Schneier on Security

Clive Robinson • November 29, 2025 3:40 AM

@ lurker,

With regards,

“A320-neo planes affected by instense solar radiation.”

I’m not surprised in the slightest.

One of the first single chip CPU’s was the 1802, which is as far as I’m aware still available for sale.

The reason the 1802 is special is for two reasons,

1, It could be run with a clock that if stoped or run very slowly put it in a very low power state.
2, It was produced in a “Rad Hardened” version for space and military applications.

https://en.wikipedia.org/wiki/RCA_1802

The thing to note is that even back in the 1970’s and earlier it was known that what we now call “Space Weather” can have a very detrimental effect on aerospace systems.

One of the designs I produced for a “Remote Telemetry Unit”(RTU) for the offshore Oil Industry had to be “Rad Hardened” for safety reasons[1].

Put simply when you are controlling the equivalent of a large bomb you don’t want the control system going off to a mad hatters tea party.

So yes the recent solar weather highs that gave us CME auroras visible as low down as Texas and problems with many LEO satellites ment there was a lot of interesting effects at “6 miles high”.

[1] Luckily for me back then, there was no “formall tests” involved so I did not have to buy any lead underware (which if you’ve ever had to ware it you will know can really slow you down).

Clive Robinson • November 29, 2025 10:45 AM

@ ResearcherZero, lurker,

With regards,

“It’s probably easier for Airbus to fix the problem because they brought the development of flight control systems back in-house, which may make it a simpler process to deal with.”

My guess is it’s not a software issue as such, but the “non-volatile memory”(NVM) it’s stored in.

So in effect it’s a “reload and test”

With part of the test being the NVM is not degraded or permanently damaged.

The thing to remember is that each year the surface area of a storage device gets smaller by quite a bit. In turn this make a charged particle hit effect bigger by quite a bit…

There is only so far ECC Memory can get you to improve reliability. And at some point the real estate for the ECC will be beyond any savings made by making the NVM cells smaller…

And that’s before we start talking about “metastability issues”. We’ve all heard of “screen burn in” but how many realise that the smaller you make active devices the more likely they are to suffer “burn in”?

Which makes metastability issues worse 🙁

Then there is also an issue due to nuclear bomb atmospheric testing. You can not get shielding that is isotope free unless you dive down to WWII ship wrecks and cut bits off[1].

All good fun and abject misery for intrinsically safe aerospace design engineers.

[1] Not quite true… When I was young and on holiday with my dad in Portsmouth UK they were diving down on the Mary Rose and pulling stuff up and storing it in a garage… We happened to walk buy and I noticed a cannon ball being used to hold the door open. It was breaking up and bits were flaking off. Being bright eyed, bushy tailed and enthusiastically interested we got chatting for quite some time with one or two of the people there. They were kind enough to let me have some of the flakes as a souvenir. Which I still have in a match box along with a photo of me standing beside it with the two people there. Inside the rust there will be solid iron in the flakes that will not have nuclear bomb isotopes.

Clive Robinson • November 30, 2025 6:05 AM

@ ALL,

Next AI investment scam “Give it Space”

I’m not sure who is jumping on who’s “hype band-waggon” with this “down the toilet” money grab but don’t take my word for it when I say it’s a dud.

The idea is basically “start up space venture companies” to team up with AI companies, to “put data centers in space”

Obviously to sell the pitch with loads of fake but plausible sounding arguments, of plenty of space to expand, unlimited power, etc etc. So basically stick an undeveloped high risk launch system maybe upto being a prototype, up the backside of unreliable power hungry AI data center rack and “go for launch” and failure to deliver, or return investment…

I could go through all the arguments I’ve heard one by one and shoot a crater sized hole in each and every one…

But why bother when some one has done the “Heavy Lift” already,

https://taranis.ie/datacenters-in-space-are-a-terrible-horrible-no-good-idea/

Oh it also goes into Rad Hardening electronics design in sufficient depth that will help peps get their noggins around the A320 Airbus issue that is grounding hundreds if not thousands of aircraft world wide. And will ground a lot more as other aircraft are properly examined (Think a Boeing III or is it IV?).

