Schneier on Security

Clive Robinson • October 21, 2023 6:26 AM

@ SpaceLifeForm,

Re : Almost not detectable.

I note the date of 16th in the article…

On the same day I got the same sort of certificate nolonger valid for

1, Duckduckgo https://html.duckduckgo.com/html/

2, Hacker News https://news.ycombinator.com/news

3, Lobsters https://lobste.rs

But not other sites… The only routing these sites have in common is closer to me than the sites themselves…

So as they went out on the same day the chances are the certs were aquired on the same day originallt, thus potentially by the same entity…

Clive Robinson • October 24, 2023 11:24 PM

@ The usual Quantum Suspects,

One to keep an eye on.

“Today, a startup called Atom Computing announced that it has been doing internal testing of a 1,180 qubit quantum computer and will be making it available to customers next year.”

https://arstechnica.com/science/2023/10/atom-computing-is-the-first-to-announce-a-1000-qubit-quantum-computer/

“Atom Computing, as its name implies, has chosen neutral atoms as its qubit of choice (there are other companies that are working with ions). These systems rely on a set of lasers that create a series of locations that are energetically favorable for atoms. Left on their own, atoms will tend to fall into these locations and stay there until a stray gas atom bumps into them and knocks them out.

Because the locations of atoms are set by the configuration of the lasers, it’s possible to address each individually. Quantum information is stored in the nuclear spin, which is relatively impervious to the environment. While other types of qubits have coherence lifetimes that are just a fraction of a second, neutral atoms will often hold their state for tens of seconds. Because the nuclear spin doesn’t readily interact with the environment, it’s possible to pack the atoms closely together, allowing a relatively dense system.”

Clive Robinson • October 25, 2023 12:20 AM

@ SpaceLifeForm and the other usual suspects interested in CPU hardware vulnerabilities.

https://www.theregister.com/2023/10/24/cascade_fuzzer_zurich/

The ETH Zurich appears to be having a run of hardware vulnarability finding recently.

This latest one is a “fuzzer” that is in effect “tuned random” rather than just random.

It uses a model based on the CPU ISA to generate it’s fuzzing program/data.

The thought occures to me is how similar this fuzzer might be to an AI LLM or other statisticaly adjusted adaptive filter system excited by a stochastic source.

Clive Robinson • October 26, 2023 9:15 AM

@ vas pup, ALL,

Re : Wired v Over The Air comms

“Hamas terrorists used ‘hardwired phones’ to evade Israeli intelligence”

First off if what is said about the “freedom fighters”[1] being underground in tunnels, “Over The Air” communications by radio etc realy won’t work (look up “Tunnel Radio” design for the likes of “Pot Hole and Cave Divers” to see why. The solution used in road and rail tunnels is “leaky feeder” and complex repeater nodes both of which are very expensive when compared to the “twisted pair” in the likes of CAT 3 cabaling.

The fact that the way things are organised with distributed hardened command posts linked by tunnels that only requires “point to point” rather than “broadcast” communications, along with simple economics, easy of maintainance, and very low power all take it in the direction of “Privacy”…

Thus I would not say it was a “deliberate security choice” but a “pragmatic choice” and very very obvious to anyone who has looked at school level history of the Great war and similar. Thus it should not be a surprise to anyone. But especially to an Intelligence or Millitary entity.

You need to be aware when evaluating such information that the current Israeli Politicians, IDF and Inteligence Agencies are all undergoing the kick-back of a massive intelligence failure very much of their own making, so they are looking to spread stories to “blaim others” for their own failures. Hence what you are seeing.

But also consider the 5,000-10,000 rockets issue Hamas are alledged to have fired by Isreali Intel sources in an increadibly short period of time.

Look at how the Gaza strip is organised and all the sophisticated electronic surveillance etc etc around it.

Each one of those rockets requires atleast 10ft of pipe capable of supporting the preasure of launch and balistic flight with a sufficient warhead, which is quite considerable.

