• Canal+ crash

    From Nicolas Paul Colin de Glocester@Master_Fontaine_is_dishonest@Strand_in_London.Gov.UK to fr.comp.lang.ada,comp.lang.ada on Fri Jul 19 23:41:44 2024
    From Newsgroup: comp.lang.ada

    Canal+ uses Ada but one is alleging that Canal+ suffered a crash today
    with Windows. Cf. HTTPS://WWW.UniversFreeBox.com/article/568957/orange-canal-et-bouygues-telecom-annoncent-a-leurs-abonnes-etre-touches-par-la-panne-informatique-mondiale
    Cf. a complaint by Mister Brukardt that Ada can not control non-Ada
    software on a shared system.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Sat Jul 20 09:23:11 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-19 23:41, Nicolas Paul Colin de Glocester wrote:
    Canal+ uses Ada but one is alleging that Canal+ suffered a crash today
    with Windows. Cf. HTTPS://WWW.UniversFreeBox.com/article/568957/orange-canal-et-bouygues-telecom-annoncent-a-leurs-abonnes-etre-touches-par-la-panne-informatique-mondiale
    Cf. a complaint by Mister Brukardt that Ada can not control non-Ada
    software on a shared system.

    It is not about Ada. It is about the fundamental principle that security cannot be added on top of an insecure system. The lesson never learned
    is that security levels impose safety problems not solving security
    issues. Modern security architectures are nothing but a huge scam.

    Thank you Microsoft!
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Sat Jul 20 07:43:18 2024
    From Newsgroup: comp.lang.ada

    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security
    cannot be added on top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly insecure, yet
    we are capable of running secure applications and protocols on top of it.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Sat Jul 20 11:08:47 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:
    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security
    cannot be added on top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly insecure, yet
    we are capable of running secure applications and protocols on top of it.

    Of course we can. That is the whole idea of the scam. Why on earth do we
    need security updates? Do you update your screwdriver each week?
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 01:04:44 2024
    From Newsgroup: comp.lang.ada

    On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:

    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security cannot be added on
    top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly insecure,
    yet we are capable of running secure applications and protocols on top
    of it.

    Why on earth do we need security updates?

    Because computer systems are complex, and new bugs keep being discovered
    all the time.

    Do you update your screwdriver each week?

    I don’t depend on my screwdriver to keep my bank account secure.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 09:22:06 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
    On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:

    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security cannot be added on >>>> top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly insecure,
    yet we are capable of running secure applications and protocols on top
    of it.

    Why on earth do we need security updates?

    Because computer systems are complex, and new bugs keep being discovered
    all the time.

    This does not make sense. You can create a very complex system out of screwdrivers and still each screwdriver would require no update.

    Systems consist of computers and computers of software modules. There is nothing inherently complex about making a module safe and bug free.
    Security interactions are primitive and 100% functional. There is no
    difficult issues with non-functional stuff like real-time problems. It
    is purely algorithmic while all mathematical complexity of cryptography
    is NOT what gets updated. It is complex only because it was designed as
    a Wood Block Tumbling Game.

    Do you update your screwdriver each week?

    I don’t depend on my screwdriver to keep my bank account secure.

    I don't need a bank account to fasten the screws. Application area is irrelevant.
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Niklas Holsti@niklas.holsti@tidorum.invalid to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 11:00:36 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 10:22, Dmitry A. Kazakov wrote:
    On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
    On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:

    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security cannot be added on >>>>> top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly insecure, >>>> yet we are capable of running secure applications and protocols on top >>>> of it.

    Why on earth do we need security updates?

    Because computer systems are complex, and new bugs keep being discovered
    all the time.

    This does not make sense. You can create a very complex system out of screwdrivers and still each screwdriver would require no update.

    Systems consist of computers and computers of software modules. There is nothing inherently complex about making a module safe and bug free.
    Security interactions are primitive and 100% functional. There is no difficult issues with non-functional stuff like real-time problems.


