Schneier on Security

Clive Robinson • February 24, 2022 6:32 AM

@ Winter, ResearcherZero, ALL,

The question is why the oligarchs invest heavily outside Russia, while the influx of investments is much smaller?

You’ve not been reading this blog, as that question has already been answered.

But…

For several centuries Russia has been a parisitical Empire. It needed no industry, or economy, because by oppression and worse it stole from other nations.

Putin has done nothing productive to build the Russian economy, all he is doing is “strip mining the land” to bring in foreign currency that he then spends on enriching himself (40billion at last count) and several others such as corrupt officials like himself, Oligarchs, Russian mafia, and other criminals.

In order to stay in power at home he projects “strong Russia” with a fake history of the Rus, and achievements they never made. To many Rus have bought into this nonsence (a bit like “trickle-down in corrupt capitalist nations).

The Russian people have a stark choice, send there sons and daughters of to be cannon fodder in Putin’s imperial dreams of “Strong Russia” or realise the only hope to have great grand children with a future is to stop the “Strong Russia” nonsens, get rid of the corrupt officials oligarchs, mafia and similar and invest the money being stolen from them in education and industry.

If they did opt to build their economy, they would have in twenty years way more than Putin’s “Strong Russia” can ever bring them.

The danger is “sentimentality” for faux past glories, of arts and other high culture. The Rus never created it, it was all imported at the point of weapons from other nations they oppressed or traded with. But “sentimentality” is an infectious disease as deadly as any plague. You can see it developing in Germany where they are drinking in Putin’s fake history.

As for the corrupt politicians, oligarchs, mafia etc, the reason they keep there ill gotten gains out of Russia is two fold.

1, They don’t want to loose the power it gives them.
2, To force multiply that power they do not want it building a Russian economy which would fairly quickly turn on them.

I hope that answers your question.

Clive Robinson • February 24, 2022 8:00 AM

@ ResearcherZero, ALL,

With regards,

“claims to stand up for the family and traditional values against a decadent west that has lost its way and has tried to corrupt Russia.”

Those appear to be good things but they are not.

Firstly “the family” is always the point of attack against society carried out by religions and cults.

The purpose is to get at the very young through their mothers, and also turn the mothers into “breeding machines”. But also instill a rather nasty situation where the family is dependent on the cult for all social and often work activities. Therefore an individual that tries to defect has no family, work, friends, etc and becomes not just a “nobody” but an “outcast”. The “lockin” advantage of this insiduous behaviour is immense.

But remember also small children don’t lie, because their concepts of harm and betrayal are not developed. Therefore their “teachers” use them as spys on the family…

Secondly “Traditional values” is a compleate “crock of fertilizer” that burns and destroys rather than promotes growth. You see it in “ultra-conservatives” who still think humanity made a mistake giving up “witch hunting/burning”. It’s a way for them to give themselves “status” at the expense of everyone else. It’s about vanity used as a pupet for power. Look at it this way what did it cost a King to turn someone into a Baron or lesser noble? Next to nothing, but, the enobaled had fiduciary obligations to a King. So the person got the vanity status of a title that they had to pay for to keep. This turned the noble into either a fool if they were mainl narcissistic, or a useful tool if they were mainly psychopathic. It’s why all offices in the church above a certain level had to be approved by “the god head” of the King whi had “divine right”. The King ruled by maintaining a balance between the barons and the bishops. With both of those paying him, and keeping the populous under control.

What you are told are “Traditional values” are mainly faux nonsense, designed to keep you in servitude. One such is the almost modern nonsense of “The protestant work ethic” where you worked yourself into an early grave, keeping “your betters” in a lifestyle where there life expectancy was around twice that of the “workers”… The promise for your early demise, was “a reward in heaven” a purely invented concept to justify not giving those who produced the wealth a share of it… The modern version of this is now “rent seaking” where you as a worker are prevented from owning inflation proof or anti-inflation assets. To see why, if you own two houses, the first you live in, the second you rent out for the equivalent of the average working income, which means you get a comfortable life style without having to work… Each subsequent house you own gives you either a better lifestyle, or the abiliry ti by another house or other fiscal wealth generating assets. Oh there is a tipping point around five homes where the interest you pay on loans depreciates significantly and a second one, around ten homes where the excess income alone is sufficient to enable you to purchase another property without a loan…

The real value of inflation to those of status, is it keeps the poor poor and without assets, and them wealthy not in fiscal wealth but in real wealth of rentable/earning assets and with sufficient income that always rises at or above inflation.

Thirdly and importantly Putin’s message is not to “Russia” but the Rus, a disparat ethnic grouping that unfortunately have in many cases a sentimental outkook on a faux history of past glories, and what those glories could be again with a “Strong Russia” Empire. The reality of this stupidity can be seen with what has happened to Belarus (White Rus) and will happen to the Ukraine and anywhere else Putin can push his poison.

The thing about Empires is that only the self appointed have status thus wealth, the rest are conned by nationalism to become the cannon fodder to feed those of status in their wasteful power strugles against each other, where any wealth they obtain is wasted on buying “guard labour” and the like.

