Schneier on Security

Clive Robinson • December 4, 2020 4:59 PM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter,

New evidence that current “social distancing” rules of 2m/6ft are woefully inadiquate[1],

https://zeynep.substack.com/p/small-data-big-implications

[1] Not exactly unexpected news to those who read the paper on dropplet movment for coughs and sneezing which gave 8m/26.25ft as the edge of the range.

Clive Robinson • December 5, 2020 8:12 PM

@ Cassandra,

… which puts a hydrophobic layer on the surface

Now that’s all I realy need “Rabid Glasses” 😉

Apparently even diluted egg yolk will act as a surficant (yes you can wash dishes with it provided the water is at most warm, I tried it years ago for demoing to kids to get them interested in science).

But it’s the “stinging eyes” problem that worries me, I walk on crutches these days thus I’m not “hands free” in any manner so “misting up” on the glasses or “tearing up” in the eyes are not something I want happening when I’m in the middle of crossing a main road.

My nearest supermarket is not far away and each time I’ve gone there I’ve had 100% “white-out” and have to stand there looking like an idiot waiting for things to clear.

But each time I’ve visited since they redid the inside taking out shelves to get more “COVID Space” they have been out of “baby stuff” and appart from over priced btand name shampoo the only stuff they’ve had has been various “family” and anti-dandruff/greasy/dry/flakey scalp/hair.

So whilst I was gently joking about not being able to see it on the shelf, they’ve actually not had any on the shelf to see whited-out glasses or not.

I’m begining to think that,

1, Baby/childrens toiletries.
2, Vitamin/mineral tablets.

Have all become the new toilet paper to panic buy. Mind you it must be about nine months since the first UK lockdown, so the baby stuff could be actual shortages…

Clive Robinson • December 5, 2020 8:56 PM

@ lurker,

There might be something to be said for New Zealand’s graduated levels of lockdown.

I think there is quite a bit to be said about New Zeland and how it has responded to COVID.

Which has been backed up in Australia where you compare thr successes and failures and why they happened.

New Zealand is doing a lot better than many firstworld states and nations you only have to compare and contrast with Europe and the US to see that.

Clive Robinson • December 6, 2020 5:21 AM

@ FA,

Most just spread some saliva on the inside, then rinse the mask with water and keep it horizontal with some water inside until they actually put it on. Works quite well.

Yes it does because it forms a “closed environment” with the face and the temprature of the “glass” stays well down thus the intetnal surface remains out of the critical ranges in it’s closed environment and the outer surface is covered in water thus droplets can not form by condensation.

Sadly spectacles are not sealed to the face and the temprature variation changes wildly through the critical ranges, so when you come in from the cold to a warm environment the outside of the glasses mist up due to the high RH and temprature. With medical paper and cloth face masks, the path of least resistance is up around the sides of the nose and out the top just under the corner of the eyes something many divers masks prevent by their design. Some “builders masks” deal with this via a strip of soft aluminium in the top of the mask so you can make it tight fitting to your nose and then put large eye protection masks over the top having your glasses inside in a more stable non fogging/ misting environment. This works, but people look at you as though you have just crawled out from the deep or you are some how making fools of them or yourself. The latter is not much of an issue, but the former can be.

Any way that path of least resistance “jets up” warm very moist air over the inner surface of your glasses which if it was a more closed environment would not cause misting.

Thus what I want if possible is a way to attract the minimum of attention so I blend in and don’t get some Oik thinking in their pea brain I’m taking the p155 out of them and for them to start talking with their fists and screaming/spitting in my face… As has unfortunatly been witnessed in quite a few places world wide during this pandemic.

If it was anything safely alowed, I would have a full face sealed light weight divers mask. The air comming in through a 3ltr capacity UV-C lit light cell with baffels to spread the incoming air in the cell to get it all UV exposed for around 30sec. The air outlet then being over the head and released around the back of the collar with bateries on a belt in the small of the back.

It would be way more effective than an N95 unassisted respiration mask at protecting me and probably as good if not better than an assisted NBC respirator for viable viral and other live biological pathogens.

I drew up some designs for a friend and did the calculations and it’s quite a viable low cost design. You could build it and sell it at around 100USD. The most dificult part would be ensuring battery safety. After all you do not want a lithium fire strapped to the small of your back and the fumes getting pumped directly into your face. My friend already manufactured equipment in China and similar so looked on it as viable for supplying hospital staff (and with a minor addition of a second light cell for use by infected patients to cut the level of viable virus they exhale). The problem was “approvals” they would take about a year… We were still discussing the viability and how to move forward early this year when he had a fatal accident.

