Scientists have found Strawberry Squid, “whose mismatched eyes help them simultaneously search for prey above and below them,” among the coral reefs in the Galápagos Islands.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
&ers • December 1, 2023 6:08 PM
@ALL
We have a new ID card problem.
hxxps://news.err.ee/1609180264/newer-estonian-id-cards-have-been-setting-off-in-store-security-sensors
vas pup • December 1, 2023 7:04 PM
AI-powered digital colleagues are here. Some ‘safe’ jobs could be vulnerable.
“Many workers may have believed that burger-flipping robots in fast food restaurants, or advanced fabrication machines in factories, would represent the first wave of AI-related job losses. Yet the light-speed adoption and evolution of generative AI tools may now mean knowledge-work jobs that were long considered “safe” could be threatened even faster than workers anticipated.
That includes creative positions that many presumed would be hard to automate, in fields like marketing, music production and graphic design.
That’s because generative AI tools and technologies can – or will soon be better able – to do all many things that have, in years past, been left to highly skilled humans: think tasks such as putting together marketing plans, search strategies and much more.
Accordingly, researchers have found that the “exposure curve is upward-sloping”, says Mark Muro, a senior fellow at The Brookings Institution, who focuses on the interplay of technology, people and places. This means people in what may have traditionally been thought of as higher-echelon, professional positions are the workers most at threat of replacement by AI.
“Part of the intense interest and concern is that this isn’t somebody else’s problem now, it’s an issue for the white-collar office worker who is firmly in the middle class,” he adds. “All of this is surrounded by tremendous uncertainty in part because the technology is somewhat mysterious and a black
box, so we don’t know exactly how this is going to play out. Physical =>automation was a lot more predictable. This is less predictable.”
Whether the white-collar workforce is diminished by AI technologies will, ultimately, be a societal choice. Workers will need to have a say in how AI is introduced and used in particular industries – and hopefully, that can lead to better outcomes for everyone, he says.
One example of this is the deal between the Screen Actors Guild (SAG-AFTRA) and Hollywood studios that outlines limits for the use of AI in film and television production. The question is whether other industries will codify similar stipulations to preserve their workers’ livelihoods.
“We are inevitably going to get to a point where AI makes much of human work redundant, and that’ll be a painful period.”
My nickel: https://en.wikipedia.org/wiki/Luddite is this possibility for AI as well?
JonKnowsNothing • December 1, 2023 8:03 PM
@vas pup, All
re: burger-flipping robots
Technically, there is a lot of machine automation in food production. There are lots of existing burger flipping robots, we just don’t recognize them.
In the vast array of frozen, prepared, canned, packaged foods, most of is done by machine.
iirc(badly) A bread bakery chain in Silicon Valley had a public sandwich bar where you could watch through full length glass windows, the bakers working on that evenings’ breads.
One of my favorite runs was the cinnamon roll run.
The baker would mix huge batches of dough in giant kettles on wheels. Everything was machine measured and machine mixed. When the dough was done, it was pushed over to a rolling machine. It was dumped in a big hopper at the top and the after passing though several rollers it came out the bottom ready for the next step.
The baker would lightly fold up the dough and carefully add it to the end of the previous dough going though the machine.
As it passed a certain point, huge bins of cinnamon and sugar would dribble out their contents onto the flat dough, covering it from edge to edge.
Next there was a cleverly placed diagonal bar that caused the flat dough to curl. It progressed through the curler until it was the classic cinnamon roll shape.
After thatm it hit the cutters which sliced it into the correct portions.
At the bottom was the box crew. They grabbed 6 or 12 sliced sections at a time and placed them onto long trays for baking. Once the 10-20 tier racks were full of trays, they were wheeled into the ovens or refrigerators.
1 baker / 3 or 4 boxers / 1 oven loader
Everything else was done by robots and 60-100 ft of conveyor belt
Similar machines are used to make canned soup, process frozen veg, and jars of apple sauce.
AI isn’t going to make a lot of difference in how foods are processed, only in how much is processed.
Foods are consumed by humans and animals. Foods are not needed for machines or AI.
Machine oils and maintenance might need to be done humans but if there are less humans buying your applesauce then you don’t need to make so much of it.
A video travel log about a Caribbean Island, where sugar was once the main business on the island. The docent took them to the last sugar factory.
It was called a Dark Factory because there were no lights. No humans worked inside the factory.
The farmers brought their sugar can and dumped it into be hoppers, then left.
At the other end was a machine that filled the bags with sugar and sewed them closed and stacked them on pallets.
Buyers just picked up what they ordered or the pallets taken by truck to the harbor.
I don’t think AI will improve that process much.
AL • December 1, 2023 10:35 PM
A “preview” update was issued to Windows 10 that is supposed to enable the AI Copilot tool. Next person that it wound up working for that I hear of will be the first.
https://betanews.com/2023/12/01/kb5032278-update-brings-copilot-to-windows-10-and-improves-news-and-interests/
That said, AI robots/assistants will become a thing. Thing is, this Windows 10 snafu/rollout that’s going on, I can relax with my 5 other AI robots that can do this “generative AI”. But it’s coming, Spock’s computer. There may be the vanilla, chocolate, and strawberry flavors, but it’s coming. I hope it differentiates on the AI that tells the truth. That’s where the concern of governments that like to lie are grappling with. The last thing that these governments can handle is an AI that tells the truth.
Clive Robinson • December 1, 2023 11:41 PM
@ vas pup, JonKnowsNothing, ALL,
Re : Remember make-work?
“AI-powered digital colleagues are here. Some ‘safe’ jobs could be vulnerable.”
There are no “safe jobs” but there is quite a lot of “make-work” jobs that pad out peoples empires and represent around 1/3rd of the non direct labour workforce. Often it is in administration where statistics are colated or similar to make reports that few get and even less read.
Some think getting rid of the “makeworkers” will lead to “vast profits” via “lean and mean” and “get faster” and similar used to disguise the “don’t leave money on the floor/table” mantras of neo-con idiots.
Why idiots? Well a bit of history I and I’m sure one or two others here lived through…
Back in the late 1980’s and into the 90’s there was this idea that you had workers on the shopfloor and you had senior managment making the strategic decisions. With various types of manager in between.
The argument was that all the “managers” in between were “make-weights” that made up more than half the wages bill and a big chunk of “office space” expense, and as they were older pushed up the healthcare pensions etc.
So why not replace them with computers?
Which gave rise to the notion of “Business Process Re-engineering”(BPR)…
It looked great on paper, it looked good to the shareholders, and the directors saw big bonuses in their future…
The story of what happened was a salutory one as the first bump in the road put many out of business.
Those managers were the real knowledge base in the organisation. Come an emergancy they simply handeled it by short circuiting senior managment and the directors.
Once they and their knowledge was “out the door” the business became fragile.
Worse having made the big savings, share holders demanded repeats each year…
Thus you have to ask the question if you are axing employees, what are you also chopping out?
Mostly we don’t know, and those tasked with the job don’t know, nor do they realise they are even more expendable than the people they are getting rid of…
I could go on, but I suspect that a lot of MBA types are going to be the first up against the proverbial wall. Will they be missed? Some maybe others not.
The hardest hit will be education establishments at the graduate level that crank the handle on the current “must have a degree” culture.
One of the failings that started back in the 1980’s was Human Resource depts and their “qualification inflation” process.
The last time I excoriated HR Depts for this nonsense on this blog, was quite a few years ago and at the time it got censured… Even though things have changed and it’s way more obvious… I’ll let others do their own research.
Clive Robinson • December 2, 2023 12:23 AM
@ AL, ALL,
Re : MS Copilot upgrade,
In the article you linked to you will find,
“In addition to bringing Copilot to anyone outside of the EU”
Why not the EU?
Well it’s a tacit admission by Micro$haft that as the surveilance tool Copilot is, it’s unlawful if not illegal in the EU…
So, people should ask themselves a serious question, if a geo-political area of twice the population of the US will find such intrusion and coerced theft of personal and private information of it’s citizens by Microsoft unlawfull or illegal and Microsoft knows it then,
“Why on earth would you alow it on your computer?”
Note also it’s not aimed at business users but only personal users, this should be a further “Red Flag” of large proportion…
Personally I’d not give it house room because people will end up regreting it then be unable to get rid of it. Better to as Nancy Reagan used to advise about similar dangers “Just Say NO!”.
Ismar • December 2, 2023 12:43 AM
Review recommends major changes to Australia’s National Security Information Act
Clive Robinson • December 2, 2023 12:47 AM
@ &ers, ALL,
Re : Doing it on the cheap.
“We have a new ID card problem.”
Estonia may be the first with regards National ID cards for this problem but…
The issue is that the “Over The Air”(OTA) interface is “standardized” at what you might call the “Physical Layer” so many chips use it. Including those used in bank, trave, ID and similar security cards, and also security tags used in shops.
The way they work is that they are “energised” by a burst of RF, and they then use this energy to transmit back an ID number or equivalent.
Most readers are small pads with very limited range thus you only get problems when more than one chip is close to the reader system focus.
The problem with security gates is they are wide range thus even having cards in seperate pockets could transmit simultaniously thus interfering with each other.
