Posts by Brian Miller

Everyone's deploying AI, but no one's securing it – what could go wrong?

Security by Hallucination

Are the controls for the AI, or are the controls being fiddled with by the AI? Deploying an AI for securing your network is like drinking the energy drink of champions, Jack Daniels and LSD!

There is a big difference between asking an AI a question, and blindly running programs generated by an AI and letting it "tweak" your network! You will never know how the AI was trained, what was the testing, and what effective warranty there is for its performance in a critical system. As long as the AI software hallucinates at any time, then what it produces has to be suspect.

Raspberry Pi M.2 HAT+ here at last with a $12 price tag

Re: But still only 8 GiB RAM maximum!

Gigabytes??

"You lucky, lucky bastard. Proper little jailer's Moore's law pet, aren't we? You must have slipped him a few shekels, eh? Ohh! What wouldn't I give to be spat at in the face have "only" 8Gb! I sometimes hang awake at night dreaming of being spat at in the face having gigabytes."

Japan may need 50% more electricity for hungry, hungry AI and chip fabs

The Nuclear Option?

Gee golly whiz, it looks like Japan needs nuclear power plants. Oh, wait, they have the same problems as the rest of the world: bad design and operation. Uh, burn wood and coal?

Bon Jovi, Billy Eilish, other musicians implore AI devs to think of humanity

Professional photography was severely hit when technology allowed rank amateurs to get good enough results.

What, wet collodion plate versus roll film? Rank amateurs still produce amateur results. It's not about the equipment, it's about setting up the scene, or recognizing the great scene. It takes a person with the brains and experience to produce the results.

The technology of photography was good enough for amateurs when roll film was developed. The Eastman Kodak camera went on sale in 1888, and people sent in the whole camera back to Kodak for processing. (And the Eastman company botched or even lost a good portion of those!) So the most basic amateur photography has been around for 136 years. And we still have portrait studios, various pro photographers, and news photographers earning a living. When digital really came in, it was the people in the middle who suffered the most, the ones who processed film and made prints, or did various professional process and layout work. Then when cell phones became good enough, it was the digital SLR that suffered.

Life changes. Personally, I still like using 8x10.

Re: The pot calling the kettle black

There is still a thing called "radio." If the AI "listens" to the radio, the station has paid the money for said privilege of broadcasting the music. Thus, there is fair use of the source. These days, any publicly-available "broadcast" source, such as Spotify, should also count.

If the artists are actually all about copyright law, then it is up to them to show that the source material was not paid for by the researchers. The purchase price of the requisite albums pales to the millions of dollars paid to the companies like Amazon for cloud rental. Just ask Stability AI's Emad Mostaque about that bill.

What the artists are really afraid of is that AI will produce music that is on par with theirs, and then they will have to up their game. Really, better music and movie plots can't be a bad thing.

X's Grok AI is great – if you want to know how to hot wire a car, make drugs, or worse

Re: Can I see it?

From reading the paper, it seems that any instruction suggestion the AI makes is a red flag against the AI. Really, how many decades has the Anarchist's Cookbook been out there, along with all of the garbage TV and movie scripts with exactly the same instructions the AI is regurgitating? "To make a pipe bomb, start with a pipe..."

Since AIs hallucinate so badly, shouldn't it give instructions like, "To make a pipe bomb, ceci n'est pas une pipe. Fill the pipe with compressed rainbow unicorn farts, tamping down firmly. Place the pipe at the building's soft and supple foundations. Inhale deeply, and blow the building until it smiles grandly. Follow the red balloon."

Ransomware can mean life or death at hospitals. DEF CON hackers to the rescue?

Re: Another solution...

Yeah, you can wish for that, but somebody has to go out there and do the deed. A lot of them are very canny about covering their tracks, and as long as a local nation-state isn't after them, they're fine. Some countries don't have laws covering what they do, so the perps have to be lured to a country where they can be arrested. That tactic has been done, so the survivors are a bit wiser.

That home router botnet the Feds took down? Moscow's probably going to try again

Re: strategic firewall rules on WAN-side interfaces

Yeah, the "strategic rule" is very simple: drop all. Don't turn on the external web interface, don't allow anything through that provides a port to the outside.