Seriously though folks don’t put your money on “AI in Space” your money would produce more return on “mining asteroids for platinum” and that just won’t pay in our lifetimes if not longer.

Further the author also has another post based on actual science that explains why Current AI LLM and ML Systems are going to be hitting another “AI Winter”,

https://taranis.ie/llms-are-a-failure-a-new-ai-winter-is-coming/

And their ultimate conclusion, is a warning investors should heed,

“Winter is coming, and it’s harsh on tulips.”

And “buttercups” alike… So put on your thick winter coat, and flee, lest your shirt be clawed from your back and your naked body be thrown out into the winter freeze.

Clive Robinson • November 30, 2025 3:22 PM

@ Winter,

In space nobody can hear you steam

Regards,

“anyone who is aware of the main problem of AI data centers, heat”

Well yes the only way to get rid of it is,

“By radiation off the dark side”

Which creates the problem of moving the heat from one place to another. Without a gravitational gradient of sufficient size conventional methods just won’t work. So closed cycle fluidic / refrigerant systems have to be used. Which means fun chemicals like ammonia. Which in turn can cause major “station keeping” problems if pipes break down in some way.

But most people tend to think of “heat” coming from “the load”… Forgetting it comes from everywhere work is done so the generation as well as the transmission to the load. Then moving coolant from pumps and friction. Basically anywhere that is not 100% efficient (which is every part).

I could go on at length, but I won’t because my stubby fingers and bad eyesight will fill it with typos.

Fun fact if you design CubSats there are no space qualified cooling systems that will fit in… So you have two basic choices,

1, Design for minimum power generation, storage, and use.
2, Design for a very short in service life time of just months.

Considering the real cost of getting even a CubeSat into Low Earth Orbit, the first route is really the only route to go. And that has all sorts of implications with respect to “down links” having to be “narrow bandwidth” thus “low data rate” with “high latency”.

Which means it does not matter how small, lite, and energy efficient sensors are, they have to be “low bandwidth”.

And the comms needs several layers of error correction including “Error Correction Codes”(ECC) at the data level, “Forward Error Correction”(FEC) at the comms level all of which sucks up loads of bandwidth, and adds lots of other latency…

Fairly quickly you realise you,

“Only have a tiny box to work in”.

Clive Robinson • December 1, 2025 6:12 AM

@ ResearcherZero, ALL,

With regards the “drug cartels”

They are the “end game” for where US Corporatism is heading.

And it won’t be the first time, the 1960’s through 90’s were rife with openly naked examples of this with the assistance of US Intel Agencies.

It never really stopped, it just got kept out of sight by “outsourcing” to the likes of South African and Chilean “security forces” that were politely called mercenaries.

But it still goes on as it’s virtually unstoppable and many US and Other Corporate leaders see it as part of,

“The cost of doing business.”

And the politicians are little better just striving to keep their involvement at a couple of arms lengths

This of course will be what AI becomes used for in the very near future unless the Hype Bubble explodes so much they become too extreme in public eyes and eventually legislated against.

Those who think different really need to take of the blinkers and see the world in a little more wider reality.

We’ve seen the Aus RoboDebt and Dutch child care disasters. The UK has a system they call “The Connect System” for Revenue and Benefits like pensions, which is without any doubt going to cause significant harm to many innocent people.

Clive Robinson • December 2, 2025 5:47 AM

@ lurker,

With regards heat pipes and,

“… the heat pipe uses capillary action, or “wicking”, to move the liquid phase from the cold end to the hot end.”

The heat pipe is a “phase change” device. And has an “outward and a return path”. The wicking is used by the return path to get the liquid state back to the hot end. But that part of the cycle does not carry heat, hence heat pipes can be and often are “heat diodes”. The actual heat transfer is caused by the phase change from liquid to vapour and back again at the hot and cold ends respectively. The phase change causes a change in density from liquid to vapour and back again but maintains the temperature of the “working fluid”.

It’s actually surprisingly efficient and can move kW of heat fairly rapidly.

However it has a few issues,

1, They have a quite limited temperature operating range.

2, The wicking or capillary action of the return path only works effectively over about 250mm / 10inches max without further assistance (in “thermosyphon” mode it can be 6m ~20ft). So there are various tricks that have been tried involving chains of them and heat exchangers.