    Well, several recent attacks use variations in execution timing as a side-channel to exfiltrate secrets such as crypto keys. The crypto code
    can be functionally perfect and bug-free, but it may still be open to
    attack by such methods.

    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From J-P. Rosen@rosen@adalog.fr to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 11:10:06 2024
    From Newsgroup: comp.lang.ada

    Le 21/07/2024 à 10:00, Niklas Holsti a écrit :
    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    A problem that has been solved since 1983, and even before (Pascal had
    bounds checking). Sigh...
    --
    J-P. Rosen
    Adalog
    2 rue du Docteur Lombard, 92441 Issy-les-Moulineaux CEDEX
    https://www.adalog.fr https://www.adacontrol.fr

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 11:19:30 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 10:00, Niklas Holsti wrote:
    On 2024-07-21 10:22, Dmitry A. Kazakov wrote:
    On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
    On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:

    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security cannot be
    added on
    top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly insecure, >>>>> yet we are capable of running secure applications and protocols on top >>>>> of it.

    Why on earth do we need security updates?

    Because computer systems are complex, and new bugs keep being discovered >>> all the time.

    This does not make sense. You can create a very complex system out of
    screwdrivers and still each screwdriver would require no update.

    Systems consist of computers and computers of software modules. There
    is nothing inherently complex about making a module safe and bug free.
    Security interactions are primitive and 100% functional. There is no
    difficult issues with non-functional stuff like real-time problems.

    Well, several recent attacks use variations in execution timing as a side-channel to exfiltrate secrets such as crypto keys. The crypto code
    can be functionally perfect and bug-free, but it may still be open to
    attack by such methods.

    It is always a tradeoff between the value of the information and costs
    of breaking the protection. I doubt that timing attack are much more
    feasible in that respect than brute force.

    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    Exactly. Non-functional attacks are hypothetical at best. They rely on internal knowledge which is another problem. An insider work is the most common case of all breaches. So, maybe, it is better to update the
    staff? (:-))
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 11:34:14 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 11:10, J-P. Rosen wrote:
    Le 21/07/2024 à 10:00, Niklas Holsti a écrit :
    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    A problem that has been solved since 1983, and even before (Pascal had bounds checking). Sigh...

    Yup, however some crackpot could always suggest an attack on bounds
    checking, e.g. exception vs. not, index to bounds comparison dependent
    on the actual values etc, and then produce a lengthy paper on a
    constructed absolutely unrealistic scenario... (:-))
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Nicolas Paul Colin de Glocester@Master_Fontaine_is_dishonest@Strand_in_London.Gov.UK to fr.comp.lang.ada,comp.lang.ada,alt.comp.acad-freedom.talk on Sun Jul 21 13:11:31 2024
    From Newsgroup: comp.lang.ada

    This message is in MIME format. The first part should be readable text,
    while the remaining parts are likely unreadable without MIME-aware tools.

    --8323329-328323417-1721556449=:1616845
    Content-Type: text/plain; CHARSET=UTF-8; format=flowed Content-Transfer-Encoding: QUOTED-PRINTABLE
    Content-ID: <ada43a20-2889-c406-95f2-4c438192e9b2@insomnia247.nl>

    On Sun, 21 Jul 2024, Dmitry A. Kazakov wrote:
    "Yup, however some crackpot could always suggest an attack on bounds checki= ng,=20
    e.g. exception vs. not, index to bounds comparison dependent on the actual=
    =20
    values etc, and then produce a lengthy paper on a constructed absolutely=20 unrealistic scenario... (:-))"

