Schneier on Security

Clive Robinson • November 20, 2023 9:16 AM

@ Bruce, ALL,

Re : Using Generative AI for Surveillance

“My guess is that it isn’t very good yet, but that it will get better.”

It’s a very obvious use of two different ways it has of analysis,

1, What the user types in as queries etc.
2, From scraping user produced Internet and similar content.

As I’ve been warning on this blog for a while now LLM’s with or without ML assistance will be primarily used for one of two main purposes,

1, Surveillance and aquisition of PPI.
2, Arms length excuses to avoid responsability for “mantra based” activities for political or financial gain.

The fact that Microsoft are going “all in” on this tells you that their use is not going to be in anyway benign, which is why I’m surprised Sam Altman has taken a position with them.

But to give you an obvious example for use that will in the very near future get “talked up” if it has not already is,

“Finding potential persons of interest”

By various “Guard labour” entities.

Apple have demonstrated that the CSAM argument is not going to be at all well received for,

“On User Device Scanning”

Less so than the push for the sofar failed attempts for,

1, Golden key back-doors.
2, End of E2EE.

So they want to jump from basic technical methods against sustems and devices, which was always going to fail as I’ve explained before all a user has to do to beat either is,

“Move the security end point beyond communications end point”

By taking “encryption off device” and using if push comes to shove a secure “hand cipher” which can be done by anyone capable of rational and deliberative thought.

From the “Guard Labour” perspective you are mostly only a threat if what you say or write attracts public attention. To do that it has to be “publicly available”.

Even if not specifically tagged as being from an individual be it by real name or pseudonym. For it to work all it needs is “stylistic match” which LLM’s do incredibly easily. Which then gives a “time line” that can be correlated with individuals time lines.

This can then be pushed by NSL’s and similar to turn into if required “probable cause” to go for more intrusive surveillance, or other anti-personel activities.

On of which is employing a technique seen at Bletchly during WWII they called “gardening” where information and events get focused around you such that you make revealing crypto or similar activity.

None of this is difficult to think through, which means it is going to happen unless made expressly illegal at all levels of “guard labour” and similar agencies / entities.

Which means that “Data brokering” and similar surveillance capitalism has to be made illegal and very promptly. Which would kill the main “Internet income” model of the big corps in Silicon Valley etc.

And in the process kick one of the legs out from under the “the user as a product” model that is so dangerous to society.

Clive Robinson • November 23, 2023 6:19 PM

@ JonKnowsNothing, vas pup, ALL,

Re : AI as clinical decision maker.

“AI won’t make any difference.”

Actually it will to,

1, Increasing profit
2, Reducing cost
3, Reducing life expectancy

And because it’s “arms length”

4, Increasing lawyer costs.

Which in turn will,

5, Increase medical,liability insurance costs.

I could go on but the main point people realy need to remember is health care is a big Merry go-round of money, where those actually giving healthcare like doctors and those receiving it like patients are the loosers and the others especially the white collar profiteers are the winners.

What AI will do is “tip the bias” further in the direction of the profiteers…

As an example…

Hearing aids, use the same chips and technology as those less than 50USD phone headsets… Yet in the UK a hearing aid will cost you upwards of 4000USD…

Epi-pens that cost maybe 1-2USD in parts well 1200USD for two.

Various Diabetes medications are so expensive that a person on an average income could not earn enough in a year to buy even a fraction of the medication cost for a year… Oh and for many years the AMA advice on diabetic control, load them up with carbs and wackin loads of meds. They will get fat develop all sorts of diseases and die a very early death, but it makes doctors costs less and drug companies and insurance companies profits higher…

So much for “caring and sharing”…

Clive Robinson • November 24, 2023 12:24 AM

@ JonKnowsNothing, ALL,

Re : Book on lower middle class and working class in the US.

“To get a good detail on the changes in the USA since ~1970 there is a book on the rise of Deaths of Despair in the USA. It’s written so the average person can understand the changes.”

There is a “working paper” from the authors that can be downloaded which covers things a little bit more briefly.

You can read a very brief outline and download the paper from The “National Bureau of Economic Research”(NBER),

https://www.nber.org/papers/w29241

Importantly it explains the “how” of Corporate Capitalist Culture acting as the primary enabler and driver.

Which is also happening in the UK all be it more slowely and was started by Tony Blair and pushed by David Cameron…

Clive Robinson • November 24, 2023 11:48 AM

@ Winter, JonKnowsNothing, vas pup, ALL,

“The increased despair is indeed limited to a group of low educated rural WNH. But that is because there is less work for these people and it pays worse.”

I think it’s actually rather more than,

1, Less work available.
2, Lower wages.

Consider “job security”.

I noticed when working with Far Eastern (Japan, South Korea, Taiwan, etc). That there is a significant “keep it to myself” culture.

