Posts by Claptrap314

UK tells UN that nation-states should retaliate against cyber badness with no warning

Re: Were people giving warning before?

One could say that it's about diplomats maintaining their relevancy.

But there is actually a bit more than that involved. The Western societies view themselves as the "good guys", and try to justify that by holding to a particular standard of behavior, especially when it comes to the conduct of war. This standard of behavior regarding war is in the Geneva conventions. There are additional conventions, I think the one on landmines is separate.

The problem is that if your goal is "just win", the Geneva conventions severely hamper your freedom of action, and there are some nations that happily flout the conventions. The resulting imbalance is...highly problematic.

One solution, especially when dealing with a fundamentally new technology, is to "adjust" the expectations so that signatories may adequately respond to developing situations. That is what this is.

How to use Google's new dependency mapping tool to find security flaws buried in your projects

Re: Library bloat ?

Don't forget that you get those security & bug fixes for free. No testing of the applications relying on them required.

Re: Library bloat ?

Ever hear of DLL hell? I've never been a fan of shared libraries at all.

Before I was a professional programmer, it was due to premature optimization. But my first professional work was for a decade in validation, and--just no.

Cryptography whizz Phil Zimmermann looks back at 30 years of Pretty Good Privacy

Re: It's Not All Good

You forgot the drug lords & the kiddie porn.

It's completely unsupportable. Yes, we mean your brand new system

Required to understand

"We were defeated by one thing only - by the inferior science of our enemies."

There are TWO golden rules:

#1 if it works, don't fix it.

#2 always keep up to date on patches.

Uncle Sam recovers 63.7 of 75 Bitcoins Colonial Pipeline paid to ransomware crew

Re: Another stake in the heart

By design, all transactions of BTC are public between wallets. Establishing the link between a wallet and an individual is left as an exercise for your local TLA. There are services (Bitmixer?) that darken things.

Re: Not your keys, not your crypto

The article references "affiliate fees"--think like a sales commission. The BTC had not been laundered yet--that's why they could grab it out of a single wallet.

My understanding is that 2% is something of a going historic rate for laundering. No idea what it's like in coin.

Re: Not your keys, not your crypto

BTC is, ETH is. I do not believe that all are. Can't be bothered to work out what the truth is, even if they weren't spreading like a pox.

Security researcher says attacks on Russian government have Chinese fingerprints – and typos, too

Re: "too crude to have been the work of a Western nation"

I'm pretty sure that by "Western nation", he meant "Western governments". Our spooks are known for some rather impressive (-ly good) work.

Re: attacks on Russian government have Chinese fingerprints

That's what they WANT you to think...

The best time to plant a tree is 20 years ago. The best time to build a semiconductor foundry is 5 years ago

When I was in that part of the industry, you had your fab fillers--older stuff that paid the bills. And you had your latest, greatest CPUs (later on, GPUs as well). That high end stuff was where you made the money to invest in the next product.

That's for a self-owned fab, of course. The build-to-order fabs cannot amortize across customers.

Re: Is this fair?

I was at AMD & IBM twenty years ago. Saunders was under a LOT of pressure by the analysts to go fabless. His response was to the effect, "Real men have their own fabs." But the cost of those fabs was going up FAST. The join Sony-Toshiba-IBM effort that created the cell microprocessor was very much about that as well.

It's very easy to sit back and say, "shareholders should not be so risk-averse" when it's not your but on the line. Show me the analysts twenty, fifteen, ten, and five years ago that were warning about this. Hint: it's all about the next quarterly report, baby!

Google says its artificial intelligence is faster and better than humans at laying out chips for artificial intelligence

This is not a surprise

At the risk of being dumped on by actual designers here, (I did validation) even twenty years ago, there was a back-and-forth race between humans and auto-routing software.

The growing complexity of the problem, and the growing sophistication of the software, means that this has always been a primary target for software takeover.

Nim, checkers, chess, go, place & route...

'I put the interests of the country first': Colonial Pipeline CEO on why oil biz paid off ransomware crooks

I. do. not. get. it.

I worked for a company with a particularly...interesting system. They did their billing on the second of the month, starting at 0200. It needed to lock the database that our company ran on, it took hours to run, and it tended to break.

