The Spectre of Future Meltdowns

I’ve created and deleted drafts on this topic all weekend. All the metaphors I’ve tried to come up with are pretty inaccurate, or don’t add anything that others haven’t already said. So I’ll just do this the boring way.

Don’t let the cute logos fool you, both Spectre and Meltdown are about as serious as you can get in computer security. Both take advantage of the design of many high-end CPUs. In order to squeeze out as much efficiency as possible, nearly all CPUs from Intel allow the processor to reorder the instructions it executes and make guesses about certain values. Unfortunately, when the CPU is jumping ahead it relaxes some of its normal security checks; fortunately, if those guesses are wrong it undoes any changes and executes the right code. On the surface, that prevents any security issues.

But there are still fingerprints of what was executed left behind, hidden in places a programmer can’t directly access but which nonetheless have subtle effects on the behavior of the processor. A clever programmer can combine brute-force checking with probability to guess at the contents of what the processor executed then erased, allowing them to wiggle past security checks. The result is devastating, as it can reveal sensitive data like passwords or worse. These attacks also take place at the hardware level, which makes them incredibly difficult to fix; at one point, US-CERT’s primary recommendation was to replace your CPU, roughly equivalent to replacing a car’s engine. Ouch! Bruce Schneier has weighed in, which saves me from being doom-and-gloom for once.

The problem is that there isn’t anything to buy that isn’t vulnerable. Pretty much every major processor made in the past 20 years is vulnerable to some flavor of these vulnerabilities. Patching against Meltdown can degrade performance by almost a third. And there’s no patch for Spectre; the microprocessors have to be redesigned to prevent the attack, and that will take years. […]

It shouldn’t be surprising that microprocessor designers have been building insecure hardware for 20 years. What’s surprising is that it took 20 years to discover it. In their rush to make computers faster, they weren’t thinking about security. They didn’t have the expertise to find these vulnerabilities. And those who did were too busy finding normal software vulnerabilities to examine microprocessors. Security researchers are starting to look more closely at these systems, so expect to hear about more vulnerabilities along these lines.

Spectre and Meltdown are pretty catastrophic vulnerabilities, but they only affect the confidentiality of data. Now that they — and the research into the Intel ME vulnerability — have shown researchers where to look, more is coming — and what they’ll find will be worse than either Spectre or Meltdown. There will be vulnerabilities that will allow attackers to manipulate or delete data across processes, potentially fatal in the computers controlling our cars or implanted medical devices. These will be similarly impossible to fix, and the only strategy will be to throw our devices away and buy new ones.

I got lucky. When I ran the Spectre demo code on my home computer, nothing happened; while many AMD CPUs are effected, they fare better than Intel’s. ARM CPUs, like those on your phone, are somewhere in between. Having said that, Schneier’s right: these bugs are a big deal, and are guaranteed to spur the development of nastier ones.

If you’d like info on both these bugs, Computerphile has a great semi-technical explanation and Jann Horn a super-technical one.

Kremlin Watch: Papadopoulos, Fusion GPS, and Fake Americans

The Last Jedi was excellent. My scribbled notes may turn into a blog post at some point, but until then I need another pick-me-up. And what better cheer is there than foreign governments messing with US politics, amirite?

Return Of The FBI

It looks like we’ve got our answer to why the FBI was looking into Trump, and it involves booze and Australians.

During a night of heavy drinking at an upscale London bar in May 2016, George Papadopoulos, a young foreign policy adviser to the Trump campaign, made a startling revelation to Australia’s top diplomat in Britain: Russia had political dirt on Hillary Clinton. About three weeks earlier, Mr. Papadopoulos had been told that Moscow had thousands of emails that would embarrass Mrs. Clinton, apparently stolen in an effort to try to damage her campaign. […]

The hacking and the revelation that a member of the Trump campaign may have had inside information about it were driving factors that led the F.B.I. to open an investigation in July 2016 into Russia’s attempts to disrupt the election and whether any of President Trump’s associates conspired.

Bravo on this one, New York Times. It also swats down the “coffee boy” line about Papadopoulos.

He was hardly central to the daily running of the Trump campaign, yet Mr. Papadopoulos continuously found ways to make himself useful to senior Trump advisers. In September 2016, with the United Nations General Assembly approaching and stories circulating that Mrs. Clinton was going to meet with Mr. Sisi, the Egyptian president, Mr. Papadopoulos sent a message to Stephen K. Bannon, the campaign’s chief executive, offering to broker a similar meeting for Mr. Trump.