10,000 rockets of 10ft of pipe that’s 100,000ft or ~20miles or most of the length of Gaza…

How did they get it in, how did they get the solid fuel etc and how did they make them?

Remember the Israel Defence and Intelligence forces are the only people to fly over Gaza and they send many many drones a day over as well.

Yet some how Hamas are alledged to have built a prodigeous number of rockets that even Russia on it’s current war economy footing could not match…

It’s why some are asking,

“Was it a total inteligence failure, or was it a quite deliberate ‘blind eye’ policy for right wing political reasons?”

The immensity of it as a failure, is making increasing numbers think the reality is it was political policy of one form or another.

Some are even saying it was Russia, through Iran with Hamas trained and supported by those missing Wagner Group forces. To stop the large stocks of artillery amunition the US has stocked piled in Israel being sent to the Ukraine.

This is the joys of “the fog of war” but what is clear is the Israeli Government has an inteligence failure far far larger than the US had with the run up to 9/11…

[1] Please do not fall for IDF and very far right Israeli political and Zionist mantras which so many do in the West etc. We’ve seen a “metric shit load” of that “echo chamber nonsense” in the MSM. Try and have a look at the WWII and later history because Israel by the same definitions is a “Terrorist State” but few say it for what it is. Zionism has effectively called for the eradication of Palistinians since it’s “get go” in the very late 1800’s. You can if you wish go to the UK National Records Office in Kew South West London and look up all the records of the “Palistinian Mandate” and the political problems including what we would now call “ethnic cleansing” and “terrorism” by the Zionist idiology believers repeatedly murdering not just Palistinians but British Soldiers sent there to try and keep the peace.

Clive Robinson • October 26, 2023 5:31 PM

@ fib, ALL,

Re : LLM and other ML and AI won’t become sentient or make your fortune.

“But it may be possible, my dear, with the use of higher order tensors, encoding more subtle relationships. Obviously we are far from that.”

It does not matter how subtle or encompassing the encodings are they will not give you sentience by any current or probably future definition. Because all the underlying silicon systems work in a way considerably different to that of biological systems.

One failing of which is silicon integer neurons have some very nasty “gotchas” that carbon biologic neurons do not.

Just one of which is that the layered silicon model is very definately serial over all network width and the biological model will very happily work in parallel over limited parts of the network and with little regard to layers. Thus silicon slows to a stop with the increasing width of the network and uses more power than the technology can disipate (heat death issue). The biological system uses very little power and due to the way it works will work without issue with any sized network or network of networks layered to any adhoc depth that can run at any propogation speed especially very slow. In short all the current silicon systems are very much capability limited by design and we’ve kind of crossed over to the point where the boundry wall is not just very visable but is approaching faster than technology can currently push back[1].

“Another aspect that I stubbornly cling to – because I suspect that AGI won’t happen unless this changes – is the glaring lack of participation of the senses in artificial models of intelligence.”

You are right to cling to it.

As I mentioned just a few hours back in response to AI making repeated mistakes with points on a sphere to you and @lurker,

https://www.schneier.com/blog/archives/2023/10/friday-squid-blogging-why-there-are-no-giant-squid-in-aquariums.html/#comment-428002

Without sensors AI of all forms is disconected from reality and this limits it’s ability to reason validly. Thus it can not “do science” or even see simple mistakes such that you get with two point on a sphere and the “great circle path”.

Further it has no sense of “actual time” that is a product of gravity or similar that can give implicit meaning to things like velocity thus distance. This is actually a fundemental failing of the silicon neural models, but is implicitly built in as part of the way carbon biological neurons work.

Oh another thing, silicon neurons are mostly linear due to the MAD instruction, with the “magic nonlinearity” tacked on at the output. Which whilst simple thus fast in very small models runs into all sorts of issues as the model gets larger. One of which is the over head which gives the ability for it to function diminishes very quickly, far faster than it’s functional ability increases.