In that area, Comcast did it's monthly network thingy on the second of the month, starting at 0100.

Guess who drove 40 minutes to work once a month at 0100?

Explain to me exactly why the correct business decision is to allow critical infrastructure controllers to be connected to the internet in the first place. Use small words.

PrivacyMic looks to keep your home smart without Google, Alexa, Siri and pals listening in

Re: misses the point

"Sure, it won't record your political opinions, "

Hahahahaha.

Seriously? Hmm... They sat in front of the TV two hours each night of the national convention of WHICH party?

They can figure out which sitcom you are addicted to by when you get up from the couch. (Commercial breaks are not synchronized between networks.)

Read up on the history of spycraft. Shocking amounts of information have been revealed by dismayingly little raw data, properly processed. Now, everyone has a multi-gigaflop computer in their hand.

FBI paid renegade developer $180k for backdoored AN0M chat app that brought down drug underworld

Notably missing: Anyting from Mexico or China

I would have thought that if there had been significant penetration of gangs importing to the US from either China or Mexico, that the FBI would have talked about that. <sigh>

Re: War on drugs

There is a big error in viewing b) as the goal.

The goal is not to "win". I seriously doubt anyone with even the most basic understanding of economics or human nature believes that it can be "won". (The later includes >99% of winning politicians, by the way.)

The goal is to minimize societal harm. On the one hand, if you have these substances freely available, you do eliminate one category of crime. Of course, if you look at what's happening in Vancouver BC, you see that another sort of crime (theft) skyrockets as the users of these substances are unwilling to limit their consumption to what they can afford by working, paying rent, and etc. Also, the cost to our medical system to deal with bad effects of taking the drugs, and of a decidedly unhealthy approach to life generally.

Surely I'm not the only person to have a family member consumed by alcohol. Despite the claims of some, most of these drugs are in fact worse. (And, we've not had thousands of years of selection pressure to develop resistance.)

What to do? We settled, more or less, on allowing alcohol & tobacco and criminalizing the rest. We're now moving (strongly) towards legalizing weed. We're also seeing a lot of ER cases with previously unknown weed-related issues.

There is no good, simple answer. I'm not even certain that there is a good one.

Re: Shades of Bletchley Park

I expect quite a few. You don't bust up every numbers game in town just because you can. The article mentions a number of >one ton cocaine shipments that failed, however.

Re: Coventry Scenario?

Yes. The idea that PM Churchill knew about the target and did nothing was a lie concocted by his political enemies. First-person accounts of that evening contradict the claim.

Re: Criminal Intelligence

I know that there is a lot of spread, but in organized crime, they go through eye-watering amounts of money. I got this from personal communications plus what I know about the Al Capone era. It's "Gangster's Paradise"--live fast, die young. They blow money like mad because they don't have anything to live for, and no expectation to live that long.

Re: Mystery dev

The security services exist in no small part so that governments can mess with each other without going to war. I expect that there is a general "understanding" that defectors, once they have spilled the beans, are to keep a low profile, and if so, are generally left alone. It's similar to the way that we don't try to assassinate their leaders & they don't try to do ours either.

Russia appears NOT to be playing by the rules regarding wet work, and it appears that the security services are furious about it. Tit-for-tat would fix it, in a hurry, but we don't seem to want to go there.

That balance works quite differently for organized crime. Tracking down & snuffing a stoolie doesn't generate the same kind of blowback.

Yeah, about that. Ever see the real numbers about what happens with the FBI's witness protection program? No? Try for a FOI lawsuit.

These organizations have comparable free resources to Russia. If he's lucky, he dies from a bunch of bullet holes.

Re: Trusting trust

As the right-pondians put it, "horses for courses". As you say, OTP is all about key management. Certainly, it does not "scale". But scale is not everything. In fact, I always assumed that OTPs were only ever used with two pads--and the encryption sheet was burned after use.

OTP actually works quite well for critical diplomatic communications, or instance. Especially if the diplomat is the key courier.

