Schneier on Security

Clive Robinson • November 5, 2021 3:28 AM

@ MarkH, ALL,

If an author doesn’t take what s/he is saying seriously enough to express it plainly … then why should I take it seriously enough to read it?

Because you have entirely missed the point.

In the world of “Unicorns and Rainbows” where clouds in the sky are seen as real estate to build castles thus fiefdoms the ability to say what you like freely is an utter illusion.

Your assumption of “If an author doesn’t take what s/he is saying seriously enough to express it plainly” is actually as absurd as “If you have done nothing wrong you have nothing to fear” and for the same reasons.

If you think enough about Cardinal Richelieu’s most famous quote,

“If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.”

You will realise that in a way he has a potential claim on being the father of that illegitimate child “Plausible Deniability” and many other manners of veiled information communications.

As you should realise from posts I’ve been making about the down side issues of using cryptography and thereby painting a target on your back.

An area of research I am undertaking is methods by which the redundancy in plain language can be used to transfer information secretly whilst having it fully in plain sight, but more importantly possessing not just plausable debiability, but protection by against betrayal by either the first or second party in a communication to a third party.

Look on it as a different direction and extension of Gustavus Simmons “Prisoners Problem” he outlined at Crypto 93 and published 1984 paper[1].

For some reason it is an area that either little or no research has been done since WWII or those that have, have for some reason not talked about it.

Communications Security does not, nore can not, exist in one layer, unless it is by denying all layers simultaneously in which case it communicates no information.

So what you see as “a cottage industry” is actually part of research.

For instance @Wael and @Ratio spent considerable time investigating how to establish a covert channel, without actually telling each other how the channel worked, using redundancy in Unicode, that can easily be seen as a predecessor to the work Prof Ross J. Anderson has recently publishe that is the subject of a thread here a few days back.

@Wael started his work with @Ratio because of the way we communicated covertly by using common knowledge domains (using the works of Shakespeare). Also from conversations we had previously had with @Nick P and others about ways to sign posts to this blog effectively subliminally. Which oddly perhaps had it’s roots in the Friday Squid page where @Nick P and I used to swap somewhat questionable stories, that also amused others. It did go wrong on one occasion when someone asked for a little clarification (I shall name no names but “yellow card” tells much). The result was our host took interest and was “shocked”.

OK so you have not seen it as research that is going on quietly (that is actually often way more interesting than many of the threads it appears in). You have noticed something going on… Whilst some may think this reflects badly on you, atleast you were aware that something was happening over the years, which is a lot better than most.

I guess some of us will have to “up our game” so those third parties don’t notice.

[1] See, “The Prisoner’s Problem and the Subliminal Channel” in,

https://en.m.wikipedia.org/wiki/Gustavus_Simmons

Clive Robinson • November 5, 2021 1:45 PM

@ Ted,

They have a self-made book they are using that is called “gapped notes.”

Ahh it’s been a while…

A little on “learning theory”,

It is a well known assumption that students do not read “hand outs” untill just before exams… Worse even if they do they won’t have the basics learned that makes the hand outs comprehensible in a fluent enough manner.

It is also a well known assumption that students do not realy comprehend what is said to them in lectures.

History shows that making students “learn by rote” that is write everything out in longhand works for getting the basics in their heads. But is too slow for modern education requirnents (you are probably being taught facts and methods at about twice the rate of a student 20-40 years ago due to scientific progress).

Another aspect, is the ~10:1 ratio between books and papers, hence the saying,

“There are only 20pages of essential information in a book”.

That is only 1/10th of a book is in effect “new” to someone already well versed in the knowledge domain. The other 90% is aimed at getting a less well versed reader upto speed.

So noting the assumptions above you can see how the idea of “gapped notes” came about. Where in amongst the apparent verbiage you write in the nuggets of essential knowledge.

Does it work, well I’ll be honest and say I’ve not got a clue, and I don’t remember ever seeing anyone else say much on it…

As for,

Do you have a strategy for reading complex material?

Yes. I used to be a very prolific speed reader, I’d read the equivalent of one textbook (programing guide etc) a week, three to five paperbacks depending on how I was getting about, and around 300-400 pages of technical information. Most of which I could recall quite accurately and say “page XXX, paragrph Y sentance Z etc.

