Microsoft Insights from the Inventor Jeffrey Snover
December 16, 2021
Microsoft is an innovative place. The company released the precision-tuned Windows 11. The firm innovated with fresh announcements about bad actors from China. Then the Redmond giant imposed some manual work on those who wanted to use a browser like Netscape or Opera.
Thus, I was interested in reading what inventor Jeffrey Snover had to say about his utility PowerShell. Navigate to “An Interview With PowerShell Inventor Jeffrey Snover.” You can either listen to the interview or read a transcript from this page.
I want to highlight what I call “insights” from this interview.
The first item is a quote about Microsoft’s ability to manage programming work done from remote locations. (Remember, please, that there is the wonderfulness of Teams to make this process a flawless as possible.) Inventor Jeffrey Snover said:
We got funding but the bulk of the development team was in India. That was a disaster as none of us knew how to do distributed development.
Interesting. I like the colorful technical term “disaster.”
The second item concerns the value of PowerShell for “the modern world.” I quote:
The interesting thing is that the Windows approach is winning in the world and that makes PowerShell the best tool for the modern world.
I wonder if inventor Jeffrey Snover is categorizing Amazon, Apple, and Google as having developers who are not part of the modern world?
Third, I circled this fascinating passage. I must admit that I thought about the SolarWinds’ misstep when I read the sentences:
software works when it works and fails when it fails. That sounds stupid but it isn’t. Most programmers focus on success. They get a clear vision of success, they budget their time for success, and they get emotionally centered on the success of their technology. When their code works, it works. BUT, it turns out that the world is not perfect. There are problems. APIs don’t always succeed. Many engineers half-ass their error handling and in lots of cases, that error handling does not work. When their code fails, it fails. Systemically introducing ‘chaos’ into a system is the best way to find out whether your code is going to work when it fails.
Are these engineers which a not taking care of errors employed by Microsoft, or are these engineers excluded from the core of devoted PowerShell users. Those are the specialists who are part of the modern world. The others? Who knows?
Fourth, I found this statement suggestive:
Microsoft is focused on “Developers! Developers! Developers!”.
Does this explain why Microsoft partners are engaged in diagnosing, reworking, and fixing up Microsoft generated software and systems. The “developers’” mantra strikes me as a socially acceptable way to say, “You people can make a fortune as Microsoft certified engineers. It’s employment for life.”
Fifth, I liked this succinct statement:
You have to decide whether security is important or not. If you decide it is important, you allocate the resources and follow the well-established Security Development Lifecycle patterns and practices. Lip service doesn’t get the job done.
Microsoft and security. It is the 21st century equivalent of ham and eggs or peanut butter and jelly. Bad actors love Microsoft code. Opportunity in abundance. Wasn’t the word “disaster” used to describe Microsoft’s management expertise in the time of Covid and distributed work?
Stephen E Arnold, December 16, 2021
How Are Those Cyber Security Strategies Working, Java Fans?
December 16, 2021
As hackers’ methods evolve, so do efforts to thwart them. The SmartData Collective describes “3 Strategies Employed by the Leading Enterprise Cybersecurity Platforms.” We wonder whether the FBI implemented these methods. If so, we think the recent hack of that agency’s systems raises some questions. That case aside, writer Matt James’ reports:
“Stephanie Benoit-Kurtz, Lead Area Faculty Chair for the University of Phoenix’s Cybersecurity Programs, offers a good summary of the changes security organizations should anticipate, especially in the time of the pandemic. ‘The threat landscape over the past 18 months has significantly changed in complexity and frequency of attacks. Long gone are the days when a lone wolf attacker was manually knocking at the door.’ To get acquainted with the ways security firms are handling the new breed of threats in cyberspace, here’s a rundown of the notable strategies the leading cybersecurity platforms and security firms are offering.”
First up is breach and attack simulation, or BAS. As the name implies, this cybersecurity platform feature tests systems for potential weaknesses. Next we learn about continuous automated red teaming (CART). Red teaming is the labor-intensive practice of having a group of white-hat hackers test one’s system for vulnerabilities. It has gotten difficult for mere humans to keep up, though, so automating the process was the logical next step. Finally, there is advanced purple teaming. This color-blending method relies on collaboration between test-attackers (red) and defense teams (blue). This seems so obvious we wonder why it was not being done all along, but apparently departmental silos are resistant to common sense. See the write-up for details on each of these approaches. James concludes:
“Many of the world’s top cybersecurity platforms and security solution providers have already embraced breach and attack simulation, continuous automated red teaming, and advanced purple teaming. These strategies in securing organizations may be relatively new, but cybersecurity professionals can vouch for their effectiveness in view of the new kinds of problems presented by cunning malicious actors in cyberspace.”