Re: Trusting trust

You see that red triangular icon on the right side of that post? That's supposed to tell you something.

Australian cops, FBI created backdoored chat app, told crims it was secure – then snooped on 9,000 users' plots

Re: * the Customer Support

On the one hand, you have government officials demonstrating care & concern for customer experience. On the other, you have the world's most wealthy companies demonstrating...

Yeah, kind of mind blowing. The one time that the lack of market discipline (in this case, the cost of doing business) works to create great customer service, and who gets it? Violent criminals.

I think Scott Adams just had his scripts written for the rest of his natural life...

Siloscape malware targets Windows containers, breaks through to the underlying Kubernetes cluster

Securing K8s?

Given that the default network policy is ALLOW_ALL, I'm thinking that there might be a fair amount of work involved.

Mind. Blown.

DoS vulns in 3 open-source MQTT message brokers could leave users literally locked out of their homes or offices

"Fail Safe"

Or not. It's your life, not mine...

FYI: Today's computer chips are so advanced, they are more 'mercurial' than precise – and here's the proof

Re: L3 cache ECC errors

Ouch, ouch, and OUCH!

If you are seeing a steady problem while ordering less than a thousand CPUs, then this is a HUGE deal. A 1/1000 escape should stop the line. Seriously, talk to your management about going to the press with this.

BECAUSE you are way, way too small for Intel to care about. And..Intel's parts are everywhere. This isn't going to just affect gamers & miners.

As to what you can do in the mean time, a couple of things come to mind immediately, sorry if you are already going there.

1) Double errors happen roughly at the square of the rate of single errors. Screen on corrected bits over a certain level, don't wait for the MCE.

2) Check that you are actually running the parts in-spec. I know this sounds insane, but if your workload drives the temperature of the core too high, then you are running it out of spec. Of course, manufacturers do significant work to predict what the highest workload-driven effect can be, but don't trust it. Also, read the specs on the temperature sensors on the part very carefully. Running the core at X temp is not the same has having the senors report X temp.

3) It sounds like it would be worthwhile to spend some time reducing your burn-in run. (I come from the manufacturer's side of things, so the economics are WAY different than I'm used to, but still...)

a) Part of why I wanted you to check the temp spec so carefully is that if you are sure that you are in spec, you might be able to run at a slightly higher ambient temp & still be in spec. Why would you want to do this? Because the fails will happen faster if you do.

b) Try to identify which part(s) of your workload are triggering the fails, and just run that part over & over. I had test code that could trigger the 750 Medal of Honor bug after 8-10 hours. Eventually, I got it to fail in 1 second.

c) Try to see if there is a commonality to the memory locations that fail. As I mentioned with the Nintendo bug for the 750, it might be possible to target just a handful of cache lines to activate the failure.

Re: Floating Point Fault

This is why science involves others reproducing your work.

Re: Google and Facebook designed CPUs

As far as I can tell, those really are more like SOCs and/or GPUs. And, no, they are complaining about someone else's work.

Re: L3 cache ECC errors

This does sound similar. Seriously, it might be worth a sit-down to talk through, even though it's been 15 years since this was my job. I don't know if you are big enough to merit an account rep with Intel or not, but if you are, be sure to complain--those parts are defective, and need to be replaced by Intel. (And Intel _should_ be pretty interested in getting their hands on some failing examples.)

Re: CPU lockstep processing

You every try designing a board like that? Triple the buses, 10x the fun! (And by fun, I mean electrical interference between buses.) Such a solution would be REALLY expensive.

Re: An oldie but a goodie

The Pentium Bug was a design error. The microcode was programmed with a 0 in a table that was supposed to be something else. That's a completely different issue from this discussion.

That chip did exactly what it was designed to do. (Some) of these do not.

Re: Somebody thought of this before

That's mostly a different issue. But yeah, some of those server parts have more silicon to detect problems (not just errors) than is in the cores.

Re: Higher datacenter temperatures contributing?

I was never privileged to tour our datacenters, but I am HIGHLY confident that G is careful to run the chips in-spec. When you've got that many millions of processors in the barn, a 1% failure rate is E.X.P.E.N.S.I.V.E.

