* Posts by Ian Michael Gumby

4454 publicly visible posts • joined 11 Apr 2006

Tech billionaire Khosla loses battle over public beach again – and still grants no access

Ian Michael Gumby
Facepalm

@Charles 9 ... Re: @Ian, close but no cigar... All you really need

I wasn't being totally serious.

You could do this a couple of ways legally.

1) You could get a movie permit and film on the beach a remake of a scene from 'Surf Nazis Must Die' Or something along from the scene from 'Apocalypse Now'. Why? Because Khosla doesn't surf!. Just film it and put it up on YouTube.

2) You could do it and if they ask you to turn it down, you do so. The police can't just fine you without first asking you to turn it down. Then, after being caught, you have a different group of people who weren't present the first day to host a party. And so on...

3) You could get a permit to protest. Here there's the issue of your first amendment rights and your right to assembly as long as its peaceful. (Remember the beach is public property).

So if you have a sympathetic person at City Hall, you can do it. Even still... have a BLM protest... (Beach Lives Matter)

Ian Michael Gumby
Boffin

@Charles 9 Re: @AC GET OFF MY LAWN

So which comic book did you read and found the ad to send $5.00 to get a JD degree?

I suggest that you actually learn the meaning of the term vexatious litigant.

Khosla is the one being sued. He's not the person using the law to harass others. In fact he does have some law in his favor .

Being forced to pay the opposing counsel's legal fees doesn't make you a vexatious litigant.

They sued him and the legal costs could be considered in part the damages that they could claim.

(It depends on the case and type of case whether or not you can collect for your legal fees.)

Because of the ramifications by naming someone a vexatious litigant, courts loathe to use that term and find someone to be a vexatious litigant.

The closest I've seen recently is a lawyer in Chicago who got in to a massive fight with his condo association over dogs, even to the point where his wife attacked a dog walker in an elevator and claimed she attacked her. You can find it in the Chicago Tribune. And yes I know some of the people involved.

Ian Michael Gumby

@Danny, Re: @Notas Badoff Over my dead body!

The previous owner is the one who could have granted the easement. For some reason he didn't.

The owner set up a shop and allowed access, however he didn't formally allow access so that when he sold the land, there is no reason why the next owner has to allow access to the beach.

The rights the previous owner gave were not permanent. So that Khosla could close it down.

Except that he couldn't due to the other laws outside of the property law. Which is what led to the lengthy legal battle.

Ian Michael Gumby

@MachDiamond... Re: Boo Freakin' Hoo

You're right, there is nothing in the law that says that an easement has to be maintained, it just deals with granting passage.

However... there's this thing called liability. Someone crosses your property and steps in a hole and twists an ankle, guess what? You will be sued. Improved or unimproved... you will still get sued.

Even if you go to court and win, it still costs you money.

Even if you improve the land... you will be sued.

Which is why he would be better off selling the land to the city.

Ian Michael Gumby
Boffin

@John Savard Re: Boo Freakin' Hoo

Ok,

Here's the thing. This is the complicated part.

Khosla is correct in that there is no easement.

So, specifically, the prior owner did not grant an easement to the city (public) which would have ended this issue when Khosla bought the property.

There is no fraud on the part of the city, county or even state. There is no 'right of way' document. This is why Khosla has legal standing not to allow people to trespass on his property. If we were only dealing with an issue of an easement... Khosla would win. But there's more to it...

There is a law however that forces Khosla to grant access to the beach because he has 'land locked' a piece of public land. (Actually there are a couple of laws which force him to grant access.)

Khosla is also correct in that he faces unknown downside in terms of potential liability if someone is hurt on his property.

The issue is that you have a couple of different laws at work and there is a conflict in how the laws are being interpreted. (Hence you either hash it out in a room full of lawyers or you go to court.) Khosla wants to keep people off the beach, so he's not going to cave. We know his position.

The simple solution would be for Khosla to sell a strip of land to the beach. He could be forced to sell via eminent domain, however the mayor has political aspirations. Note that city offered $380,000 for the land, Khosla said it was worth 10 million. (He should be careful in what he asked... )

What is being set up is that the city will use eminent domain, and Khosla will sue because he will claim the city is not giving him fair market value. Thus tying it up in court for a few more years.

