Schneier on Security

Clive Robinson • December 25, 2021 3:32 PM

@ Ted, lurker,

Pegasus spyware and Chinese coding

Remember, why we have patents,

“Only one person invented the wheel, everyone else stole the idea!”

Also known as “The better mouse trap principle” only they don’t “beat a path to your door” to come to praise you but to rob you. Have a look at the history of SendMail, it will be instructive.

The basic point is, in software re-use is realy the fundemental driver of things moving forward, every one steals from each other…

It is actually when you get right down to it “more efficient”, also “more rapid” and very importantly “more chaotic”…

So maybe your question should be,

“Is it wierd we don’t see this more often?”

To which the answer is, actually we see it all the time with “cyber-crime” it’s “cyber-espionage” where it is rare.

As @lurker notes,

“Nope. You’ve entered the world of Spy-vs-Spy. Remember, attribution is hard.”

Or more correctly it is to do with amongst others,

1, Covertness -v- Overtness
2, Invisability -v- visability
3, Misidentification -v- Identification.

And perhaps most importantly,

4, Corporate -v- Governmental.

The last of which is about,

“The utilisation of resources to obtain desired outcomes”

We say “Level III” attackers but it only is a rating of “skill level” State attackers are very different to Corperate attackers.

The likes of GCHQ and the NSA “accumulate” zero-days, developing them to full exploits but importantly NOT deploying them. Because their “desired outcomes” is not normally monetary return but continuation of access. Corporations NSO in particular it is very much all about “monetary return” they have banks and venture capatilists to pay as well as having significant life styles to support. Therefore their “desired outcome” is to “turn the wheel as fast as possible whilst there is a monetary advantage to exploit.

NSO know that to make the levels of money they have to be,

“Seen in the right places, at the right times, with the right product, if some one can meet the premium price”

Therefore they also know that any exploit they use is going to have a short shelf life at “premium prices”.

So they pay high, develop fast, and move on with at best only a couple of exploits in hand to cover over their products being “discovered”.

And the important part to realise is the “develop fast”.

Because it’s not just “Proof of Concept”(POC) code they are developing but a whole “nose to tail” system. Having the worlds best zero day is pointless if you can not get it “producing product” your customers want.

The problem is when you think about it is that their entire “product chain” has to be as hidden if not more so than the actual exploit.

Because if some one recognises code from closer to the tail they can “walk back up the beast” till they get to the nose…

So there are two basic thibgs an organisation like NSO can do,

1, Sell a compleate package.
2, Rent a service.

If they go for option 1 they are going to have an unsupportable “burn rate”. If they go for option 2 then they can arrange things such that they “decouple” the tail from the nose by becoming the body. That is their customers only ever get to see the tail and the product they want.

NSO can thus build a sensible infrastructure element that turns raw input to finished product, knowing that it also acts as a limited form of “Delphinic Oracle”.

NSO can then take “Attack POC code” and weaponise it very rapidly and secretly as it is an “instrument” or “head end” they then need to develop the equivalent of a “neck”.

The “neck” has to be bi-directional so it needs some kind of “wall” to stop people observing and corrolating known NSO input points and walking back up to the “nose”.

When you think about it you will realise that they actually need to develop multiple “necks” for each “nose” thus development in this area is perhaps the most rapid, and actually the most difficult.

High value zero-days are not just rare they are sort after by many people. As I indicated to you over your “Why Argentina?” question you might only find one every half decade or so.

That is not a reliable business model to build on for what the likes of NSO does, they need a near steady stream of zero days to cover their clients needs.

Think about some of NSO’s customers, the NSO directors etc probably are right now whilst also thinking about the best way of disapearing “alive”… That is many of those customers we are getting to find out about, would not be the sort of people you would want to upset[1] and NSO just has done so, big style, courtesy of the US Government[2]…

So NSO were almost certainly running an option 2 type operation, with a high degree of need of flexability in the “neck” area of the process.

So fast, short time scale, high turn over, for what is very likely to be near bespoke, short product life, development… Code reuse from other people is almost certainly going to be high on the developers list of ways to deliver.

But if you doubt this East Europran Russian jurisdiction Ransomware found it had to move into an option 2 type operation. Unfortunately much as NSO has discovered, “You have to watch bot just your back but your neck as well”.

The one thing you should not doubt in any way is that other people have looked very carefully at the option 2 business process and whilst be it semi-legitimate or purely criminal enterprise have decided it is just way to high a risk to sell “intangible information products” under option 2.