    Hello,

    Supposedly scientific journals are rife with evil unrealistic fraudulent=20 papers which cause really deadly consequences. Cf. inter alia
    @article {fulltext6.pdf,
    author =3D {Labb\'{e}, Cyril and Labb\'{e}, Dominique},
    pages=3D{379--396},
    year=3D{2013},
    volume=3D{94},
    issue=3D{1},
    title =3D {{Duplicate and fake publications in the scientific literatur= e:=20
    how many SCIgen papers in computer science?}},
    journal =3D {Scientometrics},
    abstract =3D {Two kinds of bibliographic tools are used to retrieve=20 scientific publications and make them available online. For one kind,=20
    access is free as they store information made publicly available online.=20
    For the other kind, access fees are required as they are compiled on=20 information provided by the major publishers of scientific literature. The=
    =20
    former can easily be interfered with, but it is generally assumed that the=
    =20
    latter guarantee the integrity of the data they sell. Unfortunately,=20 duplicate and fake publications are appearing in scientific conferences=20
    and, as a result, in the bibliographic services. We demonstrate a software=
    =20
    method of detecting these duplicate and fake publications. Both the free=20 services (such as Google Scholar and DBLP) and the charged-for services=20 (such as IEEE Xplore) accept and index these publications.},
    }
    and=20
    @online{dieHimmelistschoen,
    author =3D {{Schlangemann (pseudonym)}, Herbert},
    title =3D {{The Official Herbert Schlangemann Blog}},
    url =3D {HTTP://dieHimmelistschoen.BlogSpot.com},
    year =3D {2008--2010}
    }
    and
    HTTP://Gloucester.Insomnia247.NL/Evil_which_is_so-called_science/

