Schneier on Security

Clive Robinson • March 15, 2025 4:57 AM

@ Bruce, ALL,

In an earlier posting I mentioned Ross Anderson, who some of you know was quite fond of the pipes and traditional Scottish music.

Well you can connect him to Squid via a young lady called Jane Espie who the last time I saw her was a “Theater Nurse” at the Victoria Hospital in Kircaldy in Fife Scotland just over the famous “Forth Railway bridge” from Edinburgh.

As I’ve mentioned I’ve relatives in Kircaldy and on one occasion I had the misfortune to become seriously in need of medical attention and ended up in the Victoria Hospital.

A face with a button nose beneath a green scrubs cap enquired as to my well being as I lay there on a gurney looking not unlike a wood pile under a tarp, with a dead fox sticking out at one end 😉

Well when she turned slightly in profile I realised who she was, and I said “Your the Phantom Piper from Celtica?” To which she grinned actually quite shyly.

For those who don’r know Celtica is a high energy pipes and drum rock band that tours all over the world, but Canada and the US are repeat favourites. And whilst doing tours they also drop in on “Scot-Fests” which is where they crossed paths with a group that was back then called “Tasty Squid” from “New Scotland” that was three Drummers and a Piper.

Well Jane is “sponsored” by “McCallum Bagpipes” who Ross was known to frequent on the odd occasion.

So as the used to say on the radio program “chain made”.

But… It was not just Jane at the Victoria that put this old lug back on the road…

Jane made a Covid Video to honour the NHS workers in Fife and it includes a few other faces from the Victoria I am grateful to,

https://m.youtube.com/watch?v=4bjGpOjdmA4

I wish them all well.

Clive Robinson • March 17, 2025 12:19 PM

@ Bruce, ALL,

Google AI tech Latest criminality use.

It appears Google let “Gemini 2.0 Flash” out the door without any realistic guardrails in place…

https://techcrunch.com/2025/03/16/people-are-using-googles-new-ai-model-to-remove-watermarks-from-images/

So unsurprisingly people are taking advantage to do questionable and illegal things.

“Users on social media have discovered a controversial use case for Google’s new Gemini AI model: removing watermarks from images, including from images published by Getty Images and other well-known stock media outfits.”

Clive Robinson • March 20, 2025 2:42 PM

@ Bruce, ALL,

These are toys that are really amazing at killing people

A comment from a Wired article titled,

Low-Cost Drone Add-Ons From China Let Anyone With a Credit Card Turn Toys Into Weapons of War

https://www.wired.com/story/drone-accessories-weapons-of-war/

Economics 101 generally mentions the laws of “Supply and Demand” that basically say,

“If there is a perceived need for a good or service, then a market will arise to supply it.”

Further,

“If resources are available the market in normal circumstances will expand to supply it. And in so doing the price of the good or service will drop untill supply of resources or excess demand drive the price up.”

Both of these happen irrespective of societies mores or legislation.

To the east of Europe there is a conflict event that has been going on for more than 1000days. As with all conflicts, it generates needs for new goods and services often regardless of price.

Where there is manufacturing that can accommodate the need then the market will form and the need supplied.

But what happens when there is over manufacturing thus over supply?

Well two simple things can happen,

1, The price drops to either take up the oversupply or manufacturing cost is to high and production declines or stops.
2, New markets get created to push the oversupply into thus negating price drop or manufacturing stop.

Well the second has certainly happened.

A decade or so ago I warned that the then nascent drones could be turned by undergraduates into many things. Further that any kind of legislation would be ignored or bypassed as the commercial code could be replaced or GPS etc geo-location could be easily spoofed.

I indicated hear how that could be done and later how the Iranian’s could have fairly easily “spoofed” a US “CIA” Spy Drone and brought it down such that they could demonstrate to the world what the US were upto.

I also indicated how even “pocket drones” could be equipped very inexpensively as “Electronic Intelligence”(ElInt) and “Signals Intelligence”(SigInt) instrumentation “head ends” with all the processing grunt safely out of harms way.

Since then technological improvements have been rapid gotten a lot smaller, lighter, and less power hungry and drones of all sizes have become the chosen weapon of choice to both sides in the conflict.

Now to the point where as I suspected and indicated might happen “light aircraft” are being turned into drones that have a 500kM or more range with a considerable payload capacity above 100kg.

Now a “Second Market” for ordinary consumers has arisen questions are obviously going to arise as to,

“What are consumers going to do with these new technologies?”