The reason Putin has 40billion stacked away, is not for his lifestyle or that of his family, but to ensure that he maintains his position to exploit not just those he despises as inferior or fools, but the “useful idiots” who keep the “fools” in check by oppressive means.

The problem is that the Rus fall for his stupidity, they actually welcomed his interferance in Belarus… And look what they got for their foolishness. The same is going to happen to those breakaway states after the party is over its back in the sweat-shops making wealth for Putin and Co…

With women relegated to the all important task of “baby making” so that there is sufficient new “cannon-fodder” coming through to oppress even more nations and their peoples… The thing is Empires are unstable, and colapse usually very quickly. There is no longterm future in “Strong Russia” it needs a functioning economy and it’s not going to have one as an Empire is almost always a patasite that ends up consuming not just the prey but it’s self…

Clive Robinson • February 24, 2022 11:07 PM

@ Bruce, and the usual suspects,

You might find this of interest,

Chinese Security Lab releases information on NSA cyber attack

https://pekingnology.substack.com/p/chinese-cybersecurity-lab-discovers

Not the most readable of reports as the writer admits they are a repoeter nor a technologist[1] but it does provide links of interest.

[1] As I’ve remarked in the past many journalists lack technical knowledge that at times makes their reporting on technical matters, lets just say “quaint”. It’s unusual for a reporter to admit such things.

Clive Robinson • February 25, 2022 12:16 AM

Good news for some?

One of the defining markers of the pandemic for the tech industry was/is “Home Working” that further caused a slew of vulnarabilities for the ICTsec sector.

But what of the thing that underlies the entire tech sector “The workers”?

Some have claimed –and figures have shown there is truth in it– that they were more productive “working at home” (and there living expenses were less).

Others who have said less, have found “Home Working” to be quite stressful in two ways,

1, Feelings of “work” insecurity
2, Complications in home life

Thus want to get back to the old ways of working even though they were more productive working at home.

Well it appears “Big-Tech” are going for “Office again” as we climb slowly out of the chasm the pandemic has become,

https://www.nytimes.com/2022/02/22/technology/big-tech-offices.html

I guess this will make some happy, others not…

But think of all the cats, that have adjusted to having their providers[1] around all the time to attend to their whims… Will they survive “Back to Work”…

[1] Contrary to what many think, “you don’t own a cat” they consent to live with you if and only if you provide them with enough of what they want. Studies have shown that some cats have “multiple homes” and which one they are in depends on the time of day, interestingly such cats appear to sleep less than the claimed sixteen hours a day of “the average cat”. Personally I’m not that keen on cats especially those that insist on making themselves “tripping hazards”, dogs appear to have more sense in this respect.

Clive Robinson • February 25, 2022 8:34 AM

@ SpaceLifeForm, Anders, ALL,

Even if one can not do a lot, lots of people doing little things add up.

Be carefull, even though doing things for good, it won’t stop you being a criminal under many Western First World national legislation.

So remeber, you can knock on the door and tell others who answered or not, but gaining entry without consent, even if it is just to “look around” is worse than trespass in the real world.

Clive Robinson • February 26, 2022 1:46 AM

@ ALL,

Just one thing I forgot to say in my above about “typing cadence” as de-anonoymising Biometric.

The usual HTTPS / SSL and other data protection security will not stop the typing cadence being visable to anyone who can see your packets on the wire.

As discussed several times by @SpaceLifeForm, myself, and others, the “Border Gateway Protocol”(BGP) is in no way secure. Nore are underlying physical network protocols like SS7.

So a “Nation State Level” agency, or a myriad of smaller corporations and companies, can send your packets that reveal your Biometric thud your ID through or to any part of not just the Internet, but any part of the underlying physical layer you can not see, the globe spaning “telephone” network.

To stop this attack, you have to disable “interactive communications” at the character level. With the likes of the Google search entry box, turning off “javascript” limited any cadence to when you pressed the enter key. However to use Google, you have to have both javascript and cookies enabled.

The solution of using DuckDuckGo does not stop the biometric unless you have javascript turned off because it’s “helper” works on a caracter by caracter basis so your typing cadence still goes out on the wire and to DuckDuck, where it may be forwards onto.

As I’ve mentioned before HTML5 has a lot of “extensions” that you don’t need but alow those providing servers to collect lots and lots of information, not just about your computer so it is uniquely identified, but also about you the user so you are also uniquely idetified.

The thing is that whilst the computer can be to a certain extent “hidden on the wire” by encryption, your character by character typing cadence that identifies you can not be hidden by encryption.

As we have entered a “Global information war” that now also has a significant “kinetic component”. The instigators of which, are known to be drawing up “Hit Lists” of what they see as “Undesirables to be Neutralized or Dissapeared”.

People need to consider their “Personal Security” as it effects not just them, but their family, loved ones, friends, colleagues and others in clubs, Churches etc.

A look at what had happened to Belarus will tell you what future you will have if certain peoples plans and ambitions come to fruition.

