Posts by Michael Wojcik

Re: Puzzled Old Fool Wonders About Permanently Stored Keys.....

Did I miss something?

An opportunity to learn how Diffie-Hellman (which should really be "Diffie-Hellman-Markle", as Diffie pointed out some years ago, and arguably should be called "Diffie-Hellman-Markle-but-only-because-Ellis-Cocks-Williamson-weren't-allowed-to-publish") key exchange works without UNNECESSARY SHOUTING.

OP's post was wrong. That's the other thing you missed.

Encrypted data requires a key to decrypt it; that's what "encryption" means. Can you replace the actual key data with a procedure to generate it? Sure. Does that gain you anything, from a technical or legal perspective? It does not. By Kerckhoff's Principle, whatever is secret is the key; making the key fancy doesn't mean it stops being a key. And laws are rarely stymied by someone being a clever dick. A judge isn't going to say "oh well done, you've got us there!". He'll just throw you in the pen for contempt.

Re: What I like about X

Some X11 servers came with the DPS X extension built in. AIX's did, for one. (There aren't any AIX workstations now, I believe, just headless servers; so "AIX X11 server" is a thing of the past.)

I remember doing a bit of DPS stuff under X11 on AIX 3 back in the day.

Re: Usability, frustration, anxiety, visual fatigue, motion sickness

The point of Metaverse is to make money for Meta. Anything else is a secondary consideration.

(As for VR meetings – ugh.)

Re: So in conclusion

Of course not. For a bicycle you want a CLI.

Re: Eye strain and nausea

I've found New Mexico sunshine and no headset at all works just fine for me.

Re: Disembodied business casual

When I were a lad, we had to imagine gnawing our colleagues' limbs off for our dismemberment fantasies. And they hadn't washed, either.

Cloudflare is used for things that aren't exclusively web-related, such as DNS. Per comments above.

But, yeah, if you weren't caught out by using Cloudflare-backed DNS, you probably wouldn't have observed too many issues with your SSH connections or whatever.

I missed the outage, thanks to my time zone and working hours, but it probably wouldn't have troubled me too much since I'd still have the corporate network and there's no shortage of things I can be doing.

I have mixed feelings about Cloudflare, but they are generally quite good about explaining what went wrong. They also publish a lot of good technical content in general.

Mark Boost, on the other hand, sounds like a spoiled brat. "Everything isn't perfect! My gratification isn't immediate! How dare you!"

I've been using the public Internet since a few years after Flag Day, and I've managed to avoid panicking when I can't "access the online services that are part of the fabric of all our lives". Sometimes there are, y'know, network interruptions. Or power interruptions. Grow the fuck up, Mark.

Re: Bitcoin is still "worth" about £20,000

I wouldn't pay $25 for all the BTC in the world

Really? I would.

I mean, it'd be a great line to drop at parties. "What do I do? Oh, I work in computers. Also I own all the Bitcoin. Yup, bought it all, shut the whole thing down. Just a hobby, really."

Or: "Yeah, I remember when everyone was talking about Bitcoin a few years back. Whatever happened to that?" "Well, funny you should ask..."

Also, by definition "all the BTC" would be an NFT, and $25 is pretty cheap for one of those. "Sure, I dabbled in the NFT fad, just for a lark. Only spent a few dollars on it. Got all the Bitcoins."

It's the sort of thing Hat from XKCD might do.

Re: Identity theft protection services

Also, anyone who hasn't put a credit freeze with each of the big three credit reporting agencies (Equifax, Experian, TransUnion) should.

Anyone in the US, anyway. By law, freezing at the big three is now free. Just do it. Do it for your underage children, too; if they have SSNs, they're vulnerable.

And then freeze at as many of the smaller agencies as you can. There are dozens of them, so good luck. Innovis and Chex are a good place to start. Here's one article which lists some of them. I've only skimmed it so I can't vouch for its quality.

We've received free "identity theft protection" dozens of times, thanks to the regular parade of breaches. It's never notified us of anything. On the other hand, we've never discovered evidence of successful identity theft – just the occasional compromised debit or credit card details (which has been a widespread problem in the US thanks to foot-dragging on adopting EMV).

Usually what it means is we can expect a flurry of offers to start paying for the "service" in a few months.