I certainly decided long long ago that either option was not just workable as a process but also as a business model with “tangible physical products” such as electronic surveillance equipment. But… no way with “intangible information products” the risks were just way to high in many respects. It might have taken several decades for my reasoning to be proved… But NSO like ReVile are just the first of their respective types of business to prove it… I’m expecting quite a few more to find out in the near future. After all you can not expect to be gobling up $500million/year without somebody cutting in on your business any which way they can.

[1] We know what some of the “choicer customers” NSO were taking millions a month from, would not think twice about having people killed if they thought they were being short changed. Tyrants, Despots, and Dictators are by definition “not nice people”. Especially as they rate highly on the sadistic and psychopathic scores often with a large side order of narcissism to make them realy quite unplesant when they get disapointed. If you doubt that look at what the current leader of the House of Saud did, he quite litterly had a journalist “butchered” probably whilst still alive in a consulate surounded by CCTV. Then once “bled out”, “slain”, “jointed” like a pig, into easily managable pieces probably in refuse bags for easy movment and disposal… Then he went after the journalists employer both as an individual and as the owner of one of the worlds largest businesses. The House of Saud would have spent probably billions on this all whilst schmoozing with the worlds self appointed elite… But hey it’s only “US Oil Money” after all, and there is plenty more where that came from, just raise the oil price a cent or two on a barrel, plebty more cash to be squeezed out of US citizens and the like, and if the US won’t pay then China probably will do, and their weapons are as good as those from the US these days and probably better value as well…

[2] It is also more than possible that NSO have stood on one or two many US MIC corporate toes, so after a quiet word or two with the right people in the State Dept NSO find themselves “kicked to the gutter”. After all it also does give “leverage” over Israeli politicians, who may have been getting a little too –shall we call it bold or– demanding recently?

Clive Robinson • December 26, 2021 5:37 AM

@ lurker, ALL,

But this is anecdotal evidence, through the fog of war it is difficult to find real data.

It’s not “the fog of war” but “the speed of battle” two compleatly different things. Though if you are pined down with incoming all around and no coherant command handing out information on which way to go do you care which it is? Probably not.

With regards,

My informant in London says at that time and place vaxxers were all being given boosters of Moderna(mrna), don’t care what you had first time round.

It changes on a daily basis but yes as far as I can see it’s all mRNA not that they will give it to me.
You can look up on line what is being given and where[1].

Now to the more vexatious,

mixing the booster shots vs original, gives wider and deeper immunity

And,

whole virus vaccines … are showing better longevity and better response on newer variants than mrna or protein fragments.

Both statments are “sort of true”. It’s both complicated and whilst we do have in vitro (in glass/lab) results confirming the statments, we don’t yet have enough in vivo (in life/human) results for obvious reasons. The caution being “lab and life are very different environments” not least being the high mutation rate due to the high infection rate…

So the next question is,

“How much do you know about the ‘skirt effect””‘ in ‘Quality Curves’?”

Quality curves are not named after “Quality control” but after “Quality of performance” they look like “bell / normal” distribution curves but are more complicated. One such set of curves being the “Q curve” used in radio engineering for tuned circuits that have losses.

I’m not going to go into too much detail but assume the left hand axis gives “effectivness” as a percentage, and the axis at the bottom gives “specificity”. Importantly the area under the curve is effectively fixed for any given entity.

It’s fairly quick to see that very speciffic vaccines like the mRNA ones are very specific thus have very narrow skirts but high effectivness. The likes of “traditional” vaccines have very broad skirts so have lower effectivness. Where exactly the “center” on the axis at the bottom is also important as it can shift left or right as well…

For the first few SARS-2 VoC that had high pathogenicity (ie killed easily) you therefor wanted as higher effectiveness as you could get centered bang on top to save lives. However such narrow specificity means not that vaccine avoidence might happen, but “it will happen” which means the curve is nolonger centered on mutations especially VoC’s, as we can now see happening.

I chose Oxford AZ for my vaccine because it had a wider skirt, and was in Scottland at the time showing it was more effective because of the larger number of VoC’s it then covered. What I would have gone for if it had been available would have been a deactivated “live virus” vaccine like Sinovac. For two reasons,

1, It was a well tried thus well known process, unlike untried mRNA.

2, It has the broadest of immunity specificity skirts, even though it barely cleared the 50% effective marker (some immunity is better than no immunity).

Also being a deactivated live virus, it is more likely to give “longer lasting” immunity than mRNA because it hits more parts of your immune system in many different ways, giving more chance it will work with your unique immune system.

Which brings us around to “effectivness decay rates” it’s a complicated subject and thus prone to misunderstanding when “simply explained” so take this with a healthy dose of “it’s only an approximation for illustration”.