Fun fact, did you know that the plastic they use for making 1-3ltr fizzy drinks bottles out of is fairly transparent to UV light in the spectrum that kills bacteria and renders viruses unviable?

(if you are curious “air lasers” generate UV in these ranges and you can find information on what it will go through without causing issues so you can use liquid fluorescents that act like brightners in laundry soap to see the beam).

Clive Robinson • December 6, 2020 7:35 AM

@ Peter,

For car windows I have used shaving cream.

It’s interesting in the earlier video how well the shaving cream worked but the baby shampoo did not. There is a possability from his soapy residue comment he put on too much or dod not buff it of sufficiently.

As for if shaving cream stings or not if resedue gets in your eye it’s not an experiment I directly intend to do, but as the stuff gets near peoples eyes when they are shaving anyway I suspect it’s not likely to do damage after all “a smooth shave that makes you blind” is not a good marketing line…

The advantage is my local supermarket did have shaving cream when I was last in there…

As for toothpast I’m aware that it contains “grit” and I’m also aware of what feels realy smooth to the fingers can eat porthole glass (walking round a table for six months using jewellers rouge to make a telescope lens).

So as my glasses lenses are UV sensitive, I’ll give the toothpast a miss for now.

Re fogging spectacles (could be an new expletive :-))

Yes… That did not occure to me till I actually said it out loud, one to add to the list of “non expleative, expleatives” for the next time I need it 😉

Clive Robinson • December 6, 2020 2:26 PM

@ Anders,

configure the web server so that older cipher
suites are allowed (like Google has done).

Google had no choice due to their own venal behaviour to Android phone users and users of Chrome…

Put simply every time you try to go to a web site it forces the use of their DNS server and Google Search if the website does not respond. Google decided you had to have not just javascript but cookies on as well so they could track your web surfing habits. Google unsurprisingly blaim the EU for their venal behaviour claiming all sorts of nonsense about data collection and how “impossible” it is to turn off in Chrome (which is untrue, but for those with long memories MS tried similar claims with IE in court and got not just fined heavily but lambasted in the press).

Clive Robinson • December 7, 2020 3:07 AM

@ SpaceLifeForm,

If you care about Licensing and/or nmap.

Sadly this was bound to happen.

In essence various Closed Source Corporates, want to use nmap and charge for it. What is sometimes called “free-loading for profit”.

So to protect their profit they put nmap in a tiny little utility that just about follows the “legal wording” of the licence rather than the spirit of the licence. They then make this utility sort of open source but then use nmap’s product in their closed proprietary and presumably profitable products…

In other words doing exactly what they would be up in arms over and reaching for a battalion of over priced lawyers if you did the same to their software or data files.

The problem is to word a licence to capture the spirit of what FOSS developers want to do would make the licence one of “denial” stuffed full of “exceptions”. As such it would be unworkable.

It’s not the first and it certainly will not be the last time this “free-loading” problem arises.

Clive Robinson • December 7, 2020 12:43 PM

@ Shaun,

That ship has sailed.

Whilst that is probably true, the Uni of Washington models make a couple of dire predictions.

Firstly a half million dead by end of first quater next year.

Secondly even if vaccination occures to plan that will only save 9000 people at most.

Thirdly if 95% of the population wore masks that would save over 60,000 lives.

More interesting is that those 60,000 cross a tipping point between most hospitals just coping and significantly failing, in the latter case they can not calculate how many it will change the numbers by, because it’s very sensitive to time and other unpredictable factors such as staff and as yet not fully known seasonal maladies.

But based on other information from earlier waves you would expect upto five times the number of deaths once a hospital is saturated, many not due to COVID but accidents, heart attacks etc etc.

Based on other figures some think that by the time COVID has run it’s course in the US upto 1.5% more of the population will be dead above the expected five year average figures, either from COVID or from it’s spill over into other parts of the healthcare system.

A not well publicised fact was that 1/5th of patient’s in hospital with COVID had contracted it in hospital. Which suggests getting COVID patients into seperate fascillities with entirely seperate staff from the most senior to the most junior could save 20-30% of those expected fatalities.

