to go there…

As I’ve pointed out in the past, if your opponent has nothing to loose by fighting even if hopelessly incapable of winning an open war, they will still fight and if they can gain an advantage in the eyes of the world, then they will fight in any way that gives them that.

So the, Israeli Government whilst apparently winning skirmishes is actually loosing the war. It appears that many of the Israeli citizens are aware of this which kind of accounts for why the Israeli Premier is running around holding his ass, desperate to avoid what is likely to happen to him if he looses power.

Winter • May 30, 2021 9:25 AM

@Figurative L
“I like the love sharing, but who did you guys piss off? ”

Nothing sure, but the best guesses are a narcissistic person residing in time zone GMT+3 (St Petersburg). The aim is discrediting Bruce/this blog by posting content that lowers search rankings and give visitors the impression this is a source of disinformation.
The person displays poor impulse control and poor operations organization.

JonKnowsNothing • May 30, 2021 11:05 AM

@Clive @All

MSM report about using Deep Fake AI tech to alter maps. The report details the use of several AI programs to create a hybrid map using features of different cities to produce a map that appears legitimate but is not.

A couple of items to consider:

  • Altered documents and outright forgeries.
  • Altered maps used by millions in their phones and cars.
  • People who no longer know how to read a paper map.
  • Aviation maps
  • Military maps
  • Computer Assisted Navigation
  • Autonomous Navigating Systems

A good number of existing systems already have fakes and forgeries (WMD in the Desert(1) ) that were prepared and altered to achieve a specific purpose.

These are tech based maps and can be downloaded or side loaded or dropped by malware payload.

===

ht tps://arstechnica.com/gadgets/2021/05/deepfake-maps-could-really-mess-with-your-sense-of-the-world/

“I absolutely think this is a big problem that may not impact the average citizen tomorrow but will play a much larger role behind the scenes in the next decade,” says Grant McKenzie, an assistant professor of spatial data science at McGill University in Canada ”
….
“Imagine a world where a state government, or other actor, can realistically manipulate images to show either nothing there or a different layout,” McKenzie says. “I am not entirely sure what can be done to stop it at this point.”
…
It may be just a matter of time before far more sophisticated “deepfake” satellite images are used to, for instance, hide weapons installations or wrongly justify military action.

1, Image:
ht tps://upload.wikimedia.org/wikipedia/commons/7/71/Powell_UN_Iraq_presentation%2C_alleged_Mobile_Production_Facilities.jpg

Computer-generated image of an alleged mobile production facility for biological weapons, presented by Powell at the UN Security Council. On May 27, 2003, US and UK experts examined the trailers and declared they had nothing to do with biological weapons.

Colin Powell’s UN presentation slide showing alleged mobile production facility for biological weapons. (Subequently shown to be an incorrect allegation.)

Speech title: Remarks to the United Nations Security Council, Secretary Colin L. Powell, February 5, 2003
Slide title: detail of where material is carried in mobile production facilities for bio weapons work

(url fractured to prevent autorun)

echo • May 30, 2021 12:11 PM

@Winter

The West Bank was not part of Israel, but was later conquered. The people living there were not even part in the original deal that made Israel.

I wish people listened to what I said the first time. The final borders were undefined (and remain undefined apart from the southern border which was agreed after Egypt decided to stop being silly).

The initial Jewish settling was only provisional not fixed limits. The occupied territories are not disallowed by the original agreement. In theory Israel could have grabbed more up to the limits of the original British occupied territory. It naturally follows questions about what is or is not a viable state are discussed as well as relations with surrounding states so that state is a viable proposition.

As an ex coder self taught in philosophy I have a fair idea of rules and sets on top of having a fair idea about politics and all the other ins and outs of it.

I really do hate repeating myself so I’m not going to clarify further. If someone else has a magic bullet solution where everyone comes to the table and signs off and lives happily ever after be my guest but at some point people have to make a decision and life is short. I’m not a person who likes being sucked into an argument or whataboutary at the best of times.

Anders • May 30, 2021 3:42 PM

@ALL

hxxps://www.npr.org/2021/05/28/1001237516/what-we-know-about-the-apparent-russian-hack-exploiting-a-u-s-aid-agency?t=1622322460583&t=1622407128500

(Yes, there’s again that !”#¤% cookie-trap with javascript-only passthrough, but it’s worth reading.)

“The same Russian hackers who carried out the SolarWinds attack and other malicious campaigns have now attacked groups involved in international development, human rights and other issues, according to Microsoft. The company said the breach began with a takeover of an email marketing account used by the U.S. Agency for International Development.

Hackers sent malicious emails from the agency’s account. Screenshots show the note purports to be a special alert, highlighting the message, “Donald Trump has published new documents on election fraud.””

Hobby • May 30, 2021 4:08 PM

@echo

I enjoyed Le Bureau, not least for it sharpening up my colloquial French.

But I did find the notion of active field agents wandering in and out of the DGSE building quite ridiculous.

I sincerely doubt real operators ever go near an organisation’s known locations, let alone use the front door… And don’t get me started on the silly parking garage malarkey!!

vas pup • May 30, 2021 4:23 PM

Artificial neurons recognize biosignals in real time

https://www.sciencedaily.com/releases/2021/05/210527112501.htm

“Researchers have developed a compact, energy-efficient device made from artificial neurons that is capable of decoding brainwaves. The chip uses data recorded from the brainwaves of epilepsy patients to identify which regions of the brain cause epileptic seizures. This opens up new perspectives for treatment.”

Current neural network algorithms produce impressive results that help solve an incredible number of problems. However, the electronic devices used to run these algorithms still require too much processing power. These artificial intelligence (AI) systems simply cannot compete with an actual brain when it comes to processing sensory information or interactions with the environment in real time.

Neuromorphic engineering is a promising new approach that bridges the gap between artificial and natural intelligence. An interdisciplinary research team at the University of Zurich, the ETH Zurich, and the UniversityHospital Zurich has used this approach to develop a chip based on neuromorphic technology that reliably and accurately recognizes complex biosignals. The scientists were able to use this technology to successfully detect previously recorded high-frequency oscillations (HFOs). These specific waves, measured using an intracranial electroencephalogram (iEEG), have proven to be promising biomarkers for identifying the brain tissue that causes epileptic seizures.”

Read the whole article for more details.
I hope Elon Musk folks (Neurolink)is reading this respectful blog as well.

Mr. Peed Off • May 30, 2021 5:07 PM

“Amazon is designating many of its existing Echo and Ring gadgets (and presumably the majority of its new devices from here on out) as Sidewalk bridges. That means that they’re equipped to siphon off a tiny amount of your home’s Wi-Fi bandwidth and then use it to relay signals to Sidewalk-compatible devices using BLE and 900MHz LoRa signals. Those kinds of low-energy signals can’t carry much data at all, but they can travel great distances.

Amazon claims that the 900MHz band, which is the same band used for amateur UHF radio broadcasts, allows for range of up to half a mile. So, if you have an Echo speaker or a Ring camera in your home that works as a Sidewalk bridge, you’ll be able to send wireless signals to Sidewalk-compatible devices across a huge area. And, if you had a Sidewalk-enabled device like a Tile tracker paired with your Sidewalk bridge, you’d be able to connect with it so long as it was within half a mile of anyone else’s Sidewalk bridge.

With Amazon Sidewalk, data travels from the device to the application server and back by way of the Sidewalk bridge (or gateway) and Amazon’s Sidewalk Network Server.”

https://canadanewsmedia.ca/amazon-sidewalk-is-coming-to-your-neighborhood-heres-what-you-should-know-cnet/

https://arstechnica.com/gadgets/2021/05/amazon-devices-will-soon-automatically-share-your-internet-with-neighbors/

Curious • May 30, 2021 5:50 PM

Re. Denmark and US’ NSA’ X-Keyscore related news from last year:

Today there are some more news in local media about the cooperation between various news organizations in various countries, that, well, seem to claim that Denmark spied on Swedish some politicians and industry on behalf of USA, or let USA do it, claimed by sources.

The end of the first article mentions something called “Operation Dunhammer”. The name is apparently a project name for a work by Danish oversight organization as I understand it, for investigating internal Danish concerns about espionage/surveillance claims between USA and Denmark and others (2014-2015?), and somehow, Danish news learned of this in 2020.

https://www.svt.se/nyheter/inrikes/usa-har-spionerat-pa-svenska-politiker-med-hjalp-av-danmark (article in Swedish)

https://www.svt.se/nyheter/inrikes/peter-hultqvist-om-spionageavslojandet (article & video in Swedish)

I guess more might be told later, possibly, but there is a brief video clip (2 min) of the Swedish “minister of defence” who in a interview with Swedish television, gives off some boiler plate like responses I think. As if this was his moment to shine, saying just enough to make the statements categorically true (as a kind of pretence for making good sense).

I presently do not know how long the interview with the Swedish minister of defence lasted, but I couldn’t help but wonder if Swedish news channel SVT skipped the all obvious question which I guess might very well be hidden by their editorial take of things, in having set an agenda or a particularly framed news story per se, thus having angled the story to be about possible espionage against politicians (which I guess they can either deny, or claim that they are sorry), when what I like to know is if * I * even risk being put under some kind of investigation or surveillance, or otherwise attracting attention of say US government as a civilian.

If * I * living where I live outside USA risk being investigated for just being on the internet like everybody else, that is just wrong (and also very threatening I will argue).

So I am a European, and I used to be fairly pro USA as a kid not knowing any better, but then the Iraq invasion happened, and as an adult I have since then grown to have a very negative view of USA as a country, ofc, nothing to do with people in general in USA.

What happens next? Well, reading the news, a norwegian politician of the current government (minister of defence) seem to opine that there ought to be no open control about this. Basically, it seems the argument is: It would be contradictory to have open control of a secret service. This way, as if framing an issue of accountability as if requesting a ‘privilege’ of control wrestled from the military, but this attitude seems to hide a real privilege of the military really having full and total control of intelligence work. I would argue that any rationale for ‘absolute secrecy’ would have to be a fallacy, because of how it implies ‘absolute control’, which by itself would then unavoidable and thus an imbalance of power between military and civilian authority. One might as well expect the military to lie in that case, as if you were told “ofc, we reserve the right to decide what is necessary for you to know, knowing we actually are expected to do so”. So I think this idea of ‘control’ of military intelligence being ‘contradictory’ seems like obviously wrong, when one could imagine soliciting the military for concrete information that would be useful for clearing up controversial issues, and then the military can’t really be expected to lie about their answers if the military also are to believe themselves to be a part of society. There really has to be a resolve of the notion of military being sovereign or not, in a society with civilians rule, otherwise you might as well conclude that society is under military rule which would sound really bad for obvious reasons, as if the country is literally run by military law or worse a corrupted culture where the prospect of a military junta is right around the corner. He claims that an oversight organization has all the ‘necessary’ information, yet it isn’t described as ‘access’, but more like some kind of tautological idea of ‘having’ something, though ending up sort ofhiding the ‘having’ aspect which is ironic when it would mean ‘not having’, thus sort of eliminating the very notion of anybody non-military every ‘needing’ anything. Seems like bullshit to me, and the worst part would be to simply believe this, because then, what could you even care about if you believe you are not in the right to know certain things.

