Schneier on Security

Clive Robinson • March 21, 2022 6:57 PM

@ Ted, ALL,

I’m trying to figure out who wouldn’t want to know about a known malicious module in their software.

What your statment is asking for is a “Quality Asurance”(QA) Process which stops a “known malicious module” getting in in the first place. Is an entirely seperate thing to a SBOM.

The SBOM is just a “manufacturers component list” little different from a hardware BOM. In both cases it indicates a probable source of a component and absolutly nothing to do with the quality of the component.

Imagine if you will the Ford Pinto motorcar, Ford’s first “subcompact”. It’s BOM indicated a fuel tank as part of the fuel chain, who made it what batch it came from and date of manufacture. It indicated nothing as to if it would turn the vehicle into a “One ton cremator” under certain conditions. It took a number of mid highway cook offs and a Mother Jones article “Pinto Madness” for it to become of concern to first the public, then later those with consumer protection interests, then finally a national agency to actually indicate that it was a danger to anyone who got in one[1]. Importantly the BOM in no way identified and design flaws, as it was not the individual components at fault.

So the SBOM only becomes vaguely relevent, after the event has happened repeatedly and been identified in other ways. And mostly the SBOM is not relevant then unless a specific identifiable component is at fault. It’s actually of even less use than code signing, which I’ve had a “downer on” for decades, and it was not long ago I was proved right in all aspects of my scepticism to code signing.

In mechanical engineering components are manufactured against a reliable specification and are tested not just by the manufacturer but major users of the component. In some uses involving members of the public the component is tested “in use” repeatedly and or replaced on a regular schedual as part of “preventative maintainance”.

Such continuous testing carries atleast three basic penalties,

1, People
2, Time
3, Cost

That is more qualified people are required, the time to delivery is increased, and the cost is also increased. All three of these are seen as something to be not just reduced in the software industry but reduced below the point of “lip service”. The result of such an ethos can be tragic as some people who were friends and relatives of those on certain Boeing aircraft have found out.

A SBOM will not stop such tragic events happening in the first place, only correct engineering processes worked out over a century of response by science to failures and tragady will work towards that.

Artisanal design is about “patterns” seen in the design of wheels for horse and other animal drawn vehicles. The patterns took several millennium to reach a point of design that was at best sub-par. With science the design of wheels has moved beyond what was imaginable less than half a working life time ago. It should be noted that much software is produced by “patterns” not by either “science” or “engineering” processes.

[1] The Pinto crushed up design, the desire to get it to 2000lb dry weight and Ford changing the design process to one that halved the previous design times have all been blaimed. Likewise the changing national 301 standards during the design and production life. But the fact is statistically it was like every other US subcompact of the time. It’s been said that the real cause of the problems was not the fuel system but the drivechain that caused the Pinto to stall out when moving in fast moving traffic, thus subjecting it to rear end shunts at way above the forces used in even the most exacting of the Nationaly required tests. The reality is journalistic sensationalism and political shenanigans and the then US regulator putting their thumb on the test scales by modifing the way they carried out the test to cover their own a55.

Clive Robinson • March 21, 2022 9:27 PM

@ SpaceLifeForm, ALL,

Stay out of Dependency Hell as much as possible. Do not use Live code that you don’t host yourself.

I guess the question now is,

“Who is going to go over to,

https://github.com/npm/npm-expansions

And add ‘Nukes Peoples Machines'”…

Clive Robinson • March 22, 2022 6:37 PM

@ Gambler,

Modern software is based on a lot of untenable assumptions. No one wants to re-evaluate them, so eventually the whole ecosystem will collapse.

Of your three point the short answers are,

1, Untenable assumptions = Yes.
2, No re-evaluation = Yes.
3, Economy will collapse = Maybe.

The game as you note with,

They just hope to extract enough resources out of the current system so they can survive its downfall.

But actually they care not a jot about the downfall…

They believe that they can take the value and “skip out to somewhere or something else”.

That is they do not believe in “total colapse” just “partial colapse” and they think they will be “smart enough to know which bit will be colapse proof”.

