Posts by fg_swe

Anonymous researcher drops 0-day 'exploitarium' repo

Re: Use Memoy-Safe Language

"sloppeur" - very German non-argument. Nasty and without substance.

Welcome To Unix, Windows etc

Thousands of such overflows.

Use Memoy-Safe Language

The libssh2 exploit would have been thwarted by memory safe programming language.

Like this one: https://sappeur.di-fg.de.

Google wants AI regulation, but on its own terms

Re: German court

BINGO.

Demonic Books

While we are at it, will we also outlaw books with clearly immoral and demonic content ?

I have seen this crap in the hands of my children.

Of course the answer will be that we cannot do that for freedom of speech reasons and everybody/every-family must self-regulate, more or less.

Parents ?

Parents must be held accountable for controlling what children do with electronics. Screen time must be controlled and limited.

Playground time, football time, playing-with-other-children-time-in-real-world is imperative.

We Grownups must regulate this, the children cannot do so. Delegating this responsibility to FAANG won't work and it is cowardly.

Re: I’d rather go off grid

It's a nice mousetrap and can be funny at times. Just have some other life, such as walking the dog, meeting friends, enjoying the paradise of your forest etc IN ADDITION to WWW, AI and other computery.

Well

Google does whatever they please in spite of DSGVO, while everybody else is held to highest(read:insane) standards.

They also do not pay tax here.

That's Germany.

Re: "A Pragmatic Approach to AI Governance in America"

There is always Cuba for you, if you want clear rules, poverty and harsh punishment.

The clear rule is: never mess with the ruling oligarchy, or else.

Reallies ?

I do have not used Google Search for a long time now. Qwant is doing fine. AI I do with Mistral/le chat and ChatGPT. No need for Google. Mistral apparently also does not have the Baby Controls ChatGPT has.

This looks more like a Marketing Operation. All news good news etc etc.

"we must regulate this super dangerous thing, or it will eat humanity. Now buy our stock and profit from thing".

It's looking like a hot, messy summer for security teams as AI finds countless previously hidden vulns

With Enough Eyeballs...

Any FOSS bug was supposedly quick to be found.

We now learn there were either few eyeballs or tired owners of these balls.

But we already knew that from Heartbleed.

Infosys boss says vibe coding is no threat because there’s more to writing software than writing software

Indeed

Why pay the farmer for food, when the tractor pulls the plough ?

Pol Pot already knew this.

Re: More to writing software than writing software, for sure

Probably the AI can write the test cases, as mandated by the V model.

But who ensures the quality of the test case code ? Who ensures that e.g. system test cases really cover requirements fully ?

AI will change software engineering, but not make it easier. It will automate lots of routine tasks, but will require senior engineers to spot hallucinations with eagle eyes. Then talk sternly to the AI ;-)

Moneymen...

The folks running the London Stock Exchange outsourced trading software development to Sri Lanka. Because they were even cheaper. And as you know, you need the cheapest input in order to get the best profit. A Fiat is always cheaper and therefore better than a Mercedes, you know.

They then experienced several full-day crashes of the trading system.

More Than Return Codes

There is plenty of good training data out there on github for the AI to learn good code. Return codes will be checked, at least when you complain to the AI.

BUT - checking return codes does by no means assure correctness of code. It's just one facet of many that will make a system reliable and correct.

Someone will have to check the AI output and make adjustments to the AI build pipeline.

Someone will have to check the test cases on all levels of the V model.

This someone will be under lots of pressure, because the project is typically underfunded and understaffed. Or underqualified.

Darwin Will Do It

Applied Computer Science is an enourmous number of fields from beancounting to games to ABS brakes.

We know how to do all of it properly - the V Model. But thats too expensive for many settings. So all kind of insane corner-cutting will be done.

AI definitely can help in fast coding of simple algorithms, which already exist somewhere. It can be done responsibly.

But guess what ? Irresponsible MBAs and similar will abuse it, because they dont know and do not want to know, the limits of AI.