After days of scheduling discussions, the meeting was set and Mr. Papadopoulos sent a list of talking points to Mr. Bannon, according to people familiar with those interactions. Asked about his contacts with Mr. Papadopoulos, Mr. Bannon declined to comment.

There’s also proposals to write “neutral” opinion pieces in favour of Trump, taking advantage of his access. Well worth the read.

Fusion GPS Strikes Back

The news about Papadopoulos also undercuts a Republican talking point: Fusion GPS’s “pee tape” dossier kicked off the FBI investigation, and since that was paid for by Democrats the FBI is now tainted with Democrat cooties. Or something like that, the argument’s never made much sense to me. Whatever the case, two of the people behind Fusion GPS are pushing back.

We walked investigators through our yearlong effort to decipher Mr. Trump’s complex business past, of which the Steele dossier is but one chapter. And we handed over our relevant bank records — while drawing the line at a fishing expedition for the records of companies we work for that have nothing to do with the Trump case.

Republicans have refused to release full transcripts of our firm’s testimony, even as they selectively leak details to media outlets on the far right. It’s time to share what our company told investigators.

We don’t believe the Steele dossier was the trigger for the F.B.I.’s investigation into Russian meddling. As we told the Senate Judiciary Committee in August, our sources said the dossier was taken so seriously because it corroborated reports the bureau had received from other sources, including one inside the Trump camp.

The intelligence committees have known for months that credible allegations of collusion between the Trump camp and Russia were pouring in from independent sources during the campaign. Yet lawmakers in the thrall of the president continue to wage a cynical campaign to portray us as the unwitting victims of Kremlin disinformation.

As if that wasn’t eyebrow raising enough, Glenn R. Simpson and Peter Fritsch tease some of that testimony.

We told Congress that from Manhattan to Sunny Isles Beach, Fla., and from Toronto to Panama, we found widespread evidence that Mr. Trump and his organization had worked with a wide array of dubious Russians in arrangements that often raised questions about money laundering. Likewise, those deals don’t seem to interest Congress.

There’s more, but you’ll have to click through for that.

Attack Of The Cloned Americans

On top of all that, Russia shows up in an unexpected place. The FCC, like a number of departments in the US government, request public input on big policy changes. The number of comments coming in about Net Neutrality broke records, and for poor reason.

A study has found more than 7.75 million comments were submitted from email domains attributed to FakeMailGenerator.com, and they had nearly identical wording. The FCC says some of the nearly 23 million comments on Chairman Ajit Pai’s proposal to gut Obama-era rules were filed under the same name more than 90 times each.

And then there were the 444,938 from Russian email addresses, which also raised eyebrows, even though it’s unclear if they were from actual Russian citizens or computer bots originating in the U.S. or elsewhere.

The oddities in the FCC’s inbox have attracted scrutiny from New York’s attorney general and from the U.S. Government Accountability Office, which has opened a probe. […. New York Attorney General Eric] Schneiderman said the FCC had not cooperated with his investigation.

Rachael Maddow, my source for this story and inspiration for this blog post, goes into detail about those shenanigans and similar ones afoot. It’s worth pointing out that this one may have nothing to do with the Kremlin; automated bots are common enough that their mere existence says little about their origins, and while the Russian emails are weird there were also a tonne from Germany. Still, it does fit in with Kremlin tactics.

The point of this new propaganda is not to persuade anyone, but to keep the viewer hooked and distracted—to disrupt Western narratives rather than provide a counternarrative. It is the perfect genre for conspiracy theories, which are all over Russian TV. When the Kremlin and its affiliated media outlets spat out outlandish stories about the downing of Malaysia Airlines Flight 17 over eastern Ukraine in July—reports that characterized the crash as everything from an assault by Ukrainian fighter jets following U.S. instructions, to an attempted NATO attack on Putin’s private jet—they were trying not so much to convince viewers of any one version of events, but rather to leave them confused, paranoid, and passive—living in a Kremlin-controlled virtual reality that can no longer be mediated or debated by any appeal to ‘truth.’

Their goal is to get “the West” to stop believing in democracy, and the day we stop believing democracy can work is the day we lose it.

Some Holiday Cheer

The articles I’m working on at the moment are either a) fairly depressing, or b) a fair bit of work, which means that a whole lot of a) is coming down the pipe. So I’m going to counter-program that with a little explicit holiday cheer. For instance, this Twitter thread brought a smile to my face.

