Schneier on Security

Clive Robinson • March 10, 2023 7:22 PM

@ vas pup, ALL,

Re : Hypersonic flight.

“Hypersonic missiles differ from conventional ballistic weapons in ways that make them harder to catch by missile defense systems. It comes down to speed and altitude.”

As with all things it’s more complicated than that[1].

One issue is anti-misiles have to fly faster than the missiles they are targeting by several times.
This has issues, one of which is lack of manoverability due to lack of structural strength. This means the slower flying hypersonic missile has the considerable advantage of a tighter turning circle than the anti-weapon. So flying in a hypersonic missile on a random path profile makes it difficult to lockon to and destroy.

What a lot of people don’t realise is that plasma build up just like a space craft on reentry, causes a radio-blackout for the hypersonic missile therefore it can not use radar or radio to know where it’s target is.

Whilst this is not much of an issue when attacking land based fixed and hardened targets, it makes a significant difference if the target is mobile at 50kph or more.

The “flare” from the plasma does not need to be seen by radar it has a fairly easily identifiable emission spectrum visable in space. So it can be detected relatively easily thus mobile vehicles can just “scatter” as a first order defence mechanism. Even relatively slow moving ships can get out of the way if the missile has a conventional munitions payload.

We are aware that China has thought on this issue, and their aircraft launched hypersonic missiles have been designed for nuclear warheads as they are used as long range “stand-off” weapons.

Hence we know both the US and Chinese have researched into laser anti-weapons for ship defence, that have already been deployed. Such laser weapons can also be used offensively and they have been observed “lighting up the sky” in the South China Sea.

Thus new “tactics” are going to need to be developed for these new weapons and I suspect Russia will be at best a long way behind not just China and the US, but other Western nations such as France and UK both of whom see them as next generation lucrative arms exports as do their “partners”.

[1] Have a look at the first such design of hypersonic missile, cslled “Pluto” designed in the 1960’s by the US and scrapped for various reasons (not just becsuse it was an unshielded nuclear reactor pumping out organic killing neutron radiation).

If you remember back a few years ago Russia tried to develop it’s own Pluto and one of the early flights went badly wrong and radiation levels all over Europe went up so we had a good idea of what Russia was upto without needing any “secret intelligence”.

Clive Robinson • March 12, 2023 3:15 AM

@ SpaceLifeForm,

Re : Birthday Paradox.

When you say,

“A 1 in 10,000 chance on the key.”

Do you mean their are 10,000 posible key profiles?

If so you need to consider two things,

1, Many key profiles are not cut due to mechanical issues.

2, The birthday paradox.

So as a rough guestimate the actual number of key profiles in use would be around a half the total (sometimes less).

Then you have to apply the birthday paradox, or more properly the “birthday attack” which often gets crudely aproximated to “halve the number of bits”

So whilst we don’t know the actual number of key profiles in use, you could go with 4096 or 8192 as a range (ie 2^12 to 2^13).

Which gives a range of 64-90 same model cars in the carpark for ~50% chance of having two sets of keys having the same profile…

Which is actually quite small…

As for colour etc there is the old Model T joke to consider,

“You can have it in any color you want as long as it’s black”.

The simple fact is more than a century later the joke is little changed,

“Vans are white, sports cars red, and family cars dull, and if you see a yellow Mini scream “yellow mini” and optionally hit the person next to you.”

https://www.theyellowminigame.com/base-rules/

Clive Robinson • March 12, 2023 11:13 AM

@ iAPX,

“in both case I try to mitigate problems the best way I can.”

As I get older I’ve found in life, that there are very few “cures or solutions” just “mitigations till the next “entropy event” happens.

Worse with hindsight, every mitigation appears to sow the seeds for the next entropy event.

I’ve learnt many things the hardway, by hqving to chip away at the rockface. Not the easy way of class, books, and the distilled knowledge they contain. There is a lot I would give to be able to tell my younger self the leasons the easy way…

One hard lesson I’ve had to learn is that the ICT industry, especially the ICTsec section of it rarely if ever records it’s history, almost never distills out the hardwon knowledge, and is almost always finding new ways to repeat past mistakes just a very short time later.