    I myself wrote on 13th April 2012:
    "On February 19th 2012, Nicholas Collin Paul de Glouce=C5=BFter wrote: |--------------------------------------------------------------------------= ------|
    |"Dear Sir/Madam: =
    |
    | =
    |
    |[. . .] =
    |
    | =
    |
    |I am a whistleblower and as such I am a victim of fraud, =
    |
    |much of which the Association for Computing Machinery =
    |
    |provided to people without publishing any of my attempts to =
    |
    |expose misconduct. Shame on you. =
    |
    | =
    |
    |I tried to expose fraud which I discovered when I applied =
    |
    |for a George Michael Memorial HPC Fellowship. An anonymous =
    |
    |reviewer wished me well and he or she advised me that I have =
    |
    |"other methods to ask for redress" but he or she left the =
    |
    |message too vague for me to take my complaints further. I =
    |
    |asked the Association for Computing Machinery for help in =
    |
    |obtaining more details as to which "other methods to ask for =
    |
    |redress" I have. I did not receive an answer to this =
    |
    |question. Why? =
    |
    | =
    |
    |Why does your website contain no warning that the paper =
    |
    |"OCCN: A Network-On-Chip Modeling and Simulation Framework", =
    |
    |DATE '04 is fraudulent? Shame on you. =
    |
    | =
    |
    |Yours sincerely, =
    |
    |Colin Paul Gloster =
    |
    | =
    |
    | =
    |
    |On October 6th, 2011, Nicholas Collin Paul de Glouce=C5=BFter =
    |
    |sent questions to ACMhelp@ACM.org without receiving =
    |
    |answers: =
    |
    |"On October 5th, 2011, Mail Delivery Subsystem <MAILER-DAEMON-ACM26-3@ACM.=
    |
    |claimed: =
    | ||---------------------------------------------------------------------| =
    |
    ||"The original message was received at Wed, 05 Oct 2011 04:51:54 -0400| =
    |
    || | =
    |
    || ----- The following addresses had permanent fatal errors ----- | =
    |
    ||<lathrop@mcs.anl.gov> | =
    |
    || | =
    |
    || ----- Transcript of session follows ----- | =
    |
    ||.. while talking to mailgateway.anl.gov | =
    |
    RCPT To:<lathrop@mcs.anl.gov> | =
    |
    ||<<< 550 #5.1.0 Address rejected." | =
    | ||---------------------------------------------------------------------| =
    |
    | =
    |
    | =
    |
    |Gloster sent to hpc-fellowship-questions@ACM.org on October 5th, =
    |
    |2011: =
    | ||---------------------------------------------------------------------| =
    |
    ||"Dear Sir/Madam, | =
    |
    || | =
    |
    ||As you would be aware, my application for a George Michael | =
    |
    ||Memorial HPC Fellowship for 2011 failed. | =
    |
    || | =
    |
    ||Reviewer 3 was nice to comment: | =
    |
    ||"Good luck with your research. A word of advice, this typy a | =
    |
    ||submission is the forum to air the grievances you indicate. You have | =
    |
    ||other methods to ask for redress." | =
    |
    || | =
    |
    ||I hope to be informed of details of how to proceed with airing the | =
    |
    ||aforementioned grievances. What "other methods to ask for redress" do| =
    |
    ||I "have"? | =
    |
    || | =
    |
    ||Yours faithfully, | =
    |
    ||Nicholas Collin Paul de Glouce=C5=BFter" =
    | | ||---------------------------------------------------------------------| =
    |
    | =
    |
    | =
    |
    |Dear Sir/Madam: =
    |
    | =
    |
    |I emailed hpc-fellowship-questions@ACM.org and so I received a bounce re= port |
    |for lathrop@mcs.anl.gov . =
    |
    |Has anyone actually received the email which I had sent to =
    |
    |hpc-fellowship-questions@ACM.org ? =
    |
    | =
    |
    |I mentioned in one of the online surveys which you requested me to partake=
    in |
    |after I left Italy that I am a victim of fraud published by ACM. In the =
    |
    |fellowship application I mentioned two fraudulent papers published by ACM = which |
    |a so-called "tutor" had ordered me to praise (he and the coauthors are fri= ends |
    |to each other). He himself had coauthored a similar fraudulent paper. I re= fused |
    |to participate in this unethical activity. He censored my findings that th=
    ey are|
    |fraudsters and he said that if I would not quit then I would be failed for=
    not |
    |having a publication. =
    |
    | =
    |
    |I tried to expose this in "ACM Computing Surveys" and "The Journal of the = ACM" |
    |but the manuscripts were rejected. =
    |
    | =
    |
    |It seems that one reviewer for the fellowship cared, but the advice given = was |
    |not explicit enough for me to enact. Has the question reached that reviewe=
    r? |
    | =
    |
    |Shall ACM retract fraudulent publications? When shall ACM =
    |
    |begin adhering to its own Code of Ethics? =
    |
    | =
    |
    |Yours faithfully, =
    |
    |Nicholas Collin Paul de Glouce=C5=BFter"" =
    | |--------------------------------------------------------------------------= ------|


    Dear Sir/Madam:

    Why have I not yet received answers to any of the questions above?

    Why does the ACM Portal of the Association for Computing Machinery show=20 so-called "research" which was reported and proven to be fraudulent=20
    without warning that it is fraudulent?

    Yours faithfully,
    Colin Paul Gloster"

    The ACM let be sent: |--------------------------------------------------------------------------= ------------------|
    |"25-Aug-2010 =
    |
    | =
    |
    |Dear Mr. de Glouce=C5=BFter, =
    |
    | =
    |
    |I am sorry to inform you that your paper has been rejected. Unfortunately,=
    ACM Computing |
    |Surveys is able to accept only a rather small percentage of the submission=
    s it receives. |
    | =
    |
    |I have read your paper. It is clear that you feel that you have a grievan=
    ce against the |
    |University of Pisa and the SHAPES group. I am not prepared to let you use=
    ACM Computing |
    |Surveys as a vehicle for publicising that grievance. The language that yo=
    u have used in the|
    |paper is intemperate and would potentially lead to legal problems for the = ACM if we were to |
    |publish it. =
    |
    | =
    |
    |Sincerely, =
    |
    | =
    |
    |Chris Hankin =
    |
    |Editor-in-Chief =
    |
    |ACM Computing Surveys" =
    | |--------------------------------------------------------------------------= ------------------|

    "[. . .]