I just tell 'em to go back to Vega.

Many of my friends are Apple users, and only a few are lumberjacks.

Re: Scary

Nah. Polyglots already existed before this. Small hosted execution environments existed before this. Unless you're a fairly feeble exploit developer, this is not new.

As I wrote above, it's good work. It's not breaking new ground, particularly not in the world of advanced malware (APTs and such).

It's a fine technical accomplishment. I'm not sure it rises to "remarkable" if you follow this sort of work. Like, say, PoC||GTFO 14, which is a PDF (of the issue's contents, of course), a zip archive with the samples from the articles, and a Nintendo ROM with a playable game, all in one file.

And the text of the PDF includes the PDF's own MD5 sum, so they had to calculate an MD5 collision on top of their three-way polyglot. (Because, of course, if you take the MD5 hash of a PDF and then add it to the text, you'll change the hash.)

So, yes, congratulations to Justine for some fine hackery in the best sense, attending to how things work at the low level and bumming bytes. Good stuff. Not astonishing, though.

Re: Justine

All respect to Justine, but creating polyglots is not "computer science" under any useful definition of the term. It's good old-fashioned hacking, of the sort that could get you a nice article in 2600 or PoC||GTFO.

Indeed, if you read the PoC||GTFO collections you'll find plenty of examples of similar work.

Re: One coin one vote

Oh yeah. Just search for "flash loan" on web3isgoinggreat if you want some representative examples. (Not all the flash-loan attacks involve increasing stake for a voting takeover, but some do.)

Those suffering a schadenfreude deficit may want to head over to web3isgoinggreat occasionally for more like this story, by the way. It's generally pretty horrortaining.

Re: "we've been unable to get the whale to reduce their risk, or even get in contact with them"

It's not impossible, but it's really hard to tell (even with the advances that have been made in de-anonymization of cryptocurrencies and related tech). Thanks to the 2021 bubble, even many individual investors ended up with notional hundreds of millions of dollars' worth of cryptocurrencies. So this could be J. Random Dude.

Re: Grrr!

And by casinos for customers who drop a lot of cash, and so on.

Re: Boats

Dijkstra was a world-class curmudgeon and master of the soundbite, but like many of his pronouncements, this is pithy but not profound. It dismisses the question while resolving nothing.

Dijkstra had a fine intellect which he applied vigorously to questions that interested him, but he was often outright anti-intellectual for those that did not.

More precisely, it was meant to avoid epistemological questions about machine intelligence. That's pretty much what all of pragmatism (the philosophical school) is for – getting out of what Barbara Herrnstein Smith (much later) called the "epistemological scandal" by admitting that regardless of whether there's a metaphysical essence, we don't have any access to it; all we can know about are the testable attributes of a thing.

It doesn't completely foreclose questions of machine intelligence. Turing does state, in section 6, "The original question, ‘Can machines think!’ I believe to be too meaningless to deserve discussion". (I suspect the exclamation point is a typo, but that's how it appears in Mind 59.) But that's because he's replaced it with a pragmatist formulation. Questions of cognition (human-like or not) in machines remain relevant for philosophy as they seek to expand on our concept of mind; they're relevant for engineering as they push us to explore new technologies adjacent to them; and they're already relevant in society and law as we see conflicts over, for example, the assignment of patents to machines.

Re: YES!

That's a rather weird, and I suspect ultimately insupportable, definition of "being". But it's hard to tell what exactly you're pointing to.

I haven't seen a convincing warrant for "only running while answering a query" as a necessary condition for sapience, and in fact you can easily argue that human beings would remain sapient even if they were "paused" and "resumed". Indeed, everyone who believes in the possibility that our (visible) universe is a simulation, or who believes in cryonic preservation, implicitly believes that.

A better objection to the possible sapience of any transformer model, I think, is that we have many fields of research showing extra-linguistic and sub-linguistic components to human cognition. If language doesn't suffice for human cognition, then that shifts considerable probability against building human-like machine cognition solely out of language.