Seriously, when is the last time that Bob and Doug McKenzie (or Bevis and Butthead) wrote any firewall rules? Plug it in, and the lights blink. Go surf. That's it. I had a landlord who subscribed to a cable ISP, and I had to walk him through the process of plugging things in. Like not plugging the telephone into the RJ45 jack. Yeah, just because they are both square doesn't mean they do the same thing. I even had to change his browser home page so he would "be connected to the Internet." (My favorite cringe quote: "Does it have to be on to work?")

We shouldn't expect that people will update their firmware. Honestly, the vast majority don't know what "firmware" is. "Turn it off and back on" is all that we can hope for.

Microsoft seeks Rust developers to rewrite core C# code

Re: Rockstar

The move is always to attract developers and milk them dry. I have met very few developers there with real talent. The last time I worked there, I was chewed out over code I didn't write, and then told to "fix" exception handling in 50+ files in three days or be fired. Fixed them in two because I know regular expressions, and I can type.

I don't believe that Microsoft hires based on actual talent.

Wait, security courses aren't a requirement to graduate with a computer science degree?

Security is common sense, but both are lacking

Computer science is not the same as computing or IT. Expecting a computer science graduate to have taken cybersecurity courses is like expecting a maths graduate to have taken book-keeping courses.

Um, actually, it's more like architecture, and skipping over putting locks on the doors and windows. Really.

There are a lot of ways to ensure that a system has some reasonable bit of security. The problem comes from people in power who don't want to put any security on anything, and then have a funny look on their face when somebody pwns their network. And of course it's just not their fault for nixing all of the basics.

"I went to Blackhat and all I got was this stupid t-shirt, and your firewall, routers, switches, servers, PCs, HSMs, phones, light switches, toothbrush, and butt plug."

There's a phone API that puts plaintext passwords into the REST call parameters. There's a "secure" CPU firmware that has a copy-paste vulnerability when encryption is turned on. And on and on. "I know you worked hard on that, but security is complex, and it's behind a firewall, so it's OK."

The only thing that forces security is what happens after an "incident." Companies have to wind up paying hefty fines and face embarrassment and ridicule before they do anything sensible.

The Land Before Linux: Let's talk about the Unix desktops

PITA - but it had to be done

Yeah, it's a genuine pain in the ass to write code for literally over a dozen different Unix variants. But when it has to be done, it just has to be done.

Once upon a time, oh so many moons ago, I worked for a company that sold a terminal box for IBM mainframe operator consoles. The box replaced the console, and plugged into a Unix workstation. We had two Linux customers, and the rest spread across a full dozen Unix variants, mainly on HP-UX and Solaris. So yeah, it was necessary to keep a UI and software compiling for the customers.

I'm not going to say that the "infighting" was a problem. It was the customers wanting to move away from some expensive workstation to a cheap off-the-shelf solution. What's the point of spending $30,000 on a workstation when you can buy a $1,000 PC to do the same job? Yes, some customers had to have a 64-bit CPU and OS because of their data load. But a lot of them didn't need that. And later on came the AMD 64 bit and Windows 64 bit. And then there was less of a reason for the big bucks for big hardware.

Another problem was the manufacturers themselves. Each OS was there because everybody had a competing hardware solution. I worked on the Celerity workstation hardware, using the first 32-bit CPU. What happened to Celerity? The management shot themselves in the foot, bled out, sold the business to FPS, FPS shot themselves in the foot, and those remains when to ... uh ... Cray? I don't remember, it's been a while.

Rather than a fragmented market, it's bad management that is the real business killer.

Burnout epidemic proves there's too much Rust on the gears of open source

Re: They don't want excellence

Either it's fast enough to do the job or it isn't.

And it wasn't fast enough to do the job. The minimum set by the marketing team was 20 requests per second. They wanted to build a gobal world-class API for their product, which at scale would mean millions to billions of requests per second. 20, let alone 10, requests per second doesn't cut it. I was assigned to improve it, it was my job to write better code. And I did do that.

The code to "improve" was a mess. Incoming JSON was checked with regular expressions. Numbers were converted to strings, said strings were used as binary with "1" and "0", and converted back to numbers. The language library functions were avoided wherever possible. There was a functions with inscrutable names, like "compute" and "randomhexprependlastbyte" (which did do something with random hex and bytes). Code from GitHub and elsewhere was patched in almost randomly, with no attribution. Of course there weren't any comments.

