Schneier on Security

Clive Robinson • December 20, 2025 9:07 AM

@ 369, ALL,

With regards,

“Building structures with reusable blocks”

For a while my home was in a building that was over 400 years old.

We don’t know exactly how old because it was built out over it’s earlier existence from blocks of stone from other earlier buildings going back maybe a thousand years. We do know from carbon dating the roof woodwork and floor beams some of the oak was over 400years old. There was talk of using dendrochronological dating by matching tree-ring patterns to get it more accurate but I’d changed occupation and thus living location before it happened so never got to find out.

But I guess the oldest building I lived in where the age was known accurately was a coach house at Hampton Court Palace in South West London. It was rented by a Lady friend and we managed to get to not just see but photograph some of the Palace records that were about it’s construction. It to contained materials from earlier times in that some of the bricks were what we would call “reclaimed” or “building salvage” these days.

The thing is back then they knew the work and expense involved in making new bricks or stone facing, so re-used as much as possible.

I still have in my garage a lump of Berlin wall that I acquired helping knock a bit of it down on frenzied night last century. I have always intended to build a building in the garden and add it to the structure as a way to keep it moving purposefully through time.

So yup using “reusable blocks” from older buildings was and in some cases still is a tradition going back to the Roman times in Britain and other parts of Europe (if not earlier).

Fun fact if you ever go to York in Britain, some of the Roman infrastructure like drains and sewers are still fully functional and in use (or they were last time I was there).

I have friends in North America that have trouble getting their heads around the fact I have lived in buildings that were old before their nations existed, or first foot fall at Plymouth Rock. I’ve told them it’s actually quite common but they still have trouble accepting it. A couple of them came over from Boston to visit and I put them in a hotel that was built before Boston USA existed[1] it made quite an impression on them especially as some of the furniture in the hotel was almost as old but still in use.

[1] Whilst one or two places in what is now the USA go back further than Boston (1630), it was the site for many “Firsts” in the continent. As such there are a few of the old buildings like the Blake House there that are creaking their way to their 4th Century innings. Thus paradoxically also a century older than the USA, that kind of started on the 16th of December 252 years ago, so “Happy anniversary” and enjoy a cupper or something stronger in celebration.

Clive Robinson • December 20, 2025 9:36 AM

@ ALL,

Something for the weekend…

We used to talk about “Security”, then we talked about it as “Privacy” but in recent times both words have been made irrelevant. By the new slew of recent “think of yhe children” nonsense legislation. And before that the likes of supposed “Single Sign On”(SSO).

So what word should we now use to recognise both the predicament and a way out of it?

Well,

Privacy is Marketing. Anonymity is Architecture.

“Every company says they “care about your privacy.” It’s in every privacy policy, every marketing page, every investor deck. But if I can reset your password via email, I know who you are. If I log your IP, I know where you are. If I require phone verification, I have leverage over you.

That’s not privacy. That’s performance art.“

https://servury.com/blog/privacy-is-marketing-anonymity-is-architecture/

Has a point or three to consider.

Clive Robinson • December 20, 2025 9:20 PM

@ Ismar,

You mention the fact we are in a “Holiday Season”.

It’s actually a “holiday” that is a “holy day” in many religions because it is actually a “solstice day”.

And as it’s the “shortest day” in the Northern Hemisphere it’s known there as the “Winter Solstice” and is the “Summer Solstice” in the Southern Hemisphere.

As most religions practiced in the Western World also originated in the Northern hemisphere for “political reasons” they used the same Holy-Days as earlier religions as did the religions before those.

Well… back when we lived by the land of growing cycles and migratory cycles the Winter Solstice was a time of significant importance. So from the earliest times we carried out religious rights on that day, some of which involved human sacrifice and what later became “King for a day” with your blood being spilled on the land at dawn on the solstice day… And the selection process was from an item concealed in a community food item like a stew. Such as a hard item stirred in whilst it was cooking.