I guess, things are better in USA, or, maybe the worst still is ending up with someone who represents the military interests that doesn’t wittingly answer truthfully.

echo • May 30, 2021 6:06 PM

These items involving international diplomacy and de-escalation tease a few perspectives. Dirty tricks and blackmail and people beig used as pawn and bribary have an unedifying role to play. There’s lots of layers to this.

https://www.spiegel.de/international/world/former-afghanistan-president-hamid-karzai-we-afghans-are-just-being-used-against-each-other-a-81412b96-c7e5-4287-b423-fbc2b600f317

“We Afghans Are Just Being Used Against Each Other”.
Former Afghanistan President Hamid Karzai, 63, on his empathy for the Taliban, his bitter disappointment with the former protective power, the United States, and why he considers the EU as his role model. He says the key to war and peace for his country, however, lies with Pakistan.

https://www.youtube.com/watch?v=8d3Lyk_vlW4
Dollars VS Decency: Is China taking over New Zealand? | 60 Minutes Australia

ADFGVX • May 30, 2021 7:45 PM

@ Curious

US’ NSA’ X-Keyscore

How does that work now? Is it a terrorist threat risk assessment on every U.S. person of interest?

Sort of like a Fair Isaac // FICO® score, but you know you will never get a bank loan for anything in this life with an X-Keyscore file at the NSA — you should count yourself lucky you’re not in prison, and don’t even think about possessing or carrying firearms — because then you’re a flat-out terrorist, and if your X-Keyscore is bad enough, they are authorized to issue Military orders for a drone strike to take you out.

fear and loathing • May 30, 2021 9:09 PM

So drones are not only in charge of take out but taking out?

I saw a video of a drone taking a dog out (for a walk) in cyprus.

What happens when there’s a drone strike?

Do they just walk out, or is it a sit down strike Boston Dynamics style?

Maybe I’ll ask the Koch Brothers Disruptive Technologies about what their plans for Perceptco.

I never thought I would be praying for a drone strike but after Armenia… It may actually do us some good

lurker • May 31, 2021 12:04 AM

@echo: Dollars VS Decency

Takeaway quote from Malcolm Davis, Australia Strategic Policy Institute:

“I think all roads do lead to China.”

Winter • May 31, 2021 1:45 AM

Will we learn form our mistakes? Unlikely.

But here is the report on what went all wrong (everything?)

In May 2021, the Independent Panel presented its findings and recommendations for action to curb the COVID-19 pandemic and to ensure that any future infectious disease outbreak does not become another catastrophic pandemic.

COVID-19: Make it the Last Pandemic
A Summary

COVID-19 remains a global disaster. Worse, it was a preventable disaster. That is why the recommendations of the Independent Panel for Pandemic Preparedness and Response are urgent and vital. The world needs a new international system for pandemic preparedness and response, and it needs one fast, to stop future infectious disease outbreaks from becoming catastrophic pandemics.

The full report (URL fractured for your protection):
ht tps://theindependentpanel.org/mainreport/

The initial outbreak became a pandemic as a result of gaps and failings at every critical juncture of preparedness for, and response to, COVID-19:

  • Years of warnings of an inevitable pandemic threat were not acted on and there was inadequate funding and stress testing of preparedness,despite the increasing rate at which zoonotic diseases are emerging.
  • Clinicians in Wuhan, China, were quick to spot unusual clusters of pneumonia of unknown origin in late December 2019. The formal notification and emergency declaration procedures under the International Health Regulations, however, were much too slow to generate the rapid and precautionary response required to counter a fast-moving new respiratory pathogen. Valuable time was lost.
  • Then, for the month following the declaration of the Public Health Emergency of International Concern (PHEIC) on 30 January 2020, too many countries took a ‘wait and see’ approach rather than enacting an aggressive containment strategy that could have forestalled the global pandemic. As COVID-19 spread into more countries, neither national nor international systems managed to meet the initial and urgent demands for supplies. Countries with delayed responses were also characterized by a lack of coordination, inconsistent or non-existent strategies, and the devaluing of science in guiding decision-making.
  • Coordinated, global leadership was absent. Global tensions undermined multilateral institutions and cooperative action.

    • Preparedness was under-funded and response funding was too slow. Dedicated financing at the scale required was not available to supply medical equipment, kick-start the search for diagnostics and therapeutics, or ensure vaccines would be available to all. International financing was too little, too late.

  • WHO staff worked extremely hard to provide advice and guidance, and support to countries, but Member States had underpowered the agency to do the job demanded of it.
    The lack of planning and gaps in social protection have resulted in the pandemic widening inequalities with a disproportionate socio-economic impact on women and vulnerable and marginalized populations, including migrants and workers in the informal sector. Health impacts have been compounded for people with underlying health conditions. Education for millions of the most disadvantaged children has been terminated early by the pandemic

Mellowin • May 31, 2021 3:08 AM

Conservative fishermen still consider an underwater camera absolutely useless bells and whistles that take away the thrill of fishing. However, while they are analyzing lines and arcs on their fishfinders, those who already have a camera are playing out big trophies and filming incredible videos.

- • May 31, 2021 4:35 AM

@Moderator:

Check the email fields.

@ALL:

It appears,the Troll-Tools have changed tactics.

1, Winter #comment-380351

Has a time stamp that suggests,it is part of the following stream of created nonsense, and not from Winter.

The goes onto the comment before this one.

2, Mellowin #comment-380376

Appears to be a fake attempt at unsolicited advertising and unrelated to Security on any way. So either way is against the blog rules.

Thus may be yet a new attempt by the Troll-Tools to try to make @Moderator job harder, or get bits of their nonsense to persist for longer.

The fact it has been posted on a ‘National Holiday’ morning is sugestive.

https://en.as.com/en/2021/05/27/latest_news/1622067215_188624.html

For those who it is a National Holiday today, hopefully things will pass pleasantly.

Winter • May 31, 2021 4:55 AM

@-
“1, Winter #comment-380351

Has a time stamp that suggests,it is part of the following stream of created nonsense, and not from Winter.”

That was an accident. I seem to be here during the working hours of the Troll tool.

But you can see for yourself. The report mentioned in the comment says nothing new for whom has read the comments of Clive et al about the botched (political) response to the COVID-19 pandemic. If anything, the report is even more damning.

As always, please judge my comments by their content, not by their handle.

Winter • May 31, 2021 6:39 AM

@-
“Where is the issue?”

Just stylistics. But also the data on blood clot instances do not seem right:

ht tps://www.bmj.com/content/373/bmj.n1005.full
(URL fractured for your security)

JonKnowsNothing • May 31, 2021 7:25 AM

@All

Several MSM reports about Denmark spying on EU for the NSA or allowing the NSA to use their military intelligence. Mostly against Germany.

I do not think this is New News. There were reports during the Snowden Releases that this was happening by Danish News. This was in addition to the NSA bugging of Merkel’s Handy (cellphone) while she talked with her Mum.

It may be New News to some now in power who were not old enough at the time to read the news and were still watching their localized version of Sesame Street.

@All @Moderator

Not new news but the attacks on the blog are concerning. Regardless of the sources it may be prudent for me to shift down some. As is I cannot follow topics, posts or information which is of course the goal of the interruptions. However this only works if you play in the same space. It’s time for some negative space.

This happens in Video Games too. Recently I was considering a new game and after checking it out, found there are a lot of Twitchers Streaming the game. This opens up a whole can of peas: privacy, monetizing, copyright, TOS etc. My game play would earn someone else money, I had no option but to allow it (no opt out), I would not gain anything or control the commentary (think what’s happening here but on Live Stream (1) ). It’s common now in most games.

Some game systems are setup up in a way that minimizes this sort of thing, but that was serendipity not by direct design. Other games are deliberately setting up their systems to allow more of it with even fewer opt out options.

The only way to win is: Not to Play.

===

ht tps://www.theguardian.com/world/2021/may/31/denmark-helped-us-spy-on-angela-merkel-and-european-allies-report

Denmark’s military intelligence agency helped the US to spy on leading European politicians including the German chancellor, Angela Merkel, according to the Danish public broadcaster and other European media.

Danmarks Radio said the US National Security Agency (NSA), whose alleged tapping of Merkel’s phone was disclosed by Edward Snowden in 2013, also used the Danish Defence Intelligence Service (FE) to spy on officials in Sweden, Norway and France.

The allegations are contained in an internal classified report on the FE’s role in the surveillance partnership agreement with the NSA from 2012 to 2014, the broadcaster said, citing nine unidentified sources familiar with the investigation.

It said the NSA used Danish information cables to spy on senior officials including the former German foreign minister, Frank-Walter Steinmeier, and the then opposition leader Peer Steinbrück. It was not clear whether the Danish government authorised the taps.

The Danish defence minister, Trine Bramsen, who took over the defence portfolio in June 2019, was reportedly informed of the espionage in August last year. She told Danmarks Radio that “systematic eavesdropping of close allies” was “clearly unacceptable”.

France’s Europe minister, Clément Beaune, said the reports were “extremely serious” if proven. “We need to see if our partners in the EU, the Danes, have committed errors in their cooperation with American services,” Beaune told French radio. “Between allies, there must be trust, a minimal cooperation.”

1, Game harassment

ht tps://en.wikipedia.org/wiki/Swatting

  • this is fairly common, criminal action that happens to Live Streamers. Nothing like having the Cannon Brigade showing up behind you armed, loaded and locked on, while you are in a light saber duel with Darth Vader.

(url fractured to prevent autorun)

Eva • May 31, 2021 7:48 AM

They are so cute!! And deep-sea cameras filmed the attack of a giant squid on an artificial jellyfish

A team of biologists captured deep-sea squid in the Greater Caribbean using a low-light camera system with bait that mimics the bioluminescence of a jellyfish. The researchers met three individuals of giant clams at depths of 557 to 950 meters.

Clive Robinson • May 31, 2021 7:53 AM

@ Winter, Moderator, ALL,

The above at May 31, 2021 7:10 AM is suspect for a number of reasons.

First off, the idiolect[1] is wrong.

Secondly, compare it to the preceading two messages and their three minute time interval time stamps.

Thirdly, you will note in the 7:07 AM message the use of three words that @Winter has not used before,

1, Woke
2, larp
3, permabanned

The only posting recently that has contained “woke” is one claiming to be from @echo making a series of threats…

There are other “tells” that I am not going to mention, as there are a number of imperfect fakes of posters going up. That is there has been a two to three week learning curve for the poster of the imperfect fakes. Which was clear to any with colour vision when they tried to impersonate @Moderator.