Here's where it gets interesting. 90 acres sold in 2008 for 32.5 million is $361,100.00 an acre. While I haven't seen the map, it sounds like the city wants to buy one acre for the access for $380,000.00 .

On the surface it seems reasonable, given the price he paid. Even if you were to double it... its still far short of the $10 million Khosla countered with.

IMHO if the city were to offer him $500,000.00 for the acre it would pass muster. (Meaning its over the fair market value. )

Of course, here's the downside for Khosla.

If he were to claim that the property was worth $10 million, and the city did pay that... then his other property (89 acres) would also be worth 10 million. So he should be taxed at that level. I don't know what the property taxes are in California, but you can bet he'll be seeing red for a while.

If Khosla was smart, he would sell the land and be done with it. He has no upside.

Ian Michael Gumby
Big Brother

Re: Alzheimers?

I think you're the one with Alzheimers.

McNealy was talking about the little people Billionaires can afford to buy privacy.

Ian Michael Gumby
Boffin

@Kev99 Re: Federal public lands law

And Khosla doesn't own the beach.

Just the property surrounding the beach.

So if you can get to the beach you can surf.

I agree that there should be a statute in California law that would force Khosla to grant access.

But there isn't.

The city could use eminent domain.

Khosla could sue if he believes that the price is too low. And he could keep it tied up in court for as long as he wants to, unless the city gets a sympathetic judge. The mayor didn't use eminent domain because he has poltiical aspirations and someone with a couple of billion dollars can buy influence to shut him down.

Note: If I have miles of coast line and the first 500 feet of shore is public land, its the 501st foot that starts the private property. Of course one person couldn't buy all that land. However if its a cove, then its possible.

Ian Michael Gumby
Megaphone

@Ian, close but no cigar... Re: All you really need

You trespass and you first get a ticket. Then after a while, you go to jail.

You damage the property (e.g. knocking a gate down), you can be sued and also charged and go to jail.

What you need are a couple of boats, some very large speakers and a copy of Wagner.

Remember the beach is public property. What's to stop a group of people to show up at dawn coming in to the beach playing Ride of the Valkyrie and throwing a loud party?

Khosla can call the police, but they would still have to get to the beach...

If the city is sympathetic to the beach goers.. ;-)

So what you really need is an LST or a duck.

Ian Michael Gumby
Boffin

@AC Re: GET OFF MY LAWN

He won't be thrown in jail.

He's buying time.

The solution is for the city to use eminent domain. He'll use his lawyers to drag it out for as long as possible. A good lawyer and a friendly judge could short circuit that as well as the appellate courts.

Kholsa knows he can drag it out and the case could languish for years.

Khosla doesn't care about being important or missed. He's got his money and his friends.

I agree that Khosla is going to lose in the end, but he's doing this out of spite.

Ian Michael Gumby
Boffin

@Fan not so Obvious Re: Political catering

Clearly you're oblivious to the law.

I suggest you actually read up on Easements and rights of way. (Google can be your friend)

Once an easement is given, its hard to remove. (It can, but in this case... it wouldn't happen.)

The prior owner would have had to file for an easement that is then part of the property title. No easement, Khosla can be the grumpy old man yelling for the kids to get off his lawn.

The city screwed up because they could have used eminent domain at any time. It has nothing to do with changing zoning laws.

The fact that the mayor wants to be governor and doesn't want to piss off the ruling elite, that is the problem.

The state of California screwed up because there apparently isn't any law that forces someone who owns the property surrounding another one to be forced to grant an easement of access to that property. This does exist in other states. Or if the law does exist, why it wasn't used by the plaintiff's lawyers.

Ian Michael Gumby
Boffin

@Notas Badoff Re: Over my dead body!

It doesn't work that way.

The previous owners screwed up in letting the public have access including putting up a storefront without having given an easement to the city to allow public access.

Once an easement is granted, its very difficult to remove the easement. (Both parties have to agree.)

So that would have avoided any of this mess.

The other remedy would have been for the city to use eminent domain.

They could easily do this an force Khosla to sell at market value. (Since the city sets the property taxes, they assess the value of the property.) So had Khosla said 500K and the city 380K, the city would have bought at 500K. (The legal costs would have exceeded the difference)

In other states, when you have one property that is surrounded by another property where there is no viable access to the land, the other property owner has to grant you access.