This may be true, but these measures will only work if companies, and agencies, actually put them in place. Organizations that drag their feet on security are taking a real risk. Yep, open source Java tools. No problem, right?
Cynthia Murrell, December 16, 2021
Red Kangaroos? Maybe a Nuisance. Online Trolls? Very Similar
December 16, 2021
It is arguable that trolls are the worst bullies in history, because online anonymity means they do not face repercussions. Trolls’ behavior caused innumerable harm, including suicides, psychological problems, and real life bullying. Local and international governments have taken measures to prevent cyber bullying, but ABC Australia says the country continent is taking a stand: “Social Media Companies Could Be Forced To Give Out Names And Contact Details, Under New Anti-Troll Laws.”
Australia’s federal government is drafting laws that could force social media companies to reveal trolls’ identities. The new legislation aims to hold trolls accountable for their poor behavior by having social media companies collect user information and share it with courts in defamation cases. The new laws would also hold social media companies liable for hosted content instead of users and management companies. Australia’s prime minister stated:
“Prime Minister Scott Morrison said he wanted to close the gap between real life and discourse online. ‘The rules that exist in the real world must exist in the digital and online world,’ he said. ‘The online world shouldn’t be a wild west, where bots and bigots and trolls and others can anonymously go around and harm people and hurt people.’”
The new law would require social media companies to have a complaints process for people who feel like they have been defamed. The process would ask users to delete defamatory material. If they do not, the complaint could be escalated to where users details are shared to issue court orders so people can pursue defamation action.
One of the biggest issues facing the legislation is who is responsible for trolls’ content. The new law wants social media companies to be held culpable. The complaints system would allow the social media companies to use it as a defense in defamation cases.
The article does not discuss what is deemed “defamatory” content. Anything and everything is offensive to someone, so the complaints system will be abused. What rules will be instituted to prevent abuse of the complaints system? Who will monitor it and who will pay for it? An analogous example is YouTube system of what constitutes as “appropriate” children’s videos and how they determine flagged videos for intellectual theft as well as inappropriate content. In short, YouTube’s system is not doing well.
The social media companies should be culpable in some way, such as sharing user information when there is dangerous behavior, i.e.e suicide, any kind of abuse, child pornography, planned shooting attacks and other crimes. Sexist and abusive comments that are not an opinion, i.e., saying someone should die or is stupid for being a woman, should be monitored and users held accountable. It is a fine line, though, determining the dangers in many cases.
Whitney Grace, December 16, 2021
Specialized Software Vendors: Should They Remember the Domino Theory?
December 15, 2021
Lining up dominoes, knocking one down, and watching the others in a line react to what some non-nuclear types call a chain reaction is YouTube fodder. One can watch geometric growth manifested in knocked down dominoes. Click here for the revelation. We may have some domino action in the specialized software and services market. This “specialized software and services” is my code word for developers of intelware and policeware.
“US Calls for Sanctions against NSO Group and Other Spyware Firms” reports:
a group of politicians (including Senate Finance Committee chair Ron Wyden, House Intelligence Committee chair Adam Schiff and 16 other Democrats) accuses NSO and three other foreign surveillance firms of helping authoritarian governments to commit human rights abuses.
And what firms are the intended focus of this hoped for action? According to the write up, the companies are:
- Amesys (now called Nexa Technologies). This was a company which found purchase in some interesting countries bordering the Mediterranean, garnered some attention, and morphed into today’s organization.)
- DarkMatter (based in United Arab Emirates). This is an interesting outfit which has allegedly recruited in the US and possibly developed a super duper secure mobile device. The idea was to avoid surveillance. Right?
- Trovicor (based in Germany) once was allegedly a unit of Nokia Siemens Networks and is mentioned in a fiery write up called “Explosive Wikileaks Files Reveal Mass Interception of Entire Population.” That’s a grabber headline I suppose. True or false? I have zero idea but it illustrates the enthusiasm some evidence when realizing that interesting companies provide some unique services to their customers.
The reason for the hand waving is the publicity the NSO Group has inadvertently generated.