I gave up looking into the subject because around 1/3rd of my family are “at the coal face” working in either hospitals or long care nursing fascilities and physical rehab etc. All of them either have come into contact with COVID or are in contact with it every day, and all expect to be incontact before the spring.

Some think they might have had it others do not know, in the early days even flu got assumed was COVID and staff sent home. For political reasons staff were not being tested at the time unless admited with sever respiritory distress. So they have no idea if they are immune or not. Many do not want the mRNA vaccine, the technology is realy untested for longterm effects and no matter what people say the longterm risks are most definately unknown.

As for their mental health, what can you say, it’s like “Battle Fatigue” which gives rise to PTSD and chronic depression and all that leads to. In some it is bringing out manic cycles followed by deep depression. They do their jobs but their eneny is silent and unseen, you cannot scream at it or charge it like a berserker, no matter how you fight it as a primal human it cares not and just swirls around entirely unaffected, by anger or rage.

It’s science not physical action that will render it unviable then hopefully extinct but that is three to five years away, assuming no animal resevoirs become established.

I’m normally quite detached about the mechanics of science and it’s models. This is too close to home to personal and I’m also at high risk for a multitude of reasons.

Whilst I can deal with solitude and what others call loneliness quite well it’s a lot lot tougher when those you love are at risk and you can not go to them…

Bad enough for many, but how much worse for those who’s job it is 12hours a day and day after day without break. Every day knowing they could be bringing it into their homes and their family.

We know in the UK what will make or break our ability to deal with COVID is frontline caring staff and those that support them. Technology is not realy going to do very much, and science can be madeningly slow

Combat soldiers are aware of how the next action may be there last hence their manic behaviour when away from the line. But soldiers do get rotated out for R&R, not so for caring staff, many have to work long hours on low pay just to put food on the table and keep a roof over their and their families heads with their partners either laid off or not alowed to work.

The stress of that and knowing every day could be the day you catch your bullet, unseen unfelt untill you fall. You see it happen to others you know it’s real with a sort of visceral horror that stays in the back of the mind haunting every hour, especially those you need to rest but can not as you see the shadows like ghosts.

How many frontline staff will survive this pandemic free from mental illness is unknown but honestly it can not be many. How many will leave the proffession taking their experience with them? Dr’s and nurses are bad insurance risks at the best of times, they have something like twice the number of motoring accidents of other professions, and smoking and drinking claim more than you would expect and worse suicide is higher than normal. Unsociable hours destroy relationships even if lucky enough to have one outside of the profession.

This is what people do not see normally behind that profesional face and kind smile.

In the UK for years the politicians have ground down on healthcare staff whilst giving themselves pay rises and bonuses at every opportunity. Year by year the healthcare staff however get poorer in real terms and politicians talk about taking all their rights away if they try to assert any individual or collective rights.

The staff know that todays fair words from politicians are nothing but empty words, likewise those that have the misfortune to come under private healthcare providers know exactly what is comming down the line from shareholders and senior managment.

Sooner rather than later something is going to break and the whole nation will be the poorer for it. It’s been decades comming, but this pandemic may well be that slight straw that brings the profession down on it’s knees broken and unfixable for many years.

I can fully understand how they feel and the desperate urge to run in the face of an implacable enemy that has no thought no morals can not be reasoned with and will claim your life without any impediment.

How many of us could face the same day after day, week after week, month after month, and now year after year, knowing that your best is not good enough and that saving others is dependent on researchers and scientists who likewise are too few and struggling.

There is a case that happened not far from where I live, a healthcare worker snapped in a shop. Apparently when an unmasked inconsiderate individual basically pushed and jostled them. Apparently it did not end well. If charges will be pressed or not I’ve no idea, it’s been kept out of all but the local newspaper, which hopefully means not.

The end of tethers have been not just reached they have been drawn tighter than bow strings. You realy can only expect them to snap, lash back or both.

As you note easing the tension is one of the more important but less realised things that has to be done if people are to survive the next quater and a bit. And as we have no idea who will be unfortunate, it’s best to assume we are all on the line and act appropriately.

Clive Robinson • December 8, 2020 2:02 AM

@ Anders,

Why on earth force to use https only approach here?

You are both right and wrong, it’s a context or point of view issue not a technical one.

You may remember I point out that there is an “Efficiency -v- Security” seesaw where the more you have of one the less you have of the other for any given point.

Well this is one of those occasions.

From an efficiency point of view you are correct “the minimum to get the job done” gives a mininal barrier to entry thus potentially the maximum number of users.