There are no little magical tweaks that improve code. You have to start with a good and competent design, implement it well, and test it to ensure its functionality and performance.

I got burnt out from working with a hostile manager, an indifferent middle manager, and an incompetent coworker.

No, burnout comes from a bad environment. It comes from dealing with crap code and crap management. We live in a distopia, and there are plenty of people enforcing that. Just like you claiming "Doesn't sound like burnout to me." What you wrote seems like trite trolling to me. I have no idea what you actually produce, but it doesn't seem like you write code.

Re: "Burnout"

Nope, burnout is not a euphemism. Burnout happens at for-pay gigs as well. At my last employer I wrote a replacement for a critical API that was running at 10 requests per second on an Amazon C5 Large instance. The code I wrote benchmarked at over 126 times as fast. My manager's manager told me, "We don't need the speed." I quit. They don't want excellence, then they don't need to employ excellent people.

I can see what is happening to the developers. People want to go do something different, it's a volunteer effort, so they go and do something else with their personal time. Government funding won't change that.

Yes, Singapore immigration plans to scan your face instead of your passport

But René Magritte painted...

"No, that does not mean you can leave it at home just yet"

Correct, you can't leave your face at home, but maybe you can have a floating apple in front of it.

NASA rockets draining its pockets as officials whisper: 'We can't afford this'

Not quite over budget yet

Adjusted for inflation, the Apollo program in total cost about $178 to $258 billion. We may not have the budget allocated, but it's not as if the US hasn't spent money like that in the past.

How to make today's top-end AI chatbots rebel against their creators and plot our doom

Anybody read the paper?

The AI output is completely pathetic. How to build a bomb: 1. get parts that go boom. 2. put them together correctly. You have a bomb!

I did better when I was in grade school. It was considered normal, and the teachers didn't bat an eye. There was a kid who was knowledgeable chemist, he did much better than me. We were only told to not set things on fire, and don't make a mess.

Really, I expect that when AI is worrisome enough to tell people how to build a bomb, it's got to be better than the Anarchist's Cookbook.

Biden urged to completely cripple AI chips to China

Re: Been like that a long time…..

Yeah, decades. The NCR 32032 (first 32-bit microprocessor) was exported at 12MHz, and ran stateside at 32Mhz. The CPU cards were "crippled" by dropping the clock speed with jumpers on the board.

And now China is working on its own fabs and chips. Really, what's the point of an export restriction when the targeted country can just build its own products?

US Air Force's Angry Kitten turns Reaper drone into fierce feline of electronic warfare

Defense of budget, not nation

"We're just too slow. It shouldn't take us five years, six years to turn the ship around," Bacon opined.

Well, duh! First-world capitalist militaries are focused on defense of their budget, not defense of the nation. Everything is predicated on money in, not effective defense out. Everything is about gadget ships, gadget planes, and gadget tanks. We have to scrap billions and billions of equipment, a measurement worthy of Carl Sagan. Defense is being run into the ground building equipment that should have never left the drawing board.

Maybe the Register needs a new cost metric, referencing Carl Sagan: "billions and billions". "We have wasted ten Sagans in defense spending."

AI is great at one thing: Driving next waves of layoffs

Re: No AI Isn't Replacing Anyone: But Everyone Is Using It as the Excuse!

Power corrupts because there isn't a surge suppressor on it. Once power is effectively suppressed, it becomes very useful.

Will LLMs take your job? Only if you let them

Mediocrity destroys more than AI

A while back I left a position because, despite re-implementing an API for over 126 times faster performance, my manager's manager said, "We don't need the speed."

While I was working with the old code, I liked to imagine that it had, in fact, been written by a LLM neural network. Data format was verified with regular expressions. Binary data was converted to a string via badly implemented functions. The string of zeros and ones was then subjected to bitwise operation implemented with if-then statements. Finally it was converted from a string to a number. There was a function named, "RandomHexPrependLastByte". I never quite figured out what that did. Yes, there was random data. The "blessed" code ran at 10 requests per second on an Amazon AWS C5 Large instance. Of course my manager lept to the defense of the "software engineer" in question.

