Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/friday-squid-blogging-on-squid-brains-2.html
Tag Archives: Uncategorized
Fake Reddit and WeTransfer Sites are Pushing Malware
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/fake-reddit-and-wetransfer-sites-are-pushing-malware.html
There are thousands of fake Reddit and WeTransfer webpages that are pushing malware. They exploit people who are using search engines to search sites like Reddit.
Unsuspecting victims clicking on the link are taken to a fake WeTransfer site that mimicks the interface of the popular file-sharing service. The ‘Download’ button leads to the Lumma Stealer payload hosted on “weighcobbweo[.]top.”
Boingboing post.
ExxonMobil Lobbyist Caught Hacking Climate Activists
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/exxonmobil-lobbyist-caught-hacking-climate-activists.html
The Department of Justice is investigating a lobbying firm representing ExxonMobil for hacking the phones of climate activists:
The hacking was allegedly commissioned by a Washington, D.C., lobbying firm, according to a lawyer representing the U.S. government. The firm, in turn, was allegedly working on behalf of one of the world’s largest oil and gas companies, based in Texas, that wanted to discredit groups and individuals involved in climate litigation, according to the lawyer for the U.S. government. In court documents, the Justice Department does not name either company.
As part of its probe, the U.S. is trying to extradite an Israeli private investigator named Amit Forlit from the United Kingdom for allegedly orchestrating the hacking campaign. A lawyer for Forlit claimed in a court filing that the hacking operation her client is accused of leading “is alleged to have been commissioned by DCI Group, a lobbying firm representing ExxonMobil, one of the world’s largest fossil fuel companies.”
CISA Under Trump
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/cisa-under-trump.html
Jen Easterly is out as the Director of CISA. Read her final interview:
There’s a lot of unfinished business. We have made an impact through our ransomware vulnerability warning pilot and our pre-ransomware notification initiative, and I’m really proud of that, because we work on preventing somebody from having their worst day. But ransomware is still a problem. We have been laser-focused on PRC cyber actors. That will continue to be a huge problem. I’m really proud of where we are, but there’s much, much more work to be done. There are things that I think we can continue driving, that the next administration, I hope, will look at, because, frankly, cybersecurity is a national security issue.
If Project 2025 is a guide, the agency will be gutted under Trump:
“Project 2025’s recommendations—essentially because this one thing caused anger—is to just strip the agency of all of its support altogether,” he said. “And CISA’s functions go so far beyond its role in the information space in a way that would do real harm to election officials and leave them less prepared to tackle future challenges.”
In the DHS chapter of Project 2025, Cucinelli suggests gutting CISA almost entirely, moving its core responsibilities on critical infrastructure to the Department of Transportation. It’s a suggestion that Adav Noti, the executive director of the nonpartisan voting rights advocacy organization Campaign Legal Center, previously described to Democracy Docket as “absolutely bonkers.”
“It’s located at Homeland Security because the whole premise of the Department of Homeland Security is that it’s supposed to be the central resource for the protection of the nation,” Noti said. “And that the important functions shouldn’t be living out in siloed agencies.”
New VPN Backdoor
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/new-vpn-backdoor.html
A newly discovered VPN backdoor uses some interesting tactics to avoid detection:
When threat actors use backdoor malware to gain access to a network, they want to make sure all their hard work can’t be leveraged by competing groups or detected by defenders. One countermeasure is to equip the backdoor with a passive agent that remains dormant until it receives what’s known in the business as a “magic packet.” On Thursday, researchers revealed that a never-before-seen backdoor that quietly took hold of dozens of enterprise VPNs running Juniper Network’s Junos OS has been doing just that.
J-Magic, the tracking name for the backdoor, goes one step further to prevent unauthorized access. After receiving a magic packet hidden in the normal flow of TCP traffic, it relays a challenge to the device that sent it. The challenge comes in the form of a string of text that’s encrypted using the public portion of an RSA key. The initiating party must then respond with the corresponding plaintext, proving it has access to the secret key.
The lightweight backdoor is also notable because it resided only in memory, a trait that makes detection harder for defenders. The combination prompted researchers at Lumin Technology’s Black Lotus Lab to sit up and take notice.