From a security point of view using a superset of the newere thus assumed more secure protocols ensures all users privacy of message contents. Which can limit the number of users.

Thus at first your point appears to give the maximum number of users.

However you have to consider the technology point issue. You and I like to use older equipment as do one or two others. Our reasons are probably different or more varied but we are in effect very much the minority. So much so we are considered “quaint” by others unless they are both aware of and understand our reasoning (though they may not agree with it from their own view point).

But you also have to consider what the market does. The lifetime as far as “tax cost write off” is concerned is about eighteen months. That is the tax man expects that after just a year and a half a computer purchased for a given task will for a variety of reasons nolonger be upto doing that task thus may need to be replaced etc.

The hardware market tries to maintain a “Doubling in power” –what ever that means– every 18months and give a glib answer of “Moores Law” when asked.

This alowes the software industry to double up on bloatware every 18months.

Thus by far the majority of people have to “buy-in” to this 18month generation/life cycle nonsense in some way. So they buy as high end as they can afford knowing that they might get two or possibly three generation times or three to five years before the software they have to have compatability with to do their job will not run or not run sufficiently well on their hardware[1].

So by far the majority of users or potential users of this web site will have hardware, OS’s and applications capable of supporting secure network communications using the more modern protocols.

Thus from a security perspective, forcing people to have the modern protocols is doing them a service to increase their privacy by default.

Also and rather more importantly from the “bigger picture” perspective it makes the use of high levels of encryption so common that it is de facto usage thus de jur attacks against it can not easily arise[3].

Further it also limits the “stand out” effect that can make you a “Person of Interest”. You might also call it the “TOR Effect” where the assumption is if you use it, you have something to hide, therefore you must be doing something illegal, thus there is probable cause to investigate you, and you will be made a criminal[4] and be paraded in public as such as a warning to others…

Thus by making strong security de facto you actually protect those such as activists and journalists who upset those with the power de jur and will wield it for the joy of having power over others rather than any real need (William Barr being a prime example of the type).

So yes it’s a trade off between “Efficiency and Security” and much though I would like both in as larger measures as possible, the world doew not work that way.

[1] Hence the idea behind Software as a Service (Saas) runing applications “in the cloud” as an extension to the “thin client” idea[2] which in turn derived from “Old Iron and Terminals” of the early days of business and accademic computer use (all of which are hoplessly insecure in various ways).

[2] You are by the sound of it trying to run a derevation of a “Thin client” solution but with local program execution rather than central server based with local UI presentation. This almost certainly is a Microsoft “Windows” perspective/legacy issue rather than a *nix “X-Windows” perspective issue. One that Citrix amongst others has tried to address and you can sort of do the same with VNC, NFS, TFTP, bootp, NetROM etc with some work.

[3] Hence the battle has moved on from just “crypto” to “end to end crypto” which means we should force E2E-Crypto on users to make it the de facto mode before the authorities make it illegal de jure. But the battle will not stop with “E2E-Crypto” the authorities previously tried the “golden key” backdoor approach, which got shot at and effectively baddly winged but they will try it again at some point. The current trick appears to be trying to hide behind faux §230 arguments. By the trick of setting up a committee to decide if you as a service providing organidation are “playing by the rules” effectively giving the committee unlimited power of rule maker, judge, jury and executioner… Basically “the law of the gun” but with nuclear tipped field artillery to “shoot sheep” as a public display of “justice being done” but in reality being a “willy waving” excercise that shows not only are they in reality impotent, but actually and more importantly cuckolds kow-towing to others whims.

[4] It’s a process known as “rights stripping” and it is much beloved by those working to pervert the US Justice system. Put simplyvthe deal is you are guilty in their eyes and you will submit to their view point. If you don’t they will destroy your reputation and bankrupt you to the point you can not continue to fight to prove your innocence. Like all “Kangaroo Court” and “show trial” systems the purpose is not “for justice to be done” but only for “justice to be seen to be done” or serve some other political purpose, and that “Authority is mighty” and is also “always right” thus you must bow down or be destroyed…

Clive Robinson • December 8, 2020 5:15 AM

@ Winter,

However, I fail to see the connection between EU fraud and a Florida raid over COVID-19 numbers.

It was the abuse of political power via the heavy handed “home raid” to in effect provoke “terror” in not just the ex-employee but other people.