Why we do this to ourselves I realy don’t know, in times not so long past much of life changed when knolwedge in the Victorian and Edwardian era’s took us from artisanal hand crafts and agrarian lifestyles to science, engineering, industry and the near banshment of the darkness and the growth of transportation, cities and medicine giving us a freedom that was unimaginable.

When I was born the technology benifits society got, were from the military developing weapons to kill in horribly horific ways you would not wish to imagine.

Then an accident with a crystal with an unseen crack in it kicked of a revolution we all take for granted yet few have even the tiniest incling of how it works.

The Semiconductor indistry has changed not just the world but mankind as well. We have spread industrial across the globe, and agrarian as our great grandfathers understood it is almost gone.

One result as @Rouleauz triangles posted[1] is that as we become industrialised the cost of children rises, and you have to work longer before you have them to be able to afford them. So the birth rate drops as industrialisation takes a hold, so later and less children. A generation used to be every 15-20years with 4-7children now it’s 35-45 years and many couples are only having one child.

We are also living longer, in a few months I shall pass an odd goal post, in that I will be the oldest male member of our descended family tree, and by modern standards I’m by no means old.

As I grew up the “Three R’s” had only just stopped beong “beaten” into children with leather straps and ebony rods that could and did break bones, and children were nolonger beaten with them and had their hands broken for being left handed (as my father did)… For nearly all except the very rich the crucial life test was the “Eleven Plus Exam”(11+) that decided if you would be sent down the short brutal craft path and into work by 14 or into Grammar School to be taught the knowledge you would need to get to University to enter a Profession. I did not pass my 11+ because the head of the school claimed I had cheated and draged me out of the exam. Actually it was the other way around another boy was trying to copy off of me, but the head hated my mother (she used to be his boss and found him not to be suitable for promotion several times, he only got promotion after my mother left to have children, I later found him to be a thief so I guess my mother was right).

So I was destined for some dead end job at best. Then the Government changed the way education worked, they decided that Grammar Schools were a bad idea, and set about making the education of all children wider in scope and two years longer and “streaming” via the 11+ was officially stopped. So I did much better than some had plans for, and I ended up going to technical college where I did rather well, and should have gone on to be one of the less than 10% to go to University I certainly had the required grades. Unfortunatly I was an orphan and owned half a house, and thus was barred from grants by my local authority which in turn ment I was denied a University place…

So I went into work and soon knew the value of learning by self education[2]…

The problem we realy have is “short term thinking managment” who have worked out that if they cut wages they can force women to stay in work at low pay rates as it’s the only way a family can meet the costs of education etc. So we have the modern phenomenon of the “One Child per Couple” which has done oh so much harm to China and now the First World and now the Second World as they start to industrialise.

We talk about how mankind will run out of food, fuel and many other things. But you don’t hear about “runing out of knowledge”. The simple fact is unlike food and fuel, mankinds survival critically depends on knowledge. With knowledge we can find ways to move beyond “the way we did things”. You can see this in food production, first with the replacment of horses with steam, steam with petrol then diesel and now renewable energy. Farm labour is virtually all gone and has in effect migrated into the servicing, manufacture and design of the near robots that has replaced farm labour. The loosers mainly being the horses, with the moved man power leading different, way less brutish and longer life styles and times.

So why does the ICT industry and particular the ICTsec not learn from it’s history?

The honest answer is senior managment do not want them to, and actively discorage it…

A knowledgeable workforce has always been a very real and ever present danger to certain types who rise up in managment, in the same way a tyrant, despot or dictator knows an educated civilian population is a threat to them.

Such people would happily destroy mankind tommorow as long as they have status, power and unlimited control today…

Call it “self serving” to ensure the rise of knowledge and learning from history, because none of us are getting any yonger and someone has to provide pensions etc to todays workers who become retirees tomorrow. So it is, if you think about it, the first duty of every citizen, loyal to mankind and society, to ensure that they have children, and that all the children are well educated (and those that get in the way of that should have status, power and control removed from them both quickly and permanently).