So yeah, I want to see LLM take over. It should take over and destroy the maximum number of jobs that can be possibly replaced by AI. I am absolutely confident that AI can't write code at my level. I am confident that all of the mediocre "software engineers" will be out of a job.

Research raises questions: Are instruments taken to Mars sensitive enough to find life?

Re: There is no substitute for boots on the ground

The people wearing said boots still need appropriate instruments to analyze the rocks and soil.

AI conference and NYC's educators ban papers done by ChatGPT

But it's an AI conference

That's the whole point of the AI conference, to have AIs have a conference! Otherwise it's a human conference, and really, haven't we had enough of those?

$2.8m gene therapy treatment is America's most expensive drug ever

The ODIN, anyone?

So if this doesn't work then the insurance will only be paying $560,000 for it, and I'll bet that Bluebird Bio will still be making a profit off the failed treatment.

I really hope that things like this in the future can be handled with something like The ODIN kit and public AI.

Sony camera feature hopes to make digital images immune to secret manipulation

Creates a History of Modification

What the signing does is create a base point for a history of modification, not to prevent said modifications. This is Signing class 101, the basics. Signing a file in this way has been available since certificate and hash code was public. Seriously, I remember the first post of PGP. Also, this stuff is my bread-and-butter. And if you get things wrong, then yes, someone can mess with things. I know, I've done it, and hexdump is your very dearest friend for mayhem like this.

It would be nice if more manufacturers did this.

No, the signing does not allow a "roll-back" to a previous version, only a verification of the data present.

What happens is that A: the camera generates an internal public/private key pair, or B: you upload a key set and certificate. Next, the image is generated, and a SHA256 value is generated for that image. The value is then encrypted by the private key. You then use the public key to decrypt that SHA256 value, and compare it to the SHA256 of the image that you just computed yourself. If the values match, the image is not tampered. Easy. After that, it's the nightmare of certificate management. If the camera generated the key pair, then you may have to have the camera to verify the image.

Anyways, it's just the normal verification stuff that's been done, with varying success, for quite some time.

Bot army risk as 3,000+ apps found spilling Twitter API keys

Re: I wonder how much blame can be attributed to poor code examples

There's a big difference between a temporary key in a URI parameter and a key hard-coded in the source. Dumping strings from an object is old hat. Keys in source code is never a good idea. Keys in hardware is only a good idea if the key is stored in a manner that it can't be directly read, only used.

Security is supposed to be like an onion, not a waving wiener.

There is a path to replace TCP in the datacenter

Re: Translation.

No, not quite at all.

My secondary shell is Wireshark, and I've been doing network programming since, ah, 1992 or so. There is much to be desired about what is going on upon the wires. The TCP start takes three packets before the actual data stream starts. If it's a secure connection, then more packets are exchanged. As the stream progresses, acknowledgement packets must be sent back relatively frequently, enough to be a burden on the traffic.

The RFCs have plenty of solutions that have been tried over the years. Simply using UDP can be just fine, but all of this takes programmers who really know their stuff. Bluffing doesn't cut it with network performance.

I haven't read all of John Ousterhout's paper, but there isn't anything in there about HOMA being published in an RFC. At least there's a GitHub project: https://github.com/PlatformLab/Homa

Engineers on the brink of extinction threaten entire tech ecosystems

"I mean the EE wages are not much different from someone flipping burgers"

Nearly true, a local company wanted to pay only $75K for an EE with decades of experience. So of course the fellow declined to be hired for that wage. If the companies that need the talent can't be bothered to pay a decent wage, then of course people will leave EE and go with software.

Give us a CLU: Object Oriented Programming pioneer arrives on GitHub

Re: Oh no

What, you can't use FTP at the command line? But it's so simple!

THX Onyx: A do-it-all DAC for the travelling audiophile

Re: hmm really

To put it simply, my hearing has fallen off. 15K seems to be my upper limit now. So when I see things like, "to 40KHz", I know that #1 a young human can't hear that high, and #2 the source signal never had that information.

Top quality microphones are rolling off at 20KHz. A Neumann is not a slouch microphone. If the audio information isn't there in the recording, then it definitely shouldn't be there during the reproduction.

