Posts by Kratoklastes

Researchers crack Oz Govt medical data in 'easy' attack with PCs

Brandis' control-freakery knows no bounds: but don't worry, coz he's finished

I view the amendment that Brandis is proposing as the typical response of a second-rate government lawyer when confronted with evidence of government incompetence: make it illegal to expose government exposing incompetence. Job done, amirite?

This should come as no surprise to anyone who knows anything about Brandis 'QC' - a third-rate Brisbane barrister whose conniving to get 'silk' says more about him than pretty much anything else he has done.

And like all halfwits, Brandis thought that he could extend his control-freakery by fiat, enabling him to keep eyes on all requests for advice from the Soli-General: he took on someone several orders of magnitude smarter than him, and several more orders of magnitude more respected than he is... and he will pay for it with his political life. (Not for nothin', but Gleeson is also better-liked in the legal fraternity than Brandis, but that's a very low bar since Brandis is about as likable as haemorrhagic fever).

My point being: when the ALA calls for your scalp, you're finished as a participant in the legal community, irrespective of what political office you hold. That means that Malcolm "Parachuted Preselection" Turnbull is biding his time before sacking Brandis - literally everyone (including Brandis) knows he's toast.

And given that Brandis is a Dead AG Walking, nobody will support his proposed amendments in committee, so they won't get through.

Defuse census outrage with independent oversight of data-handling

Dunning Kruger is no excuse.

<blockquote>projecting future road use, capacity for public services such as schools, parks, libraries, demographic projections - you know, the things that are the whole purpose of having a census in the first place.</blockquote>

I'll preface this by saying that the next paragraph is not just pure 'skiting': it's a potted way of establishing that I'm qualified to make declarative assertions about data accuracy and quality, and the extent to which any attempt to create 'noiseless' data will help in formulating 'accurate' projections.

I've done a bunch of stuff on projects that did projections for housing demand (and supply of residential and industrial land), demography (regional migration; catchments for major retailers; proximity models for house prices near proposed railway stations; changes in household composition by small-area aggregates). Geospatial analysis is one of the things I understand reasonably well - up to and including analysing annual changes by individual cadastre parcel for the 31 Melbourne metro LGAs for 2004-2012, and the 5 Geelong-area LGAs for 2006-2015. My 'strongest suit', though, is the statistical analysis of data. My 'formal' training - Honours, Masters and PhD (incomplete) - was in Economics and Econometrics. I won the ABS prize in my Honours year, and got an RBA cadetship (one of only 4 offered in the entire country) and the Vice-Chancellor's undergraduate research award (the only student in the faculty who got one). I got straight Firsts for my Masters coursework subjects. One of the papers I co-authored resulted in Treasury asking our team to help them implement rational expectations in their macroeconometric model (TRYM). My PhD dissertation spent several sections demonstrating how using central-tendency measures as 'exogenous' inputs to a non-linear model was a waste of time[1].

Phew...

So with that by way of background... let's get to the idea that using the census data gives a better estimate of forward numbers, than a standard exponential curve with completely artificial noise (of the form x[t]=x[t-1]+e[t] where x[t] is the log of the variable of interest X at time t, and e[t] is a lognormal random variate).

In other words, the key question is

<blockquote>how much additional accuracy in projections would be obtained by using 'accurate' census data, versus modelling percentage changes in literally any metric of interest by dlog(X)=e where e is a vector of lognormal variates?</blockquote>

Award yourself dix points if you realised that I was sneaking up on the idea that the correct answer is "None. There is literally zero reduction in forecast MAPE from using historical survey data, over a Monte Carlo simulation using 'sensible' estimates for the conditioning parameters for the distribution of e.".

Award yourself another soixant points if you understand what variables cause the correct answer to be the case. Those variables are technological and preference changes and policy variables. Future values of these variables are literally impossible to estimate at an aggregate level, and even more impossible-er at a sectoral level... and they are not geographically constant (so Frankston and Brisbane will not have common tech change, preference and policy parameters in a regional model).

If you have snaffled all the points on offer up to now, you are barely at 'HIIB' level, which means that I would not listen to you if you were a government advisor (most government advisors are IIA's, but that's still a very low bar).

Another dix points will get you an HI (but only in one subject). These can be garnered by grokking the footnote.

Footnote[1]... This is also true in a linear model, because linear models are not bijective from the exogenous variable space to any subset of the endogenous variables; policy analysis is only ever interested in 'key' subsets of the entire endogenous variable matrix.