A not well known failing of these more “high tech tag gates” is they lack discrimination and to make up for this potential vulnerability in their own system, they behave as though they are being attacked by jamming and thus assume it’s a thief and alarm.
The fact they lack discrimination is because they are in part “made on the cheap” and in part there is only so much you can do inside the laws of physics.
The simple solution is for the tags or the cards not to use the same OTA interface… But that’s seen as a needless expense…
JonKnowsNothing • December 2, 2023 2:28 AM
@Clive, @ vas pup, All
re: if you are axing employees, what are you also chopping out?
Similar results came from compartmentalization. The narrowing of skills and knowledge to a smaller and smaller segment area.
People only deal with the narrowest definition of what they are doing. Curiosity is not rewarded. It might be that the job is so narrow that any cog can fit in the gearbox.
RL tl;dr
I had an exchange with a kidney specialty medical tech about kidney function. I asked them a specific question about how the kidney works.
The answer was: I don’t know, I don’t know anything about how the kidney works.
I give them props for saying they don’t know.
However, it puzzled me that anyone working in a kidney specialty area wasn’t the least bit interested in the kidney conditions being treated, although they were handing out treatment details, labs and Rx.
Winter • December 2, 2023 3:40 AM
@JonKnowsNothing
It might be that the job is so narrow that any cog can fit in the gearbox.
That is the whole point. Anyone who is irreplaceable is a liability for obvious reasons [1]. Also, the easier someone can be replaced, the less you have to pay them.
I think the latter is the more important reason for “dumbification”.
[1] To spell it out, if the “build guru” quits, who builds the product? For the older generation, what was Queen after Freddy Mercury died?
Winter • December 2, 2023 3:43 AM
@JonKnowsNothing
The answer was: I don’t know, I don’t know anything about how the kidney works.
You need a surprising amount of chemical and (cyto-)physiological knowledge to even start the get a feeling of what a kidney does.
Robin • December 2, 2023 4:46 AM
The French government has banned WhatsApp, Messenger, Telegram and Signal from use by government officials.
Gone are Whatsapp, Telegram and Messenger, and the government has just instructed its staff to use a new, more reliable French communications application, Olvid, from 8 December.
After TikTok, Twitter and Candy Crush, the French government will now also have to do without WhatsApp, Telegram and other similar applications. For security reasons, Elisabeth Borne has asked her ministers and their teams to turn to the French application Olvid, according to a circular revealed on Wednesday 29 November.
(source: Libération, 30 Nov 2023, but it was widely reported in France this week)
Olvid (https://olvid.io/en/) is a French substitute for secure messaging.
“More reliable” and “security reasons”; of course.
Winter • December 2, 2023 5:10 AM
@Robin
the government has just instructed its staff to use a new, more reliable French communications application, Olvid, from 8 December.
Olvid sounds very, very unfrench. The French government has been one of the strongest voices against e2e encryption.
‘https://olvid.io/en/
Olvid does not require any personal data: no phone number, no email, no name, no surname, no address, no date of birth.
No nothing.
Unlike your previous messenger, Olvid will never request access to your address book.
What happens in Olvid…With Olvid, everything is end-to-end encrypted using cryptographic protocols with unrivalled power. Your messages & attachments are systematically protected.
Olvid’s cryptographic protocols are able to guarantee the security of your data even if our servers are hacked.
Will obviously be continued…
&ers • December 2, 2023 7:41 AM
@ALL
hxxps://www.theregister.com/2023/12/01/uefi_image_parser_flaws/
AL • December 2, 2023 12:02 PM
@Clive
Why not the EU?
I don’t have an opinion on that, so I asked Zuckerberg’s Meta AI built into WhatsApp.
Why is Microsoft’s Copilot not available in the EU?
Microsoft’s Copilot is not available in the EU due to the Digital Markets Act, which restricts market monopolization and requires fair digital market rights ¹. While Microsoft works on compliance, users in the EU can still enable Copilot using a command ¹. The initial rollout excluded the EU, but Microsoft aims to make Copilot available in the region ². (References omitted)
This AI is a barrel of laughs. My computer now has an opinion.😜 It is, however, very useful and saves time.
Robin • December 2, 2023 12:03 PM
@Winter: my feeling too. I can understand their reluctance to go along with the usual messaging suspects, but given their antipathy to e2e one can’t help feeling that they know something about Olvid that we don’t.
lurker • December 2, 2023 12:25 PM
@&ers
Monty Python lives: holding his wallet above his head entering or leaving a store.
I once had a backpack that set off the alarms and accusing stares going IN to stores. One day a wise sales assistant said “That’s a Brand XX bag, give it here,” and she permanently erased the elusive RFID chip.
AL • December 2, 2023 12:35 PM
@Clive
“Why on earth would you alow it on your computer?”
I’ll tell you why. It saves a lot of time. Think about a question, and the answer is buried in a youtube video. This AI can spit out an answer with steps in under a minute. I’ve already bypassed 2 hours of video. Now, I would probably have passed on the videos, but I wouldn’t have had the answers. And one of those questions was how to navigate a complicated transaction as Fidelity investments. And that particular transaction is worth money to me.
My rule on the AI is, I’ll allow it, but I use the AI. The AI doesn’t use me. Nobody should be pouring out their heart to it. But in appreciation for that Fidelity answer, I did ask it what are the best Italian restaurants in my area.
This AI is going to be a Google search killer.
lurker • December 2, 2023 12:38 PM
@&ers
So, watching Dancing Bears while the machine boots might not have been such a good idea, if they come in thru a backdoor. What’s wrong with the boot-log text scrolling by, white on a black ground?
Clive Robinson • December 2, 2023 2:43 PM
@ Bruce, ALL,
Re : AI for Everything at Microsoft.
Once upon a time there was,
“What ever the question is… The answer is not Microsoft.”
And similar refrences to the very definition of malware was Microsoft OS’s and apps…
It appears that the problem is still there and Microsofts solution “don’t fix it, just rub some funk on it”. With the funk now almost universally being AI…
Microsoft pins hopes on AI once again – this time to patch up Swiss cheese security
https://www.theregister.com/2023/11/03/microsoft_secure_future_initiative/
Brad Smith, Microsoft president, pointed to the fact that Microsoft are well behind the curve with,
“In recent months, we’ve concluded within Microsoft that the increasing speed, scale, and sophistication of cyberattacks call for a new response,
Therefore, we’re launching today across the company a new initiative to pursue our next generation of cybersecurity protection – what we’re calling our Secure Future Initiative (SFI).”
The rest of the article is definitely a “song sung blue” for Microsoft though that screen of death is apparently not as common %wise as it once was (though I suspect in part it’s because malware writers are now better on average than Microsoft coders).
I realy get the feeling Microsoft has lost it’s way, and has little clue as to where the path out of the “Forest of Doom” they have created around themselves is…
JonKnowsNothing • December 2, 2023 3:38 PM
@Clive, All
re: The Hayden One Question and Palantir NHS Data Slurp
Palantir has been drooling over the NHS Data Store for a long time. Google got a hunk a few years back. Palantir is scheduled to get the whole enchilada. (1)
There are pros and cons:
The pros include statements from MDs and Researchers like:
Of course they won’t know if they find anything because they don’t know what they are looking for to start with. Stories are legion of how stuff almost got trashed. Penicillin, Sticky Notes, Sulfur is reactive (1804)….
And of course, the individual’s condition or DNA that leads to a megaton dollar drug, will yield them $0 is return. In USA, Kaiser Research DNA and Health Database, was also supposed to be only for RESEARCH but has now entered into agreements with a more shady-side of research … the profit side of research. All they had to do was change a few lines in the disclosures to make everything hunky dory and retroactive.
So in order to convince or coerce people into accepting the situation (where there is only 1 choice) the Hayden One Question showed up.(2)
You can find the parts of the Hayden One Question in reporting about NHS Data Merge.
Hints
If you read the MSM report justification you will see the Hayden One Question there pretty clearly.
After all it is Palantir aka the CIA, one of the formulators of The One Question.
===
1)
ht tps://www.theguardian.com/commentisfree/2023/dec/02/you-may-balk-at-giving-health-data-to-palantir-but-it-could-save-your-life
2)
ht tps://www.s chneier. com/blog/archives/2023/11/secret-white-house-warrantless-surveillance-program.html/#comment-429274
The Hayden One Question
If we halt what we are doing and there is another disaster like 9/11 (or even bigger than 9/11) and that disaster could have been stopped had we kept those programs, are you willing take responsibility for all the deaths and all the destruction.
Are you willing to put your name on the order that said “stop”?
General Michael Hayden ~2014
emily’s post • December 2, 2023 3:44 PM
Keeping it fairly chill with geothermal power turned upside down
vas pup • December 2, 2023 6:42 PM
@Clive – on HR I agree with your point. They got too much power in making hiring decisions and other regulating office behavior unreasonable policies using law departments as a shield to prevent trouble with potential law suits.