Also see Boeing MCAS: MBAs decided to let it develop in India by rookies. It cost 300 dead passengers+crew plus $25 000 000 000 in follow-on damage. The MBAs wanted to save in the order of $30 000 000. Indian rookies did not know the basics of sensor failure validation and they faked a sensor fault test case.

We will see an MCAS level of AI coding desaster and then more responsible approaches will be taken.

India blocks Telegram ahead of scandal-hit medical school entrance exam

Re: Crazies

Until the keys are broadcast, only 3 servants in the ministry know the set of questions. They are hopefully well enough paid to keep the ship from leaking. If not, jail the leaker.

There are much more important secrets kept by much larger teams inside governments.

Crazies

One can see how backwards India is. Punish the mailman for illegal letters. Next time include the mailman WhatsApp, the swiss one and DeltaChat ?

Here is the protip:

1.) Ministry sends the test questions to all test centers, AES/GPG encrypted.

2.) All tests are done at exactly same time. Testees must appear 15 minutes before.

3.) Keys for test questions are broadcast by Ministry 5 minutes before 2.

Then the miscreants can do nothing of value by leaking questions.

Massive password-stealing attack hits 75k Fortinet firewalls

Correction

"exposing a complex, shoddy HTTP interface to the internet" is worst practice. If you just expose a minimalist, proven correct, cipher library, you can do this.

The Problem At Hand (And The Entire Class of Admin-Console Flaws)

...could have been fixed 30 years ago with a mathematical proven correct, KISS cipher library. 2000 LOC C++.

Here is an attempt https://di-fg.de/WhyMST.html

It looks like Silly Valley DOES NOT WANT to do that.

No

We just have to start using well-known computer science techniques instead of QUICK AND DIRTY ENGINEERING.

1.) Well-educated, experience software engineers developing security-critical systems. Computer Science Degree. No more half-educated pastors and chemists.

2.) Well-defined, strictly scanned+parsed languages from machine code to JSON input. No serialization shortcuts

3.) Mathematical verification of critical components such as SSH. See also seL4, CompCert, MST(https://github.com/DiplIngFrankGerlach/MST)

4.) K.I.S.S. instead of SSL/TLS-type of BLOAT.

5.) Memory-Safe, strongly typed Programming Languages instead of the C-Hamburger (also see https://sappeur.di-fg.de/LanguageAnalogy.html)

The bottom line is: the internet accepted your challenge. You will lose.

How To Fix This Once And Forever

Satellites, data center servers, firewalls, industrial control systems (water supply, electrical substations, sewage treatment plants, etc.), sensors, and their control computers require remote monitoring and operation. Remote Desktop Protocol and X11 are among such applications. Clearly, these command interfaces must be protected against unauthorized or hostile access; a wide range of private and state-sponsored cyber actors—such as "hackers" and cyber-warfare personnel—must be fended off. Fortunately, however, there is no need to process potentially hostile data packets at the application layer. This allows the security challenge to be reduced entirely to a problem of cryptographic engineering. In turn, the cryptographic design should be minimalist, thereby allowing its correctness to be mathematically proven.

More: https://di-fg.de/MinimalesChiffrierSystem.html (use GT for a version in your language)

Cisco SD-WAN make-me-root bug under attack

How To Fix This Type Of Weakness Once And Forever

Satellites, data center servers, firewalls, industrial control systems (water supply, electrical substations, sewage treatment plants, etc.), sensors, and their control computers require remote monitoring and operation. Remote Desktop Protocol and X11 are among such applications. Clearly, these command interfaces must be protected against unauthorized or hostile access; a wide range of private and state-sponsored cyber actors—such as "hackers" and cyber-warfare personnel—must be fended off. Fortunately, however, there is no need to process potentially hostile data packets at the application layer. This allows the security challenge to be reduced entirely to a problem of cryptographic engineering. In turn, the cryptographic design should be minimalist, thereby allowing its correctness to be mathematically proven.