Oh and remember Belarus was and presumably still is quite a bit behind in the communications and IS/T infrastructure than many Western First World Nations. So “the states” capabilities there are more limited than the US, UK, and most central and western European nations (and other places like Australasia and a number of Asian nations).

Clive Robinson • February 26, 2022 3:30 AM

@ Winter, SpaceLifeForm, ALL,

What about Putin? Would he be willing to give his life for his people?

A rhetorical question…

But I will answer it any way,

I rather hope Putin would give his life for the Russian people, the faster the better.

Why because it would I hope for a little while kill off his “Strong Russia” nonsense, that is killing not just Russian’s but other people needlessly.

What Putin want’s will be the ruination of Russia and bring death and destitution on it’s people, of that there is no doubt. The wheel of history has turned and crushed previous Russian Empires several times. It would be the madness of a psychopath to think the wheel would not turn again with the same result.

Clive Robinson • February 26, 2022 3:44 AM

@ SpaceLifeForm, Winter,

“Z: “The fight is here; I need ammunition, not a ride.”

Hmm times have changed from

King Richard III : “A horse, a horse, my Kingdom for a horse!”

Admittedly he wanted it to give him a higher position to ride through the frey to seek his real enemy and destroy him.

Kind of like wishing for a B2 bomber to go drop a message of “love” –just as pigeons do– on Putin’s head, but by a few megatonnes more than a pigeon 😉

Clive Robinson • February 26, 2022 4:03 AM

@ For ALL,

Speaking of anthums and such like, they are to nationalistic for many.

So a wish for all,

https://m.youtube.com/watch?v=X4R3EFfGjeg

With hopefully for those dispossesd and driven from their homes,

https://m.youtube.com/watch?v=vbM2BarUOfY

Clive Robinson • February 26, 2022 9:10 PM

@ SpaceLifeForm, ALL,

About an hour ago @elonmusk tweeted

Which in many ways is good news for many ordinary people (and also opens an issue some politicos are not going to like even in the US).

And… Because it is good news, what is the betting someone in the US SEC is trying to work out how to turn that into another $20,000,000 fine for/or the equivalent of fraud / insider trading / existing…

After all a Fedaeral judge made it fairly clear after lawyers presented argument that another / further SEC action was “virtually wrong at every level” and an “unconstitutional power grab”, by handing down what to many would apear a considerabl rebuke of the SEC ending up in her court three years ago of,

“Take a breath,” said US District Court Judge Alison Nathan. “Come back with your reasonableness pants on.”

Some above their natural competence pay grade civil servents carry grudges with religious zeal, others are just trying to “feather the nest”, and it is right that they should be reminded that taking their cushy pension options early could be a their best career move…

https://www.theverge.com/2019/4/4/18295240/elon-musk-sec-tweets-judge-nyc-ruling

Clive Robinson • February 27, 2022 8:29 AM

@ Nick,

RTF isn’t really a standard format; it’s a Microsoft format.

True, but at the time I started using it it had the following advantages,

1, Microsoft had “opened it up” enough that others could use it.
2, Microsoft put it in their products.
3, The files were “human readable”
4, The files were imported by other major software
5, It became an unoficial lingua franca, long before Postscript/PDF
6, Importantly unlike Postscript/PDF it was not Turing Engine compleate source code.

This enabled me and others to write software to “audit it” and block any “funnies” that might be attempts to exploit vulnarabilities in.

For instance you might have heard of a “NOP (No-Op) Sledge” a trick to “bust the stack for fun and profit” well it stoped those deader than “a fish trying to cycle across a desert”.

Which was a start into semi-automated “air-gap crossing”, for data-files that had presentation formatting.

The work flow process back four decades ago was if a document was internally generated, as a draft or original document to print it off. Then along with all the paper documents of relavance coming through the post box, put it in a file hanger in a file cabinet in a central organisational location. Then manually update the “file record sheet” with data such as date and who had sent it to atchive. As a “secure store” it was fairly good, as a usable resource nagh not so good, it was a dark cave where trees went to a nonexistent future life.

As part of the “market deregulation” and “selloff” of “State owned utility assets” by Mad Maggie Thatcher back in the 1980’s various concerns about “Customer Service” were brought into the light. The result was a kick back to life for “electronic records handeling” systems that were at best on life support at the time. Which ment “cash out time” for original investors, so the price of such systems shot up to unaffordable unless you had to have them by legislation / regulation.

The reality of such systems were a crude database that held inverted text linkex to an indexed file tree. You could build your own system with an “off the shelf” data base from Microsoft or several others and a Source code Control System which was easily available on *nix. The problem, getting the data off of the paper and into plaintext ASCII that would go in the database, and storing the files in a displayable format that would remain supported…

So even though RTF was not “An Open Standard” as we would think of them today… RTF files from four decades still open up in modern Office apps, even though the other more propriety formats “Microsoft and Co churned through for upgrade-gelt” are now in effect “lost to the wastes of time” and thus show in very short order the entropy effect of ephemeral existance.