But they keep making silly mistakes look at the 7:06 AM posting, it’s got one or two amusing mistakes in it.

It was the real @Winter that suggested using the email address field like low grade “autheticator” in that whilst the @Moderator, @Bruce, and I assume the hosting service SysAdmin’s do have access a low grade “Troll” not even of “script kiddy” ability will not.

[1] The word “idiolect” is not often used outside of certain knowledge domains one of which is the form of clinical psychology used in the forensics of documents and similar “words of record”.

A persons “idiolect” is distinctive and usually unique to an individual and their use of language. It encompasses an individual’s usage of spelling, punctuation, vocabulary, grammar, and when including the spoken word their pronunciation.

Whilst an individuals idiolect is in the full variety of language unique to the individual, it is based on groups that have influanced the individual. That is whilst the idiolect differs from a group or regional dialect, it does contain a common set of linguistic characteristics shared among the groups of influance. This enables the individual to be in effect traced back through their influancers.

One use of idiolect analysis in clinical psychology and psychiatry is to spot people with distinct states that they switch between and to discover the effects that a physical insult to the individuals brain may have had.

Curiously Curious • May 31, 2021 8:24 AM

First off, the idiolect[1] is wrong.

Have a lot of fun with that one, you are not even scratching at the topmost surface layer there.

You have really no clue how far obfuscation techniques have evolved during the past decade.

Anything you might find is intentional or a product of intended “coincidences”.

May you enjoy a nice mid-morning, to the honorable gentleman.

Winter • May 31, 2021 8:39 AM

@-
“The heat you give them is only increasing their rage, the carnage of which then awaits the moderator. Not fun if you ask me.”

That is indeed a dilemma. Is it better to mark inappropriate comments to help other readers and the Moderator, but attracting the ire of the troll, or leave the inappropriate comments alone and sucking in unsuspecting readers into unhealthy discussions and maybe giving the blog a bad name?

My choice is based on what the Troll-tool would want. And it is clear it does not like my actions. Also, the bad impulse control and retaliations of the Troll-tool make it extremely obvious to everyone that the comments were indeed bad-faith Troll-tool productions.

So, then the question becomes, what is worse, a readable comment section with hidden poison, or an unreadable comment section with clearly marked poison?

However, if the Moderator or Bruce tell me to stop, I will obviously do so.

Winter • May 31, 2021 8:45 AM

@Nick P
“How exactly and why do you expect us to believe you?”

I don’t. Just as I do not believe your are Nick P.

But this was posted for the Moderator.

echo • May 31, 2021 9:58 AM

If this was my site I would get this space defined as critical infrastructure (and there are criteria which may make this possible) and call the National Crime Agency. They’d probably laugh but if it happened to a high profile person they would shift their asses.

Maybe someone will start treating my verification and trust scheme seriously rather than sneering at it.

As for the UK there is some really serious stuff happening at the moment which is pushing the UK in the direction of Poland and Hungary. The UK government has launched an outright assault on one major human rights organisation. Loads of people saw it coming and warned about it and none of what is happening around this area is a coincidence. It is deliberate. This is a major in the clear shift to align with the far right.

Clive Robinson • May 31, 2021 11:22 AM

@ echo,

Maybe someone will start treating my verification and trust scheme seriously rather than sneering at it.

It is deficient in anonymity and would make it’s database a toxic liability to the site host.

Things that would be easy to fix but for some reason you want to get sniffy and accusatory without reason.

You feel free to accuse others of gaslighting, piledriving and sneering. Not exactly reasoned argument is it?

Mistakes in security systems are known to be not just harmful but sometimes fatal (CIA system that went bad and Iranian and Chinese lives were lost).

Poorly designed or poorly implimented systems suffer from bit-rot and thus become unstable. So do systems with unneeded attributes and complexities. Unstable systems have a habit of blowing up in peoples faces and the fall out can be quite extensive.

These are the subjects this blog deals with as and when they come up, thus pointing out a technical deficiency in somebodies design is to be expected as par for the course.

Think about taking out the need for “real ID” and the main issues of lack of anonymity and toxic data effectively go away. You get a simpler system that requires less complexity and less security which would be other pluss points.

Otherwise defend your requirment for “real ID” and the costs required.

echo • May 31, 2021 12:03 PM

@Clive

Oh do stroll on. Not in the mood for it today or giving your gold plated avoidant waffle a second of attention.

Funily enough you were the complete opposite with you ten layer deep super technical system when you were obsessing getting a key or data over a border. I’m like too complicated there’s a simpler easier way and you snottily defended your scheme. As it turns out the scheme I was thinking of featured in a docu-movie of a famously outed operative I watched some months later. I wonder if anyone can guess which movie.

Then there’s your claims about not being able to write a key on a Rizla paper. It’s been a while so I forget how many bits of data I could store on one now but I took this seriously. Using no equipment other than an HB pencil and storing bits as characters using hexadecimal as a form of compression I hand wrote however many it was now. I emperically proved I could store 100-200 or 400 or whatever it was on one single Rizla paper and hadn’t even used the other side. Oh, the denials from you Clive and people believing I used special equipment when I had made no mention I had. No. Just my eyeballs and an ordinary HB pencil and a desk to write on. So not only was the challenge possible but exceeded and also possible in the field.

And that’s just a couple of reasons why I stoppped listening to your “certified professional” schtick and tub thumping gravel voiced technobabble when you think you’re right.

While I’m here I will nitpick a slip you made nobody picked up on. Rocket stoves are not effecient. You’re confusing them with stoves with a secondary burn which burns the excess gases. A rocket stove does not do this. This was an easily understandable mental slip but if you’re going to get crusty I’m going to start bringing up every hairsplitting nitpick.

Anyway, you’ll have to excuse me as I’m off to the shop and need to put a face of slap on as appearances must be maintained.

echo • June 1, 2021 1:27 PM

https://www.theregister.com/2021/06/01/autos_and_the_worlds_semiconductor_supplies/

“Supply chains are different for consumer electronics versus autos,” analyst firm Gartner’s Ben Lee, told The Register.

Lee explained further:

For PC and smartphones, tech evolution matters. Those manufacturers care more about performance and less about price. They need high performance to compete with others. The lifetime of a product is also shorter, two years to replace a smartphone and three years to replace a PC.

It matters less for autos, they can handle slightly outdated tech. They care more about the security of the computer and less about the state of tech revolution. Tesla’s success has changed this a bit, but tech lags for automotive in general.

Madness.

echo • June 1, 2021 4:16 PM

https://www.wired.com/story/new-to-vinyl-records-shopping-what-you-need-to-know/

******* is a digital hub for all things vinyl. It’s a marketplace, social media site, and encyclopedia for records and other physical media formats. The most useful thing about ******* is that you can keep track of your collection, and its database is extremely complete, down to various pressings and releases of the same record. The site also gives you estimates on the value of your collection as it grows and as pressings become rare.

As a marketplace, your best hack is to see what record stores in your area post their inventory to Discogs … and then call them directly to purchase over the phone. If you’re local, you can avoid shipping fees and possibly even get a discount! Some places increase the price of records on ******* to compensate for seller fees and shipping.

Not even analogue is safe from someone trying to tie you to the cloud or part you from more money. I kknow it makes financial sense to some people but what about exercise and mental health and socialising with other people? What about the fabric and texture of society and reinvigorating the high street? I’d like to think this is the first thing someone buying vinyl for the first time would be thinking about.

In Germany I think the word “free” is banned. It’s something Amazon is in hot water with legal challenge in the US due to its Prime service and allegations of disguising monopolistic ambitions?

There’s lots of security issues buried in this infomercial from your personal space being abused by publishers, your brain being hacked by marketers, different legal standards, and use of secrecy.

Moving on and thinking about UK media I read today of one odious rag, The Telegraph, printing a story which was highly partisan and based on an obvious and easily provable lie at its core. This isn’t journalism nor does it even meet the standards of advertising so I’m curious how they can get away with it at a regulatory and tax advantage level. And it’s not a one off either nor is the Telegraph the only one pulling this stunt.

https://www.theguardian.com/australia-news/2021/jun/02/how-the-good-war-went-bad-elite-soldiers-from-australia-uk-and-us-face-a-reckoning

But there was institutional failing too, he says. “People knew laws were being broken, people understood the modus operandi of the night raids. But every time an operator reported back from these raids and didn’t find themselves in front of a tribunal that just further convinced them they were doing the right thing, that the laws didn’t apply to them.” The practical culture of special forces operations – small autonomous teams of four to six highly trained troops conducting secretive raids seeking insurgents – contributed to a sense of secrecy, impunity and unaccountability. […] Some special forces soldiers sent repeatedly to the very apex of the fighting grew disconnected from the rest of their militaries, and from moral and legal codes they had grown up with and in which they had been trained. […] “It is the difference between a warrior culture and a professional culture: the profession of arms. One says, ‘Our job is to kill enemies,’ the other, as a professional military officer, believes, ‘Our job is to control violence to a strategic end.’ “Much more deeply, there is a culture of impunity, particularly at the higher end of these militaries, that the laws that apply to other soldiers don’t apply to special forces – that they are somehow special, somehow above the law. The laws of war don’t work that way.” […] Ledwidge argues that two lines of argument are often prosecuted in explaining, if not defending, the commission of war crimes. The first argues civilians can never understand the pressures and exigencies of war. “This is entirely specious,” Ledwidge says. “The overwhelming majority of … soldiers manage to fight professionally without giving in to the temptation to shoot prisoners, slit the throats of unarmed boys, or casually kill farm workers, all of which are alleged in the Brereton report. Brereton is very specific and clear: none of these crimes were committed in the heat of battle. Murders took place after raids or shootouts. The victims were all unarmed.” The second argument is that such brutalities are a necessary fact of winning war, a point, Ledwidge says, that “rather misses the reality” that the US and its allies were defeated. “One reason for this was that the central narrative of the overall Nato mission – ‘We’re here to protect you’ – was rather undermined by armed men smashing their way into people’s houses and slaughtering the innocent.” […] Ben Saul, Challis chair of international law at the University of Sydney, says: “The report is complex, but to simplify, there are three key factors which drive compliance with international humanitarian law. “One, training: good, repetitive training, of what is expected of soldiers on the battlefield. “Two, strong leadership and command: commanders following the rules, and instilling in those they command that they have to follow rules. “Three, the threat of credible sanctions – and this is a factor that even influences non-state armed groups, terror groups, rebel groups – if there are sanctions, not just on paper, but real sanctions that lead to convictions.” Saul argues there are drivers, too, of non-compliance with international humanitarian law. Moral disengagement emerges from combatants finding justifications for violations, and from a dehumanisation of the enemy. “There is a lot of dehumanisation that goes on in war, regarding the enemy as inferior or subhuman. It’s a moral distancing that treats them as undeserving of the respect of the law.” […] “Ultimately there is an important difference between pulling a trigger and getting it wrong, and taking a prisoner and executing them in cold blood. Anyone who does not recognise this distinction, or is prepared to ignore it, does not deserve to belong in any professional military.”

https://www.theguardian.com/fashion/2021/jun/01/my-hairline-threatened-my-identity-so-much-the-ground-felt-shaky-why-hair-transplants-are-booming

Williams, the president of Bahrs, says standards are so low that many surgeons don’t know what a good transplant should look like. “Some men are just happy to have a few hairs back, but a great transplant today is something even your hairdresser won’t know about,” he says. A bad transplant can leave moved hairs unnaturally spaced or growing in strange directions. Donor regions at the back of the head can be left with noticeably sparse coverage. Hamish’s own transplant journey is not yet over. When he made his decision, he considered jumping on a plane to Turkey. He says it’s easy to seek a quick fix when you’re vulnerable. But something told him to hit pause. He did deeper research, including via Stevenson’s website and Bahrs, to help him navigate a blizzard of claims and offers. He is due to go under the knife this year at a reputable London clinic, where he is prepared to pay thousands more than he would have done in Turkey. “I’ve been looking for anything to get over the anxiety and panic,” he says. “I just want to get on with my life.”

