Daniel Miessler's Blog, page 74

Visibility and Understanding Lead to Tools and Weapons

Being in security I think a lot about whether things are tools or weapons.

The distinction applies to guns. It applies to encryption. It applies to offensive security tools. And it applies to technologies like machine learning and the use of AI-monitored cameras throughout society.

The link I’m highlighting here is:

Visibility plus Understanding --> Tools and Weapons

Visibility means you have the opportunity to observe a given object or behavior, like a message sent between people, or people traveling from place to place.
Understanding means you can learn a lot about that thing once you see it, like who it is, what it is, how it’s built, how it works, etc.

This applies to so many things. People, bridges, locks, neighborhoods, and populations.

If you know precisely how DNA and human biology work, it’s easier to make DNA-based biological weapons.
If you know how bridges work, and how to build them, it’s much easier to blow them up.
If you know how web applications are built, it’s a whole lot easier to break into them.
If you have visibility into everyone moving within a city, and you can see their faces, and you have ML algorithms and facial recognition software monitoring those feeds, you can learn a lot about everyone being watched.
And if you know psychology, sociology, and neurobiology—and you combine all those disciplines with knowledge of people’s biometric data, their facial expressions, their body language, etc.—you end up with the ability not just predict their behavior, but to influence it.

Medicine and Bioweapons. Civil Engineers and Terrorists. Personalized ads and Population Control. This is the curse of progress.

Weapons are mirror images of tools. The insight that gives you one gives you the other simultaneously. It’s only a question of time.

Humanity’s chances hinge on maturing fast enough to contain the weapons that emerge from the tools that we cannot help but create.

We’re so in love with new functionality—and the money that comes with it—that slowing down is not an option. We run in dark rooms carry scissors because we don’t want to be outside when someone else finds the treasure.

The best we can hope for is a series of small mistakes that hurt us enough to pay attention, but not enough to end us. This seems to be what the Unibomber saw, and why he thought it was acceptable to kill.

He was wrong about that, and also to think what he did could make a difference.

There are billions of dollars being spent right now—using our planet’s smartest minds—to create the breakthroughs that will enable bioweapons, autonomous attack drones, and algorithms of population-scale manipulation.

I find it pleasantly ironic that an atheist like myself is resigned to faith as a strategy against despair.

I’m not sure it’s faith actually. More like resignation—to the unfolding of the universe.

Here’s to hoping we master the tools, and ourselves, before civilization-ending weapons become too easy to create and use on each other.

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Why High-end Podcasts Reduce the Bass in their Audio

I’ve been podcasting for around 5 years now, and at some point in the process, I became obsessed with mics and sound and recording.

For a while I used an RE-27 mic, which was quite nice, but I recently upgraded to a U87AI, by Neumann. It’s probably the world’s most respected mic, used by NPR.

The sound that I thought I was into was a clear, deep sound, and I had created that in various ways over the years.

But then I read a piece about how NRP acheives its famously grep podcast sound, and it was all about doing the exact opposite.

Basically, when people are traveling, driving, on trains, or just generally out and about, there is a lot of low frequency droll.

Like a deep hum that blends into the background.

And what NPR found was that audio that had these low frequencies in it would often get drowned out by—or mixed in with—that noise.

So they decided to cut through using higher frequencies.

They recommend activating low-pass roll-off, either on your mic itself or post-production, which takes that deep rumbly bass out of the voices, and speaking at an oblique to the mic from around 6-12 inches away.

This is taking some getting used to because I love that other sound, but I’m trying to see this as outsourcing a problem to NPR for the last 20-30 years.

They have high-end people who’ve come to this conclusion after decades of experimentation, so who am I to argue with that?

So if you want to make your audio more NPR-like, apply a low-pass filter so your product can cut throught the din.

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

San Francisco is a Microcosm of America’s Future

San Francisco is a strange place.

In one part of town—on any given weekday—you can see tens of thousands of 20-50 year-olds scurrying to their top 5% jobs.