Would I chose RTF these days? Well it would certainly be on the short list where as PDF and many more would not even make it to first round consideration.

I’m of the opinion that all file formats to be considered should be,

1, Not have in any way Turing Compleat “source” in them.
2, Be as simple as possible
3, Preferably be “human readable” in the simplest and oldest of “editors”.

As such simple text files and/or simple raster dot graphics files that can be if required subjected to OCR.

As you might know “I’m a known disliker of “data file storage” for good and sensible “legal reasons” to do with “hidden meta-data” and similar that appear to be becoming iniversal in even “Open Standard” file formats. It’s why I say “Paper, Paper, Never Data” when responding to “discovery” and with “electronic discovery” now becoming common that files be stored as simple image files, so they are like “photo copies” of old, where you could see what you were giving to your enemy[1]. Also,

“You can not give what you have not got”

It is not illegal to throw out what you consider “trash” everyday, week etc. There is no defined legal measure of how long you should keep documents, or in which form.

Thus “office rules” about cleanliness apply to data systems as well, especially in these days where “resourceful attackers” will get to users systems.

It is not “Destruction of evidence” as some would have you think. That at best only becomes applicable once legal notice has been formally given to you.

[1] In the British Army and other military services and I assume most other militaries in the world of,

Never leave ammunition for the enemy

But it applies to all things, that is “You do not yield resources to friend or foe” unless you are darn sure they can not hurt you –not just now but in the future– or you are compelled to do so[2].

[2] As what you as the data owner would regard as unauthorized or illicit access to your data is now very likely threats. Be it by the very real risk of cyber-criminals as seen with recent Ransomware attacks or the currently less likely compulsion by authority, it is your legal duty to reduce the risk, as it effects shareholder value, legal confidentiality, and a whole lot more. You are therefore required by law to think ahead and make life as reasonably difficult as possible for any potential attacker. This includes having work flows with mandated purges and much more besides. As long as the rules and proceadures are properly documented, followed, and enforced, what is gone, is gone, along with the other waste.

Clive Robinson • February 28, 2022 5:58 AM

@ JonKnowsNothing,

The 12 guys are pretending they are going to hold off an armoured column with basic rifles.

It won’t be the first or the last time…

Oh have you ever heard of the “Boys Rifle?

This a picture of two Swedish soldures during the “winter war” and they each have one.

The 19mm bullet traveled at just under 3000ft/Second and would go through an inch of armoured plate at 100yards…

Sadly nolonger with us, is one of my relatives who told suitable horror stores not just of carrying 35lb of “elephant gun” but firing it in training and in actual warfare against what we would now call “Armourd Personnel Carriers” that had a small weakness or as Ted put it “A vulnerabilty spot smaller than a Dragon’s ring piece” which if you hit it mashed the engine block.

Ted was an interesting character and at the time I did not know what a “ring piece” was, but a significantly disapproving look from my mother and several grins from those around gave me the clue I should probably not repeat it.

Ted was both a heavy drinker and smoker, and his wife died unexpectedly young, and they had no children. So having had some heart attacks and minor by the standard of the day strokes, he decided as he was not expected to make it to his sixtieth, to trade the house in for a place in an “old folks hostel/home” and with his health record got a good deal… He had always been a long distance runner, and at the “home” he struck up a relationship with the “head nurse” who was close to half his age, and she ended up in what was once called “The pudding club”… So there he was a short while later with a new young wife with a first child on the way… To say it caused no end of legal problems is as an understatment.

What I will remember Ted for was the day of my father’s funeral, as I was the male heir it fell to me to ride at the front of the herse and I was only half way through my teens and now an orphan to “be adopted”. I was near to tears and it must have shown. Ted poped into the seat next to me and told me jokes and funny stories about my Dad all the way and made me feel a lot better so I got through not just the service but the wake as people were expecting. Little did I know the hell that was to follow by the adoption, and shortly there after the strugle for emancipation, and what I gave up to get out. So yes that short time in the front of the herse has stuck with me as a last happy memory of childhood.

Ted went on to increase the size of his family and see all his children into adulthood. Even in his eighties he was still fitter than those a lot younger.

Clive Robinson • February 28, 2022 5:28 PM

@ JonKnowsNothing, ALL,

There are several specs and this one supposed to have added a marker to the cable to indicate the “true” bandwidth throughput.

No such thing as “true bandwidth” with cables, as the RF looks like it flies off as you go around corners[1]…

It’s why twisted pair cables used for telecommunications were given “Catagory”(CAT) numbers where CAT 1 was just about good enough to be used as “door bell wire”… Where the characteristic impedence of the transmisson line was mostly irrelevant, but the capacitance per unit of length and I^2R “copper loss” loses were most certainly not[3].

Some cables are now over very short lengths rated up into the microwave (10GHz / 3cm) regions where untill a few years ago “waveguide” was the prefered transmission line.