Will the knock on NSO Group have an impact on Amesys Nexa, DarkMatter, and Trovicor? Those YouTube videos may foreshadow what might happen if government officials look for the more interesting and more technologically advanced specialized software and services companies. Where can one find a list of such organizations? Perhaps the developer of the new OSINT service knows? Curious? Write darkcyber333 @ yandex dot com.
Stephen E Arnold, December 15, 2021
AI: Inherently Unethical. Algorithms or Humans at Fault?
December 15, 2021
I was not familiar with the online information service Dazed. The entity published “An AI Trained on Reddit Has Warned Researchers That It’ll Never Be Ethical.” Interesting assertion. I am not able to define “intelligence”; therefore, “artificial intelligence” is beyond my grasp. “Ethics” is a term hoary with age and also tough to define. You know. Epistemology, religion, existentialism – each adds some uncertainty to the term.
The article states:
“AI will never be ethical,” the [smart] Megatron Transformer said. “It is a tool, and like any tool, it is used for good and bad. There is no such thing as good AI, only good and bad humans. We (the AIs) are not smart enough to make AI ethical. We are not smart enough to make AI moral. In the end, I believe that the only way to avoid an AI arms race is to have no AI at all. This will be the ultimate defense against AI.”
But Reddit? What about even more interesting firms’ use of artificial intelligence?
Maybe just unethical with or without scripts, numerical recipes, and helpful thumbs on the scales?
Since there are some definitional issues, why worry?
Stephen E Arnold, December 15, 2021
Why Search Is Hard and Quick and Dirty Good Enough Methods Are Train Wrecks
December 15, 2021
I recommend to anyone interested in search and smart software the article “The Business of Extracting Knowledge from Academic Publications.” I am not going to summarize it, nor am I going to discuss why modern search systems are racing toward a collision with useful information retrieval. There was one omission from the essay, and I want to highlight it. I am not critical of this write up. I want to make clear that there is another dimension to scientific, technical, and medical publishing that is often overlooked. I learned this when we created the Pharmaceutical News Index decades ago.
Here’s the omission:
Wizards in technical fields work overtime to obfuscate some of their systems, methods, insights, and findings. The reason is that wizards want to remain wizards and have an ace up their sleeve if one is required to win a poker game for tenure, an over achieving graduate assistant, or some legal eagle involved in a patent dispute. Other reasons for withholding, distorting, and shaping information are related to insecurity. Yep, wizards are wizards in order to have a way to build a defense against those who don’t know what they don’t know and think that what they know defines knowledge.
When it comes to search and retrieval, key words are okay but not perfect. Index terms (what GenXers call tags) are helpful. But the substance of STM content does not yield insights, inventions, or any of the other “knowledge gems” that those pitching smart software believe will spill forth in a results list or a visualization.
What does the information in the article imply for smart software? My answer is, “Misleading or incorrect answers to certain types of inquiries.”
Don’t believe me? That’s okay. Just wait. STM content is “easier” to index than general business writing which is much easier to tag than the excrescences on TikTok, Twitch, or (heaven help me), Twitter.
Stephen E Arnold, December 15, 2021
Chinese Company Excitement: Xiaomi
December 15, 2021
Own stock in Alibaba? Well, think Xiaomi.
Lithuania made a discovery during a recent cybersecurity assessment that, honestly, does not surprise us in the least. We learn of the finding in Big Technology’s piece, “A Xiaomi Phone Might’ve Shipped With a Censorship List in Europe. Now What?” A certain Xiaomi phone model sold in Europe was found to carry a built-in censorship list of about 450 political terms, like “democratic movement” and “long live Taiwan’s independence.” The blocklist lay dormant, but it could have been activated remotely at any time. It is thought its inclusion on phones shipped outside China, where censorship is the norm, may have been a mistake. Reporter Alex Kantrowitz writes:
“After the government published its findings, things got weird. The list swelled to more than 1,000 terms, including hundreds of non-political terms like ‘pornography,’ seemingly to turn the political blocklist into something more generic. Then, it disappeared. ‘They reacted,’ Margiris Abukevicius, Lithuania’s vice minister for defense, told me. ‘It wasn’t publicized from their side.’ The accusations, which Xiaomi disputes, clarified just how fraught the West’s relationship is with China’s growing technology power. As China-based tech companies like Xiaomi and TikTok flourish, there’s still no playbook in North America or Europe to deal with their potential to censor or steer culture via algorithms. TikTok, with its inscrutable feed, remains unchecked. And the Lithuanian government’s report on Xiaomi, replicated by another researcher, sparked a collective shrug. ‘Western countries,’ Abukevicius said, ‘are more and more reliant on technologies, and a big part of those technologies comes from countries which are not friendly, which we don’t trust, and it poses risks.’ How to address those risks remains unclear, though. Xiaomi was Europe’s top-selling smartphone manufacturer in the second quarter of 2021, and it’s number two in the world overall.”