They are educated, they have careers, and they’re minds are on their work, their hobbies, and a search for meaning in it all.

But walk for 10-20 minutes and you can be surrounded by a complete breakdown in society. The sidewalks are littered with human feces and drug paraphernalia. There is garbage everywhere. And people are gathered together without anywhere to go or anything to do. Naturally, it’s a center for suffering and crime.

This area doesn’t just cover a few blocks like most think. It’s actually a massive part of the heart of the city—a city that’s much smaller than people imagine.

This is getting some attention, of course. The media has been highlighting the homeless encampments, the crime, the drugs, the bad roads, the lack of affordable housing, etc.

But the craziest part about this isn’t actually how bad it is. It’s how bad it is just a few blocks from the richest place in the world, with the people there completely ignoring it.

Police—when they are there at all—stand in these areas as if they’re in Mr. Rogers’ Neighborhood. They completely ignore drug use, mentally deranged people, overt littering, and much worse. It’s invisible to them, like everything is ok.

And the privileged people with—you know—jobs and careers and stuff—we do the same. We walk through these areas casting whatever spells in our minds that keep us sane.

We should be doing more to help these people.



This is a travesty. We should be ashamed.



I wish someone would just take all these people somewhere and clean this all up.



This is why I am ok with paying higher taxes; that’s my way of helping.



I need to do more to help with this, but I don’t know what to do.

The Poverty Patronus

We mutter these incantations like a Poverty Patronus that protects us from crumpled bodies on the street, shuffling zombies looking dead-eyed at us as we pass, and all the other poop-shaped affronts to our civilized nature.

Then the phone rings, or we get to work, and it’s time to prepare for that next meeting.

Everything is fine. Nothing to worry about. It was all a bad dream.

Except it’s not. It’s not fine. It’s not ok. And some people—the people you passed actually—didn’t actually wake up from the dream. They’re still living it.

So that’s one point: the people in the top 5% live right next to the people at the bottom, yet neither society (the city, the police, etc.) nor the people (you and me) do much to improve it.

The second point is that this is happening all over the country. Hayes Valley and the Business District are the vibrant coastal cities, and The Tenderloin is becoming everywhere else in America.

We’re producing violent disharmony in this country right now. Disharmony in education, in job opportunities, and in lifestyle. And those divides are like tectonic plates: sooner or later they will make noise and snap back in place.

We saw some of that in 2016, and I think we’re likely to see a lot more in 2020.

If you look at the stock market, the tech sector, and the thriving businesses at ski resorts and meditation retreats, things look quite healthy. We’re doing amazing!

Well, no. We’re not.

You are. I am. But we’re not America.

We’re in the Business District. We’re in Hayes Valley. We’re in the top 20%.

The rest of the country is quietly suffering. They need multiple jobs to pay rent. They are getting pillaged by profit-focused healthcare pricing. And their children have grim options even if they do go to college.

America is becoming Downtown SF surrounded by The Tenderloin, and we step over those bodies on the way to work at our own peril.

As Piketty tried to tell us, the Patronus will only hold for so long.

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 210 (Member Edition)

This is a Member-only episode. Members get the newsletter every week, and have access to the Member Portal with all existing Member content.

Non-members get every other episode.

Sign in

or…

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 209

.errordiv { padding:10px; margin:10px; border: 1px solid #555555;color: #000000;background-color: #f8f8f8; width:500px; }#advanced_iframe {visibility:visible;opacity:1;}#ai-layer-div-advanced_iframe p {height:100%;margin:0;padding:0}

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

I’m Still Mad About Game of Thrones

The reason I didn’t write this earlier is because I’m ashamed to be writing about a TV show at all.

There will be spoilers.

But I liked Game of Thrones, and I cared about it for nearly a decade. So I guess it makes sense that it left a mark.

So I guess—first things first—why am I mad?

Is it because the last season or two were bad? Sure, I guess that’s the easy path. The last season sucked, and they ruined everything. That’s a way to be done with it.