If you do the basc maths for 32bits for each point on the screen multiplird by two, you end up with some very large numbers. If you treat that as a frequency the cable needs to let the 3rd, 5th and preferably the 7th and 9th harmonics through. So if you assume a 10x frequency response you can calculate the maximum length of any given cable can be due to the alowable “antenuation margin” and the cable loss per unit length.

All this is mind numbingly dull to RF engineers, but it does form some of the bread and butter of their work. It’s less mind numbingly dull for telecommunications engineers, as it is frequently the entirety of their job. As for those doing LAN’s and “home entertainment” systems they rarely if ever get taught it let alone use it. Then there are the “audiophiles” who will assure you they can hear how much oxygen is in the copper of their “digital” audio cable…

[1] The real reason is a bit more complicated. But overly simply bending a cable like bending a pipe changes it’s characteristics to a certain extent. With water you get relected energy as “turbulance”, with RF you get a step impedence change, that causes some of the signal to be reflected back towards the source / generator where it again sees the wrong impedence and reflects back again, so you get what is called a “Voltage Standing Wave Ratio” or “VSWR”. In a perfect transmission line eventually the energy would be absorbed by either the generator / source impedence or the load / sink impedence. The reality is often quite a bit gets disipated as heat in the insulation between the two conductors, unless it “spills out” as a “Common Mode Return Current” to the “third conductor” which is the “outside of the coax screen”[2].

[2] Due to “skin effect” that very strictly limits how far an “Alternating Current”(AC) which RF and most digital signals are can penetrate a conductor, the outer braid or screen of coax has two conducting surfaces that are issolated from each other. One surface on the inside and one on the outside, as skin effect stops conduction between the two, you can have different currents/signals travaling in diferent directions. However when you get to the end of the cable you often get a “node” wher Kichoffs law applies (sum of the currents entering a node equall the sum of the curebts leaving a node). Which means that putting a “choke” on the outside of a cable, can effect the “apparent” signal in the cable. Oh and due to “dielectric effects” in insulation like the plastic foam inside and the outer PVC jacket, the velocity factor on the inside surface is different to that on the outside surface by around 25-35% of the speed of light (inside ~0.7C, outside ~0.95C). Which causes different effects due to cable length.

[3] The capacitance of a transmission line between the conductors and the inductance along the length of the wire give you not just the characteristic impedence of the transmission line but it’s effective low pass filter characteristics, often given in Decibels(db) loss per length at a given frequency. What you rarely get given is the “ohmic losses” as these are often swamped by skin effect[2] and dialectric loss values.

Clive Robinson • February 28, 2022 7:43 PM

@ Anders,

Even on the peace time you can’t live long enough off the grid, during the war you are even more vulnerable and dependent. Our battery technology is still in its infancy.

I’ve run a Yaesu FT-817N and a FT-780R off of a home brew “Solar Generator, that to my surprise keeps LiPo batteries going 24×7 even in a grey over cast UK winter. The 780, draws only 80mA in receive mode the 817 quite a bit more. It’s all built into a box and uses a couple of fiberglass masts.

The setup is 70cm NBFM to HF LSB SSB NVIS experimental repeater. It worked OK. It also works OK with a Marine band HT to the MF marine band.

The VHF/UHF NBFM depending on where you site it gives you a five mile radius coverage area with as little as 0.1W output. The HF LSB SSB in NVIS gives a two hundred mile radius on only 5W and would on other bands at certain times of the day do 3K mile DX.

I’ve been asked to build a prototype with “Open Souce” SDR and other hardware for a potential market for the likes of the Red Cross etc.

The downside of Lithium batteries is that whilst they can all be discharged below freezing, some can not be charged below freezing. This is not a problem if it’s maned in a “hot tent” but a potential disaster for remote operating above 45 degrees lattitude. One solution is like that used by “wind generators” they need a load to work into to stop them spining out of control. Thus the charger has a battery port and a “dump load” port which is basically just a big resistor. If you build a charger that detects “low temp” as many BMSs do, then you could flip a relay so the solar pannel heats the batteries with a dump load. All you need to do is design a suitable insulated container for the batteries and load.

Oh select your “Battery Managment System” with care… Some power themselves off of the battery in a way that when the cells are discharged the BMS gets “disconnectd” so it won’t charge untill you get the cell voltage back up again, a bit of a “catch 22” situation… And not something you want happening on a remote system.

Clive Robinson • March 1, 2022 1:06 AM

@ The usual sucpects,

You might find this analysis of things of interest,

https://m.youtube.com/watch?v=rzja-LOqUd8

Much of it you may well have already worked out but it appears “think of the children” reasoning is one reason frontline behaviours are not alowed to get home…

This can be further confirmed by the “burn in place” orders for Rus Mil bodies, so “no repatriation ceremonies” to create “Bad news”[1]

Not only is someone trying to build a false history as to their glorious leadership[2], they are trying to avoid their own Vietnam, but is likely to fail on both counts.

[1] When I first heard this, I thought tight git… That is rather than pay relatives the penson due, declare the dead not even as “Missing in Action” but as “Deserters” thus pay no money at all and have the excuse to harass the relatives indefinately. It will be interesting to see if Putin selected troops by marital/parental status, thus no voices[2] to soil his image in future generations.