It kind of made me very employable last century as it was quicker to ask me than it was to ask a librarian or try using what was by todays standards quite primitive search tools (look up WAIS and Z3950 if you feel like a little culture shock). But more importantly I could interpret both wooly enquires and complex data for people.

Then in 2000 I was attacked on the way to work one morning and my head was karate kicked (according to witnesses) into a metal pole with a street sign on it. The result was a full fracture of the lower jaw, a break that the maxiofacial surgeon said was very rarely seen on live people. To be short it resulted in me being unable to renember what I was reading after about a paragraph, and a slower than normal reading speed and a vwry distinct change in personality. Oh and an intense dislike of groups of people on streets especially teenagers, that the “specialists” put down to “latent agrophobia” what ever the heck that means[1] combind with “cognative overload” from “hyper alertness”…

So there I was as an adult who’s livelyhood was very dependent on aquiring information, who to all intents and purposes could nolonger remember what I was reading… However I could remember just about all I knew before the attack, and I had no problem writing or reading out aloud…

So with unemployment beconing from a very high paid job I had to find a solutuon, as I could not fake it for long… Neither the “trick cyclists” or neurosurgeons were of any help…

By chance I realised that two things worked to get things into memory,

1, Read it out aloud a couple of times.
2, Transcribe in longhand.

Neither were particularly fast. My spending on books dropped from the today equivalent of $6000/year to next to nothing.

I had no choice but to change jobs back to being a “design engineer” of transmitters, secure equipment, surveillance devices, and the like as the required reading was a very small fraction of that of a ICT security systems design/development consultant/manager.

Over time I’ve effectively learned to re-read and I’m now a little bit over where you would expect a professional of my age to be. Strangely because the ICT industry for some reason fails to learn it’s history my long past knowledge becomes current again over and over… I just have to stear clear of the madness that is the proliferation of programing languages and lunacy of “kitchen sink” libraries, that have all the apperance of having been cranked out by an organ grinder’s monkeys[2] on some extract of cactus juice…

But to answer your question, you first have to get the foundations and basic methods if any knowledge domain nailed down.

As far as I’m aware writting them out long hand and reading them out aloud when you are alone, are still the best way to do that, along with practicing the nethods over and over.

Once you have them fixed in your mind you can move forwards. For many they are learning not to work but pass an exam. So the methods differ.

For exams, it’s the old “question cards” and a method to best utilize them. Basically you have a stack of cards on one side of each is a question on the other an answer.

So the question on one side,

What are the two basic types of law under the English judicial system?

And on the other side,

Tort, arises from a failure to forfill a private duty.
Criminal, arises from a failure of a public duty.

You pick a card of the stack read the question then “say out loud” the answer. Turn it over, if you got it wrong put ir in a pile to the left of the stack, if you got it right it goes on the pile to the right.

When done shuffle the two pules seperately and remake the stack with the shuffled left pile on top.

When you have only a pile on the right, put the cards away and get them out the next day and start over.

That gets simple facts and data fixed in your brain, it does not work for moderately complex or highly complex facts or methods.in both cases it’s “write’m in long hand”. That is you write down mini essays for moderately complex facts and do worked examples for methods.

Do not under any circumstances do more than 20mins at a time, then take a ten minute break. So two sesions an hour for two hours at a time and no more than three times a day.

If you stick with it, it generally works.

The trick with highly conplex facts/knowledge and methods is to break them down into much smaller and thus managable chunks. Work out which are foundation chunks and learn them first, then like a brick layer work your way up from the foundations one layer at a time.

However before digging in deep tey writing a mibi essay that is the eqyivalent of a 20,000ft view. This kind of helps you see how the blocks relate.

In a way it’s kind of like the process behind both design and project managment.

Hope that helps.

[1] This was the “state of the art” for practitioners back at the turn of the century,

https://pubmed.ncbi.nlm.nih.gov/1636806/

If you read the conclusion and thibk “No 5h1t Sherlock” you will understand my exasperation.

[2] As they say “That’ll ruffle the feathers on a turkey”, so expect as it’s Nov 5th, there will no doubt be fireworks. And we all get to chant “gunpowder treason and plot” around the fire,

https://www.dltk-holidays.com/guyfawkes/mpoem.htm

Though not the last verse, like the redacted verse of the English National anthem it realy does ruffle feathers,

https://www.historic-uk.com/HistoryUK/HistoryofScotland/O-Flower-of-Scotland/

Clive Robinson • November 7, 2021 6:45 AM

@ Ted,

Orphaned?