If you have any doubt about this look up the long history of “water rights wars” and who currently are buying up all the water rights they can get their hands on legaly, by illegal extortion, or force majeure.

But I’ve predicted for over two decades now that whilst history has “water wars” as the ultimate control via denial of agriculture etc. I’ve been looking at “energy wars”. The US has since the 1980’s been running as a matter of foreign policy a way to control the worlds energy supplies, not just the dwindling carbon fossil fuels, but nuclear and more recently “alternative” energy sources.

This “control of energy” is yet another form of warfare, some would say worse than “bombing them [nations] back to the stone ages” to stop independent economic development, thus the ability to get out from being the equivalent of vassle states for the US and other alleged Super Powers. The point being as water is fundemental to agrigulture thus feeding your population, energy is fundemental to any kind of industrialisation that lifts your population out of poverty and enslavment/serfdom.

Thus a plan thought up by the economists behind the German National Socialist party, carried on into the current EU. Put simply quite a number of industrial regions can not feed themselves, so they are actually vulnerable to food supply control[1]. So the plan is foist huge debt on certain nations so they are forced to remain agrarian and feed the industrisl regions at low cost. Look at what has happened in the EU with the North beggering the South and asset stripping them of any viable industry. In a smaller way look what happened with Spain and the Catalan. Most of Spain is bankrupt beyond recovery, so they are doing the “Parisitic Empire” routien on the people of the Catalan[2].

[1] Something not lost on Putin, see what petcentage of the worlds grain comes from Rilussia and the Ukrain combined.

[2] Which is the fate Russia keeps inflicting on other parts of the world. Putin’s “Strong Russia” is predicated on slavery anf serfdom and worse. Basically what Russia has always done for the last 600years or more, rather than actually develop a real economy. The fate of Russia is always the colapse of it’s parasitic empire. You only have to look at the history of Spain to see what is going to happen to Putin’s Russia. He can not avoid it and stay in power…

Clive Robinson • March 23, 2022 11:30 AM

@ Bob Paddock, ALL,

With regards,

In the end the only thing software licensing will do is enrich lawyers and drive software development to places without such regulations.

You forgot to mention that the users of software will also move, so it will not be just software developers moving to eastern mongolia or some other such place, other jobs will go there as well due to keeping supply / manufacturing lines short.

Software licencing is as silly an idea as saying you have an “Engineering licence” that covers all asspects of engineering.

You would need hundreds if not thousands of different domain sublicences, many of which would overlap in many odd ways. Thus you would need a hierarchy of licences with foundation licences.

For all the fact I deride the artisanal way of software development and say it should have a more engineering focus (which it should). Software developers actually have to know way more than Drs, Lawyers, Accountants, and most other “profesionals” because there are no stable niches in which you can stay and become a life long expert, many come and go in a very short time. The reason is the “software industry” only became an industry maybe fourty years ago, and it has not developed even usable “metrics” yet. In engineering terms that takes you back to the days of steam power, where any half way competent aryisanal wheel wright or blacksmith started making boilers.

Engineers and science as we know them were born out of death and destruction created by artificers who did not know there was a better way, and they all wantd to cash in on the future…

Well two major things are different with software and boiler development,

1, In the main awful as it is software does not cause destruction and death (well OK when peoples rage boils over or the stress turns their arteries to pipe clay).
2, We know there are way better ways to do software development (but they take time and resources which managment don’t want).

When you talk to software developers that have degrees and higher degrees, many did not go down the CompSci route, software was just some part of what else they were doing. Further they know there are better ways, but unless they are in very niche areas such as ultra critical safety systems, then they know managment won’t go down those routes…

Where we realy need licences is not in the software development and support people but in those who manage them…

Clive Robinson • March 23, 2022 9:40 PM

@ JonKnowsNothing, ALL,

All of “Western” Europe (and North America) have all tried to get Russia to develop a “real economy”, meaning One Exactly Like Ours.

That on it’s surface is a form of “tribalism” which is not what is needed, in fact it’s about the worst thing possible for all of us.