Except it’s not. That doesn’t explain why this is still a splinter in my soul.

Let’s look at the deeper reasons. And let’s start with a capture of what went wrong.

It was too easy to defeat the night king
It was too easy to defeat the whitewalkers
Not nearly enough people died to make it a big deal in the final battle
Many characters didn’t proper treatment, e.g., Cersei should have had a death that matched her life

Those are bad, but the real problem was Daenerys.

This is the reason I’m still mad about this goddamn show.

I’m mad that they messed up her character. And I’m mad that they didn’t realize they did it.

I keep hearing defenses from the TV show producers, and from GRRM, saying that the seeds were laid all along. That we should have seen it. That it went exactly as planned, according to a meticulous plan of character development.

Well, you know what? You’re right. You did show that she could go bad. You did show that she had it in her the whole time. And it was realistic.

But so what. Fuck you anyway. And here’s why.

You turned a character—loved by hundreds of millions of people around the world—into fucking Hitler.

And not a little bit, either. Like actual Hitler.

Uniforms. Mass death. Planned control of the world. The subjugation of any who resist. All of it.

People fucking named their kids Daenerys. She was a feminist icon. She was a goddamn hero.

She represented the light with darkness. She represented breaking away from destiny and being better than what we were supposed to be. What others thought we would be.

But no, you had to honor the original idea and honor all those seeds you planted along the way. You had to see the full tree be born as it was planned from the beginning.

I get that nobody planned on it being as big as it was. And I get that it’s hard to change course on a story and production like that.

But damn.

Once you saw that the entire world wanted this girl to break the chain—to be better—to overcome. You could have found a better way. Hell, I could have. And hundreds of people actually did.

There were tons of lines where she went a little bad—and like Kamakasi’d her dragon into Cersei’s tower killing them both—or some other dramatic ending. She didn’t have to exit as a saint.

But Hitler?

That’s your answer?

Turn the one fucking beacon of hope—built over 10 years—into a genocidal murderer?

And then, to make the thing even worse, you mess up the execution on top of it.

Suddenly the whitewalkers aren’t so bad after all. All the Dothraki die in an episode, but then turn out to be just fine. And so many characters get abysmal resolutions (Jaime, Brienne, etc.)

What we lost wasn’t just a show. What we lost was hope that a show could actually be as good as it promised.

That’s the part that bothers me.

It was a crime against hope.

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Comparing Offensive Security Tooling and Gun Control

A debate recently flared up on Twitter around creating and sharing high-quality Offensive Security Tools, such as Empire. Richard Bejtlich came out against, saying that OST tools were doing more harm than good.

“We believe that Powershell and Empire framework will remain a major threat vector employed by APTs, malware authors, and Red Teams.” SO WHY ARE YOU UPDATING IT? You are improving capabilities you explicitly say are *used by bad guys.* Scottie, beam me up from this bizarro world. https://t.co/3Pnrrel5DA

— Richard Bejtlich (@taosecurity) December 23, 2019

I was about to reply to him pointing out that OST are how Red Teams are able to convince Blue Teams that they need to take the situation seriously. But Amit Serper had just made the same point.

Because that's the only way everyone moves forward. The red team's purpose is to improve the blue team. If APTs won't use PSEmpire they'll create something unknown for themselves (which they often do). Keep sharing knowledge ➡️ keep getting better. https://t.co/G2Gtdwt2pT

— Amit Serper (@0xAmit) December 23, 2019

I thought that was the end of it, but then Andrew Thompson showed up and dropped a blog post of his that sent my brain into Cognitive Dissonance Level 7—which is a good sign that an opportunity for learning may be in the area.

OFFSEC as a discipline serves the interests of security. Offensive Security Tools (OSTs) aid OFFSEC in serving the interests of security. OST release on the public internet is not the best way to do it. More in my blog: https://t.co/xplmbJs1Px

— Andrew Thompson (@QW5kcmV3) December 23, 2019

Then I started chatting with my friend Joel Parish, and he mentioned something interesting. He said the whole conversation made him revisit his ideas about gun control. And I was like, “What? How does it…oh.”

