Schneier on Security

Clive Robinson • June 14, 2025 5:08 AM

@ ALL

Something I saw in a comments section of The Register,

Vibe coding!

When you’re so shit at being a script kiddy that you can’t even cut and paste something together!

From,

https://forums.theregister.com/forum/all/2025/06/13/forget_vibe_coding_were_all/

That whole comment section is actually one of the better ones, and… With the most up votes given to a snark on systemd 😉

Clive Robinson • June 14, 2025 8:45 AM

@ StephenM, ALL,

With regards,

“Aus will pay a whole lot and receive nothing.”

Not quite true… It will receive international ridicule and the Aus negotiation team will be invited to be the table center piece at the next “Thanksgiving Dinner” just like any well stuffed turkey…

I’ve pointed out that the US has no intention of delivering let alone “value for money”, it’s just a never never plan to get money in the door to off-set US horrendously bad ship building. Even the UK will be pushed past the Parson’s Nose as the people here making the UK side of it were “idiots squirming under Boris the blob”.

Note the very recent less than subtle blackmail from Mr “Signal Group with Journo” Headsmack.

The US is telling NATO countries the same “Spend more on defence” actually meaning “Only spend it with the US” and have what you’ve paid for be grabbed or worse.

I’ve mentioned the whole reason behind the US Chips Act etc is to get the Semiconductor FABs and technology into the US where they will be in effect “grabbed under the war act” along with all IP etc (and employees with commercially confidential information will have it extracted in one way or another…).

The Taiwanese Government is certainly aware of thid which is why they’ve put pressure on TSMC not to do anything more than “play along”.

Because the Taiwanese Government knows the only thing keeping CCP boots off of their island, is the US military, and the only reason the US military is in the South China Seas and environs is the likes of the TSMC plants providing chips the US Mil are reliant upon in more ways than one.

So watch TSMC play along, yes they will build plants in the US over the next half decade or so, but without really investing. But you can probably guess it will be “third line” chips for the Auto industry etc using FAB equipment not upto making first line chips.

At a “pickpocket convention” you keep your gold watch in your inner button down pocket, and put a polished “brass ring” on your waist coat chain[1].

[1] A brass ring was once a marketing tool on carousel rides. It cost the ride owner nothing, and even helped make the ride look more popular thus brought in more people with money to be fleeced. For some reason I’ve never really grasped people in the US think grabbing the brass ring is a measure of status (read Catcher in the Rye). Rather than the marketing gimmick that they had been fobbed off with as part of the capitalist path to “rob them blind for profit”.

Clive Robinson • June 14, 2025 3:42 PM

@ Mr. Peed Off, ALL,

You have to wonder, on reading,

“The models are already deployed by agencies at the highest level of U.S. national security, and access to these models is limited to those who operate in such classified environments.”

If they had “soccer training” and of they got the “Executive football” to kick around or… If the Trumper through the toys out the pram and stommped off home “With the bat and the ball”…

Ahh so many jokes so little time…

@ ALL,

For all those who took part in the “No Kings Marches/Protests” I hope it all went off peacefully with no provocation?

Oh and something else it appears from what I’ve seen in non US MSM, the executive is only sending tanks and such into blue states… To needlessly do millions of dollars of damage to the roads and other transport infrastructure that will cause significant economic damage to the States concerned.

Can anyone on the ground confirm this?

Clive Robinson • June 15, 2025 3:42 AM

@ Ismar,

With regards,

“is it painful to know so much yet not being able to change anything?”

There is a saying in the UK that,

“Ignorance is bliss.”

It’s at best only true in the very short term. Longterm ignorance will enslave and worse people.

Or in US parlance such people are called”sheeple”… which in reality means those of certain failings will abuse people who do not have sufficient “situational awareness” mentally and physically.

The way to change things is not by violence, insurrection, or similar, but by helping people to become “situationally aware”. As well as giving them the mental tools to lift themselves out of the hole they have been pushed into by authoritarians.

When I was young great change was going on in that girls were getting opportunities that their mothers had not to go out and earn money and be independent. But there were limits on what they were allowed to do. My mother was a serious historian, but “the system” would only let her be an “assistant historian” or “teacher” even though she was more qualified and more capable.

WWII however had shown young women there was more than just working in shops and factories doing manual labour. Young men came back prematurely aged, to discover society had changed and girls were nolonger becoming wives or nurses in the towns they were born in. In some places it caused violence, in others a rapid growth in the middle classes for the brighter girls. By the time the 1960’s came along, girls had not just economic freedom but freedom of movement, and they moved away toward the places where there were middle class opportunities.

