Schneier on Security

Clive Robinson • June 11, 2021 10:00 PM

@ Ismar,

what does this say about the robustness of digital currencies against state-level actors?

There is way to little fact and way to much supposition in that Dan Goodin piece for any conclusions to be drawn.

For instance it’s known that the US Government has already got a stock of bitcoin from previous FBI activities (one FBI agent actually tried stealing some, a few years back and got caught).

Thus that 75 BitCoin may not have been purchased by ColPipe but only used by the FBI.

As for grabbing DarkSides electronic wallet they FBI might have done if the DarkSide operators were stupid enough to keep it in a system that could be reached by communications. Various attackers have done this from time to time already.

As for the passwords required, if you can “grab the wallet” then you can “key-log” the keyboard…

But it might be simpler…

As I noted a couple of days back DarkSide operated a “full service ransomware service” and charged around a 20% fee.

Thus it is possible that the originator of the attack was a disgruntled ColPipe employee. If you search on line you will discover their CEO was not liked at all by employees. Hardly supprising when you find out which companies ColPipe actually “fronts for”, for various tax avoidence and effectively money laundering reasons including bungs to politico’s etc.

So it is entirely possible a simple “CommSec” failure was responsible for the 63 bit coin recovery. That is the BitCoins went to DarkSide who took their cut then sent the rest on to the disgruntled employee in a bitcoin wallet with the balance in it along with the wallet password. If it got “intercepted on route” or “pulled” from the disgruntled employees computer then recovery would not be difficult.

Mind you “recovered” is an ambiguous word when it comes to encrypted information. That is you can “recover” encrypted information, but without the encryption key they remain worthless even though you in theory possess them…

So the FBI might have a BitCoin wallet with BitCoins in it but no password because the previous owner of the wallet has not handed it over for various reasons or even spoken to the FBI (actually a wise thing to do). Thus the FBI could be trying to “brut force” the wallet pass phrase as we speak[1]…

But we don’t know, as there is little or no reliable information only the minimum required for court proceedings. So it’s all speculation untill we get further reliable facts (which is actually not that likely for a while).

[1] Which may prove futile, in that the previous owner of the wallet could have picked a sentance or paragraph from a well known poem or book and added a few bits extra then run it through a hash algorithm a number of times. That number decided by say a telephone number or other publicly available information that can be turned into a number. Whilst both the search space and combinations are “finite” that in now way means that it can be found in the length of time the Universe is believed to have left.

Clive Robinson • June 12, 2021 5:51 PM

@ SpaceLifeForm,

Clive, prove me wrong.

I can not because your hypothosis of,

Now that I think about it some more, the TLS handshake timing differences may actually be a side channel.

Is correct and easily shown as such, the only real question is the “information capacity” under any particular set of circumstances.

Which raises the question of “How much information capacity is required?” for you second hypothosis of,

Where a Downgrade Attack can lead to fingerprinting.

The answer depends on how good a fingerprint you desire, and wether you are using it to “identify or eliminate”. That is when in “search mode” it’s often faster to ask “is this NOT the target?” rather than the much slower “is this the target”.

For the “NOT” case only one time based test is required thus “targets in potentia” can be rapidly “eliminated” depending on what you know about your actuall target.

For instance there are photographes of our host with a “laptop” some will be able to visually recognize the make and model, thus get a hardware specific “time”. If @Bruce is at a conference with a video link, an attacker will know the network address range and if @Bruce can be seen using his laptop from the video link of the audience an attacker can go through active connections from an upstream node one by one forcing a re-negotiation etc.

Cutting out the dull bits, it’s fairly easy to see if the re-negotiation has the right time signature or not. Once you’ve eliminated all the “not” wrong time signatures you are left with a small subset that you then have to gain other information on for a sufficiently positive identification.

Can you squeeze sufficient further information out of a re-negotiation? that I’m not sure of as I’ve not tried it. But I suspect other slower techniques used to identify time deltas of the main CPU XTAL frequency peculiar to each motherboad will work just fine (it’s one of the ways I identify services running on the same host but at different network addresses).

Clive Robinson • June 12, 2021 6:57 PM

@ SpaceLifeForm, Weather, ALL,

You mentioned the “floating point” denormalisation CPU hardware issue yesterday.

Oddly, I’m looking into a related subject.

As you probably know in assembler you have access to a flags register, so when you add two ints you know if the result is zero or has overflowed as there are flags you can branch, skip over, or jump on depending on your CPU. Likwise there are greater than, less than, and equall to branches etc in most CPU assembler instruction sets. As an assembler level programmer you just take it for granted they are there and just adapt your thinking as to if it’s branches, skips, or jumps in the CPU ISA you are working with.

However jump that chasam between the CPU ISA and a supposed “high level language” and there are no flags you can get access to…

So lets look at C because it’s used to write so many other “higher” level languages, they all inherit the same defect “no flags”…

So consider a multi precision library you define a structure of,

{
Ptr : to digit array
Ptr : to exponent array
Int : size of digit array
Int : size of exponent array
Int : flags
}

Or similar, where “flags” contains the sign bits, carry bits and zero bits for both arrays your low level algorithms fake. That way you only have to worry that the two arrays only have positive integers in them.

Now when you look at Knuth, and Menezes et al, they both give algorithms for doing multiprecision add. Likewise several Open Source libraries writen in C.

When you look inside those low level algorithms you see something that I consider “most odd”… As you are probably aware a MAD (multiply and add) instruction is a standard primitive for nearly all arithmetic on integers snd in most maths algorithms.

Well the “ADD” in all the cases I’ve been looking at is half as fast as it can be and uses twice the memory it needs… All because of the way the “carry” is implemented.

Look at it this way, lets assume an 8bit CPU it has two natural integer sizes 8bit/1byte and 16bit/2byte.

In assembler you would use the 2byte ints and uses “ADD with Carry” to add two arrays (U and V) to get a result in in a third array (W) withvthe lengthbof the W array being equal to which ever is larger the U or V array. Simple quick and fairly painless.

In C however with Char being an unsigned byte and Int being an unsigned double byte what you see is most odd.

You load an int with a char for both the U and V array and add the two ints then save the Int away in the W array. You then shiftvthevresult down 8bits so the W int hogh byte is now the low byte and add the next ints for U and V that each only contain a byte, and around you go working your way up the U and V arrays making a W array twice the size it needs to be, and only doing a single byte add as opposed to a dpuble byte add and doing a very slow 8bit shift… You then have to “fix-up” the W array to remove all those redundant high bytes.

Without going into the nitty gritty, you can do a two byte “int add” and care not that it overflows because you can easily check with a fast compare that is if the result is less than the smallest of U or W a carry would have been generated.

Thus you can do 2byte int adds using the memmory efficiently, not having to do the mind numbingly slow 8bit shift down of the high bit and with half the number of add operations so only half the number of loop iterations and no fix-up required.

It strikes me as odd that from what I’ve seen every one does the equivalent of byte sized adds in 2byte ints…

Just wondering if you’ve ever seen anyone do it the more efficient way?

And if so where?

Clive Robinson • June 13, 2021 5:19 AM

@ Weather,

As I said assembler is generally straight forward and if I was only dealing with one CPU architecture and a sensible optimising compiler that you can use in-line ASM macros in it would for both speed and efficiency be the way to do it…

But when talking 1byte and 2byte ints CPU architecture, there is one “truck-load” of CPU architectures which whilst the all do an add with carry and the bottom of the loop test is more or less,

Compare LoopCNT with MaxSize

(though there was the compare-branch in one RISC design which always struck me as odd).