Not in the US, though. Xiaomi was blacklisted here until recently, and FCC commissioner Brendan Carr is taking Lithuania’s discovery into account as he decides whether to allow Xiaomi smartphones to run on our wireless networks. In Europe, more countries are investigating the matter. It is uncertain what measures will be taken; an outright ban seems “extreme,” we’re told, considering there is no evidence the blocklist was ever activated within the EU. Kantrowitz points out the bigger issue going forward is a more general one—Western nations need a plan to address the culture clash and potential security risks cropping up on our devices.
Cynthia Murrell, December xx, 2021
DarkCyber for December 14, 2021, Now Available
December 14, 2021
The December 14, 2021, Dark Cyber video news program is now available on the Beyond Search Web log and YouTube at this link.
Program number 25 for 2021 includes five stories.
The first is that a list of companies engaged in surveillance technology and specialized software for law enforcement and intelligence professionals is available without charge. The list is not comprehensive, but it is one of the first open source documents which identifies companies operating “off the radar” of many analysts, law enforcement professionals, private detectives, and would-be investigative journalists.
The second story adds another chapter to the chronicle of missteps by a company doing business as NSO Group. The Israel company develops and licenses specialized software to government agencies. However, the use of that software has become problematic. This edition of Dark Cyber reports about the alleged use of the Pegasus mobile phone data collection system to obtain information from US diplomats’ mobile devices. The consequences of MBA thinking have roiled the specialized services market worldwide.
The third story extracts pricing information made public by the Brennan Center. The documents obtained via a FOIA request to California were prepared by the Los Angeles Police Department. Although redacted, the documents contained what appears to be trade secret pricing information about the Voyager Labs’ surveillance data analytics system marketed worldwide. The Dark Cyber story reveals how to download the document
collection and additional details about a very low profile company’s technology and methods.
The fourth story describes new digital cameras which are the size of a grain of salt. Dark Cyber then reveals that
a small roll up drone has been developed. The form factor is similar to a seed which spins as it floats to the
ground. Combining the miniature cameras with the seed-like phone factor creates opportunities for a new approach to video surveillance.
The final story announces a new Dark Cyber service. The weekly Instagram post will provide specific information about Web sites now used by law enforcement, analysts, and intelligence professionals to gather data about persons of interests, the social media activities, their location, and other high-value facts. The new service goes live in January 2022.
Dark Cyber is produced by Stephen E Arnold, who publishes the Web log called Beyond Search and available at this link.
Kenny Toth, December 14, 2021
NSO Group: How about That Debt?
December 14, 2021
The NSO Group continues to make headlines and chisel worry lines in the faces of the many companies in Israel which create specialized software and systems for law enforcement and intelligence professionals. You can read the somewhat unpleasant news in Bloomberg’s report, the Financial Times’ article, and Gizmodo’s Silicon Valley-esque write up. Gizmodo said:
the company’s cumbersome mixture of unpaid debts and growing international scrutiny have made NSO a bloated pariah and is forcing its leadership to consider shutting down its Pegasus spyware unit. Selling the entire company is also reportedly on the table.
First, the reports suggest, without much back up, that NSO Group has about a half a billion US in debt. This is important because it underscores what is the number one flaw in the jazzy business plans of companies making sense of data and providing specialized services to law enforcement, intelligence, and war fighting entities. Here’s my take:
Point 1. What was secret is now open and easily available information.
Since Snowden, the systems and methods informing NSO Group and dozens of similar firms are easy to grasp. Former intelligence professionals can blend what Snowden revealed with whatever these individuals picked up in their service to their country, create a “baby” or “similar” solution and market it. This means that there are more surveillance, penetration, intercept, and analysis options available than at any other time in my 50 year career in online information and systems. Toss in what’s in the wild from dumps of FinFisher and Hacking Team techniques and the gold mine of open source code, and it should be no surprise that the NSO Group’s problem is just the tip of an iceberg, a favorite metaphor in the world of surveillance. None of the newsy reports grasp the magnitude of the NSO Group problem.
