Information Security – Page 17 – Maverisk / Étoiles du Nord

Really Bad Life

The recent spat on (team, in particular) sports not being the character building they’re supposed to be, has a pendant in other realms of game as well. The former, here; the latter, here.

Where, similar to other areas of enticement (link and other posts on this blog), the idea of a level paying field not through the starting positions but through procedural justice, seems to want to jump over the weaving errors of our societies being the unevenness and inequality of the starting positions. Also eloquently explained (with a moral take-home) here. Typical in the RBC article above-linked, in the base (sic) of the great game of golf with its handicap system. But still; this doesn’t diminish the feelings of inequity, either on the non-compensated-for-bad-luck-starting-points side, or on the feeling-bad-for-having-lost-the-advantages-of-an-advantaged-starting-point side.

Wouldn’t wars be over and world peace break out when the problem that eluded some of the most eminent (economics- and others) thinkers, as here and certainly here and here, be solved ..? What transformation away from a bad one, would that require of the world society ..?

I’m seriously interested to hear any pointers and partial work already …

[On the edges of Nature and Appolonian order…, and perfection (in horizon balance) is boring; Ancy-le-Franc]

Needing trolley answers — NOW!

Needing your help on this. In two ways…:

How come all the ethicists dreaming up ever more complex versions of the Trolley Problem, but are only too gleefully snickering at n00bs-to-the-field that figure out the peculiarities as they are led through the many pitfalls in thinking — but never arrive at definitive answers themselves! and are just happy with ever further complicating the issues.
Question is: How to bang their heads long and hard enough or, to give them a last chance, lock them up without food and drink until they deliver definitive answers? Left or Right, Yes or No, with ‘or’ being absolute XOR not ‘and a bit “and”, too’.
How does System 1 thinking, or System 2, tie into these sort of discussions ..? As said problems call for immediate decision (no time to wait for decades of completely useless non-answers from ethicists…), System 1 would probably have it, System 2 being too slow. How does System 1 respond in this arena, then ..? Should be tractable.
[Of course you didn’t expect me to stick to even my own ‘two’ of the intro, did you?] Is System 1 inherently more tied to the hunter-gatherer life that humanity has evolved in for so much longer, than the agri-society of late (10k years) ..? If so, in what way could we use such connection(s) and ramifications (…) to improve our responses to the above, and to society’s ails in general..?

OK, enough questions, possibly though certainly not certainly not answerable in a simple Comment … Hence:

[Ah, the Classics, they would probably provide better, actual, solutions, wouldn’t they ..? Ancy-le-Franc encore]

All Your Data Are Belong To Us

Or, in the form of a question: When
a. One has to notify authorities of any (possible!) data leak, per law, in Europe and soon maybe also in the USofA,
b. Even BIOSses aren’t secure anymore, baked in from the word Go and onwards,
Shouldn’t all organisations declare all of their infrastructure and hence all their data, possibly compromised ..?

Just asking.

[Edited to add this. Also relevant; this one deeper (?)]

And:

[Calm, not private; Museumplein Amsterdam]

You're So Smart

In a reference to a song about me:
Most ab-original humans wouldn’t pass a serious Turing test.
Most serious AI trying to pass, would.

You, the select elite of my blog readers … Well, elite by numbers, mostly, or ..? And select, as in ‘clicked by error’..?

Just kidding, of course, off course.
What I meant was: as originally intended, Turing tests have become a hypothetical mind game ‘only’. Now that we’re approaching ‘intelligence’ of machines, like, graduating from ANI to AGI and on to ASI without a blink — not all of society will change at one instant to the next level, and then after some prep all of society will move to the next! Much more creepy stuff is out there without general (public its) knowledge than you can imagine (if anything) — suddenly we return to the thought experiment.
Acknowledging that we have never been able to give a sort-of extentional definition of ‘intelligence’, only an intentional one. Which may indeed suffice. Now that we’re accustomed, and into ethics discussions rather than did/did-not type of things (ex the laggerds who still can’t stand being surpassed by ‘dumb’ machines — calling them that, calls yourself ‘below’ (quod non) that…), we’ve seem to have made the question irrelevant. When a few still say that this sort of thing is impossible, others are already doing it and hardly anyone seems to care.

The latter part being the scary bit. Wait and see just will not be enough here, in particular RE settling the Ethics elements. It’s not only self-driving cars where momentum is out of human hands and into Technology’s… It’s everywhere.

To not be afraid — or to be but be brave and conquer your fears and Act, this:

[Still recognisable as VR trompe l’oeil; Rijks Amsterdam]

New Normal Hacking

Errm, anyone still surprised about (not) new news on data being stolen, ransomware striking, or democracy perverted, anywhere, all the time ..?

Got a bit worried, and wondered whether there would be others the same, about the current Mehh impression of everyone in the loop, about even political parties [now openly], voting machines, etc., getting cracked and data stolen which combined with at last, at very last finally, the hackability of voting machines not, against all sane arguments, being tamper-resistant — which leads to the vulnerability and class broken-ness of fundamental human values.

And still, there’s hardly more than Mehhh.

Would anyone have a reason not to worry …?

Ah:

How you know that you are old in infosec: you remember when you were trying to get the world to care about improving security.

— Dino A. Dai Zovi (@dinodaizovi) October 6, 2016

Oh well, blue pills everywhere …? Plus:

[Sorry to say lads and lassies of the Royal Academy of Arts, but the Gemeentemuseum did beat you, on this one]
[Edited to add: No, this post was written before the NIST October 7 ‘news’ came out that (‘end’?) users are tired of hack-warnings (security fatigue), if that were a thing. Which is also not quite what I meant above, which is worse…]

Are sw bugs taxing your resilience ..?