What happens next is where the “fun” happens… Some CPUs might or might not change the “carry flag” on a compare as the CMP is actually a SUB (sometimes “one’s complement”)… so you have that little prob to deal with, but if you are lucky you just get the Zero flag set for equal thus the simple,

Branch if not zero LoopTop

Or on CPU’s that use “skip”,

Skip if zero
Jump LoopTop

But weirder ones where you can only branch or branch on zero and both only backwards, and all jumps are forwards forcing Do-Until loop bottom testing unless you like complex constructs,

01 Jump 03
02 jump 25
03 CMP R1 with R2
04 Branch zero 02
.
. Loop block
.
24 Branch 03
25 …

Some even futz with the carry flag on the negative branch… (thankfully these are now rarer than “hen’s teeth”).

So doing things in a C compiler starts making a whole load of sense not just for code reuse but the average coder’s sanity.

But… the compiler will often be some dialect of K&R not ANSI / ISO, thus “native CPU ints” of “unsigned”. As “sign bits” are a “whole different ball of wax&resin” to chew on, if the CPU even supports them in hardware…

Which when you think about it, it realy need not as they are just a programmer convenience “artifact” bought at the expense of CPU instruction time[1]…

[1] That’s why some early generation programmers like those writing Reg Transfer Logic (RTL) or the Microcode that sat on RTL, realy did look “Einstein hair-do mad”, with optional inch and a half wide “good old boy suspenders/braces” as well as two inch wide belt, both of which you could easily tow a truck with… Oh and the all important waist coat / vest to show they were “thinkers not doers” The colour of which denoted “status”[2] much like martial arts belts do these days, but being based on “gown colours” with black being the starting or default with white being the top 😉

And before you ask yes I have my own waist coats but as with our hosts @Bruce’s shirts, mine are not plain (and I don’t button them, unless I don’t want to be disturbed like “Office Door Policy”). Oh and there is the European “Shirt sleve” policy. Professional’s do not roll their sleves up also collars and cuffs should be white for those who are “desk” managment fastener with links for those who have personal assistants / number 2’s. Sleeves are only ever rolled up when “examining or operating” something much as with medical practitioners. Thankfully “belt and braces” have morecor less faded out these days, but there dress signals still apply. What many in the US call “The IBM look” is actually “off duty” informal for “officers”, business suits for “formal” or “duty of base”. With the On-Duty “dresses” being No 1 – ceramonial/parade, No 2 – formal, and then these days just “working dress” on base or in public sometimes called “soft top” due to head covering not being a peaked cap. Oh and then “field” or various levels of “battle dress”.

[1] The “waist coat” or “Vest” tradition is perhaps best known at NASA where Gene Kranz used to get a new white one made by his wife for each mission.

Clive Robinson • June 13, 2021 7:02 AM

@ ALL interested,

Yes I have to write code for “odd machines” which range widely in capability…

Some where CPU might actually be “Custom FPGA State Machine” for getting a 5-100 times speed up over traditional Consumer Off The Shelf(COTS) CPU’s you find in PC’s, Smart Devices and IoT and the myriad of “rack servers”.

But I also still have to do stuff with “the cheapest of cheapest” used in “instrument heads” which can be 8 or even 4bit microcontrolers used in the likes of Industrial Control System(ICS) sensors or two-wire “control pannels” (think a switch or shaft encoder with bit banged RS232 output). Or what some now call “Dumb meters” for utilities providers and even “medical electronics” and “robotics”.

The expression “Full Spectrum” realy does not cover it, like “Full Stack” stops a long way short of the depths I dive into.

The problem is, people are finally waking upto the fact that even instrument heads and two-wire interfaces need to be secure these days, as you have not a clue what some twat will do between sensor and operator control desk to shave a few cents of “operations costs”.

Well even low grade security these days means what was not so long ago “munitions grade crypto” restricted by international agreement[1] being the minimum requirment.

With such crypto comes the need for “multi-precision” integers be they for just logical operations or arithmetic operations. Which means you have to build the equivalent of upto a 512bit ALU. Or software equivalent.

You would be surprised at just how many “microcontrolers” do not have “Wallace Tree multipliers” or “Barrel Shifters” that do things in minimal clock cycle counts.

Also the clock cycles to save power are in the “less than 100MHz” range not the “greater than 1000MHz” range your PC or Smart Device uses where burning 10-50Watts of power in an “idle loop” waiting for user input is taken for granted… Some microcontrolers draw picoamps (10e-9) in standby waiting for a wakeup interupt from what might be femtoamp output sensors (think differential moving plate capacitor instead of a moving contact switch).

Adding inefficient code be it in cycles or RAM is a non starter.

Adding machine code is likewise a non starter.

Like @MarkH I do multi precision add without worrying about “overflow” thus you do,

W = U + V + C

Where the only issue is C moves the goal posys left and up one.

Think of a two bit add of U+V,

-00 -01 -10 -11
-01 -10 -11 +00
-10 -11 +00 +01
-11 +00 +01 +10

Where “-” is no carry and “+” is overflow or carry which you do not need to see it just helps explain.

Which is the same as with no carry in thus C=0

With carry in the table is

-01 -10 -11 +00
-10 -11 +00 +01
-11 +00 +01 +10
+00 +01 +10 +11

Thus you have to take care how you decide how you set the carry out because the result can equal not be less than the lowest value of U or V

That is,

W = U + V + C

00 = 00 + 11 + 01

As “code is sequential” this is just a matter of testing C before you test U and V agsinst W thrn set C appropriately.

But the “standard refrences” programers would reach for if implementing multi-precision for crypto, such as Knuth or Menezes et all, don’t show this. And the stand alone multi-precision libraries I’ve looked at don’t either…

I get the feeling they fall into the MAD primitive thinking.

That is rather than have seperate MUL and ADD primatives you think of “Multiply then Add”(MAD) as an atomic primative as this is a universal primative for all polynomial based (ie radix) arithmetic including matrix maths.

[1] Here’s a document from the end of the last Century about the imolications of the Wassenaar Agreement,

https://www.cyber-rights.org/crypto/wassenaar.htm

Where even putting a “Linear Feedback Shift Register”(LFSR) in a product was viewed with deep suspicion and often significant bit length restrictions (16 bit for checksums and error detection / correction codes being about all that would get the nod).

It’s realy not much better even today, there are hoops, loops, rings of fire, and other “dog show” style impediments put in the way. One such being “Electronic Code Book”(ECB) being “suggested” in a way that says “do you think yer big enough?”.

Clive Robinson • June 13, 2021 2:45 PM

@ Weather, All interested,

First you need to understand a little fact that an optomising compiler should know if you make “C” local in scope to the loop block…

W = U + V + C

Is not equivalent to

W = V + C
W = U + W

Or any other combination using two adds.

This is because the compiler would recognise that C can only be 0 or 1 thus a single add of U + V with the assembler code starting with “add with carry”(ADC) not ADD would add C in at the least significant bit, so in assembler the C compiler would set the real CPU carry flag as appropriate.

Why would it do this, well in a standard ALU Logic operations are “bit wide” and done in parallel, but Arithmetic operations are “bus wide” thus carry has to propagate across however many bits wide the bus is, thus 64bit adds are slow compared to 64bit clears, complements etc.

One thing you find a lot of students misunderstanding is that a SUB is actually a “two’s Complement ADD” but importantly with only one ADD not the two adds implied by,

R1 = U
R2 = V

R1 SUB R2 :
R2 = R2 XOR 11…11
R2 = R2 + 1
R2 = R2 + R1

W = R2

Smart compilers look out for such savings because INC (++) and DEC (–) are actually not ADD 1 or SUB 1 due to tricks you can pull with Fast Look Ahead Carry generation (no I’m not going to go through it, it’s way to laborious). Also CLR R1 and XOR R1, R1 are the same microcode using just the XOR bit wide logic instruction that is built in of a “full adder” (look up the design of the logic in a 4bit “bit slice” ALU like the 74181 TTL ALU chip[1].