Point 2. There’s a lot of “smart” money chasing a big pay day from software purpose built for law enforcement, intelligence, and military operations. VC cows in herds, however, are not that smart or full of wisdom.
There are many investors who buy the line “cyber crime and terrorism” drive big, lucrative sales of specialized software and systems. That’s partially correct. But what’s happened is that the flood of cash has generated a number of commercial enterprisers trying to covert those dollars into highly reliable, easy to use systems. The presentations at off the radar trade shows promise functionality that is almost science fiction. The situation today is that there is a lot of hyper marketing going on because there’s money to apply some very expensive computational methods to what used to be largely secret and manual work. A good case for the travails of selling and keeping customers is the Palantir Technologies’ journey which is more than a decade long and still underway. The marketing is seeping from conferences open only to government agencies and those with clearances to advertising trade shows. I think you can see the risk of moving from low profile or secret government solutions to services for Madison Avenue. I sure can.
Point 3. Too few customers to go around.
There are not enough government customers with deep pockets for the abundant specialized services and systems which are on offer. In this week’s DarkCyber at this link, you can learn about the vendors at conferences where surveillance and applied information collection and analysis explain their products and services. You can also learn that the Brennan Center has revealed documents obtained via FOIA about Voyager Labs, a company which is also engaged in the specialized software and services business. Our DarkCyber report makes clear that license fees are in six figures and include more special add ins than a deal from a flea market vendor selling at the Clignancourt flea market. Competition means prices are falling, and quite effective systems are available for as little as a few hundred dollars per month and sometimes even less. Plus, commercial enterprises are often nervous when the potential customer realizes the power of specialized software and services. Stalking made easy? Yep. Spying on competitors facilitated? Yep. Open source intelligence makes it possible to perform specialized work at a quite attractive price point: Free or a few hundred a month.
What’s next?
Financial wizards may be able to swizzle the NSO Group’s financial pickles into a sweet relish for a ball park frank. There will be other companies in this sector which will face comparable money challenges in the future. From my perspective, it is not possible to put the spilled oil back in the tanker and clean the gunk off the birds now coated in crude.
Policeware and intelware vendors have operated out of sight and out of mind in their bubble since i2 Ltd. in the late 19909s rolled out the Analysts Notebook solution and launched the market for specialized software. The NSO Group’s situation could be or has already shoved a hat pin in that big, fat balloon.
More significantly, formerly blind and indifferent news organizations, government agencies, and potential investors can see what issues specialized software and services pose. More reporting will be forthcoming, including books that purport to reveal how data aggregators are spying on hapless Instagram and TikTok users. Like most of the downstream consequences of the so called digital revolution, NSO Group’s troubles are the tip of an information iceberg drifting into equatorial waters.
Stephen E Arnold, December 14, 2021
Intel: How to Guarantee Higher Prices and Non Priority Deliveries of Chips from a Certain Foundry
December 14, 2021
Pretty amazing management moments have ticked down Intel’s decline over the last couple of years. Now a speech may have locked in higher prices and slower delivery of foundry produced chips. Who will do the fabbing? Intel itself. Nope. Taiwan Semiconductor or TSMC.
How did this happen? Where will water for Intel’s newly announced facilities in Arizona originate? These are two good questions. Only of which will I address. The water issue? Nope, not today. It is raining in Kentucky and there is the Ohio River. And — wait for it — an aquifer. Arizona? Sand? Collector cars. People my age.
“TSMC Founder: Pat Gelsinger Too Old to Make Intel Great Again” reports that two CEO types engaged in some good natured corporate humor. The Intel chief executive (Pat Gelsinger) allegedly quipped:
that the reliance on Taiwan as the global hub for semiconductor manufacturing was a significant risk since China had never given up plans to capture the country. “Taiwan is not a stable place,” said Gelsinger at Fortune Brainstorm Tech, reports Nikkei. “Beijing sent 27 warplanes to Taiwan’s air defense identification zone this week. Does that make you feel more comfortable or less?”
Ho ho ho.
The equally quick witted former big dog at TSMC pointed out:
But the ambitious CEO may not have enough time to bring Intel back to its glory days.
Ho ho ho.
Look for more friendly encounters between these two big outfits in the future. Geo-politics and old age are timeless sources of joke inspiration. Ho ho ho.
Stephen E Arnold, December 14, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