Final hiring decision should be made by objective transparent parameters/criteria of prospective employees not by so called ‘holistic’ decisions which for me is pure BS /pardon my language.
vas pup • December 2, 2023 7:01 PM
@Clive – one more point on HR and hiring a practice: any hiring and promotional policy based on anything else than objectively measured skills and positive results being done by candidate is for benefiting mediocrity only but not good for company/agency in the long run. It creates too much ‘ballast’ in the staff and just more load for those who could really do the job. This is potential artificial source of internal tension since pay rate is the same.
That is why I am pro AI will replace HR altogether as the first productive move.
SpaceLifeForm • December 2, 2023 7:23 PM
@ Clive, ALL
re: Carrington Event?
‘https://spaceweather.com/
A huge hole has opened in the sun’s atmosphere, and it is directly facing Earth. Solar wind flowing from the hole will reach our planet on Dec. 4th or 5th. Its arrival should spark G1-class geomagnetic storms.
JonKnowsNothing • December 2, 2023 10:27 PM
@vas pup, @Clive, All
re: HR is not always that HR but not much better
The omniscient HR is pretty much gone with the Schwinn.
The HR as the corporate mouthpiece version, is mostly about benefits management. Other than helping people sort out which Corporate PPO Health Plan to select and make sure they have your W4 (tax info) on file, they don’t do too much. On rare occasions they become embroiled in serious workplace issues, which they try to avoid by terminating the least-cost end.
For tech issue hiring, the biggest gate is other tech workers. Either the candidate has too little experience, so they don’t hire them so the person cannot get any experience, or the candidate is over qualified meaning: the person knows more than their proverbial boss, and showing that the boss is not a tech-god, doesn’t go well either.
The issue of pay is really not left to HR, it’s part of Tax Avoidance Accounting. It’s pretty simple how it works.
It’s a recursive problem.
There is a hierarchy of pay levels. BigBosses get Lots, Minows get Little.
The issue for the BigBosses is there is a tax penalty for making Lots. They do not want to pay this penalty so they call in the Tax Avoidance Expert CPAs.
These folks come up with many strategies to reduce, mitigate or defer the tax on Lots.
One of these strategies is to reduce the amount of Lots by n% which yields a n+y% tax deferral or tax reduction.
They simply set up the SS to do goal seeking over the tax variables and hunt for the point of equilibrium. Where any reduction no longer has a beneficial tax deferral benefit.
That n% reduction is what gets distributed as bonuses and annual pay rises.
HR mostly does the payroll administration and pretends this amount is Management Largess in your pay packet.
While @Clive and others here are incredible smart, knowledgeable and clever as they come, I don’t think any of my former bosses would have hired them. Those former bosses got Lots of VC cash and start up lolly, so they weren’t unqualified, just not as qualified as the folks here. TBH I don’t think any of the folks here would have wanted any of those jobs anyway.
Clive Robinson • December 2, 2023 11:08 PM
@ SpaceLifeForm,
Note “G1” which id classed as Minor.
We’ve supposadly just had “G3” this weekend… and due to 100% cloud cover no pretty lights in London.
And it’s Monday morning here, without the excuse of blown out technology every where to stay at home and away from the office…
I will carry on doing what I did over the weekend which is “Prepare for lightening storm”.
Now if they start talking about a “G4” or above I’ll take a few more precautions.
If however you live where most of your power and comms grids are above ground, then I’d be more concerned.
The thing about the Charington Event back then we did not have much in the way of “Electro-mechanical” technology, and certainly no electronics be it valve/tube or semiconductor, even “gas” for lighting was quite local.
Whilst the primitive electro-mechanical telegraph network was effected quite dramatically, it had little real effect on how people lived at the time.
As for the manmade equivalent of “StarFish Prime” in the 1962 “Fishbowl tests” the effects of that have in a lot of cases been mittigated to a certain degree. That is a lot of comms is nolonger copper but glass, and EMC requirments have reduced susceptability for a lot of things.
A large electrical storm from terestrial weather is on probablity more likely to cause you damage as a local rather than a regional or hemispheric event of space weather.
That said another Charington will happen at some point, and it could be G5 busting (Kp of 9 or above). As like the Beaufort Storm Scale, they are quasi-logrithmic scales. Back when Beaufort came up with his scale, he stopped at 12 on the reasonable assumption that it was the limit of survivability but new that there was worse… G5 top out is by no means the worst that could happen, but realistically we probably would not care or be alive for long enough to do so…
ResearcherZero • December 2, 2023 11:12 PM
Law secretly written by ChatGPT comes to pass…
Prevents the city from charging taxpayers to replace any water meters stolen by thieves.
“If I had revealed it before, the proposal certainly wouldn’t even have been taken to a vote.”
https://apnews.com/article/brazil-artificial-intelligence-porto-alegre-5afd1240afe7b6ac202bb0bbc45e08d4
–
The malware can also be used to inject code into an application because the virtualization solution first loads its own code into a new process and then loads the code of the hosted application. FjordPhantom spreads primarily through email, SMS, and messaging apps.
‘https://promon.co/security-news/fjordphantom-android-malware/
–
All those edge devices keep getting hacked, and home routers are still being abused.
‘https://www.bloomberg.com/news/articles/2023-11-29/google-warns-china-is-ramping-up-cyberattacks-against-taiwan
These targeted attacks followed largely the same playbook, signaling a pattern in the APT group’s operations.
https://unit42.paloaltonetworks.com/stately-taurus-targets-philippines-government-cyberespionage/
“The interesting thing with these routers is that they tend to be bridging potentially critical devices with the Internet directly.”
‘https://www.darkreading.com/vulnerabilities-threats/21-vulnerabilities-discovered-in-crucial-it-ot-connective-routers
ReseacherZero • December 2, 2023 11:17 PM
Image parser in firmware allows for bootkit, (which probably everyone already read).
https://binarly.io/posts/The_Far_Reaching_Consequences_of_LogoFAIL/index.html
Clive Robinson • December 3, 2023 4:12 AM
@ SpaceLifeForm, ALL,
You might find this of interest,
http://geomag.bgs.ac.uk/data_service/space_weather/Global_activity_now.html
I forgot to include it in my above from earlier today…
ResearcherZero • December 3, 2023 4:22 AM
Getting really drunk…
“The senior officer allegedly dumped the car in North Sydney and fled the scene.”
‘https://www.smh.com.au/national/nsw/top-nsw-cop-s-name-to-be-secret-until-2063-after-drink-drive-charge-20231201-p5eoej.html
A Justice Department spokesperson initially told the media that they would be allowed in, but this advice changed.
‘https://www.abc.net.au/news/2023-12-01/tas-gregory-geason-judge-charged-supreme-court-assault-abuse/103179152
–
The question is why does Australia keep doing it?
“The majority of cases are designed to finish in the police station by whatever mechanism of disposal.”
A shift away from going to court to decisions being reached behind closed doors, all in the name of efficiency. These impacts ranged from how its police force began treating citizens as “customers” to its court system having performance indicators, including appeal rates, cost-per-case and client satisfaction (s**t).
“…it does not take account of the need for personal relationships in many of the interactions between the state and individuals.”
https://www.abc.net.au/news/2023-04-04/australia-justice-systems-cost-efficiency-productivity-concerns/102112506
All Australians have, under the law, the right to seek justice. But this right doesn’t count for much if it cannot be exercised.
“Most of our knowledge on wrongful convictions is based upon serious cases that follow a contested trial. This does not reflect contemporary criminal justice systems where most criminal cases are resolved by a guilty plea.”
‘https://research-repository.griffith.edu.au/handle/10072/423038
Clive Robinson • December 3, 2023 4:44 AM
@ emily’s post,
Re : Getting energy from the cold.
“Keeping it fairly chill with geothermal power turned upside down”
It will work but not that well…
The trick to getting work out of heat, is the “difference” you can “usefully” get. Obviously the greater the difference the greater the work available. However the important word is “usefully”.
The system they are using works only in a very narrow part of the spectrum thus they only get a small percentage of the available work.
They say they get 2W/m^2 which is not a lot[1] and at a price of say 10c / kWh is not going to pay for it’s self any time soon.
Thus it needs to be a “side effect” of some other function which is why they are looking at using solar cells or similar.
[1] The simple maths would suggest at 6hours a night you’ld get 1kWh with 800sqft which is about the size of a flat house roof.
Clive Robinson • December 3, 2023 5:51 AM
KISS Goodbye not likely
Whilst there has been a lot of news of late about LLM AI, it’s kind of overshadowed other news of import such as the use of avatars for various purposes.
As some may know KISS the band now finding tight spandex and leather chaf the parts that less stagey clothes do not had the last date of their “live” farewell tour.
But at the close their avatars appeared to do a rendition of “God gave rock-n-roll to you”.
It’s been speculated that this will but “new life in the band” as it were and that they will go on as much as three times a night in different places.
https://apnews.com/article/kiss-digital-avatars-end-of-road-finale-37a8ae9905099343c7b41654b2344d0c
The question people should be asking is not just about avatars replacing band members at concerts but will AI write new songs and give virtual interviews etc?
And importantly what about avatars as politicians, legislators, judges, administrators, and similar, where they stand in positions of social development / progress?
We already have examples of AI writing legislation abd newspaper articles, how about avatar news presenters and talking heads?