To see why this non-bijectivity is the case a fortiori, change the closure (swap the endogenous variables-of-interest for the same number of 'naturally' exogenous variables - so the system remains mathematically solvable).

Force the swapped endo-vars to remain unchanged, then perturb the rest of the exogenous variables by some arbitrary percentage and solve the model. Do that several hundred times, and you will have several hundred sets of all variables where the endogenous variables of interest take the same value, but the exogenous variables are different. Bijectivity... categorically rejected.

Congratulations... you just proved that there are multiple vectors of values for the 'exo-vars' that are consistent with the same vector of values for the endo-vars of interest. (This is why I stopped being interested in 'point' (or 'single-path') forecasting: to say anything meaningful about the statistical properties of the endogenous variables of interest, requires a stochastic sensitivity analysis).

Award yourself the last dix points and join the Firsts. You still need a further douze points to finish next to me in 4th year. (OK, so that last bit was pure skiting).

This is the type of “throw more money at it” response that should be expected by those who spend their life on the tax tit.

Let’s get to the core argument of this tax-eater’s thought-bubble…

Government fails after spending 10-figures on something that a couple of 2nd-quintile undergraduates could accomplish in 3 days… so that means government has to set up yet another trough and hire a bunch more ASO5s and 6s who will work in a stultifying cubicle-farm (overseen — let’s be honest — by someone who is mates with the Minister).

The result will — always and everywhere — be a boondoggle staffed by semi-competents, which will fail to achieve its objectives (even though those objectives will be low-balled by the political-parasite class).

Bear these two things at the front of your mind…

(1) — the ABS data repository is not secure. Anyone with any experience in pen-testing can verify that for themselves, and if I was ever dragged into court for refusing to participate in the census I would prove it in real-time. The ABS’s ad for its intrusive addition to government surveillance programs is typical of government advertising — it has the same truth content as a shampoo or cosmetics commercial.

(2)— The data will be handed to Five Eyes — the Australian government’s surveillance sharing program with the US, UK, NZ, and Canada. Anyone who thinks otherwise is a naïf or a shill.

inb4 “If you have done nothing wrong, you have nothing to fear”. If that’s true, what wrong has .gov perpetrated that makes it require its gigantic squads of obese half-wits in faux-military drag at airports? (I speak here of the ‘Border Farce’ — another corrupt crony-infested boondoggle). Ditto all the security at courts and every major .gov installation. They clearly fear us - so by their own logic they must have done something wrong, right?.

The NBN is another example that really does show what government contracting is all about. It was birthed in corruption, and was never, ever going to come in on budget or be delivered on time, and it was always always going to be obsolete before it was finished.

As it stands, every Australian household is on the hook for at least $10k before a single byte of data is downloaded. That’s roughly 10 years of ‘full-whack ADSL plus calls to locals and mobiles’… before anyone connects to the thing.

And NBN will be obsolete before it’s launched (it’s obsolete now).

And some politically-connected vermin will buy mansions in Potts Point based solely on the dough they have snaffled in the crony-fest.

Government failure is a far more important drag on economic activity than market failure — when governments fail to educate children, furnish health-care, or prevent property crime, the government answer is to reward that failure with greater budgets: the private sector withdraws capital from failed projects and lets them be replaced by someone with better ideas.

Let’s change the system so that the franchise only extends to those who are net tax payers — whose tax payments more than offset the goods and services they obtain from government. I refer to these people as NTP (Net Tax Payers), to be contrasted with NTR (Net Tax Recipients).

That means no politician or bureaucrat would have a vote, because their entire salary has to be funded by the net taxes from NTP private sector workers. Sure, they give some back (i.e., they pretend to pay tax), but that is simply the return of some portion of the taxes that are used to pay them in the first place… and they still get .gov-furnished goods and services.

Better yet: make .gov a subscription service. I get absolutely nothing from .gov that I could not get at a better price from the private sector. Monopoly always results in low-quality, expensive output, whether it’s one-size-fits-all Mao suits, or politically-monopolised justice and law enforcement.

Oz stats bureau deploys a bot to harvest Twitter IDs

"Your data is secure" should be the subject of a class action

One thing that you can sticky-tape to your fridge, is that the team responsible for datasec at ABS is comprised of 3rd quintile talent except at the very top (where it will be 4th quintile for datasec, but 1st quintile for brown-nosing and empire-building).

They will all be ASO5 or 6, getting $78k a year, tops - basically exactly in line with average weekly earnings for all-comers, and 25% below the average for full-time male employees in Information, Media and Telecommunications. So expect average intelligence (economy-wide) and average technical expertise (economy-wide), and average (economy-wide) understanding of how to properly implement decent data security.

