Schneier on Security

1&1~=Umm • March 13, 2019 10:12 PM

@Pan:

“I’ve solved many a difficult problem, problems nobody else could figure out, by sleeping on them.”

It’s not just the biological process of ‘sleeping’ there are other biological processes as well…

Which is why you will in certain high risk industrial zones, find health and safety warnings put up on the inside of toilet cubical/stall doors.

One of the recognised ways of dealing with intensive or complex thought problems is ‘Mindfulness’ it is a way to either distract or put in neutral the concious mind so the subconcious mind can work on the problem. Likewise in meditation the notion of ‘clearing the mind’ or ‘centering’ via breathing and other excercises.

Thus the real trick is to train yourself to do it at will, as and when needed. Such ‘thinking on the spot’ is actually very rare, most people give ‘gut reaction’ answers which are almost a ‘canned message’ or ‘knee-jerk’ response.

Which is why you should treat with caution immediate replys to questions that are either unexpected or complex. Likewise with work those that ‘jump in immediatly’ will be not solving the problem, but probably making problems. There is a lot of ‘Technical Debt’ in all walks of life and it’s ‘canned responses’ that lie at the bottom of most of them.

Thus a good skill to learn is ‘Distraction Actions’. In days past when smoking was common, the act of lighting a cigarette in a ritulistic way was a distraction action. Like walking it did not require concious thought to do thus the mind could think, but to the observer it ‘filled in the gap’ to the reply without awkwardness or embarrassment. Similar distraction actions are cleaning of glasses, adjusting sitting position and the like, even the clearing of the throat.

However distraction actions need not be short, studies of those who are or were considered geniuses shows that whilst they may have ‘busy days’ they only spend a short time actively working on the problem task. What they do is ‘fill in’ with other activities that are in effect mechanically repetative, that free the mind to work on the problem task in the background.

I’ve known a number of higher level education instructors who find marking student papers is for them a distraction action. That is not to say that they are not marking diligently, they are, but the process is sufficiently different to thinking about the problem task that they are in effect doing both.

At a different level I find ‘doing housework’ to be a mechanical distraction action, the ‘mokey brain’ gets on with what is a repetative mechanical task, of doing dishes, pushing the vacuum, or ironing, whilst I think about other more interesting problems. Which is why I have a notebook and pencil to hand, such that I can break off from house work to note down what is important or make a calculation.

I suspect that most people who are sufficiently intelligent can ‘observe the surveillance’ and the way it works, thus develop destraction actions to keep the surveillance occupied whilst they have freed up their minds to do other more important thinking.

The trick you have to look for is what triggers the surveillance into higher levels and how to avoid them. Thus keep the surveillance on you at the minimum.

Put simply surveillance systems are very hierarchical in the way they work, in fact with a little thought you realise it is the only way they can be made to be efficient. The classic example is the security guard in front of twenty or more monitors, they can only focus their attention on one at a time, and going from screen to screen ‘time sharing’ their attention will quickly give anyone a migraine. So they don’t do that, what they actually do is defocus their concious attention on all of the screens and become passive or in effect in stand by, and they wait for their sub concious to get a trigger such as movment. Which pulls them out of standby and draws their attention to that screen. Thus if an attacker does things very slowly or very quickly the security guard does not get the trigger to pull them out of standby, thus their attention does not come into focus and they miss entirely that which they would have seen if their conscious attention was focused on that screen.

The problem with workplace ‘work surveillance’ is that with non mechanical tasks it’s difficult to impossible to come up with real measurands. As @Jon has noted above ‘Lines of Code’ count is easily gamed. More importantly you can actually put in a load of crap in an ifdef, it does not actually have to do anything other than add to the line count. Broken comments are another way to do this, in either case it needs a higher level of inspection than just counting lines. Such levels of inspection require something other than mechanistic automation as there are many many ways to game, thus you end up eventually with a real equally or better skilled person looking at the code to see if cheating is occuring, there are few people that would willingly do such a job, and if they were good at it their skills would be wasted doing it as a task anyway.

One area you see this in is accountancy crime, where ordinary auditors go through the books year after year and do not pick up what a highly focused forensic accountant will at almost a glance (see ‘Benford’s Law’ as an example)

Which brings up the ‘A.I. Question’ could someone come up with a system to do such a thing with minimal type I and type II errors? I guess the answer is possibly, but at what cost?

The thing is there is ‘missed opportunity cost’ you have finite resources, how you use them defines how you progress. History shows authoritarian regimes eventually fail due the cost of surveillance or guard labour if not an earlier demise due to people taking other actions. The point being surveillance uses resources the more intensive the surveillance the more resources required. As surveillance is by definition unproductive in nature when functioning as desired those resources are in effect wasted. Thus opportunities to use the resources more wisely or productively are lost, or more correctly wasted which by almost any book on business is bad practice.

Also it’s generaly a sign of incompetence in managment. The reason people with skills change jobs is not because it’s a bad company, but because of incompetent managment, who are going to ruin the company anyway. So ‘The Smart rat leaves the ship before it starts to sink’ preferably when it’s still tied up against dry land.