But according to those who crave status, power and unlimited control for their own ends… That viewpoint makes me some kind of “Evil Socialist” 😉

[1] @Rouleauz triangles post,

https://www.schneier.com/blog/archives/2023/03/friday-squid-blogging-were-almost-at-flying-squid-drones.html/#comment-419282

[2] I later entered Uni as a mature self funded student on a Master of Science in InfoSys Design and started moving over to do a real PhD[3]. Then I was attacked one Thursday morning on my way to work and my head was Karate Kicked into a metal sign post by what appears to have been a police “Confidential Informant”… So another “set-back” on my personal road of learning…

[3] I say “real PhD” as I already had a DD I’d got from a US let’s be polite and call it an “educational organisation” that did not exactly teach… Unsurprisingly it got “cleaned up” when the US Gov discovered just how many of Gov employees had got promotions and pay rises by using it (for pay the money, submit a thesis, get an award, collect higher pay grade…) It’s a model a lot of once very reputable Uni’s have drifted into as they have turned themselves into “hedge funds” (and no doubt will soon regret it as the recession realy starts to bite).

Clive Robinson • March 13, 2023 7:20 AM

@ SpaceLifeForm, JonKnowsNothing, Winter,

Re : More Monkey business.

The tax dollars from the past couple of years were obviously burning a hole in somebodies pocket,

https://www.reuters.com/markets/deals/pfizer-buy-seagen-deal-valued-43-billion-2023-03-13/

So I guess the gain of function will be more than expected…

Clive Robinson • March 13, 2023 5:19 PM

@ Bruce, the usual suspects and those who’s brains still function

New “collision attack” on RIPEMD-160

Titled,

“Analysis of RIPEMD-160: New Collision Attacks and Finding Characteristics with MILP”

https://eprint.iacr.org/2023/277.pdf

I’ve read it but I’m not going to even try to explain it whilst my brain still aches 😉

Clive Robinson • March 13, 2023 6:30 PM

@ JonKnowsNothing, ALL,

Re : RoboDebt meets triage.

Yet another quite deliberate use of computers to distance corrupt or worse decisions with the old,

“Computer says NO”

Argument. This time in US medical insurance,

https://www.statnews.com/2023/03/13/medicare-advantage-plans-denial-artificial-intelligence/

Some people need to be subjected to their own rules…

Clive Robinson • March 15, 2023 5:48 AM

@ SpaceLifeForm,

Re : ICMP RCE

Bit and bobs are getting dragged into the light…

One SecFirm (Tenable[1]) said that there were 76 inddividual CVE’s,

“Microsoft addresses 76 CVEs including two zero-days exploited in the wild, one of which was publicly disclosed.”

In this MS Patch Tuesday are quite a few RCE’s, so pick your choice, but also,

“CVE-2023-23415 is a RCE vulnerability in Windows operating systems and was assigned a CVSSv3 score of 9.8. The vulnerability lies in the way the operating system handles ICMP packets when an application running on the vulnerable Windows host is bound to a raw socket. Exploitation is performed by sending a malicious fragmented IP packet to a vulnerable target, leading to arbitrary code execution.”

Others have indicated that one of the CVE’s has been used by suspected Russian attackers, against US Gov and US Infrastructure sites hinting at this ICMP RCE.

Oh Tenable also gave another CRITICAL, in the Windows “Cryptographic Services” as another RCE,

CVE-2023-23416 is a RCE vulnerability in Windows operating systems that was assigned a CVSSv3 score of 8.4. The vulnerability exists in Windows Cryptographic Services, a suite of cryptographic tools in Windows operating systems. Exploitation is performed by importing a malicious certificate onto a vulnerable target, requiring the attacker to authenticate to the target or entice an authenticated user into importing the malicious certificate. CVE-2023-23416 was given a rating of “Exploitation More Likely” using the Microsoft Exploitability Index.
“

There’s an itch at the back of my head that says this is not a first for Microsoft and Crypto Certs.

[1] Tenable give a break down of the MS Patch Tuesday,

https://www.tenable.com/blog/microsofts-march-2023-patch-tuesday-addresses-76-cves-cve-2023-23397

Clive Robinson • March 15, 2023 6:26 PM

@ SpaceLifeForm, ALL,

Re : Big v. Small

“Is 860 a big number?”