“The taste of freedom was strong, it’s call a siren song.”

Those who remained well they got married and entered domestic poverty and all that went with it…

In effect those that were situationally aware escaped the servitude, and the violence that oft went with it and made better lives for themselves.

Both my parents raised me to be not just inquisitive and curious but to instill in others the same awareness of what was around them. I was barely into my teens when I was teaching people to sail and build boats. I went into design of boats using the new composite materials but also had hobbies involving radio and electronics. I earn’t money by fixing peoples radios and televisions as well as picking up older equipment at “jumble sales” and “fixing restoring” and selling them on to people who could not afford new. Then I got hit by a mineral oil allergy, shortly followed by an allergy to the “plastics” in the composits. My path had to change and I was not even out of school… So I moved in the direction of a hobby, and thus studied science and electronics in college. Other disasters befell me such as being orphaned whilst still at college. So my path had to change again so I went with the new field of computers.

But I’d found the profession was lacking in balance, women were not just a rarity they were virtually unknown in the profession. So I got actively involved in changing that, which I still do today, only my scope is a bit broader as it’s now “STEM” I encourage.

The lesson is there is no bliss in ignorance, happiness comes from having choices, and choices usually only come about with knowledge of skills and the environment you are in, and other environments further away in which you might be better suited either now or in the future.

Speaking of the future, people talk of “Fight or flight” as though conflict is lifes lot. Neither fight or flight are good options as they have both significant cost and risk attached. As my father taught me,

“The best place to be when there is trouble, is some place where there it is not.”

By that he ment not flight but an orderly and planed strategic withdrawal to “better ground”.

Or as he was apt to put it,

“Get out whilst the going is still good.”

And for that you need situational awareness and the skills to make the most of it.

Both my parents were by education and practice well off and quite far up on the middle class scale. But they remembered what their parents and grandparents had taught them about how to survive poverty and hardship by being prepared for it, and also opportunity. Lessons they taught their children, and I have passed on to not just mine but other children some of whom are now parents, and are passing it on to them.

Change does happen, but slow and steady is better than fast and furious, as people don’t get left behind or trampled under foot.

Clive Robinson • June 15, 2025 3:39 PM

@ Setec Astronomy, ALL

With regards Hobbes –and Calvin– it is over a third of a century old and has had “near misses” in the past. The most major probably being last year,

https://arstechnica.com/gadgets/2024/01/after-32-years-one-of-the-nets-oldest-software-archives-is-shutting-down/

Hopefully it will rise again as will the other services mentioned in the Email you link to.

As for me… Thanks for enquiring. Tomorrow morning it’s off to the Doctors to see if I’m still worth having surgery carried out on, or if things will be left to run their economic course to short term failure.

Clive Robinson • June 16, 2025 2:59 AM

@ Flow control,

With regards,

“Seems the dam controllers were doing it wrong, if a password was all it took to gain access. These control systems should have much better protection than a mere password.”

Sadly the only Norwegian words I know come from a miss spent youth working in the off shore industry, and lets just say they are of the NSFW type that gets enounced when metal hits the thumb etc.

So information to make comment is limited.

But when you think about it nearly all “access control” ultimately falls to either,

1, Something you are (Biometrics)
2, Something you know (passwords)

As “Something you have” always needs to be gated against theft / evil maids loaning to others so they can do a temporary “work around” (that never goes away).

The first is increasingly frowned upon, not because IT/Managment cares if an employee gets their finger chopped off etc. But because in the general case the false positive and false negative rates are way to high. Thus the actual security is about 10bits equivalent or less secure than a 4digit PIN for a bank card.

Clive Robinson • June 16, 2025 9:11 PM

@ lurker,

With regards, the statement by the U.S. Commerce Department’s Bureau of Industry and Security,

“Such chips likely are either designed with certain U.S. software or technology or produced with semiconductor manufacturing equipment that is the direct product of certain U.S.-origin software or technology, or both”

Is actually irrelevant under international trade treaty agreements the US originated and signed up to.

Look at it this way, I build a house with nails I purchased at the local hardware store in my area. Do you around the other side of the world have a right over those nails that were not made in your area, from ideas so old they predate the USPO and thus could never have been patented or restricted in any way?

No.