With time all things fail, that is they decay. It does not matter if it is from heavy use wear&tear or corrosion&seize-up from no use, it happens in the same way as entropy dictates, and it’s one of those fundemental “laws” in the universe as we currently understand it.

So obviously those effectivnes quality curves diminish with time.

Thus the obvious questions are “How?” and “How fast?”.

Well the how is generaly “reduction in area under the curve” which means one of three things,

1, Effectivness goes down.
2, Skirt draws in.
3, Both.

Actually it’s all depending on progression of time.

As Omicron appears to be of low pathogenicity but quite a way across from the center of the skirt, it’s “down toward the bottom of the skirt” that concerns us most (take a moment to let that sink in).

Obviously giving a booster will lift the area under the skirt but if it has the same center it’s not going to move it out very much. So if the virus VoC is too far off the vaccines skirt then it does not matter how much you lift the skirt it’s going to do next to nothing in “lifting percentage effectivness” for that VoC…

So giving a narrow skirt vaccine is not ideal, but if it’s all you’ve got…

Which is a very important concern and significant problem. Because drugs companies do not want to cure you or make you immune.

Like all “drugs pushers” they want your money or more correctly “highest price for minimum cost” so they want you hooked, and giving three boosters a year would be up the top of their fantasy list.

In vaccine production like most other mass production, by far the biggest cost is “up front” especially with mRNA vaccines… So whilst Big Pharma will “talk up” being able to come up with a twiddled vaccine, they have absolutly no intention of doing it any time soon, if ever in your life time. As long as the demand for the current vaccine continues they care not if it works or not, they will do nothing other than sell it…

Make of that what you will, but I know from experience of working in similar ethos mass production businsses in widely different industries (petrochem, consumer electronics) what it means.

[1] The UK “National Health Service”(NHS) has a web site where you can check the status of your local walk in center,

https://www.nhs.uk/service-search/find-a-walk-in-coronavirus-covid-19-vaccination-site

If you search say “Westminster” you get offered a choice of two, so selrct “City of” and the first option is “St Thomas’s” click on “See opening…” and you get some handy little tables for availability for various “age groups and jab types”. Note at the top they are a “Pfizer” site only. But… When you look down you will see the bottom two enteries are “Boster dose” [Available] and “3rd dose” [Unavailable]. Which is a problem for me as I fall in the “3rd” dose category. If you back button and go into “Hills Phamacy” you will see they carry both Pfizer and Moderna, but only Pfizer for booster dose (this is “suggested prefrence” policy). But… What it does not say, as it does at many walk in centers is, “IMPORTANT GP letter…” required. You can see the entire thing by back button then select “Montgomery Hall” and scroll down.

What is not mentioned is “There is a hole in the system!”… One of those “we will ask you questions” is “Have you been in hospital as an in patient?” and if so “Why?” if you mention “blood clot in the heart” then you might as well say you are “a leper” you would be more welcome. They insist on a GP letter… Which requires a “meet with the Doc” which many Docs are not doing… So in effect “Go home and Die” only they get upset when you put it as bluntly as that. The same thing happens if they look your records up on the National data base (the one they sold to US “SpysRUs Corp” Palantir for £1).

Clive Robinson • December 27, 2021 9:30 AM

@ SpaceLifeForm, JonKnowsNothing,

It really is at this point. The PCR tests are coming up negative, when people clearly know they are sick.

The problem with PCR is you have to know what you are looking for. And… If that thing disappears logically you can not find it.

So you need to look for several things, the more you look for the more expensive it gets and the more blured the results as when you get close enough in many things start to look the same (just four base pairs at the bottom). At some point there is a crossover and full sequence testing might as well be done.

Things going on in Australia…

I hear that they have decided because their vaccination rate is significant enough, that for low pathogenic varients with high infectivity, lockdown is going to cost more than it will save in the long term.

Part of this is being infected gives you immunity advantages over just being vaccinated.

I get the idea but I’m not qualified to say if it is good or bad my interests in science do not lean that way enough.

But the idea appears to revolve areound IgA.

Apparently IgA gets made when you get the disease, but not if you get vaccinated.

IgA exists outside of your body, and is found in bodily fluids such as saliva and mucus that line what are for SARS-CoV-2 the primary entry routes.

In effect IgA takes the battle outside not just the bastion but ouside and away from the baily as well.

Therefore even though you may be breathing the virus in, it has to get past the IgA before it can infect you. So effectivrly it cuts the potential infective viral load down. So making your bodies ability to fight that much greater in proportion.

But… IgA is not very specific so whilst it might be generated in response to Omicron potentially it will also work with all the varients of Omicron that are poping up, not unexpectedly.