[…]
The researchers found J-Magic on VirusTotal and determined that it had run inside the networks of 36 organizations. They still don’t know how the backdoor got installed.
Slashdot thread.
EDITED TO ADD (2/1): Another article.
Friday Squid Blogging: Beaked Whales Feed on Squid
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/friday-squid-blogging-beaked-whales-feed-on-squid.html
A Travers’ beaked whale (Mesoplodon traversii) washed ashore in New Zealand, and scientists conlcuded that “the prevalence of squid remains [in its stomachs] suggests that these deep-sea cephalopods form a significant part of the whale’s diet, similar to other beaked whale species.”
Third Interdisciplinary Workshop on Reimagining Democracy (IWORD 2024)
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/third-interdisciplinary-workshop-on-reimagining-democracy-iword-2024.html
Last month, Henry Farrell and I convened the Third Interdisciplinary Workshop on Reimagining Democracy (IWORD 2024) at Johns Hopkins University’s Bloomberg Center in Washington DC. This is a small, invitational workshop on the future of democracy. As with the previous two workshops, the goal was to bring together a diverse set of political scientists, law professors, philosophers, AI researchers and other industry practitioners, political activists, and creative types (including science fiction writers) to discuss how democracy might be reimagined in the current century.
The goal of the workshop is to think very broadly. Modern democracy was invented in the mid-eighteenth century, using mid-eighteenth-century technology. If democracy were to be invented today, it would look very different. Elections would look different. The balance between representation and direct democracy would look different. Adjudication and enforcement would look different. Everything would look different, because our conceptions of fairness, justice, equality, and rights are different, and we have much more powerful technology to bring to bear on the problems. Also, we could start from scratch without having to worry about evolving our current democracy into this imagined future system.
We can’t do that, of course, but it’s still still valuable to speculate. Of course we need to figure out how to reform our current systems, but we shouldn’t limit our thinking to incremental steps. We also need to think about discontinuous changes as well. I wrote about the philosophy more in this essay about IWORD 2022.
IWORD 2024 was easily the most intellectually stimulating two days of my year. It’s also intellectually exhausting; the speed and intensity of ideas is almost too much. I wrote the format in my blog post on IWORD 2023.
Summaries of all the IWORD 2024 talks are in the first set of comments below. And here are links to the previous IWORDs:
- IWORD 2022: home page, essay and talk summaries
- IWORD 2023: home page and talk summaries.
IWORD 2025 will be held either in New York or New Haven; still to be determined.
AI Will Write Complex Laws
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/ai-will-write-complex-laws.html
Artificial intelligence (AI) is writing law today. This has required no changes in legislative procedure or the rules of legislative bodies—all it takes is one legislator, or legislative assistant, to use generative AI in the process of drafting a bill.
In fact, the use of AI by legislators is only likely to become more prevalent. There are currently projects in the US House, US Senate, and legislatures around the world to trial the use of AI in various ways: searching databases, drafting text, summarizing meetings, performing policy research and analysis, and more. A Brazilian municipality passed the first known AI-written law in 2023.
That’s not surprising; AI is being used more everywhere. What is coming into focus is how policymakers will use AI and, critically, how this use will change the balance of power between the legislative and executive branches of government. Soon, US legislators may turn to AI to help them keep pace with the increasing complexity of their lawmaking—and this will suppress the power and discretion of the executive branch to make policy.
Demand for Increasingly Complex Legislation
Legislators are writing increasingly long, intricate, and complicated laws that human legislative drafters have trouble producing. Already in the US, the multibillion-dollar lobbying industry is subsidizing lawmakers in writing baroque laws: suggesting paragraphs to add to bills, specifying benefits for some, carving out exceptions for others. Indeed, the lobbying industry is growing in complexity and influence worldwide.
Several years ago, researchers studied bills introduced into state legislatures throughout the US, looking at which bills were wholly original texts and which borrowed text from other states or from lobbyist-written model legislation. Their conclusion was not very surprising. Those who borrowed the most text were in legislatures that were less resourced. This makes sense: If you’re a part-time legislator, perhaps unpaid and without a lot of staff, you need to rely on more external support to draft legislation. When the scope of policymaking outstrips the resources of legislators, they look for help. Today, that often means lobbyists, who provide expertise, research services, and drafting labor to legislators at the local, state, and federal levels at no charge. Of course, they are not unbiased: They seek to exert influence on behalf of their clients.