Both yes and no, that’s why we normalize and call it a percentage.

I do not know just how many US CInf systems there are and the FBI probably does not either.

Especially as many orgs will try very hard not to have such expensive liability hung around their necks.

The simple fact is Ransomware is profitable and a real “free market” so you can tell what’s going to happen.

1, Those that can will enter the market as long as there is profit.
2, Those “that can” increases by way of knowledge and availability.

There is little or nothing you can do about the spread of knowledge, also trying to remove the profit actually rarely works.

So that leaves the control measure as “availability” of targets. Currently it is what they call “a target rich environment” and the number of “fixes” is few and “mitigations” short lived.

Anyone looking at Microsoft’s current “Patch Tuesday” inclusions will see something like 1/3rd of the patches are to stop “Remote Code Execution”(RCE) attacks.

Some of the RCE’s have been known to already be used against “Critical Infrastructure” on MS systems.

The simple fact is any RCE attack will give a toe-hold at some level, some at above any user level so beyond what most SysAdmins can deal with. Once an attacker is in and has got to the “system” level they can do virtually anything they want.

You have three possible defences against “unknown” attack vectors,

1, Have no external comms.
2, Run external to the system profiling.
3, Shut the system down and sweep all memory for illicit changes.

Of the three the first makes most sense where it can be used.

I look at the FBI recommendations and groan inwardly as whilst they might look good as bullet points…

Any way as most of us realise, it does not matter how hard we work to make systems secure, managment or marketing will do the opposit…

Such is the nature of “free markets” the spiral is by definition downwards given a little time.

Clive Robinson • March 16, 2023 4:30 AM

@ lurker, SpaceLifeForm,

Re : Critical Infrastructure Risk.

“it’s interesting that the biggest part of it is Healthcare & Public Health.”

It also has the biggest number of computer users in CInt and comparatively speaking has by far the least amount of money to spend per user or computer.

“Do these provide best ROI for the bad guys?”

It depends on how you look at it…

They are obviously easy to get into (I still cringe when thinking about one consult I did on a hospital). But also they have a fall back… If the hospital won’t pay and the attackers have the patient medical records they can contact the patients directly and “put the screws” on them. Whilst many patients would not pay as they can’t, there will always be some who will, and others can be coerced if the attackers show they know who the victim works for or similar.

From a ransom attacker’s point of view they need to contact a potential victim as easily, cheaply and anonymously as possible. Thus electronically by Email or similar would be their chosen route.

So giving organisations the minimum of contact information the better your chances of avoiding being a secondary ransom attack victim. Or being used for identity theft or similar.

Clive Robinson • March 16, 2023 11:48 AM

@ Winter,

Re : Ken and the Rooster egg…

“Ken Thompson: Anyway, I’m half transitioned now.”

There is an old philosphical question,

Q : There is a church spire that comes to a perfect point and it is thus avoided by all of our feathered friends. For this reason a Rooster decides that it must therefore be a safe place for what it has in mind. So on a calm windless day up it flys and carefully lays an egg with the “big end down” and flys off. Now as we all know things do not remain balanced for ever so must eventually fall. The question is not in which direction but simply when?

Thus Ken’s half transition is like the egg…

Clive Robinson • March 17, 2023 5:07 AM

@ JonKnowsNothing, SpaceLifeForm,

Re : No Deposit no return.

Based on what others with more “insider information” are doing we are heading for another “Run on a Bank” finally making clear we are in another global recession but with the appearence for public consumption of it being another,

“‘Financial Crisis'(FC4?) precipitated by the little people”

Hence not telling the real cause of the problem, which has been building since Thatcher and Reagan back in the 1980’s with the “Free Market”, demanded by the finance industry and pushed by neo-con think tanks. Which amoungst other things gave rise to the “Lloyds LMX Spiral” scandal.

Since the “deregulation” of the “Big Bang” you will find just one or two of the nastiest mid rung operators have come to be exposed. Look up the history of “Fred The Shred” for instance, and Bob Diamond at Barclays over the LIBOR scandal, but others at the likes of HSBC remain nameless. As do those where their misdeeds get hidden by corporate structures and large fines that the little people pay, and soon it’s “back to normal” with a different financial scam.