How about if I used a tool like a hammer to put the nails in? An idea that certainly goes back long long before the USPO and originated in Europe. Not the US.

The technology used is not “US” nor is it “US Gov” property. What became clear with the US sponsored anti-5G is just how far behind the technology curve in semiconductor production the US is. Something the now Tub Trumper made worthless “Chips Act” was supposed to correct.

The Tub or it’s minions may not want to admit it but China has been ahead technology and manufacturing wise for quite some time. And is one of the primary reasons US businesses and Corps out sourced and off shored so much there.

In short the Tub trumper administration is saying,

“We own everything because we say so and you have to do what we say with what you make”.

I’ve mentioned on this blog for several years “The King game” that invented the excuse of “Divine Right” to cover up what is narcissistic “Might is Right” thuggish behaviour… So yeh not unexpected.

But apparently it was supposedly Tub Trumper’s birthday bash over the weekend, and as reported in some MSM, apparently more people attended the “No Kings” events than his military tattoo. Which as I understand it was of the sort willy waving nonsense beloved by authoritarian regimes like those in Russia and China…

Perhaps there is a lesson in that lack of attendance…

Clive Robinson • June 16, 2025 11:50 PM

@ Bruce, ALL,

Robotic AI sailing surveillance drone

Take a thirty foot long canoe style hull, add a keel and a sail and you have a craft even ancient Polynesians would recognize.

Now add solar systems for power to run sophisticated / secret surveillance equipment and an auto pilot system driven by what the company owner claims is “AI”,

“Saildrone founder and CEO Richard Jenkins compared the vessels to a “truck” that carries sensors and uses machine learning and artificial intelligence to give a “full picture of what’s above and below the surface” to about 20 to 30 miles (30 to 50 kilometers) in the open ocean.”

In this deployment it appears that the surveillance is for “Russian under-sea cable cutters”.

https://apnews.com/article/denmark-robot-sailboats-baltic-sea-bfa31c98cf7c93320115c0ad0e6908c5

Clive Robinson • June 17, 2025 7:16 AM

@ Bruce, ALL,

The last nail for LLM AI?

Some might have noticed that there is a lot of “Get of my lawn” type behaviour in current AI LLM ML training.

The AI companies want unfettered access to others work, yet they are working every which way they can to stop others getting similar access to what they have collected.

This is rather more than another form of “Enshittification” it’s trying to build “tied in markets” in a “winner takes all” game we’ve seen play out before.

The term for it is based on,

“Pulling up the drawbridge”

We are starting to see it with all the AI companies and it is only going to get worse rather quickly.

The thing is it’s short sighted because it will fairly quickly have the opposite effect that is intended. It is after all why we have “Open Source” and “standards” that both boost “interoperability”, “invention” and “progress” that contrary to what the idiots think does bring profit.

Any way, one observers viewpoint,

https://www.dbreunig.com/2025/06/16/drawbridges-go-up.html

My advice just accept that current AI LLM, LRM, and ML systems are at best mediocre and all to often complete crap. Further the Corps behind these systems and the VC’s and other investors want “quick pay off” as they “pass the potato” to the next idiot in line. In effect we are just one step away from “enshittification” and there appears no short term way to stop it for those in the game, they are committed to “make bank fast” and that’s not happening because the current product is “not fit for market” and certainly can not and most likely will not ever meet the claims being made for it…

There will be a monumental burn of hundred dollar bills making almost as much energy as the LLM’s currently use when answering questions like,

“Why is green the traditional colour hospitals get painted in?”[1]

Thus the current AI hype bubble will either burst as many such “black tulip” markets do. Or it will just deflate like a “whoopee cushion” causing much embarrassment and desire by most not to be in the same room as it were.

The sage advice currently is based on,

1, Any resources you invest in current AI LLM LRM and ML systems is almost certainly not going to give the hoped for results.

2, The current state of this type of AI is not just well below par it’s stuck in a near bottomless sand pit akin to quick sand.

3, Mostly the current AI is a failed attempt at ML to make the patterns 1980’s “Expert Systems” used real human experts to show and encode.

And the advice is,

“Sit on the side lines and keep a watching brief, but most importantly remember the 1983 advice of,

“A strange game. The only winning move is not to play.”

[1] There is a real answer and it’s not what most think… And I’ve yet to see a current AI LLM system get it right… It’s why it’s a reasonable “litmus test” question.