End of the year Twitter confession: Until recently, I was a conservative. I rolled my eyes at almost all talk of ongoing oppression, systemic racism, sexism and misogyny, microagressions, and any hint that speech could = violence. I considered myself a classical liberal. The right talks of “red pill moments,” in which a person of the left is mugged by reality and becomes rightwing. I prefer the term “paradigm shift,” which describes a fundamental change in scientific disciplines. I went through a paradigm shift starting 5 years ago.

Teaching at Wabash College in Indiana, I spent some time with the students and faculty of the Malcolm X Institute for Black Studies. Learning (and seeing) the experiences of these students in small-town Indiana changed me. Coming from Canada and then Ithaca, NY, it was easy for me to overlook and ignore the oppression other groups faced (though it was still there). But in Indiana, these students were regularly pulled over by cops (I never was), tailed by staff at stores (I never was). They also faced far more blatant acts of racism, like shouts of “white power” from passing cars, etc. There is simply no denying that African Americans face this kind of thing day after day after day. That I don’t is just the very tip of my white privilege.

I began to see the world and myself differently. I saw that I am extraordinarily privileged, that though I do work hard I am starting way ahead of others by being white, upper-middle class, with educated parents, etc. I’m not where I am just because of what I’ve done. Since meeting the students of Wabash College and the MXI, I simply can’t be a “classical liberal” any more. There simply isn’t a level playing field, not in terms of race, educational opportunities, economic resources, etc. To act like there is is cruel and self-serving. Many things have also happened since to change my view of the world (reading Aristotle, Augustine, and Aquinas, for one…), but in general I now err on the side of not presuming my experience is like others’ experiences. I try to default to compassion and self-awareness.

To end the confession, perhaps too honestly: Only 5 years ago I might have said “all lives matter”; “not all men”; “everything is up for debate”; “I’m a free speech absolutist”; “students need to be prepared for the real world”. Now I say “black lives matter”; “I believe women”; “I don’t get to debate the existence of others”; “free speech absolutism benefits the already powerful”; “marginalised students have already seen more of the real world than I ever will”. That’s my paradigm shift.

If you’ve got a few objections brewing in your brain, check the rest of the thread; Matthew Sears does a good job answering the ones that popped into mind.

What I find notable in this story is the contrast. Red-pilling is commonly an active thing, where someone preaches at you and stuffs pamphlets under your nose until they reel you in. Sears’ story has some similarities to my own: no-one tried to get me interested in social justice. There was no persuasion by others. Both of us just listened to other people with an open mind, applied a little logic, and naturally became supporters of social justice.

Lies may spread quickly and give comfort, but they need to be pushed. The truth quietly sits there, waiting for you to arrive.

Uh Oh

Apologies for setting off the fire alarm, but:

Francis Rooney (R-FL): I’m very concerned that the DOJ and the FBI, whether you want to call it deep state or what, are kind of off the rails. People need a good, clean government.

Hallie Jackson: Do you think people don’t have a good clean government? … There are those that look at comments, like the ones that you’re making, and say that Republicans are working to, essentially, try to discredit the Department of Justice and thus discredit the Russia investigations. Is that not what you’re doing?

Rooney: No, I don’t want to discredit’m. I, just, I would like to see the directors of the agencies purge it, and say, look, we’ve got a lot of great agents, a lot of great lawyers here. Those are the people I want the American people to see, and know the good works being done. Not these people, who are kind of the deep state.

Jackson: Language like that, congressman, “purge?” Purge the Department of Justice?

Rooney: Well, I think that Mr. Strzok could be purged, sure.

To put that in context, Peter Strzok exchanged a series of private texts with Lisa Page, while Strzok was part of Mueller’s Special Council investigation. Upon learning of the texts, Mueller removed him from the case. Just over three months later, a selection of those texts were released to Fox News and Republican lawmakers, who immediately seized on Strzok’s anti-Trump comments as proof of bias. Problem is, only a subset of those texts were ever released, from an active investigation into the situation, and the Department of Justice is refusing to answer important questions about them. Also, Strzok had a lot of opinions.

Regarding Clinton, Strzok once texted, “I’m worried about what happens if HRC is elected.” He also referred to Clinton’s daughter, Chelsea Clinton, as “self-entitled,” and dismissed Sen. Bernie Sanders, I – Vt., as an “idiot.” Page also called Sanders supporters “idiots.” They also both had low opinions of President Barack Obama’s attorney general, Eric Holder, with Strzok writing it was “wildly offensive” for Holder’s portrait to be next to that of iconic Attorney General Elliott Richardson and insisting that a television be turned off when Holder spoke at the Democratic National Convention.