As for those higher up the ladder you don’t get to hear of what they do… It’s not written down and often it’s first made legal by “suasion” over private meetings. The most public of which is Davos, but you don’t get to see the actual people, just their proxies. Not to different to lobbyists, but less crude and way more effective.

But what are those neo-con think tanks doing that those top rung squatters fund through multiple defensive layers?

Well some would call it revisionist history others worse, but when challenged they tell you, you do not have the correct point of view…

A prime example is from Philip Booth, who was at the time the “Institute of Economic Affairs”(IEA) editorial and programme director. Who also had many many other jobs (including religious posts a characteristic that we have come to realise is indicative of a “certain type” like the ex-head of the UK Post Office who had so many innocent people jailed or driven to their deaths).

At the time (2015) The Guardian tried to debunk the nonsense by Philip Booth, but there is only so far you can go. Before “the friends” –pay masyers– of the person you are trying to hold to account starting whisper and similar campaigns against you. Which have been the nastier side of US Politics against journalists in recent years. Such attacks mainly run by the right of center folks (the names of which would probably trip the moderation filter).

Any way you can read The Guardian article,

https://www.theguardian.com/business/2015/may/25/margaret-thatcher-deregulated-city-london

Then read the IEA’s copy of the actual Philip Bootb artical and see how he is blaiming “the little people” in several ways.

Oh a little warning before you do go read it,

Do not click on any of the links in the article “they are watching”[1] also turn of cookies and javascript

https://iea.org.uk/publications/research/thatcher-the-myth-of-deregulation

[1] If you “mouse-over” you will see the links are of the form,

http://www.iea.org.uk/in-the-media/… …

That is rather than give the link to the Guardian article as I have done, they cause your browser to link back to their system, where your details will be recorded as will the link…

[2] Barclays and what they did to LIBOR had an effect on every person who had savings, debts, or any kind of financial commitment,

‘htt ps://www.hbs.edu/faculty/Pages/item.aspx?num=43888

Clive Robinson • March 17, 2023 3:01 PM

@ Winter, ResearcherZero, ALL,

Re : Mostly people say Random when they don’t know the inputs.

<

blockquote>”And there are even more pundits who will claim their randomness are not “pure enough”. There will always be drift, side-channels, and biases that can be raised.”

Yes and raised with significant validity, because they have a habit of becoming known to an attacker in ways most who disparage them have little comprehension of or don’t care to get to understand, thus blow security out of the water at step 1.

What many call “True Random” or “Random” is actually “noise” which is “assumed to be random” but is actually,

“The sum of multiple signals”[1]

Mostly the signals are not at all random and many are mostly determanistic[5].

Interestingly if you go for the “minimum multiple” of two signals, it is exactly the same model as a “stream cipher” and all alledgedly random signals can be treated as such.

Thus you can in effect invert the view and say one signal is “determanistic” and the other “non determanistic”. The dificulty which immediately becomes obvious is how you seperate the wanted “non determanistic” from the unwanted “determanistic”[5].

The basic answer is these days using DSP algorithms to synthesize any non determanistic signal, invert it and add it in as another input.

Whilst this deals with signals you can recognize as determanistic and synthesize in waveform and phase, you can not do the same for “chaotic” signals which can appear random but are not at all.

You can easily generate such a signal with two oscilators at different non harmonically related frequencies driving a D-Type latch. If the frequencies are stable, and you integrate the random looking and complex latch output that “looks random” close in, you get a very nearly perfect sin wave at the difference frequency of the two input sinewaves… Which is a bit of an “Opps moment when you demonstrate it”. It’s also something a lot of Silicon Valley Chip designers appear non cognizant of as they use “ring buffer oscilators” to drive a D-type latch and use that as an on chip random source… Worse fully determanistic signals such as “power supply noise” phase modulate the oscilator outputs. This just adds a determanistic noise to the D-Type output, which when put through a hash algorithm gives the very false impression of “random” when it’s nothing of the sort.

[1] The use of summation makes the process effectively degenerate to just the two signal case. Which can be easily seen when you consider

Sig_out = Mod N (Sig_i+1 + Sum_0…i)

[2] So any proof or attack on the two signal case is valid for how ever many signals you chose to use as input.