So while the beach is public property, Khosla's property surrounds the access to the beach. So the courts should have forced Khosla to grant an easement. Since they haven't done this... I guess its not a law in California.

Khosla should have lost this by now, were it not for the political ambitions of the mayor who could have used eminent domain which the courts would have allowed.

Surfacegate: Microsoft execs 'misled Nadella', claims report

Ian Michael Gumby

@DJO Re: Not surprised...

This would be true if you're looking at the overall price of the component and the price of the SSD.

As SSDs become cheaper, you'll start to see this because it will reduce the cost of the component.

If you have a tablet, do you really need 128GB or more of flash storage?

Not for today's use cases, but in 5 years time, who knows. The point is that if the cost of the flash chips drops, and the price of the component drops to a reasonable point where its cheaper to replace than to fix... you'll see it.

I mean if you drop and crack your screen on your iPhone and the cost to repair it is 25% of the cost of the phone or the cost of the upgrade to a later model... you have to consider which is a better choice. (Once a phone is broken, even repaired, its never the same. Of course, YMMV.

But you get the idea.

Lauri Love and Gary McKinnon's lawyer, UK supporters rally around Marcus Hutchins

Ian Michael Gumby
Trollface

@Tom Re: But...

PS: Supper long prison sentences would massively reduce the overcrowding in prison cells.

But what will they give you for dessert ?

Ian Michael Gumby
Holmes

@AC ... Re: But...

The moral of the story is to first learn what you are talking about.

The DAs always talk hard and the harder they talk, the more likely the case against the person is BS.

They want him to take the plea deal because its a win for them and they can notch their belt and move on.

The question is what evidence does the FBI have against him?

In terms of getting an indictment, any evidence that is proffered is accepted at face value to be true. Its at trial when the defense team can take apart the evidence and convince a jury that he is innocent.

Taking a plea deal is an admission of guilt in exchange for a lighter sentence.

If they have real solid evidence, he should take the deal.

If they don't. He shouldn't.

If he's completely innocent, he shouldn't, and should fight it.

With a felony conviction, he could be free to go back to the UK, however, he will have no career in IT, and could be limited where he could travel. Some countries will refuse him entry because of his conviction.

I am not suggesting he is innocent or guilty, but that you need to understand the situation of what is real and what is not. You have a twisted fantasy of the guy being sent to supermax for a white collar crime.

Gen Pop would be way more dangerous, depending where he is sent.

Salesforce sacks two top security engineers for their DEF CON talk

Ian Michael Gumby

@TheVogon

If you walk away with anything and reuse the code you are on thin ice regardless of if its a trade secret. In fact, the company could call pretty much a ham sandwich a trade secret and have grounds to sue you in to oblivion if they wanted. (You got caught walking away with their code.)

The developers aren't in the wrong unless the company can show that they disregarded the text message prior to their talk. Remember the company did give prior approval of the talk before they left for the conference which means that they had reviewed and approved the content.

Ian Michael Gumby
Mushroom

@FuzzyWuzzy? Put down that crack pipe son, its rotting your brain.

I guess you don't bother to read or pay attention to some of the news stories... Stop me if you've heard this one... There's this company called Waymo that was recently purchased by Uber...

There are more stories like that where a programmer who worked for a trading company got jail time for stealing proprietary code he wrote when he went to work for another company.

The point is that as an employee, your work is owned by the company and you have no writes to the work unless the company expressly grants you rights to them.

You want to work on an Apache project? When you submit code, you are agreeing to indemnify Apache if they get sued and you are explicitly claiming ownership of the work so that you can grant Apache license to use it.

Salesforce is in trouble and can be sued for the termination.

The issue is that they first approved the presentation. They then attempted to cancel it before they were to present. If the claim that they didn't see or get the text before the presentation started, is true, then they shouldn't be fired because they were unaware that the presentation had been rescinded.

If the company can prove that they saw the text and said 'oh fsck it', then they would have been right to terminate.

I'll wager that the company will give them a heft severance settlement to quiet things down.

