Daniel Miessler's Blog, page 86

Unsupervised Learning: No. 169

Unsupervised Learning is my weekly show that provides collection, summarization, and analysis in the realms of Security, Technology, and Humans.

It’s Content Curation as a Service…

I spend between five and twenty hours a week consuming articles, books, and podcasts—so you don’t have to—and each episode is either a curated summary of what I’ve found in the past week, or a standalone essay that hopefully gives you something to think about.

Subscribe to the Newsletter or Podcast

Become a member to get every episode

The Bifurcation of Elite Education

I think the bottom is starting to rot out of the education racket. Elite education today is essentially two different things:

The prestige of having gotten into that school, and
The education you receive there.

These two things are separating from each other, and I think that separation is about to accelerate.

Better education elsewhere (or at least as good)

A number of studies have shown that the level of content at regular universities is often very similar to that of elite institutions, yet people who graduate from the top schools still make more money over their lifetimes.

I think what’s going to happen is that more and more professors are going to become disillusioned with the drama and friction and politics, and will start teaching classes themselves or via loose collectives online.

A high-quality video series—with some interaction for paying students—could reach tens of millions online, as opposed to a few thousand inside an elite college. And there are already efforts to get this type of thing going.

We’re also seeing this from regular institutions doing the free online courses, but imagine a deeper level of that—just like a regular course—for a reasonable price. And importantly, this would be a direct relationship between the people paying and the experts teaching the classes. So they wouldn’t have to watch everything they say for fear of angering a university.

Status indicators

If the education itself became available for less money, and to more people, through a system like the one above, that would raise the question of how companies and society could tell the elites from the normals (you know, because that seems to matter), and I think the answer might come in the form of various clubs and associations.

The more tech we use the easier it gets to validate certain types of activities. People might form clubs based on their salaries, or their net worths, or their amount of social media influence. Or the number of people who read their content on websites they write for.

Whatever.

The point is that evolution makes us want to give ourselves elite labels, and form small and selective groups. So if elite colleges stop being an avenue for doing that, due to come combination of cost and unremarkable education, then people will find other ways to draw those distinctions.

China has a social credit system. We have credit scores. Black Mirror had some ideas as well.

I think we’ll see many iterations of such ranking and reputation scoring platforms grow in popularity, even if they’re only popular in certain small or elite crowds because they’re gross to talk about in public.

Summary


Education is becoming too expensive, and the quality of the education isn’t growing at the same pace.
Education from other sources is improving in quality, and technology might enable decentralized options of extraordinary quality very soon.
Once the education component is separated from the status of going to an elite school, we’ll find new ways to get a validated indicator of status assigned to people at various stages of their lives.

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

The Need for Post-Capitalism

When I saw Yuval Harari live with Sam Harris in San Francisco, I heard a lot of interesting things. But the most interesting thing I heard that night was from Harari, when he said something like:

Forms of government have periods where they’re best suited, based on the evolution of the people at that moment. And as the people change, so must how we manage ourselves.

An imperfect paraphrasing of live comments by Yuval Harari in 2018

This shook me when I heard it, because I think the example he used was democracy.

It’s hard to know how much of this was his thought vs. mine after the fact, but I’m giving credit regardless.

He talked about older forms of government, which worked at the time but became outmoded, and then said that democracy is about to go out of style as well. Not just because it’s not fashionable, but because it’s no longer functional.

That got me thinking about when Picard gave someone a lecture in Star Trek the Next Generation. They were asking about money, and Picard explained how that was no longer a priority for them, because now they care about exploration.

I wish we were at that point, but we’re not.

Post-capitalism doesn’t mean Socialism

The problem we have right now is many have diagnosed the problem correctly, but have become obsessed with the wrong medicine. Marx had the same issue. He nailed the fact that Capitalism had issues, but he thought—and many in 2019 are thinking—that the answer is to give the poor the resources of the rich.

Marx and many today were right that Capitalism is failing the masses, but they’re wrong in thinking that Socialism is the answer.

The fix isn’t redistribution, or Socialism—it’s actually much harder and simpler than that. We have to change what we value.

We have to move from valuing the amassing of wealth to valuing the thriving of humanity as a race. We have to move from consumerism to experienism. We have to move from epitomizing power to epitomizing creativity.

That’s a loose estimate based on reading a number of books on the topic.

And we have to do it fast, because we’re about to be looking at a world were 85% of the U.S., and 95% of the world, is not terribly needed for regular work.

This isn’t a work problem though—it’s a meaning problem.

We need new ways for people to find meaning in life, besides the ones given to us by evolution and the toiling difficulty of everyday life.

You can’t take away peoples’ jobs and their value to society—or have that be taken away naturally by the efficiencies of automation and AI—and then expect them to be happy with a monthly stipend.

People don’t need money; they need to feel valued. People don’t need payment; they need respect. And people don’t need handouts; they need to earn their way. That’s what evolution rewards, and it’s what our societies have always been based on.