Mad as it might sound the design of wide adders is not a done deal, thus is still an area of active research.

But getting back to the loop block

i = 0
X = Array size
C = 0
LopTop
. M = MAX Of (U[i],V[i])
. W[i]=U[i] + V[i] + C
. If C==1 and (W greater than M)
.. C=0
. If C==0 and (W less than M)
.. C=1
. INC i
. If i is less than X
.. Then branch to : LoopTop

If you check the tables you will find that “droping through” from the If C==1… That clears C into the If C==0… Does no harm to the results. But you do get some flexibility if the CPU does “odd” branching.

[1] https://en.m.wikipedia.org/wiki/74181

Clive Robinson • June 13, 2021 7:00 PM

@ SpaceLifeForm,

From s_mp_add.c

/* zero the carry */
u = 0;
for (i = 0; i dp[i] = a->dp[i] + b->dp[i] + u;

/* U = carry bit of T[i] */
u = c->dp[i] >> (mp_digit)MP_DIGIT_BIT;

/* take away carry bit from T[i] */
c->dp[i] &= MP_MASK;


}

Looks like it’s still using an overflow bit that gets shifted down by MP_DIGIT_BIT into an int for holding the carry ‘u’. Then a mask ‘MP_MASK’ to remove the overflow from the number.

Clive Robinson • June 14, 2021 3:17 AM

@ SpaceLifeForm, ALL,

The code I cut-n-pasted from s_mp_add.c in TomsMath code is “deficient” in certain characters…

Becsuse the “smiley filter” on this blog “silently swallows them”…

[que grinding of teeth noises off stage left]

So look up the original code on git hub.

But the point remains it generates a “carry” by wasting memory thus CPU cycles that it does not need to do.

Whilst on PC’s most don’t care about memory usage inefficiency, they do care about what they get for CPU cycles so the question still remains,

“Why use a method that requires twice the number of turns around the inner loop?”

Especially when you consider the hidden “pointer arithmetic”[1] that accessing large arrays can have with some compilers.

[1] Pointer arithmetic in C is “done out of sight” and it can be a real “health hazard” especially in loops. It very much depends on how good the compiler is at picking up “hints” in the source code. One solution is to do it yourself by using the sizeof operator outside of a loop to get a constant that you can then do your own simple “Add and Compare” pointer arithmetic with, rather than let the compiler throw in multiplication or other CPU cycle hungry operations. But as @MarkH notes, things are, different on different CPUs (sometimes even in the same ISA family such as the IaX86 family). So you should manually “walk through” the compiler assembly output and run tests.

Clive Robinson • June 14, 2021 8:02 AM

@ Fake, ALL,

With regards The Grugq, whilst he does get somethings right, he sure makes some howlers…

This one made me laugh like you would not believe,

https://gru.gq/2019/11/02/security-thinking-ruined-secure-messengers/

The first few paragraphs are a compleat nonsense,

“Secure instant messengers are a miracle of the modern age… …Modern mobile phones are the safest and most secure computers available, anyone can get one.”

Sorry but as I’vr said repeatedly and explained why that’s a “truck-load of bull crap”.

Anyone buying into that thinking is doomed from the start.

The only correct thing in there is the rather astute Charlie Stross observation

“Telephones connect places, mobile phones connect people.”

But even that kind of misses the meta-data issue of the age old “follow the money” which along with other physical resources can “track back” if care is not taken.

That said though The Grugq’s further points have some validity appart from,

”
1 – Ephemeral messaging”

Which unfortunately is based on an invalid assumption, even though for ordinary crypto and secure apps is all to true.

Thus,

“Firstly, once a message has left your control you no control over that menage anymore. That is very literally the first principle of communications.”

Is actually NOT TRUE.

To understand this you have to understand how “Perfect Secrecy” based on “True Random” can give you not just “plausable deniability” but “actual deniability”[1].

When you do and you follow the rules correctly, it’s game over for Second Party betrayer as their alleged evidence only convicts them not the first party…

Thus the notion of “Arms Length Anonymous Managment Of Sources”(ALAMOS). That is it has full message content deniability and if used correctly the message can be broadcast as plaintext over as wide an area as you want.

An early version of this idea was the code phrases broadcast by the BBC to all German occupoedvor influanced areas prefaced with “Now some messages for our friends”. The actuall phrase was selected randomly as a “code word” the person who had the code book with it in could look it up and read what the actual message ment.

Much in plaintext carries redundancy that can be exploited. For instance the set of phrases,

{Dear Sir, How Are You, I hope this finds you well, Hi, Wotcha, Hello, …}

Are all replacments for each other if you have eight of them then you can obliviously send three bits of information in plaintext in plain sight. If you use an OTP to change the actual three bits to what can not be told appart from truely random then, there is no correlation possible.

Obviously you can expand this. To as many bits as you want with phrases that have random content such as,

“We should meet up for XXX”

Where XXX is from a set like,

{tea, coffee, meal, drink, beer, lunch, breakfast, supper}

The real trick is to get the Second Party to generate the OTP written in their own handwriting and send it to you… If they are even half smart they will know that the evidence will only point to them and them alone… Thus betrayal is fairly pointless.

But the real take away for everyone is to know that Politicians and Law Enforcment has already lost the “golden front/back door” arguments, and they can not win[2] them ever. Thus they can be questioned closely on what their real motives are (setting up a “Police State” etc?).

[1] I’ve explained this in the past and how you can use it to various levels. But to start thinking in the right mindset remember that the security of a One Time Pad, is not that the original message can not be recovered it can, but “That all plainrext messages of the same or lesser length as the ciphertext are equiprobable”. Thus even though you are seen sending a message the true message is only recoverable by having a copy of the “true random” keystream. Thus even if the second party beytays the first party all they can show is they have a ciphertext and an unverifiable key stream that is easily arguable they created themselves for their own reasons… To make it even more deniable you actually send innocent plaintext messages and use an interesting form of covert channel within them call an “oblivious channel”[2].

[2] An oblivious channel is one with a proofvof “Perfect Security” in the same way an OTP has. You can look it up on Wikipedia and the like, but it was made public back in 1984 by Gustavius Simmons. He described it by posing the “Prisoners problem” that is a highly constrained communications environment. The important point to note is that exploits “randomness” that is inherant in an othereise structured format. Thus you simply use the OTP principle to hide the communications securely in the plaintext message. The important point for the First Party is never to “act on the secure message” they send to others, otherwise that provides circumstantial or better corroboration if the Second Parties betrays the First Party. Instead the First Party should act on the visable “Open plaintext message” as though it’s valid and fully above board, thus providing corroberation that what the open message is actually valid.

Clive Robinson • June 14, 2021 9:11 AM

@ Who?, SpaceLifeForm, ALL,

in the last years firmware has become incredibly powerful but, at same time, incredibly convoluted

Various members ofvthis blog raised concerns over all asspects of Firmware in Flash years ago.

Oh and Pre-2007 hardware, you are looking nearly a decade to late, it was untrustworth by 2007.

As you note “old hardware” is becoming like solid gold hens teeth, just something you hear talked about and never see for real. Nor could you tell it had not had it’s ROMs pulled and reprogramed before you acquire it…

Thus the question of,

“If you can not verify how can you trust?”

There are solutions to this and they can be found described on this blog in various places.

But the first step is to realise that you can work with hardware that will betray you, just as you can work with systems that have low reliability in a high availability environment.

That is use three entirely seperate and unrelated hardware systems to do the same task then compare the three outputs. If they are all the same then the probability is up at near 90% you’ve not been betrayed.