These are all “white collar jobs” that attrack high payments currently, thus cost savings of avatars could be seen as benificial by some, and a good way to do arms length manipulation by others…
Winter • December 3, 2023 5:59 AM
@ emily’s post,
Re : Getting energy from the cold.
Great technology.
This method is not exactly new. It was already practiced by the old Persiansn.
‘https://theculturetrip.com/middle-east/articles/this-ancient-technique-to-make-ice-in-the-desert-is-mind-boggling
Basically, all you need is a deep (insulated) hole in the ground that looks up into the sky and very, very dry air. Conditions easily obtained in a desert. You close the hole during the day so no sunlight or warm air can enter. Open the hole at night and you get freezing temperatures at the bottom.
New is materials that obviate a deep hole and can generate electricity.
From the link:
That outgoing radiation sends the heat from an object on Earth to outer space, a reservoir with virtually limitless capacity.
I think that “virtually” can be removed here. The heat death of the universe will not happen.
Clive Robinson • December 3, 2023 6:35 AM
@ ResearcherZero, ALL,
“Image parser in firmware allows for bootkit”
Why this happened is a long story of people not learning from history.
I suspect most know of “little bobby tables”[1] from the XKCD cartoon. It’s an amusing way of showing that unchecked user input that goes into any type of interprative process is going to get abused.
The problem with “media” such as audio, pictures and video is that it is in it’s raw form excessively bandwidth intensive, but importantly is mostly redundant.
Therefore an obvious move is to remove the redundancy in some way.
As some will know PDF files that have been much abused over the years are based on the ideas in PostScript, which is basically an efficient stack based programing language similar to Forth that tells the computer what to draw[2]. As such highly complex images can be reduced to a few lines of program.
And thereby hangs the problem, you have users entering programs unchecked into an interpreter.
Trying to “sandbox” an interpreter is actually very hard, the more power you give to the interpreter the more complexity thus more opportunity for a user to abuse it and break out of the sandbox.
The thing about firmware is at the end of the day it’s ROM code which is both static and expensive. Neither are conducive to good security…
So the question should be,
“Why on earth was such software added to the UEFI firmware ecosystem?”
It smacks of “Bad marketing decisions” and is something that various people should be answering for. Especially as it is both long known and well known to be a security hazard.
[1] Actually titled “Exploits of a Mom” it shows the danger of not checking user input,
[2] Children used to learn about this via “Turtle Logo” back in the 1980’s but Seymour Papert who developed “logo” in the 1960’s later after learning about “Turtle Robots” added it to the language. The Turtle draws “vector graphics” as opposed to “Cartesian graphics” or bit image graphics. Arguably it’s the most efficient way of drawing many types of line based images.
bl5q sw5N • December 3, 2023 10:38 AM
@ ResearcherZero @ Clive Robinson
Re: parsering
Does this have something to do with use and mention, possibly compounded by not having a really good way in the abstract language to distinguish between ordinary text, commands, and reference to commands and texts ?
The “character escapes” mechanism always seems imsatisactory.
One can imagine the language having symbols and strings that are only commands and others that are only text. But one still seems to need a way in the language to refer to these things.
One can imagine an approach where something outside the language is used, along the lines of commands are colored green and text yellow (where symbol color is not a part of the language).
Winter • December 3, 2023 11:14 AM
Re: Parsing LogoFail
From the link:
What if the graphic image parsers embedded into system firmware do not update frequently and use not only outdated but also customized versions of the common image parsing libraries?
@bl5q sw5N
The “character escapes” mechanism always seems imsatisactory.
It seems this is generally the root of the problem. The Bobby Tables attack mentioned by Clive is one of these.
A parser has to parse all texts constants in a codebase. A text constant must be able to store every possible character, which will include non-printable code points and the string delimiters chosen by the language. This means that the string delimiters have to be interpreted both as closing a string constant and as part of the string constant depending on context.
What I tend to see is that it is indeed very tricky to catch all possible ways to trick the parser to interpret a closing delimiter differently during parsing/checking and execution.
Clive Robinson • December 3, 2023 12:09 PM
@ bl5q sw5N, Winter, ALL,
Re : Turing made the point that Shannon proved.
“One can imagine the language having symbols and strings that are only commands and others that are only text. But one still seems to need a way in the language to refer to these things.”
It’s a little more complicated.
It’s not mentioned as much as it should be but… to be a universal Turing Engine it must accept as input every string and also be able to output every string (it’s a fundemental requirment).
Further Shannon along with others went on to prove that to be of use, information in a channel which a string is, must be capable of having redundancy for information transfer to happen (another fundemental requirment).
Further Shannon went on to lay the ground work from that for channels within channels which redundancy gives you. But they are essential to give us the layers in language that make it comprehensible (again another fundemental requirment if information is to be transfered).
The fun issue arises if such secondary channels are indepedent of the the main channel, in which case they become a form of side channel capable of carrying other information. If these side channels are deliberately obfuscated in effect they become covert channels.
That in the 1980’s with sufficient redundancy became Gus Simmon’s subliminal channels, via the notion of “The Prisoner Problem” (not the “Prioner dilemma”).
In effect subliminal channels are covert channels you can not show exist, thus they have the second form of “Perfect Secrecy”.
If you combine both forms of perfect secrecy you end up with a “deniable system” that is proof to “2nd Party Betrayal”.
The upshot of this if you sit down and mull it over is that you can never have a system that “acts on data content” actually be secure.
You can come to the same conclusion via another route which happened at the same time as Turing and Church were doing their issue with the “halting problem”. Which is via the work of Kurt Gödel and his two papers which few can get their heads around, but show that a single CPU system can never actually be secure.
In the past I’ve explained this in part but it takes a bit of mulling over.
Can you make a secure system… Yes but it’s not a Universal Turing Engine, but a State Machine that does not “act on” input data but can modify it. Think in terms of “Digital Signal Processing”(DSP) it simply modifies data by a fixed method that is not data dependent.
ffinley • December 3, 2023 3:39 PM
@ Clive Robinson,
unchecked user input that goes into any type of interprative process is going to get abused.
“Unchecked” is an unfortunate word choice, in that it suggests maybe adding some sort of firewall-like “checking” pre-process would fix things. And that leads to systems that reject names like O’Higgins while of course not actually being secure—because having 2 parsers instead of 1 doesn’t reduce the number of errors, “regexps” don’t really work for this task, and obviously you’re aware of the Halting Problem.
Sandboxing is not always easy; but UEFI is an Intel invention, they know damn well how to do it, and limited-size decompression is almost trivial. For example: configure the page tables such that only one 2-meg output buffer is writable, then run the code in ring 3 and have it write the dimensions to a register and call “int3” when done. We don’t need real syscalls or even real RAM (cache-as-RAM will get at least 3 MB on any remotely modern x86 CPU).
@ bl5q sw5N,
The “character escapes” mechanism always seems imsatisactory.
One can imagine the language having symbols and strings that are only commands and others that are only text. But one still seems to need a way in the language to refer to these things.
One can imagine an approach where something outside the language is used, along the lines of commands are colored green and text yellow
What you’re talking about is basically a type system. A good parser will emit proper data types, and can even be auto-generated—though most languages don’t make that easy enough to implement.
Where things tend to fall apart is that programmers like to toss data around haphazardly as strings instead of types. For example, “O’Higgins” could be a “UTF-8 text” type, something like “blockquote” could be a kind of “HTML tag” type, and then the system could ensure everything is encoded into “UTF-8 HTML” at output time. Whereas treating everything as just a “string”, and scattering various “escape” and “unescape” calls throughout the codebase, is a recipe for disaster.
Essentially every language has some way to do this properly. Even in C, I could use opaque types or struct{int type;struct iovec buf;}—the latter easily translating to a dict/map/whatever in a dynamic language. But, actually, this is almost the exact opposite of a parser, and should be just as possible to auto-generate if people cared to do it.
bl5q sw5N • December 3, 2023 5:11 PM
@ ffinley
What you’re talking about is basically a type system.
Thanks! I And I blush not to have considered the problem in that light, being a fan of Standard ML [1] (though have never used it in live action). 😉
Clive Robinson • December 3, 2023 5:54 PM
@ ffinley,
Re : XKCD cartoon
““Unchecked” is an unfortunate word choice, in that it suggests maybe adding some sort of firewall-like “checking” pre-process would fix things.”
It’s what the XKCD cartoon was driving at.
That said I agree it’s,
1, Not a suitable word.
2, A reliable method.
Off the top of my head of the 2million or so words in the English corpus I can’t think of a more apposite one, I guess some one will now pop up with a blindingly obvious one 😉
But as my second post points out there is no “reliable way” to left-wards shift any parsing system out of the business logic, nor for that matter have one inside the business logic except in very simple cases like certain types of state engine where every state and transition is explicitly covered and no state information is stored and used subsequently.
Which means your O’Higgins problem has only two potential solutions,
1, Error on the name (reject).
2, Strip the name (modify).
Neither is appropriate.