So, for example, in neurology you have things like the work of Antonio and Hannah Damasio's team on the effects of somatic inputs on cognition. In psychology you have the vast array of well-documented cognitive fallacies humans are prey to. Narratology has contributed some rather extensive theorizing on how humans construct narratives from sensations, ideation, and reflection to condense a stream of thought into meaning. (Incidentally, you'd find some ammunition for your "sense of the passing of time" argument there.) Phenomenology has documented the peripatetic and chaotic nature of human consciousness. Much work has been done examining the vexed workings of human memory. When a model includes non-linguistic mechanisms comparable to those, and others, we might see something that's a bit more difficult to distinguish from sapience.

Or we might build a model which does something that we think might be sapient, but in an entirely different way. But then it wouldn't be human-like.

Re: Sentience? Meh...

Add a laser pointer to the apparatus.

Re: Sentience? Meh...

Yes. There are situations where machine sentience is an interesting question, but this is not one of them. Sapience is the matter at hand. Lemoine and many commentators got that wrong.

(JFTR, I think it exceedingly unlikely that any human-built artificial system to date is sapient under any useful definition of the term. Sentience is in some ways a harder problem, because sentience among organisms is still very much under debate. There's an argument for calling any cybernetic system – that is, any system with a feedback-based control mechanism – sentient, on the grounds that it modifies its behavior in response to stimuli.)

Re: The real issue

Pascal was a Christian

Sure, but "I think therefore I am" (cogito ergo sum) was Descartes.

Re: Chinese Room

It defies any purely physical description of any mental process.

I'm afraid you've fundamentally misunderstood it. See my other post in this thread.

Re: Chinese Room

The thought experiment itself, but not Searle's entire argument. It's important to read the actual Chinese Room piece ("Minds, Brains, and Programs"), and at least skim some of the initial responses to it from the "symbolic manipulation" school of AI practitioners, and then Searle's response to those responses.

The Chinese Room can be seen as an exercise in ordinary-language philosophy, specifically of phenomenology. Searle describes the experiment, then says "I'm not sure what I think thinking is, but I'm pretty sure I don't think it's that". But in his response to the initial challenges he notes explicitly that he thinks mechanical thought is possible, because he believes the human CNS is mechanical. In other words, he took a monist position on the theory of mind: that mind is an effect of the body, and the body is a physical mechanism. There's no magical spiritual or metaphysical component that makes human cognition something that could never be achieved by artificial means.

So the Chinese Room argument is that artificial cognition may be possible (in fact Searle believes it is), but it's not a matter of manipulating a set of symbols which have no further mental depth.

Re: Programming for smart contract execution... What could go wrong?

If your software isn't sitting in an append-only register, you can, y'know, fix it.

As it is, there's a large body of methodologically-sound research showing that the smart-contract domain is rife with terribly buggy programs. If anything, it seems to be worse than the (appalling) state of software in general.

Re: The final stage of the crypto collapse

Since the cost of these attacks is extremely low, it really doesn't matter. If the attacker extracts 1% of the nominal value as hard currency and/or goods and services, they've made a decent day's payout.

Also, as we saw in a number of cases, a number of the True Believers have cash reserves they're still willing to pour in to try to prop up their houses of cards. (Ugh, that metaphor is so mixed it looks like I got it from Tornado. Anyway.) So there's still room for the artful types to extract real value before the whole thing goes cold iron.

Re: this oracle implementation was reviewed by a competent third-party team as well

I don't think anyone's found a problem with the oracle implementation. The oracle design was broken.

Re: no computer criminals get sentenced hard enough to discourage them or others

Yep. Organized crime typically operates like an MLM, insulating the organizers from most consequences. And why wouldn't it? Criminals can see how businesses work, and since they're committing crimes anyway, there's no regulatory framework or other mechanisms to discourage them from exploiting their employees.

Re: How much longer is it going to take ?

There's a wide array of psychological traps that make people fall for various cons. Some studies suggest those who are most confident they can detect scams before falling prey to them are actually more easily fooled by certain approaches.

That includes 419 scams. One 419 victim in Michigan was the treasurer of a good-sized firm and embezzled a large sum in order to feed the scam. That's someone with financial training and experience, and sufficient focus to rise to a high-level corporate position. Often desperation overrides rational calculation.

And, alas, there have been some financial schemes which sounded too good to be true but nonetheless were (often because some government body didn't think things through). The Economist had a retrospective several years ago on audacious (but legal) financial deals which included a few of those. So there's always that sliver of possibility to tempt people.