jwtadvice

I've been following Bruce Schneier's blog for a long time. He is a decent cryptographer, and a notable personality and technical expert.

He's very new to "geopolitics".

In fact, he's published a number of corrections on his blog about fundamentally incorrect predictions he's made about Shadow Brokers in particular (he predicted that their encrypted file they published was just random garbage and didn't actually contain any cyberweapons).

Here Bruce is speaking about things beyond his expertise. It's not particularly brave to point out the flaws in his analysis.

This article reads pretty lazily in my opinion.

It fails to mention that the CIA had an internal hunt for the contractors which leaked the "Vault7" arsenal - confirming that indeed it was a contractor and indeed that they had mishandled the arsenal by providing global access to the weapon cache.

It also failed to mention the full original story provided by the Shadow Brokers and those that reported on them: that NSA had (similarly) mishandled hacking tools by loading too many of them onto attack staging servers. This story has not changed, nor have the recent publications contradicted it. In fact the Shadow Brokers said exactly what they were going to publish when they first went public and have followed through with what they said they were going to publish exactly.

The author speculates and conspires that both of these must be Russia. Mostly it's the standard fare conspiracy theorist "to whose benefit" but it's clear the author doesn't understand whether and how Russia would benefit from these disclosures.

Finally, after all the public panic induced over "Russian hacking" during the election, there's been no intelligence summary, statement, or even Congressional statement to the affect that either the Shadow Brokers or the Vault7 leaks are in any way attributed to Russia. Wouldn't that have been fuel for that fire?

My guess is that the Shadow Brokers are a criminal organization with informal relationships with state intelligence services. My guess is that Vault7 was a CIA and contractor who shared the massive trove too broadly, where it ended up in the hands of the Wikileaks journalism reporting outlet.

The author appeals to Occam's Razor only by name. The lack of careful analysis in the article insists, unfortunately, in using unfounded speculation in the place of evidence, and horror, to then appeal to Occam's Razor on behalf of assumptions.

I recently wrote a chess AI in javascript, and found that it wasn't able to evaluate nearly as many moves per second as I expected, even though the implementation was pretty light (though not extensively optimized).

My feeling is that for serious AIs that need to perform huge tree evaluations (whether classical alpha-beta or something closer to monte-carlo minimum regret searches) there's several orders of magnitudes of optimization that can be performed, huge gains from subtle tradeoffs (larger static memory allocations, memory caching strategies, etc) and deep heuristics that can lead to pruning search spaces by huge percentages.

Highly tuned implementations such as these - or the graphics visualizations from the demo scene - have always fascinated me as an art form.

In practice, for most practical purposes, the industry seems to value more code for more features over the incredible feats of superimplementation.

The congressional hearing last week had them say that "the Obama Administration threw pebbles, and it's about time we started throwing rocks."

This is incredible. I followed this link down into the Margolus-Levitin theorem, which puts a physical limit to how much computation (entropy?) you can produce with a single joule of energy (6 x 10^33 operations/second).

It seems that at some point the unit for powering computers would then have to be matter, since there's such an incredible amount of energy stored per newton.

Could you explain the difference between whataboutism and context, particularly if a comment tries specifically to say that "two wrongs don't make a right"?

They would love to if someone gets them copies of the FSB hacking tools.

SONY had partnered with the US government to create a film that they thought and hoped could galvinize a revolutionary mood in North Korea (by making a comedy about the CIA assassinating the leadership and showing that mock assassination on screen). The DPRK considered this an attack (similar to the US considering the disclosure of hacked DNC emails an attack) and responded with a cyber attack on the contracting firm.

I remember when the internet was primarily shock videos and Newgrounds flash animations, and really crappy expages raw HTML webpages with flaming GIF animations.

That internet was horrible. It was filled with goatse, tubgirl, lemonparty, crush videos and much more.

The internet today doesn't have that. But it is politicized. And just like mainstream media control of the politics has created a race to control platforms and communities.

The internet has fracturous communities that break down into camps of people who are collectively gas-lighting one another. And in spaces where there is an established groupthink - anything that questions that groupthink is immediately a threat to the entire ecosystem of that space. And so the term "troll" has come to mean "anyone that doesn't agree with the groupthink."