So if any of the input signals are both,

“Truely unknown and truely unpredictable.”

Which is very rare[5]. Then the Sig_out can be considered from the observer’s point of view “non determanistic”.

However if none of the input signals are Truely unknown and Truely unpredictable, then the signal output is from all points of view “determanistic” therefore not random[3].

[3] Can “determanistic” be used to replace “truely random”, well that is a bit of a vexed question. The generalised idea is,

“Determanistic is sufficient if the observer is incapable of determaning that the output is determanistic.”

Which whilst nice in concept and used in a number of alledged proofs, is actually not true.

Any determanistic cryptographic algorithm has dependency. That is each bit is dependent in some way on the previous bits. If you know the size of the effective state array as is needed for a stream generator it is trivial to show that if the actual state array is N bits, you need a maximum of 3N-2 bits output to be able to determine every bit from there on. This is actually related to the “unicity distance” of all cipher systems[4].

[4] Shannon called the issue with input statistics and their effect on uniquely discovering a key “unicity distance”. and went on to prove that for “Perfect secrecy” –ie all messages equiprobable– the length of the key material had to be as long as the plaintext message length and all ciphertext characters had to be not just equiprobable themselves but also independent of each other (statistically flat / fair ball drawing from an urn with the ball being returned to the urn after it’s drawn).

[5] Contrary to the impression given most natural sources have little indipendence from bit to bit. Worse many follow a predictable line on a graph or have an offset they sit upon.

Thus “true entropy” is actually a very rare commodity like fine scent that has to be distilled out with very great care.

Also humans are very very bad judges of “random” and our statistical algorithms aren’t much better. Whilst they can tell you a source you test is bad in one particular way it can not tell you the myriad of other ways it has failed, and none can say a source is good.

[6] The unicity distance is based on the output of a cipher, and defines the length of the message where the all messages are equiprobable drops to just one message in what is effectively a brut force search. As such it uses the plaintext statistics which makes it message statistics dependent.

The simple way to see this is to view the cipher as a simple “Belalso” –Vigenere– cipher. Lets say the alphabet size is 26 letters and the message is 5 letters long. It’s easy to see that there are 26^5 possible messages (N) and likewise 26^5 keys(K). However if and only if the plaintext is in readable english such as WINED or CRIED it’s easy to see that the number of messages (M) is now very much reduced from N.

Importantly though is to realise that for any given ciphertext(C) beyond a certain length each M has only one key K that gives the plantext. So with K possible keys, only K(M/N) of them will produce acceptable english plaintext. Just one of these keys(K) is the correct key, even though several keys will on short lengths give acceptable plaintext(M). Thus the question arises at what length L of the message is a sufficient length to eliminate all but the correct key.

By observation as M/N gets decreasingly small as the length L of the message increases, at some point L will be large enough to make the number of incorrect keys equal to zero. Equivalently, this is the message length L where K(M/N)=1. This L is the unicity distance. Important to note that for the same key K the unicity distance L is dependent on the plaintext statistics so will vary from message to message.

Also in a fully determanistic cipher the number of keys(K) is dependent on either the width and complexity of the equivalent mapping of a block cipher, or the actual size of the state storage in a stream cipher. With english plain text being nearly always uniquely recognized in 25-29 characters or ~127bits the unicity distance of DES would be less than 2blocks and a little over 1 block for AES.

[7] What Shannon did not emphasize, is unicity distance is also dependent on the key statistics as well as the plaintext statistics. So whilst someone might argue with a “book code” of approximately 2000 charecters a page, and 250 pages the total size of key material is 400,000, the reality is that is way way off. For instance if you are known to have only 10books in your possession then it does not take much in the way of a trial search to find which is being used. Because you would in effect be using a key stream where the individual chatacters are NOT independent of each other or even close to being statistically flat. Which gives rise to a much faster way of breaking the cipher. The statistics of the cipher text via a simple Chi Squared test would show not only that two plaintexts had been used but other charecteristics that would make breaking out the plaintext from the keytext easy, thus giving a length of keytext which could be searched for in hundreds of thousands of books remarkably quickly. But even the books do not need to be searched. All authors have a style that can be recognised statistically thus limit the body of works to be searched down to very few, maybe a dozen or two.