BTW, if you take your code with you... you are breaking the law and you can be sued. Even if you win the lawsuit, it will still cost you massive amounts of money and could get you terminated from your current job.

Blocking peeps on social media? That's a paddlin' for governors, senators, house reps

Ian Michael Gumby
WTF?

So... riddle me this... when is a democracy organized?

In truth Democracies tend to be one of the more inefficient forms of governments.

Ironically, that's actually a good thing.

Ian Michael Gumby
Boffin

Meh!

So...

Let me get this straight.

The US politicians have taken to use social media to expand their reach in to the getting the word out.

Yet they block individuals from being able to access said accounts.

Ok? And?

I mean if Sen. Al Franken were to block Anne Coulter from his account, do you think the Press would care? (Franken is liberal, Coulter is Conservative.)

Also why would a politician ban someone from their social media account unless said person was a twat and was abusing the privilege ? Suppose you were following Trump and then started to retweet "Trump is a meanie..." or something worse? Would it be wrong for Trump to say buh-bye, you're banned from being one of his followers?

Public Servant or Private Citizen, its the same thing. If the service (Twitter) allows one to ban followers... then the right to do so exists for all.

Seems there are lawyers who are happy to take your money or do it to make a name for themselves.

Wouldn't it be great if we had a legal system where the loser pays? Now that would shut down this carp fast.

FBI's spyware-laden video claims another scalp: Alleged sextortionist charged

Ian Michael Gumby

Re: One overlooked problem

They wouldn't have busted down the door.

There's more to the investigation than a single point of contact.

Its that single point that leads to a location that leads to further investigation.

Ian Michael Gumby

Re: I've never been so happy..

I think he was saying that if the bloke were to repeatedly slip and fall in the shower, he wouldn't shed a tear.

Or that the guy should become Bubba's bee-itch

Cisco's server CTO says NVMe will shift from speed to capacity tier

Ian Michael Gumby
Boffin

Flawed logic

The article talks about the use of the NVMe drives for doing just in time analytics. Their example of a recommender engine is a poor example.

Recommender engines will be based on batch jobs which will run off peak local to the user and then be used for the next 'day'. Note for global companies night/day become relative. Recommender engines to not need to provide near real time calculations, only the ability to retrieve the calculated value which does not need to be precise.

More unnecessary hype where the plain facts are enough to say that these will be disruptive in terms of overall IT performance.

No vulns. No hardwired passwords. Patchable. Congress dreams of IoT: Impossible Online Tech

Ian Michael Gumby
Boffin

@AC ... Re: @Gene Cash

If you're in the middle of a procurement cycle... meaning that you've already agreed to purchase X units... you can continue that cycle.

Of course at the same time you expect the vendor to issue a fix and re-certify that they are free from known vuln.

Yes, its a lawyer trying to understand the SDLC and software development. Its just as bad as when a lawyer wants to play doctor.

Its their way of answering ... "What do you mean my mail server was hacked because of a security bug that my vendor never patched and had known about it for the past X years!"

The key here is that the Gov can then go after the vendor and force them to repay $$$ and/or fix the vulns...

But then again... what do you do when several congress critters hire a Pakistani con-man to do their IT work where he hires out his family and some ghost employees to do the real work...

Ian Michael Gumby

@Brian Miller Re: Known vulnerabilities

The issue is this...

Suppose there's a vuln that you know of Aug 1.

You don't fix and ship your product Aug 2.

You're in trouble.

Now suppose there's no known vuln Aug 2 and you ship.

Aug 3, there's a vuln found.

You're ok, but you have to be able to push out a patch.

That's what they are saying.

So shipping out a Linux distro that has a 10yr old vuln that no one fixed... you need to fix it ASAP.

Of course... its meaningless because you will be self certifying your kit that you flog.

Ohm-em-gee: US nuke plant project goes dark after money meltdown

Ian Michael Gumby
Mushroom

@JK63 ... Tornado / Earthquake proof not that hard.

Building a nuclear plant that can withstand a Tornado or Hurricane (This is S.C ) isn't that hard.

The designs are fairly well known and thick re-enforced walls will stop debris.

Flooding too can be managed and earthquakes... while rare can also be mitigated.

Protecting against an aircraft hit?

That's going to be a weird one that will take a bit of testing/modeling.