The carbon biological neurons appear to be not linear at all but logrithmic through out which means the overhead problem does not arise nor does overflow or scaling issues. As well as all sorts of other little nasties such as rounding issues that like cracks in the pavement trip things up in the most difficult ways to predict.

But the current generation of AI people and their “Venture Capitalist”(VC) backers do not want you knowing these things because they have not yet become billionairs selling you the “faux securities”[2] that are in reality “fools gold”. That is they don’t want you “killing their mythological ‘goose that lays the golden eggs'” they want you to believe the hype is “magic” and you will get immense wealth as they pump up the bubble.

The reality is that the real money in LLMs and similar is as surveillance tools. You only need look around at the current people who make real money out of stealing peoples privacy and marketing it, to see the same faces promoting the surveillance use of LLM’s etc via search engines and chatbots. But also they are talking up the notion of “legislation” that in reality will act as a drawbridge behind them, just as Uber used to try to do. Thus they get a “closed shop” and stop others entering it.

Adopt “a jaundiced eye” and say to yourself,

“How are they trying to scam me?”

And you will start to see part of what is going on.

Oh and then there is the flip side of surveillance which is faux-news and the like used to control people in “echo-chambers” and the like.

Look up faux AI from the early computerized “analyst” of Weizenbaum’s Eliza program –from back in the days of minicomputers– which has given us the ChatBot very dangerous “Eliza Effect”, to the even more dangerous issues with Kuyda’s Replika,

https://www.schneier.com/blog/archives/2023/10/friday-squid-blogging-why-there-are-no-giant-squid-in-aquariums.html/#comment-428050

That has lead people not just to becomming terrorists but traitors to, and getting convicted and jailed,

https://www.schneier.com/blog/archives/2023/10/microsoft-is-soft-launching-security-copilot.html/#comment-428027

https://www.wired.com/story/chatbot-kill-the-queen-eliza-effect/

So “Mass-Surveillance and Personalised-Control” is what current AI tech are best at both of which are the wet dreams of those with dark tetrad issues you will find towards the tops of hierarchies that give power/influence or the money to buy it.

[1] We saw this very issue arise with AI well over a decade or so back and then about half a decade back somebody came up with the “AI transformer” based in part on the “Attention Model” which has brought us more or less to where we currently are,

‘https://builtin.com/artificial-intelligence/transformer-neural-network

Well it’s running out of potential fast and that brick wall is fast approaching. Will someone come up with the next trick to give us more mileage? Who knows but one thing history tells us is the law of diminishing returns usually wins due to an exponential rise in resources required for each successive step.

[2] Something the SEC might get around to convincing a Court they are, thus then being able to levy billions in fines on all but the VC’s as is happening with anything crypto-coin or NFT look alike.

Clive Robinson • October 28, 2023 5:44 PM

@ SpaceLifeForm, ALL,

Re : The “Xmas gift that keeps giving”

The Apple Chip has as an Aussy friend would say “Come a gutsser”.

And the attack has new wrinkles that I suspect will get ported to other CPU chips,

‘University researchers have developed a novel exploit that can steal information from virtually all modern Apple Macs, iPhones, and iPads.

Dubbed “iLeakage,” the exploit targets WebKit, the JavaScript engine that powers Apple’s Safari browser, and is reminiscent of the Meltdown and Spectre attacks of 2018.’

https://www.theregister.com/2023/10/26/ileakage_apple_exploit/?td=keepreading

As Safari “gets around” the issue is likely to be quite wide spread.

‘As Apple requires all browsers on its App Store to be based on WebKit, third-party browsers on Apple devices, like Chrome and Firefox, are essentially just Safari with proprietary wrappers on them that add functionality, and are therefore vulnerable to the attack.’

But when you look at the “how it does it” the actual attacks are quite generic in nature…

‘Most vulnerabilities are the result of software programming, but side channels are hardware-based and can take many forms. Data can be leaked through sound, a device’s power rails, electromagnetic radiation, and other means.