[2] As most religions know if you tell children things before they are around five, they get built into the childs fundemental belief systems. We saw this in Northan Ireland where grandfathers would tell wee small grandchildren about the glories and atrocities that they believed as though they were first hand living memories. The Grandfathers having had it taught to them on their grandfathers knee, as wee small children. Even though the events were from as much as five hundred years before, and what was being told had little or nothing in common with historic records and archeology.

Clive Robinson • March 1, 2022 8:54 AM

@ MarkH,

Never saw triple digits before

Not officially… There was a time after the fall and economic colapse when you could not get an official rate that made any sense.

A friend who went over on business four times a year used to take a stack of very low value USD notes. At one point he got offered a thousand roubles for a five dollar note “as the first offer”, he did not accept (he suspected it was a setup). He did pay bills with them and as he said “Ten bucks for a hotel room and three meals a day for a week, not bad value”.

It’s why he also spent “holiday time” there and used to joke his holiday all in cost less than his weekly food shop…

He tried seting up an “honest business” but at that time “honest was not wanted”.

Here we are oh thirty years later give or take, and it looks like the wheel has turned nearly full circle for the average Russian economically…

I would not want to be on “fixed salary” or pension, starvation is going to put in an appearance any time soon.

If Putin has filched more than 200billion USD which some think is the case[1] then the Russian people would probably like it back.

[1] Apparrntly we can prove Putin has pushed 40billion for the UK. Which probably means two to three times that, and similarly for other countries, so yes 200billion could easilybe on the low side…

Clive Robinson • March 1, 2022 10:26 AM

@ Ted,

Berlin Wall. This is the wall that was built after WWII, when the Germany capital was divided

Not only have I been alive longer, I have a chunk of it as a memory from being there when it came down over thirty two years ago (Nov 89). Though the build up had started months earlier, with East Germans being “allowed out” via adjoining nations and the Evil that was Honicker and his wife being shown as effectively impotent and importantly without support. Fear of a bloody civil war was spreading through the summer. The world held it’s breath…

It was a realy scary time to be a foreigner in West Germany but even worse in Berlin. It was the end of the 1980’s and the cold war “certainties” were evaporating rapidly. It was a chill november and I was on business there, my hosts had made reasuring noises to my then boss, so it was decreed I go. But I felt palpable fear about what was happening, and the UK Government had issued dire warning to travelers, never a good sign.

After I arived, in Germany I chatted to a taxi driver on the long drive. His English was atleast as good as mine, and he correctly predicted that there would be no military action or civil war as “Germans, do not hurt their brothers”.

And so it came to pass, appart from the sense of fun and euphoria in the young who treated smashing bits of the wall down almost as a “party game” I think most Germans were quietly pleased.

Today in particular I wonder what Mikhail Gorbachev thinks of all this. It’s his 91st birthday tommorow, a time for reflection. His views were in a way prohetic five years ago,

https://m.youtube.com/watch?v=vj1IIlqGeu8

I met him briefly some years ago now, in the early days of him setting up his “green cross” he came and did a “meet and greet” of what were effectively volunteers.

It’s funny how memories over three decades and a bit ago, are still fresher, more brilliant, vivid and colourfull in my mind than the current events, that appear to lack colour and almost reality. I ask myself is this what would have happened all those years ago if it had been a different man?

Oh and as always, there is that tune…

https://m.youtube.com/watch?v=hPKXKjTBDlU

So here we are, and perhaps oddly, I find myself involved in these events. Again in the background, just in a different way…

Clive Robinson • March 2, 2022 4:11 AM

@ vas pup,

With regards ADS-B I’m more than aware of it and have mentioned it before on this blog[1]. Because it also tracks the CIA and FBI and their highly “questionable” flights tracking people in the US by “meta-data on “Find, Fix and Finish” activities. Importantly it has blown a number of CIA “Domestic” activities… even though the CIA spent millions setting up “front companies” and the like. It’s important because it shows that the CIA are not just over confident, they are dangerously so (hence also the reason behind the Chinese rounding up so many CIA “sources” and executing them).

But getting back on track, actually AIS –for ships–, ADS-B –for aircraft– are a legal requirment just like for “red tail lights, white side lights, and front headlights” for driving your car on public roads at night (some countries require them to be on all the time the vehicle is occupied).

ADS-B is primarily a safety system to help avoid not just collisions in the air, but the stagering increase in “near misses” as the skies are getting more and more crowded, especially over densely populated areas like large cities every one wants to fly to…

So onto your questions,

Q1: Why those broadcasts are not encrypted, so only authorized people could see the content?

Firstly you want a safety system to work, (even military vehicles / ships / aircraft have lights on them etc for good reason). Not only do people in aicraft want to know where other aircraft are, so do people on the ground who would get tonnes of wreckage destroying their homes, families etc if two aircraft collide.

So the system is designed “to work the best it can in all conditions”.