    * 7. Why did you let your membership to ACM lapse? Please select all that=
    =20
    apply.

    I didn=E2=80=99t see the value in my membership
    [. . .]
    Too expensive
    [. . .]
    Other (please specify)
    I had complained to you about subsidy fraud which you publish (I used to=20 work under a coauthor fraudster). You refuse to retract it so you are=20 accomplices so a subsidy fraudster got away with perpetrating perjury=20 covering up this fraud so he went on to murder 3 men.
    [. . .]
    * 9. Would you consider renewing your ACM membership in the future?
    [. . .]
    No
    [. . .]
    10. Please share what would compel you to become a member of ACM again.
    Please publish errata and retractions and apologies. Testify against=20 scientific malconduct instead of pretending that you adhere to your "Code=
    =20
    of Ethics". Resurrect the victims whose murders you are guilty of in 2nd=20
    or 3rd degrees. Repair my reputation. Refuse to publish baloney. Arrange a=
    =20
    fair PhD exam for me (I whistleblow against a PhD so-called "tutor" so I=20
    am denied even a dissertation defense!). Make amends."
    wrote I myself on
    HTTPS://WWW.research.net/r/FPSC3KH
    on April 20th, 2024. This survey stated that the Association for Computing=
    =20
    Machinery wants to contact me afterwards to try to get me to join, but 3=20 months and 1 day afterwards I still do not get a follow-up.

    Note by the way that a court made a final unappealable court order for a=20
    PhD scholarship to be paid to myself but such a defendant refuses to obey=
    =20
    such an order. Note also that a court made orders to allow me to go to a=20 university but such a putative university disobeyed such orders and=20
    instead got armed professional combatants to hit me out even though I did=
    =20
    not threaten (confirmed by a district attorney); I myself did not fight=20 (confirmed by CCTV); and I did not have a weapon (confirmed by policemen).=
    =20
    Cf.
    HTTPS://WWW.COE.int/fr/web/cpt/portugal

    Sinc=C3=A8res salutations.



    Nicolas Paul Colin de Glocester
    --8323329-328323417-1721556449=:1616845--
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Niklas Holsti@niklas.holsti@tidorum.invalid to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 14:31:27 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 12:19, Dmitry A. Kazakov wrote:
    On 2024-07-21 10:00, Niklas Holsti wrote:
    On 2024-07-21 10:22, Dmitry A. Kazakov wrote:
    On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:
    On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-20 09:43, Lawrence D'Oliveiro wrote:

    On Sat, 20 Jul 2024 09:23:11 +0200, Dmitry A. Kazakov wrote:

    It is about the fundamental principle that security cannot be
    added on
    top of an insecure system.

    Actually, it can. Notice how the Internet itself is horribly
    insecure,
    yet we are capable of running secure applications and protocols on >>>>>> top
    of it.

    Why on earth do we need security updates?

    Because computer systems are complex, and new bugs keep being
    discovered
    all the time.

    This does not make sense. You can create a very complex system out of
    screwdrivers and still each screwdriver would require no update.

    Systems consist of computers and computers of software modules. There
    is nothing inherently complex about making a module safe and bug
    free. Security interactions are primitive and 100% functional. There
    is no difficult issues with non-functional stuff like real-time
    problems.

    Well, several recent attacks use variations in execution timing as a
    side-channel to exfiltrate secrets such as crypto keys. The crypto
    code can be functionally perfect and bug-free, but it may still be
    open to attack by such methods.

    It is always a tradeoff between the value of the information and costs
    of breaking the protection. I doubt that timing attack are much more feasible in that respect than brute force.


    Security researchers and crypto implementers seem to take timing attacks
    quite seriously, putting a lot of effort into making the crucial crypto
    steps run in constant time.


    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    Exactly. Non-functional attacks are hypothetical at best. They rely on internal knowledge which is another problem.