More: https://di-fg.de/MinimalesChiffrierSystem.html (use GT for a version in your language)

Cisco adds another SD-WAN box to max-severity bug advisory

How To Fix This Once And Forever

Satellites, data center servers, firewalls, industrial control systems (water supply, electrical substations, sewage treatment plants, etc.), sensors, and their control computers require remote monitoring and operation. Remote Desktop Protocol and X11 are among such applications. Clearly, these command interfaces must be protected against unauthorized or hostile access; a wide range of private and state-sponsored cyber actors—such as "hackers" and cyber-warfare personnel—must be fended off. Fortunately, however, there is no need to process potentially hostile data packets at the application layer. This allows the security challenge to be reduced entirely to a problem of cryptographic engineering. In turn, the cryptographic design should be minimalist, thereby allowing its correctness to be mathematically proven.

More: https://di-fg.de/MinimalesChiffrierSystem.html (use GT for a version in your language)

Claude is his copilot: Rust veteran designs new Rue programming language with help from AI bot

ALGOL is GREAT

It is memory safe and has a Java-like garbage collector. Or rather, Java is the New Algol.

There exist mainframe OSes written in ALGOL. One of them you can still buy from Unisys.

But if you believe the bozos, C and Unix are so much better, because they dominate the market like McDonalds does.

Who needs quiches, if you can get the same $hit burger all over the world ?

Bots, bias, and bunk: How can you tell what's real on the net?

Re: Contrarian View (fg_swe)

Expletive but no argument ?

From this follows: my arguments are valid.

Re: Contrarian View

Why exactly ? You provide zero arguments.

Richard Tomlinson on Disinformation

Remember Richard, former SIS man, who wrote a book called "big breach" (find it with google for free).

SIS and BBC would spread disinformation about their little dissident Richard, labeling him a "terrorist". Which could have killed him e.g in France, when police broke down his hotel room door.

I think Richard was not the smartest cookie(not seeing the cues, rebelling against superior power etc), but labeling him this way was clear and dangerous misinformation.

Voice != Images

I got the same stuff from yt.

To me, most of the voice sounded genuine, but the Images presented were cr4ptastic. He-111s flying next to F-35s in a piece about the F4 and the like.

When you spot disinformation, report to yt. This should alert the algorithm. In theory, at least.

Report and downvote obvious trash.

Yay

Joseph Dshugashvili had a beard, too.

Ok, Then

Why is nobody turning the screws on China, who produce 30% of World CO2 ? Expanding coal use by 1000MWe WEEKLY.

My suspicion is that some powerful financemen have very nice business with both China-production and at the same time doing the CO2 scam in Britain and Germany.

Russia produces 4% of CO2 and have no intention to scale down whatsoever.

Britain about 1.5%, Germany 1.7% or so.

This awfully looks like a hugely successful COMINTERN information operation.

Subsidize

Subsidize a newspaper long enough, and it will sing your tune.

Contrarian View

So the Redtops here want to convince us that Covid vaccine were essentially something great and good. All the products pushed by oligarchs, banks and corporations are essentially something good.. They can do nothing wrong, these commercialists cannot have malicious effect on the mass media.

I claim:

1.) Covid vaccines were dangerous quick+dirty substances pushed by the king of improvisation, William H. Gates. A man without proper, completed education. Not even beancounting.

2.) CDC VAERS WONDER had a very strong Adverse Effects Signal. Factor of 10000 more reports of near-death adverse effects than e.g. Measels vaccines.

3.) Out of my probably 300 acquaintances+friends, at least 2 had very serious adverse effects from Covid vaccine. One near death heart inflammation. Several others reported severe, though not live threatening adverse effects.

I am by no means a communist, quite the opposite. But neither do I think the oligarchs are super intelligent and super above board.

Thank god there are forces who do not worship Mammon.