Post-capitalism

We had monarchies. We had socialism. We had totalitarian regimes. And we had religions, like Catholocism and Capitalism (Harari).

But now it’s time for the next thing, and it’s not Socialism.

Socialism is an (inferior) peer to Capitalism. It’s for a certain stage in our human development. A stage before we could automated most of the work out of our hands.

Once the algorithms and machines can do most of the work, we’ll need something way different.

Andrew Yang thinks it’ll be social capital, i.e., doing nice or useful things for others, which will be traded as currency.

I think the answer is something like that, but that truly emersive VR Video Games will be a major part of the solution. I think the solution will be to recreate real-world value systems (but hopefully less nasty) within the game world, and to trade capital based on what you do in-game.

So you can still be a cop, or a firefighter, or a scientist—all in-game, and you’ll still get all the benefit as if it were the real world.

But this is so far away!

And that’s assuming we make it there.

We have to make it through the phase where only 5-15% of the world is thriving while the rest struggle and suffer. And that situation brings with it the very real possibility of turmoil, revolution, and backward steps in civilization.

The solution is moving to Post-capitalism before that happens.

We have to find a way to give meaning and a sense of value to the billions of people who are losing it as we speak.

And we don’t have much time.

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 168 (Member Edition)

This is a Member-only episode. Members get the newsletter every week, and have access to the Member Portal with all existing Member content.

Non-members get every other episode.

Sign in

or…

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

My RSA 2019 Summary

RSA was good this year, but I didn’t really notice any major new trends. Nothing on the scale of—say—AI, or blockchain. But there were some disruptions that looked quite interesting.

Primary themes

The overall themes I saw this year were largely the same as last year, with a few notable changes.

AI talk has become a lot more tempered and realistic. People are realizing it’s more like saying you have a database, and you really have to describe HOW you use it, and not just say you have it.
Lots of threat intelligence stuff.
Lots of focus on orchestration.
Lots more OT stuff.

I suppose the S1 Ranger thing (below) qualifies as Asset Management.

I’m dissapointed to not see much about Asset Management. Maybe next year, when the Linux desktop becomes popular.

Chronicle Releases Backstory

The Backstory release by Chronicle appears to be groundbreaking.

They’re doing a cloud-based offering that is priced by your employee count rather than data usage, and that’s tens, hundreds, or even thousands of times faster than existing solutions.

It’s basically using all the Google magic secret sauce regarding scalability and speed, to do super fast correlation of malicious behavior for an enterprise’s data.

They just launched, but they’re already getting a ton of partnerships.

The key is the ability to go backwards, which is a play on Chronicle and Backstory, which is cute.

They are keeping all your data (I think indefinitely?) and letting you say things like,

We just learned about this APT, which uses this one domain, which we happened to notice that someoene else on your network went to 14 months ago, and it was Julie, and here’s everything else she’s done since then, and everyone else who’s been to that domain.

Oh, and in 250ms.

This and the next tool are definitely the biggest disruptors I saw at the show.

SentinelOne Previews Ranger

SentinelOne is—according to what I’ve seen with multiple customers—the top endpoint protection product, and what they showed at RSA is a new tool called Ranger that allows their installed agents to look laterally at what else is on the network.

So it’s asset discovery using their existing sensors as opposed to installing a bunch of taps or gateways.

It’s super interesting because it’s getting directly into Tanium’s world, which is all about visibility and management.

Ghidra release by NSA

I was in the talk where NSA released Ghidra, and I thought it was quite interesting.

As I wrote after the announcement for the talk, I thought the whole thing was basically a well-meaning PR stunt. That is, a PR stunt for all the right reasons. So, more like a gesture of kindness.

And that was spot on.

What I found interesting about the tool—and the thing that made all the difference—is that Ghidra was not a new tool that they just released for some good press. Oh, no. It’s the primary tool they themselves use, and have been using for years.

The undisputed king of reverse engineering tools has been IDA Pro forever, but with this release the market has instantly changed.

Not only is Ghidra free, while IDA Pro is multiple thousands of dollars, but it actually has many unique features that even IDA doesn’t have.

There’s a back button for changes that won’t mess up your entire session
There is support for many platforms
There’s a decompiler that can go from binary to C pseudocode
There are collaboration features

…and these are just a few of the differences.

Ghidra instantly became the one and only true competitor for IDA Pro, and in many ways it’s far superior.

This couldn’t have come at a better time, because I’m about to learn some basic RE myself.

It’s quite impressive actually, and I can’t wait to dive into some basic RE CTF challenges.

Summary

Solid show, for what it is.

If you come to RSA thinking you’re at Gartner Security, or reInvent, or DEFCON, you’ll be sad.

But if you see it as a chance to see old friends and learn what the industry is doing, it can be enjoyed.

Think of it as the Momentum Partners PDF in real life.