Now, for decades, that spec is a curve and not a point. (IE: don't run over this speed at this temperature, or that speed at that temperature) This means that "in spec" is a bit more broad the naive' approach might guess.

They also have temperature monitors to trigger a shutdown if the temp spikes too high for too long. They test these monitors.

Re: For shame!

Just another page for the existing one, my friend.

Re: so...

You do know what a transistor is, correct?

Re: How do they know this is new?

We had a case of a power signal coupling a high bit in an address line leading out of the L1 in the 750. Stopped shipping product to Apple for a bit. Nasty, NASTY bug.

I don't recall what exactly was the source of the manufacturing defect was on the Nintendo bug, but it only affected certain cells in the L2. Once you knew which ones to hit, it was easy to target them. Until I worked it out, though... Uggh.

Re: How do they know this is new?

I deliberately avoided the term "hole migration" because it tends to cause people's heads to explode, but yeah.

And not just quasi-stable. The effects of hole migration can be VERY predictable. Eventually, the processor becomes inert!

Re: Buggy processors--that work!

You would think so, wouldn't you?

The design broke up an instruction into parts--instruction fetch, operand fetch, result computation, result store. (It's been >20 years--I might have this wrong.) The in-order core executed these four stages in parallel. It could do this because of the preliminary work of the out-of-order processor. The out-of-order core might take 15 cycles to do all four steps, but the in-order core does it in one--in no small part due to that L0. The in-order core was being drafted by the out-of-order core to the point that it could manage a higher IPC than the out-of-order core--as long as the data was available, which it often was not, of course.

Retail consumers avoid the cost that manufacturers charge for it. So...sure.

What to do about open source vulnerabilities? Move fast, says Linux Foundation expert

Re: More Good Habits

I agree that the whole, "be generous in what you accept and strict in what you admit" was a dangerous rubric from the get-go, and certainly undefensible by the time that m$ was rampaging across the industry.

I have often stated that the lack of trivial overflow detecting is a major wart with K&R. Not irreparable, however.

Re: Stop Using C and C++

You have some sort of study to back that 70% claim? May I see the methodology?

You cannot fix stupid or lazy, and writing code that actually meets an interesting spec is hard.

I certainly agree that sloppy programming like while (a++ = b++) {} should have never seen the light of day, the problem is not the language. It was stdlib, which promulgated a dangerous data type into an unsuspecting world. Culture is everything, and claiming, "the world would be so much better if we just changed tools" is the province of daydreamers & dictators.

Re: I found a good way to test a program

Rule #1 of programming: The user is your attacker.

Those names are entered by the administration, and are non-editable by the teachers.

Problem #1 solved. Next?

Re: K.I.S.S.

As I've mentioned before, they "small parts" idea breaks down WAY faster than you expect. My favorite example comes from Newtonian physics. Start with two bodies with certain masses and initial locations & vectors. We can solve this with the calculus. Add a third body. Nope.

What we HAVE proven is that there exists systems of five bodies such that the entire system escapes to infinity in finite time.

State machines don't fall off the cliff that fast--oh. Wait. What is BB(5) again?

Re: "Turing Complete"

Sure--by limiting its access to memory & time from the kernel, and jailing it's file system.

If you can prove the OS and file systems are secure.

If a scripting engine is Turing complete (and most are), then the halting problem fails. So you cannot prove that it only consumes so many instructions.

And it's pretty easy to write a Turing machine that takes a step to the right after n! steps have executed.

Or accesses a directory "../" + whatever it did before.

Google's diversity strat lead who said Jews have 'insatiable appetite for war' is no longer diversity strat lead

Re: Dispassionately

And the man who came up with this is an as***le. That is a straw-man argument explicitly used to drive non-woke individuals from the public sphere.

Re: 'I wonder if anyone has checked to see if these are still his views.'

As in--"You say ANYTHING to the press about this, and you are fired."

The policy of truth: As ransomware claims rise, what's a cyber insurer to do?

Wallet tracing

Surely by now even the skiddies know to use a separate wallet for each infection...