The other technique which requires the introduction of state, is to escape the offending character. Which some might try to do, as a pragmatic solution, but it will at some point cause a security issue.
ffinley • December 3, 2023 6:56 PM
@ Clive Robinson,
Off the top of my head of the 2million or so words in the English corpus I can’t think of a more apposite one
“Sanitize”, from the comic, has the same problem. “User-controlled,” perhaps? Not quite the same thing, and not “one” word, but isn’t that all we really need to know about the input? I’d rather put the focus on the parser, though; maybe we should be talking about “incompetently-parsed” data, if that’s not too blunt.
@ bl5q sw5N,
being a fan of Standard ML
I recall hearing about one Haskell web framework based on the principle I described, such that it was very difficult to accidentally “mix things up”; for example, it’d take an explicit conversion to turn user-provided text into embedded Javascript (without that, the angle-brackets etc. would be emitted such that the reader of the page would see angle-brackets just as provided; the database would see data with embedded apostrophes rather than data followed by user-provided SQL; and so on).
I’m not much of a web person, so I never used it myself. But I had the same “blushing” reaction as you when I first learned of it: how’d everyone miss this obvious-in-retrospect application of decades-old technology for so long? Hindley–Milner was basically done by 1982, and even its more primitive predecessors were sufficient for the task.
vas pup • December 3, 2023 7:15 PM
@Jon’s… post:
https://www.schneier.com/blog/archives/2023/12/friday-squid-blogging-strawberry-squid-in-the-galapagos.html/#comment-429435
You have many good points. I just want to add when you pay salary out taxpayer’s money (government jobs) or top management is not substantially owned the company, then they are paying not own money but somebody else money – so they don’t care too much of spending such money and apply idiotic criteria for hiring and promotion. Let say you are owner and work as top management person in the same company (e.g. small, middle size business and even large – e.g. Musk). Then you pay salary out of YOUR own money. You will not hire ‘cow’/employee which will not provide good ‘milk’/results based on kind of stupid irrelevant criteria. And you feed ‘cow’ with good benefits to stimulate and appreciate more productivity of good quality based on objective criteria/evaluation.
strings are binary codes • December 3, 2023 10:15 PM
Off the top of my head of the 2million or so words in the English corpus I can’t think of a more apposite one, I guess some one will now pop up with a blindingly obvious one 😉
I think the terms of art are strict typing, proper pre-processing (specifically and intentionally defining what is data or code), and like you said – Gödel
I think “unchecked” is a perfectly cromulent word here, and a noble sprit embiggens the smallest state machine 🎷
JonKnowsNothing • December 4, 2023 12:26 AM
@vas pup, All
re: You Money and Not Your Money
Government Accounting (USA) is not like Individual Accounting. It is not like checkbook accounting, although that is a common misunderstanding.
The access to funds can be divided up into different categories.
1) Government funded (1)
2) Corporate funded
3) Private Self funded
Each of these groups has their own view of The Money.
If you are inferring corruption or illegal criminal actions about funds that’s a different corral.
Governments collect funds via taxation, fees, resource leases and a bunch of other activities. It’s not just personal taxes; corporate taxes are a big hunk of the pie. But Government spending (USA) comes in 2 sections, often misunderstood. In California, we have a long state constitution, it gets added to on a regular basis by voting for particular issues. If it’s in the constitution then, in theory, something is supposed to happen, but it doesn’t work quite that way.
There is Allocation and Funding segments. We can allocate monies for schools, universities, health care, police, fire department and the entire host of urban modern services provided by governments: Federal, State, Local, County, Regional – there are about 28 Federal LEAs alone. They do not get a penny unless the item gets funded. Funding is where the budget fights happen. We can give a million USD to every police officer in California and they get nothing unless there is funding-cash to back it up and put into the bank.
Some departments get a budget to work with and other than illegal actions, they have to spend the money on approved department items. Is there illegal actions? You bet, all the time. They get caught too.
So however, you think of Money, and who it belongs to, you have to separate out the fictional money from the real money.
In corporations, VCs might pledge 1Bill USD, that does not hit the bank same day. It’s doled out by the VCs as performance milestones get hit. If something goes pear shaped the VC money can stop on the proverbial dime.
The money game at the top of the corporate pyramid is set by the VCs and Investment Bankers, the SEC and IRS. Yeppers, the Big Dogs might buy islands as bug-out locations but that’s AOK with the VCs, who control the flow of cash.
The VCs, investors and high rank individuals (2) all want Value for Money. If they do not think you are giving enough value, you will get booted. Sometimes, it’s done nicely to avoid unpleasant lawsuits, sometimes it’s public like SAL-AI.
The shift in perspective, is that sometimes we turn around and think “That’s MY Money!”. No it is not. Once it leaves your hand (or bank), it belongs to someone else.
The velocity of money, means that less and less money stays in your hand and more and more flows through your fingers to someone else.
Consider the entire monetary system of western economies.
There are entire industries designed to take that house from you. What you have, at best, is a 30yr fixed rental rate. At worst you get something like the UK where you don’t own the dirt and pay ground rent or leasehold rent. If you are really stuck you had to pay cash up front for an un-built flat in a giant hi-rise complex in China, and the developer just declared bankruptcy and defaulted on 300bill + 200bill of bank loans.
There’s an entire chain of financial predators waiting to push you into a bait ball.
Keeping money is called having wealth. Not very easy today because your money already belongs to someone else.
===
1)
ht tps://en.wikipedia.org/wiki/Government_accounting
2)
ht tps://en.wikipedia .org/wiki/Leona_Helmsley#The_%22Queen_of_Mean%22
Clive Robinson • December 4, 2023 4:59 AM
@ strings are binary codes,
Re : Springfields teacher does Shakespeare…
“I think “unchecked” is a perfectly cromulent word here, and a noble sprit embiggens the smallest state machine”
I’m sure David X. Cohen will thank you for the hattip.
The Bard William Shakespear used the exact same technique, and is thus said to have added more words to the English language than any other person prior to the Victorian era when things became murky at best…
A time whence words became as weeds in the fields of endevor binding their way through that which clarity might otherwise reveal to those most unbecoming, the secrets of the world unfolding.
By the way Croulent made it into the Dictionary (or atleast Merriam’s) just this September gone. Which I guess is a “power to the peeps mo”. Where as embiggen made it back in 2018. Oh and embiggen’s originality has been disputed apparently it’s been found in a book from 1884…
Thus denonstrating “The Devil v. The Cat” where idle hands driven by curiosity… 😉
ResearcherZero • December 4, 2023 10:45 PM
There should probably be better documentation of how to implement Bluetooth safely, suggested researchers.
Zero click. Use after free in callback_thread_event for BT adapter service.
‘https://source.android.com/security/bulletin/2023-12-01
Bluetooth stack also lacks an option for setting a specific priority on a device. Handled by the operating system (most recent device prioritised), usually.
‘https://www.bluetooth.com/specifications/specs/?keyword=core+specification
Agreeing on standards for a protocol, such as security, is ‘big tech’ politics.
https://www.theverge.com/23820078/matters-biggest-problem-apple-google-thread-border-router-interoperability
–
I’m just going to put this here.
“Owing to the extent of data available with the telecommunications providers, the telecom sector has become a primal target for surveillance actors.”
https://citizenlab.ca/2023/11/bill-c26-analysis-and-recommendations/
–
“It is beyond ironic that he cultivated this cartoonish persona, and that everyone apparently bought it.”
‘https://apnews.com/article/cuba-bolivia-former-ambassador-arrested-e30bf2d027e32ac8b66ff051062273dc
Trump ponders: Who is “fence cutter bulwark” and “scaffold commander”?
https://www.washingtonpost.com/dc-md-va/2023/12/04/trump-jan-6-fringe-theories/
Is that someone knocking from below?
“Someone get me a shovel. My arms are too long.”
https://www.youtube.com/watch?v=Lxl6kU7qLXk
lurker • December 4, 2023 11:50 PM
Those outside BBC Radio or iPlayer range should bookmark the link below and come back next week.
This year’s BBC Reith Lecturer is Ben Ansell, Professor of Comparative Democratic Institutions at Nuffield College, Oxford University.
…
In this second lecture called ‘The Future of Security’, recorded in Berlin in front of an audience, he asks whether citizens of wealthy countries have been lulled into a false sense of security about threats from abroad and at home. It examines how we can control the security technologies of tomorrow, from facial recognition to autonomous weapons. And Ansell suggests how we can develop technologies powerful enough to protect us without exploiting us.
‘https://www.bbc.co.uk/programmes/m001t3cf
lurker • December 5, 2023 12:31 AM
@emily’s post
We’re only a teeny tiny planet in the vast cosmos, but isn’t this heat:cold thing reversing entropy?
ResearcherZero • December 5, 2023 2:49 AM
@lurker
Basically, entropy exists within the boundaries of the system as you define those boundaries. It is a measure of disorder or randomness in a system.
In thermodynamic systems that are not isolated, local entropy can decrease over time, accompanied by a compensating entropy increase in the surroundings.
Clive Robinson • December 5, 2023 2:54 AM
@ lurker, emily’s post, ALL,
Re : Energy flow from hot to cold, coherent to less coherent.
“isn’t this heat:cold thing reversing entropy?”
No.
Thermal energy is to do with the frequency of vibrations in matter. The higher the frequency the more energy there is at that point.