There are three ways a “tribe” can exist long term,

1, Self sufficient thus issolated if they wish, and are alowed to be.
2, By being a parasite, in one way or another, what you might call a “criminal enterprise” which is the way of those we alow to lead.
3, By trading with other tribes, allowing the build up of expertise that would not otherwise exist, and the forming of an interlocked commonwealth by which all move forwards equitably.

What you semi-sarcastically call “One Exactly Like Ours” is actually “us” being a parasite off of “them”. As most know where there is a “them and us” viewpoint trouble follows every time.

It is a way of oppression and theft, where “we” force “them” into being a vassal state of slaves and serfs, so we can “asset strip” them and leave them with nothing of worth. There is no “long term” existance in that for “them or us”.

Call it a “Deniable Empire” where “we” take the benifits but give non of the “protections” or benifits to “them”. But most importantly “we” use it to pretend we are some how the occupiers of the “Moral High Ground” where as in fact “we” are being about as bad as it can get on the evils of “might is right” spectrum, whilst fooling ourselves we are being “beneficent” etc.

Such hypocrisy was given a name back in the 1800’s it’s called “Playing the White Man’s Game” and a look at the activities of the “merchant venturers” through history will tell you a lot about how it fails.

Such Empires always end, as the flow of treasure / spice is one way by oppression and it becomes endemic. So such Empires are unstable and often end badly. A look at Spanish history through to what they are still upto tells you just how iniquitous and destructive such behaviour is.

The underlying problem is a “parasite” does not evolve inteligence, or skill or move forward. It gets trapped in a mindless cycle of bloodsucking, rapacious behaviours from which it can not escape.

The reason is to quote the words of a song,

“The subtle whoring that costs to much to be free”

Of lazyness and indolence, in the good times the treasure flows in and it is used foolishly to buy pointless status symbols, thus the treasure flows out. The problem is gain by buying is not sustainable only gain by learning and applying knowledge is.

That is to be sustainable each participent in trade has to have a “value added” process. It is the excess value from that process that in part sustains the population in the present, and the rest if invested “in our future” rather than squandered in our present makes it sustainable.

The other issue is resources that become waste, have to become resources again in a bound environment, which the Earth effectively is.

Appart from energy that comes from the Sun, we live in a bound but leaky environment that is actually “running down”. That is we are loosing to space noble gasses like helium, hydrogen etc as well as life sustaining gasses and molecules. At the other end radio issotopes are decaying down towards the likes of iron. We are lucky in that we have a moon that imparts energy into our planet and keeps the core molten which in turn gives us a significant magnetic field that creates a bubble around the planet that deflects much of the “Space Weather” that would otherwise have stripped our atmosphere away by now.

So we have a dwindling set of resources, a growing population and a realy bad non recyclable polution problem.

That is few realise that the ultimate form of polution is the heat from ineficiency of work. Every thing we do is “work”, and requires energy input, but it is all inefficient. Which causes energy to go from a coherant usable state to an unusable incoherant state of random movment or vibration of atoms and sub atomic particles by a number of processes the dominant of which is radiation transport. Together those processes give us the effect we call “entropy”. That random vibration is what thermal energy is and if it can not radiate away, then by logic the planet will heat up. Thermal energy by it’s very nature is “destructive” thus adding to the overal entropy effect. How we reduce this is currently a matter of some debate, with many behaving the way Nero was alleged to do, which is “Fiddle whilst Rome burns”.

If such people are alowed to have primacy, then the end will come rather quickly. Trade by which knowledge is gained gives sustainability of the resources we can hang onto. Unfortunately that is not enough, as resources are being lost.

Only knowledge and it’s application through science and engineering will get us to the point we can,

1, Reverse the resource loss.
2, Sustainably manage thermal polution.

If we don’t then we know we are doomed by simple logic.

Howrver there is another issue that is even more contentious which is “population growth” that has enabled us to hide another issue which is “increasing life span”.

I’m not going to go into them but I know you are aware of just how contentious they realy are (from HIP discussions).

The upshot is two things are needed to ensure the survival not just of humans but the ecosystem we call earth,

1, An equitable commonwealth.
2, Getting out of the gravity well.