I mean a 787 with full tanks of fuel... You'd have to consider the speed and angle of attack.

Of course if you build the bulk of the plant underground, you could do it...

Although in Low Country... you may have an issue with flooding.

GPS III satellites and ground station projects get even later as costs gently spiral

Ian Michael Gumby
Boffin

Re: Do you have any idea how GPS works?

Sorry Lee, had to down vote you.

You forget to mention that all of the clocks in the satellite are synced.

So at time T, each sat broadcasts the time and based on your distance from the geo stationary sats, the signals will arrive at different times. So that you can triangulate your position by knowing the fixed positions of the sats and the deltas in the clock signals. (All signals travel at the same speed, c. )

Its not the time differences, but the deltas for the same time signal to arrive at your location.

A small nit, but a big difference.

Don't mind if I do, says Nokia, taking a €1.7bn chomp out of Apple

Ian Michael Gumby
Boffin

But but but ...

Nokia doesn't make anything anymore !!!

Sorry no sarcasm tags, because its obvious.

Look, the issue is that its difficult to accuse a 'patent troll' of doing something wrong, let alone defining what a patent troll is...

Would you call Google a patent troll? How about IBM? Apple?

Funny, but consider this..

<some company> goes under and auctions off their IP.

IP is a tangible asset that can be bought or sold. Joe buys up some of the company's IP.

Joe who is a Wall St. Investor does this as an investment. Joe then sue's a compay? (Lets say Apple) for infringing on the patents. Is Joe a patent troll?

Instead of Joe, Google buys the patents. (Replace Google with any other company). Google then sues Apple for infringing on the patents. Are you now going to call Google a patent troll ?

That's the problem.

There's more to a patent troll than just suing to protect their investment in IP. IMHO its how they go about doing it and who they sue. Google, Apple, IBM, etc ... will sue the manufacturer who violated the patent. Not the consumer of the patented product.

The point, boys and girls, isn't that the action of buying an asset is what makes one a patent troll, but their actions on how they protect their investment. So you need to learn to use the term properly.

With respect to this case. Nokia... had they gotten the money from licensing, do you think that maybe they would still be in business today making phones? So maybe Apple is a little more evil because they willfully violated the patents for their own benefit?

Just food for thought...

Google tracks what you spend offline to prove its online ads work. And privacy folks are furious

Ian Michael Gumby

Re: This is why you want anonymous payments

But its not anon when you have to register the title and transfer the title and pay the tax. Cash or not certain transactions are going to be noticed.

Ian Michael Gumby
Black Helicopters

@Daedalus Re: News indeed

Affinity cards is one way to track customers while at the same time the store has all of the credit card purchases made by customer.

Its when you have the Store branded affinity card selling your shopping history to a third party that you start to have issues.

With respect to Google, they have connected two separate PII data sets that create a really criminal bit of snooping.

Suppose you are diabetic. So they start to show you adds for diabetic products. and then tie back your pharma purchases for drugs and glucose meter supplies back to you. Along with your other prescription meds.

That's a no no and it would be illegal under HIPPA.

Google's only defense is that they can 'protect' the information, all the while they are snooping on you worse than the government.

Free clue. With the government they have laws. Google just laughs at it and does what they want until caught and threatened. Another free clue. Google can always sell your data to the government of your choice. (Now you wonder why they were cozy with the Dems? ;-) Moffit field use at a low price including a discount on fuel? ;-)

Amazon 'mulls' deeper health tech invasion with stealth skunkworks

Ian Michael Gumby
Boffin

Seriousl Daft!

Gartner analyst Anurag Gupta said the field was ripe for disruption. This is partly because of the “asymmetric information” balance in the sector – where patients have significantly less information than their clinicians do – and the idea that patients are steadily “morphing into the healthcare consumer,” he said.

This is so wrong it would be laughable if it wasn't so dangerous.

You can hand the same information to both the patient and the clinician. The biggest difference is that the Clinician will understand what the data represents. If you don't believe me, then ask your doctor why they hate the internet. Patients are given access to information, yet they don't understand what they read.

You can't replace the doctor with a machine, there's more to medicine than just diagnostic tools.