And then consider how low a bar that is, when sector-specific attributes of all three of those things is low.

Consider that within the tech sector there are a shítload of people whose understanding of data security is woeful - including relatively well-paid, relatively highly-skilled people working at security firms or responsible for data layers at large firms (e.g., notice all the vulns found in high-exposure apps like DropBox, LastPass, etc).

Government does not pay enough too recruit talent, and its workplaces are actively toxic for talent (they are not remunerated well, and they are not recognised adequately, they are not resourced properly, and their feedback is not sought - because it's brown-nosers and triangulators all the way up to the Minister*).

If I am ever prosecuted for refusing to fill out this Orwell's-wet-dream snooping document, I will show the court in real time how easy it is to expose personal data from a government data repository. It won't get me off, but it might help the "failed barrister on the bench"** think a bit harder.

*: disclosure - my youngest sister was a Senior Adviser to the Prime Minister (Gillard). She plays no role in, and doesn't endorse, my view of bureaucrats (as Upton Sinclair quipped, 'It is difficult to get [your sister] to understand something, when [her] salary depends on his not understanding it.').

**: there are some judges who are very smart people and were very good advocates. My old mucker Michael Croucher (now Croucher J of the Vic Supremes) is a good example - we studied economics together and he and I both won RBA cadetships (and we both turned them down). While he has a very sharp mind, and would not be prone to Dunning-Kruger on matters of technical complexity, it remains that he is part of a machine that relies on mediaeval garb and faux-solemn set-piece theatrics to give the process undeserved gravitas, when the average person in the 'big chair' is a bit of a dullard, relative to the average practitioner. Maxim 237 applies*** even if not specifically in Croucher's case.

Smart judges who were good advocates are the exception: the run-of-the-mill judge makes Vosper, Graves and Oliphant JJ (from 'Rumpole') look like Denning by comparison.

**: Maxim 237 from "Réflections ou Sentences et Maximes Morales" (1664) by François, Duc de la Rouchefoucauld, which goes -

"La gravité est un mystère du corps inventé pour cacher les défauts de l'esprit." (Gravitas is a physical charade designed to conceal mental shortcomings).

'NSA' hack okshun woz writ by Inglish speeker trieing to hyde

I hinted at much the same thing myself...

In a comment on ZH - which is worth reprising here.

---------------------------------------------------

Told ya (that the talent-rich phyles are starting to understand the relative merit of uncorking .gov).

Is funny press release like written by Russian, da? Da.

Is lucky we not step in it.

The thing about national-level artificial monopolies - be they in 'justice', 'law enforcement', 'intelligence' - is that they are always <b>fragile</b> (in the NNT sense).

Firstly, they are entirely populated by second-raters: everyone above GS5 is either a 'True Believer' (i.e., gullible as a newborn, and therefore easily soc-eng'd) or a careerist bullshit-artist (i.e., useless for anything except toadying towards superiors and taking credit for underlings' work). At the very top, everyone is employed/installed based on their proximity to that most vile of pseudo-humans - politicians.

Secondly... think what it means when procurement is overseen by, and facilitated by, the types of people in 'firstly'. It means that tech procurement is done in an environment that contains nobody with the chops to evaluate the product.

So everything is acquired by a 'proximity model' - people get contracts because they're linked to, e.g., Chertoff... and once they've had one contract whose flaws didn't get exploited on 0-day, they are at the trough forever.

I fully support everything Snowden did after he left (except that he should have blasted half the entire corpus into cyberspace, and kept the other half as insurance, rather than installing 'curators' - be they never so well intentioned). But bear this right at the front of your mind: <strong>he is not that bright</strong>. Snowden was a high-school washout, and not because he was 'too smart to excel' (I know plenty of people who are like that, and he's not one of them). Yet he rose through the ranks of the alphabet soup agencies <strong>like a fucking boss</strong>.

The security-theatre industry is not staffed with the 'best and brightest'. 'Mudge' - always a nappy in hacker circles - is one of .gov's best, and he's fucking useless. Mudge is the hacker equivalent of Dumb Shitbird (Domscheit-Berg) - someone who tried to coddle up to a genuine talent, then betrayed them the moment someone turned up with enough pieces of silver.

Ask yourself who wants to work for NSA: they have to 'believe in the mission', which makes them obviously incapable of adult levels of cognition, let alone genuine talent.

Internet of Car...rikey what the hell just happened to my car?