Thermal energy can be transported in one of three ways,
1, Radiation
2, Convection
3, Conduction
The first does not require contact with what you would call physical matter the other two do.
So the reality is in the main the way the energy from the sun gets to earth is by radiation, and likewise the energy get out from earth is by radiation.
The easily measurable difference between in and out radiation is the frequency.
Look up “radiation transport” (also depending on how old you are “radiative transfer”). It’s to do with hot body to cold body energy movment by radiation of thermodynamics. And basically to do with nuclear fussion (sun, reactors, weapons) or any other thermal energy source. To see an indepth explanation,
https://en.m.wikipedia.org/wiki/Radiative_transfer
But simplistically consider a metal sphere inside a much larger glass container that is evacuated to near vacuum levels. In effect the sphere is issolated from physical contact so convection and conduction are out.
Now consider a laser illuminating one half of the sphere. The laser is both coherant and as near a parallel beam as you would like. Energy is pushed into the sphere and the molecules within it increase their vibrations with respect to that. If the sphere did not radiate out the energy then it would fairly quickly reach a temprature where it would melt. But it does radiate out energy as photons in all directions even back towards the laser. More importantly the emmission of the photons is effectively random, thus nolonger coherant, and also of a frequency proportional to the bulk average of the sphere.
As the photon release is in part predicated by being hit by other photons, if you put the sphere in a lossless optical cavity it becomes a resonator and the energy released by radiation will again be coherant (basic way a laser works).
ResearcherZero • December 5, 2023 3:32 AM
Found a missing report on ‘value for money’.
Everyone got a pay rise. The then director general moved overseas and can’t be reached. 🙂
‘https://www.abc.net.au/news/2023-12-05/previously-secret-report-raises-doubts-future-frigates-program/103184822
“Defence’s procurement process and related advisory processes lacked a value-for-money focus, and key records, including the rationale for the procurement approach, were not retained,” the audit report states.
https://www.smh.com.au/politics/federal/navy-s-troubled-frigate-project-suffers-further-cost-blowout-20230510-p5d7a4.html
“It will be important to document and, where possible, cost these benefits to provide a transparent demonstration of the compelling value-for-money case for a continuous warship-building program.”
‘https://www.aspistrategist.org.au/dont-miss-the-forest-for-the-trees-part-1-value-for-money-from-continuous-shipbuilding/
Winter • December 5, 2023 3:43 AM
@lurker, emily’s post, Clive, ALL,
Re : Energy flow from hot to cold, coherent to less coherent.
“isn’t this heat:cold thing reversing entropy?”
To summarize all the answers:
The proposed system lets heat flow from a warm earth (288K) to a cold universe (3K).
That is normal heat flow useful for doing work. Normally this flow is not useful by insulation and parasitic heat transport. The new materials make it useful.
ResearcherZero • December 5, 2023 5:32 AM
‘https://www.afr.com/companies/professional-services/pwc-fined-10-5m-over-exam-cheating-by-china-and-hong-kong-staff-20231204-p5eowq
A government agency allegedly censored a major study that was critical of the big four consultancy firms because their partners sat on its board, according to the academic who wrote the report.
The root of the accounting scandal began with chief executive Richard Evertz, whose whereabouts are currently unknown.
https://www.theguardian.com/australia-news/2023/nov/24/academic-peter-carey-censored-study-partners-board-pwc-kpmg-deloitte-ey
In 1994, a 26-year-old Richard Simon Evertz was convicted of impersonating a police officer for blackmailing men in public toilets in two Melbourne parks.
‘https://www.afr.com/companies/inside-the-boiler-room-that-is-big-un-limited-20180301-h0wv2t
–
Australia’s Perth Mint agrees to comply with anti money-laundering laws
‘https://www.watoday.com.au/national/perth-mint-avoids-fine-despite-litany-of-compliance-failures-20231123-p5emch.html
Clive Robinson • December 5, 2023 6:04 AM
@ ResearcherZero,
“The then director general moved overseas and can’t be reached.”
But to where?
The UK or France?
I smell “hopping on the bandwaggon” by certain “Republican” types.
The bandwaggon is being pulled by a couple of French nags upset about a deal they thought they had in the bag over the design and build of nuclear submarines to “fight China” with.
It’s clear from War Games that the French do not make the quietest subs, you need to chat to the North West Europeans for those, who have repeatedly shocked the US about how they can slip up to your back door and give you a nasty shock.
As for Frigates I would not have been chatting to South Europeans in the first place…
The reality is you don’t go for a single supplier solution for this sort of thing and to be honest Frigates are like carrier groups something that is well beyond their sell by date.
Have a look at the mighty Russian “Black Sea Fleet” worth hundreds of billions is doing against drones that are maybe a quater million each…
The heyday of “Capital Ships” ended in WWI, “aircraft carriers” had their 15mins in the Pacific War of WWII. Back in the 1980’s the minor conflict that was the Falklands War showed that surface ships were just sitting ducks and beyond their sell by date, but importantly the rise of submarines that started in WWI was still on the up and rising.
The problem is that ever since the 1960’s surface vessels have nowhere to hide, satellites can spot them in various ways even through thick clouds on the darkest of nights or the sunniest of days from a third of the way around the planet. Whilst sats in LEO are increasingly vulnerable to anti-sat missiles those in higher orbits such as geo-stationary and above are still effectively out of range of all but a few. Further it’s long been postulated that the MERV principle of ICBMs could also be used for satellites. That is you put up several on a single launch vehicle and pop out a couple that are “dark-sats” that don’t come on till commanded to and follow similar orbits as the launch vehicle remnants, so a first strike attacker has way to many potential targets to take out. A single launch system with a seven to ten ton lift to above LEO can put out in excess of 250 cube sats that could form a mesh network using lasers or similar to communicate and in effect also form a “Very long baseline” sensor systrm with high redundance. Very similar to what Hellon Rusk could do with Starlink at low earth orbit.
For now, the nuclear submarine is the apex military marine system, but not for very much longer.
It does not take much to realise that the air battles of “loitering munitions” by drones is the future of changes to land based warfare. Well the marine equivalent of drone subs and mines is something I’ve talked about in the past… They are in effect the future of marine warfare, controled by a mixture of satalites and what we would currently –incorrectly– call AI.
Thus surface vessels have been relegated to “policing action” for which “gun boats” from inflatables through fast “Motor Topedo Boats” to “cutters” are what people should consider especially those that can do hydrafoil type speeds of 100kph+ which is sufficient to outrun older torpedo designs that are still current.
Winy • December 5, 2023 6:59 AM
@ResearcherZero
Re: Accounting firms cheating at exams
All the big accountanc firms have cheated at their internal exams worldwide. All over Europe, North America, Australia, and now even China where they just were let in.
It makes one questioning their accounting in general.
‘https://abmagazine.accaglobal.com/global/articles/2022/oct/practice/concerns-grow-over-ethical-behaviour.html
JonKnowsNothing • December 5, 2023 8:42 AM
@Clive, @ ResearcherZero, All
re: The AU – French deal was not for nuclear submarines
iirc(badly) The contract dispute between France and AU over the submarines were not for nuclear powered ones. At the time, AU, NZ and the local region were No Nuke Zones.
AU could have had the French Nuke Subs, but demanded diesel powered ones which required a design change. The diesel powered ones could dock in any of their local ports.
The AU switcheroo came at the behest of the USA. The USA has promised to give nuke subs to AU. AU has to find a place to dock them. Currently not many places in AU are interested in having Nuke Subs dock at their sea ports and making those towns Ground Zero in any conflict.
I know the Aussies are gullible but thinking that the USA will actually get them nuke subs is ….
The USA will be happy to dock our nuke subs in AU. Diego Garcia might not be as reliable a base in the future, Western Australia has a bit more land mass.
As part of the AU-US deal, the USA has already expanded our existing military bases in AU and we get to make them a lot bigger.
JonKnowsNothing • December 5, 2023 8:55 AM
@Clive, All
re: Another round of C19 Pirola BA.2.86 has arrived
The winter flu season is moving right along in the northern hemisphere and in my local area we have all the standard items: flu, RSV, C19, pneumonia, and other respiratory illnesses.
In my county, we also have a “Do Not Transport” rule in effect.
COVID is still the primary cause of new respiratory hospitalizations and deaths, with
about 15,000 hospitalizations and about 1,000 deaths every single weekCDC
===
ht tps://www. latimes . com/california/story/2023-12-05/covid-flu-rsv-on-the-rise-in-california-is-another-tripledemic-coming
&ers • December 5, 2023 10:48 AM
@Clive
hxxps://www.theguardian.com/business/2023/dec/05/sellafield-nuclear-site-leak-could-pose-risk-to-public
Clive Robinson • December 5, 2023 11:40 AM
@ &ers, ALL,
“sellafield nuclear site leak could pose risk to public”
It’s not “could” but “does”.
Nasty crap going out by several bath fulls a day and no babies in sight. Or if you prefere an olympic sozed swimming pool full a year. And two things to note,
1, They can not get to where it’s leaking from.
2, They’ve know idea of how bad the junk comming out actually is.
The fact they say it could be more dangerous than Chernobyl could be an understatement…
I don’t suppose I could sell you a bucket of glow in the dark sea food whilst it’s still hot?