3, The diameter of the pipes can be surprisingly large and can be upto 22mm ~9/10ths of an inch. Which has issues on bend radius etc.

Whilst the first two are not generally an issue in most laptops and computers or LEO Bus systems. The third is realistically not going to work well for what goes in a data center rack.

The first issue was –back before C19– a research item in the UK and the EU were putting a fair chunk of change into “Single Loop Pulsating Heat Pipe” using wickless “Hybrid Heat Pipe”(HyHP) technology where the pipe effectively oscillates[1]

It’s a knowledge domain, that is in flux thus not directly “amenable for engineering” use and I want things to settle a bit before I “dig in”.

Oh and then there is “radiation degradation” to consider you send up one type of working fluid but what does it turn into with time…

Any way heat pipes and I are of a similar age ={ and you can read a techno/historical report,

https://www.scirp.org/pdf/JECTC_2015032615124788.pdf

[1] It’s kind of one of those “Don’t ask” ideas and a bit like getting your head around jet engines, a “simple” explanation is given as,

How does HyHP work?
The vertical operation in gravity, as well as the distinctive location of the heating and the cooling sections, causes the fluid to circulate regularly in a preferential direction guaranteeing stable operation and homogeneous temperature distribution of the system. The combination between channel dimension and working fluid is chosen in such a way that the device will operate in thermosyphon mode on the ground and, in the case of weightless conditions, in capillary mode, meaning that the liquid completely fills the tube section and therefore vapour expansion and contraction cause an oscillation of the liquid/vapour patterns.

For “the basic stuff” NASA has a “viewfoil” style presentation,

https://ntrs.nasa.gov/api/citations/20230009276/downloads/Heat%20Pipes%20for%20Space%20Applications%20Part%201%20-%20Axial%20Grooved%20Heat%20pipesy%20Rev4.pdf

However much of it is actually assuming “Constant Conductance Heat Pipes”(CCHP) rather than the simpler wicked pipes. In part because CCHP can give greater lengths in low or near zero gravity differential environments.

Clive Robinson • December 3, 2025 4:56 AM

@ ALL,

IBM dumps cold water reality on AI fools dreams

OK IBM have a famous past, in the old old story of IBM and computers, and the boss saying maybe five were needed world wide[1]…

Howevever that has not stopped,

https://www.businessinsider.com/ibm-ceo-big-tech-ai-capex-data-center-spending-2025-12

IBM CEO says there is ‘no way’ spending trillions on AI data centers will pay off at today’s infrastructure costs

AI companies are spending billions on data centers in the race to AGI. IBM CEO Arvind Krishna has some thoughts on the math behind those bets.

And significant doubts that AGI will happen at any price.

His three headline points are,

1, There is “no way” to make a return on investment let alone profit at current costs.

2, That is $8 trillion of Capital Expenditure”(CapEx) means you need roughly $800 billion of income over operating costs just to pay for the interest.

3, And puts the probability of current technology reaching AGI, at less than 1%.

Whilst it might be “back of the napkin” reasoning, the figures are based on current known costs for building data centers.

But also there is,

4, It then takes about $80 billion to fill up a one-gigawatt data center.

5, With proposals to commit 20 to 30 gigawatts, for each company… that’s $1.5 trillion of CapEx,”

6, At best you will get 5 years use of the equipment before it’s effectively scrap.

7, We don’t currently have the required “technologies [with] the current LLM path,”

Which is why Arvind Krisha proposed the point I’ve made here several times of what he called “fusing hard knowledge”. That is of input of carefully curated very domain specific knowledge into LLMs tuned with highly specific rules. It is a very specialised future path which we’ve seen with AlphaFold.

But… as they are highly specialised use cases, we generally only have need for a very few super computers at any one point in time.

Which is why currently very few super computers actually exist, and they are mostly in National Science “Super Computing” Centers as they get paid for not by corporations R&D but national tax take.

Worse, such use cases are mostly “One run and done” to answer specific questions, or like Weather Forecasting are continuous run. Both are at the very end points of the computing spectrum, and you just don’t make consumer / commercial products thus money at such outliers.