These two articles caught my eye for a number of reasons. The top issue is how the media treat issues relating to men and issues relating to women differently. They are often framed in a serious way and revolving around power and hierarchies and legal arguments and quantifiable factors. It’s a cliche but true that “soft issues” are presented differently. More subjective. More emotional and less easily quantifiable. More flannel.

The first article is a distilled drill down of “certified professionals” sniffing their own gases and a failure of fundamental principles and standards with unpleasant emotional and human rights consequences. It’s not peculiar to the military but can be discovered across a range of professions from the law to medicene and I daresay others, or even output like serialised show title sequences and costume and scene design, and music.

The second article isn’t important or remotely relevant to me personally but I do note the difference in coverage between an article discussing cosmetic surgery for men versus cosmetic surgery for women. Standards vary as does marketing and sales techniques yet with this article there is none of the hysteria associated with articles relating to women’s cosmetic surgery. There are no “serious” medical opinions wading in to bluster about malpractice or undue pressure or talk up scare stories demanding better policing of the industry or banning of marketing as has historically been the case with women’s cosmetic surgery such as breast implants or the luridly named “designer vaginas”.

Weather • June 1, 2021 5:12 PM

@echo
I hear were your coming from, but unless that’s a answer to a question… Anylzer that?
@slf
I’ve got 2 bit, but its ceaser,with hexadecimal, maybe spaced, easily for me to decode, but hard for others.

A Cesar cipher from 0-10 A-G first capital , you send me a sha256 and I’ll replied through that means

SpaceLifeForm • June 1, 2021 11:04 PM

A bad example of moderation

https://www.theregister.com/2021/06/01/google_usenet/

The Usenet group comp.lang.tcl vanished from Google Groups for several hours before being restored on Tuesday.

…

Google took over the Usenet archive when it acquired Deja News in 2001.

Almost a year ago, comp.lang.forth and comp.lang.lisp, were also removed from Google Groups. And they remain unavailable. Likewise, comp.lang.c and comp.lang.python are currently inaccessible via Google Groups.

The suppression of Usenet groups has cultural, academic, and technical consequences. Some active systems, for example, still rely on Forth.

SpaceLifeForm • June 1, 2021 11:42 PM

JBS actually had good backups and procedures?

Or did they pay the ransom?

Guessing latter.

CoVantage • June 1, 2021 11:57 PM

COVID in Victoria, Australia. Be lucky this isn’t coming to you soon… or is it?

  1. ID checks at regional businesses, or no transaction
  2. QR code checks at all businesses
  3. Playing into all transactions logged, even if you desire the quasi-anonymity of cash

If “Privacy is dead” in the late 90s or early 2000s, Victoria Australia without Human Rights Act backing is allowed to play the authoritarian card to a population who cares little and has no legal backing to challenge it.

I know that @Bruce has commented earlier on QR codes and the almost 20-year history of “security theater”. But seriously, is this the next 10-20 years of society in that even those who do not take up touch-on digital transactions have only the choice to grow their own food to escape the machine? How preposterous!

Winter • June 2, 2021 12:51 AM

@CoVantage
“If “Privacy is dead” in the late 90s or early 2000s, Victoria Australia without Human Rights Act backing is allowed to play the authoritarian card to a population who cares little and has no legal backing to challenge it.”

You leave out the important part: Victoria is in a lock down and Victorians are not allowed to be outdoors at all. There are very strict rules for the reasons you can leave your house, and the requirements you mention are all intended to make sure everyone complies. And the population cares about their health and safety first, and their “freedom” later.

In short, Australia implements strict rules to curb the pandemic, and it works. Australia has 900 (yes 900) COVID-19 deaths. Canada with approximately the same population has 40,000 COVID-19 deaths.

Strict Australia saved around 39,000 lives, compared to “lax” Canada. If the USA had implemented the strict Australian policies, there would have been only 12,000 COVID-19 deaths in the whole of the USA, instead of the current 600,000[1].

https://en.wikipedia.org/wiki/COVID-19_pandemic_death_rates_by_country

[1] “Live Free or Die” has gotten a rather sinister sound in the USA, as it works out to be “Live Free and Let Die” under COVID-19.

Winter • June 2, 2021 2:20 AM

These do not need any introduction. I suggest you look at the examples. The Unicorn example in the second link is quite unsettling.

Truth, Lies, and Automation
How Language Models Could Change Disinformation
ht tps://cset.georgetown.edu/publication/truth-lies-and-automation/

In light of this breakthrough, we consider a simple but important question: can automation generate content for disinformation campaigns? If GPT-3 can write seemingly credible news stories, perhaps it can write compelling fake news stories; if it can draft op-eds, perhaps it can draft misleading tweets.

To address this question, we first introduce the notion of a human-machine team, showing how GPT-3’s power derives in part from the human-crafted prompt to which it responds. We were granted free access to GPT-3—a system that is not publicly available for use—to study GPT-3’s capacity produce disinformation as part of a human-machine team. We show that, while GPT-3 is often quite capable on its own, it reaches new heights of capability when paired with an adept operator and editor. As a result, we conclude that although GPT-3 will not replace all humans in disinformation operations, it is a tool that can help them to create moderate- to high-quality messages at a scale much greater than what has come before.

Better Language Models and Their Implications
ht tps://openai.com/blog/better-language-models/

GPT-2 displays a broad set of capabilities, including the ability to generate conditional synthetic text samples of unprecedented quality, where we prime the model with an input and have it generate a lengthy continuation. In addition, GPT-2 outperforms other language models trained on specific domains (like Wikipedia, news, or books) without needing to use these domain-specific training datasets. On language tasks like question answering, reading comprehension, summarization, and translation, GPT-2 begins to learn these tasks from the raw text, using no task-specific training data. While scores on these downstream tasks are far from state-of-the-art, they suggest that the tasks can benefit from unsupervised techniques, given sufficient (unlabeled) data and compute.

(URLs fractured for your protection)

Clive Robinson • June 2, 2021 2:23 AM

@ SpaceLifeForm,

I know you maintain a watchful eye on the activities of AWS, and the “control power” they are accumulating.

Not sure if you know about this fun little “Amazon Inside” game they have started in on,

https://www.theregister.com/2021/06/01/aws_ecs_anywhere_goes_live/

It’s clearly a “The Amazon way, not the Open way” and even though the hardware may be in your data center, it’s “remotely controled” maintained etc by Amazon who can “flick the off switch” at any time…

If I was into “Dane Gelt” or “Official Ransom” then I would be salivating at the opportunities that this would give for “tightening the screws” and “upping the premium” because whilst the end customer might think they own their data…

lurker • June 2, 2021 2:52 AM

@CoVantage: QR code checks at all businesses

New Zealand MSM thought it was a great joke when an elderly citizen was found to have been taking photos of the QR codes. Maybe his phone, like mine, was too old to run their precious “app”. Give the contact tracers the camera roll, they’ll work it out.

Clive Robinson • June 2, 2021 3:19 AM

@ The usual suspects,

https://www.theregister.com/2021/06/01/bt_starts_trials_of_new/

I originally read the article because of the mention of Quantum Key Distribution (QKD) mentioned, but unfortunately it did not go into any details.

Put simply the “Hollow Fiber” or “Optical waveguide” could double or quadruple the current QKD range at a given bit rate which would be advantageous to a limited subset of potential QKD customers such as “Inteligence Agencies”.

But Hollow Fiber will almost certainly be well in the sights of “High Frrquency Traders” and their like who pay “megabucks” for nanosecond shavings.

But I’m sure some will be thinking “What is holow fiber and why is it of interest?”.

Well current fiber is currently made by heating a block of optical class up and pulling it very rapidly into a single very very thin fiber of great length (think miles not yards).

As a process at the 20,000ft view it’s little diffferent to drawing a single hair fine strand of copper wire. At a similar hight view making hollow fiber is like drawing a copper pipe rather than wire.

Which as it’s a more complex and thus currently more expensive process raises the question of “Why go to the trouble?”

Overly simply the velocity of light in a medium is related to the mediums properties that are also related to it’s density.

It’s been long known there are three basic types of unbalanced transnission line for Electro Magnetic Signals in the lower end of the RF spectrum,

1, G-Wire transmission line.
2, Coaxial conductor.
3, Waveguide.

You can try and think of them as a single wire, a wire in the center of a tube, and a tube without a wire in it.

In the first two cases you need a suppprt structure that unfortunately effects the transmission of the EM signal along the transmission line that not just slows it down it also increases the losses for any given length.

I could give the transmission mode lecture as to why this is but it would be fairly dull if not incomprehensable reading for most without a lot of background knowledge.

The short take is the “velocity factor” in twisted pair transmission lines can be as low as 1/10th the speed of light and around 2/3rds in many coax cables, whilst in what are the metal tubes of wave guides it’s not much different to the velocity of light in air.

Well for similar reasons the same is true of optical transmission lines with solid fiber being appreciably slow compared to optical waveguides which hollow fibers are in effect.

Another advantage, is that as EM waves are energy they heat any lossy material up. The more loss the shorter the length of transmission line you can use and the more it heats up. The same is true of copper conductors where very thin wires are often used in things called “fuses” that melt if too much energy is pushed through them. Dry air for various reasons is not very lossy at all thus does not absorbe the energy and heat up. Therefor waveguides and hollow fibers can carry significantly more energy for a given diameter, as well as having a way more significant range.

Thus as hollow fibers become more economical to produce they will naturally displace single fibers made of glass or plastic. Thus they will be the next generation of bulk data transmission technology (with I suspect vaccum waveguide working up in the top end of the EM spectrum the generation after that).

