Ross Anderson

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/03/ross-anderson.html

Ross Anderson unexpectedly passed away Thursday night in, I believe, his home in Cambridge.

I can’t remember when I first met Ross. Of course it was before 2008, when we created the Security and Human Behavior workshop. It was well before 2001, when we created the Workshop on Economics and Information Security. (Okay, he created both—I helped.) It was before 1998, when we wrote about the problems with key escrow systems. I was one of the people he brought to the Newton Institute, at Cambridge University, for the six-month cryptography residency program he ran (I mistakenly didn’t stay the whole time)—that was in 1996.

I know I was at the first Fast Software Encryption workshop in December 1993, another conference he created. There I presented the Blowfish encryption algorithm. Pulling an old first-edition of Applied Cryptography (the one with the blue cover) down from the shelf, I see his name in the acknowledgments. Which means that sometime in early 1993—probably at Eurocrypt in Lofthus, Norway—I, as an unpublished book author who had only written a couple of crypto articles for Dr. Dobb’s Journal, asked him to read and comment on my book manuscript. And he said yes. Which means I mailed him a paper copy. And he read it. And mailed his handwritten comments back to me. In an envelope with stamps. Because that’s how we did it back then.

I have known Ross for over thirty years, as both a colleague and a friend. He was enthusiastic, brilliant, opinionated, articulate, curmudgeonly, and kind. Pick up any of his academic papers—there are many—and odds are that you will find a least one unexpected insight. He was a cryptographer and security engineer, but also very much a generalist. He published on block cipher cryptanalysis in the 1990s, and the security of large-language models last year. He started conferences like nobody’s business. His masterwork book, Security Engineering—now in its third edition—is as comprehensive a tome on cybersecurity and related topics as you could imagine. (Also note his fifteen-lecture video series on that same page. If you have never heard Ross lecture, you’re in for a treat.) He was the first person to understand that security problems are often actually economic problems. He was the first person to make a lot of those sorts of connections. He fought against surveillance and backdoors, and for academic freedom. He didn’t suffer fools in either government or the corporate world.

He’s listed in the acknowledgments as a reader of every one of my books from Beyond Fear on. Recently, we’d see each other a couple of times a year: at this or that workshop or event. The last time I saw him was last June, at SHB 2023, in Pittsburgh. We were having dinner on Alessandro Acquisti‘s rooftop patio, celebrating another successful workshop. He was going to attend my Workshop on Reimagining Democracy in December, but he had to cancel at the last minute. (He sent me the talk he was going to give. I will see about posting it.) The day before he died, we were discussing how to accommodate everyone who registered for this year’s SHB workshop. I learned something from him every single time we talked. And I am not the only one.

My heart goes out to his wife Shireen and his family. We lost him much too soon.

EDITED TO ADD (4/10): I wrote a longer version for Communications of the ACM.

Welcome to Developer Week 2024

Post Syndicated from Rita Kozlov original https://blog.cloudflare.com/welcome-to-developer-week-2024


It’s time to ship. For us (that’s what Innovation Weeks are all about!), and also for our developers.

Shipping itself is always fun, but getting there is not always easy. Bringing something from idea to life requires many stars to align. That’s what this week is all about — helping developers, including the two million developers already building on our platform, bring their ideas to life.

The full-stack cloud

Building applications requires assembling many different components.

The frontend, the face of the application, must be intuitive, responsive, and visually appealing to engage users effectively. Behind the scenes, you need a backend to handle data processing, storage, and retrieval, ensuring smooth functionality and performance. On top of all that, in the past year AI has entered the chat, so to speak, and increasingly every application requires an element of AI, making it a crucial part of the stack.

The job of a good platform is to provide all these components, and any others you will need, to you, the developer.

Just as there’s nothing more frustrating than coming home from the grocery store and realizing you left out an ingredient, realizing a platform is missing a major component or piece of functionality is no different.

We view providing the tooling that developers need as a critical part of our job as a platform, which is why with every Developer Week, we make it our mission to provide you with more and more pieces you may need. This week is no different — you can expect us to announce more tools and primitives from the frontend to backend to AI.

However, our job doesn’t stop there. If a good platform provides the components, a great platform goes a step further than that.

The job of a great platform is not only to provide the components, but make sure they play well with each other in a way that makes your job as a developer easier. Our vision for the developer platform is exactly that: to anticipate not just the tools you need but also think about how they work with each other, and how they integrate into your development flow.

This week, you will see announcements and deep dives that expound on our vision for an integrated platform: pulling back the curtain on the way we expose services in Workers through bindings for an integrated developer experience, talking about our vision for a unified data platform, updating you on framework support, and more.

The connectivity cloud

While we’re excited for you to build on us as much as possible, we also realize that development projects are rarely greenfield. If you’ve been at this for a long time, chances are a large portion of your application already lives somewhere, whether on another cloud, or on-prem.