Thus you can improve that by running “check work” where you know what the answer is thus can tell if the system has “switch states”. This then means that hardware in the betraying state will be detected. Which forces the attacker to only betray once in a while. With three systems the probability that all three will only betray when you are not running “check work” can be made arbitrarily small.

Hence “Probabalistic Security”.

Conceptually or in theory it’s easy to understand. However in practice it needs considerable care to get right but it can be done.

The next problem is segregating your nearly trustable system from external influance…

This is easiest if the system is only a generator, that is it has no input other than the initial seed and it just sits their generating output.

However even getting data out is problematic, as the data rate incresses the need ti check for errors etc rises. Thus any error mechanisum that is not “Forward Error Correcting” only is going to have a “back channel” input that can be exploited by an attacker.

I could go on bit I suspect you get the jist of the complexity of the problem.

Oh and any input back channel or otherwise can contain an “oblivious” transfer subliminal covert channel (see my above post).

Each of issues that arises will have ways that they can be eliminated partially or fully, but only if you can recognise the possability of their existance…

Which gets out of the “Known, Knowns” (white swans) territory to the “Unknown, Knowns” (black swans) or “Unknown Unknowns” (platupus) territories.

Clive Robinson • June 14, 2021 7:54 PM

@ SpaceLifeForm,

Maybe I am a Buffalo.

The opportunity that afords for jokes is immense[1]…

So I shall go for the essoteric and simply say,

“Watch out for Young man with Springfield”

[1] Turns out “Buffalo buffalo buffalo” is a valid sentance as “buffalo” also means “to bully”. Worse after that you can just keep adding buffalo…

https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffalo_buffalo_buffalo_Buffalo_buffalo

https://en.m.wikipedia.org/wiki/Buffalo_Springfield

https://en.wikipedia.org/wiki/Springfield_rifle

Clive Robinson • June 14, 2021 8:56 PM

@ SpaceLifeForm, Fake,

Security Theatre, This will not leak… Sounds cool… Sounds great… Wait, wtf?

I do not do TechCrunch any more on principle –I do not agree to be data raped– thus I would encourage others not to use them.

But that asside…

Am I correct in thinking it relates to,

https://support.google.com/a/answer/10741897?hl=en

And Client Side Encryption(CSE) that has been in beta for a little while?

If you read the document, you will see that all Google are realy doingvis moving the “Key Managment” thus follow on leagle issues from them to a third party supplier…

As for “in browser” security, I simply do not trust it going back to the earliest days of “hushmail”.

Realistically the “security end point” issue I highlighted back with secure messaging apps still applies.

And let’s be honest Google is doing things to Chrome that are weakining it’s security so the answer to the question of “This will not leak…” is like that in a Christmas kiddies pantomime when the “Dame” makes a comment and you all shout back “Yes it will”.

I suspect it’s a “technical fix” to the NSL and similar Google get from the FBI fronting for other US Federal agencies and other LEAs etc that costs them real money to process via the legal dept.

Now all Google has to do is just send each agency a stock letter saying “Not possible to comply so ‘cease and desist'”.

I suspect Alphabet calculate that the FBI and DoJ psychos are still a little wary of Big Silicon Valley Corps after the calamitous result over the very public case they started against Apple. Apple unexpectedly for the FBI DoJ psychos faught back big style with lots of adverse publicity flooding in on the FBI and DoJ, who then had to humiliatingly “Pull the rip-cord” after it became clear the case was going to go against them and make adverse case law…

In a way Alphabet / Google are “Firing a warning shot across the bows of SS FBI”. Which means the FBI will go after the “Third Party KeyMan service” be it an organisation or via malware against a companies own service.

Either way Google does not get the “butchers bill” or “bad publicity” and can maintain the fiction of “clean hands” just as Pontius Pilate supposadly did[1] in the Bible.

Will the FBI “double bluff” and try calling Google on it… I suspect not at the moment. Because I guess the FBI and DoJ psychos will keep pushing their golden key front/back door nonsense at non US legislators just as FBI Director Louis Freeh did during the 1990’s. Working on the theory if they can be persuaded other nations, then the resulting foreign legislation can be used as a fulcrum to jam a lever up agsinst US legislators (see the nonsense that Australia have enacted).

[1] We get the expression “To wash our hands of …” from
Pontius Pilate’s alledged actions via scriptutes, thus some now regard him as a Saint and a myrta because of it…

https://en.m.wikipedia.org/wiki/Pontius_Pilate

Clive Robinson • June 15, 2021 3:13 AM

@ SpaceLifeForm,

If you Downgrade Attack a cell modem connection from 4G to 2G, does it smell?

It will fairly soon…

2G has been pronounced dead, but has refused to assume the position in some places… So in theory is rotting away, but it grasps firmly to resources others want, like an aged miser to their gold.

Likewise 4G should be eventually be told the same thing but… There is 4G LTE that delivers today what 5G might but cirrently does not and actually may not for various reasons.

And some for geo-political reasons want 5G dead now, hence the lack of push back over that definate over cooked if not roasted beyond caramelized smell in the vicinity of masts…

Apparently 6G has the Microsoft piz azz[1] look, much is promised bells will have their own whistles and dogs will do back flips through hoops on fast moving buggies and the 6G world will have peace prosperity and loads of apple pie…

But that’s all marketing bumf, the reality is as US industry know, that the technological capability is not there…

But the truth is actually the technology is there, it can be seen in 5G, but owned by the wrong sort of people… So MAGA will not fall from heaven, thus milk will not flow nor will there be honey all because… But never let the truth get in the way of a good marketing campaign Microsoft never did or will.

[1] We realy need to drop the “z” spelling for the “s” spelling on that one.

Clive Robinson • June 15, 2021 5:11 AM

@ Curious,

I think Fermat’s last theorem has to be wrong, in thiking that cannot be an infinite amount of primes, but ofc I am no mathematician so I can’t prove this with a calculator.

Primes are a proper subset of integers, so if integers are infinate then most intuitively would think incorrectly that a proper subset could not be infinate…

Are you aware of Cantor’s diagonal argument where he proved that infinities had infinities (used by Turing as part of his argument about the halting problem)?

Thus it can be said that between every integer there is an infinity of real numbers some of which are rational but mostly irrational. Thus as the axis of a graph produce a frame within each square an infinite plane exists, which is usefull when you are trying to keep things out of sight.

Now are you aware of Factorials? If intergers are infinate then factorials must be infinate as well.

Now we come to the notion of “Twin Primes” that is three numbers in succession, a Prime an even number and another Prime.

Now something not many are aware of that I spotted before I was a teenager.

Twin Primes can be found either side of factorials or partialy degenerate factorials. More interestingly they are also found either side of the Prime’s equivalent of Factorials.

That is 3! is 6, 5 and 7 are it’s twin primes, 30 is 2x3x5 29 and 31 are it’s twin primes.

Knowing this you can make a way better Prime sieve especially with very large Primes than the “Sieve of Eratosthenes” you would have been taught in high school[1].

Thus the expectation is that twin primes of this form must be likewise infinite… But are they, that’s the question but more importantly is what I’ve said so far a proof?

Whilst it might be the start of reasoning out a proof, we know it’s not a proof because there are known exceptions to the general rules.

That is 4! is 24 flanked by 23 and 25 and we know 25 is not Prime but a Prime squared.

I won’t go into any further into the maths detail other than to say the Prime Factorials are a proper subset of Factorials and as with Primes and Integers the same relations are expected to hold thus are expected to be infinite. Which in turn implies that those Twin Primes that hug them are very probably infinite as well.