Clive Robinson • June 2, 2021 3:32 AM

@ lurker, CoVantage, Winter, ALL,

New Zealand MSM thought it was a great joke when an elderly citizen was found to have been taking photos of the QR codes. Maybe his phone, like mine, was too old to run their precious “app”. Give the contact tracers the camera roll, they’ll work it out.

Shows there is a problem with the idea, that is you need “the latest tech” or at most one or two generations old.

What many will forget is that,

“Authority is a hammer and usually sees anomalies as nails“.

If you don’t have the required tech you get forced out unless you comply. Thus you are in effect “opted-in or die”…

Which raises the question of,

“How do you opt-in in lockdown, when you can not buy the required technology to survive?”

At the moment it’s “Smart Phones for QR codes”, but this will move to “Smart Phones for immunisation status” and thus move to “Smart Phones as passports”

Anyone else see a problem with that?

Clive Robinson • June 2, 2021 4:36 AM

Is RowHammer Dead and gone?

Whilst many thought the added protections in DDR4 would kill RowHammer off, as expected it turned out to be a “Sticking plaster for a broken bone”. That is it tried to cover up the surface symptoms not what was broken and actually failed to do both…

Well Google have not unsurprisingly found that you can with some effort get the RowHamner effect to work not just on immediatly adjacent DRAM rows, but the next rows out,

https://security.googleblog.com/2021/05/introducing-half-double-new-hammering.html

They call it “half-double” which is less clear than a yard of lard as far as naming goes, however the article is a brief easy read and gives links to other recent RowHammer attacks.

But the big take away realy is not the fact that RowHammer has been extended, but that you actually have to solve such problems as “cover-up mitigations” are only as good as what they cover, and most times they cover very little.

This is because they focus on “specific instances” rather than “general classes” of attack…

I know it’s a point I keep making but as such failings keep occuring people are obviously either not taking it onboard, or they are going for “cludge solutions” for some reason (managment/fiscal/speed/?).

As I’ve also pointed out such “cludge solutions” have been known since before we had scientists and engineers. It came to a head in the Victorian Era when artisan craft persons built the first steam engines for real work. For reasons that are with hindsight obvious, they often failed sometimes catastrophically, and it was the rising numbers of deaths that cause politicians to finally enact legislation.

Security fixes by cludge solutions in hardware, I had hoped, would have reached a head in the 1980s and 90’s with the issues surounding Smart Cards. But no, they are still with us and as Intel have shown with their CPU issues, they now see no real reason to fix the mess just offer mitigations that are every bit “cludge solutions”.

To an end user of such “broken hardware” the choices are stark, you either live with a major security vulnerability which will bite hard at some point or you come up with your own “general class” level mitigation. The most obvious and broadest scope mitigation against outsider attack being “total segregation from communications”. That is if an outsider can not reach a vulnerable system then they can not attack it, subvert it, steal data from it, or make the data unavailable.

Whilst total segregation can be done comparatively easily with energy-gapping, for most the total lack of communications makes it unsuitable for what they need to do. Even push-out style gap grossing as was seen with Data Warehousing in the 1990’s is insufficient, as data needs to be got in and updated quickly these days.

Comming up with secure bi-directional gap-crossing is not at all easy, and comes with some non obvious security vulnerabilities via flow control and error handling to name but two.

Perhaps the biggest problem currently is lack of appropriately skilled staff, where even the equivalent of a million dollars a year, just won’t get you the staff you need…

Winter • June 2, 2021 5:38 AM

@Clive
“Whilst many thought the added protections in DDR4 would kill RowHammer off, as expected it turned out to be a “Sticking plaster for a broken bone”. ”

But isn’t it a kind of “law of nature” that any efficient system will have time/energy side channels that allow inspection of the processing?

Or, in other words, every system that does not have equal-time/equal-energy processing of input will leak information about what is processed.

Clive Robinson • June 2, 2021 8:21 AM

@ Winter,

But isn’t it a kind of “law of nature” that any efficient system will have time/energy side channels that allow inspection of the processing?

It’s axiomatic and follows on from the laws of thermodynamics.

To simplify,

1) To do work, requires work to be done thus no system can be 100% effeicient.

2) ultimately there can only be two forms of waste from the inefficiencies of work, matter and energy. Currently the energy to convert energy to matter is not within our effective grasp.

3) Coherent energy becomes steadily less coherant and where possible more diffuse and ends up as low grade random thermal energy, that would take more energy to make coherent than you could get out of it, thus there is what is in effect a barrier. Otherwise perpatual motion would be achievable.

It looks a little like circular reasoning so far but the likes of radiation transport go through cycle after cycle untill you get the end result of low grade random thermal energy. Think of what happens when a nuclear device happens to see this in action. As has been observed “all clocks run down eventually”.

There are only three things you can do with information,

1, Communicate it,
2, Store it,
3, Process it.

Depending on your view point information either is subject to physical forces and the speed of light or it is not. As we know that is true for both energy and matter that make up our physical universe. Thus the question is does information exist outside of energy or matter, and is impressed or modulated on them so we can interact with it in the physical universe.

The answer to that depends on your definition of impress or modulate, as far as we currently believe that requires a force of some kind…

So working on that view all things we do with information would require work to be done, thus there must be information leakage impressed on the waste products of inefficiency.

Which has implications for your statment,

in other words, every system that does not have equal-time/equal-energy processing of input will leak information about what is processed.

It’s not true due to the fact you use qualifiers via, “does not have…”

The factually correct statment would be,

“Every system that performs work will leak information about what is processed.”

What you might try to hide by using “equal time” will require extra work to get the desired reault, thus waste will be produced in another way which by definition will carry the information negative in some way. Which makes “equal-energy” of the system not possible. It might draw constant energy from a source and store an excess to “smooth” what is drawn, but atleast twice the energy movment plus some will occure at the storage mechanism, and that “plus some” will leak information at twice the rate, first as the energy goes into storage, then as it comes out again to do work.

Even if you significantly “bandwidth limit” the information is still there as it’s spectrum folds over at what is the Nyquist point. So what was a positive frequency becomes a negative frequency and can still be extracted[1]. However the more times it folds over, the more the additions make it look like random noise.

[1] See the likes of the Weaver “third method” for SSB for a practical use case that id now much used in “Software Defined Radios” that use DSP techniques,

http://www.hanssummers.com/weaver/weaverlib

echo • June 2, 2021 9:06 AM

I’m less interested in what Clive has to say and more interested in what he isn’t saying. That really is the curious thing.

As it turns out I’m dealing with other problems in the human rights sphere. After a quick analysis of one UK state agency it was very clear from a reading of their policies, knowing how these organisations can present one face while hidig another, and the data they were acting on there was an attempt by ministers and agency decision makers to subvert the human rights and equality acts among other law. A lot of people in this sphere just accepted the decision as read even if they didn’t like it and just complained about it, and swallowed the line they could always complain about activities in this sphere later.

The direction by the agency to use the complaints system was a second attempt to game the system as the effective protections in place plus the agency marking its own homework from the point of view of its original decision being the starting point would pretty much see every complaint thrown in the bin.

Believe me when I say I got zero respect for it off anyone but a judicial review callenge is now underway led by a third party with standing. We will just have to wait to see what the outcome is.

No I don’t wave around “certified professional” status or put things over in teeth grinding “duck and roll” formal lingo which checks off the paint by numbers list of memes which signify “belonging” to said group but I know my sh*t and know BS when I see it.

I have a few suspicions about a lot of things and a European Court of Human Rights judgment landed this week. Curiously, the government got a few things in a few days before this decision. Whether this was deliberate or a coincidence I have no idea. I also have no idea how much attention or not UK government lawyers pay to rulings by the EHRC or any other court but there are times when I suspect it is greater than zero and this legal knowledge is used by government lawyers to rig things in the governments favour while deliberately withholding this from the public so the public are always fighting with both arms tied behind their backs.

The Ministry of Justice successfully withheld legal advice from FOI and the Guardian was not able to overturn this in the courts. Given the published policy information and the fact I read widely and deeply on subjects which get my attention I have a very strong suspicion exactly what case law the Ministry of Justice is using. The case law is Australian and from the Austrailian criminal courts. Most people don’t know this but in England and Wales criminal and civil cse law can be used in either court. Now before anyone starts screaming and says you cannot import legal instruments from a foreign jurisdiction (or potentially a Common Law jursidiction where the legal fundamentals have drifted so as to be incompatible) without the approval of a judge News International slid Australian civil law past the judge without a murmer to obtain a massive tax break from HMRC. Interestingly, one reason why the Ministry of Justice would withhold knowledge of this legal instrument from anyone is it sets a precedent which would have many state setor decisions overturned and a lot of people being owed a lot of services the government has no intention of paying for. Putting these two completely unconnected cases together reveals an interesting little wrinkle in the system.

Moving on another thing people may not know is Information Theory law is now a thing within the courts of England and Wales. I had done some digging a few years ago to see if Systems Theory could be used in law and found nothing other than a Wiki analysis of information theory law in the US. Potentially this could be imported into a court case but it was wholly dependent on whether the judge allowed it or not. Since then there has been a directive which established Information Theory into law and this has been used by a QC fighting a human rights case. You can guess at the blank looks I get whenever I mention Information theory law to some people but that’s a story for another day.

Winter • June 2, 2021 9:51 AM

@Clive
“So working on that view all things we do with information would require work to be done, thus there must be information leakage impressed on the waste products of inefficiency.”

There are caveats here. Reversible computations expend no energy, in the limit of long times. But that has no practical implications yet.

What is more interesting from a practical view point is that it is possible to obfuscate the time/energy side channels by “time/energy padding”. The operations of interest are all “padded” with noops to take equal time to complete and to spend equal amounts of energy, irrespective of the input and operations chosen. I understand that such things are already applied in cryptographic key processing.

It is obvious that such “padding” is (very) inefficient in computational terms.

That is why I said that efficient computations always have time/energy side channels.

Winter • June 2, 2021 9:55 AM

@echo
“As it turns out I’m dealing with other problems in the human rights sphere.”

Why do you think there are people here who are under the illusion that there is any love lost between UK governments and Human Rights? That is, Human Rights to the defense of the UK citizen.

echo • June 2, 2021 12:16 PM

@Winter

Why do you think there are people here who are under the illusion that there is any love lost between UK governments and Human Rights? That is, Human Rights to the defense of the UK citizen.

I have no idea who thinks what anymore. Opinions get polymorphic when treading directly or indirectly on vested interest of varying shades and textures. Doing something because it is the right thing to do is very out of fashion.

Many years ago a friend who had previously appeared in The Times won a legal case many in the legal profession including judges and lawyers believed was unwinnable. He had done all the legal research himself in one of the local law libraries and wrote up the case himself. In his own words all his lawyer did in court was read out what he had written. Obviously there’s a little more to it than that but that’s the version he told me.