That’s why we’re constantly making it easier for you to connect to existing infrastructure or other providers, and working hard to make sure you can still reap the benefits of building on Cloudflare by making your application feel fast and global, regardless of where your backend is.

And vice versa, if your data is on us, but you need to access it from other providers, it’s not our job to keep it hostage in a captivity cloud by charging a tariff for egress.

The experimentation cloud

Before you start assembling components, or even coming up with a plan or a spec for it, there’s an important but overlooked step to the development process — experimentation.

Experimentation can take many forms. Experimentation can be in the form of prototyping an MVP before you spend months developing a product or a feature. If you’ve found yourself rewriting your entire personal website just to try out a new tool or framework, that’s also experimentation.

It’s easy to overlook experimentation as a part of the process, but innovation doesn’t happen without it, which is why it’s something we always want to encourage and support as a part of our platform.

That’s why offering a generous free tier is something that’s been a part of our DNA since the very beginning, and something you can expect to forever be a staple of our platform.

The demo to production cloud

Alright, you’ve got all the tools you need, you’ve had a chance to experiment, and at some point… it’s time to ship.

Shipping is exciting, but shipping is also vulnerable and scary. You’re exposing the thing you’ve been working hard on to the world to criticize. You’re exposing your code to a world of untested edge cases and abuse. You’re exposing your colleagues who are on call to the possibility of getting paged at 1 AM due to the code you released.

Of course, the wrong answer is not shipping.

The right answer is having a platform that supports you and holds your hand through the scary parts. This means a platform that can seamlessly scale from zero to sixty. A platform gives you the tools to test your code, and release it gradually to the world to help you gain confidence. Or a platform provides the observability you need when you are trying to figure out what’s gone wrong at 1 AM.

That’s why this week, you can look forward to some announcements from us that we hope will help you sleep better.

The demo to production cloud — for inference

We talked about some of the scary parts of deploying to production, and while all these apply to AI as well, building AI applications today, especially in production, presents its own unique set of challenges.

Almost every day you see a new AI demo go viral — from Sora to Devin, it’s easy and inspiring to imagine our world completely changed by AI. But if you’ve started actually playing with and implementing AI use cases, you know the harsh reality of making AI truly work. It requires a lot of trial and error to get the results you want — choosing a model, RAG, fine-tuning…

And that’s before you even go to production.

That’s when you encounter the real challenge — provisioning enough capacity to stay up, without over-provisioning and overpaying. This is the exact challenge we set out to solve from the early days of Workers — helping developers not worry about infrastructure, just the application they want to build.

With the recent rise of AI, we’ve noticed many of these challenges return. Thankfully, managing loads and infrastructure is what we’re good at here at Cloudflare. It’s what we’ve had practice at for over a decade of running our platform. It’s all just one giant scheduler.

Our vision for our AI platform is to help solve the exact challenges in deploying AI workloads that we’ve been helping developers solve for, well, any other type of workload. Whether you’re deploying directly on us with Workers AI, or another provider, we’ll help provide the tools you need to access the models you need, without overpaying for idle compute.

Don’t worry, it’s all going to be fine.

So what can you expect this week?

No one in my family can keep a secret — my sister cannot get me a birthday present without spoiling it the week before. For me, the anticipation and the look of surprise is part of the fun! My coworkers seem to have clued into this.

While I won’t give away too much, we’ve already teased out a few things last week (you can find some hints here, here and here), as well as in this blog post if you read closely (because as it turns out, I too, can’t help myself).

See you tomorrow!

Our series of announcements starts on Monday, April 1st. We look forward to sharing them with you here on our blog, and discussing them with you on Discord and X.

A few relevant quotes

Post Syndicated from corbet original https://lwn.net/Articles/967420/

I’m on a holiday and only happened to look at my emails and it
seems to be a major mess.

— Lasse Collin

The reality that we are struggling with is that the free software
infrastructure on which much of computing runs is massively and
painfully underfunded by society as a whole, and is almost entirely
dependent on random people maintaining things in their free time
because they find it fun, many of whom are close to burnout. This
is, in many ways, the true root cause of this entire event.

— Russ Allbery

Incredible work from Andres. The attackers made a serious
strategic mistake: they made PostgreSQL slightly slower.

— Thomas
Munro

There is no way to discuss this in public without turning a single
malicious entity into 10 000 malicious entities once the
information is widely known.

Making sure the impact and mitigations are known before posting
this publicly so that everyone knows what to do before the 10 000
malicious entities start attacking is just common sense.

— Marc
Deslauriers

Again the FOSS world has proven to be vigilant and proactive in
finding bugs and backdoors, IMHO. The level of transparency is
stellar, especially compared to proprietary software
companies. What the FOSS world has accomplished in 24 hours after
detection of the backdoor code in #xz deserves a moment of
humbleness. Instead we have flamewars and armchair experts shouting
that we must change everything NOW. Which would introduce even more
risks. Progress is made iteratively. Learn, adapt, repeat.