Another study, at the US federal level, measured the complexity of policies proposed in legislation and tried to determine the factors that led to such growing complexity. While there are numerous ways to measure legal complexity, these authors focused on the specificity of institutional design: How exacting is Congress in laying out the relational network of branches, agencies, and officials that will share power to implement the policy?
In looking at bills enacted between 1993 and 2014, the researchers found two things. First, they concluded that ideological polarization drives complexity. The suggestion is that if a legislator is on the extreme end of the ideological spectrum, they’re more likely to introduce a complex law that constrains the discretion of, as the authors put it, “entrenched bureaucratic interests.” And second, they found that divided government drives complexity to a large degree: Significant legislation passed under divided government was found to be 65 percent more complex than similar legislation passed under unified government. Their conclusion is that, if a legislator’s party controls Congress, and the opposing party controls the White House, the legislator will want to give the executive as little wiggle room as possible. When legislators’ preferences disagree with the executive’s, the legislature is incentivized to write laws that specify all the details. This gives the agency designated to implement the law as little discretion as possible.
Because polarization and divided government are increasingly entrenched in the US, the demand for complex legislation at the federal level is likely to grow. Today, we have both the greatest ideological polarization in Congress in living memory and an increasingly divided government at the federal level. Between 1900 and 1970 (57th through 90th Congresses), we had 27 instances of unified government and only seven divided; nearly a four-to-one ratio. Since then, the trend is roughly the opposite. As of the start of the next Congress, we will have had 20 divided governments and only eight unified (nearly a three-to-one ratio). And while the incoming Trump administration will see a unified government, the extremely closely divided House may often make this Congress look and feel like a divided one (see the recent government shutdown crisis as an exemplar) and makes truly divided government a strong possibility in 2027.
Another related factor driving the complexity of legislation is the need to do it all at once. The lobbyist feeding frenzy—spurring major bills like the Affordable Care Act to be thousands of pages in length—is driven in part by gridlock in Congress. Congressional productivity has dropped so low that bills on any given policy issue seem like a once-in-a-generation opportunity for legislators—and lobbyists—to set policy.
These dynamics also impact the states. States often have divided governments, albeit less often than they used to, and their demand for drafting assistance is arguably higher due to their significantly smaller staffs. And since the productivity of Congress has cratered in recent years, significantly more policymaking is happening at the state level.
But there’s another reason, particular to the US federal government, that will likely force congressional legislation to be more complex even during unified government. In June 2024, the US Supreme Court overturned the Chevron doctrine, which gave executive agencies broad power to specify and implement legislation. Suddenly, there is a mandate from the Supreme Court for more specific legislation. Issues that have historically been left implicitly to the executive branch are now required to be either explicitly delegated to agencies or specified directly in statute. Either way, the Court’s ruling implied that law should become more complex and that Congress should increase its policymaking capacity.
This affects the balance of power between the executive and legislative branches of government. When the legislature delegates less to the executive branch, it increases its own power. Every decision made explicitly in statute is a decision the executive makes not on its own but, rather, according to the directive of the legislature. In the US system of separation of powers, administrative law is a tool for balancing power among the legislative, executive, and judicial branches. The legislature gets to decide when to delegate and when not to, and it can respond to judicial review to adjust its delegation of control as needed. The elimination of Chevron will induce the legislature to exert its control over delegation more robustly.
At the same time, there are powerful political incentives for Congress to be vague and to rely on someone else, like agency bureaucrats, to make hard decisions. That empowers third parties—the corporations, or lobbyists—that have been gifted by the overturning of Chevron a new tool in arguing against administrative regulations not specifically backed up by law. A continuing stream of Supreme Court decisions handing victories to unpopular industries could be another driver of complex law, adding political pressure to pass legislative fixes.
AI Can Supply Complex Legislation
Congress may or may not be up to the challenge of putting more policy details into law, but the external forces outlined above—lobbyists, the judiciary, and an increasingly divided and polarized government—are pushing them to do so. When Congress does take on the task of writing complex legislation, it’s quite likely it will turn to AI for help.