Yesterday someone suggested that I was a traitor to my country and would be hunted down because I fact checked a group hysteria. I've been called everything under the sun and have received all sorts of threats. But in that community I'm the one who is labeled a troll.

(I've been criticized, and even temporarily banned from HN on the premise that I was a troll. In that case, I had been explaining and defending the Chinese case for their sovereignty over territory in the South China Sea. It was not bearable on this forum.)

Private companies are the current gatekeepers to free speech, to propaganda, to censorship, to surveillance. They can not disregard human rights and principles of free society any more than a government can - just as they can not violate human rights. Just because its an oligarch and not a politician, the rules of a free and just society don't suddenly change.

Private companies have some property. Their property rights do not supercede human rights.

Then, another solution would be to dismantle the oligarchic model of economic management and provide the mass of people with the property rights of the platforms of their own free speech. But I suspect that our society isn't ready for anything that radical and must in the meantime merely hold private property accountable for its partnership with government to circumvent sovereignty restrictions.

Well this is the CIA.

It can confuse the attribution so that trust is spoiled, so that energy is spend uselessly, so that another country takes the blame, for false flag attacks to justify other strategic moves.

I see a number of these articles from time to time about the health effects of (warm|cold) water treatment.

Seems to me not to be a replacement for exercise, a healthy diet, and good sleep. Maybe as a supplement. Or maybe for someone who is injured or old or has limited opportunity.

Unfortunately good scientific work along these lines very often lead to headlines that lead people to think: wow this is like a shake-weight but there's a science paper proving it.

There's no replacement for hard work.

Yeah, that's nice PR.

Currently there is a partnership between the major infrastructure providers and the Federal government to remove, discourage and defund content that has national security implications.

This theoretically includes news, such as the Snowden Documents, which Facebook did not allow people to share on their timelines during the height of the scandal.

What are the boundaries of censorship?

It should be noted that while "extremist content" provokes images of beheadings, the very vast majority of content put out by those suffering and fighting on terrorist/freedom-fighter side (insurgent side) in the middle east, for example, is positive and are messages about their condition, what life could be like without dictatorship or foreign intervention, or about piety, family or society.

This content is censored in addition to the more brutal but less frequent content equally. But it's more controversial to specify this. So broad strokes are used to identify "extremist content".

Similar programs are underway to control the spread of perspectives by people in Russia, China, even Turkey or Israel and others.

There has been no public debate and under the Trump Administration there isn't likely to be.

The coup attempt was very, very real.

Erdogan's subsequent power grab was/is also very real.

(They aren't mutually exclusive.)

The social media rumor that you're referring to has been widely discredited.

My purpose was to talk about biases of media outlets in general rather than discuss the biases of one particular media outlet (Wikileaks).

Wikileaks has important biases. So does CNN. Wikileaks does important reporting. So does CNN.

Of course these are just two outlets. I don't mean to focus just on the two.

(Of the two I think Wikileaks would be the most missed, were it to disappear.)

My point is that it is incredibly important to discuss and take into account the biases of the outlets information is being published by. This is how I intended to discuss the bias of CNN and if you look you will see I brought this up under the context of the parent comments of my own. Namely, it is not quid pro quo.

With the gap of 7 months?

Russia and Turkey at the point of the disclosures were in a rapprochement: https://www.foreignaffairs.com/articles/turkey/2016-07-20/ru...

The result of the disclosures was a weakening of that warming relationship, with Turkey pivoting again in its foreign policy - at least for some short time.

What else has Wikileaks reported on?

The Italian "Hacking Team" - https://wikileaks.org/hackingteam/emails/

Saudi Arabian Embassy Cables - https://wikileaks.org/saudi-cables

Pirate Bay Court Documents - https://wikileaks.org/gottfrid-docs

Cables from the Assad administration in Syria - https://search.wikileaks.org/syria-files/

Documents from inside Scientology - https://wikileaks.org/wiki/Scientology

Swiss Banking Tax Offshore Scandals - https://wikileaks.org/wiki/Bank_Julius_Baer

His point isn't very compelling for the following reason: instead of taking my argument ("Wikileaks publishes on far more than the US") he took an anecdote decorating my argument ("for example Turkey") and tried to argue the anecdote (poorly).