Most manual labour can be done by those who can “pick up the tool” therefore as an employer I have no reason to care if you come or go because I can replace you in as little as half an hour (have a look at so called “gig-economy”). However as a job becomes more sophisticated lead in time becomes increasingly a problem. That is the “on the job training” asspect increases and this is productivitively “dead time” for the employer, yet it has the “full cost” for that time. Thus whilst the “body” might be near instantly replacable the “learned skills” are not. Thus the “fire and hire” cycle is reduced.

The more technically sophisticated, and especially when much of the job can be in an employees head not their muscles the more dificult it is to replace a person.

When you are talking about engineering design and similar to lose a “key employee” half way into a project can kill the entire project dead with massive attendent costs / losses.

In the Far East they knew this thus where they could they kept “secret knowledge” very much to themselves as firing them would be a major issue. Those who used to work with “Microsoft Foundation Class”(MFC) libraries, knew that using the “Microsoft approved entry points” was at best inefficient, and it was said by those that “reverse engineered” Microsoft applications that there were other entry points Microsoft used but did not publish so Microsoft had a “competitive advantage”. How true this was is open to debate, but it’s certainly true in the early days that “power coders” used to use many unofficial and undocumented entry points. They very certainly tried to keep such things very secret even in their own code, hence the “we know but don’t document” barrier to others who might replace them.

As a rule of thumb, the better qualified you are the more your job is “brain skill not brawn skill” and what you hold in your head is of vastly more worth thus your job security is very much higher. Which also counts for a lot when it comes to “pay negotiations”…

I found this out one day by accident. The boss had in the past given me a load of crap why I was not even worth an inflation rise let alone one for the effective promotion…

But some one in HR had ‘tipped me the wink” a couple of weeks earlier that others were getting 10% above inflation. So after a chat with a colleague I’d gone out and got another job offer that was the equivalent of a 40% rise. And I’d already accepted, unbeknown to my then boss.

In the evaluation meeting the boss pulled the “company is in difficult times etc etc and how very luck I was to get the very very small raise he had, had to fight senior managment to get for me”. I knew it was compleate cattle scat and just took the payrise letter and did not say very much. The following day I de-documented all my work and changed names in code and started spaghettifying not just code but other work so it was way to conveluted to get your head into. At the end of the week I handed in my notice not to my boss but to HR after my boss had gone early, and I’d requested I be payed for my outstanding leave entitlement. Come monday mid morning he opened his mail and got a note in the internal mail about me having handed in my notice… And it was then that he draged me into his office and stupidly demanded to know what game I thought I was playing in effect accusibg me of trying to “shake him down”… and he stupidly got the hump after I simply reiterated the facts, he made some comment about he would see if he could get me more money, and he later came back with a couple of percent more. I told him “to little to late” and that, “that boat had sailed” and I was going for a long holiday on “my boat”[1] for a month down into the Mediterranean to relax and sort things out. He was very very anoyed and told me I’d have to do a handover and document in what he incorrectly thought would be a months notice…

Later that day the afternoon internal mail got to peoples desk in trays and quite supprisingly some got photocopies of the entire depts pay rises, how I realy don’t know… Anyway he got to hear about it and assumed I was behind it and made the old “you’ll never work again” style argument in front of witnesses… I was advised to put a formal complaint by HR, for harrisment… They decided it was best they let me go home on full pay and owed holiday pay etc rather than work my notice.

A salutary lesson about “Knowledge is power” if you are prepared to use it.

I was later told[2] that after I left the project I had been running went compleatly sideways then crashed and burned and most thought I’d done well to get out when I did.

A few months after that apparently the boss took –enforced– early retirment, and the last I’d heard of him was in 98 apparently he’d set himself up as a “consultant” but was not bringing the money in as it were. The skill set he had, was suffering a “market turn down”. However others of us had hit the Y2K trail and were pulling in decent money. I jumped into a new proffession and full time job about mid 99 as I could see a “night of the long knives” comming up as accountants and their bosses would want to get their Y2K spend back. As it turned out the night of the long knives was a long time comming and 9/11 kept the money rolling in for those who were flexible enough to have dodged the IR35 rules that were shockingly applied retrospectively. It was the first Finacial downturn / recession in 2003 and Crisis four years after that, which finally stopped the ball rolling for “the independent contractors” in the UK.

It’s the IR35 rules that the likes of major Corps are exploiting on the “zero hours” and “gig economy” jobs like Uber-Eats. Basically they put in the workers contract a clause that says they have to be able to provide a relief / replacment and the contract will be terminated if they don’t. That way they are an “agent” not a “worker” so have no legal protections. This in turn has created a sub culture of people actually acting like an agent, or more correctly a “gang master”.

Which brings us back to a point @JonKnowsNothing made a couple of days back.