Clive Robinson • June 18, 2025 2:49 AM

@ Mr. Peed Off,

With regards,

“It’s true, after all, that Waymos are roving surveillance machines.”

I would have thought that was a given, the same as it is for less well equipped thus less surveillance suitable Tesla vehicles.

The reason behind it is the US is a litigious collection of states and people “on the hustle”. So to protect themselves from law suits the “self drive” / “drive assist” companies collect as much “self defence evidence” as they can.

As such data is automatically “third party business records” that are “collected in a public space” arguably not even a trip to court is required by law enforcement and others.

With regards,

“Peter Thiel and Alex Karp’s Palantir”

If you look back on this blog you will see I’ve been waving a red flag about them and their tactics for quite some time now.

And this sort of thing is only going to get worse…

Because rather than legislators fighting for their voters rights, they are more inclined to “feed of the lobbyist nipple”.

With regards ICE and immigration, it’s an issue that’s been building since the 1960’s if not earlier.

What is now a lifetime ago George Orwell after his experiences of working with the BBC and white and grey propaganda “war work” wrote the book 1984[1]. In it he predicted much of what has subsequently happened.

His view points on the political classes are the most telling, but his understanding of the evils of ubiquitous technology were profound.

So much so some have argued that his writings have been used as “How Too’s” by authoritarian politicians and their followers. It’s why I still recomend people read his works as an abject lesson of what is predictable with a little understanding of corrupt humans in power.

So the politics that have lead up to ICE activities was and still is quite predictable. As George Orwell pointed out the political class are by and large failures, and in the authoritarian form always will be. Thus they need an “evil enemy” to blame all their failings on… Whilst actively creating conditions to have such enemies.

It’s why people need to realise that all these “War on XXX” are actually a war on the voters to excuse the leadership failings. Every time you hear “Think of the children” etc you know that a quite deliberate policy is in play that is going to harm you as an ordinary voter.

But George Orwell is not the only person to realise what is going on…

Read the famous poem by Lutheran pastor Martin Niemöller who living in Germany saw what was going on. In it he effectively condemns complicity of German intellectuals, clergy, and labour groups for aligning themselves with the National Socialists for power. In the period following the Nazis’ rise and consequent incremental purging of their chosen targets, with invented excuses and what we would now call “echo chamber” rhetoric,

https://hmd.org.uk/resource/first-they-came-by-pastor-martin-niemoller/

As you indicate certain types of behaviour are going to happen as people “Rage against the machine”. Unfortunately they rarely effect the out come as their activities are all to predictable, and will get used by the political class to their advantage.

We’ve recently seen such politically inspired behaviour in the UK with the current incumbents. And I can only see it getting worse and building to what is likely to be a series of linked globe spanning unrest both civil and inter state.

[1] He was living in a little book shop –now pizza parlor” at the time. Located at the bottom of “Pond St” Hampstead Hill across the road from the Royal Free Hospital. He was not a well man,

https://academic.oup.com/cid/article-abstract/41/11/1599/356821

Having been plagued with chest ailments much of his life, as a real “freedom fighter” in the “Spanish Civil War” he becoming diseased with tuberculosis from which much else followed. Untill he succumbed a few years later at what some consider the peak of his insightful writing.

Clive Robinson • June 19, 2025 7:05 AM

@ ALL,

Report on Iberian black out in, and it says management not renewables to blame.

https://arstechnica.com/science/2025/06/spanish-blackout-report-power-plants-meant-to-stabilize-voltage-didnt/

Basically it was as I originally indicated a “cascade fail” as issues got thrown upstream and thus multiplied in effect and so cascaded out.

The real culprit appears to be a mismatch between expected and actual behaviour. In that gen-sets tripped out to protect the gen-set at lower voltage and tighter frequency points than expected. Thus models of what to do as a system management procedure were wrong.

I’ll be interested in seeing the full report when it comes out in “English”.

Apparently after careful examination and a deep dive, no sign of cyber-attack or similar was found.

The thing is though, the smaller a grid is the less likely it is to suffer a cascade event. Having a whole continent as a single grid without suitable breaks might be more efficient, but you pay for it with increased fragility. Thus faster and more reliable management is required.

To make it worse, moving to “Smart Grid” operating where demand is managed in premises from remote monitoring might be a great way to increase existing infrastructure capacity, but it again increases fragility.

Thus the question arises as to what sort of management is required to counteract the fragility, and to be honest that is a “ripples in a pond” type issue.