    As I understand it, the "internal knowledge" needed for timing attacks
    is mostly what is easily discoverable from the open source-code of the
    SW that is attacked.


    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 18:49:27 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 13:31, Niklas Holsti wrote:

    Security researchers and crypto implementers seem to take timing attacks quite seriously, putting a lot of effort into making the crucial crypto steps run in constant time.

    Cynically: they certainly know how to butter their bread...

    As I understand it, the "internal knowledge" needed for timing attacks
    is mostly what is easily discoverable from the open source-code of the
    SW that is attacked.

    Considering many many layers of software to predict timing from code in uncontrolled environment would be a challenge.
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 21:52:58 2024
    From Newsgroup: comp.lang.ada

    On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-21 03:04, Lawrence D'Oliveiro wrote:

    On Sat, 20 Jul 2024 11:08:47 +0200, Dmitry A. Kazakov wrote:

    Why on earth do we need security updates?

    Because computer systems are complex, and new bugs keep being
    discovered all the time.

    This does not make sense. You can create a very complex system out of screwdrivers and still each screwdriver would require no update.

    There is an old engineering adage, that the complexity of a system arises,
    not so much from the number of individual components, as from the number
    of potential interactions between them.

    If you have a box full of screwdrivers, then all you have is a box full of screwdrivers.

    If you have a computer system made up of a bunch of modules interacting
    with each other, then you could have, potentially, quite a complex system indeed.

    Look up the term “combinatorial explosion” to learn more.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 21:53:46 2024
    From Newsgroup: comp.lang.ada

    On Sun, 21 Jul 2024 11:10:06 +0200, J-P. Rosen wrote:

    Le 21/07/2024 à 10:00, Niklas Holsti a écrit :

    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    A problem that has been solved since 1983, and even before (Pascal had
    bounds checking). Sigh...

    Pascal had no checking for memory leaks or double-frees.

    Rust certainly seems to be a next-generation solution to these sorts of
    memory problems.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Sun Jul 21 21:55:10 2024
    From Newsgroup: comp.lang.ada

    On Sun, 21 Jul 2024 18:49:27 +0200, Dmitry A. Kazakov wrote:

    Considering many many layers of software to predict timing from code in uncontrolled environment would be a challenge.

    And yet it has been successfully done on the hardware itself, right down
    under all those layers of software (cf Spectre/Meltdown).
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From J-P. Rosen@rosen@adalog.fr to fr.comp.lang.ada,comp.lang.ada on Mon Jul 22 08:36:08 2024
    From Newsgroup: comp.lang.ada

    Le 21/07/2024 à 23:53, Lawrence D'Oliveiro a écrit :
    On Sun, 21 Jul 2024 11:10:06 +0200, J-P. Rosen wrote:

    Le 21/07/2024 à 10:00, Niklas Holsti a écrit :

    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    A problem that has been solved since 1983, and even before (Pascal had
    bounds checking). Sigh...

    Pascal had no checking for memory leaks or double-frees.

    Rust certainly seems to be a next-generation solution to these sorts of memory problems.

    We were talking about bounds checking, that Pascal had.
    Nowadays, you should not use pointers directly, but containers. Pointers
    are necessary only for writing containers, thanks to Ada's features not
    found in other languages, like allocating dynamically sized arrays on
    the stack.

    Note that in Rust, containers are written using unsafe Rust, therefore
    Rust is not better than Ada on that aspect, it is a complicated solution
    to a problem that Ada doesn't have.
    --
    J-P. Rosen
    Adalog
    2 rue du Docteur Lombard, 92441 Issy-les-Moulineaux CEDEX
    https://www.adalog.fr https://www.adacontrol.fr

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Mon Jul 22 09:16:09 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
    On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:

    If you have a box full of screwdrivers, then all you have is a box full of screwdrivers.

    If you have a computer system made up of a bunch of modules interacting
    with each other, then you could have, potentially, quite a complex system indeed.

