Schneier on Security

Clive Robinson • April 7, 2025 6:15 AM

@ Anonymous,

With regards,

“EU should start with his buddy Elmo instead. Just put 100% tariffs on Tesla and start taxing X.”

Funny thing is Trump appears most upset by US Cars not selling in the EU…

Firstly the Tesla Truck can not be sold or driven in some countries on the East of the Atlantic, as they break safety legislation regulatory rules that have been in place since before Tesla got going.

Other US vehicles are not just way to large and ugly in peoples eyes –including a lot of Americans– They do not pass anywhere near close to “emission standards” that are increasingly strict in cities and urban areas across the bulk of where Western individuals live.

Some of the reasons EU and Far East cars sell in the US despite the existing tariffs is they areca lot less expensive to run and in the eyes of some are a “half way house” to EV where there is not the civil infrastructure in place for EV.

But also the realisation that EVs are going to be a failure of not just expectation but continuation.

Firstly the US power grid in many places has not received the maintenance required let alone the necessary upgrades since around the 1960’s and a couple of decades later with Ronnie RayGun deregulation the end of US civilian infrastructure was in effect sealed with the clock counting down.

Cory Doctrow outlined why and called the process “Enshitification” or “why we can not have nice things”. He’s not the first to notice the individual stages but he was the first to give it a satisfying “roll of your tongue” name. And importantly more recently he’s starting to talk about ways to stop it’s further progress and roll it back.

With regards Trump caring or not and the question of “Who knows or particularly cares?” I suspect many are holding out for the mid term elections to knock out his supporters and hopefully send some of those with senility / dementia off to a “care home” where their needs would be better met. But I suspect that will happen too late to undo the damage done.

I just hope the reason for the mid terms getting suspended is not the start of a World War that way too many of the “past retirment” age politicians want to fight. Last time around we had that lunatic John Bolton pushing every which way to start a World War with his actual target being surprising to many Europe and another “cold war supremacy” position to create.

Clive Robinson • April 7, 2025 5:13 PM

@ ResearcherZero,

With regards,

“I have however never tested if these things come in threes.”

Nor have I but there is an old army saying,

Once is chance
Twice is coincidence
Thrice is enemy action

Though I’m more of a,

One is none
Two is sometimes one
And three are rarely true.

(About the reliability of mechanical clocks used in celestial navigation and how “voting protocols” work).

The point is we actually don’t notice the first occurrence unless it directly effects us. Journalists do notice two and might give it an inch. But three times in quick succession makes the front page, maybe even above the fold (I wonder how many even know what that means any more 😉

But consider the odds are 1:N^2 in a relatively short time period broadening out such that it kind of drops into a Gaussian curve that for some reason gets scaled by 1/sqr(2 Pi) {which is approximately 40% and pops up in all sorts of places[1]}

The point is N^2 for 3 sticks out by having two similar time periods even though the chance of it happening is only about one in nine. For some reason humans tend to be sensitive to regular time intervals.

[1] Getting Pi in the normal, Gaussian distribution or bell curve formula appears odd… But to get the area under the bell curve does not work in calculus but you can get the volume under the curve when plotted in 3D and as that gives you a circular object W=2Pi just appears… Interestingly you also get this volume by dropping pieces of paper from a hight where they fall like the balls in a “pin board” but in 3D. If people want to know more,

https://towardsdatascience.com/why-does-pi-show-up-in-the-normal-distribution-a10baf4a71f1/

Fun fact mathematicians use the radius and engineers use the diameter. The reason is it’s easy to draw a circle with a compass, and easy to measure the diameter of a round or spherical object with a slip or spring caliper, then read off on a measure (similar for tube internal diameters).

Clive Robinson • April 8, 2025 2:05 AM

@ ResearcherZero,

With regards the assumed fake forensic investigator that Brian Krebs details, the UK had a similar case a few years ago (I’d give you a name or link if I could remember it).

But the post on Brian’s site that cracked me up the most when I read it last month was about a DOGE email to “un-terminated by judicial order” CISA employees.

Now you would think that some if not all of the judicially reinstated CISA employees would know email is less secure than a soaking wet brown paper bag…

Somebody at DOGE –or should it be DOGiE– had obviously not read the industry wide memo about email security…

The DOGiE Muttling’s email told the un-terminated to send personal details by email… But encrypted with no requirements as to how or what to do with the KeyMat[1].

Brian rightfully rips into the DOGiE Muttling in a polite way,

https://krebsonsecurity.com/2025/03/doge-to-fired-cisa-staff-email-us-your-personal-data/

Me I might be tempted to be less polite, but the problem is no matter what I say the DOGiE Muttling would actually gain beneficially…

And lets be honest I’m not here to educate the Hellon Rusk Mutts.

[1] This is not the first time this has happened… A long time ago I was asked to “advise” someone who had received something similar by a legal idiot who made patent trolls look cute. My advice “Employ unicity distance to your advantage” so a suitably large block of “ciphertext” was sent by email reply. The legal idiot acknowledged receipt of the ciphertext email reply and electronically signed it… Opps.

For those that do not know unicity distance is a measure that Claude Shannon came up with when investigating “Perfect Secrecy” which has some interesting properties. Wikipedia says of it in,

https://en.wikipedia.org/wiki/Unicity_distance

“In cryptography, unicity distance is the length of an original ciphertext needed to break the cipher by reducing the number of possible spurious keys to zero in a brute force attack. That is, after trying every possible key, there should be just one decipherment that makes sense, i.e. expected amount of ciphertext needed to determine the key completely, assuming the underlying message has redundancy.”

Whilst truish it kind of misses the best points. You can view unicity distance as a measure of the independence of bits in a “key stream”. The more independent the bits are then “the more secure” the cipher and corresponding ciphertext is… If they are fully independent then you get what Shannon called “perfect secrecy”. Thus all things became sort of in “superposition” 😉 that is all bits of the plaintext were equiprobable untill seen through the polarization effect of the full key stream.

Clive Robinson • April 10, 2025 9:18 AM

@ ALL,

“Has Microsoft dropped the proverbial?”

It looks like they have killed of valid “family subscriptions” to MS Office,

“M365 Family users wake up to notice ‘Your subscription expired'”

https://www.theregister.com/2025/04/10/not_just_you_microsoft_365/

Clive Robinson • April 10, 2025 10:49 AM

@ ResearcherZero, ALL,

CISA withheld SS7 failings and the consequences from the public

This won’t be a surprise to you, @SpaceLifeForm, @JohnKnownsNothing, @Namewithheld…, And several others as discussed over the years…

It appears that “Signaling System Seven”(SS7) is even worse of a National Security issue than the CALEA backdoor…

CISA have an unclassified report on it but won’t publish it for reasons no one who understands SS7 can comprehend. So things have come to a political head,

“Wyden blocks Trump’s CISA boss nominee, blames cyber agency for ‘actively hiding info’ about telecom insecurity”

https://www.theregister.com/2025/04/09/wyden_blocks_trumps_cisa_boss/

I do find it mildly amusing that the Trump and Musk behaviours with respect to CISA has made this possible.