Yes, both my parents died within a few months of each other shortly after I had started what was then higher education but before I’d reached what is for some reason called “the age of majority” so I had to be adopted…

Fun times not.

There have been other “earthquakes” in my life, and whilst you can not predict them you can atleast prepare for some, and with time turn even the bitterest of lemons into something more palatable.

Ever asked what the most important “Security Criterion” is?

Well it is (no mater what others say),

“Survival of a system in the face of adversity”

That is a system has to be resilient, and that applies to the human system at all levels as well as the technical at all levels. So the most important rule in both life and security is plan for the earthquake moments and build in resilience to meet them. Hence the expressions “Ten year Storm” and “hundred year Storm” you will get to here at some point in systems design.

It’s why when I advise students about the projects they should pick I give them a little life advice as well.

One is, being engineers that if they are any good, one or both of two events will happen in their proffesional life,

A, They will be made unemployed.
B, They will strike out on their own.

And that they need to prepare for six moths to eighteen months of no income or assistance to get back on their feet, hence they need,

“A year and a half of ‘drop dead’ money.”

Also one half will statistically have a life changing event that will knock them or their family off their feet, so they need to make preperations as they go along.

This is sound advice to every one, and not “SHFT” thinking, it goes back to the times of our greater grand parents and started centuries if not many millennia before that.

As I’ve indicated in the past I have a Doctorate of Divinity from one of those “back of a cornflake packet universities” that existed in the US[1], even though I have no belief in deities and the rest of the power grab nonsense of churches and cults. However I did honest research about the morals and life rules and why they exist[2].

More than one religion has as a basic tenant the storage of a years supply of food water and four years supply of seed crop to see people through the lean times in an agrarian based society.

What is different in modern times?

Well we assume that food will always be on the shelves. Well as we’ve recently seen that is not a wise assumption for quite fundemental reasons.

We also assume that we can pay our way out of future problems via insurance. Well as we’ve recently seen that is not a wise assumption for quite fundemental reasons.

I could list a great many more but the part that remains constant with each one will be,

“that is not a wise assumption for quite fundemental reasons.”

What are those reasons? Well many will argue, but the one top of the list has to be,

1, Hierarchical control structures.

Then

2, Abdication of responsability.

Then what some call,

3, The dark triad.

Of mental disorders that are significant in some (psychopaths, sociopaths, narcissists, sadists, and similar that prey on others that sometimes get called “Hawks”).

4, Authoritarian following.

These are those that do the biding of others, and so alow the building of “guard labour” that is an instrument of both fear and oppression against who ever it is directed.

You realy do not need anything else as the roots of other things are grown in the soil those four make.

Thinking about 1&2 tells you that you have to be responisible for yourself and your family, and that it is best to keep it as secret as possible from others. Which gives you the fundementals of OpSec.

Because thinking about 3 tells you how they think about 1 and how 4 is their enabler.

And so on. We also know it’s a system that is doomed to fail. Over countless millennia “nature” by evolution has found that whilst there is growth in such a system, it fails to random but probable events, or it becomes fragile and just breaks for various reasons.

Nature appears to have developed a 2/3rds rule for systems I won’t go into the maths that shows it’s valid but it appears that ~2/3rds is the optimum for many things including efficiency and even “water rockets”.

So the idea of supply chains or any queuing system can be 100% is a nonsense, which means the 100% utilisation of resources is also a nonsense, you have to keep reserves to see you through not just the lean times but those rarer earthquake times, you know they are going to happen and they do fairly regularly if your timescales are large enough but are compleatly unpredictable in much shorter time scales.

One thing is certain though is that despite warnings, society has through 2 alowed 3 to take away resilience from the majority of society,

“It is the common fate of the indolent to see their rights become a prey to the active. The condition upon which God hath given liberty to man is eternal vigilance.”

From 1790 by Irish orator John Philpot Curran.

“There is an imperialism that deserves all honor and respect — an imperialism of service in the discharge of great duties. But with too many it is the sense of domination and aggrandisement, the glorification of power. The price of peace is eternal vigilance.”