That is it would appear to be Australians are thinking “broadening the skirt via omicron may be adventageous for not just society but the majority of individuals…

However as far as I’m aware omicron has not been around long enough to make definate claims.

Clive Robinson • December 27, 2021 11:30 AM

@ Ted,

With regards,

““This gives a maximum battery life of at least 11 years if the device never came out of sleep.”

I would say unlikely to near impossible in an AirTag. Even if still inside the battery manufacturers specialised packing and not as claimed “in circuit”. Very few battery technologies make it to a five year shelf life (even with fiddling the figures).

The latest comercial technology is a modified lithium with manganese dioxide arangment, where the msnganese dioxide “can” act as a stabaliser, but I’m not aware of anyone actually having had them in production long enough to verify the claimed 90% shelf life.

Lithium technology is a “wet electrolyte” technology, which has advantages and disadvantages. For instance in rechargable lithium cells whilst you can take power out of them below 0 Celsius, do not try charging them as you will strip the recharge life down to near zero. That is lithium technology has odd temprature characteristics.

But ask yourself what the impedence of atmospheric air at 100% humidity, 25 Celsius ay sea level is across a 1mm gap… Then you have to figure that into your “in circuit” calculations.

So[1],

1/(Rtot) = 1/(Rdis) + 1/(Ratm) + 1/(Rcrt)

Rtot : Total resistance, from,

Rdis : Self discharge resistance.
Ratm : Atmospheric resistance.
Rcrt : Circuit resistance.

As far as I can see Rdis and Ratm have been left out of his calculations. But what of Rcrt?

From other things the author claims, the AirTag will never be just in sleep mode… That is it wakes on a timer to do things like transmitting a becon signal and calculate new KeyMat, which if the author has identified the KeyMat type (PubKey) correctly is not going to be “CPU lite” thus the daily current averaged is going to be rather more than the measurment of minimal sleep mode current would indicate.

So the current given for the device draw is impossibly low as the device does not stay in “sleep mode”. Therefor Rcrt is lower than probably used in the calculation.

So very probably as I indicated earlier, somebodies math is to simplistic.

So the statment he made is wrong even in his own view, so why make it?

Especially as in real terms it has no actual meaning to the short term usage and security of the AirTag device…

Hence my comment,

“Treat what is said “With Caution”…”

[1] For those not instantly up on basic electronics, 1/(Rtot) is actually the “normallised voltage” current over a selected power cycle. If you want the “true current” it should be,

Itot = Vtrm x 1/(Rtot)

The problem is, even though some cells hold the loaded “Terminal Voltage”(Vtrm) fairly constant due to very low internal “Effective Series Resistance”(ESR), Vtrm does drop with increasing or peek current. So as the current drawn increases the more energy is disipated in the ESR component inside the cell. Which means that the actual power delivered to the circuit goes down with respect to the current drawn.

Vterm = Vint x (Rtot / (Rtot + ESR))

Clive Robinson • December 28, 2021 12:42 AM

@ SpaceLifeForm, Ted,

I’m sure that a signature of the Airtag firmware is verified by the parent device (iPhone, iPad).

Probably not, but it will probably happen now someone at Apple has read your posting 😉

It’s the way this blog appears to work, “the usual suspects” chat and suddenly “Researchers” and “Company employes” just happen to have the same bright idea or so they claim…

Clive Robinson • December 28, 2021 4:22 AM

@ SpaceLifeForm,

These 3 bullet points are carefully worded.

Yes, I’m aware of that…

Did you read my comment a little while back about using AirTags as “beacons” so you could track a users iPhone?

Well guess how that works…

Clive Robinson • December 28, 2021 10:05 AM

@ Ted,

What Apple devices do you think he is referring to?

Any that can pick up the broadcasts from the fake airtags, store and then forward the data onto Apple.

So basically all that currently work in the Apple network.

The important point to note though is “high latency” as well as low bandwidth.

The other thing is that the “Secure Area”, must be sufficiently large that not just the AirTag but a user with a “Store and forward” repeating device must be able to “get inside”. So potentially a room sized faraday cage not an equipment enclosure sized case.

Nearly all equipment I’ve designed for “Secure Area” use has been EmSec / TEMPEST screened such that the secure area can be just an ordinary 8ftx12ft army tent.

So the attack outlined is realy for people using COST equipment. Where the likes of “Sonic Security” / “Acoustic Cryptanalysis” has not been considered (it’s just one reason why I talk not of “air gaps” but “energy gaps”),

https://en.m.wikipedia.org/wiki/Acoustic_cryptanalysis

Clive Robinson • December 28, 2021 2:48 PM

@ AC2, ALL,

Sure Amazon plugged this particular type of problem but that’s pretty useless..