I’m very much of the opinion that if you want something properly do it yourself and while there is merit in going to experts and seeking support where apprioriate, and I’m not allergic to either, there is a certain slowness of mind especially in the UK when it comes to matters of the intellectual persuasion. There’s always some job title or nosey parker who will tell you something is not possible or who will send you off on wild goose chases and a whole long list of other stupidities. There’s hypocrisy and double standards and deliberate playing of one side off against another. The list goes on and on.

Now I was lamenting only the other day that nobody in the sphere I am interested in had the guts to bring a case. Lo and behold this morning someone shoves an essay in my face which included a list of over a dozen or so cases. Well, yes, but it neglects to mention important and everyday cases which could or should be had and this should measure in the hundreds. The fact it doesn’t is a red flag and everyone is too dumb to spot it. They are also too dumb to ask why and too dumb to fix the problems acessing the courts which are known knowns.

If you rewind and read the article on military problems I posted earlier you ay note there is a thread running from top to bottom and it’s a thread which generally runs through the UK as a whole.

While writing this a legal comentary and some Crown Prosecution Service guidance has come to my attention. Without going into details the particular subject area does have my focus and it’s somethig I raised along with contextutal issues with the polcie on a previous occasion. I logged this alog with the police response which highlights a number of problems with the police. One of the problems the polcie is like a lot of people on the internet is they don’t actually read the law nor have they consulted with a alwyer yet they confuse their random opinion they acquired off their colleagues or friends or simply their own kneejerk avoidance of work or victim blaming with what is actual law and all the attendant obligations and duties which go along with this.

Without being a lawyer myself I know my law pretty well and it’s interesting how this legal commentary and the CPS guidance confirms what I thought was the case. The hardest part generally is securing a conviction under this law for the kinds of cases the CPS is highlighting but there are also other guilty parties including UK state agencies who themselves are guilty of triggering the guidance. That’s not going to be something the goverment wants to admit even if the mainline of their policy drive is the root cause of the problem.

I have a nasty habit of writing circular narratives in the Chinese style rather than the usual Western linear style. It’s not because I’m Chinese it’s just because that’s how my mind works and, again, you may be able to see the repeating pattern of abusive hierarchy making itself felt in the link between government dogma and avoidable crime as defined by the CPS.

Winter • June 2, 2021 12:46 PM

@echo
“I have a nasty habit of writing circular narratives in the Chinese style rather than the usual Western linear style. ”

That could be the reason I often have no idea what you want to say.

The impression I get from your comment above is that you argue that the UK common law court system does not work well. I have yet to meet someone who would disagree. Which makes me wonder why you spend so much time arguing this point.

MarkH • June 2, 2021 1:12 PM

@Winter, Clive:

Information leakage is impossible to prevent, and very difficult to contain for security purposes.

However, it’s a fundamental error to view “Rowhammer” as some kind of side channel. It isn’t, properly speaking. It’s the exploitation of a design defect.

It is fundamental to storage technology that a write to a specified address must affect only that address, AND NO OTHER. The maximum acceptable rate of failure to meet this requirement should be less than one in 10^10.

Random incidence of such failures can never be completely prevented, but these RAMs fail in this manner repeatably.

That’s just bad engineering.

Clive Robinson • June 2, 2021 1:21 PM

@ Winter,

There are caveats here. Reversible computations expend no energy, in the limit of long times. But that has no practical implications yet.

Reversable computation with Toffoli (CCNOT) and Fredikin (CSWAP) gates do expend energy, if you want to get the results out. That is they use energy for the computations, and you get it back if and only if you reverse the computations. If however you take the results of the computations, you can not reverse them so you get to keep the energy deficit and the resulting waste (especially in DNA Computation[1]).

With regards,

What is more interesting from a practical view point is that it is possible to obfuscate the time/energy side channels by “time/energy padding”. The operations of interest are all “padded” with noops to take equal time to complete and to spend equal amounts of energy, irrespective of the input and operations chosen.

Not sure where you got that idea from, whilst you can have equal time it has to be at the expense of something else, otherwise you don’t get computation you can use.

That is “to do work you have to expend energy over time” yes you can in theory get the energy back by reversing the computation, but not the time, and you always loose out when you output the data.

Thus whilst you might make energy equal you have to have something else unequal.

There is no free lunch, it’s all down hill somewhere, the real question is a compound one of,

“Where is the inefficiency leaked, can it be detected, and can impressed information be usefully recovered?”

You can play around shifting the “where” but that involves doing more work that also leaks information all be it’s negative (think charging and discharging a capacitor). The important points to note are you can not both charge and discharge simultaniously, and when you square the signal as happens naturally you get a positive result, and out the information goes from your process.

[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3535638/

echo • June 2, 2021 1:42 PM

@Winter

That could be the reason I often have no idea what you want to say.

The impression I get from your comment above is that you argue that the UK common law court system does not work well. I have yet to meet someone who would disagree. Which makes me wonder why you spend so much time arguing this point.

It was pretty simple. The rest of the work is up to you. While there are problems with the common law court system this wasn’t my particular nor only focus. Nice gaslight but I’m not buying it.

Winter • June 2, 2021 2:53 PM

@Clive
“That is “to do work you have to expend energy over time” yes you can in theory get the energy back by reversing the computation, but not the time, and you always loose out when you output the data.”

That was not my point. My point was that it is possible to equalize the energy output of all processing of all input by adding noise energy to those tasks that release the less energy. This obfuscate the energy profile of the processing, or in other words reduces the SNR.

This is the equivalent of making all messages of equal length by padding.

Fake • June 2, 2021 3:10 PM

@winter,

It’s not that simple, different numbers and operations are handled by different parts of the chip. Certain numbers may emit specific frequencies for specific durations at specific moments during various unspecified processes.

Weather • June 2, 2021 3:10 PM

@the person that posted it

Noon:

Dec CX
Jno noon
Main

There’s four possibly things one msb of ECX is got a value, it will continue loop, jno with DEC might not set the overflow flag, continue loop. CX could hold all the bits and after a word, will breakout and run.
Try coming up with one that has six possible paths, then ten^6 for were you can lead a program.
I haven’t seen jno used when debugging, but have seen it in shell code.

name.withheld.for.obvious.reasons • June 2, 2021 4:09 PM

2 Jun 2021– Doubting the Risk is the Risk
During a conference where political operatives claimed that a coup d’etat should happen, according to former U.S. general Michael Flynn, the most telling “sign” was actually the signage at the conference. The large banner on the platform said “For God and Country”. This continued parallel of the religious undertones that are a part of the larger threat to the U.S. democratic republic has a cohort and insidious relationship between religion and politics. To ignore this is to be dismissive of the heart of the problem and the undue risk this represents to democracy in the United States.

If the moderator continues to shunt these posts, please restate the posting policy to clarify. Security has been the central tenet of my posts, even if the appearance of a non-sequitur the threads in totality say otherwise.

echo • June 2, 2021 5:03 PM

@name.withheld.for.obvious.reasons

Following on somewhat from my earlier posts the UK military has had to throw out some members because they had far right links. (I don’t have a url to hand but it was reported this week.) There were indications the unoffical number was actually higher.

I sometimes watch military related videos on youtube. I’ve personally reported some ex military personnel with youtube channels for nurturing far right ideology and conspiracy theories. It’s nothing blatant but if you’re English you will get the nod and a wink undertones. It’s enough to raise a caution flag and itchy trigegr fingers with regard to Prevent anti-extremist legislation. Youtube do nothing by default of course because youtube hide behind the US jurisdiction and US style “freedom of speech”. For England and Wales (and other jurisdictions) you have to begin filling in legal submissions.

While browsing one UK military youtube yesterday on, I forget what, there was a worrying number of “God bless the Army”, or whatever. I’m wondering where this is coming from. The monarchy kissing element was strong but this kind of “God Bbless” kind of language is usually the kind of thing Americans say not British.

I linked in the previous Squid topic to a report which highlighted the links between far right terrorism and right wing religions including a breakdown of where major sources of right wing funding of extremist agendas came from. The official report may not be wholly up to date not cover the full map of far right limks as other data I have seen but the US and Russian presence is large.

The current UK regime (I hesitate to call it a government) reeks of dodgy connections and dodgy agendas and basically lied and levered its way into power on the back of other lies and armtwisting. It is, effecively, a coup with some very scary ideas if you are not a member of “the party”. And as we know not only did the current regime benefit from the Brexit coup which itself had links with very dodgy types in the US and Russia as well as terrorists in mainland Europe (reported in the media) but the current regime gives fuel to far right elements in Poland and Hungary and I daresay Russia and the US too.

I couldn’t care less about what security issues are attached to boys toys. That fits so heavily into known known and lather rinse repeat my eyes glaze over. I think they are the least of anyone’s worries and the really pressing security threat issues are much more pernicious. I do agree these hints and tells are the most important clue and agree that doubting the risk is the risk. This is, after all, how at least one odious creature of a man is warming a chair in Downing Street.

Clive Robinson • June 2, 2021 6:11 PM

@ MarkH, Winter,

That’s just bad engineering.

That depends on the viewpoint. Most memory manufacturers know a 1 in 10,000,000,000.0 soft error rate across a chip is not directly achievable. Thus correction mechanisms have to be used hence Parity check and later ECC DRAM sub systems were being built and put in use for getting on to half a century ago.

As the size of memory elements decreases the expected error rate increases, worse the number of bits goes up to some power for any given chip area (thermal conditions are less of an issue with memmory). Thus even with “engineering improvments” we can expect similar or worse error rates to still apply.

Thus in effect an economic bench mark has been set, and moving it will not prove popular either with manufacturers or customers.

It does not matter if we like such a bench mark or not as engineers, it’s the economics that dictate what engineering is done.

If people want higher reliability, faster memory or both, they can design their systems to not use DRAM but some variation of SRAM. However due to the limitations imposed by the speed of light and the physical properties of PCB materials, you quickly bump into the law of diminishing returns. So SRAM will never have the same maximum bit density as DRAM at the same clock speed.

Which brings us onto,

However, it’s a fundamental error to view “Rowhammer” as some kind of side channel. It isn’t, properly speaking. It’s the exploitation of a design defect.

That actually depends on who is defining “side channel”. If you say RowHammer is not a side channel attack you will have to say the same for cache timing attacks, and many others that are currently considered to be either side channel attacks or some more selective subset of them.

As I’ve previously noted the original definitions of various channels goes back to Lampart 73 and Simmons 84 with the fundementals Shannon 48. Likewise not only do others go back quite far into the past, they have all been “updated” over the years thus the definitions change (much as colloquial language does).

SpaceLifeForm • June 2, 2021 10:42 PM

@ Winter, Clive, MarkH

Silicon Turtles

8 page PDF. It’s not just Ram. Some snips. My bold.

I would not conclude that it is only the silicon, but that the possibly weird stuff can happen due to microcode bugs and/or microcode attacks. Then again, the manufacturer can always blame things on cosmic rays, but there is more here than that.