Two particular AI capabilities enable Congress to write laws different from laws humans tend to write. One, AI models have an enormous scope of expertise, whereas people have only a handful of specializations. Large language models (LLMs) like the one powering ChatGPT can generate legislative text on funding specialty crop harvesting mechanization equally as well as material on energy efficiency standards for street lighting. This enables a legislator to address more topics simultaneously. Two, AI models have the sophistication to work with a higher degree of complexity than people can. Modern LLM systems can instantaneously perform several simultaneous multistep reasoning tasks using information from thousands of pages of documents. This enables a legislator to fill in more baroque detail on any given topic.
That’s not to say that handing over legislative drafting to machines is easily done. Modernizing any institutional process is extremely hard, even when the technology is readily available and performant. And modern AI still has a ways to go to achieve mastery of complex legal and policy issues. But the basic tools are there.
AI can be used in each step of lawmaking, and this will bring various benefits to policymakers. It could let them work on more policies—more bills—at the same time, add more detail and specificity to each bill, or interpret and incorporate more feedback from constituents and outside groups. The addition of a single AI tool to a legislative office may have an impact similar to adding several people to their staff, but with far lower cost.
Speed sometimes matters when writing law. When there is a change of governing party, there is often a rush to change as much policy as possible to match the platform of the new regime. AI could help legislators do that kind of wholesale revision. The result could be policy that is more responsive to voters—or more political instability. Already in 2024, the US House’s Office of the Clerk has begun using AI to speed up the process of producing cost estimates for bills and understanding how new legislation relates to existing code. Ohio has used an AI tool to do wholesale revision of state administrative law since 2020.
AI can also make laws clearer and more consistent. With their superhuman attention spans, AI tools are good at enforcing syntactic and grammatical rules. They will be effective at drafting text in precise and proper legislative language, or offering detailed feedback to human drafters. Borrowing ideas from software development, where coders use tools to identify common instances of bad programming practices, an AI reviewer can highlight bad law-writing practices. For example, it can detect when significant phrasing is inconsistent across a long bill. If a bill about insurance repeatedly lists a variety of disaster categories, but leaves one out one time, AI can catch that.
Perhaps this seems like minutiae, but a small ambiguity or mistake in law can have massive consequences. In 2015, the Affordable Care Act came close to being struck down because of a typo in four words, imperiling health care services extended to more than 7 million Americans.
There’s more that AI can do in the legislative process. AI can summarize bills and answer questions about their provisions. It can highlight aspects of a bill that align with, or are contrary to, different political points of view. We can even imagine a future in which AI can be used to simulate a new law and determine whether or not it would be effective, or what the side effects would be. This means that beyond writing them, AI could help lawmakers understand laws. Congress is notorious for producing bills hundreds of pages long, and many other countries sometimes have similarly massive omnibus bills that address many issues at once. It’s impossible for any one person to understand how each of these bills’ provisions would work. Many legislatures employ human analysis in budget or fiscal offices that analyze these bills and offer reports. AI could do this kind of work at greater speed and scale, so legislators could easily query an AI tool about how a particular bill would affect their district or areas of concern.
This is a use case that the House subcommittee on modernization has urged the Library of Congress to take action on. Numerous software vendors are already marketing AI legislative analysis tools. These tools can potentially find loopholes or, like the human lobbyists of today, craft them to benefit particular private interests.
These capabilities will be attractive to legislators who are looking to expand their power and capabilities but don’t necessarily have more funding to hire human staff. We should understand the idea of AI-augmented lawmaking contextualized within the longer history of legislative technologies. To serve society at modern scales, we’ve had to come a long way from the Athenian ideals of direct democracy and sortition. Democracy no longer involves just one person and one vote to decide a policy. It involves hundreds of thousands of constituents electing one representative, who is augmented by a staff as well as subsidized by lobbyists, and who implements policy through a vast administrative state coordinated by digital technologies. Using AI to help those representatives specify and refine their policy ideas is part of a long history of transformation.
Whether all this AI augmentation is good for all of us subject to the laws they make is less clear. There are real risks to AI-written law, but those risks are not dramatically different from what we endure today. AI-written law trying to optimize for certain policy outcomes may get it wrong (just as many human-written laws are misguided). AI-written law may be manipulated to benefit one constituency over others, by the tech companies that develop the AI, or by the legislators who apply it, just as human lobbyists steer policy to benefit their clients.