As for encryption and authorised persons, as every pilot in the world is authorized and many ground crew etc, also as all aircraft above a certain size are also effectively authorized the secret “key” would not be secret very long. In fact it would be out rather quickly, because it would be a massive single point of failure. Which in safety systems with lots of lives very much depend on, it would be cause for major comment.

But also consider, in French they have the word “sécurité” meaning both things English has the words “safety” and “security” for. And even in English “security” has several meanings that in ICTsec we use more domain specific words for (one of which is “authentic” which has atleast two different meanings in use, and likwise the word “trust”).

The dual usage of words is not something you want in either safety systems or security systems. Because it causes confusion and that kills in both domains.

So “There are good and proper reasons” for ADS-B to be the way it is and they will always over ride other concerns by a very very large margin.

Q2: I guess military planes do not have same vulnerability and can’t be traced. True?

Military aircraft are subject to the same rules as civilian aircraft at all times they are not in an active war zone, just the same as military road vehicles and ships.

Air safety trumps most things when it comes to aircraft that kill not just those on the aircraft, but potentially many on the ground when thing go wrong. 9/11 longterm statistics should tell you why that might be.

Actually all pilots can turn ADS-B off, just as ships crew can turn AIS off. Brcause like all electronics in aircraft it comes with a “real power off switch” again for safety reasons (fire, jamming of navigation systemes etc). However turning ADS-B off is almost always subject to an enquiry and fines etc. As it’s considered the equivalent of “reckless driving”. It’s something pilots just do not do unless there is an imminent threat to their aircraft and SOBs.

Even when in combat, military aircraft do have other safety systems still active such as IFF that are technically “secret” so their own side do not shoot them down.

Look at it this way, you fly out over enemy territory, off of everyones radar. When you come back you appear on your own sides defence radar. With out an IFF system how do they know to let you pass rather than fly a heat seeking missile up your tail pipe? Contrary to what many claim about “Stealth Aircraft” they can all be “target aquired” and shot down.

Q3: If Q2 is true, why same technology could not be used for private jets?

Even if there was such a system as a secure ADS-B it would not be alowed on civilian aircraft for not just safety, but security reasons.

At the end of the day, nobody has to have their own private jet to travel in, even the US President could “fly coach”. Thus the potential threat to an oligarch by identifing where their plane is, is not even a very distant corner case for those responsible for the millions of lives involved by air safety requirments.

And that position is justifiable, in that most airports that take jet aircraft have faily significant security precautions. So the oligarchs issues realy only start when they cross over from “air side” which as they are not an aircraft at the time makes it a “non-issue”.

[1] In the interests of “disclosure” I’ve designed many things in my professional life, many to do with “communications” and importantly “fail safe systems” that also includes “Safety Systems” and “Secure Systems”. So I can see not just both sides of the issues, but more importantly why “confusion” ends up in system failure and the consequent deaths when things inevitably go wrong.

Clive Robinson • March 2, 2022 10:14 AM

@ ResearcherZero,

People that think authoritarianism would be great in our own countries, ought to be a little more careful.

The real problem as Bob Altimier pointed out is not so much the authoritarian leaders but their followers.

I know I’m going to upset some but many Police Depts have many such people. Give them a flag to wave, a drum to bash, a bugle to blow or a saber to rattle and they will jump in line.

Their usual argument is “strong xxx” be it leader, master, nation or just despot and they are happy.

The thing is they have not a clue what “strong” is and not a chance of getting within a country mile of recognizing “good leadership”.

But Bob Altimere do not talj about the real evil… That which lies between the puppet leader and the the followers.

They tend not to be as narcissistic as the puppets basking in what they see as deserved adulation but they are certainly way up on the psycho/sociopath scales, and find as their lieutenants those with strong sadistic traits to organise the followers into “guard labour”.

Back in the 1930’s they were named after the colours of the shirts they wore… Often a colour that if it did not wash out, blood would not show up as obvious stains.

Such people although they do get toppled, never realy go away. Unfortunately they appear to learn from their mistakes, the so called “good citizens” rarely do… Not because they can not learn, but rather having disposed of one threat, they just want to go back to the way things were, to get on with life.

Clive Robinson • March 2, 2022 1:10 PM

@ ResearcherZero,

You might find this of interest,

https://www.theguardian.com/commentisfree/2012/aug/26/compliance-authority-failure

Clive Robinson • March 2, 2022 8:24 PM

@ SpaceLifeForm, ALL,

With regards,

https://nitter.net/

Which you can read without needing javascript, cookies and all that 5h1te (especially the bandwidth wasting adds).

You could also try and read Rik Ferguson’s Twitter account via Teitter. But… not only do you have to have javascript on they now force you into a Login page very very quickly.

If anyone knows any of the “Dummy Sucks” at Twitter tell them from me,

That is not a winning strategy.

Especially at this time when people are looking for news, and you might expect to pull in a lot more “fresh meat”… Driving them away to an Open Source frontend really?