So that’s why I’m writing this—to compare the two. And specifically to ask and answer the question of how one can be generally pro-gun control and pro-OST at the same time.

When I say guns I mean reasonable guns.

I think the best place to start is by acknowledging for both guns and OST that there is both positive and negative. It’s hard to argue against a handgun or shotgun for home defense, or for Nmap or Burp for protecting your own assets.

I think the disagreement lies at the extremes where one or more thresholds are reached, and those thresholds can be of multiple types.

Proliferation: some tipping point of too many guns
Power: people having access to AK-47s and body armor
Indefensibility: armor-piercing rounds, undetectable construction materials

I’ve written about similar tradeoffs in regard to gun control, and what they taught me then was that weapons don’t exist without context.

This reminds me of what I just learned about genetics, actually, which is basically that it’s useless to talk about what a gene does without knowing the environment it’s in.

For guns, I think it’s possible to have an environment where having a gun in the house is better for that homeowner, and better for society. And the same goes for concealed carry law.

But, crucially, there’s a multi-variate threshold beyond which adding additional guns becomes bad and/or where removing guns becomes good.

This is all a matter of data.

This is a big assumption, and one of the reasons the gun control debate is so squishy.

Assuming a community can agree what good and bad mean, and we can measure the variables that we’re testing against, e.g., current crime rate, average age of males, education level, current number of guns, etc., we should be able to adjust variables and observe changes. Or we can look at multiple communities where those variables are naturally different.

But each society should have some ideal number and type of guns based on these shared goals and variables.

As I talked about in that piece on gun control, you could have a situation where the local criminals are robbing people and businesses with impunity using handguns, and they’re doing so because they know their targets are not allowed to carry them.

Adding a concealed carry law and doing an advertising campaign around lawful gun owners fighting back could massively reduce gun crime in that environment, which is a position that many seem unwilling to consider.

But once you inject more guns into the population, you still have young men, and you still have alcohol, and you still have accidents. So while a certain type of harm might have decreased, you might have significantly increased the number of kids being hurt with those same pistols at home, or random fights resulting in shootouts. Just because the guns were there when they weren’t before.

Right, so let’s transition to OST.

It seems to me that the crucial point is whether the presence of the offensive tool adds to the defense of the population. And similar to guns, it seems like this happens in two main ways.

Raising awareness and visibility
Improving resilience via benign exposure to real-world TTPs and compromise

But both of these require that you actually benefit from them happening to you.

If you can make a tangible change by learning about a TTP, then the OST that made that happen was helpful. If you can make a tangible change that improves defense against the same TTPs after being battered, then it was helpful to take the whoopin.

I think—and I’m not sure this is correct—that the argument being made by Richard and others is that some of the tools are so good that you can’t realistically defend against them.

If awareness doesn’t help you, and getting owned by the Red Team doesn’t help you—then why are we doing it?

Maybe the tools are so good that any defenses erected become negligible upon the next attack. Or maybe it’s theoretically possible to defend against them, but most people don’t have security teams, so the point is moot.

I think those are the two main points being conflated and/or argued in this debate.

Is the state of security so bad that more OST is like dropping off guns in a bad neighborhood? Where you know you’re only going to produce more victims, and not more deterrent or resilience?

Or is the state of OST tools so good that more OST is like releasing plans to an undetectable poison that you can make in your kitchen, and that can kill tens of thousands with a thimble full.

If one or both of those is true—and to the extent that they are—I absolutely see the point. Those are some of the same reasons that people are pro-gun-control.

Me personally, I’m all about understanding the environment that the weapons are being introduced into. Having data on it. And therefore knowing how your stimuli will affect outcomes.