— Jan Wildeboer

Седмицата (25–30 март)

Post Syndicated from original https://www.toest.bg/sedmitsata-25-30-mart/

Тайната на грънчаря е, че всеки път започва отначало. Същото се отнася за нашия герой – Хираяма. Всеки ден той започва отначало. Не мисли как го е направил вчера или как ще го направи утре. Винаги го прави на момента. Това е още една от тайните на грънчаря, който придава различна красота на всяко повторение.
Вим Вендерс

Седмицата (25–30 март)

В последния уикенд на „София Филм Фест“ все още имате възможност да гледате „Прекрасни дни“ – най-новия филм на режисьора Вим Вендерс, който представлява дълбоко вълнуващ и поетичен разказ за откриването на красота в ежедневието. То може да бъде толкова натоварващо и изпълнено със стрес и тревоги, но винаги крие в себе си и неподозирани късчета красота. Ние се стараем да ви помагаме да ги откриете дори когато изглежда много трудно.

От гледна точка на политическите новини дните от изминалата седмица не са точно прекрасни. Оказва се невъзможно да се намери нов служебен премиер и ситуацията е толкова предизвикателна, а досегашните предложения – нелепи и несполучливи, че дори беше създаден сайт „Министър ли съм?“ с отговор на въпроса попаднали ли сме случайно в списъка с министерски номинации… Много се говори как държавата ще изпадне в конституционна криза. Но Емилия Милчева смята, че това са само внушения, и в своя седмичен анализ „Български политически животни“ разсъждава колко висок е потенциалът на родните политически фигури, повели обществото към шести парламентарни избори за последните три години.

По повод 20-тата годишнина от членството на България в НАТО президентът Румен Радев направи равносметка и обобщи, че всички държави членки са длъжни да обединяват потенциал, усилия и ресурси, за да може да развиват военна наука, високи технологии, Космос и изкуствен интелект. И докато вървят красиви речи за международен мир, сигурност и справедливост, в същото това време МВР е заето с търсене на поводи за увеличаване на полицейското присъствие в София. Въоръжените полицаи, патрулиращи по улиците, карат ли ви да се чувствате в по-голяма безопасност? Светла Енчева си задава въпроса дали тези акции, тип „Въоръжена бдителност по никое време“, са продиктувани от загриженост за гражданите, или са по-скоро бутафорно присъствие с цел печелене на предизборни точки за показна активност.

В опит да отместим фокуса от тези проблеми отново повдигаме завесата над също не особено приятната тема за качеството на медицинската помощ у нас. Според закона, когато пациент отиде в лечебно заведение, той има право да очаква, а медицинският персонал е длъжен да му оказва такава медицинска помощ, която е утвърдена и в медицинската теория, и в практиката. Уви, реалността често се разминава с предписаното в закона. В „Грешка 404: Здравеопазване по неправилно зададени параметри“ Надежда Цекулова повдига важни въпроси в интервю с адв. Мария Шаркова, създателка на уебсайта „Лекарска грешка“, който събира статистика за делата по случаите, наречени в правото „медицински деликти“.

След подробното запознаване с наболели въпроси от седмицата на човек внезапно му се приисква просто тихомълком да излезе от света на новините. И тук на помощ се притичва редовната ни рубрика „От дума на дума“, в която тази седмица получаваме подробно разяснение на всички възможни начини за изсулване, тоест за елегантно измъкване, макар че „Винаги другите са тези, които се измъкват (по терлици)“, както е озаглавила текста си този път Екатерина Петрова.

Почти накрая, но не и по важност, ето и една великолепна инициатива, която не бива да пропускате: най-популярният, заслужил репутацията си през годините езиков справочник „Как се пише?“ обедини усилия с екипа на The Huts Group, за да направят заедно дигитално помагало в помощ на дипломиращите се дванайсетокласници. Под надслов „Животът няма „аУтокорект“ от днес до деня на матурата по български език и литература (17 май) в профила на „Как се пише?“ в Threads ще се публикуват тестови въпроси, съобразени изцяло с формата на държавния зрелостен изпит по БЕЛ. Колко често? Всеки ден. Защото „Как се пише?“ вече не е просто важен въпрос, а неотложен.

Краят на месеца е и няма да ви оставим без стихотворение… дори и то да напомня, че „В ада без изход и ние бяхме…“. Йоан Ес. Поп е един от живите класици на съвременната румънска поезия, а чудесният превод е на Лора Ненковска. За щастие, поезията продължава да съществува, за да ни предлага алтернатива на грубата реалност… или поне различен поглед към нея в опит да я осмислим по-добре. 

Зорница Христова отлично разбира тази необходимост и съвсем уместно е избрала да ни представи в рубриката „По буквите“ един от най-големите съвременни английски поети – Филип Ларкин, с последната му стихосбирка „Високи прозорци“. Какво липсва в дните? Нещо, което да не е мираж, нито неумело самозалъгване, нито лъжа…

В седмичните анализи на „Тоест“ май нищо не липсва. 

Приятно четене!

The collective thoughts of the interwebz