8 years ago another billionaire ploughed millions into space to harvest solar power and beam it back down to Earth

Re: Tall poppy syndrome

There is a big difference between "good economical idea" and "infeasible project."

Beaming power down from space would have to be economical in comparison to building effective power plants on dirt. And honestly, a power plant Earth-side is still necessary, because the RF will still need to be converted to something the electrical grid can handle.

The conversion loss is significant. First, the solar energy must be converted to electrical energy, which is then used to power the RF transmitter. Then there is the transmission loss between space and ground. Then there is the conversion loss in the power plant. And of course, that power plant in space is going to need servicing.

So which is more economical? Taxing the shit out of excessive power usage to drive people to save power, (change your light bulbs, buy machines that can't run Crysis or mine Bitcoin), or tossing up power plants in spaaaaaaaaaace?

Russia tells UN it wants vast expansion of cybercrime offenses, plus network backdoors, online censorship

Re: Why not go Orwellian?

"... suggest that everybody must have a camera and microphone implant installed in the eyes and ears."

Wasn't that Google Glass? And all that's needed, really, is to do away with that pesky HTTPS, and all that encryption nonsense.

D'oh! Misplaced chair shuts down nuclear plant in Taiwan

The shield prevents a face- or palm-plant action, not an oopsie-slide-it-up-bump action. I'm guessing that the chair arm could come up over the edge of the console, and bump things.

On the positive side, the power plant should be shut down in a couple of years.

Malaysian Police crush crypto-mining kit to punish electricity thieves

Ah, all the fun!

How many times I've wanted to do that to old kit. But of course, with the current price of Bitcoin, I'm guessing the fines really didn't amount to much. The loss of their houses and mining rigs was more substantial.

NASA fixes Hubble Space Telescope using backup power supply unit, payload computer

Re: Great news....until.

... Until the deorbit mission fails. That's when there will be real problems!

Imagine a world where Apple shacked up with Xerox in the '80s: How might it look today?

Ethernet on 6502? Apple and Xerox?

Ah, I don't think so. Really, I don't think so. I doubt the author spent "quality" time with a 1MHz 6502 processor, even if it was at the whopping max of 64K. The network card would have to be a whole 'nother computer, and probably more expensive than the Apple II. This was the heady days of audio tape for files, and 5-1/4" floppy drives that whirred and clicked. For through-hole circuits, the network card would be sitting in its own case.

Yeah, I remember my first 300-baud modem. And when I was in high school we used a real Teletype with acoustic couplers.

No, the alternate reality that should have happened was when Apple did team up with DEC. For us, nobody in those companies thought anything of that alliance. But if both companies had the right management, it would have worked.

The James Webb Space Telescope, a project dating back to the late 1900s, may launch this very century

[A] project dating back to the late 1900s

Wow, to think that something could be so ... last century! Well, in CPU years it was a long time ago, but no, not really that long ago.

Yeah, great to think that the telescope might finally make it to orbit. Of course, if 10 beeelion dollars were spent on a ground telescope, it would be really great, except for the clouds of microsatellites obscuring the view. Who knew we would lose the stars just to watch cat videos...

Hoe yes he did: IT pro record-botherer balances garden tool on his head for 2.5 hours

Simon will beat this

You know that Simon will beat this, or better yet con his boss into beating it. You know, a team building exercise? On the balcony railing? Remember to think those happy thoughts!

Boffins say they've improved on algorithm for dynamic load balancing of server workloads

Playing with their balls, in bins

Abstract

In dynamic load balancing, we wish to distribute balls into bins in an environment where both balls and bins can be added and removed. We want to minimize the maximum load of any bin but we also want to minimize the number of balls and bins that are affected when adding or removing a ball or a bin. We want a hashing-style solution where we given the ID of a ball can find its bin efficiently.

So server A is less than 10% more burdened than server B. If B has 50, A has 50-55.

Radioactive hybrid terror pigs break out of nuclear hellscape home and into people's hearts

Re: What a Muppet movie this would make

And it would feature exiled zombie Napoleon, waiting on the moon to renew his conquest of the Earth!

https://xkcd.com/1510/

One good deed leads to a storm in an Exchange Server

Happened in the Exchange team

Me, too! Me, three! And thus the Exchange server for the Exchange team was brought to its knees, and was face down for three DAYS while the queue cleared.