Who came up with that idea? Make them CEO the competition would love it…

Clive Robinson • March 2, 2022 8:58 PM

@ SpaceLifeForm,

Poignant,

https://nitter.net/Cherubicdoll1/status/1498895717187788804

Clive Robinson • March 3, 2022 7:37 AM

@ Winter,

The BBC Has Revived An Old-School Radio Service

Revived is probably not the best word “reserected” from the dead, might be better…

There is a lot of nasty nasty politics behind this in the UK.

The BBC World Service has from the end of WWII, done “double duty” with it’s MF and HF transmitters in that the “Spooks” originally from the DWS at Pounden and later Mi6 from Hanslope Park have used them to send out coded messages and the like to “operatives abroad”. Look up the likes of the Linconshire Poacher, and “Cherry Ripe”,

https://en.m.wikipedia.org/wiki/Lincolnshire_Poacher_(numbers_station)

As the “Diplomatic Wireless Service”(DWS) came under the “Foreign And Commonwealth Office”(F&CO) it also had military units attached both regular and as called at the time Territorial… @Bruce has touched on this when posting about “Aspidistra” as was, located down towardrs the South East corner of the UK in Crowborough.

Well the “party” that is currently in both power&chaos, in a previous existance decided that the Big HF stations around the world that so many relied on were nolonger necessary due to satellite TV, Cable Television and the Internet…

All of which obviously fail to work quite quickly in a war zone.

So the UK political party concerned axed the BBC World Service even though they were repeatedly warned of the consequences of doing so…

Well as we now know Russia has missiles that can shoot down satellites in low orbits and bigger toys for geostationary satellites…

Which means that a defence strategy based on satellites is not exactly a good one…

So now we are in a crisis that our politicians created, so they are now running around like the proverbial headless chicken…

It would be funny if it were not so sad…

As the solar cycle is on the rise as is certain types of political behaviour, I think it’s likely that a number of people will be advising the politicos “it’s time to pull the mothballs out of the tank coils and re-boot ‘Radio Enduring Europe'” or whatever they end up calling it[1] as “Voice of America”(VoA) would not exactly be popular.

[1] There is a book known and loved in certain circles as “WRTH” for the “World Radio and Television Handbook” that lists nearly all the transmitter stations, their schedules and physical location and other info such as power and antenna types. They anounced that the 2022 edition would be the last printed a little while ago… I wonder if, there is an uptick in HF stations as may well happen if WRTH might decide to keep on printing…

Clive Robinson • March 3, 2022 12:45 PM

The NEW Linux RANDOM commit

As some here know the existing Entropy Pool System in the Linux Kernel “random” has been see by some as old and nolonger fit for purpose.

Further it has one or two issues such as “seed files” that make otherwise difficult attacks possible if care is not used.

So a patch has been produced that alows you to see what the changes are from old to new, pluss supporting comments,

https://git.kernel.org/pub/scm/linux/kernel/git/crng/random.git/commit/?id=d512f889f8c7c7b80fe556748b90ae290b92f610

Clive Robinson • March 4, 2022 5:09 AM

IETF “Bad PKCs list”(Draft)

It is a problem known by crypto engineers, but not so much by software developers, “Standard / Test” keys are NOT secure and should never ever be used outside of testing. But the inverse is true, you should not use your other keys for testing because then they become “bad”

But how do you know which are the bad news keys you should only use for test? Well, it turns out you probably don’t, as nobody puts warnings or poison symbols on them, and there is no real refrence list.

Something Peter Gutmann has decided realy needs addressing,

“The widespread use of PKCs on the Internet has led to a proliferation of publicly-known but not necessarily acknowledged keys used for testing purposes or that ship preconfigured in applications. These keys provide no security, but since there’s no record of them it’s often not known that they provide no security. In order to address this issue, this document provides a set of widely-known test keys that may be used wherever a preconfigured or sample key is required, and by extension in situations where such keys may be used such as when testing digitally signed data.”

https://datatracker.ietf.org/doc/draft-gutmann-testkeys/

Clive Robinson • March 4, 2022 8:04 AM

@ ALL,

I guess “Post Quantum Cryptography”(PQC) posting is a little like London Busses… You wait ages for one to come along, and then you get a whole bunch all together…

Now I’d be one of the first to admit that when it comes to “Cloudflare” I adopt “The Longer the better” policy when it comes to shap pointy sticks or spoons.

However they have come up with a whole bunch of blog threads people might want to read throug,

https://blog.cloudflare.com/tag/post-quantum/

Clive Robinson • March 4, 2022 7:14 PM

@ SpaceLifeForm,

With regards BGP route change you should have included,

Expected ASN: 212463 (NGROUP, UA)

And the unexpectd “event”,

Detected Origin ASN 35004 (NETGRUP, RU)

So someone has been redirecting network traffic from UA Ukraine to RU Russia.

Now why would anyone want to do that, I wonder…

How many decades is it now, people have been calling for BGP to be made “more secure”…

Maybe it is time people started taking note, as “Death Lists” can be made on knowledge of such rerouted traffic.