Faster does not mean safe.

hxtps://sigops.org/s/conferences/hotos/2021/papers/hotos21-s01-hochschild.pdf

This happened to us at Google. Deeper investigation revealed that these instructions malfunctioned due to manufacturing defects, in a way that could only be detected by checking the results of these instructions against the expected results; these are “silent” corrupt execution errors, or CEEs. Wider investigation found multiple different kinds of CEEs; that the detected incidence is much higher than software engineers expect; that they are not just incremental increases in the background rate of hardware errors; that these can manifest long after initial installation; and that they typically afflict specific cores on multi-core CPUs, rather than the entire chip. We refer to these cores as “mercurial.”

…

Some specific examples where we have seen CEE:

•Violations of lock semantics leading to application data corruption and crashes.

•Data corruptions exhibited by various load, store, vector, and coherence operations.

•A deterministic AES mis-computation, which was “self-inverting”: encrypting and decrypting on the same core yielded the identity function, but decryption elsewhere yielded gibberish.

•Corruption affecting garbage collection, in a storage system, causing live data to be lost.

•Database index corruption leading to some queries, depending on which replica (core) serves them, being non-deterministically corrupted.

•Repeated bit-flips in strings, at a particular bit position(which stuck out as unlikely to be coding bugs).

•Corruption of kernel state resulting in process and kernelcrashes and application malfunctions.

Weather • June 2, 2021 11:28 PM

@slf markh Clive winter
Just like debugging a PE you find code that is wtf.
I gave you some points, use realmode, its 16bit, if there’s a catch it will run 32/64bit instruction.
You’ve helped me so return, but …

SpaceLifeForm • June 2, 2021 11:31 PM

Insane

hxtps://www.bleepingcomputer.com/news/cryptocurrency/norton-360-antivirus-now-lets-you-mine-ethereum-cryptocurrency/

When Norton Crypto is enabled, the software will use the device’s graphics card (GPU) to mine for Ethereum, which will then be transferred into a Norton wallet hosted in the cloud.

Winter • June 3, 2021 1:55 AM

@Fake
“Certain numbers may emit specific frequencies for specific durations at specific moments during various unspecified processes.”

Side channel attacks are physical measurements of signals. Countermeasures are two-fold, 1) reduce the strength of the signal, 2) Increase the noise.

With any signal, it is always possible to add more noise to reduce the reliability of the measurement until the SNR drops below the level where the signal is useful.

Fake • June 3, 2021 2:22 PM

I don’t like it, how many people have went to jail for the loose wording of the CFAA and the Supreme Court waits to review it and issue an escape clause for a corrupt cop who used a database he was not supposed to access in unscrupulous ways to violate someone’s constitutional rights for one of his informants?

Women’s rights advocates and the ACLU need to examine this hair splitting closer in my book, this reeks.

Aaron is DEAD over CFAA abuse, now a cop gets his conviction overturned when he’s supposed to be held to a higher standard?

If this stands don’t expect any privacy from any database as there are no longer any victims.

What's the damage? • June 3, 2021 3:11 PM

Let’s not even prosecute ransom ware skiddies anymore we all know full well 99% of the people affected have honestly given them access to said computers networks and databases. I’m going to need your password to install a script to repair your computer, did I forget to tell you that I was going to format your drive in an encrypted fashion and then lose the keys?

It’s for security purposes only, financial security…

My consultation is free, but the recovery process is 500k USD.

Fine print? Just try to find print, we didn’t have any sort of an agreement and you gave me access, should’ve thought long and hard about restricting it first.

Read all those mail order bride messages on classified networks boys, you’ve got nothing to fear from the American courts and you might even find yourself a member of a foreign referral network with some very nice soon to be taxable bank drops.

You never gave me access? I sent you about 50,000 emails… Viagra, Steroids, Vicoden, sexy women in your zipcode… I know you saw the brochure because the VBA I embedded in that XLS called home.

You only click the ones you’re interested in, we only send our brochures to the ones WE’RE interested in.

Now there’s a meeting of the minds.

MarkH • June 3, 2021 3:32 PM

Re SCOTUS ruling:

I’m with Fake on this … the effect will be to legitimize many harmless activities, but also plenty of truly malignant activities.

And Swartz is still dead.

Ideally, this will be a call-to-action for Congress to enact legislation which is far better targeted.

Clive Robinson • June 3, 2021 5:11 PM

@ SpaceLifeForm, ALL,

Hope nobody minds if I avoid the politics involved. But will note that there were other charges that could have been used and would probably have succeeded.

However the prosecutor went with what they thought would be an easy win, as it was assumed to be impossible to not be found guilty. But it blew up in the prosecutors lazy ass face as it rightfull should have done.

So why do I say rightfully?

Well consider @SLF’s point,

Does this mean I can be abusive with nmap?

Well before this the answer was almost certainly no because the CFAA does not in any way define what it means by authorised access…

Look at it this way I send a packet from a computer it goes through the Internet and arrives at the destination computer.

The actual process as we should know is rather more complicated.

Lets’s say you did a search on Google and you found some information and returned a bunch of links with a short paragraph for each, or a photo.

Does it return the site access policy and who is authorized or not?

Simple answer of course not. So how do you find out what it is?

Simple answer in 99.99% or more of cases is you can not unless you actually access the site… Which of course in most policies is not covered. So you would under the CFAA as written be guilty.

But it’s actually worse than that.

To access the site you first have to get the URL converted to an IP address usually via the DNS.

The DNS is a hierarchical system with very limited caching. The way it works is you walk up the hierarchical system till you find the IP address in a cache. But unless the site is one of those top thousand or less sites, the chances are it won’t be in any of the caches between you and the root of the domain.

So what happens is you go “over the top and down the other side” looking in those caches till either you find the IP address in the cache, or you hit the sites authorative DNS records, which will be in a lot of cases be held on a computer at the same site the server you are looking for the IP address for. Almost certainly the policy will be a,site policy not a host by host policy.

Now the CFAA does not specify what access is in terms of technology only what is the “directing mind”.

Ergo you clicked on a link supplied by Google, and a “user agent” for DNS was launched by you clicking on the link. The user agent crawls up to Google’s root DNS service, and then dropps down into the site…

Where it probably breaches the site policy under the way the CFAA is written.

So you are as far as the CFAA guilty before you even get the IP address to follow, that might give you the site access policy, but probably does not. The chances are you will then get sent via the Google suppled URL based on the Google DNS service pulled IP address to a web server you then “access”. You are by this time quilty twice over, and have not yet got anything back, including any warnings or site policy agreement.

Many will argue it’s the equivalent of walking through someones front door without permission…

But that is at best a very very long stretch and “trespass” is a “breach of a private duty” (Tort) not a “breach of a public duty” (Crime).

Think about that for a moment, even if I have an “access forbiden” notice on my front gate, and front door, if you can walk in without committing any other crime then it’s a “Civil not Criminal” matter. But… More importantly,

1, It needs a contractual breach
2, The remedy if a loss can be shown is a fine.

So when and what is the contract…

Well it depends on if it’s a private, commercial or public property and importantly who the person accessing it is.

A postal worker has an implicit right of access to all of them to deliver mail, unless otherwise specifically prohibited. A court appointed officer can not be prohibited if they are on official court business, if not they actually have less rights than a private citizen. Law enforcment it is ambiguous and based quite often on “a belief”…

But what about a private individual, well like police officers they have a right of access if they have reason to stop a crime, aprehend a criminal in the act, or if they believe a life is in imminent danger. Also to “serve notice of proceadings” which can be either written or verbal. Yeah think about that one, if your neighbour is creating a nuisence or acction likely to cause a breach of the peace, you are entitled to go up and give them notice that you intend to initiate proceadings in a court (in fact you are required legaly to “give notice of intent before action” a minimum of usually 14 days before submiting papers to court.

Now via a thousand years of practice, various implicit contracts have developed about what you are and are not alowed to do and when. Unless there is a notice on a gate, you are alowed to go upto the door of a private dwelling and knock etc to reasonably attract attention of the property owner or their agent for a whole number of purposes. However if you start going anywhere else then things get complicated.

Commercial premises, you are alowed to enter if the doors are unlocked for the purposes of business during reasonable hours. Obviously there is a difference between a shop and an office, but an office is reasonably expected to have access control via a locked door or barrier between a vestibule / foyer and the rest of the building (it’s more complicated with the likes of loading bays etc).

Public buildings work on the notion of access alowed at reasonable hours unless a prohibition (private party staff only etc notice) or shut/locked door or barrier is used to segregate public from private areas.

Now consider the online equivalents, how the heck are you expected to know what implicit contract is inplace if you can not see what type of site it is and the server freely alows you access by responding to your TCP request and compleating a transfer of information that does not contain any warnings or policy…

Well the CFAA expects you not only to have balls of crystal, but if you have not to stand accused of being a criminal for having the temerity of even asking what the contract is.

Which brings us back to @SLF’s question,

Does this mean I can be abusive with nmap?

The answer is NO twice over and you will get convicted because,

1, Abusive behaviour is usually a crime where ever you do it.

2, The prosecutor will tell the jury and press that “nmap is a tool used by unauthorised criminals” and that “you were unauthorised” therefore imply you are a crook who should be turned into a criminal. The judge will when giving instructions will effectively re-enforce that because of the way the CFAA is worded and scoped.

Thus as is more and more prevelant these days you are not “innocent untill proven guilty” but “Guilty unless you can prove you are innocent beyond all doubt”…

It’s almost impossible to meet the burden of proof required with the CFAA and similar unless you are extrodinary wealthy or lucky to get the level of representation required. Which means for the average person in the US they have a three way choice,

1, Go to jail.
2, Go bankrupt.
3, Accept some crummy plea deal.

With the prosecutor knowing that you are almost certainly going to go for “door number three” thus they will put a goat behind it. Most legal representatives will take a big fat fee and tell you to take the deal, cash your cheque and walk away whisteling “money for nothing”.

But hey that’s justice “The Corporate way”.

Fake • June 3, 2021 5:45 PM

@SLF, cc: Clive

What services do you offer good sir?
Which bays are available?
Is the North facing access open at all hours to everyone?

You left your open sign on and building unlocked I thought somebody was here but while I waited I decided I’d look through your companies portfolio.

SLF is self defeating with his admission of guilt, signed sealed and cached by Google for future posterity.

Me however, I think it’s perfectly reasonable to try to get a business owner/ operators attention when I can’t find somebody on site.

Clive Robinson • June 3, 2021 6:02 PM

@ Fake,

Very prescient sir,

Trust me it gives me no pleasure being right on this, infact the exact opposit, I’d much rather be wrong.

The reason is that there is a very good reason why most countries keep their military and law enforcment forces segregated.

Whilst they are talking of the DoJ and make it look like law enforcment will be in the driving seat…

Realistically it will now be considered “National Security” thus the likes of the various Cyber-Forces who are military or intelligence agency led will almost certainly run the show at the sharp end.