If we fail to do both whilst we still can, then the Earth’s fate is sealed. Then the only subject left to argue about would be when and how, it will end for “all of us” not if.

Clive Robinson • March 25, 2022 7:41 AM

This would be funny if…

It were not so serious,

Somebody has tried to get at thousands of MicroSoft Azure developers via NPM…

https://www.theregister.com/2022/03/24/developers_using_microsoft_azure_targeted/?td=keepreading-top

They have probably had atleast 10,000 opportunities to catch people on the hop…

Clive Robinson • March 25, 2022 5:03 PM

@ SpaceLifeForm,

As I noted 4 days ago…

Yup.

But it’s worse than that… They insist the handling of the SBOM can only rationally be done by “Robots and tools”…

Well how do I put it…

A human seeing the version number of a part jump massively, would more than likely say,

“Hang on a moment why?”

Thus dig further, and ask others.

A robot/tool just checks “which is bigger” and thus gets slamed off the rails of any journy to a local repository to some distant place of hurt and pain.

OK I think we can expect the tools to get some kind of update to reduce this specific issue in future, but it’s going to have lots of issues in ordinary usage…

But that’s not the point, people need to consider. Consider a human mind with leys call it malicious intent, will think up ways to cheat any automated system out there that is above even rudimentary complexity (and version numbers easily crosses that threshold). Importantly those of malicious intent will carry out tests with thos “robots and tools” till it finds a way that works, then they win (and always will do[1]).

We see this with Malware and AV systems.

The thing about SBOM’s is they are at best a very lousy “audit system” that without one heck of a lot of human interaction will fail and fail over and over again…

The reality is the people thinking this SBOM nonsense up are at best on an “academic self-abuse trip” and those they work for/with see a new “Enterprise Tools” market to fleece lots of money with.

If people think I’m wrong then three rules apply,

1, They have to say specifically what they don’t agree with point by point –with no hand-wavery.

2, They have to, evaluate with logic and present their formal reasoning.

3, They have to stick around when things with SBOMs inevitably fail to do anything other than past tense audit, and go through why their reasoning failed.

[1] To see why draw up even a modetately simple specification. Then work your way through every potential state transition and write a bullet proof state machine… Only you will find you can not do that, for a whole heap of “usability issues”. Oh and folks please do not imply “Machine Learning” or “AI” will solve this… We already know it won’t currently and if history is anything to go by won’t any time soon if at all…

Clive Robinson • April 18, 2022 5:47 PM

@ Michael Vielhaber,

Only remedy I see (for the critical stuff, rest is and will be doomed):

Every thing is “doomed” in one of two ways,

1, It evolves into something better.
2, It comes to a cessation.

The first is “evolution” the second covers several things but most important is “entropy”. Like it or not eventually evolution has to come to an end, as it requires work to be done.

Entropy is the decay of energy states from coherent to incoherent. Work can only be done when there is sufficient coherent energy available above the incoherent thermal background.

As for,

LESS People.
Smarter people.
Real software engineers.

I’m known for my view that “software engineering” is not “engineering” nore is it something that is done by far the vast majority of developers and coders. Put more simply the majority do not follow any recognisable engineering methodology.

Is that their fault? Mostly no, it is the fault of consumers, shareholders and managers. We’ve been through the arguments for and against this many times on this blog. The result is usually, reason and logic -v- wishy-washy argument that somehow engineering fundementals do not apply… Because well “software is creative” endevor followed by hand waving and that people tend not to get injured or be killed by bad software, so it’s somehow acceptable.

Which brings us to,

That implies mostly male, white, not too young.

Which in the main describes people who do the “engineering / science” methodology on which we build the real physical world. Not the “artisanal patterns” of try and try again of hunt and peck solutions that still in many cases bares no relation to physical reality.

The question thus is “Why the specific group are of this type?”.

Something that has been noted since the late 1980’s is engineers tend to have high IQ’s but lower “social communications” skills, and be quite a bit further up what we now call the autism spectrum than others. They tend to have few what they consider “real friends” but the normal levels of people they are acquaintances with. They also tend to get not just married later but have children later in life. Further that engineering had a parent to child pass on (about 15% higher than other occupations).