I'll give him an upvote. Not because I think his argument is really good. But because he contributes to the conversation.

I read through about 10 pages of the first book ("without models"). It struck me as very nearly identical to current statistics practice. It clearly differentiated itself as discussing counterfactuals (the data needed to actually determine causality) but I could not find the section of the book that described how counterfactual data can be inferred from missing data (without it being "turtles all the way down").

Does anyone in this area have a succinct way to explain how counterfactual data can be inferred by these techniques - and how traditional statistics practice is not able to perform this inference?

Right. But it's curious that "How biased is CNN?" gets shut down any time it comes up as a serious topic. From the whitewashing they did on the genocide in Bahrain (after accepting money from that government) to the misleading coverage of Syria, Snowden's mass surveillance disclosures, US torture program, Iraq War - to its current poor coverage of the humanitarian crisis being caused by the US intervention in Mosul.

It would be wonderful to discuss the role that different outlets play and different biases come in. But it's difficult because any time the topic comes up "faithfuls" from all sides come in and it starts to look more like a sports or religion debate than it does an illuminating conversation.

Yeah, Wikileaks has some biases.

I actually think they are incredibly important biases. Also, I don't think they are nearly as "anti-American" as some panic about.

The problem is that other sources are not willing to perform the kinds of investigations and do the sort of publications Wikileaks and few others are willing to do.

When Snowden approached CNN, the Times and a number of other large media outlets they attempted to report him to the Feds rather than report on the domestic and global mass surveillance programmes.

The incentives, partnerships, timelines and ethics of major media outlets prevent them from speaking truth to power.

Anyone in the know how about whether the CIA subverted the security of software or whether they inserted vulnerabilities into software?

One of the shocking and disgusting things from the NSA leaks was that it actively sought to create new vulnerabilities and to create subverted software industry products in the United States.

So far it looks like the CIA is using discovered vulnerabilities (imo better than sabotaging industry). But given the size of the leaks I'm having difficulty confirming that this is indeed the case.

Yes. Correction made in the parent comment.

Thank you.

The number of times I've had perfectly reasonable ideas downvoted immediately on reddit...

This is a far, far cry from the kinds of quality journalism that Wikileaks does. It appears that the claim the password was 'password' wasn't a story in and of itself but an anecdote relating to the weakness of Podesta's password (which is true).

Compare that to Clapper, Director of National Intelligence stating for the record under oath that national intelligence does not have a surveillance operation targeting Americans in the homeland. That was a lie and one intended for testimony.

Assange here is just saying: Podesta's password is weak. It's hard for him to qualify that it was spelled "p@ssw0rd" rather than "password" during an interview.

The fact that you think saying "password" rather than "p@ssw0rd" disqualifies Assange as a lier goes to the heart of the anti-body reaction that nationalists have about hearing news that doesn't validate pre-existing opinions that they have about the nobility of their nation and its leadership.

The difference between "password" and "p@ssw0rd", while technically true, it is so pedantic it does not apply to the spirit of the conversation.

Wikileaks published the internal communications of the Erdogan Administration in Turkey, indicating among other things (corruption) the administrations back channel to the Assad Administration in Syria (an enemy of the United States).

The fallout of these disclosures potentially contributed to a building coup attempt in Turkey by forces loyal to the US (which the US tacitly supported) that burst just a week after the disclosures.

Wikileaks does not only publish "against" America. When it does, it's closer to home for the Americans and we hear more news coverage about it. In any case, wouldn't it okay that there are outlets that produce true news focused on negative aspects of the United States, keeping it accountable? That seems like a positive thing to me - though I don't think Wikileaks is "it".

This is perfect.

Much of the US media narrative about its overseas interventions likewise fall into this category.

Much of the war propaganda consumed by the US population is based on truth. The problem is that US citizens don't have the appropriate context to understand that truth. The fallout is incredible damage to people and lives overseas caught up in great power struggle that could be a different way if there we a systemic commitment toward building a real basis toward international security (over, say, unipolar control).