Attributed to Leonard Henry Courtney, 1st Baron Courtney, who more famously gave us,

“Facts are facts, and although we may quote one to another with a chuckle the words of the Wise Statesman, “Lies — damned lies — and statistics,” still there are some easy figures the simplest must understand, and the astutest cannot wriggle out of.”

Yet we alow them to do so hence “fake news” we see so much of.

[1] Yes there used to be a lot of them you payed them money wrote a 100-400 page thesis and you would get issued a qualification that you could hand to your HR department etc. A few years ago it created a scandle in the US State and Federal Governments, apparently very many people had them. Not realy surprising it’s the basic law of economics, if there is demand then the supply will appear. If you bring out rules about employment then you create restrictions thus your arbitary rule limits supply in some way that creates the demand and a lot of other problems. It’s why I’m all for “equal hiring” but against the idea “positive discrimination” quotas.

[2] For instance “ingestion rules”. What some call Kosher foods, are not from one faith you have halaal foods amongst many others they often have basic or fundemental similarities. Which have since been found to be scientifically valid despite the pronouncments of the medical proffession. The next one I suspect will finally be alowed out is “short fasts”. The medical profession backed by the food industry pushes lots of little meals every day which is easily provable as harmful. Many religions however promote regular short term fasting which has not been shown to be harmfull despite many attempts to do so. So we have an epedemic of obesity and lifestyle diseases all around us in the west even though we apparently live longer. However studies have shown that those who participate in religion live longer than others, and some evidence suggests they have a lot less life style diseases hence expensive interventions… One of the most expensive life style diseases in the US is diabetes, and recent research shows that fasting provides ways to control it with out the eye wateringly expensive drugs and by following those food rules…

Clive Robinson • November 7, 2021 10:22 AM

@ Ted,

I pray you felt especially acknowledged and loved by your adoptive parents.

As I said “fun times not”. I won’t go into details, but I understand the abusive nature underlying the idea of slavery and indenturedhood, and how even your legacy can be stolen away from you legally.

But worse how those that abuse think that they must be forgiven because they claim to have found god…

You can dye the pelt of a leopard or dalmation, but in time the spots grow back just as befor.

People can change, but it takes a crucible to do it, there is a saying that translated into English is,

“The hammer that breaks the glass, also forges the iron”

So the real questions are,

“What comes out of the crucible, not what went in?”,

“Was the crucible hot enough to effect change?”

If people are sufficiently cold, there is no crucible hot enough that can cause them to change even unto death.

Something people should wisely learn from orhers hurt, and not have to endure their own.

There is a legal way out called “emancipation” but you have to have the means to buy your freedom, which is difficult when it is legaly taken from you,

https://legal-dictionary.thefreedictionary.com/emancipation

Freedom has a price few can afford as long as others can legaly take all that you have. So even though we claim freedom as a right it is not a gift that is bestowed, it is continuously taken from us by those that would do us harm, it is the principle of “kings” and the games they played through guard labour. The latest version is the hidden hand of the free market, devaluing money and aquiring assets to rent-seek to keep society in check…

Clive Robinson • November 8, 2021 2:41 AM

@ name.withheld…,

s/Maxwell/Clerk Maxwell/
s/German/Scotish/

Clive Robinson • November 9, 2021 8:07 AM

@ John,

For me this was that path that allowed me to return to sanity.

Some years ago now back in 1986 there was a film called “Crocodile Dundee” and there was a scene where mental health gets mentioned.

In it Mick Dundee (Paul Hogan) is listening to Sue Charlton’s (Linda Kozlowski) explanation of having a friend who sees a therapist. Mick looks at her and says

“Hasn’t She Got Any Mates?”

Sue,looks suprised and says

“You’re right. I guess we could all use more mates.”

Then asks Mick,

“I suppose you don’t have any shrinks at Walkabout Creek.”

Mick smiles in a soft way and replies

“Nah, back there, if you got a problem, you tell Wally. And he tells everyone in town, brings it out in the open, no more problem…”

It’s stuck with me for over three decades as it’s another side of “It takes a village” observation.

Apparently I’m not the only one it’s stuck with,

https://silverlobster.wordpress.com/2016/06/03/hasnt-she-got-any-mates/