Notes


NSA also has other open source tools, including an SDR framework called REDHAWK.
Axonius is also another Asset Management play, which takes the asset inventories from tons of vendor products and unifies them into one.
Inky (which I’ve advised for in the past) is also super cool tech, if you’ve not seen it.

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

RSA 2019 Summary

Overall trends

The overall trends I saw this year included:

AI talk has become a lot more tempered and realistic. People are realizing it’s more like saying you have a database, and you really have to describe HOW you use it, and not just say you have it.
Lots of threat intelligence stuff
Lots of focus on orchestration

I’m dissapointed to not see much about asset management.

Maybe next year, when the Linux desktop becomes popular.

Ghidra release by NSA

I was in the talk where NSA released Ghidra, and I thought it was quite interesting.

As I wrote after the announcement for the talk, I thought the whole thing was basically a well-meaning PR stunt. That is, a PR stunt for all the right reasons. So, more like a gesture of kindness.

And that was spot on.

What I found interesting about the tool—and the thing that made all the difference—is that Ghidra was not a new tool that they just released for some good press. Oh, no. It’s the primary tool they themselves use, and have been using for years.

The undisputed king of reverse engineering tools has been IDA Pro forever, but with this release the market has instantly changed.

Not only is Ghidra free, while IDA Pro is multiple thousands of dollars, but it actually has many unique features that even IDA doesn’t have.

There’s a back button for changes that won’t mess up your entire session
There is support for many platforms
There’s a decompiler that can go from binary to C pseudocode
There are collaboration features

…and these are just a few of the differences.

Ghidra instantly became the one and only true competitor for IDA Pro, and in many ways its far superior.

This couldn’t have come at a better time, because I’m about to learn some basic RE myself.

It’s quite impressive actually, and I can’t wait to dive into some basic RE CTF challenges.

Summary

Solid show, for what it is.

If you come to RSA thinking you’re at Gartner Security, or reInvent, or DEFCON, you’ll be sad.

But if you see it as a chance to see old friends and learn what the industry is doing, it can be enjoyed.

Think of it as the Momentum Partners PDF in real life.

Notes


NSA also has other open source tools, including an SDR framework called REDHAWK.

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 167

Unsupervised Learning is my weekly show that provides collection, summarization, and analysis in the realms of Security, Technology, and Humans.

It’s Content Curation as a Service…

I spend between five and twenty hours a week consuming articles, books, and podcasts—so you don’t have to—and each episode is either a curated summary of what I’ve found in the past week, or a standalone essay that hopefully gives you something to think about.

Subscribe to the Newsletter or Podcast

Become a member to get every episode

The Privacy Implications of 5G

Most people have heard that 5G is forthcoming, but few are versed on the key advantages over 4G LTE. Here’s a primer.

Speed: Becasue it’ll work at much higher frequencies (many proposals use ranges over 6Ghz) you can move more data per unit of time.
More Call Capacity: there will be less congestion and service degradation in busy areas.
Lower Latency: applications that require low latency will thrive on 5G.
Higher Efficiency: 5G will allow towers to send data directly to devices rather than broadcasting in all direction simultaneously, and many say that you’ll have less total radiation becasue the output can be reduced. Others say it’ll increase because there will be so many more towers that are closer to you.

One concern will be bandwidth caps, since you’ll be able to use so much data so quickly.

Many will likely want to use their 5G connection rather than WiFi or home internet because it’ll be so much faster.

A privacy impact

A tradeoff of using such high frequenices is a lack of signal penetration. Lower frequencies can pass through obstacles like buildings and tress much easier, while super high frequencies can be disrupted by almost anything.

More towers at shorter ranges means tighter location triangulation.

This means you’ll need more towers, mini-towers, and relay locations. Which also means that you’re likely to be very close to multiple transmitters when using your device, which in turn means that authorities—or anyone with access to your phone’s radio location—will have a much tighter understanding of your current location.

This is great for many reasons, but it’s not without implications.

There are also other ways to get even better location data from you, like leaky apps giving GPS location.

People concerned about privacy will notice immediately that this gives police, the phone company, and anyone with access to that data, a more precise location for you at all times.

I think we’re still figuring out how much tigher that location will be, but it looks like it could be improved by a factor of 10 or more.

Notes


More detail on location accuracy for 5G Link

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 166 (Member Edition)

This is a Member-only episode. Members get the newsletter every week, and have access to the Member Portal with all existing Member content.

Non-members get every other episode.

Sign in

or…

—

Subscribe for one coffee a month ($5) and get the Unsupervised Learning podcast and newsletter every week instead of just twice a month.

Unsupervised Learning: No. 165

Unsupervised Learning is my weekly show that provides collection, summarization, and analysis in the realms of Security, Technology, and Humans.

Think of it as Content Curation as a Service.

I spend between five and twenty hours a week consuming articles, books, and podcasts—so you don’t have to—and each episode is either a curated summary of what I’ve found in the past week, or a standalone essay that hopefully gives you something to think about.

Subscribe to the Newsletter or Podcast