Schneier on Security

Clive Robinson • May 4, 2021 6:02 PM

@ Ismar,

Why do we keep doing this to ourselves- making unnecessarily complex systems we can never secure fully ?

The answer is simple…

Firstly we can not make things secure ever, that is security is fleeting.

The reason for this is twofold,

1, Humans find new ways to break things everyday, thus what was secure yesterday is not secure today (Somebody called them “Black Swans”, somebody else called them “unknown knowns and unknown unknowns”).

2, Those in power wish to remain there, therefor they desire absolute security for themselves but absolutly no security from them for everyone else.

When you put the two together you get an unstable mess, where the only thing you can say is that like entropy where things move inexorably from ordered to disordered / chaos, all states of being move from the secure to the insecure.

Even the old,

“Three can keep a secret if the other two are dead”

Is not true due to meta-meta-data[1] and the failings of the human memory. A secret eventually finds it’s way out one way or another.

Trying to hide something always involves expenditure of resources, because it is an active process. The utilisation of resources leaves a trail of informarion that can mostly be “accounting/audit” can be followed. Trying to hide those just consumes more resources whilst making things more complex.

One of the failing of the human mind is we just do not do complex very well. That is we can not see things from every direction. In part this is because we are on the inside looking out, whilst others view from the outside looking in. But also because we focous on what we see and we do not look everywhere so there are holes between our viewpoints.

[1] When all is said and done security, secrecy, or privacy are all about “denying others” to be able to do that you have to possess something that you can withold. The fact something exists effects orher things around it. That is as the old phrase has it, “It fills a hole”. Thus to deny others you have to in effect hide not just what you possess but the hole it occupies. The problem with hiding holes is it’s always imperfect in some way. Thus the imperfections are meta-meta-data that indicates there is meta-data about the data on what it is you are keeping from others. Thus they might not know from the meta-meta-data what it is, but they do know there is something… It’s unavoidable because it takes more camouflage to disguise/hide something even casually than the something it’s self takes up, the better the camouflage the more of it is needed. Think of it as hiding a tree, you can hide a small tree in the shade of a larger tree, but to cover all angles you need a wood, but a forrest does it better because it hides the wood (just as Russian dolls hide those within).

Clive Robinson • May 5, 2021 12:24 AM

@ EvilKiru, Ismar

3, A lot of people prefer making as much money as possible as soon as possible above everything else.

I tend to put such people some way under those seeking power, they have similar motivations of gain.

But thay are seen as failures by those further up, because they have failed to realise that money is just a tool to use. So rather than the ultimate goal of power, they tend to buy what they think are outward projections of success and status, they are as an academic friend once noted “so petiet bourgeois”[1].

Personally the desire for status, power or money has never realy interested me, yes I have material gains and yes I’ve done the capitalist thing, but as a means to an end which was freedom from others, and to do what I wanted to do. Alledgedly I’m a “high end creative” a sort of trades person who uses brain not muscle as their marketable skill. Such people do not realy fit into the “social and economic strata” that Marx and Lenin formulated to fill out the older “estates model”. In part because back then they were seen as being part of the clergy which belonged in the first estate rather than in the lower estates. The reality was Carl Marx was already out of date as he put pen to paper in the British Library reading room. Society due to industry and the force multipliers it provided was moving beyond the peasant in the field, that had been externalised to Empire via trade. Thus what evolved as communisum was in reality an attempt to hold onto the power structure of the old estates model but with a new court of patronage and no middle classes or religious control of the first estate. As my friend also succinctly put it “Same sh1t different faces”. George Orwell kind of got it right in Animal farm when he decided Napolean should be a pig…

[1] The various bourgeois are social status standings general in the “middle class” with a range of petiet bourgeois to haute bourgeois. With the petiet being a little above trades people, traditionaly the top end of skilled trades people who formed guilds and the like, through shop keepers and costermongers, who have small busineses and do “civic duties” not because of a desire to do so but to show they are members of the club as it were. The haute bourgeois being the upper end of the middle class who employ others not directly but through others. At the bottom the “proffessions” such as law medicine and accounting at the top what these days would be called indistrialists or capitalists. Thus calling them petiey bourgeoisie is in effect a put down or insult.