Amazing new algorithm makes fusion power slightly less incredibly inefficient

Ian Michael Gumby

Re: Here are some free ideas

You need to check out some of the research by MIT.

There are designs that make using newer super conducting magnets viable. And newer materials.

Tokamack ?Sp? is based on toroid design but some of the incremental research is using linear systems.

More funding is needed and leaps in R&D and material science.

Ian Michael Gumby
Boffin

Re: Back in the day

The article talked about an improvement in the temperature and efficiency over current methods by a factor of 2.

You can go online and find YouTube vids on MIT research in to Fusion and their take on R&D outside of the large scale Tokamacs ?sp? where they want to use the plasma shape to help with its efficiency.

The issue is to raise the temps and the longevity of the 'burn'.

And yes... its still just 50 years away.

I blame Bush, Obama and Congress over the past 12+ years for killing high energy funding.

The interesting thing is the super conducting materials used to help create the magnetic fields has advanced. Kinda cool. So you should check out the vids.

Boffin supercharges FPGAs with timing signal tweak

Ian Michael Gumby

@ John ... Re: Abstract is not clear what is being changed.

This is for a specific FPGA. This implies that all of the FGPA compilers are open to this type of improvement.

To be honest, its this sort of low level grunt work that gets overlooked.

Ian Michael Gumby
Thumb Up

@Kevin Re: Love the comment...

Most PhD papers are meh. Meaning that they aren't as radical or disruptive.

This is really cool work and it shows that the tools you get from the OEM isn't always optimized.

This should make those working for the vendors stand up and say 'doh!' .

Again Thumbs up for a good job.

HoloLens: Microsoft brags about AI chip in next-gen techno-goggles

Ian Michael Gumby
Paris Hilton

Can someone define what is meant by AI?

Seriously,

Yet another term that has been morphed by the marketing droids to make their stuff sound cooler than it is.

Paris? Why? Because my AI is smarter than a blonde. ;-P

I've got a verbal govt contract for Hyperloop, claims His Muskiness

Ian Michael Gumby
Trollface

@Snorlax ... Re: Please complete this sentence Elon:

A verbal contract may or may not have value.

A 'verbal' government contract has no value.

Maybe he was talking to Gov. Brown of California. Now that's a contract you can use as a spring board to bounce off of.

Let's harden Internet crypto so quantum computers can't crack it

Ian Michael Gumby

@Technical Ben Re: Neat idea. Obviously depends on the qualtiy of the "random" generator

Exactly.

So you generate your one time use pub/pri key (Assume a reasonable length of 8096 bits ) and then use that to wrap around the shared secret.

The spy would have to capture all packets being sent in the stream and then try to break the decryption by first finding the initial pub/pri key and then trying to determine the shared secret.

Now if you have a rolling encryption where the shared secret changes frequently... or rather frequent enough... your messages will be very, very difficult to crack and it couldn't happen in subjective real time.

So you can encrypt streams well enough that current and next gen(s) quantum computers could not easily crack your stuff.

Ian Michael Gumby

@ Technical Ben ... Re: @ Mark 65 Possible deadly flaw - compromised software

Ok.. you've kinda missed the point.

The article suggest that you generate a one time use pub/private key that you send the public key to the other side. They then create a certain random secret and they use the public key to encrypt their response holding the key.

This has nothing to do with the quantum computer except that the quantum computer is trying to break your encryption. Because this pub/priv key is a one time use, its harder for the quantum computer to break it. And then you have the randomized shared secret. The random noise file is something that makes it harder to break than just taking a stream off the random number generator which may or may not be as random as you would hope. I take it a step further and then say take a random number and use that to find an offset in to the file.

The issue was that if the randomized secret wasn't completely random, it would be easier to break.

And you are correct. The whole point of this is to make it impossible to break the keys in subjective real time or in any short order. If you want to make it more difficult, set up a rolling encryption that does this every so often making it more difficult to listen in.

That's the best you can do.

Ian Michael Gumby
Boffin

@DougS Re: Not just to protect stored communications

Actually no.

First, if you're storing data in an encrypted format, you need to be able to decrypt the data for use. So you would be better off decrypting and then encrypting the data over time with newer methods.

Keep in mind that there's a cost to the decrypting that you incur when you want to use the data. ;-)

At the same time... the data will lose value over time.