It’s an “unsolvable problem”…

Obviously what ever rules you come up with, in by far the greater number there will need to be exceptions…

Some years ago, a well known manufacturer of “electric shavers” came up with a “wet-n-dry shaver” for that extra special shave, and the advert showed someone putting the shaver into a sink of water… Apparently some people tried the same thing with mains powered electric shavers… And the fact you should not do so came as a bit of a shock to them.

Also a percentage of people are either not exactly bright or they can be malicious.

A machine is not concious, it feels no pain, and it has no social attributes unless we program them in.

We design computers to “do as instructed” and very annoyingly for many people, “they do exactly that”. Humans however in general do not work that way.

When Mom asks the teenager “Don’t you think it’s time to put out the trash?” it’s not actually a question and it’s certainly not open to debate. A computer would in effect reply with a “Yes” or “No” answer, as would quite a few of those on the autistic spectrum.

Human communications is “full of such richness”, the trouble is as the old joke has it sometimes “it promoteth organic growth, but it is very strong and none can abide it” to mean it’s kind of dropped out a bovine rear end…

How do you give a computer a sense of humour let alone irony or sarcasm…

Clive Robinson • December 29, 2021 1:57 AM

@ SpaceLifeForm,

Ignore any official numbers. They will be lies, just like 2 years ago.

That is certainly true for WASP nations in the Northern Hemisphere. As far as we can tell the UK and US were and probably still are the biggest liers, and certainly fiddled the figures every which way they could it was so obvious to anyone who had eyes to observe and use them (it’s why I called out very early on to look at the “excess death” figures).

As for what China is doing it looks like “fogging” with something like hydrogen peroxide or the more recent “electrolised brine”. The former breaks down into water and oxygen rapidly, the latter is like bleach and does break down fairly quickly.

Will it be effective?

That depends on your goals and the route you want to take to reach them.

If the intention is to get people off of the streets for various reasons then the fogging is probably more effective than a water cannon at a riot.

One of the reasons for the rapid spread of SARS-2 in the Northern Hemisphere is people not taking things seriously. Especially with bogus claims for political reasons.

But one of the primary reasons for people not taking things seriously is they do not see politicians and public leaders taking things seriously. In fact mostly the very opposite, as a result now we have developed a “Do as they do, not do as they say” culture.

All to often we hear from supposed leaders “You don’t want to do that because it will panic people” it’s basically FUD as is “think of the children” to push through another unstated agenda, or an excuse to do nothing proactive.

As far as the UK is concerned, we have consistently had some of if not the worst figures in real terms. We are without doubt the “Dirty man of Europe” if not a much wider area. Mainly thanks to our politicians and leaders doing just about everything wrong. One of the few things we did get right in the UK was “sequencing” because by chance we had sufficient equipment to do so.

So perhaps the UK and if the current trends are correct[1] the US as well should get their houses in order first, before we throw stones…

[1] It has been reported that in Manhattan at testing centers they have a more significant number comming through, but more importantly over 50% of the people are testing positive. Whilst this does not mean 50% of the population of Manhattan have Covid, it does indicate a rapid rise in community spread, and yes people will die because of it.

Clive Robinson • December 29, 2021 2:14 AM

@ SpaceLifeForm, ALL,

RE browsers, passwords and account lists.

I think it’s fair to say that with regards security, just about every thing browser developers have done since the earliest days is just wrong.

So badly wrong you can not help but wonder who is paying them and why.

I would have thought most developers should know the difference between storing a “plaintext list” and a “hash list” and the advantages of the latter, and the serious security disadvantages of the former.

Is “user convenience” really that important?

Clive Robinson • December 29, 2021 5:49 AM

@ ResearcherZero, ALL,

Once you have experienced an atrocity, or anything in the ball park of [one], you certainly don’t want to experience it again, yet humans remain proficient and prepared to commit them.

The reasons for atrocities are few and excuses plenty, but at the root of it is fear.

Take one atrocity from history,

We call him “Vlad the Impaler” and whilst he is still a hero in Rumania for what he did in the 1400’s mostly in the West we think of him incorrectly as “the real Count Dracular” of Bram Stoker’s Victorian fantasy stories of blood, lust, and power.

The atrocity Vlad is mainly remembered for is the impalement of the 20,000 mostly Turkish prisoners used to line the route to the capital

But few stop and ask why Vlad did it and what did it potentially achieve?