Look up what the EU’s OLAF anti Fraud unit had done to the German journalist Martin Tillack,

http://www.theeuroprobe.org/2012-033-martin-tillack/

And the European Commission’s former chief accountant Spaniard Marta Andreasen,

https://www.accountancyage.com/2003/11/27/profile-marta-andreasen-personality-of-the-year/

You will note the name of Neil Kinnock in there, he was a UK politition from Wales and has tried to set up a “political dynasty” there by changing the voting system[1]. Let’s just say he has some of Trump’s less desirable features and then some more of his own. I know from direct experience his autobiography is a compleat load… He used to live close to me and what he says in the book is very far from the reality of the house, lifestyle and education his children were getting as was much else that others I knew from Wales who also had the misfortune to live close to Kinnock and his family confirmed.

Such was Kinnock’s infamy he became “the but of a joke” in the film of Hitchhikers Guide to the Galaxy, the puppeters styled a Vogon Puppet after him. In the film there is a build up with a long “run down” on the Vogons and their least desirable characteristics thus why “you should endevor to avoid them at all costs” before presenting a bumbling low whitted low status vogon bureaucrat with a face and hair that so resembles Neil Kinnock it is hard not to make the mental connection almost instantly…

Any way for other background on what OLAF got upto in the way of intimidating people,

https://www.telegraph.co.uk/news/1917315/Calls-for-sacking-after-EU-anti-fraud-office-misled-courts.html

[1] Neil Kinnock cooked up a plan with Tony Blair, then UK PM to trial “proportional representation”(PR) in Wales. Whilst this might sound a good idea you have to understand it was done to create a political dynasty. Thus you have to look a little deeper.

The downside of their PR scheme is that you do not vote for a candidate but a party that then selects the candidates as it sees fit… Thus Kinnock fixed things so that he would be the first selected, ensuring that he could effectively not be got rid of, then puting others of his family next etc…

Clive Robinson • December 8, 2020 5:59 PM

@ SpaceLifeForm, Anders,

FireEye got phished by FancyBear?

The funny thing is FireEye in their report on “FancyBear” that they call “APT28″[1] they noted that FancyBear had a habit of using sites they had attacked as network proxies for other attacks…

So don’t necessarily believe every thing you read from their site 😉 (listen for manic laughter “off stage left”).

As you may remember I had a fairly low opinion of Mandiant before FireEye purchased them. It looks like not much has improved since…

As the old joke has it,

“Sometimes when you pay for what you get, you get what you pay for…”

Or the more modern “When you pay s41t, you get…”.

I wonder if they like dogfood?

@ Anders,

my main computer died and this is only temporary solution. so soon no RW

I hope you get things sorted soon hopefully without great expense. The loss of machines can be a major “Embuggerance”.

[1] hxxps://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf

Clive Robinson • December 9, 2020 1:31 AM

@ SpaceLifeForm,

They are saying this is a new attack. My hunch is microcode and UEFI related.

They qualify it a bit, as a new attack to the them and those they’ve talked to. Which is actually important to note.

Apt28 has been known to use upto six “zero day” attacks in very short order, suggesting to some that not only did they had them to burn, but had state level funding to pay for the research[1].

The simple fact is the reality of vulnerabilities is such, that not only are they rather more numerous than many think, they are at all levels of the computing stack including “Layer 9 – Managment” and potentially above (and if likes of Bill Barr have there way then “Layer 12 – Legislative”).

The fact we rarely see vulnarabilities down in the “below CPU ISA level” is more a reflection on the perspective of those who are looking for vulnerabilities than the distribution of the vulnerabilities. As seen by the fact that known issues in CPU hardware design remained just “uninvestigated” for thirty years. When someone finally looked they became that “Xmas Present that never stops giving”. Even though earlier indistry known issues in lower layer hardware DRAM gave us RowHammer, these vulnerability finds, almost always appear to be “trail breaker led”. That is one person “breaks the trail” in what was formally virgin but not unknown territory, then others with the required skill sets in academia and the like come running down the trail widening it into a highway in a lust to grasp their little piece of fame that will atleast double their basic market value.

For years now I’ve been warning about “Efficiency -v- Security” which is where nearly all vulnarabilities arise from, and that the only sensible mitigation is propper issolation of systems via energy gapping and the like. Neither view point is popular with various parts of the industry, but that does not make them any the less true or viable as security mechanisms.