Clive Robinson • March 18, 2023 1:55 AM

@ modem phonemes, ResearcherZero, Winter, ALL,

Re : Some things just happen.

“Everything proceeds by cause and effect. Does this mean deterministic ?”

Err no. To be “determanistic” requires more than “cause and effect” it also requires it be repeatable, by prediction, thus design.

So whilst I can hit a golf ball and get it to land somewhere, I can not subsequently claim where it landed was by design. If however I say it will be a “hole in one” and it does indeed drop down the hole, even that does not make it “by design” unless I can do it every time… (which at the very least would probably and almost quite predictably get my golf clubs used by others for less than legal application against my person, so would be by design and very probably repeated, so becoming a quite determanistic intent).

Clive Robinson • March 18, 2023 9:12 PM

@ Winter, lurker, modem phonemes,

Re : Free will and agency.

“What is free will? And how does it interact with the laws of nature? Most accounts of “free will” transcend physics, and the arguments for it are in the “just so stories” category.”

Free will is about choice or the same as the Roosters Egg, “You know it will fall, but you do not know when or in which direction it will fall nore can you in a finite physical universe but you know it will fall”[1]

It’s the same as the balls in a “quincunxor”[2] you can show that their starting path is toward the center of the base line and first pin. But any imperfection between the release point and the first pin no matter how slight will cause a divertion that when you boil it down comes out to the square root of the modulous –or absolute value but not sign– of some value aproaching but never reaching zero (thus importantly giving symmetry around the path). Because that value can never be determind we give it a probability between two values.

Now you can argue the demon has “infinite depth of vision” but as I’ve shown in the past in a finite physical universe which science says this universe is, there is no ability to store, communicate or process such values. As you yourself know because you have used in the past the square root of two argument to show infinity exists, and the effect it had on thinking when Pythagoras worked out this fact.

Now the interesting thing with the “quincunxor” is that beneath the first pin there are two pins forming a row. And beneath that row another row where effectively each pin has two equidistant pins below and either side of it’s center line to the base (obviously you deduplicate where two pins would be coincident in space). Thus every pin is a spire for the Roosters Egg of the decending ball to form an impossible to know choice of direction at an impossible to know time as neither can be calculated due to the infinity problem in a finite physical universe.

All of that is within the laws of physics to however many X^-N radix values you care to use, the next radix always has that “root of two” infinity issue beyween two points.

So you can not know what route each ball will take and where it will end up on the base line. All you know is that it has a probability from the center line of the first pin to the base. It’s simple to see it must be symetrical by the basic law of reflection, but the probability less so, but as you know can be calculated to some approximate value we call an imprecise probability.

But as you also know on mass the balls will fall in the same pattern every time[1]. Because of this we can work with the imprecise probabilities and mostly care not a jot which direction the Roosters Egg will fall or when it changes direction, if it does or does not at any given pin.

You can argue any which way you like but you know if you are rational that the result of this is that no matter what the demon might know it is always insufficient therefore the demon as described can not exist except as a concept based on a cognative bias from a belief of “all knowing all powerfull” that can not exist in our finite physical universe.

If you want to argue the point further consider another rational proof given by Donald Knuth if you want to look it up (see §3.4.1-C of the second volume of his still incompleate and evolving Treatise of Seminumerical Algorithms). I give a brief over view and the consequences it has for both the Demon and your argument below[3].

Which brings us to your,

“If you say it can’t, you effectively say the laws of nature as currently formulated are wrong. Please feel free to amend them and win the Nobel prize.”

No I don’t say the “laws of nature as currentky formulated are wrong”. I actuall prove your view point is incorrect in a finite universe.

And no I do not expect a Nobel in physics for “stating the bleeding obvious” though arguably they have all been awarded for exactly that reason. Which is also informal proof if required that our knowledge of physics is not just incompleate, it is still evolving.