35% of orgs, WITH A CIO, have ZERO cybersecurity staff, per 2018 Gartner global study of 3,160 orgs with CIOs. What do you think the stat is for those without CIOs? Probably also zero. Twitter infosec is the top 10%, at best, arguing with each other. https://t.co/TXD8G2oJRJ

— Richard Bejtlich (@taosecurity) December 23, 2019

Richard is talking about how few companies actually have any legitimate defenses, and the percentage that can defend against a decent Red Team is way less than 65%, so that seems to be driving his position.

I can’t say I disagree with that.

I had a crazy idea this morning that I don't actually believe, but thought would be a great book idea.

What if all this local municipality hacking and ransomware was part of a government resilience exercise?

Don’t want to patch? Cool. Prepare to be shut down.

— ᴅᴀɴɪᴇʟ ᴍɪᴇssʟᴇʀ (@DanielMiessler) December 16, 2019

But I also said recently on Twitter that it would be super interesting if all these city ransomware cases were actually a Federal government Red Team exercise designed to do tough love resilience training.

In other words, if you can’t survive this then you’re not going to survive what China, Russia, and Iran are about to throw.

Summary

So here’s where I think I stand on this.

We shouldn’t try to ban OST as an alternative to doing the hard work of hardening.

OST can do good and can do harm.
How much of each you’re getting depends on multiple environmental factors.
If it’s possible to learn from OST and get better as an organization, city, or country, I lean heavily towards MORE OST.
Where it is completely impossible to learn and improve from OST, or where the OST is so advanced that it makes learning/improvement pointless, I am willing to have a conversation about controlling it.

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 208 (Member Edition)

This is a Member-only episode. Members get the newsletter every week, and have access to the Member Portal with all existing Member content.

Non-members get every other episode.

Sign in

or…

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

How Absurdism Applies in Everyday Life

I think Absurdism, coined by Albert Camus, is one of our most powerful and practical philosophical concepts. It’s often defined as:

It’s the conflict itself, not either of the two sides that are conflicting.

The conflict between the human tendency to seek inherent value and meaning in life, and the human inability to find any in a purposeless, meaningless or chaotic and irrational universe.

Wikipedia

That’s the traditional definition, but I see Absurdism in so much more of life.

I see Absurdism in a broader sense. I see it as any existential conflict between the human condition and reality. But let’s start with the canonical version.

The Meaning of Life: Humans seem to be wired to require (and perpetually search for) an ultimate meaning of life, but based on our current understanding of the universe, none exists. It’s Absurd because of the conflict between our need for this meaning, and the fact that it may not exist.

This is the classic one—the one that he created the word for. And it is perhaps the deepest and most consequential one. But many other examples are appearing as we continue to learn about the universe.

Free Will: Humans seem to be wired to believe that we have free choice (my explanation here), but there doesn’t seem to be any evidence for justification of this belief in science. It’s Absurd because of the conflict between our intuition and our practical need for this belief, and the fact that it may not exist.

The free will debate pulls one right into a related question, which is, “Why do anything?” If free will doesn’t exist, what does it even mean to say things like, “I want to be a better person.”, or, “I need to do better next time.”

If the world is just stumbling along—randomly or not—according to laws of physics, then we can’t actually influence anything. Given this view, staying in bed and eating Crunch Berries becomes a remarkably logical way of conducting oneself. After all, it was either going to happen anyway, or it wasn’t.

So, really, why do anything? In my framing, this a deeply Absurdist question.

Ambition and the Desire for Improvement: Humans seem to be wired to believe that we can and should try to improve ourselves and our surroundings, but in a mechanistic world (random or otherwise), it doesn’t actually matter what you do. This question is Absurd because of the conflict between self-improvement—and a desire to do good in the world—being some of the most important reasons that humans have to exist, and the issue that if free will is an illusion then we’re all just taking credit for the universe unfolding as it was going to anyway.

Right, so, the search for meaning and the reason to do anything at all. Those are big.

But so is love.