And one answer to that is what the Wired article is about.

Personally I’m not as worried about it as less well informed journalists and politicians are.

Terrorism is generally not “irregular warfare” the people it attracts are generally not the sort of people who have technical capabilities or knowledge. Whilst crude “bomb making” is within pre-teen “chemistry set” type capabilities the design of other weapons is generally out of such peoples capabilities and all to often their patience levels and as the old advice has it,

“Hast kills the impatient and intemperate all to quickly”

Even Shakespeare was aware of this with the famous line of,

“Hoist with his own petard.”

Engineering is generally a thoughtful occupation and those who live long enough to get good at it generally have a high regard for their own skin, thus are usually temperate and patient. Further they tend not to subscribe to the notion of,

“Move fast and break things”

When high levels of “energy and mass” are involved, preferring the “live to fight another day” of things.

Because they generally the can also predict far enough to see on whom things that “go up” tend to “come down upon”.

Clive Robinson • March 20, 2025 10:04 PM

@ Bruce, ALL,

UK Gov asking for input on Computer Evidence

This is something the late Prof Ross Anderson would be not just talking about but asking anyone with any reasonable expertise, experience or opinion to submit.

https://www.gov.uk/government/calls-for-evidence/use-of-evidence-generated-by-software-in-criminal-proceedings/use-of-evidence-generated-by-software-in-criminal-proceedings-call-for-evidence

Whilst it talks of “software” it’s a typical misunderstanding of the subject matter.

In reality software is dependent on humans that design, write, and test it, as well as the humans that put data into it’s operation and configure, operate, and maintain it, as well as humans that try to disrupt it’s operation for various reasons.

Likewise software is dependent on the hardware it uses to processes, store or communicate information with, as well as obtain input by. So includes not just standard peripherals but the gamut of connected equipment, not least of which being IoT, CCTV, microphones, BLE beaconing, positioning, location and other sensors such as “Smart Meters” etc.

Basically anything that is a system or subsystem that can or does generate any type of information from the physical or informational domains or acts upon information in those domains. That is information that can be generated, communicated, stored or processed to generate other information or action physical or informational.

Unfortunately the person who wrote the page shows the same failings as Australian Prime Minister Turnbull, almost as far back as the UK “Investigatory Powers Act”(IPA-2016),

https://www.newscientist.com/article/2140747-laws-of-mathematics-dont-apply-here-says-australian-pm/

It’s an attitude we should strongly take issue with, especially when it comes to Stochastic and Probabilistic systems which are becoming highly prevalent due to current AI LLM and ML systems.

OK it gets called “Hallucination” or “Soft Bullshit” in the relevent domains of expertise as “terms of art”. But in reality the point needs to be firmly made that it is “non deterministic” and “without repeatability or provable causal behaviour” and is in reality little more than somewhere between “throwing dice” or “throwing darts” with your eyes closed.

The notion of “evidence” is based on the notion of “truth” from which facts can be reliably established. The fact it was mathematically established that there is a problem with any logic beyond the most basic a century ago. That shows it’s inconsistent, thus incapable of proving it’s self to be reliable, the consequence of which is no computer can “check it’s self” to function as it should at any level should be cause to wave a big red flag.

Thus the answer to a question such as,

“Can a computer report falsely?”

Is most definitely “yes”

And to the obvious following question of,

“Can a computer be reliably audited after an event?”

The answer is most definitely “no”.

After that it all goes downhill…

(It’s the same arguments that are used about why ‘computer voting’ is a bad idea).

The fact that politicians and to a certain extent the judiciary really do not like this… Gives rise every so often –since UK PM Maggie Thatcher decreed that what was printed on a piece of paper was “The uncontestable truth”– as evidence against “what they want being true stacks up adversely”, they feel the necessity to either,

1, Make it go away.
2, Some how fix it by legislation.

And so far, always end up finding they cannot do either, so they fudge it. With so far moving further and further away from the Thatcher view point. Which they find unfortunately causes problems they can not resolve, hence significant injustice can and does arise.

The actual solution is to treat current computers systems as,

1, Unreliable witnesses with a long history of “false testimony” given.
2, Hostile witnesses that can not be cross examined.

In the past I’ve pointed out how you can resolve some of the issues but also it’s not possible with current computing systems.

This subject needs “Public Debate” not a “nod and a wink long grass kicking” that is clearly wanted to in effect “carry on as before” in a pretense of a cosy delusion.