Why? Well intuitively think of Primes as “waves crossing the X axis” they form patterns of reflection around those Prime factorials. If you actually draw them out the structure realy hits you in the eye. It’s also a beautiful structure, whilst the artists assertion regards “Beauty is truth” is an unprovable statment at best, there is a germ of truth in it as any engineer, scientist or mathmatician will tell you “If it looks ugly it’s probably wrong or you are looking at it wrong”[3]. Which begs the question is it a fundemental to the universe or just to humans, where pattern recognition and various forms of symmetry recognition are survival traits?

[1] But… I should give a “health hazard” warning at this point with regards cryptography. Knowing this means that there is now a whole class of Primes you should avoid in cryptography. That is finding a very very large Prime Factorial is fairly trivial when you know a few mathmatical tricks with serieses[2]. Then using that as a point to reflect around to sieve around is likewise trivial by using a pre-generated look up table. Thus using such Primes is something that should best be avoided…

[2] There are a lot of such tricks but one very simple one you night find of use when doing mental arithmatic, to start you thinking about the others. And more importantly why they are highly sort after by mathmaticians and such a danger to cryptography…

Take a long string of sequential integers that is even in length of N integers. Cut it in half and write the second half in reverse order under the first then add them together. So for the first ten digits 0..9

01234

98765

99999

You get a constant of which there are N/2, that constant is simply “first digit plus last digit”. Thus to add up all the digits one by one to get 45 is hard work compared to calculating 10/2=5, 0+9=9 and 9×5=45 which most can do in their head fairly rapidly.

[3] I think many would agree that “the software industry” clearly did notvget the memo…

Clive Robinson • June 15, 2021 6:12 AM

@ GNU,

Restating Goats question @Clive what do you think about stallman?

That is a very loaded question.

And whilst I’m not a politician, I’m also wary of both walking on uncertain ground and needlessly playing Russian Roulette, even if it’s only using my feet for target practice.

So what can be said that is “unemotive” and “factual” from a more distant view point?

Well there is a very clearly visable political process going on that is bigger than Stallman, which he has been unfortunately caught up in. Likewise there is clearly “alternative facts” being thrown around by people nobody remembers anything about or of them saying anything back then decades ago…

What can be said of Stallman is he is “Non neuro-typical” and in some ways lacks what is called “emotional intelligence” which is now treated as a life long disability. It’s considered very bad form to kick somebody about just because they have a disability, or just are different it’s one of many “isms” that are not acceptable in modern society, and never should be. Which is why practicing quite a number of “isms” is actually a criminal offence in it’s own right.

A visable side effect of non neuro-typical reasoning is the need to both drill down and explain as the person reasons their way through a complex problem to find answers, looking for evidence as they go. But importantly their viewpoint changes as the process progresses. Likewise they do it without putting on “conceptual filters” as that would be at a minimum intellectually dishonest, worse “pre-conceptions” are often the root of many evils not just “isms” in the world.

However others for some reason regard such filters as “essential” or “God Given truths” which they most definately are not, presuambly because they do not have to thibk or reason and find false comfort and stability with them. A form of intellectual limitation, which usually results in significant cognative bias, as we have seen over the last year in wider society with the likes of Qanon and Anti-vax and a lot worse (institutional murder of Blue-on-Black etc).

Those with cognative bias will rarely if ever change their view point, it is as though they have been religiously indoctrinated and thus ride off to their chosen “Holy Land” to slaughter those they see as “Heritics”. They believe without evidence of any kind they are “Morally Right” and generally they form the core of what is a boat anchore on society moving forward. Thus even though apparently “radical ” the reality they are mainly uconservative and unthinking, thus fairly easy pickings for those with political agendas who do think a little, even though it is that of Machiavelli’s ploting and scheming (see the “Dark Triad” for motivations).

Thus you have a compleatly stupid “We are the Good guys” mentality that uses the excuse of “For the common good” to enforce “might is right” by “mob rule” and trite mantras, going to war. They are the modern day Don Quixote’s tilting at giants only they can see, whilst others see the productive machinery of windmills being destroyed. Are they any different from “ludites” throwing their clohs/sabots into the machinery?

The best thing to do with such people is to give them a wide berth and let the inevitable infighting commence that will eventually deal with their education / evolution / demise. History shows many examples perhaps the most commonly known is the French Revolition, though there are many others that are a better fit.

So knowing what the likely out comes are going to be, I’m going to exit quietly stage left and let them get on with it.

Clive Robinson • June 15, 2021 12:24 PM

@ Goat,

I can’t say about his personality or ethical background, what Clive says seems reasonable to me but “maybe” he isn’t a good person

My personality and my ethical backgroind like those of other people have two parts, the inate and the learned. It’s why people can change one way or the other.

But am I good or bad, that’s not upto me, it’s how others see me. That is if you hold a viewpoint and I agree with it you might believe me to be good, however if I do not agree with your view point you might believe me bad. You could also see me as basically good bit just disagre with the topic under discussion or the way I present it. But is how you or anyone else views me actually relavent[1]?

What is important is the argument I make, the reason I make it, and can I justify my position in an honest and what would be considered a trustworthy way?

It’s then upto the person who hears my argument to decide if my argument is reasonable. Based on what can currently be established, and what it is reasonable for me to know the two are not the same[2] and the party hearing my argument may know things I do not and vice versa.

But then we come to a real thorny problem. Is the person who hears my argument open to changing their own point of view?

If they are not open to change, what does that make them? What does it say about any view they might express about me rather than the argument I present?

The original reason I did not reply, was a deficit of information on my part. I’ve had an opportunity to look into some of it and now my reason has changed. I realise this is not something I realy want to get into for the reasons I outlined above.

You are free to look at my argument and decide on what you know if it’s realy an area you want to get into yourself.

Because even if you limit your scope very narowly, others will not let you do so. You will be pushed proded and accused by those who have already made their minds up and are not going to change it. Further they will not care if you are a good or bad person, they will just see you asva target to attack in any which way they can.

Worse if you are seen to win the argument by others, they will not acknowledge that they will either become more dogmatic if not rabid and if that fails and others support you they will simply slink away to somewhere else they can self justify bad mouthing you to others.

If you doubt this, all I can say is so far you’ve been lucky in life. Don’t change your luck now it’s not worth the price you will end up paying.

[1] Good men can make bad argument for all sorts of reasons and the opposit is also true.

[2] I can not be expected to argue for or against information I’m not party to, but I can make argument for the future based on knowledge of the past in general not specific terms.

Clive Robinson • June 15, 2021 4:40 PM

@ SpaceLifeForm, Curious,

We now create N=2x3x5x7x11x13x17x19x…

Another “Prime Factorial”.

Oh maths trivia “Prime Factorials” were given the name Primorial by Harvey Dubner[1], who drew the analogy to primes similar to the way the name “factorial” relates to factors… The symbol used for Factorials as most know is the “Shriek” ! And very much less well known is the symbol for Primorials which is the “Hash” or what some call the pound symbol of #

And… You have “Primorial Primes” which are those Prime numbers I talked about as being the potential Twin Primes stradling a factorial or as we now have the term Primorials.

Thus your,

We now create N=2x3x5x7x11x13x17x19x…x
Q + 1

Which is the upper Primorial Prime of Q# (ie Q#+1).

@ Curious,

If your head is spining a little bit don’t worry it usually all makes sense rather sudenly, and then you wonder why it seemed so daunting.

[1] Harvey Dubner coined the name Primorial back in the 1980’s if memory servee correctly, in the arly 90’s he was the discover of more than half the then known “large primes” and he was an electronics engineer and he and his son built “filters” using DSP components that out performed state of the art super computers at the time. Though he later moved to using FFT’s… So if you ever wondered why both the NSA and GCHQ advertised for specialists in these areas you probably now have an answer. He is also the author of what is known as the Dunbar Conjecture,

https://en.m.wikipedia.org/wiki/Dubner%27s_conjecture

Which is still an open problem. If somebody solves it, it will have some interesting concequences both theoretically and practically. Probably the least of which is it will answer the “Twin Primes” conjecture that they are in fact infinite. Sadly he died back in 2019, but he has left a rich legacy behind.