Frank Gerlach

Brackenheim

Germany

Rosalind Franklin rover catches a break as NASA reaffirms commitment

Aschbacher

Its "AschBachEr" as in Ash and Creek. Literally the "man from ash creek".

https://de.wikipedia.org/wiki/Josef_Aschbacher

Aviation delays ease as airlines complete Airbus software rollback

Re: No

Any proper control unit software engineer operates under the assumption that variables do not simply flip, as this nullifies any assumptions made about the code. Ideally the RAM, the Flash and the CPU itself performs ECC both in storage and in processing paths. The other option is to run a second unit in lockstep and compare the outputs, as identical bitflips in two ECUs is very unlikely.

There is no way a control algorithm can accept a bitflip of control variables or of program code; the outcomes can all be catastrophic.

Re: Indeed

There are some nasty upstarts in that one asian nation, who would love to take over Airbus and Boeing in one swipe...

No

Imagine the bitflip occuring inside your imagined dampening filter. Filter value jumps from 0x0005 to 0x8005. The output of your control unit goes from "minimal" to "maximum" in 20ms or so. In a matter of seconds the a/c attitude goes into a dangerous pitch that will rip the a/c apart. In the meantime your dampening filter went from 0x8005 to 0x8001 - not a relevant difference to save the a/c.

In reality it is probably much more complex PID controllers and filters working together to do the ELAC work. But any bitflip in the PID and the filters will hairraise the control software engineers. They want NOTHING of the like happening in their control codes. They want either immediate reset of the ELAC(in something less than 300ms) or a switchover to the Other Elac.

"until you leave the flight envelope"

This happens in a few seconds with maximum elevation of the horizontal stabilizer at full speed. A major aspect of this control unit is to keep the a/c pitch inside proper limits. A control algorithm only works as long as there are no unchecked bitflips... See the problem ?

Re: Details, Aerospace Software

Can you provide more details ?

Re: Radiation Testing Services

Not hard to come up with a experimental rig for this purpose. The hardest thing will be to convince the MBA sitting on the purse. Can be done for less than 100k dollars, if you have access to Boeing and Airbus scrap parts.

Guess What, Genius

It is your job as a proper development engineer to find contradictions and bullshit, discuss with customer and then change the requirements document.

THAT IS YOUR MOST IMPORTANT VALUE CREATION.

sorry for shouting.

Re: Radiation Testing Services

Boeing also seems to have exquisite capabilities and a network of even more exquisite partners to do radiation testing

https://www.boeing.com/specialty/radiation-effects-laboratory#accordion-7aa0d0df7d-item-bfd8ce86b9

As I wrote above, some radiation sources need national labs capabilities.

Radiation Testing Services

Quick search with AI yields companies like this:

https://radiationtestsolutions.com/services/radiation-effects-testing/

https://www.northropgrumman.com/what-we-do/space/launch-vehicles/launch-vehicles-and-propulsion/testing-for-success

It seems the capabilities already exist, ready-to-use, but some MBA beancounter decided it was not necessary to contract them.

Indeed

Airbus and EASA are stonewalling on the exact details of this failure mode. I guess they consider control unit engineering to be their secret sauce and fear they could advance the competition by telling too much.

My best guess is that L104 removed a redundant RAM storage+computation path, which would detect and mitigate the bitflip.

Or maybe L104 simply turned off ECC by accident. This would align with their decision to perform a hardware replacement of older control units. They probably have no ECC at all.

But then there is the Airbus philosophy of triplicate and higher control unit redundancy. Why did that not catch the bitflip ?

Assembly Code Review

Of course machine code review will only be done for highly safety-critical parts of e.g. a flight control system("FlugLageRegler") and probably not on less critical things such as the radar, the radio and the like. Focus efforts on the most important parts and relax it on the lesser ones. Basic rationality goes a long way.

Re: Protection is ideally done by hardware, but can also be done in software

In aerospace software development you do not blindly trust the compiler, rather you will review every single line of Ada code and resulting machine instructions.

And you will test the effectiveness of your measures by a realistic particle/ radiation beam, which simulates hundreds of years of a/c operations in a matter of days.

So ? You want the pope to fly on a more dangerous plane than others ?

Quite dark view of humanity. Too much Marx Intake ?

So ?

Put the control unit behind a properly designed armourplate/water tank to get the required radiation spectrum and particle count.