Well the route would have been taken by an invading army of such superior forces that it could not be defeated by normal means and Vlad was aware he was outnumbered potentially 25 to 1.

Well the gruesome line of impaled certainly deterred the Ottamans and several others, and so brought a form of peace and potentially saved lives and captivity in slavehood for many (hence his hero status).

With regards,

Even the Buddhists do it.

Perhaps you should say who it was against?

Buddhists have long been persecuted by Muslims, and some of it in more recent times at the end of the last century in Bangladesh have been described as “genocidal”. Previous persecution by Hindus is resurfacing in India and then there is the behaviour of the Chinese still going on against Buddhists.

Buddhists feel significantly threatened, and with good reason. Within living memory they have had many atrocities committed against them, and for various economic deprevation and similar reasons their monasteries have a lot of angry young men within them.

Unfortunately for many mostly peaceful muslims, others have made the thought of reappearance of such persecution and genocidal behavioirs come to the forefront.

As noted by, Alan Strathern, fellow of History, Brasenose College, Oxford,

“The global climate is crucial. People believe radical Islam to be at the centre of the many of the most violent conflicts around the world. They feel they are at the receiving end of conversion drives by the much more evangelical monotheistic faiths. And they feel that if other religions are going to get tough, they had better follow suit.”

Fear or the use of it can be not just a powerful political tool, but a very dangerous and vindictive one that can go down the centuries.

Recent goings on in the Middle East are in no way going to ease these perceptions, with knowledge of Vlad the Impaler having detered an army that would otherwise have been impossible to defeat, perhaps people can see why such things can and do happen…

Clive Robinson • December 29, 2021 7:13 PM

@ SpaceLifeForm,

Seriously, it’s going to rip. There is no way it will not happen.

And as it rips, it will become anew in a difrent guise… This we know with almost certainty.

What we don’t know is which way it will go…

Obviously to have any real run it will either have to jump aways along the bottom axis, so it is “as new” or it will have to be more infective.

If either of those happens then we will have to see what else might have changed for better or worse O’heck jumped in the gentler direction, but the next could jump the other way. Pick up your coin and flip…

Clive Robinson • December 29, 2021 8:05 PM

@ lurker,

Vaccination does not prevent one getting infected, or spreading the virus

That is because it’s moved along the bottom axis, and is comming out of the shadow of the skirt of various vaccines that were realy “to specific”.

There was an anouncment from “Scotty in Marketing” the other day anouncing a new policy of “get it for free” as being in doors in nice weather and away from your friends and work colleagues is apparantly not Skippy’s way now.

Clive Robinson • December 30, 2021 8:18 PM

@ JonKnowsNothing, SpaceLifeForm,

In the USA the military triage units are being deployed (quietly).

In the UK the disasterous “Nightingale” units idea is being “dusted down” again… This time with what appears a little more thought[1].

Let us hope things don’t go “long” as we realy don’t want the return of the TB Santorums.

[1] There will be eight hubs of 100beds, this time colocated with hospitals that have respiritory disease competence,

https://www.bbc.com/news/uk-59823652

One hospital on that list I’m already an out-patient at there respiritory disease clinic. I have been for over two decades now, due to having had my head karate kicked into a street sign back in 2000… If the hospital is competent or not is an open question. ICT wise I’d say not, as I’ve said before, they have lost laptops with my medical records on them on three seperate occassions they have notified me of.

Clive Robinson • December 30, 2021 8:30 PM

@ SpaceLifeForm, ResearcherZero, -,

Caught on recent 100. Already disappeared.

Yes, the traits you indicate suggest that it’s how was it last put “the Troll Tools beating away at it again”.

I was wondering the other day if a reaperance was about to happen as a few of those stupid comments that try to be offensive have poped up suggesting someone was testing the waters again to see how fast @Moderator responded.

Clive Robinson • December 31, 2021 3:52 PM

@ Ted, lurker, null clam, ALL,

Re: Apple product QA

Once upon a time back in the 1960’s we had the start of what has become known as “Fast Moving Consumer Electronics”(FMCE). Basically the use of the then new transistors in their tiny glass envelopes compared to even the smallest of Tube/Valve triodes and pentodes enabled manufacturing to stop being hand wired on “tag strip” and made on “Printed Circuit Board”(PCB) not just conveniently small but that could run off of flash-light/torch batteries.

Not surprisingly manufacturing moved fairly rapidly to the “Republic of China” which we now call Taiwan.

One of the issues of mass production is it is asymetric. That is shipping to customers is considerably less expensive then shipping a product back for repair under guarentee.

In fact the cost of shipping back just one item from a customer could cost more than any profit on six or more shipped to customer items.

