Notices by Zimmie (bob_zim@infosec.exchange), page 2

@evacide @Blort @pluralistic We simply need tech companies to invent a new number you can only use if you believe in truth, justice, and the American way!

@ArchaeoIain @davidaugust > Miscarriages of justice can be dealt with by the courts.

Which courts? Specifically which ones? And where do we go when those fail us? And where do we go when *that* court fails us? It’s not practical to have an infinite series of courts for appeals, so it has to end somewhere. What do you do when the final court is hopelessly corrupt?

Consider the crime of “felony murder”, which is also known as “not murdering anybody at all”. The fact anybody is in prison over this is inherently a miscarriage of justice, yet it’s very rarely fixed by the courts.

Edit: looks like the equivalent legal concept in Australia is “constructive murder”. In the US, if you are involved in any way with a felony (even an unwitting accessory) and someone dies (regardless of who or of circumstances), you can be charged with murder. Of course, if you actually kill someone, they charge you with real murder, not with “felony murder”. Stealing as little as $200 is a felony in various states.

Pardon power is good, and isn’t used nearly often enough.

@hisham_hm @mwl People really take the wrong thing away from the trolley problem. It isn’t directly about what you personally would or should do. Instead, it’s like an axis of comparison for ethical frameworks. It’s one of the extremes where differences (and sometimes similarities) between them become more apparent.

Like how Schrödinger’s cat isn’t saying the cat is both alive and dead, it’s taking a model we have for quantum effects and showing how, when taken to extremes, it produces results which are patently absurd.

@cR0w @jornane @The_Turtle_Moves @dalias I share this every time “user education” is brought up as a solution to phishing. It’s the first two lines of an email sent by the security team at my company at the time.

@ryanc A fabric which stretches in one direction is said to have “two-way stretch”. A “two-way mirror” is only a mirror from one direction. Almost every instance of a term with “way” in it is mind-numbingly wrong.

@ryanc @kajer @davidmc @zesty In that case, if the fuse blows, there’s current.

@ryanc @kajer @davidmc @zesty It probably does, just not labeled that way. Current mode is low impedance. The downside is if your multimeter isn’t fused, measuring wall current with current mode will probably show ~15A for about five milliseconds, then your multimeter melts and/or explodes.

This is the only real downside to the demise of incandescent bulbs. Loose sockets are cheap. You could stick one plus a switch on a board, hook the mystery wire to the switch, the other end of the switch to one terminal on the light socket, and neutral (or earth, if neutral isn’t available) to the other terminal of the socket.

If the bulb doesn’t light, there’s voltage on the wire, but not much current. If the bulb lights, there’s current.

@delegatevoid @LukaszOlejnik Upper limits on passphrase length are mostly about closing a possible resource exhaustion vector on the authenticating system. If you hash it all down to 64 bytes, there’s no point dealing with passphrases longer than 128 characters. Further characters don’t add any further entropy, but if you have no upper bound, some knucklehead is going to make your server hash the entirety of War and Peace over and over.

@lmorchard @WhiteCatTamer @nex @alexhammy It would be really challenging. For example, I have no idea how you would make the word “house” sound blue.

@Di4na @clacke @makdaam @hendric That doesn’t seem at all the case to me. The Therac-25 report had quite a few big lessons.

• Data races can exist anywhere shared mutable state exists. This was poorly understood at the time. Language people have taken this to heart with copy-on-write data structures, static analysis for control flow, and more recently with proof-based data access validation as seen in Swift 6. This kind of issue is why those capabilities exist, and why you shouldn’t just turn them off to silence warnings.
• Software interlocks are strictly worse than hardware interlocks. They have more opportunities to fail in non-obvious ways.
• Safety-critical software has become a much more formalized discipline, finally matching the rigor of real engineering. For example, techniques were developed to prove a given program is free of bugs by proving it exactly matches the behaviors defined by its formal specification (no undefined behaviors, and no missing behaviors).
• Reported issues should be treated as real until you can prove what happened. Part of the reason the Therac-25 hurt so many people is the company brushed off the early issue reports.

A lot of the company-culture problems the incidents exposed are still major issues today. The company thought their software was perfect, and they didn’t include it in their analysis of potential failure modes. They didn’t have any independent review of their code. They shipped straight to production (the hardware and software were never tested together outside customer installations). They didn’t document error codes and didn’t differentiate between minor errors and safety-critical errors.

@jerry @SunTzuCyber

@ryanc IPv4 numbers are really poorly specified. I personally use notations other than dotted decimal (especially hex integer) much more than I use dotted decimal because it’s so much easier to do math with them. For example, they greatly simplify matching expressions like this. They also help when dealing with networks which aren’t byte-aligned.

@Oneironaut @admford The visible antenna is either Bluetooth or WiFi. There could be a cell radio we can’t see, but it’s common for these to connect to a separate cell phone hidden a short distance away. That minimizes the risk the skimmer contains information which could be tracked back to the criminal, making it effectively disposable.

@ryanc I’m a fan of FreeBSD, so I’ll point to the Juniper EX2300-24p. 24x1g copper ports with 370W PoE budget, 4x10g SFP+ ports. $100 used.

@mcv I had to fight that fight when Spectre/Meltdown were the shiny new flaws. “We need you to prove the firewalls and routers aren’t vulnerable to Spectre/Meltdown!”

That whole class of flaw requires the ability to run code on the target system. If somebody who isn’t on my team can run *any* code on our firewalls and routers, we have much bigger problems.

@thomasfuchs Gets even more interesting. In the terms of service, they say you must opt out by emailing arbitrationoptout@23andme.com, and if you don’t, you agree to arbitration. They could argue writing only to legal@ (which is the what the “notify us” link does) is not enough.