Because these use cases are actually not profitable for every day companies or corporations, they won’t replace employees, or make them on mass individually more productive.

There is basically only two things they will do,

1, Provide an opening for new fields of endeavor.
2, Provide artificial predictions of potential future events or actions.

Whilst the first is more likely to have societally beneficial results. The latter is very much the opposite when applied to humans and their everyday activities.

People need to remember,

“Whilst criminals might be outliers, most outliers are not criminals, even if some for their own benefit use arguments that paint that view.”

That is if your statistical model says “Something will do X” even if the something has “no agency” there is actually no reason to believe the something will actually do X.

Think of it like “Brownian Motion” we can make predictions that as we add energy to a working fluid the particles of the fluid will increase their movements. As a result we can say the working fluid when viewed on mass will become less dense “by some probability”. But we still can not say where any individual particle is, or in what direction it is moving, nor it’s actual velocity. All we can actually say is,

“If we add them all up and normalize we can give a mean / average for them on mass based at best on an unknowable probability.”

And that is a very real danger to society as it will be existential for some members, and of significant harm to others, for the short term benefit of very few.

[1] The 1943 quote from Thomas Watson, chairman of IBM, tops the list of historical computer prediction quotes,

https://www.computinghistory.org.uk/pages/218/Historical-Quotes/

Clive Robinson • December 4, 2025 1:34 AM

Are AI VC’s getting desperate enough to offload with fraud?

There is a strategy similar to the first stages of “Pump and Dump scans” used when “Venture Capitalists” want to push a “crock of 541t” they are getting desperate to move before it hits a “best before date”. It’s known as “Kingmaking” and it’s basically a form of misrepresentation or fraud in name but strangely apparently not legislated against in the US under certain conditions…

Techcrunch feels it has evidence of this which it’s put in an article,

VCs deploy ‘kingmaking’ strategy to crown AI winners in their infancy

‘[Giving] an extremely handsome valuation relative to revenue is becoming an increasingly common investment strategy among top-tier VC firms. The tactic is known as “kingmaking.”

This approach involves deploying massive funding into one startup in a competitive category, aiming to overwhelm rivals by granting the chosen company a bank-account advantage so significant that it creates the appearance of market dominance.

Kingmaking isn’t new, but its timing has shifted dramatically.

“Venture capitalists have always evaluated a set of competitors and then made a bet on who they think the winner is going to be in a category. What’s different is that it’s happening much earlier,” said Jeremy Kaufmann, a partner at Scale Venture Partners.

This early aggressive funding contrasts with the last [AI] investment cycle.’

https://techcrunch.com/2025/12/03/vcs-deploy-kingmaking-strategy-to-crown-ai-winners-in-their-infancy/

As I said not technically illegal but many would consider it at best extremely deceptive, if not dishonest.

Why?

Well because the strategy kind of relies on not letting investors know certain pieces of information, such as actual trading income free from outside “pump up” investment.

Because it “fine lines” and is “so questionable” it’s often seen as a “Desperate measure” indicative of the VC’s,

“Trying to pass a hot potato.”

That is knowing or suspecting things are about to go horribly wrong for some reason in a market segment and trying to get out whilst they still can by –as a friend of mine once put it–,

“A diversionary tactic akin to reorganising the deck chairs on the Titanic.”

But back to the ultimate paragraph of the article,

‘But those precedents don’t faze major VC firms. They prefer to bet on a category that seems like a good case for AI, and they would rather invest early because, as Peterson put it: “Everybody has fully internalized the lesson of the power law. In the 2010s, companies could grow faster and be bigger than almost anybody had realized. You couldn’t have overpaid if you were an early Uber investor.”’

Take careful note of,

“the lesson of the power law.”

Sometimes called the “log log straight line plot”. Like the “normal distribution curve” of additive probabilities,

“It’s “a curve that pops up everywhere in nature.”

Oddly in another case of weird simultaneous coincidence Veritasium has just put out a nice vid on the “power law”,

https://m.youtube.com/watch?v=HBluLfX2F_k

With some really nice visuals.