Hence the silver three pence or six pence piece we use today as an indicator of “luck” in the coming solar cycle.

Any way the solstice is not a day but a moment in time as is pointed out in,

https://www.bbc.co.uk/weather/articles/c8e9rwdd94yo

And it’s in a few hours time.

So may I wish you all a good new solar cycle and hope your local customs are both benign and safe and don’t require going out in the cold.

“Be warm, be safe, be happy.”

Even if you follow the lunar-solar or Chinese calendar which is late this solar cycle, and falls on Tue 17th Feb.

Clive Robinson • December 22, 2025 3:21 AM

Part 1,

(Partitioned due to auto-mod at 8AM UTC.)

@ ALL,

Drones are going down

Some time ago when commercial drones were just starting to be used in the war at the East of Europe there was a discussion here about there effectiveness and where they could go.

It was pointed out that the traditional military “occupy the high ground” was the way to look at it. Further it was noted as how it would effect the type of war that WWI became in terms of extending the notion of using the ground as armour that turned into trenches.

What was not talked about was how trench warfare developed by getting coal miners to dig out under the static front lines and under enemy positions and putting a lot of HE under them and doing extensive remodeling of the landscape from “high ground to vast craters (see articles on Vauquois, Messines Ridge, and the first day of the battle of the Somme). These became the largest man made explosion events ever known untill the end of WWII and the nuclear bomb.

Clive Robinson • December 22, 2025 3:32 AM

Part 3,

Well that conflict to the east of Europe very recently turned in a new direction in that attacks on Russian surface vessels by drones took on a new dimension as well as getting extended into the Mediterranean sea,

https://m.youtube.com/watch?v=Gc4D26vfHbQ

Whilst the available intel suggests the UUV drones are currently made from commercial equipment and their payloads conventional HE explosives it would not take very much to change that.

Take an impending war that the US has tried to provoke against Iran or China. We know China can out manufacture the US not just in terms of quantity, but quality and speed as well as being an established nuclear power.

We also know that they are developing quite sophisticated long range, very long duration sea based drones for ISR type activities that can very easily be converted into a loitering munition of considerable power. It would be daft not to consider they have similar UUVs that could “bottom squat” for a considerable period (months). Thus could become intelligent mines that are nuclear capable.

Iran whilst not currently nuclear capable, could become so within a few months according to quite a few experts. What we know they can do is build both ballistic and non ballistic missiles and all manner of quite sophisticated drones, cheaply and quickly.

Clive Robinson • December 22, 2025 3:37 AM

Part 5,

But there is another point that needs to be noted, China is rapidly advancing in AI, and they appear to be avoiding the “scaling” and General AI” traps that the west has got into at the vast cost to the national infrastructure and economies. In fact they appear to be pursuing “Small AI systems” that could fit in a laptop or desk side case. That could form widely distributed and difficult to attack “Very Wide Area Mesh Systems”. But just as easily go in EV’s or drone systems.

So consider what a bottom squatting UUV that is not just long term loitering but fully autonomous when in the attack phase like a “6th Gen AAV” could accomplish especially if it carries a tactical nuclear device… Especially when all maned vessels need ports and harbours to “support the biologicals on board”.

Thus attacking ports, harbours and commercial shipping may well be the face of the next major powers conflict. On the “sanctions theory” of,

“Kill the trade, kill the economy, kill the state.”

Clive Robinson • December 22, 2025 10:46 AM

@ Not Really…, ALL,

With regards,

“…at 39C3 this weekend. It will be recorded…”

That’s 27/28 Dec… When most people are all crashed out after Xmas/boxing day and suffering the fate of dry turkey&stale bread Sarnies that even good Mayo&Mustard can not make easy to swallow…

So people are either sleeping it off or trying to avoid by running/walking to the Pub to immerse the few remaining brain cells in basic preservative…

Either way the brain is at best on “stand by” with that little red LED to say there is minimal function, but it ain’t answering the door.