It's the US corporate obsession with 'IP'

Quite apart from the retardedness of attempting to 'bolt-on' datasec because designers didn't think about it at the design phase, the carmakers' approach to their onboard systems is identical to banks' approaches to their client datasec (including, but not limited to, the security protocols for web interaction).

That approach centres on developing everything themselves, in order to have a proprietary system. That way, the expense is R&D and can be amortised (and/or marked up as an intangible asset).

In the software crypto world, one of the very first things that good crypto devs will tell you is "Do not try to develop your own crypto. P(you miss something critical)=1. Use an open-source library."

And yet time and time again, software firms have implemented their own versions of data encryption - the best example being Microsludge with NTLM (a really sick joke of an encryption protocol) - and it turns out that their 'roll your own' approach was vulnerable to a fundamental exploit (timing oracles, padding oracles, or any of the other shocks that crypto flesh is heir to).

Being crowd-checked isn't a guarantee, as the OpenSSL vulns from last year make clear... but it's a good deal better than having black-boxed code (often code that is badly documented - so if key members of the dev team leave, you can't make head nor tails of it).

Carmakers also know that most car buyers will never become aware of the vulnerability - journalists are stupid, power-craven and technologically illiterate, and so will repeat whatever talking points are being promulgated by the car manufacturer.

I can see it now... a 500-car pileup on a major turnpike, with cars' brakes failing to respond, and accelerators 'pedal to the metal' ; the TV news would say

<blockquote>"Tragedy today on the roads, as global warming caused electrical malfunctions in 500 vehicles. Witnesses say that cars rammed into the pileup - which began with a semi-trailer that had jack-knifed. ISIS immediately claimed responsibility, claiming that it had hacked the systems of the vehicles, however a spokesman for the White House said that this was 'clearly propaganda trying to exploit this climate-caused catastrophe' and that the event reinforced the need to ratify the Paris climate accord. Industry insiders agree: in Detroit is our Maggie BleachedTeeth with a spokesman for Ford. Over to you Maggie..."</blockquote>

Windows 10 Anniversary Update: This design needs a dictator

I do several things every day to advance the cause of datasec - but unless I develop early-onset Alzheimers, there is no way in hell I ever donate my time to fixing Redmond's crapshower of insecure failware. I have my home network router clamped down tighter than a nun's nasty (and far tighter than I would need to if all of our home machines were non-Microsludge), and I monitor every packet that leaves The Lovely's ultrabook (the only Windoze machine on our net) - that's as much of my time as I am prepared to waste on Redmond's habitual release of half-finished bloated malware.

And about your idea that anyone who is in a position to understand the massive, secular, institutional-level failure of Microsludge, is also obligated to furnish free labour to the masses in order to mitigate that failure? Well, that's the sort of drivel I have come to expect since the internet user's median IQ started falling precipitously in the early '00s (from ~115 and an average of 120, to 100-ish on both scores). it's of a piece with third-quintile no-hopers who accumulate vast amounts of student debt, then wonder why they can't get a job that yields a salary sufficient to make repayments. (Lietmotif: the world does not reward anyone outside the top decile, and even then it does so barely. Unless you're top percentile, you're not going to make out).

Windows is garbage. Insecure, half-finished, bloated dreck that only survives because 99% of computer users (and 95% of adults) operate at level of competency equivalent to a mediocre grade 9 student.

I have one home machine infected with Redmond quasi-malware, but only because my partner - a lawyer - moves in circles where nobody can work outside of the Windows 'biosphere'.

As a result of that one machine loaded with Redmond's insecure garbage, I spend my spare moments wondering what gaping security hole will next be discovered by a teenager with an IQ 2sd above normal (and 3sd above the average Microsludge security-layer coder)

In a world not dramatically tilted by artificial barriers to competition (e.g., 99% of Microsludge's revenue existing solely because of IP/patent protection), the desktop OS market would have gone the same way as the server OS market (and the hypercomputer market - where all bar one of the global Top 500 use... wait for it .... Linux).

In another 10 years, Windows will be something about which the kiddies know nothing - much the same as the average 20-year-old nowadays has never heard of OS/2 Warp (I had a copy: one of the very few OSs that I've ever paid for). And MSFT will be headed the same way as Nortel, Yahoo and everyone else who thinks that a dominant position - obtained by gulling the stupidest - is a way to success. That is, to zero.

The internet exists to kill bad ideas, and to expose fraud. Microsludge has imposed its half-finished, insecure malware on the world for 30 years (OK, so pre-internet the security problems were less pressing), but nowadays nobody needs to care about them - they have as much relevance to the future of computing, as the US has to the future of diplomacy.