It was this “late children” that for a couple of decades various investigators assumed might be the root cause of engineers being higher on the autism spectrum including the “Old gametes are bad gametes” and similar arguments. Something that is now increasingly seen as a false notion.

Which brings us onto,

That implies no trans-stuff, no codes-of-conduct. No diversity mixing.
Go woke, stay broke.

All societies have “codes-of-conduct” they are a fundemental part of any social grouping. Anyone who puts “Personal Rights above Social Responsability” is generally a self entitled person who sufferes from one or more of the “dark mental deficits” of narcissism, sadism, Machiavellinsm and being a psychopath. Resoning and logic deduction tend not to be high on their list of attributes.

As for the various SJW activities, in times past we had “Political Correctness” and before that various other sniffy type “I’m more moral than you are” type behaviours.

On analysis such people are not the success in life they think they should be or particularly held in the esteem they believe they are entitled to (unsprisingly). By and large they are disruptive in their aproach to life and insist their view is somehow more valid than anyone elses, that rules do not apply to them etc. They get called many things such as “Passive Agressives”, “Karens” and similar. Because they tend to be petty and small minded and suffer from stunted or abnormal behavoural development and have a strange form of vanity.

Because of their often limited abilities, the are very careful to avoid anything where logic, reason or plain facts will show up their inabilities. They can not live in an environment where they might be held accountable or shown to have been wrong. Thus they “crab sideways verbally” and do not commit on paper on any other way in which they might be shown to be wrong. If challenged they will blaim others, usually by saying the other person did not understand or just flattly denying.

They are therefore actually very bad at most things required for group functioning or any kind of success in life as individuals or otherwise and their relationships are almost always nonfunctional. More formally they suffer from a form of Narcistic Personality Disorder (NPD) and exhibit “Passive Agressive” behaviour traits that can become indirectly or sometimes directly physically agressive, if they think they will get away with it. You will find such people get sent on “anger managment” courses, as few actually want to deal with them other than by avoidence (the wrong thing to do).

I’ve been told they are attracted to certain types of activity, one of which is “talking about organising” rather than actually organising or coming up with workable methods to achieve desirable outcomes. So not “meetings about meetings” but meetings about the organisation that should be considered for “meetings about meetings”[1]…

The point is these people will gravitate to where their “ego food” requirments are likely to be met. Unfortunately those who lack the “social communications” or similar skills will be seen by Karen’s to offer an ideal environment for their existance. Any worthwhile manager, should be alert to the warning signs and exert appropriate managment early and unavoidably[2]. Often a Karen will realise that they are not going to get what they want and will move somewhere else and if they won’t go their inability to “follow the rules” will fairly quickly lead down the disciplinary path.

Oh and one thing just to be clear the term “Karen” has no implied gender bias, the behaviours are found in as far as I am aware all human genders, as it’s effectively predicated on an underlying “state of mind” such as one of the “dark mental deficits”.

[1] A friend who’s proffession it is to deal with the more extream forms of NPD pointed out that those further down the agression scale are the sort who would get on “make-work committees” and if given the opportunity would “Discuss endlessly in the minutest detail the shade of green best used in all lighting conditions to indicate biliousness on a poster warning that you might get seasick on a cruise boat…” a turn of phrase that has for some reason got forever stuck in my head 😉

[2] Have a read of,

https://thenarcissisticlife.com/the-passive-aggressive-narcissist/

About halfway down there are a couple of lists of traits that once you are aware of them you can “plan for the trouble to follow”. Avoidence is not an option, though by and large nearly all managers are “avoident” where every they can be. Remember Passive-Agressives almost never respond to mediation and the like because they see it as “confirmation of victimisation”. They might in a very few cases respond to formal rule setting and documented accountability, but it will be at best grudgingly. In the meantime the harm they do is often irreparable. Thus early action as indicated toward the bottom of the article is realy the only sensible way to minimise harm. Especially when you remember some narcissistic personality types will resort to indirect or even direct harmfull behaviours including planned violence with intent to do more than just transitory harm.