Quite a few years ago in a conversation with @Nick P on this blog, I indicated I did not think that it was possible to secure a laptop or similar such that it was secure enough to cross a national border (of a nation with a competent SigInt agency or simillar). It’s taken a few years to become a more widely held view as people get a little older and wiser. Hopefully they will start to realise the validity of the two points I’ve mentioned.

But a prediction, the Internet does not realy offer mankind new markets, just new faces for existing markets. That is shopping and crime make money, but advertising and newspapers that are information based have not earnt money thus underhanded effectively criminal tactics of stealing peoples privacy has been the model that has made early entrants wealthy. But they are desperately trying to diversify as rapidly as possible into other areas as they know that, not only are the other fishes growing rapidly, but the pond is shrinking and their effective cartel is being attacked from all directions. Not least of which being legislation with teeth, and worse for them, they know their response to the legislation is the equivalent of newspapers trying to profit from “PayWalls” is not going to work in the long run. The reason is the legislation has in effect done the information equivalent of putting in a “Distance Cost Metric” that economists tend to ignore that actually makes competative markets work.

Thus I expect other nations to start putting in legislation that is effrctively a “Distance Cost Metric” so that home markets will have a chance to compete. This will force even the likes of Microsoft to loose their effective monopoly.

But my prediction is that the Web as we know it has passed a tipping point into decay by rot. Browsers have tried to take over the duties of OS’s and have mainly failed bringing all sorts of security vulnerability classes back from the grave where we thought were long dead and buried by thoughtful OS design. Similar issues are going to occur with “user space IO” and the like in servers. Yes these changes away from the OS offer speed advantages, but the real issue is it’s a drive “for efficiency over security” and we know where that leads. By the time the required security has been put back the advantages of user space IO and similar OS bypassing technology in browsers will be small and have lots of managment issues (OS’s centralize security measure control making it managable, user space or application level security does the opposit).

In effect the idea of centralise security where a few experts can give it to all developers no matter how bad, will come back and much that will be done on the web due to what are lax security practices currently will have to be foresaken or moved back into the OS somehow.

As @Dave noted on another thread,

…it’s necessary to take all the geeks outside and shoot them…

Such dangerous geeks are to be found in web and smart device app development in the main curently. But they will “if hung correctly” mature with age. The question is though as they could be viewed as young wines “Will they develop depth and charecter as they mature or just turn into vinegar?”.

[1] But paying for research is not the Russian way especially when it can be had nearly for free… Thus they could have been taken from somebody elses stock pile[2], or those doing research were given something that they could not get but comes almost for free to the Government such as immunity from prosecution and extradition (which we know goes on for others carrying out activities abroad for the Russian Government).

[2] Ask yourself who alledgedly has the largest stockpile of “cyber-weapons”, and also has had “contractors” walk out the door with secrets from their computers atleast twice that we publically know? It might be why they are keeping very quiet, and why if there was a competent hand on the tiller of the ship of state rather searching questions would be asked of the agency…

Clive Robinson • December 10, 2020 1:07 AM

@ SpaceLifeForm, Anders,

If you can detect a bit-flipping router, can one use it for exploit before others detect the problem?

That depends on which bits it flips or you can make it flip and what and how you are going to attack.

In a properly defined communications protocol traffic should be protected at each layer by being encoded and checked with, parity / checksum / ECC / hash etc. Also due to avalanche criteria block based asymmetric encryption should fail hard (stream ciphers generally are transparant to bit-flipping which is why they are not used as much as they might otherwise be).

That is in the digital layers of a network “bit flipping” should be detected thus corrected or dropped. Any NetAdmin should be keeping a running check on communications errors in the lower stack levels and a SysAdmin likewise in the upper stack levels. Like bad blocks on hard drives bit-flips are usually a warning that hardware is starting to fail.

But you can only measure what you “see” or “look to see”…

One of the things that does happen when data communications is thought to be “reliable” is that “looking and checking” first get seen as an “overhead” then as a “pointless overhead” then “just a nuisance to code that steals performance”. Especially when you make the mistake of thinking “this is actually redundant because of other stack layers checking”…

Your eye might have seen a comment aluding to this issue in the tweet thread.

So the answer is a bit more complicated. For instance if you know there is a bug in someones network code, you might not need to flip specific bits just get the number of errors up so a counter or some such overflows badly and crashes a bit of kit, like a network sniffer on a network intrusion or monitoring device.

Especially if the attacker has two routes to a target, one through the bit-flipper error generator and one not.