Back in the 1940’s and 1950’s British industrial manufacturing was running into reliability problems and it was looked at “academicaly”… The result was the foundations of what we now call “Quality Assurance”(QA) from the “British Standards Institute”(BSI) and later other Standards Organisations.

When put in place effectively QA reduced the number of manufacturing defects significantly and stoped the Far Eastern Manufacturing going bankrupt.

An unwanted side effect of this as far as Western Manufacturing was concerned was that manufacturing in the Far East got cheaper and cheaper in comparison so jobs went overseas or as we now say “outsourced” or “off shored”. A form of “short-termism” that has significantly damaged Western Nations economies and made them not just dependent, but critically so on not just potentially hostile nations, but dangerously over optimised supply chains, that fail at the tinyest of issues, be they a pathogen that can not be seen, or a ship geting “piloted” into the banks of a canal.

And it is this “over optimisation” that is the primary root cause of most issues. In essence neo-con thinking is that there can be bo ineficiency and productivity has to be not just increased but increased whilst reducing costs…

The result of such thinking is that things have become so fragile, not even the briefest flutter of a butterfly’s wings at one end of a supply chain is needed to create a chaotic storm and massive failures at the other.

If people do not realise this by now, then they need their heads examining, which is especially true of the so called “Chicago School” where the examination would best be done by the application of a “4 be 2” process, untill the recipient fully understands the error of their ways…

But it might prove difficult because of the Upton Sinclair observation,

“It Is Difficult to Get a Man to Understand Something When His Salary Depends Upon His Not Understanding It”

And those Chicago School Deans etc have the nicest of offices, confrences and lucrative book deals. Because they know what certain individuals want them to write.

Look on it as the “neo-protestent work ethic” just as false as it’s always been but spread by the modern MBA acolytes rather than the tardy priests that had diminishing power to excercise.

The thing is it’s gone to far, this optomisation is now destroying manufacturing.

The expansion and bursting into flame of certain types of lithium power cell is well known, even to the public with both Boeing and Airbus passanger aircraft effected, samsung phones burning peoples ears and neather regions and back in the 1980’s the likes of electronic door locks burning doors down.

Apple has absolutly no excuse the problem seen with their battery is well known not just in the FMCE industry but in nearly all electronic design from those knocking circuits together at home for school / college projects all the way through to aerospace with billion dollar craft.

Some of you might have heard of Alan Sugar who founded Amstrad back over half a century ago. He decided to move into “Cordless Phones” and got his own team of engineers to design a range of phones for him, and he wanted it manufactured in the Far East. The company I was working for at the time was asked to bid for the work, so a group of our engineers went over to his office, to go through the design. It was immediately clear that his designers new nothing about NiCad rechargable batteries. Not only was the charging circuit wrong which would have critically shortened the life of the batteries the design had the batteries in the wrong place and importantly there was no easy way to change the batteries… Alan Sugar “was not a happy camper” when our team explained this to him. We did not get the job, not because we could not do it, but because he sacked his designers and went back to the drawing board… So problems with batteries and wireless handset phones is not exactly a new problem.

Apple have consistantly gone down a road of making repair by others increasingly impossible as they make vast profits from it, over and above the ludicrous profits they make on the products themselves. Worse this profit is kept off shore to avoid paying any real taxation on it. So Apple have actually gone beyond a point of no return on their finances, so they have to find a way to generate money back on US soil so they can pay for setting up US manufacturing.

If I was a suspicious person I would say that this defect was actually deliberate to cause a much shorter product life, that pushing a very profitable for them “repair or replace” cycle onto their fan-buoi customers who have a very high value for X from,

X = money / sense

I got wise to Apple racketeering four degades ago, what puzzled me then and makes me shake my head with disbelief these days is why people still fall for it.

Clive Robinson • January 1, 2022 8:29 AM

@ name.withheld…, SpaceLifeForm, -, Winter,

One ringy dingy…

And similar such as,

hxxps://www.schneier.com/blog/archives/2021/12/friday-squid-blogging-squid-headed-statue-appears-in-dallas.html/#comment-397805

are what I regard as “early warning” of sounding out the @Moderator response time.

Clearly designed not to trip a “naughty words” filter, but also to be significantky offensive, in a particular faux juvenile manner.

The time/date of “December 30, 2021 10:53 PM” should be raising a flag.

Clive Robinson • January 1, 2022 8:48 AM

@ SpaceLifeForm, name.withheld…,

I spotted this loophole two decades ago.

Did you also spot what else went on?

Allegedly the new routes were advertised from China, and that was where the trafic was sent via.