Think about this... 70+ years after WW II, what is the operational value of deciphering the Japanese or German codes?

Encryption should be strong enough to protect the data as long as the value of the data exceeds the cost of the encryption. Keep in mind that you will also have protections around the data which reduces access to the data in the first place.

Ian Michael Gumby
Boffin

@Milton Re: @ Mark 65 Possible deadly flaw - compromised software

Using your army training.

The concept is to generate a single use pub/pri key as the initial wrapper for the counter party to send you a random secret.

Then you can further use the shared secret...

Simple concept.

The issue being raised was that the random secret wasn't so random.

But if you have a random noise file, changing the offset in to the file will increase the randomness instead of sharing the same file each time. If you were to then change the length of the seed and hash it using a strong algo (e.g. SHA-2) you will have a fairly unique number of a fixed length that is well ... more random and harder to find over time.

Note: If I use the same secret over and over and only generate a new pub/pri key, then its possible to break it w a powerful enough quantum computer. If the secret is not the same... then you will have a bit harder time, now wouldn't you?

Does that make sense?

Ian Michael Gumby
Boffin

@Milton ... Re: @ Mark 65 Possible deadly flaw - compromised software

WHOA!

You misunderstood my comment.

From the article:

The brief explanation of such a key encapsulation mechanism (KEM) is: “the initiator randomly generates a random, ephemeral public and private key pair, and sends the public key to the responder in QSKEi payload. <u>The responder generates a random entity, encrypts it using the received public key, and sends the encrypted quantity to the initiator in QSKEr payload. </u>The initiator decrypts the encrypted payload using the private key. After this point of the exchange, both initiator and responder have the same random entity from which the quantum-safe shared secret (QSSS) is derived.”

The issue that was being raised was that the lack of randomness in the responder's payload.

Yes you are correct. All I would want is a random start point in to the noise file. Yes, even though the file of random noise is random, I wanted to add more randomness by offsetting the starting point in to the file.

Most people download a random noise file than try to generate one themselves. (There are actually web sites that sell random files. )

So if I have a 8KB random noise file, I could randomly set the offset such that I can generate multiple sets of 4K or 8K strings that are less likely to be repeatedly sent to the counter party.

I don't need to do the hash, however the hash would be smaller than the 8K file and would be faster.

The key to this is that the pub/pri key is being generated on the fly and is used one time (implied) and then you're sharing a random secret back. The implication is that the random secret is also one time. Thus sending the same random 8K secret would reduce its effectiveness. By randomly changing the starting point would increase the 'randomness' in the process. If you take a random length and hash, you would increase the randomness with a potentially long enough value that changes each time.

Does that make sense?

Ian Michael Gumby
Boffin

Yo! Zalazny wantabe ... Re: @ Mark 65 Possible deadly flaw - compromised software

One of the assumptions of intelligence is that you assume your opponent has perfect intelligence. Thus they'd have the noise file as well. The proposed solution here is far better than your approach. Nice one, though.

Love your lit reference to a fantasy/fiction character that can never die...

But you missed the point.

No. Perfect intelligence would be that they have the same random noise sample. Thus if you use a less than random number generator, it would be possible to generate a series of pairs of random numbers (offset and length) and could then generate the same hash that you use. (Assuming that they also know which hash you are using.)

But the attacker doesn't have your random noise file, nor do they know which hash algo you're using. So they can't easily find your seed. Which is the point.

Note: I was responding to a fellow commentard who believes that FOSS is better than a proprietary solution. Which in this case isn't true. I just created a simple way to generate a secure random number that would be very difficult to break. The whole example was how to get a more random number or seed for your encryption algo than one from simply using a random number generator which you may find to be less than random...

Ian Michael Gumby
Pirate

@ Mark 65 Re: Possible deadly flaw - compromised software

Actually no.

There are other ways to increase randomness.

Imagine using the random number to find a seek position in to a file of random noise. Then a second number to get its length. And then take a hash for your random value.

Now tell me how a quantum computer can break that since they lack the actual random noise file.

It may not be the fastest, but it will do the job

One-quarter of UK.gov IT projects at high risk of failure

Ian Michael Gumby
Pirate

Re: Why go Anonymous you coward!