Love: Humans seem to be wired to believe that love is an essential and beautiful part of our existence, but in a world where evolution crafted our brains to be rewarded by certain chemicals, it starts to look like the entire thing is an illusion. Squirt, squirt. And we can largely already replicate the feeling with drugs. This issue is Absurd because of the conflict between love being a fundamental value and goal of all humanity, and the fact that it appears to be a clever hack by evolution to allow us to survive, cooperate, and reproduce.

And the same goes for any pleasure, in any activity. If you look closely enough, there’s most likely an evolutionary reason that your body is rewarding you for doing that thing.

The crash and the rebirth

Ok, great, so where does that leave us?

It doesn’t look like there’s any ultimate meaning to the universe
We don’t actually have free will, so we’re not actually making any decisions
It doesn’t actually matter if we try to be better than yesterday, since we either were going to or we weren’t anyway
And love and pleasure are just evolutionary tricks embedded in our brains to make sure we try to pass on the best genes

Wonderful.

And why the hell am I even writing this? Isn’t this all horribly depressing?

No. It’s glorious. It’s gloriously Absurd.

This is the bottom. This is accepting reality for what it is, and it’s essential if we want to be serious citizens of this universe.

Coffee vs. Absurdism

Bertrand Russell had it right when he said:

The good life is one inspired by love and guided by knowledge.

Bertrand Russell

Ah! But love is an illusion created by evolution!

Sure, technically true, but it doesn’t matter. Here’s the entire point of Absurdism as it applies to all these dimensions mentioned above.

We are human
This is the only reality we have
Our human experience is incongruent with that reality

The universe. Physics. Biology. Evolution. Neuroscience. Quantum Physics. These all provide models of our underlying reality.

But that isn’t the same as human experience. Humans weren’t designed to understand our underlying reality. We were designed to compete and succeed in the context of survival and reproduction.

So rather than seeing quarks and particles and neurons, we see choices, emotions, and relationships. Rather than seeing forces, and masses, and valence electrons, we see love, and ambition, and sacrifice.

We’re operating at a different layer, because we were built by evolution.

And that’s ok.

The key is to simply understand how different these two things are. We’re like tastebuds stuck to the bottom of a chair leg on Mars, and we’re being asked to analyze the subtle wavelengths of light coming from a star we cannot even see, halfway across the universe.

Meaning comes from struggle

That’s what’s Absurd about the whole thing. Our hardware and software aren’t meant to interact with reality directly. They’re meant to interact with other players in this game of Survive and Reproduce.

And now we’ve played the game so well that we’ve evolved far enough to see the other world. The real world. And we’ve started to notice the discrepancies between the two.

So what?

Does this really change anything about the human world?

Who says we can’t have both?

Is time with a dear friend any less sweet? Is Ice Cream any less wonderous? Are coffee and sex and laughter in some way diminished?

They are not.

The good life is one inspired by love and guided by knowledge.

Bertrand Russell

To me Russell’s guidance applies perfectly to our situation.

We can simultaneously enjoy the beauty of our human experience and use our newfound knowledge of the truth to understand it, and to enhance it even further.

We may be unable to find universal meaning in the universe. Trying to better yourself may be an illusion running inside the mind of an advanced ape. And love may be a chemical reaction designed to control our behavior.

But the good things in this human life are not diminished by the contrived or atomic nature of their substrate. No explanation of biology or physics can remove the magic of a smile, of kindness, or of love.

These two perspectives—the human and the absolute—are colliding. And that collision produces many instances of the Absurd. But it’s ok.

Learning about the underlying truth should not make our human interface any less enjoyable.

Embrace it (love), and study it (knowledge).

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 207

.errordiv { padding:10px; margin:10px; border: 1px solid #555555;color: #000000;background-color: #f8f8f8; width:500px; }#advanced_iframe {visibility:visible;opacity:1;}#ai-layer-div-advanced_iframe p {height:100%;margin:0;padding:0}

—

If you get value from this content, you can support it directly for less than a latte a month ($50/year) which also gets you the Unsupervised Learning podcast and newsletter every week instead of just twice a month.