[1] I used to have a largish sail boat that I used to race and cruise with. One or two work colleagues had been out on it for a day sail or just to crew and I’d alowed one or two to borrow it for a weekend or week to “get away”. And they had stuck photos up on the company notice board of their happy and sometimes green faces. So it was well known that “He’s got his own yacht”…

[2] Oh and the company I went to work for, I’d got the job through one of my old work colleagues who’s brother worked there and needed a good engineer so it was a “good fit”. Apparently my old colleagues got to find out how much I was earning at my new job very quickly. I found this out one night through some of them at a Stag Night a month or so later. For the wedding of the girl from HR who was marrying the guy who sat at the desk next to mine. They were borrowing my boat for their honeymoon –which is why I’d sailed it down to the med on a “shake down”– as they were saving up for a house deposit. Apparently staff turnover in the old Dept had gone up dramatically as well.

Clive Robinson • November 24, 2023 4:51 PM

@ Winter,

Re : De documentation are spaghettification.

“Clive, is this really you?[1]”

Yup it’s me.

I did bot say that the code stopped running or could not be built.

It was just not easy to read…

For instance in the original source a variable of

CntDnSecs

Is more or less clear. But a change to

Int_173

In no way changes the functionality of the code. But it makes the redability that little bit harder.

You can make it even less readable by turning it into a local pointer to an entry in a ptr table that gets populated in the start up code. Also consider the likes of Stack Randomisation for security and the many ways you can do it.

This is actually not unusuall, especially if you write as I often do “stack based code” which means the code is that much closer to being fully reentrant and will happily run on 16bit or less microcontrolers that at best have no way to relocate code that gets interpreted.

Back in the 80’s and 90’s in the UK reentrant code that was reusable was the rage, and there were no laws that said the code you wrote had to be “poetry in execution”. Stack based code where you do your own memory managment can be increadably benifitial when things have to be ROM based and you have no MMU to obfiscate code position.

Worse it was the start of the craze for “overloading” so yeh code was less clear than that pit of snakes in a Harrison Ford Movie.

Have a look at the original C++ code it was actually C code using tables of structures hidden behind macros and the like…

As for documentation, then as now documentation was fairly optional…

Also the fun thing the UK copyright to the source code that produced the run time code that went into the compiler, belonged to an employer, the documentation and even macros and libraries that went into a pre-processor and got linked etc did not, the copyright on those belonged to the person who wrote the code behind them.

Clive Robinson • November 25, 2023 4:08 PM

@ JonKnowsNothing, Winter, ALL,

Re : Autism counts in ICT thus AI.

“AI datasets are predominately male views, and repositories of historical data mined by AI for their training sets is male oriented history.”

This is to be expected for many reasons but three you might want to consider,

1, Historically women were discouraged from STEM especially TE (something I’ve fought against all my working life. As I used to sarcasticaly say women were taught that the epitome of female achivment was the perfectly cooked backbeans on toast for her childrens tea).

2, The “voices” are not ephemeral and thus only current, they are doccuments that accumulate. Thus if every male “voice” stopped parity of comment in the corpus would be something like a half to full decade away at best.

3, In STEM high functioning autism goes a very long way in espectially in TE. Depending on who you ask there are four to five times as many males on the high functioning autism spectrum than there are females. Personally I think the difference is less. Because autism is a “social communications” personality disorder, the presented male symptoms, unfortunately further drive women out of the more tech heavy side of TE.

Have a look at “Gamer Gate” and “Cancel Culture” in TE and what was once called “Knuckle Dragers v. Pinko Hairs” later “SJW Doxing/bombing/gaslighting” conflicts and you actually see two sides of the same problem fighting each other.

Shockingly for some when told it shows the behavioural sex divide in high functioning autism spectrum presentation. In part because women learn to “mask more” than men do. In short the level of high functioning autism spectrum women is probably very much higher than currently diagnosed because the diagnostic methods are aimed more at male presentation charecteristics and women very much have to mask more than men just to be even on the edge of Neuro Typical female group dynamics.

Masking is something that is increadibly stressful, because in effect you have to lead a double life without having time to “decompress” and recover. Thus inability to perform at a high functioning task is degraded at best and mental health issues abound.

One of the things about “lockdown” that has scared politicians is that the workforce apparently are not going back to work. Whilst Long Covid is very real, there are significant mental health issues that have been drawn out by the issolationism that lockdown caused.

Whilst those “who need to live in other peoples heads” –micro managers etc– suffered, less recognised is that those “who need to live inside their own heads”, felt freedom like they had not felt it before. That is during lockdown they mostly did not need to mask and they very much decompressed and as a result realised they did not want to go back to the sheer fear and tourture of leading double lives fealing effectively like “enemy agents living behind the lines” in the country of the Neuro Typicals.

Keep your eyes on the scientific literature to see this start to get documented and the political battles it will cause… As the neo-con types seek to “dominate and suppress” by victimisation and blaiming, as you would expect from “strong-men” types with their significant personallity defects that are currently better documented due to their very significant harms and risks to others. It’s why the “Drive them back to work” right-wing dictitorial attitude is extrodinarily detrimental to society espexially for the vast majority who sit between the two ends of the bell curve.