The side channel exploited in iLeakage lies within the speculative execution feature of Apple’s chips. In fact, speculative execution is a feature of most modern CPUs that offers performance benefits.’

And has got around preventative measures Apple put in post Meltdown and Spector.

So it could prove fun… As

“The gift that keeps giving.”

Clive Robinson • October 28, 2023 10:28 PM

@ bl5q sw5N, Winter,

Re : You can not reach infinity in a finite and bound universe.

“It seems we get in a turtle assemblies all the way down and never get a complete account.”

By definition you can not reach the end, so you can “never get a complete account” by definition.

Because some people are cognitively biased to not accept the fact that, they feel they have to sprinkle magic pixie dust explanations around the place to compensate for that.

One such is the notion of “entities existing outside of time”, that they then embue with fantastical abilities, without cause or reason.

It can fairly easily be shown that in a finite universe information is also finite therefore we can never know everything[1]. We just have to live with it and accept there are things beyond our finite abilities[2].

[1] This has been gone through in the past on this blog and I’ve put the explanation up repeatedly, so you can search back for it.

[2] One thing that can be reasoned is that if we actually knew where the universe came from, we would nolonger be in a bound universe which means that the very basic laws of nature on which all knowledge is built would nolonger hold.

Clive Robinson • October 31, 2023 4:37 AM

@ SpaceLifeForm,

Re : ML AI and LLM’s and pick your words with care.

“At least it knows that the earth is not a perfect sphere.”

Having had reason in the past to actually “measure the deviation” from a sphere and use it in other calculations[1] I can say “I know” rather than “I’ve been informed”[2].

People need to realise that LLMs are so far the biggest and most expensive experiments in “GIGO software” mankind has made for the purposes of surveillance.

Worse due to their effects on the environment, LLM’s do actually represent a potential “existential threat” to nature due to the ultimate form of pollution “heat”.

But are they realy of any practical use?

That is to their users are they anything more than a modern version of mid Victorian and earlier parlour ammusments and similar playthings, that cunning artificers manufactured to seperate money from the bored rich…

Remember though… who the LLM Great Great Grandmother was, “ELIZA” a fake Rogerian psychotherapist built in software. Which was designed to get inside your head and get you to talk about that which you would not with others[3].

Not to different to Freudian psychotherapy techniques developed by the now much discredited Sigmund Freud, who apparently spent much time getting into hysterical women from the “idle rich” classes heads.

Which in turn are little different to certain types of interogation techniques still used to get criminals to talk and falsely confess.

Which brings us to,

“I would ask it again if the earth is flat though.”

It’s programed to say almost anything to keep you talking to get in your head further. So if it’s algorithms indicate saying the Earth is flat to you will keep you engaged…

But remember every word you type is recorded and it becomes a third party business record which has no “privilege” thus can be accessed without your consent or notification, but also used to make profit and be sold to data brokers and the like.

As the saying goes,

“You are the product, not the customer.”

[1] It’s not something the average person gets informed of, but is obvious when you think about it. The deviance effects “Great Circles” and “gravitation” thus “navigation” by things that are not as physicall. The problem back in the 80’s was next to nobody knew thus it was not easy to find out the actual figures to the required accuracy for shoving in software for radio navigation devices.

[2] The LLM is at best just an overly compressed library, with a not very good search engine… Ironically it’s these failings that make it “look intelligent” to those that are less understanding in the way it works. Thus it begs the question,

“Is ‘fallibility’ the true mark of humanity in the majority of humans eyes?”

[3] The ELIZA progran was first written by Michael Wallace, about a decade after Rogers wrote his book. And,

“When the original ELIZA first appeared in the 60’s, some people actually mistook her for human. The illusion of intelligence works best, however, if you limit your conversation to talking about yourself and your life.”

http://psych.fullerton.edu/mbirnbaum/psych101/Eliza.htm

Where you can find a version in JavaScript.