Page perhaps best summed up their worldview when she texted Strzok during lunch with an unidentified person: “We both hate everyone and everything.”

Finally, there’s no evidence Strzok’s private opinions had any influence on Mueller’s investigation of Trump! Remember the “active investigation” bit? When the texts were released to Republicans and Fox News, the DoJ had still not concluded an internal probe into the matter. Now that those texts have been hopelessly politicised, how can that investigation remain free of charges of bias?

And yet, based on that context, a Republican Congressperson is ready to “purge” the FBI of people like Strzok. People who, so far, are only guilty of privately saying mean things about the US President.

via GIPHY

We’re not even a year into Trump’s presidency, yet the United States is becoming an authoritarian state far faster than I thought possible. Others are catching on to this, too.

Note that the calls for a “purge” of the FBI and DOJ are becoming more explicit, actually using the word “purge” and moving from the right-wing publications to sitting members of Congress. A small part of this is simple partisanship, what threatens the leader of your political party is bad and needs to be attacked. But what we’re seeing goes far, far beyond that and can only be explained by the Republican right’s broader embrace of authoritarianism, which both predates Trump, accounts for his rise and has in turn been accelerated by his presidency.

This point is critical to remember. Trump’s flouting of democratic norms during the campaign was a core element, perhaps the core element, of his appeal. Support for Trump certainly wasn’t in spite of this. Nor was it incidental. We focus on Trump’s antics. They remain erratic and unbridled. But equally important, probably more important, is the absence of any overriding respect for the rule of law or democratic norms among his supporters. Functionally that means the entire Republican party, even if individual Republican officeholders may express a muted displeasure.

Others were way ahead of me.

Given that some of [Rep. Lindsey] Graham’s worst fears about Trump’s Kremlin ties and mental state have been legitimized, what accounts for the senator’s changed attitude toward the president? There are a variety of possible rationales available for conjecture, many of which apply to the GOP at large. Opportunism may play a role, as Graham complies with Trump in order to pursue right-wing extremist economic policies and war. Blackmail may also be an issue, given that Graham has admitted his email was hacked, as was the RNC’s, by Russia. Trump has derided and threatened members of Congress and private citizens, and it’s not a stretch to imagine him unleashing his fire– publicly or privately–on Graham.

Graham’s radical change in rhetoric is reminiscent of the behavior one sees in autocratic regimes when potential political opponents are mollified or threatened into compliance. But the truly troubling question is not what is driving his changed behavior, but what it means for the rest of the GOP, especially as speculation mounts that the Trump administration could end Mueller’s investigation and propagandists recast Republicans like James Comey and Mueller as enemies of the state. In 2016, Graham initiated the call for an investigation into Trump’s Kremlin ties. In 2018, judging by his recent actions, Graham may lead the way in ensuring there are no consequences for what investigators have discovered.

Either way, it’s time to panic. Americans, your democracy is rapidly degrading! There is no better time to become politically active, to petition your representatives, and push back against those that would rob you of political power. The rest of the world is counting on you, because the consequences will effect the rest of us.

Bayes’ Theorem: Deceptively Simple

Bayes' Theorem, in classic form

Good ol’ Bayes’ Theorem. Have you even wondered where it comes from, though? If you don’t know probability, there doesn’t seem to be any obvious logic to it. Once you’ve had it explained to you, though, it seems blindingly obvious and almost tautological. I know of a couple of good explainers, such as E.T. Jaynes’ Probability Theory, but just for fun I challenged myself to re-derive the Theorem from scratch. Took me about twenty minutes; if you’d like to try, stop reading here and try working it out yourself.

[Read more…]

Women’s Work

[I know, I’m a good three months late on this. It’s too good for the trash bin, though, and knowing CompSci it’ll be relevant again within the next year.]

This swells my heart.

LAURIE SEGALL: Computer science, it hasn’t always been dominated by men. It wasn’t until 1984 that the number of women studying computer science started falling. So how does that fit into your argument as to why there aren’t more women in tech?

JAMES DAMORE: So there are several reasons for why it was like that. Partly, women weren’t allowed to work other jobs so there was less freedom for people; and, also… it was simply different kinds of work. It was more like accounting rather than modern-day computer programming. And it wasn’t as lucrative, so part of the reason so many men give go into tech is because it’s high paying. I know of many people at Google that- they weren’t necessarily passionate about it, but it was what would provide for their family, and so they still worked there.