Clive Robinson • June 16, 2021 3:13 AM

@ Goat, Winter, ALL,

Edited to add: I meant even if stallman isn’t a good person does he deserve this?

I urge you to look beyond just RMS.

He is not the first to be attacked in this way in the Open Source movment, nor the first in STEM to be attacked over a failed political plot involving a restaurant without a basement, that got entangled with the claimed behaviours of a Billionair and others in public facing domains.

Then start asking the question of why? By examining those making allegations, accusations or doseminating them, and who they are connected with and what the result of their “15 minutes of fame” are for others.

But aleays,remember “Public Opinion” is a Beast that is awoken by rummors, allegations and accusations that are vague / damaging but have little or no substatiating evidence. The Beast once roused needs to be fed blood to be satiated thus go back to sleep. We used to call it vigilantism, but these days it’s become “A Sport” for spectators to invest further emmotions in.

But remember the Beast of Public Opinion must be satiated because it has been invested in by thousands who neither think nor reason just do. Thus the raw power and energy built up by such investment becomes unpredictable and earths out like lightning where ever it can causing much damage and mostly the where or who is only obvious with hindsight.

But is it random? I would argue increasingly not these days as where there is power to be manipulated there are those who will do so.

As I’ve noted before there are thre basic “types” of racist, but it’s more generally true as well,

1, Those who are basicaly failiures in their own lives or who feel they are in some way, thus use tribalism to vent.

2, Those who have been harmed by some one of a recognisable group thus blaim all in that group / tribe[1].

3, Those who profit by tribalism who stir it up one way or another for money, power, status, or some combination.

The first type are often Bob Altemeyer’s Authoritarian followers who all to frequently form the nexus of “Guard Labour” or “make work” jobs, where the only reward is “faux status”[2].

Their “faux status” is due to a “trickledown” effect from those who form the third group, who subscribe to Joseph Stalin’s view of “useful idiots” or similar such as “Any fool can be a Tool”, “Use’m, Abuse’m, Destroy’m” all on the “Wash, Rinse, Repeate” cycle principle.

Between the second and third group is an interesting group, who took money or enabled others to be recipients of money whilst turning a blind eye, and when it went bad as it was very probably going to. So to protect themselves they scapegoat others thus maintain their cosy little makework positions. You would be surprised at just how many “Administrative” decisions are made this way, as the “seat stuffers” close ranks for “herd protection”. Such behaviours but closer to the third type are “seat stuffers” closing ranks for for “herd protection” in Politics, as they “protect leaders” and the like “For the good of the tribe”.

So take a good look for who benifits most for bringing down “figureheads” both in the short term (journalists) and longer term (competitors) and just how cheeply such defenestration or decapitation brings the third type rich rewards without them getting their hands dirty.

For an ineptly done example have a look at Microsoft’s past behaviours especially in the repeating SCO case.

As I’ve said you need to be aware there is a broader context involved and the Beast is not yet satiated, thus there is the potential for it to earth out close to you.

[1] I use “tribe” as a “collective noun” that is a group of individuals who chose to collect together for a shared reason. I could use “club”, “gang”, “troop”, or other collective nouns such as “gaggle” or “squable”. However which ever I use others will ascribe additional purjative meaning that I most definately do not intend. However even if they do not give voice they will implicitly assume I have “Bad Faith Intentions”. Tribe however is a recognised term that gives rise to other words with specific meaning such as “tribalism” which other collective nouns do not have, thus arguably it is the correct term to use.

[2] http://iclinstitute.com/The_Authoritarians_–_Short_Synopsis.pdf

Clive Robinson • June 16, 2021 6:05 AM

@ name.withheld…, ALL,

Just to let you know we are on the same page. You and I have, in the past, received or have been on the receiving end of meritless claims of a misogynistic, racist, or of some other set of poor behaviors. Your cause as I understand it is more to humanism then away from it.

Yes I believe in humanity, not vengeful or otherwise inventions of those whose cupidity and basic lack of morals lead them to prey off of others who just wish to survive and with a little luck be both happy and thrive.

It also means that I have to be accepting of peoples mistakes and accidents, which in theory could be avoided but in our practical reality can not.

I’ve been told I have an open mind, by the same person who once quiped,

“The trouble with having an open mind, of course, is that people will insist on coming along and trying to put things in it.”

My parents tried to bring me up to be responsible, not just to myself but others as well, sadly I was orphaned before they had got beyond the foundations, thus never saw it they had succeeded or not.

Life as an orphan is not to be recommended, it’s difficult to build on uncertain ground and being preyed upon by others almost a given. Some call it “The University of hard knocks” but the reality that most do not realise is that you do not graduate, because it’s “Life Long Learning”.

Making things easier for people to learn has always been one of my primary drivers, and sounding cautionary notes from history is part of that.

Whilst Sir Isaac Newton was being very rude with his “standing on the shoulders…” comment, the truth is we stand on the successe and failures of those who have been befor us.

Thus we actually have more to learn from failure than we do from success.

Success can be by chance or planning, but few ever see the usually way less than perfect planning only the trappings of the success.

Analysing failure by testing it and finding out why it happened teaches us way way more.

Our host has pointed out in the past that to be able to design good crypto/security you first have to become expert at breaking it.

Security design is one of the hardest forms of design there is. For most designers they, like insurance assessors, work with statistical averages of effectively non determanistic causes with predictable effects.

In security design you also have to deal very much with the opposit. That is very non average, very determanistic causes, usually with highly unpredictable results.

Thus as again our host has pointed out “You have to think hinky” to many “hinky thinking” apprars like some kind of “sixth sense” the reality is in the general not specific attackers are predictable thus you get to see patterns and these can guide you. Examining why things fail and adopting good “Testing Techniques” makes the process more exacting and also broader in scope thus further reaching especially towards likely specifics.

Few tricks are new, but new variations thus new “instances” pop up all the time. The secret to the design is not just recognising the underlying trick, but collecting it together with other tricks with common properties, thus forming “classes”. You then design against the class not the instance.

There are two good reasons ICTsec is in the mess it is and why it has become a “Red Queens Race”,

1, ICTsec as an industry does not learn from history.
2, All the time is spent fighting instances not classes.

Unless we learn that failure is to be not just expected but learned from neither of those is going to change. I think many know from their high school education what happens when a species does not change in the face of a changing environment.

What is true for ICTsec is actually true for Society in general.

Because one of the most important parts of society as we know it is,

“The Freedom that Privacy gives us”

Without that Freedom we can not experiment, learn, understand and grow. Anything that stops that process has only one eventual outcome.

Privacy is only possible through security, thus security is fundemental to our existance.

Those of concervative view fight change thus growth, those that religiously or similar stop the spread of knowledge fight learning and thus understanding, and those that are totalitarian in view fight privacy thus stop freedom and are the ultimate human existential threat.

It’s this we see behind nearly every injustice in society. But importantly as has oft been poinyed out “No man is an island” we all live in society even when we think we do not, thus whilst society has responsability to see we all get treated fairly and with understanding, the individual has to realise they have a responsability to society and all within it.

Unfortunately when it comes to “Personal Rights -v- Societal Responsability” some thing they have entitlement to the former without the latter. That can only ever end badly for all, because we all grow as society grows.

I would rather be a nonentity with what modern society has made available to me, than live in times past where I might have high status but a short, nasty, brutal and in reality impoverished life of near now groth and fudal explotation.