25% failure is a high number.

At one client... I had 7 of the top 10 key feature enhancements get handed to me. 100% success.

Next project, same client... management claimed success, we all said it was a bust. Then the next 6 project on third team 100% success.

So yeah, 25% is a high number. Especially when you can easily lower it.

Ian Michael Gumby
Boffin

@AC ...Re: Why go Anonymous you coward!

Sorry, but I am one of those contractors that gets called in to do the heavy lifting. I've worked in telco where 80% of the work was done by contractors/consultants. And this product became the cornerstone of the company. Of course every one of us contractors pushed ourselves to do our best work and we were a band of professionals.

Smaller teams of seasoned experts will always outperform the marching masses... regardless as employee or contractor.

When the contractor believes that he's only as good as his last project... he has skin in the game.

Ian Michael Gumby
Boffin

Why go Anonymous you coward!

<side rant>

Look you silly git, when you have a real comment that no one in their right mind will find offensive, why hide yourself? Or do you just like the Guy Fawkes icon? :-P

</side rant>

25% is a huge number. When you hear it from the government, admitting their failure, we know that they are guessing on the lower side and that the number is much higher.

As an IT professional, I look at some of the projects that failed and I have come to realize that its more than just setting realistic expectations, but that there aren't enough highly skilled developers working out there at all levels.

<rant>

Too many IT people lack the core training that you get from a solid engineering program. Boot camps can teach you to code, but they don't train you in the theory or how to think about solving a problem.

Too many HR types hire in staff who couldn't design or program their way out of a paper bag. Too much focus on agile where its really just a set of iterative waterfall projects and isn't really all that agile because if you need to correct a previous sprint, you've upset their apple cart. RAP/RAD is now becoming a lost art.

Sorry to say, but if the UK gov were to actually spend $$$ and hire top notch guys who have mastered their craft, they would end up spending less overall on the project and come out ahead. Of course this goes back to the real problem... There aren't enough of us to go around and those who are around end up competing with people who cost 1/2 of their rate and lie on their resumes to get the job for which they are not qualified.

</rant>

I apologize for the rant but seriously, this industry is so f-'d up its insane. On both sides of the pond.

FreeRADIUS fragged by fuzzer – by invitation – and fifteen fails found

Ian Michael Gumby
Boffin

Re: C is a [value judgement of choice] language for security

You can use some tools to catch brain farts, but yes, you really have to know what you're doing and learn how to think.

Today, many who think that they can code, can't. The quality of software has gone downhill because bean counters look at the cost of developing software and then having it in production for less time because of the paradigm shifts and language shifts so expensive well written code becomes a luxury.

When you look to hire a senior level developer, check out to see what sort of watch he's wearing.

Ask him why he wears that watch. If he doesn't wear a watch and says his phone tells time for him... that's a major red flag.

Ian Michael Gumby
Boffin

Re: C is an excellent language for security...

Like its been said.

If you can't master C, then you'll never be a Jedi Master.

And Like I said above.

Never put a regular driver in an F1 car and expect good things.

Ian Michael Gumby
Coat

@AC Re: C is an excellent language for security...

Spoken like a person who never mastered the C language.

If you've never learned to code in C, then you'll never be a jedi master.

Said as an old Jedi Master who's written a couple of C programs/apps and an embedded OS still in use today around the world.

Why the Kubernetes Kids can't hurt Bezos' Amazon beast

Ian Michael Gumby

Kinda misses the point...

I agree with the article, and its take on some spin... I also agree with AndyPiper to a point.

Its not about developer convenience but more on lowering the cost of development and time to value.

You can build and test in small dev environments and then deploy anywhere. I can give developers a decent MacBook Pro, and then a small cluster to test local, cluster deployment. Then I can move to production either on prem or at cloud provider.

The thing about lock in... its the high cost of moving data out of the cloud or around the globe w your cloud provider.

Funny thing... IBM's new mainframe... X14 could be a game changer depending on costs.

2017: The FBI alerts parents to dangers of Internet of Sh*t toys

Ian Michael Gumby
Black Helicopters

Re: Ga goo gaa!

You mean the toys that can be morphed in to monitoring tools of not just TImmy but the entire house hold?