While the AI might be cheating by taking salient features from RAM rather than from pixel values, this is still an incredible feat. Just a few years ago we did not have generic algorithms that could take even salient features and self-learn policies to near this level this quickly.

Here's a recent Thinktank summary of the encryption and what access is difficult for the government.

https://csis-prod.s3.amazonaws.com/s3fs-public/publication/1...

You will find that the following summary is correct: The federal government does not have an issue getting the plaintexts it desires today.

This is because of a large number of capabilities come together: first most communications does not have unrecoverable encryption. Strong encryption is extremely rare, composing very small percentages of the communications available. Then, where encryption is available it isn't applied by default. Then, where encryption is available and applied by default, there are key escrow mechanisms for most of these cases. Then, there is a legal mechanism that requires communication service providers to provide decryption for any of the encryption that they provide. Then, what encryption can is build over the mechanisms for providers and services offer, most of it can be defeated. Then, what can not be defeated mathematically, access can be gained from other types of law enforcement activity, including lawful hacking exercises and capture of unlocked target devices. Then, what can't be gained by any of this can be inferred from metadata that is almost always available in plaintext, provided by mass surveillance collections.

I encourage you to read the associated literature, both reports like the above, and the contents of the Snowden Disclosures.

Namely: both law enforcement and intelligence operations are able to thwart the very vast majority of communications among Americans as well as those abroad. There do exist some systems that lead to unrecoverable encryption - they are in the very vast majority and can and are thwarted using other types of operations (if the cost-benefit analysis deems it necessary). And so it is not a reasonable position to remain skeptical in the face of overwhelming evidence.

It should also be noted that a number of "Hollywood scenarios" have been disclosed and have been seriously debated on a national level: before the 90s all cryptography in the United States was mandated to be weak to government interception (this isn't that long ago) and can we go without mentioning DRGB? Apparently we can't.

The sum total of all of this is that by and large, as a rule, federal intelligence and usually even regional law enforcement are able to access almost all civilian communications (in Seattle, for example, all of the cities communications including social media posts are hoovered up by our city police).

I want to be clear here: nationalism and euroskepticism are also fact-based worldviews.

The difference between the worldviews are which facts are emphasized, shared and deemed culturally relevant.

You can make pretty much any movie "based on a true story."

> This comment in particular seems to imply that government agencies can break e2e encryption.

Much E2E encryption can be broken by government agencies. For HTTPS for instance, the government is a certificate authority accepted by your browser - as well as there having been multiple cases of collaboration with well known CAs to have certs minted for them. In this case there's no need to break RSA. In any case, much of TLS is open to various kinds of breakage (that is not as hard as RSA), and NSA docs showed a number of instances where intelligence agencies would sit behind load balancers and at data center chokepoints in domestic companies to gather information where PKI no longer poses a problem (behind the load balancers being referred to here as "end-to-end").

Basically, there's many ways to thwart "e2e" that isn't cracking 4096 bit RSA. Intelligence agencies do all of them.

What an incredible way to conceptualize and compare computer versus biological viruses (with the size of them in bits looking reasonably similar).

In the virus writing scene there are a number of trends that have allowed generic approaches to outsmart even incredibly complex "virus scanners":

1. polymorphic code - basically you keep the Turing Machine / Program Logic the same, but you use random widgets with random side effects to implement the program logic. In this case each instance of the virus is different per infected host and there are no reliable signatures based on the bits to recognize them.

2. Packers - basically a program that on its own is not malicious but can carry another compressed and encrypted program that it will "unpack" in memory and then execute - allowing a virus to ride through virus scanning.

3. Stagers - A small and otherwise innocuous piece of code that pulls commands in either real time or as needed from the network, keeping all program logic in memory, and executing malicious code that is never packed into a formal executable file (and thus never scanned by anti-virus). These have the advantage that they are basically impossible to forensically debug because the attacker will change or turn off the payload after the stager succeeds the first time.

Has nature found a way to emulate any of these creative methods for bypassing immune systems? I remember hearing that HIV can look innocuous to an immune system, but I'm not sure that's because it uses a technique like the above.