But another point you should keep in the back of your mind “chaotic” means neither “random” or “unstable” nor even an aproximation to them. Which can be demonstrated by simply observing the jointed pendulum, it always ends up in a stable and fully predictable point of rest. Further it’s behaviour has quite predictable but nonlinear points based on the level of energy you initially put into it, and the value of force we call gravity applied to it.

[1] Unlike a simulation… When my son was at that intently curious stage where he would get into anything and everything. I took him to a museum in Telford where such behaviours can be induldged more or less safely, without the need for “helicopter parenting”. They had a “simulation” there that adiquately demonstrates the limit of knowledge. It simulated a fun fair “loop the loop” ride where you could control the initial energy of the push and how the car would respond using the laws of motion. However I showed that if you got the amount of energy just right, you could get the car to stop hanging down from the very top of the loop. I left the car like that several times and each time a “demonstrator” came buy they would note it and press a hidden reset button as they mistakenly thought the program or the computer had locked up… When I realised this I told the demonstrater it was actuall working correctly and briefly demonstrated it. It turned out the demonstrator was a volunteer who was at university doing a degree in physics. So as my son was actively engaged with something else, I got chatting with the demonstrato and explained that the program “should not be fixed” as it actually demonstrated visually something quite fundemental to all including up beyond graduate level. That is it gave a visual example of Turings “Halting Proof” as well as the limits of finite resources on the ability to “know” or “predict” thus why caution should always be used with the output of simulations for “real life modeling”.

[2] The “quincunxor” from the Galton boxor quincunxor, or Galton board, is seen almost where ever simple gambling, children are alowed to loose money at, happens like “fun fairs”. The device was “thought up” or as others prefere “invented” by Sir Francis Galton. He did it to demonstrate what we now call the “Central limit theorem”. Esspecially that with sufficient sample size –number of balls– the binomial distribution, actually approximates what we now call the “normal distribution” or bell curve. Similar can be reasond by adding flat distribution probabilities such as the out come of throwing multiple dice[3].

[3] Briefly because Knuth not just explains it but gives an itterative proof you can easily look up (see “The art of Computer Programming” Vol II §3.4.1-C of his ever incompleate thus evolving Treatise on Seminumerical Algorithms).

When you throw a single dice, if it’s “fair” it’s observed distribution becomes flat the more times you throw it, as we should expect[4]. But when you add a second dice the probabilities of throwing two dice add, so with each throw of the pair, and supprisingly to many the probability distribution is nolonger flat, it becomes a triangle. Add a third dice and you add those triangles from throwing a pair up and suddenly you see the start of the normal distribution emerging in the center. Keep adding dice and “the tails” become a closser and closser match to those of the normal continuous distribution. Knowing this is actually useful in a practical sense in that if you have a “true random generator” where the outputs are truely independent and “fair”, then by simply adding N outputs you go from a flat to normal distribution with any precision you care, based only on increasing N… And importantly for arguments about that Demon, the bit width of the underlying “natural numbers” or integers you use to approximate real numbers, showing that the Demons abilities inside our finite universe are also finite, thus there will always be information the Demon “Can not know”.

[4] However the dice no matter however “fair” never actuall predictably reaches a flat distribution nor does it stay there once it gets there, it always ends up crossing back and forth “hunting” it. Thus the question arises as to the trend of the curve of such hunting, and the nature of the “noise” is it random, chotic, both or something else like complex but determanistic, and of course in this physically finite universe will we ever have sufficient knowledge to “know rather than approximate by average?”

Clive Robinson • March 19, 2023 1:47 PM

@ Winter,

“If you want to argue the evolution of the universe is not deterministic (which is the point of Laplace), then tell us where the indeterminism enter the equation.”

I can not, for exactly the same reason the Demon can not exist.

There are fundemental laws of nature that stop us being able to see the universe in it’s entirety (see “time cones”) or look back beyond certain points in time.

The fundemental rules as we see them for our universe most definately make the Demon impossible. Not just as a potential reality but an idea.

We know beyond any doubt that anyone has ever bothered to raise that omnipotence and omniscience are within our universe ruled out by the laws of nature as we know them.

So,

“Laplace’s demon describes the universe, not itself.”

It is only a concept out of a man’s mind to describe his thought processes by analogy. In reality it does not make it as a postulate.