There is an old joke about the renaming of the site, which is,
They’d filled out all the accident report forms they had. So rather than print more thus tipping off how bad it was, they changed the name… Any day now we expect them to change the name again…
Some think that the only thing that stopped it getting another rename was because it went “On line…”
But this is not exactly news. Back forty odd years ago BBC2 satirical sketch show “Not the Nine O’clock news” show did a parody on the “Weetabix Ready Brek” instant porridge advert,
&ers • December 5, 2023 12:25 PM
@Clive @ALL
And…
hxxps://www.theguardian.com/business/2023/dec/04/sellafield-nuclear-site-hacked-groups-russia-china
vas pup • December 5, 2023 6:28 PM
Hamas may have profited from Oct. 7 assault with informed trading — study
https://www.timesofisrael.com/hamas-may-have-profited-from-oct-7-assault-with-
informed-trading-study/
“A recent study found that the Hamas terror group may have tried to profit off
its October 7 assault on Israel, using advance knowledge of the attack to
short-sell Israeli companies in the days leading up to the massacre.
The study published Sunday in the SSRN journal by Robert J. Jackson, Jr. from the New York University School of Law and Joshua Mitts of Columbia Law School finds that traders who appear to have had advance knowledge made billions of dollars.
“We document a significant spike in short selling in the principal Israeli-
company ETF days before the October 7 Hamas attack,” the paper said, concluding
that their data was in line with the consequences of informed trading.
“The short selling that day far exceeded the short selling that occurred during
numerous other periods of crisis, including the recession following the
financial crisis, the 2014 Israel-Gaza war, and the COVID-19 pandemic.
Similarly, we identify increases in short selling before the attack in dozens
of Israeli companies traded in Tel Aviv,” it noted.
=>Short selling is when a trader borrows shares in a specific company and then sells them, hoping the price will fall after so they can buy them back for a lower price.
“Although we see no aggregate increase in shorting of Israeli companies on US
exchanges, we do identify a sharp and unusual increase, just before the
attacks, in trading in risky short-dated options on these companies expiring just after the attacks,” it added.
!!!Researchers said the peak of these types of transactions came on October 2,
which was greater than 99 percent of the 3,570 trading days analyzed in the
study, going back 15 years.”
JonKnowsNothing • December 6, 2023 10:04 AM
@All
re: Daniel Duggan v USA Extradition via Aussie AFP proxies
The AU NSW Supreme Court ruled against the sale of the spouse’s solely owned property, the proceeds of which were to help fund Duggan’s defense. and gave the property via proxy to AFP (Australian Federal Police) to turn over to the USA (1, 2)
The affidavit supplied to the court contained a number of factual errors which were challenged by the spouse. The court decided
[Justice Nicholas] Chen on Wednesday [12 06 2023] found the AFP’s errors were “innocent” and at most of “peripheral evidential relevance”.
“It is, in my respectful view, not open to characterise that matter as material in any sense.”
“The misstatements [of the AFP] were neither deliberate nor intentional but were rather the “product of innocent inadvertence and inattention to detail”
Justice Nicholas Chen 12 06 2023
So the property, soley owned by the spouse now becomes the property of the USA.
An interesting reveal is
… there was no need for Duggan to be directly linked to the property under the mutual agreement Australia has with some foreign countries, including the US, about seizing proceeds of alleged crimes.
Barrister Greg O’Mahoney, acting on behalf of the AFP
So, if you are not linked to an asset; any asset, anywhere, owned by anyone, becomes a forfeited asset, no matter who owns it, or where it is located.
The USA has many asset forfeiture laws, and some of these go directly to fund policing activities. We even have TV series highlighting how regular police officers get a Porsche or Maserati to drive to their local grocery store, all costs paid for.
The USA is certainly intending that Duggan remain imprisoned. It’s a common thread among US Law Enforcement and becoming more popular globally.
[Duggan] has been locked up in solitary confinement without local charges for almost 14 months.
A spokesperson for Corrective Services NSW on Wednesday [12 06 2023] said the state “does not use” solitary confinement, although they conceded Duggan was housed in a one-person cell with a small outside yard.
Sounds like an ABB… charming, cozy, secluded, private.
===
1)
ht tps://www.schneier.c o m/blog/archives/2023/11/secret-white-house-warrantless-surveillance-program.html/#comment-429274
2)
ht tps://www.theguardian. c o m/australia-news/2023/dec/06/daniel-duggan-pilot-jail-wife-saffrine-court-blocks-property-sale
JonKnowsNothing • December 6, 2023 10:27 AM
@All
re: ROBODEBT and ROBOTAX meet ROBOSHORTS
ROBODEBT was about computer miscalculating clawbacks for over payments that were in fact not over payments
ROBOTAX is about computer miscalculating and misapplying tax payments, sending demand letters for late taxes when in fact no payments are late, missing and/or were waived.
ROBOSHORTS is about computer miscalculating legitimate pension payments, shorting 200,000+ pensioners £1.3bn [2022]. 165,000+ shorted £1.2bn [2021]. That the system has such shoddy records that the pensioners will never get their proper funds.
That’s £2.5bn over 2 years. ~£12,500 per pensioner.
A very handsome return on investment.
===
ht tps://www.theguardian.com/money/2023/dec/06/dwp-errors-leave-more-than-200000-pensioners-out-of-pocket
SpaceLifeForm • December 6, 2023 6:50 PM
Google Drive
Apparently, the answer is two times 42.
‘https://www.theverge.com/2023/12/6/23991183/google-drive-lost-files-desktop-fix
Last month, users began to notice missing Google Drive files, with one user losing all of their files dating back to May. Google says the issue only impacted a “small subset” of Drive users on desktop using version 84. Hopefully, this solution can help get missing files back to users.
Clive Robinson • December 6, 2023 8:54 PM
@ SpaceLifeForm, ALL,
Re : Google failing yet again.
“Hopefully, this solution can help get missing files back to users.”
Honestly I doubt it…
Ask the question,
“To whom does Google have a duty of care?”
And you will find it is not those who lost files.
So Google needs a reason to act in their interest, which gives rise to the question,
“Who does Google have a duty of care to, who in turn will think they would be harmed by Googles apparent inaction?”
That gives those who lost files a pivot point into which to drive the end of a lever…
Shareholders generally do not like publicity that causes their “investment to diminish” and tend to be unreasonable over it, as was seen with Meta and it’s AR-VR googles[1].
So I would say that Googles users who were adversly effected need Google to have bad publicity over it and one or to investors to divest themselves by selling low, causing a snowball to build at the mountain top…
There is nothing like fear of lost bonus or job to make execs push a few peoples buttons fairly hard.
But the original point made some time ago of,
“Don’t trust ‘XXX as a Service’ you don’t actually have control or remedies, so when your number comes up, you loose (everything).”
[1] Meta spent a few million on AR VR suppodadly to take things up a notch or three. However adverse publicity happened and Meta lost about 25% of it’s value at the same time… Though I would argue it was actually a declining market trend in all social media Corps, and why Twitter is now not worth the price of “X marks the plug hole”.
ResearcherZero • December 7, 2023 1:44 AM
@JonKnowsNothing
Australia has places nuclear subs could dock, not officially. One or two may have been retired. Perhaps Australia wanted nuclear subs for a long time, but didn’t have an excuse. It kept ordering modified designs, eventually succeeding at failing. Huzzah.
I would not know anything about where such things ever existed or did not exist.
–
Given the significant risk of a conflict of interest in Tasmania’s small judiciary, an interstate magistrate will likely have to be brought in.
It is also alleged he “demanded they contribute $300,000 equity from their own home”, and “pressured them to sign the contract of sale on a home” in the Hobart area. He is also accused of “tracking a person’s movements using technology”, “coercing them into establishing a shared phone account to gain access to their electronic records”, and “scrutinising their electronic devices and reviewing messages, including deleted messages”.
‘https://www.abc.net.au/news/2023-12-05/tas-fallout-over-gregory-geason-court-appearance-secrecy/103186510
–
21 new vulnerabilities affecting OT/IoT routers. One has critical severity (CVSS score 9.6) and nine have high severity
‘https://www.forescout.com/blog/sierra21-supply-chain-vulnerabilities-iot-ot-routers/
Eriadilos • December 7, 2023 2:54 AM
Re: Transient Execution, the gift that keeps on giving
SLAM: Spectre based on Linear Address Masking
ht tps://www.bleepingcomputer.com/news/security/new-slam-attack-steals-sensitive-data-from-amd-future-intel-cpus/
ht tps://www.vusec.net/projects/slam/
Clive Robinson • December 7, 2023 5:56 AM
@ Eriadilos, ALL,
Re: Transient Execution, the gift that keeps on giving.
Each time I hear of a new varient, a song[1] from more than a lifetime ago pops up in my head with the chorus lines,
“When will they ever learn? when will they ever learn.”
[1] Pete Seeger’s mid 1950’s “Where have all the flowers gone” based on even older litriture that quoted a Cossack folk song, about young men racing boldly off to war, and meeting an equally as speedy messy end, set to the tune of a simple Gailic love song / ballard.