SEGALL: You say those jobs are more like accounting. I mean, look at Grace Hopper who pioneered computer programming; Margaret Hamilton, who created the first ever software which was responsible for landing humans on the moon; Katherine Johnson, Mary Jackson, Dorothy Vaughan, they were responsible for John Glenn accurately making his trajectory to the moon. Those aren’t accounting-type jobs?

DAMORE: Yeah, so, there were select positions that weren’t, and women are definitely capable of being confident programmers.

SEGALL: Do you believe those women were outliers?

DAMORE: … No, I’m just saying that there are confident women programmers. There are many at Google, and the women at Google aren’t any worse than the men at Google.

Segall deserves kudos for getting Damore to reverse himself. Even he admits there’s no evidence women are worse coders than men, in line with the current scientific evidence. I’m also fond of the people who make solid logical arguments against Damore’s views. We even have good research on why computing went from being dominated by women to dominated by men, and how occupations flip between male- and female-dominated as their social standing changes.

But there’s something lacking in Segall’s presentation of the history of women in computing. She isn’t alone, I’ve been reading a tonne of stories about the history of women in computing, and all of them suffer from the same omission: why did women dominate computing, at first? We think of math and logic as being “a guy thing,” so this is terribly strange. [Read more…]

Citizens of the United States: You’ve been Hoodwinked

Remember that giant fight to preserve the Affordable Care Act from earlier this year? Where comedians weighed in with emotional appeals, mass protests led to mass arrests, politicians who voted against it were cheered by their constituents?

President Donald Trump on Wednesday claimed the Republican tax overhaul has “essentially repealed Obamacare” but said officials “didn’t want to bring it up” until the legislation had already passed.

“The individual mandate is being repealed. When the individual mandate is being repealed, that means Obamacare is being repealed because they get their money from the individual mandate,” Trump said at the start of a cabinet meeting.

He said the tax bill has “essentially repealed Obamacare,” though the legislation has eliminated a key provision of the health care law but not repealed it entirely, and claimed Republicans will come up with something that will be much better, whether it’s block grants or whether it’s taking what we have and doing something terrific.”

“We didn’t want to bring it up. I told people specifically, ‘Be quiet with the fake news media because I don’t want them talking too much about it,’” Trump said. “Because I didn’t know how people would — but now that it’s approved I can say the individual mandate on health care, where you had to pay not to have insurance, okay, think of that one, you pay not to have insurance. The individual mandate has been repealed.”

Emphasis mine. Taken at face value, Trump is claiming he deliberately hid his latest attempt to take away your health care away in a tax bill that primarily benefits wealthy donors to the Republican party, and with the help of Republicans managed to pull it off. That’s remarkably cruel.

It’s also untrue, as is usual for Trump.

Contrary to a statement that President Trump made Wednesday, nixing Obamacare’s individual mandate does not mean that Obamacare has been repealed in the GOP tax bill. The individual mandate, which requires most Americans (other than those who qualify for a hardship exemption) to carry a minimum level of health coverage, is actually still in effect for 2018—meaning that you may have to pay a steep tax fine if you don’t have health insurance, for one thing. And even after the individual mandate repeal goes into effect the following year, Obamacare’s individual insurance markets, federal subsidies to help Americans pay monthly insurance premiums, and Medicaid expansion in the dozens of states that implemented it will all still be in effect barring further Congressional action. […]

Ultimately, repealing Obamacare’s individual mandate would cause 13 million fewer Americans to be insured in 2027 compared with current law, according to the nonpartisan Congressional Budget Office (CBO). Healthier and wealthier people may choose to forgo coverage, and even poorer, medically needy people may not sign up for insurance because they don’t know which options are available and there may not be the same sense of urgency to enroll without the mandate. The CBO also predicts that premiums in the markets would spike 10% without Obamacare’s individual mandate as the exchanges are left with a sicker consumer pool. However, for most Obamacare enrollees (those making between 100% and 400% of the Federal Poverty Level), an accompanying increase in federal subsidies will make up for higher premiums. Those making above that income level (about $48,000 for an individual or $98,000 for a family of four) will have to face the brunt of premium increases, though.

So in reality, repealing the individual mandate will either raise your health insurance or increase government spending. The latter might get solved with a tax hike or legislation which passes the cost back to you. All this was done so Republicans could lick Trump’s boots as they celebrate a windfall for millionaires, break promises to shore up health care, and pretend the hasty process hasn’t created a future shitstorm.

I hope to hell you aren’t gonna take that lying down, no matter what side of the political aisle you’re on.