Yet we see modern day War Lords living short, nasty, brutal and very impoverished lives. You realy have to ask Why? And What is wrong with them?

But it’s not just War Lords it’s many pushing for empty status that actually harms them not just others and can only have one inevitable outcome as history shows on nearly every page.

Clive Robinson • June 16, 2021 7:22 AM

@ JonKnowsNothing, Winter, ALL,

Re:

Be mindful that the USA has just declared “we’ve won the war on COVID-19”

My viewpoint is,

“We’ve not even won the first skirmish, in the Northern Hemisphere and we know our battle plan is a loosing one”

Which viewpoint you are closer to is upto you.

But look at it this way, even if you have been infected and recovered or are fully vaccinated the disease mutatation rate is linked to the current infection rate that we know is rising against expectations.

Thus at some point any immunity any one currently has is going to be of diminished effectiveness.

Thus there is a probabilistic risk.

The thing about such risks is we know that given sufficient time the probabilities become closer and closer to unity. Where a risk ceases to be a maybe but a probably or definately unless other risk diminishing activities are under taken.

We should all know by now what those risk diminishing activities are.

So I’ll just say keep doing and stay safe.

It’s what I am doing, hopefully my risk will stay lower thsn maybe 😉

Clive Robinson • June 16, 2021 2:36 PM

@ MarkH, ALL,

Since you posted your question, I keep looking at my multi-precision archives.

Yeh, for what should be a simple issue there sure as heck is a lot of different ways people do it.

In assembler you would expect different ways with different processor classes that is you would expect CISC and RISC to be different even if all modern CISC von Neuman machines are realy RISC Harvard machines internally.

But when it comes to high level languages, so many are basically writen in C with a smidgen of ASM you’ld expect a basic “standard way” to emerge, yet it appears it has not which is odd.

As I said I can not help but feel it’s down to the difference between how people view primitives.

Most programmers thing in terms of uniary(+,-) and binary (+,-,*,/…) whilst those dowing DSP or certain types of maths or ADT’s think of just the single trinary MAD operator. I can’t help thinking it’s those who think in terms of the trinary MAD where using only half a register width makes sense for the multiplication that makes the difference.

I’m probably wrong, in that they probably all came from high level language backgrounds and read Knuth on multi-precision and others coppied them without realising or thinking there might be a better faster more memory efficient way to do it. Asembler background programners more used to having to do their own pointer arithmetic and the like would know there were better ways. But then you’ld expect them to drop straight into assembler rather than try doining multiprecision in just about any high level language as they are ill suited to it due to not having direct acces to the flags register.

As a friend of mine often says,

“A bit of a doozy that one!”

Clive Robinson • June 17, 2021 3:11 AM

@ Winter,

There are only two ways to prevent 1% of the population to die from COVID-19, a cure and vaccination. Vaccination prevents disease, a cure limits the damage. Make your pick.

It’s interesting that you do not talk about the % of the population that will die during the prolonged period it will take to vaccinate people.

Or how the virus will mutate during that time.

We’ve had atlrast 4 Varients of Concern in a year that are considerably worse than the original two strains that were identified in China.

You only have to look.at the appaling death rate in India which could have topped 100,000 a day some believe likely (India has minimal to no effective health care outside of major towns and cities thus deaths do not even get recorded in some cases).

China got the infection under control by strong quarantine measures, they have no where near vaccinated their population yet economically and socially they are near back to normal.

Australia and New Zeland had area wide lockdowns and likewise got their economies and sociall lives back to near normal well before they started vaccination.

I’m sorry but there is quite a bit of evidence stacked up against the way you present things.

Whilst,

1, There is no medical cure.
2, There are apparently no effective medical theraputics (unless in pattent by big phama, but they appear at best minimally effective by independent observation and clinical trials and are eye wateringly expensive).
3, Currently medically only vaccination provides some protection and reduces your chances of going to hospital or dying.

But as I keep saying with the best will in the world, of which there appears very little politically, it’s going to take years not months to vaccinate even just the more accessable parts of the world that have nominally functional health care.

Thus we have to look at non medical limitations to the spread of the disease,

4, PPE and hands, face, space ventilate, is known to have stopped and some believe compleatly eradicated a fairly nasty flu varient this past “respiritory disrase season” in the Northern Hemisphere.

5, Personal quarantine for those at significant risk untill they could be vaccinated has by simple statistics been proved to work.

6, Local area lockdown has been proved to stop community spread in various countries and regional lockdow proved to work beyond reasonable doubt in Australia and their economy and social lives are back to near normal with hospitalisations and deaths from COVID down in single digit numbers and actual deaths below pre-COVID five year averages for infectious disease.

7, National lockdown of boarders has proved effective in many countries and their economies and social lives are back to near normal with death rates lower than pre COVID averages for infectious diseases.

8, Very wide area lockdown in China has stopped COVID and socially and economically they appear back to normall.

Thus quarantine in one form or another is very effective be it petsonal, local or regional.

So it appears quarantine in it’s various forms is the only evidenced based way we have currently to limit the spread of SARS-2, stop infections thus the attendent mutations, and bring society and the economy back to near normal, all whilst limmiting the horredus numbers of needless deaths, where such measures are not in place.

What we do know is certain “capatilist nations” in the Northern Hemisphere have only played at lockdown, supposadly to protect the economy… But that has failed absolutly massively, all to predictably (and was predicted on this blog as you know as you actually were involved with the predictions).

All that has realy happened is that vast sums of money have been transferred into a very limmited numbers of hands and they are busy using it to buy up assets to form an even larger “rent seeking” economy that only they benifit from.

The debt from this transfere is going to be paid by the ordinary citizens for the next four generations at least if not a lot longer. In fact it is likely in the US there will be nobody who is currently alive who will still be alive if the debt ever does get payed off.

Why you now ignore this and rail against some of the actuall evidence and avoid even talking about it is somewhat puzzeling. Not just to me but to one or two other long term posters.

Yes I appreciate you’ve been attacked by certain people who have political or financial axes to grind but denying documented evidence is actually playing into their hands, and they know this.

Clive Robinson • June 17, 2021 6:19 AM

@ Winter,

Indeed, but you will be unable to enforce a lockdown for another 50 years just because you do not like vaccination.

I’m pro-vacconation, especially the more traditional well understood methods of making them.

As for 50years I certainly hope not, in the UK we have an expression “stop gap measure” it basically means you have to do something to minimise harm whilst you bring an actual solution on line.

people will get sick and die waiting for vaccination. The lockdowns and quarantines were intended to minimize that death toll.

Which is my point and they are certainly working in many places and appart from long distance travel for short term reasons life has returned to more or less normal in those places. As for long distance travel for short term reasons it’s something that’s kind of just about half a century old at best and is in no way a necessity in life. It’s certainly not a right, in fact for political reasons our freedom to travel has been diminishing this century.

It does not stop the spread of SARS-2, it just slows it. We already see it coming back in waves every few months. But even if we can slow it enough to prevent waves, everybody will get infected eventually and 1% will still die, not this year, but this decade.

I think at this point you need to split things along what are eco-political lines. The reason it keeps comming back in waves in some places is the cupidity of politians on the take from lobyists in certain industries.

If the politicians had actually kept lock down on hard just under a year and a quater ago, for five weeks we would only have had a minor blip that would have died out and may well have made SARS-2 extinct as we did with SARS-1. But the cupidity of politicians in the whole of North America, UK, Continental Europe, right through Russia and the Stans along the Silk Road ruined that opportunity and there was absolutly no excuse for such behaviour. It’s condemed much of the World to Infection.

China on the other hand behaved in a way that Western Politicians would actively avoid. That is draconian as it appeared the got ontop of the infections and eliminated it from China in a relatively short time.