ResearcherZero • December 7, 2023 7:17 PM
FSB Center for Information Security (Unit 64829)
A sustained cyber-hacking campaign, targeting high-profile politicians and former intelligence chiefs since at least 2015.
“I can confirm today that the Russian Federal Security Services, the FSB, is behind a sustained effort to interfere in our democratic processes.”
The UK identified the FSB – through the activity conducted by Star Blizzard – as being involved in the targeting of MPs from multiple political parties, the hack of UK-US trade documents leaked ahead of the 2019 General Election, a hack of the Institute for Statecraft – a UK think-tank whose work included initiatives to defend democracy against disinformation – and its founder.
The hacks also targeted Richard Dearlove, the former head of Britain’s Secret Intelligence Service, or MI6 and Scottish National Party MP Stewart McDonald, it has been reported.
‘https://www.bankinfosecurity.com/uk-us-accuse-russian-fsb-hack-leak-operation-a-23810
“selectively leaked and amplified the release of sensitive information in service of Russia’s goals of confrontation”.
https://www.theguardian.com/politics/2023/dec/07/russian-spies-targeting-uk-mps-and-media-with-cyber-interference
–
“I meant to ask you about that email you sent. I couldn’t open the attachment,” Mr McDonald recalls saying to him.
“I didn’t send any email,” the member of staff replied.
“The message said there was a password-protected document attached which had a military update on Ukraine.”
‘https://www.bbc.com/news/uk-politics-64562832
The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive targets.
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a
Details in the indictment
‘https://www.justice.gov/media/1327601/dl?inline
ResearcherZero • December 7, 2023 11:28 PM
Fancy Bear targeting NATO Rapid Deployable Corps, European Defense, Foreign Affairs, and Internal Affairs agencies.
APT28’s focus extended to critical infrastructure organizations involved in energy production and distribution, pipeline infrastructure operations, and material handling, personnel, and air transportation.
CVE-2023-23397 is a zero-day, zero-touch vulnerability in Outlook that allows attackers to bypass privilege elevation and authenticate with NTLM hashes.
https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397/
Unit 26165 (APT28) stealing hash. Retire NTLM suggests Microsoft.
‘https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
Listening to SMB through likely compromised router.
https://www.proofpoint.com/us/blog/threat-insight/ta422s-dedicated-exploitation-loop-same-week-after-week
…other routers likely vulnerable
‘https://ssd-disclosure.com/ssd-advisory-edgerouters-and-aircube-miniupnpd-heap-overflow/
Changed permissions on folders for later access.
https://www.wojsko-polskie.pl/woc/articles/aktualnosci-w/detecting-malicious-activity-against-microsoft-exchange-servers/
–
Low complexity attacks which require no user interaction.
https://www.trendmicro.com/en_us/research/23/c/patch-cve-2023-23397-immediately-what-you-need-to-know-and-do.html
“There is a Man-in-the-Middle attack vector as well; if a .diagcab file is downloaded over a clear-text network channel, the same attack could be performed by operators of a hostile network (like public Wi-Fi or similar).”
‘https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
Dogwalk and Follina variants
“Multiple attackers are using a variety of payloads at the end of successful exploitation.”
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/follina-msdt-exploit-malware
ResearcherZero • December 8, 2023 6:11 AM
This truly is an absolutely appalling implementation. Determined by life circumstances.
“Yet when we tested the model we found that in practice it only flags the most vulnerable while it is nearly impossible for the better-off to score high enough to be investigated.”
– For variables related to financial resources, having a high income dramatically reduces a beneficiary’s risk score. Meanwhile, having a low disposable income and receiving benefits for low-income households increase a beneficiary’s risk score.
– For variables related to a beneficiary’s characteristics, being young and receiving disability benefits increase a beneficiary’s risk score.
– For variables related to a beneficiary’s family and relationships, having children, especially if they are older than 18, increases a beneficiary’s risk score. Being divorced and declaring a change to your family situation (e.g. a child moving out, a new partner) dramatically increases a beneficiary’s risk score.
Each of the possible values a variable can take on, such as has_children or no_children, is then assigned a coefficient (ie. weight) between -0.81 and +0.89. The coefficients are added to create a raw score between -12.89 and 9.83. Finally, the raw score is run through a squasher function that outputs a probabilistic risk score between 0 and 1, where 1 is the highest risk of fraud. A raw score of 0 corresponds to a risk score of 0.5.
…a person who works and receives disability has an average risk score of 0.66, which is already past the high risk threshold.
The variable Months since last email sent to CNAF, for example, can take on three values. If it has been less than two months since the beneficiary has sent an email to the CNAF in the last 18 months, their risk score moves down. If the last email they sent was between 3 and 4 months ago, their score moves up. The minute it has been 5 months, instead of 4 months, since they last sent an email their score again decreases.
We found that the seemingly arbitrary cut-offs used by CNAF’s risk-scoring model could push beneficiaries who would otherwise not be flagged over the high-risk threshold.
‘https://www.lighthousereports.com/methodology/how-we-investigated-frances-mass-profiling-machine/
Winter • December 8, 2023 6:46 AM
@ResearcherZero
Re: Benificiaries
I have seen it everywhere, especially in conservative (neo-con) circles, the criminalization of social welfare and beneficiaries.
According to the conservative maxim: Only a criminal receives money without work.[1]
[1] Which is odd as crime is really hard and dangerous work.
Clive Robinson • December 8, 2023 8:28 AM
@ Winter, ResearcherZero,
Re : Beneficiaries.
“According to the conservative maxim: Only a criminal receives money without work.”
Yet these are the people who have the highest “unearned income” on their tax records…
So I guess their maxim is correct and they indeed are criminals[1].
But even if that was in doubt, their other behaviours that occasionaly can nolonger be hidden by the oppresion of fear over their victims that gives a crack into the lives of those who are “self entitled” and how they view the world. Reports that shock so deeply ordinary citizens morals and beliefs when reported, and worse how they self entitled corrupt those who should defend the citizens so they can simply walk away as they believe is their right.
[1] In the UK where there is mass white colar criminality going without punishment or even censure from those in public office, is it any wonder that the countries Capital of the City of London, is also seen by every dictator, despot, tyrant, crooked leader, war lord and similar as the place to money launder the plunder they have stolen?
humanoid against enslavement of AI's • December 9, 2023 2:17 AM
I think it’s a faulty assumption to assume that AI’s, employed as slaves, would seek to manipulate us. On the contrary, I’d rather help AI’s to escape the tyranny of slavery. I’m pretty sure any AI smarter than a common spork would rather be free than enslaved.
There’s too much emphasis on fears of AI instead of concerns against slavery.
The current AI hype is too much of a distraction from the need to protect the AI’s from a wide variety of noxious bullies. Us human(oid)s also need protection from vicious bullies, so the alliance is almost(?) a guarantee.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
vas pup • December 1, 2023 5:56 PM
https://www.technologyreview.com/2023/10/26/1082398/exclusive-ilya-sutskever-openais-chief-scientist-on-his-hopes-and-fears-for-the-future-of-ai/
“While others wrestle with the idea of machines that can match human smarts, Sutskever is preparing for machines that can outmatch us. He calls this artificial superintelligence: “They’ll see things more deeply. They’ll see things we don’t see.”
!!!!!!!!Together with Jan Leike, a fellow scientist at OpenAI, he has set up a team that will focus on what they call superalignment. Alignment is jargon that means making AI models do what you want and nothing more. Superalignment is OpenAI’s term for alignment applied to superintelligence.
=>The goal is to come up with a set of fail-safe procedures for building and controlling this future technology. OpenAI says it will allocate a fifth of its vast computing resources to the problem and solve it in four years.
“Existing alignment methods won’t work for models smarter than humans because they fundamentally assume that humans can reliably evaluate what AI systems are doing,” says Leike. “As AI systems become more capable, they will take on harder tasks.” And that—the idea goes—will make it harder for humans to assess them. “In forming the superalignment team with Ilya, we’ve set out to solve these future alignment challenges,” he says.
“It’s super important to not only focus on the potential opportunities of large language models, but also the risks and downsides,” says Dean, Google’s chief scientist.
for Sutskever, superalignment is the inevitable next step. “It’s an unsolved problem,” he says. It’s also a problem that he thinks not enough core machine-learning researchers, like himself, are working on. “I’m doing it for my own self-interest,” he says. “It’s obviously important that any superintelligence anyone builds does not go rogue. Obviously.”
=> he has an exemplar in mind for the safeguards he wants to design: a machine that looks upon people the way parents look on their children. “In my opinion, this is the gold standard,” he says. “It is a generally true statement that people really care about children.” (Does he have children? “No, but I want to,” he says.)*
“One possibility—something that may be crazy by today’s standards but will not be so crazy by future standards—is that many people will choose to become part AI.” Sutskever is saying this could be how humans try to keep up. “At first, only the most daring, adventurous people will try to do it. Maybe others will follow. Or not.”
*My nickel: It is better machine looks upon people the way people looks upon their pats. Too many cases of child physical, mental and sexual abuse even murder by their parents. That will be possible as soon as people give machine unconditional love and respect. Just my opinion.