Sorry to sound a little wooly on the answer but, you realy have to know not just what an attackers intent is, but also the failings of all the kit in the path to understand if random bit-flips may be of use to an attacker or not.

Clive Robinson • December 10, 2020 8:16 AM

@ ALL,

The title says it all,

FTC Sues Facebook for Illegal Monopolization

No doubt that will rise a few smiles and even Yee Harrs around the place,

https://www.ftc.gov/news-events/press-releases/2020/12/ftc-sues-facebook-illegal-monopolization

Clive Robinson • December 10, 2020 8:53 AM

@ Bruce, Moderator,

You might have heard that YouTube has changed it’s rules,

https://blog.youtube/news-and-events/supporting-the-2020-us-election

Basically as far as YouTube is concerned the US 2020 election is “over” and the results called. Therefore it is removing any content that is now posted alleging any kind of election tampering / fraud / software glitches / etc, etc as soom as they become aware of them.

Hopefully now that YouTube have “closed the book” on 2020 election as history, others will now do the same abd a little normality will return.

Clive Robinson • December 10, 2020 11:43 AM

@ MarkH,

And so it goes …

They say “Reality bites” so I can see why some might want to dodge the fangs of the beast 😉

@ Winter,

I am pretty sure a certain public figure will get a book deal with “I won” and start his own TV channel etc.

Probably not whilstvthe money is still rolling in to fill his “personal” polotical fund… Somebody mentiond it’s likely north of 200million by now…

But yeah at some point he is going to squeeze his ego back on the box… But in all honesty TV is actually dying especialy with the “Hip-n-Trendy” set who slurp up boxed sets and the like faster than a dehydrated Elephant at a watering hole… I guess though his main “voter base” are still cable TV types if they have the cash, broadcast if not. Fast Internet has probably passed them by as “economically unviable” thanks to Agit Pai at the FCC.

Clive Robinson • December 10, 2020 10:50 PM

@ ResearcherZero,

Ionizing radiation can travel unseen and pass through these materials.

Actually ionizing radiation is very high frequency EM radiation. Depending on how you view it it starts at the upper end of the visable light spectrum and goes up in frrquency through ultravilot onwards through X-Rays etc.

The thing is that although they can be focused thus turned into a beam it becomes increasingly dificult with increasing frequency.

Which does not tie in well with,

If you ever see someone pointing a small hand held parabolic dish towards you with what appears to be a UHF antenna protruding from the center, you begin to feel queasy, warm, and your body hair begins standing on end.

If it was generating ionizing radiation then it would not be focused by such a structure. And if you think about it further if it could “pass through these materials” then the operator would no be in any way protected by the dish. Worse for them the beam energy drops of in radiant systems by 1/(r^2) thus as they would be atleast ten times closer than the target they would be geting R^2 the dose or a hundred or more times the damage the target is getting.

Which I suspect means that people without a technical background are conflating two or more entirely different things.

Which is kind of confirmed with,

For more than a quarter of a century, from 1953 to late 1979, the Soviets bombarded the US embassy in Moscow with microwave radiation that resulted in numerous American officials being found with abnormal white cell counts, causing severe health problems.

Microwave radiation can be easily focused into beams, because it’s of a way lower frequency than ionizing radiation. It causes damage by “I^2 R heating” not destroying chemical bonds or ripping atoms apart.

Thus I suspect what looked like a dish with a TV antenna in it was one of a number of “backfire antennas” used in the high UHF and low microwave frequences.

Clive Robinson • December 10, 2020 11:39 PM

@ SpaceLifeForm,

With regards,

”Mastercard
has just informed me that they are terminating…”

This is actually very bad news.

In effect it’s censorship by illegal means and once it is alowed to start it will just get worse and worse.

The reason they get away with this nonsense is people do not think beyond what they are being spoon fed. You can see it in some of the comments on that twitter thread.

People have to understand the difference between “infrastructure services and technology” and “discretionary services and technnology”

When you run an “infrastructure service” you have to accept that you are a “Common carrier” that is you supply the service equitably to all without fear or favour. The system of transfering payments is without doubt a “common carrier” “infrastructure service” because denying it when you follow the logic down is the same as taking away somebodies right to exist in society.

The fact this is a very dangerous move to individuals and society can be seen by the use of “Think of the children” emotive manipulation to blind people to the real issue.

If people want politicians to make particular goods and services unavailable then there is a correct legislative proceadure to follow, and that is the route that should be taken.