Which saves me having to explain it in my left-handed way 😉

Speaking of which I’ve mentioned before that the “taught” economics of the free market is about “goods” and as presented by economists it’s about “tangible –physical– objects”. What is oft not stated clearly is the cost for each object increases as you move away from the point of manufacture. Crudely it’s an r^2 cost that applies to every object and this comes directly from profit so acts as a damper and limits the size of a market. However intangible –information– objects such as those supplied as “services” are different. For example with the Internet it’s effectively a “one off cost” to install infrastructure, not a cost per information packet. Have a think through how that effects the size of the market and what that does to players. Especially when the players are not paying the “one off cost or recurring costs” their customers are…

The difference accounts for why “supply chains” are stripped to less than “the bare bones” and have become so fragile and insecure.

But does it also give a clue as to why VC’s are behaving the way they are over AI?

Having had a run of “no hopers” of Blockchain, crypto-coin, NFT’s, Web3 and Smart-Contracts, which have shown that this time around the biggest threat is market killing “regulation” through apparently randomly instigated and quashed EO legislation.

Clive Robinson • December 4, 2025 11:15 AM

Free Software Foundation Europe leaves Hellon Rusk’s X to rot in pieces.

https://fsfe.org/news/2025/news-20251204-01.en.html

Hopefully this snowball will start an avalanche of those who leave for better places.

Clive Robinson • December 4, 2025 6:10 PM

@ ALL,

Is a Panda Warping around your innards causing you a 541ting Bricks Storm?

Hot of the press as it were is this

https://www.theregister.com/2025/12/04/prc_spies_brickstrom_cisa/

PRC spies Brickstromed their way into critical US networks and remained hidden for years : ‘Dozens’ of US orgs infected

Alleged “Chinese cyberspies maintained long-term access to critical networks – sometimes for years – and used this access to infect computers with malware and steal data, according to Thursday warnings from government agencies and private security firms.“

(Yes the Typo of “Brickstromed” in the title is the either the articles author or their editors doing, not mine).

In essence the attack uses vulnerable “edge devices” which in some cases are in effect “IoT Class devices” to get in, then attack VMware products to turn a toe hold into a “bridge to far”.

This sort of “weak edge device” entry, is not going to go away any time soon due to the nature of the “Edge Device Market” where security upgrades are still a rarity.

As for the VMware attacks that follow, again it’s a “Market Place failure”. The product was untill Broadcom got their sticky fingers on it, fairly ubiquitous… So was a good ROI target for attackers.

It is almost laughable, that Broadcom that was untill it purchased VMware a couple of years back mostly a Hardware Manufacturer, that made devices that ended up in those vulnerable edge devices…

Clive Robinson • December 4, 2025 7:13 PM

Microsoft can not sell AI Slop, so they cut sales person targets in half

Yup, is it an admission by Microsoft that they’ve dumped a bucket load of cash yhe size of some nations GDP’s into a bottomless black hole?

Apparently not as that would be “too face palm” even for Microsoft…

Read more on it at,

https://arstechnica.com/ai/2025/12/microsoft-slashes-ai-sales-growth-targets-as-customers-resist-unproven-agents/

Microsoft drops AI sales targets in half after salespeople miss their quotas. : Microsoft declared “the era of AI agents” in May, but enterprise customers aren’t buying.

“Microsoft has lowered sales growth targets for its AI agent products after many salespeople missed their quotas in the fiscal year ending in June, according to a report Wednesday from The Information. The adjustment is reportedly unusual for Microsoft, and it comes after the company missed a number of ambitious sales goals for its AI offerings.“

It’s that “enterprise customers aren’t buying” aspect that many should note.

Because if enterprises are not buying into the AI Hype two important things will most likely happen,

1, The AI-Hype bubble will deflate or implode in the near future as a new AI-Winter blows in.
2, If work places see no “productive use” for Agent based AI –which appears to be the case– then most likely they are not going to replace humans just yet.

But also remember from what has been said of many Microsoft AI sales is that they were made by “compulsion”. That is people had to buy AI to keep what they needed.

In which case the reports of,

“Way less than one in ten take up”

might have a degree of truth that is,

“Stacking the brown stuff for ultra low orbit flight”

So make sure you have your own PPE for class 4 bio-hazard rating handy 😉