There would be a solution when we’d find a way to tax software makers for their product faults.

Because caveat emptor can work only if unlike in softwareland, one can duly (!) examine the product before purchase otherwise-and-anyway culpability for hidden flaws remains with the seller/licensor.

Which is impossible with shrink-wrapped stuff — and the ‘license’ claim is ridiculous, moreover the EULA is inconsistent hence null and void: Either the product is used under license hence the product quaility liability remains with the producer/licensor or the licensee is liable for damages the use of the product might cause but then invariably ownership is with the purchaser.

The software maker can’t have their cake and eat it; that would run against basic legal principles. And claiming that one’s always allowed to not use the product and choose another one or not, the Hobson’s Choice that brings about so many legal ramifications that even $AAPL’s pockets would never suffice, would invariably lead to oligopoly/cartel charges …!

Or, as this may easily be solved when taken as a societal problem just like environmental stuff like CO₂ pollution (we all need electricity): Why not tax the software makers for their ‘pollution’ of the IS environment with bugs ..? (And prohibit the use of greenhouse gases like SQL injection weaknesses?)
Like, after post-write but before release, this (Dutch) news that casual carelessness is a headache for government(s)… A bit like driving rules with no enforcement, maybe ..?

I’m not one for fighting the real windmills… hence:

[The outards of the inn(ard)s of courts; Bridget’s London obviously]

Simply, stats

Just putting it down there.

With some discussion, OK, OK…:

Fubbuck still the largest, “of course”, but by less of a margin than previous (?);
Because FB ‘messenger’ oh horrendous thing, is listed separately. Prob with reason. At least, because reasons;
QQ and QZone still biggies, to grow ..!?
Tumblr’s big this time. Let’s dig for demographics, et al., to see whether some specific user group is biasing stats. The age-old subject that the Internet was invented and invaded for, may be a big one in this;
LinkedIn larger than Pinterest. A #first ..? And not by much. Cause? Sturdy growth, hanging in there, holding out and succeeding by others falling back; or has some take(n)-over played a role here …?
Insta quite big but maybe not living up to the hype (or what’s its growth), Snapchat rather flat. Is Millennialhyping a thing from the past already ..?

Contra Bruce, for once

For once, Bruce is not at the right end. Maybe not opposite of it, but.
As per this here blog post of his — a repeat of one of his, and others’, thread.

The argument: We make things, like, security, too difficult for users and hence (?) we shouldn’t try to change them into secure behaviour.
The contra: ‘Guns kill people’, or was it that the men (mostly) firing guns, kill people? And the many toddlers shooting their next of kin since, being at the approximate maturity of the Original gun pwner, they have no clue.

The Contra, too, and much more to the point when it comes to ‘information’ ‘security’: We should make cars run at maximum 5Mph … Since ‘users’ are waaaay too stupid to drive carefully.
Just don’t mention that ‘security’ is a quality not an absolute pass-or-fail thing, and that ‘information’ could not be more vague. [Except ‘cyber’, that’s so vacated of any meaning that it’s a black hole.] And don’t mentoin we still seem to let cars be used by any other moron that once, possibly literally decades ago before ‘chips’ were invented, passed some formal test — the American idea of the test coming very, dangerously, close to … was (sic) it the Belgian? system where one could pick up one’s driver’s license at the post office. Able, allowed, to buy cars that drive not just 5 but 250Mph, on busy roads, without protection against using socmed mid-traffic… One thing could be to introduce Finnish-style booking for unsafe behaviour (if caught, not when as per next paragraph [think that through…]), and/or huge fines for the producers of bad equipment (hw/sw) comparable to fines on car makers, or outright laws to build airbags in, etc.

And then, if we’d design ‘secure’ systems, e.g., the Apple way, we’d end up with even worse Shallows sheeple that have so much less clue than before… And all in the hands of … even in ultra-liberal countries one would suggest either Big Corp, or Big Gov’t, both options being Big Brother literally in such an atrocious Dystopia of humanity.

So, you want safe systems? You get the loss of humanity before actual safety.

[Yes I get the Humans Are The Cause Of Much Infosec Failure thing (including Human Flexibility Can (still!) Solve More Than Machines Can, Against System (!) Malfunction), but also I am completely in favour of both the Humans Must Through Tech Be Completely Shielded From Being Able To Do Anything Wrong and Humans Should Retain All Freedom To Act Responsibly solutions.]

Pick your stand. And:

[Use G Translate if you have to, from Dutch. Typifying the driver, probably, if only for picking the brand/car…; London]

You're Exposed…

You haven’t studied this here overview hard enough. Because you’re not even on it so shows your lack of will to enormously improve the seriousness of your (clients’) information security which would get you onto the list, just. Your security being too much of a joke to even achieve this level of honest attempt at seriousness.

ig_nobel_stinker_serif_icon_400x400

Teh business, does it exist ..?

On purpose, teh. Plus a spoiler: No.

Though this is a tell-tale sign your infosec program, of whatever kind, will #fail, wholesale.
’cause If you can’t specify all stakeholders, at their various levels of detail required, beyond swiping them up under the ‘the business’ nomen, Then you might as well call it ‘teh’ business, as you are vague to the point of irrelevance, as you will be regarded by ‘the business’ and since that’s where 99.9% of your security sits (including budget holders…), fugeddabout effectiveness.
Endif. No Else.

So, stop using ‘the business’ as a stopgap designation for your lack of understanding of the infosec problems that you claimed you could tackle hence you demonstrate to know no thing about the swamp of root causes to the problems that you said to go solve.
You n00b.

Oh well…:

[Some specific business; Madrid]