They went down the “Social Responsability” route even though it was harshly enforced at times.

The West especially the America’s for purely political reasons pushed the,”Individual Rights” agenda, and we can see just how much harm that has caused, and is continuing to cause as they head into what is probably a Third Wave potentially from a new way more infectious and harmful mutation. Which is coupled to political nonsense about “winning” that just is not true, but is in time for the Summer Holiday season to encorage ill afvised behaviours. Together they could easily make a third wave worse than the second wave. I hope not but you’ve seen what has happened in Brasil and India, the Americas could well see it happen to them especially as the UK figures suggest the Delta or Ondian Varient has an R0 of 6-8 with it more likely to be 8 now.

Oh and as Manus Brazil showed having been previously infected won’t of necesity stop you being infected again by a new varient.

Based on politics and neo-con economic driving, it’s not exactly difficult to predict where the worst hit places will be…

Vaccination will not stop the Delta / Indian varient becomming dominent or sweeping through populations that inyermingle freely. A lesson some are going to learn very much the hard way. Viruses care not a jot for politicians and their cupidity, but the next host they can infect. That will cause the virus to mutate into previously low risk groups and it’s a flip of the coin not evolution with this virus that decides just how harmful each mutation is.

Do we have a vaccine for the Delta varient, not as such and the existing ones are not as effective as they were. How long it would take to come up with a new vaccine is not realy development time dependent but getting manufactiring ramped up then getting the supply out and potentially revaccinating every body before a sizable petcentage of the population has evem had their first vaccine shot…

So potentially another half million US citizens in a bad way, with hospitals still close to capacity in many places.

Clive Robinson • June 17, 2021 8:57 AM

@ Z.Lozinski, vas pup,

Clive can tell you who I work for

I shall just sing ELO’s Mr Blue Sky, that should be enough of a clue 😉

As for “I may be biased”

Well just reading most large company house journals can give you a different out look, especially if they do domain R&D but is it realy biased… Probably not in many peoples view.

I must admit I’ve realy lost interest in Quantum Computing, I just don’t think it’s going anywhere any time soon except in very niche areas. Like AI it’s also fracturing into different technology type groups and lessons learnt in one group do not appear to be transfered onto other groups so the “square wheel” keeps appearing.

As somebody noted “The technology has potential, but when is the question…”

Clive Robinson • June 17, 2021 2:55 PM

@ Winter,

But if the UK would rejoin, how would the British public respond? A very large portion of them would still hate us even more.

But what portion?

What does not help is US President Biden thinking he’s Irish, and the US State Dept sticking it’s oar in when most EU diplomats know their policy is “To destroy Europe” as quickly and thoroughly as possible.

Like many EU politicians Biden realy has no clue as to what goes on in the isle of Ireland. To say it is delicately balanced is an understatment.

Thus you have the Catholics in the South and some in the North. And in the North you have Protestents that are realy rather right wing Scots descendants.

Scottish Politicians are a joke, but the one thing they appear clear on is they do not want the Protestants of the North of Ireland “coming home” especially their politicians. Though in general the people of both Northern Ireland and Scotland wanted to remain in the EU (the Welsh did not, even though they were doing the best out of the EU… So go figure that one) the problem is as nearly always the English Parliment in London.

Thus you have an interesting situation the Northern Irish Protestants who are realy Scots descendants pretending to be Dutch, want to be sort of English, and the English apparently do not want to be a part of the EU. The catholics in Northern Ireland want to be united with the South and presuambly also want to stay in the EU because they did not do to baddly out of the EU. The Scots if their politicians actually did something other than vacillate want to be out of the Union as well. As for the Welsh well where they want to be nobody is altogether sure including them selves.

Well at the G7 conferance things got a little unpleasant nobody appears sure what exactly the French President said but it’s been equated with saying that Northern Ireland is not part of the UK, which got him a fairly round rebuke even from his own diplomatic core.

Either he was trying to be cleaver and it failed or he was being a little ham fisted…

Geologicaly Northern Ireland and The South are indeed one island. Oddly perhaps part of Scotland is not part of the rest of Great Britain, nor is it part of Europe…

Now geo-politically the United Kingdom is not quite what people claim it is because of the “AND” Northern Ireland… Which does not make it a part of the United Kingdom but in effect a protectorate like the Channel Islands.

Any way Boris Johnson got all miffy about it and threw a few toys out of the pram…

Thus the US and France appear to many in England to want to “rekindle the troubles”… I’m fairly sure the EU does not want “Irish Terrorists” blowing up parts of Brussels, or Paris or even Berlin… But the US and France definately do appear to be trying to stear towards for the possibilitynt of making cheap political jibes/tricks.

Unless people wise up it is going to get messy, how messy is anyones guess and to be honest I don’t want to find out…

But as with Trump not being welcome in Scotland, Biden is rapidly making himself unwelcome in Ireland.

As for French leader Macron, he is not doing himself any favours anywhere currently. As for the lunacy of the North South Irish EU trade barrier it’s not going to work and never was, it’s best to chuck it out and go for a more rational approach. The EU not anyone else wants the barrier, so if they want it they better stump up the half billion or so Euros to get it working but then they are never going to do that, so a majpr festering sore is going to open up…

Clive Robinson • June 18, 2021 3:50 AM

@ SpaceLifeForm,

It’s not trivial, but it will definitely exercise your mind.

Err it depends on the type of your proof…

You’ve got the choice of mathmatical or graphical…

Clive Robinson • June 18, 2021 6:48 AM

@ Winter,

So, is it Odessa, Texas, or Odessa, Ukrain?

Apparently Ukrain.

But just been reading up a bit as it’s lunch time now,

According to one news report on the Internet, the Ukrainian authorities searched the first photo and 20 other properties only got six suspects and a small sum of money (apparently the criminals are supposed to have netted over a half billion dollars of which there is no sign).

But as to the others apparently it was a multiple forcrs multiple countries raid and although the number of people arrested has not been said, nor the number of places raided, what there was was full of perscription drugs, gold, bars, silver bars and many many uncased computers…

So as lunch is getting on for over further reading will have to wait till later, but both cases look fairly interesting…

Clive Robinson • June 18, 2021 1:04 PM

@ name.withheld…,

either a lot of false positives, and I mean a lot, or there is something wrong

To claim a war is over when the enemy has neither died or surrendered might likewise be considered that there is something wrong.

Like you I’ve seen where the figures are not matching those expected if other things are true.

Without wishingvto sound alarming the figures in the UK are not ehat would have been expected either

However the UK does a lot of genotyping per head of pipulation and the US does not. Thus we can explain the UK figures by the Delta (India) Varient of Concern that duevto having an R0 close to 8 has very very rapidly become the dominant strain and is probably near 2.4 times more infectious than earlier strains. Worse other information suggests it is closer to being vaccine avoident than other strains and more harmfull.

So those vaccinated are some what more likely to end up in hospital but unlikely to die, the partially or unvaccinated are not going to be as lucky.

But also the initial infrctious stage symptoms have changed and it has only the charecteristicsvyou would expect ofvthe summer sniffles or hayfever. That is what have been key symptomatic distinguishes such as loss of smell/taste, rash etc are not present so differential diagnosis is a lot harder and people who are infectious may just think it’s the summer sniffles and not get tested. It also appears to targetca younger age range as well.

But the R0 of nearly 8 is very worying it means community spread is very rapid (you infect 8 people on average). With the US “Opening up for Summer” a significant third wave could be on states like Florida before they even know it’s happening, with hospital saturation being the first but to late warning sign.

Over the next few weeks even if fully vaccinated I would still be somewhat retiring about being gregarious.

Simply because the cause for the apparently wrong numbers is currently unknown and waiting a short while is way lower risk than assuming they are just errors and puting it about.