But as pointed out at the time due to BGP’s entire lack of security, the real origin of the new routes could have been from anywhere via chosen routers etc…

It was only later the NSA were caught on photograph with “their hand in the cookie jar” putting implants into kit being exported.

It was in response to such behaviours that the Chinese brought out legislation baning certain US and other kit from parts of their infrestructure… Which US politicians made such a hoo-har avout at the time.

So yeh the USG SigInt agencies and compliant US Politicos, got outed over time. Not that the compliant US MSM would print such “trails of evidence”.

Clive Robinson • January 1, 2022 5:25 PM

@ name.withheld…, SpaceLifeForm,

A ceiling, at zero degrees directly overhead, some altitude beyond 20 miles, is considered space…

Yes and no, it depends on how you look at it. There is a lovely bit of dialogue in the file The Martian, where Matt Damon goes through why he is a “Space Pirate” that explains the situation rather well.

Put simply, “yes it is space” but under intetnational treaties “any territory not on earth” is “international waters” thus subject to all sorts of funny legislation including “Maritime Law”.

There is a whole bunch of legislation that the “International Telegraph Union”(ITU) of the “United Nations”(UN) put in place with regards intentional EM signals, which makes “spying on individuals communications” questionable at best.

It’s one of the reasons the US in particular has tried to make the definition of a “terrorist”, or “agent of a foreign economic power” etc so broad that they can claim buying the likes of dog worming powder etc on the Internet a matter of “National Security” so they can claim an exception to the treaties and agreements.

From the 5eye perspective you are “conspiring” with an “agent of a foreign economic power” when you buy via Ebay, Alibaba, etc anything that has originated in part or whole from abroad… So just aquiring and using your mobile phone, smart device or most other electronics means you have,

“Conspired with an agent of a foreign economic power”

So you are all legaly targets because you use electronic devices…

Whilst a court if faced with this might rule against it, it makes a wonderful “collect it all” excuse, and the trick with “standing” will be used to keep it out of court.

The first time I had reason to think about it was back in the 1980’s with the failed UK spy satellite “Zircon”,

https://en.m.wikipedia.org/wiki/Zircon_(satellite)

What is not mentioned in the Wikipedia article is that the design got a major near “from the ground up” redesign/rework atleast twice. And to make it all more difficult there were a significant number of unexpected deaths in the Marconi teams involved.

The first major redesign was for “mobile phones”… Back in the 1970’s mobile phones were very very few and were effectively “Car Phones” and used VHF frequencies. By the earky 1980’s cellular Analog Mobile Phones (AMPS) in the UHF bands were fairly readily available and designs for fully digital systems such as D-AMPS and those based on DECT Cordless were quite common (look up “Rabbit Communications”). In the end the Zircon design could not keep up with the plethora of standards being turned out.

The second redesign was due to the US Government reneging on “special relationship” agreements. It became clear to the UK during the Falklands War that agrements about use of satellites was “one way” which is why Zircon got put on a faster time track. The US having agreed that the UK could use the “Space Transport System”(STS) or Space-Shuttle to put up satellite’s started to get evasive on launch dates etc. Thus Zircon had to be redesigned to be of a smaller diameter so it could be rocket launched (the same thing happened to the UK Mil-Com Skynet satellites).

Then engineers involved started dying unexpectedly in what looked liked staged accidents / suicides and the word went around not to join any of the teams involved. It got so bad it is said by insiders of the time that Marconi were threatening engineers not just with being sacked but “never working again” if they did not transferre over to a Zircon team…

I found out because I knew someone who worked in Marconi, and he was looking very depressed. So a few of us took him out one night for a “Beer and Curry” evening. He got a little drunk and told us about what was going on and how he had been told he might have to move down to Portsmouth. He asked us to keep it quiet but said if he died suddenly we were to tell people. It was then that we realised he was not depressed but scared half out of his mind.

He kind of got lucky, in that his mother became seriously ill and he had to take increasing amounts of unpaid leave to take her to hospital etc and look after her. As a result his name got taken off of the “potential list” for Zircon work.

Mind you he did tell one or two funny stories. One Mil satellite system he was designing, the use of Spread Spectrum came up. As he pointed out “the bloody thing moved around so much” that it was already “Spread Spectrum”.

One of the things to come out of the UK Skynet system was the use of “Surface Acoustic Wave”(SAW) filters to “fast lock” onto satellites. In effect you could use them to make programable “matched filters” which could “lock-up” a receiver about a hundred times faster than conventional tracking loops pushed by US designers. Apparently this was such a surprise to the US MIC it actually gave the UK Government a barganing chip in the “special relationship” but as with most UK politicos they blew it…