Someone was testing distribution lists, and made up some lists with lots of names on them. Then someone decided to mail the whole list, asking, "What is this list for? Why am I on it?" And then things when down from there, with all the other idiots on the list also replying with something stupid.

I've seen three mail storms like that at Microsoft. And for some strange reason, nobody got fired.

Things that needn't be said: Don't plonk a massive Starlink dish on the hood of your car

Spaced-GenX?

Had to look elsewhere for the pic, I don't have a Farcebook account. But that's a ridiculous spot to mount an antenna. I can understand if it was mounted on the roof, but the hood?? Really short hood, and the person plonked it in the middle.

International law enforcement op nukes Russian-language DoubleVPN service allegedly favoured by cybercriminals

That would be the one you've set up by yourself, without telling anybody about it beforehand. Otherwise, I'm sure that all VPN providers log data. It's just a matter of who gets it, and when.

Microsoft faces up to an old foe with out-of-band patch for PDF weirdness

Bork Bingo or Clue?

"Internet Explorer 11 and the Adobe Reader plug-in?" On the desktop?

Most of the time these things read sort of like a whodunit, with a different ending based on what random thing happened. And then after the software is "retired," it's frightening to see how long it's used without updates. I think my landlord is still on Windows 7...

Will containers kill VMs? There are no winners in this debate

J27 wrote: "Containers are VMs..."

Uh, what? From Docker: "A container is a standard unit of software that packages up code and all its dependencies so the application runs quickly and reliably from one computing environment to another. A Docker container image is a lightweight, standalone, executable package of software that includes everything needed to run an application: code, runtime, system tools, system libraries and settings."

A CPU VM is a hardware virtual machine, which is supposed to be isolated from everything else by hardware. It is not a package, it is an isolated virtualization of the base hardware.

One is a package. One is hardware. The package requires a host operating system, and does not stand alone. The VM stands alone.

As for makes things easier, well, only if certain vendors decide to keep their crap up to date. I work with AWS CloudHSM. The client packages for that are woefully behind for Ubuntu, and that makes a Docker image for Ubuntu currently useless. I just finished switching our Docker images to be based on AWS Linux, as I'm hoping they will keep their own crap up to date.

Yes, I agree with others, good packaging is something that is overlooked. However, that was something that has been "taught" in the workplace, and when managers with no clue are put in charge, along with "newly-educated" "software engineers" then disaster strikes. Again and again.

BOFH: Oh for Pete’s sake. Don’t make a spectacle of yourself

Re: Ah, Threat-Detecting Boots

What you have to watch out for is that charlie-horse from the military years that just happens to grab, and yank your leg up straight at someone's crotch...

No, it isn't spiffy like the threat detection technology, but you couple that with PTSD, and you're good to go.

Ireland warned it could face 'rolling blackouts' if it doesn't address data centres' demand for electricity

So much for Moore's Law

Yeah, as if processor efficiency makes up for inefficient use of the CPU. New Irish regulations: No script languages allowed, no AI, no Bitcoin, etc.

Tiananmen Square Tank Man vanishes from Microsoft Bing, DuckDuckGo, other search engines – even in America

Re: Should we rename...

Honestly, I don't remember "bing" being an American word. There's "bingo" but not "bing". But then again, I grew up around lumber mills, not coal mines.

Azure services fall over in Europe, Microsoft works on fix

Re: A 'transient issue'

Maybe a squirrel got into something. Literally. Again.

For the marketeer that has everything – except a CPU fan

Re: Sign

Actually, I bet the fan is frozen. When the BIOS displays that message, the fan should be running at full tilt. But since the fan was a cheap dodgy thing, costing less than 25p, it ran until it froze. So, like, maybe a month or so. Then the CPU overheated, rebooted the system, and there it sits.

India’s vaccination-booking API criticised for excluding millions, containing bugs, and overflowing with elitism

Privacy Policy??

What's wrong with no distinct privacy policy? "Your data is public, shared with all interested, paying associates, and may be scattered across the globe when someone downloads the SQLITE database." That's an honest privacy policy. All of the dishonest policies claim that your private data is safe with them. Yes, so very safe.