So just as well they are recording 😉

Clive Robinson • December 24, 2025 5:26 PM

@ Wayne,

With regards your “Driving Home For Christmas”[1] of,

“I freak out my European friends when I tell them I’m driving 5-600 miles to visit family or friends.”

Possibly because most European countries are mostly just not that big…

Over to the East of London, there is a tunnel for traffic to go “under the River Thames. It’s been quite a while since I had reason to go there, but back last century a friend Bob Smith and I were of to a windswept hill in Essex to do some “Microwave Contacts” on 10GHz to test out a new system we had built.

As we approached the “toll booths” Bob noted that a couple of weekends before he had friends over from Europe and how he pranked them. He and his girlfriend had got out their passports and put them on the dashboard and casually said to their European friends in the back that as they were going “North of the river” they would need to show there passports as well. Looks of shock apparently crossed the European friends faces as they had left them locked up back at the house…

Apparently when Bob’s girlfriend revealed it was “Bob having a joke” the young Norwegian lass siting behind him thumped him in the upper arm in revenge. In an apparently slightly less than playful way –as he still had the bruise– nearly causing an accident…

And yes looking at the toll booths I realised they did look like a European boarder crossing.

From what I’ve heard from some American friends that live up in a blue state just below Canada, they are only half joking when they say they are expecting “Papers” demanded just to get south into a red state the way things are going.

So you might want to consider getting your travel papers for your longer drives 😉

[1] A nice Xmas song from the 1986 by Chris Rea who sadly died just a couple of days ago, but the song goes on and I suspect will do for years to come,

https://www.youtube.com/watch?v=Jckb3dnS5fw

I was still “wearing the green” back in the late 80’s and had a lady friend up in Scotland, so I took the then still running “sleeper” train instead.

Clive Robinson • December 26, 2025 9:23 PM

@ JG5, ALL,

You note of the US economy and Current AI LLM & ML Systems,

“Maybe they will be able to get it up to 9% before the “AI” bubble bursts. The LLMs are a lot like gargling dogshit. Definitely will toughen up your gut biome against misinformation and disinformation.”

Somebody else has just likened using such systems as being like flipping back to Command Line Interfaced game ocf Zork or earlier “Multi User Dungeon” MUD Games,

‘PromptQuest’ is the worst game of 2025. You play it when trying to make chatbots work

“Everything you hated about text adventure games is now being sold as a productivity tool
“

https://www.theregister.com/2025/12/26/ai_is_like_adventure_games/

I must admit I had not thought about it that way but yes, the problem the author Simon Sharwood initially highlights is truthfully there especially,

“Adventure games were big in the 1980s, a time when computers were flaky and unpredictable, and AI was an imagined technology. Games that required obscure syntax were mostly tolerable and generally excused.

I’m less tolerant of AI making me learn its language.”

This is a commonly expressed opinion by the sweat-shop workers forced onto the “Hamster Wheel of Pain” that Microsoft AI offerings like “Cop-out” are. By their Senior –read old-fart– Manglement that want to impress shareholders with a real reduction in productivity and profit, but a very real and great uplift in “Soft bullshit”[1] and neo-techno-hype.

But the issue that is in effect a “Kiss of Death”(KoD) on the current AI LLM and ML systems as productivity tools,

“In other AI experiments, I have found that the same prompt produces different results on different days. One prompt I use to check I haven’t left any terrible typos in stories produces responses in a different format every time I use it. Microsoft has also, in its wisdom, decided to offer different versions of Copilot in Office and in its desktop app. Each produces different results from the same prompt and the same source material.“

For a “productivity tool” to be of any use, it has to be part of a “tool chain”. A primary requirement for such “tool chains” to work is that at each step along the chain,

“The tool output must be not just consistent, but more importantly ‘repeatable’ in output for each use with the same input”.

This is so “interface change format / filter scripts” used between the output of one tool and input to another tool can be,

“Both easily, and confidently written.”