Thus the question,

“Do we want thoughtfull criminal investigations based on HumInt by law enforcment, or extrajudicial kinetic action based on meta-data from satellites etc?”

Because I suspect it will escalate to the later in fairly short order as a “show of force”…

SpaceLifeForm • June 3, 2021 6:20 PM

@ Clive, ALL

Dire Straits

“money for nothin’, chips for free”

I may have a typo. Do I?

Clive Robinson • June 3, 2021 6:48 PM

@ MarkH,

Ideally, this will be a call-to-action for Congress to enact legislation which is far better targeted.

More likely it will be a call from corporates to their lobbyists to go “persuade” Congress to “broaden the legislation”. Thus the result from the legislators will in many respects be worse.

Corporates like the CFAA and other broad scope legislation they can use to in effect externalise any responsability for the lack of security their efficiency drives for shareholder value create.

After all why spend money on security when a bit of PR and easy criminalization means they don’t have too.

I know some will question this view point but consider Pacific Electricity and Gas (PEG). They decided that spending money on maintaining clearance around over power lines and the power lines themselves was not in shareholder interests… The result was many fires, considerable property damage to others, and a judge finding against PEG who then hid behind bankruptcy law to evade responsability and instead of fixing the peoblem just instituted black outs instead if the weather forcast suggested there would be more than a very gental breeze…

This “don’t leave money on the table” neo-con / libertarian mantra mentality in corporations is a corosive poison eating away at all parts of the US not just infrastructure. The resulting downward spiral is going to do more damage than the worst “Hundred year Hurricane” ever could…

As with all “Lemon Markets” the only solition to such doenward spirals is legislation and regulation. Which is the last thing the fly by night investors want, thus neither do corporate managment. Thus paying lawyers to write the legislation they want and using lobbyists to impress it onto the legislators is realy the only game in town. Look at it this way 10-20million USD/year for properly implemented security to prevent cyber attacks, or just shell out 5 million to ransomware idiots hiding behind Russian skirts after a couple of decades… For “shareholder value” it’s a no brainer, but for the customers the costs due to not having access to energy has cost many tens if not hundreds of millions of dollars.

The shareholders take the profit and the customers get hit with the losses and cost of failures due to lack of maintainance etc.

Clive Robinson • June 3, 2021 7:00 PM

@ SpaceLifeForm, ALL,

I may have a typo.

I was going to say “checks” but I thought people would think it was my “fat finger” at work or slip of the spell checker / auto correct or similar.

But yes you got the band, and it was their “Brothers in Arms” album with the sky blue cover with a chrome steel guitar on the cover. Whilst the track was considered the most popular, it was most certainly not the best on the album by a long way.

Weather • June 3, 2021 8:09 PM

@all
Some things you can’t test on a lan and need a wan ,I think this is a middle ground, about Aaron Swartz I think the FBI updated there produce so the death wasn’t in vane.

SpaceLifeForm • June 3, 2021 10:55 PM

@ Fake, Clive

Does this mean I can be abusive with nmap?

Rhetorical question. Obviously.

I do not abuse nmap. In fact, my most common use case is to port scan my own router from an outside point on the internet. Or a client of mine.

Do you know who abuses nmap? Attackers looking for open ports.

Watch your incoming traffic on TCP port 22. Even if you do not have a sshd running.

You would be amazed.

nmap is a tool. Can be used for good. Can be abused.

In fact, nmap documentation specifically discourages abuse.

No guilt on my part. A bit of evidence on your part. I guess that will be cached too.

Clive Robinson • June 4, 2021 4:52 AM

@ SpaceLifeForm, Fake, ALL,

nmap is a tool. Can be used for good. Can be abused.

My oft repeated comment about “tools being agnostic to use” and that it’s the “Directing Mind” that is responsible to their use, should tell you my long held view point.

But unfortunatly we live in the modern version of psycho-babble quasi-religious authoritarianism little different to the times of Witchcraft and Witchfinder Generals[1] and the hysterical lunacy that gave rise to the Salem witch trials.

Whilst less directly leathal you can look up the “Red Scares” and “Unamerican behaviours” that gave Senetor McArthy[2] such prominence in the early 1950’s.

When added to other similar event in history are added a pattern emerges.

Due to “instability or strife” a form of tribalism starts, and thus people become less and less trusting, and a state of almost paranoia arises. Sometimes called “the beast” it’s what alows rhetoric from the chancers and disafected to claim five minutes of fame as they turn people into vigilantes who will hang people just for being different.

When such a beast is roused, it has two primary characteristics the first is for sacrifices from which to draw avenging blood, and the second for zelots to bath themselves in the blood and faux glory. Without the zelots it dies out. But using fear and paranoia the zelots drive it ever forward for their own personal profit, power and above all status. We joke about politicians and their “But think of the children” rhetoric, but it is exactly this nonsense that has led to crowds of violent societal misfits finding cause celeb and taking the law into their own hands without thought or reason and people get hurt or worse.

Back in the Obama era, what had previously started as a new drum to bang by journalists and those who failed to understand technology, became not just a “political button to push” but a rhetoric of new cold war politics and state craft.

It’s said you can not have smoke without fire, but fire requires oxygen, fuel, heat and an inceduary moment or spark to start the conflagration.

Thus the press were providing oxygen in large amounts and the incompetence of the Silicon Valley Corporates was heaping fuel up high and thus the politicians turned the heat up…

The beast has phoenix been given a birth of fire and it needs victims. What better way than faux crimes, which is what various broadscope thus dangerous legislation has given us.

As an aspiring prosecutor you need as many victims blood on your resume as possible as it is The American Way of “points make prizes”.

Thus what better way than to change public perception?

So tools become “devices of evil intent” by lawyers,rhetoric, and the follow on pushed into the minds of juries is those that use them or have access to them must be evil. And as history teaches us those clasified as evil people must be guilty of something, thus they should be convicted condemed and taken from society.

Thus it’s a “pious duty” that every citizen must respond to or be themselves considered evil in times of distrust, thus likewise be condemed and thrown to the beast…

All the time the flames get fanned by those who seek to rouse the beast for their own profit, power or status.

Whilst it might be hard for many in the US to see this, those outside see it build all to clearly, the signs are there and US culture is a high octain environment of chancers fleecing thousands with faux ministries more effectively than faux Nigerian Princes, or Russian script kiddies.

The spark has been struck, and the smoke is rising from the kindling, what will be the result?

The events of last year and the begining of this year, have created an environment of paranoia that just a few groups each no more than a handfull of people are driving from different directions. But each is spreading outwards encoraged by Silicon Valley Corporates eager to get views for their “points make prizes” business plans.

How long do you think it will be before you are told to look for evil in your presence?

Personally I think it’s already started and unless actively called out for what it is, will build as the power hungry but otherwise inadequates find ways to gain profit, power and status and others get harmed as a result.

Oh and it’s not just the US where this is happening, evidence suggests that US money and influance is being used in the UK fairly successfully as various people hone their skills. So think of the UK as “Test Lab Britton”…

[1] https://en.m.wikipedia.org/wiki/Matthew_Hopkins

[2] https://millercenter.org/the-presidency/educational-resources/age-of-eisenhower/mcarthyism-red-scare

Winter • June 4, 2021 8:11 AM

@Clive
“The events of last year and the begining of this year, have created an environment of paranoia that just a few groups each no more than a handfull of people are driving from different directions.”

I respectfully disagree.

We were entering the pandemic with nationalists in power all over the world, from old hands Putin, Modi, Xi, Netanyahu, and Abe, to new faces like Duterte, Trump, Johnson, and Bolzenaro. The world was racing to war. Trump almost started one with Iran and was rattling swords with China trying to fracture the world into camps for a new cold (or hot) war. I think few people would doubt Trump’s resolve to start some war, if it were just to get reelected.

Then the pandemic struck and everything changed. No one is interested in a war anymore. There is also no interest in other expensive international adventures. The one thing everyone wants is an end to the pandemic and an economic boom.

Trump’s plans for ending democracy in the USA failed (but the GOP are working on a new attempt). Modi is looking into an abyss filled with corpses, as is Bolzenaro. Netanyahu likely lost his position (not sure yet), Abe is gone. Putin still has nothing to offer his people, who do not even trust their own vaccine, Xi wants to offer his people growth in the light of every other nation looking at their supply chains involving China.

We are living in interesting times, but we avoided another war.

What the pandemic showed clearly was that those countries who were well organized, e.g., South Korea, did very well. Others like the USA, Brazil, and India did little better than your random developing country. It will take some time for this to sink in.

Goat • June 4, 2021 10:30 AM

@Winter. I don’t think India would have gone to any war within the borders but it could have happened inside it. The Religion based hatred was growing just before the pandemic diverted attention of the people.

In Delhi the situation went quite bad and Riots ended with a dark silence. Many Families were pushed to the pangs of poverty yet again….

The problem is ultimately the concentration of power. I can testify that I observed hate filled messages circulating before Riots and the ~Surevelliance~ Regulation of social media to make it more ~Survelliance~ Democracy Friendly has been happily appreciated in our country. Do you think these come out of nowhere?

The (Possible?) planned consensus around this is the real (Existant?) problem.

Note: Any Resemblance of this content with sedition is a mere coincidence, The author possess immense love for “public order” and integrity of the nation

Winter • June 4, 2021 12:56 PM

@Goat
“I don’t think India would have gone to any war within the borders but it could have happened inside it.”

Indeed, I was expecting an ethnic cleansing in India, with pogroms against Muslims. They were preparing for that.

name.withheld.for.obvious.reasons • June 7, 2021 4:44 AM

@ Clive, Winter, Goat
In looking at the intersectional nature of the nation states and their performance via the pandemic, a startling coincidence and inference to cause struck me (yes, this is not a claim to causation).

Each of the countries within which the state response to the 2020 Christmas Pandemic (my words) share a non-political (hypothetically) social normative change seem to be in play. Each of these countries is undergoing a moral and ethical reframing of normative behavior affecting state functions. Religions; Hindu influences in Modi’s government, Christian Influences in Brazil, Hungry, Russia, US, UK, and the like are not shared by South Korea, some Western European countries, Vietnam (much of Asia too), New Zealand, and others that were successful. Additionally, hyper masculinity is not present in these countries that have had more success in beating back the pandemic outbreak.

In summary; superstitions held by freedumb loving white men are the leading cause of preventable death during the 2020 Christmas Pandemic.

Clive Robinson • June 7, 2021 6:33 AM

@ name.withheld…,

superstitions held by freedumb loving white men are the leading cause of preventable death during the 2020 Christmas Pandemic.

It has often been pointed out that “Bigoted or ‘Stale White and Male'” are very poor choices from relationships through running any kind of organisation or Nation or Federation of nations.

One observation is white and or male, may be a general case but there are occasionaly exceptions (Mugabe, Thatcher and in the UK currently Patel).

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.