    Tight coupling = bad design. No difference to screwdrivers. However you
    can take integer arithmetic if you dislike screwdrivers. However complex system you build, there is no need to update integers.

    Look up the term “combinatorial explosion” to learn more.

    Bad design leads to explosion of non-trivial unanticipated system states making it unpredictable. This is what happens when you add security on
    top. You patch holes drilling new ones to fix the patches.
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Tue Jul 23 01:48:12 2024
    From Newsgroup: comp.lang.ada

    On Mon, 22 Jul 2024 08:36:08 +0200, J-P. Rosen wrote:

    Le 21/07/2024 à 23:53, Lawrence D'Oliveiro a écrit :
    On Sun, 21 Jul 2024 11:10:06 +0200, J-P. Rosen wrote:

    Le 21/07/2024 à 10:00, Niklas Holsti a écrit :

    But certainly, most attacks on SW have used functional bugs such as
    buffer overflows.

    A problem that has been solved since 1983, and even before (Pascal had
    bounds checking). Sigh...

    Pascal had no checking for memory leaks or double-frees.

    Rust certainly seems to be a next-generation solution to these sorts of
    memory problems.

    We were talking about bounds checking, that Pascal had.

    Which is only one potential pitfall for bugs with security implications.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Tue Jul 23 01:49:16 2024
    From Newsgroup: comp.lang.ada

    On Mon, 22 Jul 2024 09:16:09 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
    On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:

    If you have a box full of screwdrivers, then all you have is a box full
    of screwdrivers.

    If you have a computer system made up of a bunch of modules interacting
    with each other, then you could have, potentially, quite a complex
    system indeed.

    Tight coupling = bad design.

    And yet you are relying on those systems right now. Do you do online payments/banking? You depend on those systems crucially for that.
    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Dmitry A. Kazakov@mailbox@dmitry-kazakov.de to fr.comp.lang.ada,comp.lang.ada on Tue Jul 23 09:06:26 2024
    From Newsgroup: comp.lang.ada

    On 2024-07-23 03:49, Lawrence D'Oliveiro wrote:
    On Mon, 22 Jul 2024 09:16:09 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
    On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:

    If you have a box full of screwdrivers, then all you have is a box full
    of screwdrivers.

    If you have a computer system made up of a bunch of modules interacting
    with each other, then you could have, potentially, quite a complex
    system indeed.

    Tight coupling = bad design.

    And yet you are relying on those systems right now. Do you do online payments/banking? You depend on those systems crucially for that.

    I don't understand your point. Should I bubble with joy each time it
    crashes or gets compromised?
    --
    Regards,
    Dmitry A. Kazakov
    http://www.dmitry-kazakov.de

    --- Synchronet 3.20a-Linux NewsLink 1.114
  • From Lawrence D'Oliveiro@ldo@nz.invalid to fr.comp.lang.ada,comp.lang.ada on Tue Jul 23 08:36:13 2024
    From Newsgroup: comp.lang.ada

    On Tue, 23 Jul 2024 09:06:26 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-23 03:49, Lawrence D'Oliveiro wrote:

    On Mon, 22 Jul 2024 09:16:09 +0200, Dmitry A. Kazakov wrote:

    On 2024-07-21 23:52, Lawrence D'Oliveiro wrote:
    On Sun, 21 Jul 2024 09:22:06 +0200, Dmitry A. Kazakov wrote:

    If you have a box full of screwdrivers, then all you have is a box
    full of screwdrivers.

    If you have a computer system made up of a bunch of modules
    interacting with each other, then you could have, potentially, quite
    a complex system indeed.

    Tight coupling = bad design.

    And yet you are relying on those systems right now. Do you do online
    payments/banking? You depend on those systems crucially for that.

    I don't understand your point. Should I bubble with joy each time it
    crashes or gets compromised?

    You seem to say one thing and do another, is my point.
    --- Synchronet 3.20a-Linux NewsLink 1.114