If not, then a very high level of developer time will be consumed effectively uselessly in the production of such tool chain “interface scripts”.

Funny thing is, back in the early 1980’s we knew this about AI, and that is why this became oh so famous,

https://m.youtube.com/watch?v=MpmGXeAtWUw

[1] Yes “Soft Bullshit” is a very real “term of art in the knowledge domain” (and more palatable than what you suggest to gargle with 😉

See,

https://the-decoder.com/chatgpt-isnt-hallucinating-its-spreading-soft-bullshit/

Clive Robinson • December 27, 2025 4:51 PM

@ JG5, ALL,

It will soon be “New Year” and it looks like the Current AI LLM and ML System “buzz” is more like a fizzle or hiss.

It’s become clear that OpenAI seniors and others have been playing the financial equivalent of the “shell game”. By passing debt round and round to form spirals that look like impressive deals rather than unsustainable debt.

This is especially true of those White Elephant Data Center deals, that even a back of a napkin calculation show can never become free of debt, or more importantly afford what is needed to get the power and water to run them.

Even Nvidia is not going to make returns on them as their desperation to find new markets comes through both louder and clearer.

A look at what is going on suggests that money Nvidia is getting in from the US is being immediately given back to the companies in various ways so that they can appear to be a viable market for Nvidia Product.

All of which means the “Venture Capitalists”(VCs) now need a new “fleece the chump investors” vehicle…

As I’ve mentioned I’ve had involvement with AI and Robotics off and on since the early 1980’s. Which is why I keep my eye open for more main stream media articles in the subjects to see what the VC’s may latch onto…

So seeing,

https://www.theregister.com/2025/12/25/humanoid_robots_investment_surge/

Alerts my 6th sense as to where the serious chump money may well get pushed towards… Possibly as early as Q1/2 2026.

Clive Robinson • December 28, 2025 4:58 PM

Part 1,

@ lurker, ALL,

More on AI ‘Shell Game’ and Geo-Politics.

This article,

https://ossa-ma.github.io/blog/groq

Explains more about what the Current AI LLM & ML Systems “shell-game” is all about with a concrete example that happened just a few days ago.

Yes it’s long and Yes it’s slow to start, and No I’m not going to give a synopsis as ‘Yes it’s information dense’, and it would like as not hit some limit somewhere in the automod.

And importantly ‘Yes it leads into Geo-politics’ and avoidance of legislation and regulation controls.

Which is necessary background reading.

Which leads back to the article you link to which is actually as much about geo-politics as it is about technology.

It first makes the same point I’ve been making about AI needing,

“Agency over imaging and haptic sensor input”

With,

“Yet behind the show lay a paradox: humanoid robots were running fast but still could not “see.” Most lacked the autonomy, perception, and decision-making that would make them genuinely useful.”

That is the AI needs sensors that are local to it that it has full agency over, so the system can properly “understand the environment”[1] in ways we can not understand in our selves (because the testing required in living creatures would be ethically and morally unacceptable).

Hence the article noting,

“The competition revealed less about the future of artificial intelligence (AI) than about the pressures shaping how China – and the world – presents technological progress.”

Which indicates the “geo-political” aspect before leaping into the “sociopolitical and anthropological” aspects.

Clive Robinson • December 28, 2025 5:04 PM

Part 3,

[1] Most do not realise that giving any AI system so far designed “just images” and “just sensor readings” to train on will provide just statistics on what is given. It can not provide what we call “knowledge of the environment” because it’s not “closed loop”.

That is there is no mechanism by which the AI system can “test the environment” to produce statistics on the environment not just the sensors.

[2] In the UK “fake training” is one way we ship in people from what we see as second world nations and use them for “on the job training”… Which in reality is getting people in, using them whilst they are young and healthy then booting them out without pension or healthcare back into their nations of origin. Like “internships” it’s a despicable way to behave.