Regardless of what anyone thinks of any of this, regardless of whether it will be a net positive or a net negative, AI-made legislation is coming—the growing complexity of policy demands it. It doesn’t require any changes in legislative procedures or agreement from any rules committee. All it takes is for one legislative assistant, or lobbyist, to fire up a chatbot and ask it to create a draft. When legislators voted on that Brazilian bill in 2023, they didn’t know it was AI-written; the use of ChatGPT was undisclosed. And even if they had known, it’s not clear it would have made a difference. In the future, as in the past, we won’t always know which laws will have good impacts and which will have bad effects, regardless of the words on the page, or who (or what) wrote them.
This essay was written with Nathan E. Sanders, and originally appeared in Lawfare.
AI Mistakes Are Very Different from Human Mistakes
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/ai-mistakes-are-very-different-from-human-mistakes.html
Humans make mistakes all the time. All of us do, every day, in tasks both new and routine. Some of our mistakes are minor and some are catastrophic. Mistakes can break trust with our friends, lose the confidence of our bosses, and sometimes be the difference between life and death.
Over the millennia, we have created security systems to deal with the sorts of mistakes humans commonly make. These days, casinos rotate their dealers regularly, because they make mistakes if they do the same task for too long. Hospital personnel write on limbs before surgery so that doctors operate on the correct body part, and they count surgical instruments to make sure none were left inside the body. From copyediting to double-entry bookkeeping to appellate courts, we humans have gotten really good at correcting human mistakes.
Humanity is now rapidly integrating a wholly different kind of mistake-maker into society: AI. Technologies like large language models (LLMs) can perform many cognitive tasks traditionally fulfilled by humans, but they make plenty of mistakes. It seems ridiculous when chatbots tell you to eat rocks or add glue to pizza. But it’s not the frequency or severity of AI systems’ mistakes that differentiates them from human mistakes. It’s their weirdness. AI systems do not make mistakes in the same ways that humans do.
Much of the friction—and risk—associated with our use of AI arise from that difference. We need to invent new security systems that adapt to these differences and prevent harm from AI mistakes.
Human Mistakes vs AI Mistakes
Life experience makes it fairly easy for each of us to guess when and where humans will make mistakes. Human errors tend to come at the edges of someone’s knowledge: Most of us would make mistakes solving calculus problems. We expect human mistakes to be clustered: A single calculus mistake is likely to be accompanied by others. We expect mistakes to wax and wane, predictably depending on factors such as fatigue and distraction. And mistakes are often accompanied by ignorance: Someone who makes calculus mistakes is also likely to respond “I don’t know” to calculus-related questions.
To the extent that AI systems make these human-like mistakes, we can bring all of our mistake-correcting systems to bear on their output. But the current crop of AI models—particularly LLMs—make mistakes differently.
AI errors come at seemingly random times, without any clustering around particular topics. LLM mistakes tend to be more evenly distributed through the knowledge space. A model might be equally likely to make a mistake on a calculus question as it is to propose that cabbages eat goats.
And AI mistakes aren’t accompanied by ignorance. A LLM will be just as confident when saying something completely wrong—and obviously so, to a human—as it will be when saying something true. The seemingly random inconsistency of LLMs makes it hard to trust their reasoning in complex, multi-step problems. If you want to use an AI model to help with a business problem, it’s not enough to see that it understands what factors make a product profitable; you need to be sure it won’t forget what money is.
How to Deal with AI Mistakes
This situation indicates two possible areas of research. The first is to engineer LLMs that make more human-like mistakes. The second is to build new mistake-correcting systems that deal with the specific sorts of mistakes that LLMs tend to make.
We already have some tools to lead LLMs to act in more human-like ways. Many of these arise from the field of “alignment” research, which aims to make models act in accordance with the goals and motivations of their human developers. One example is the technique that was arguably responsible for the breakthrough success of ChatGPT: reinforcement learning with human feedback. In this method, an AI model is (figuratively) rewarded for producing responses that get a thumbs-up from human evaluators. Similar approaches could be used to induce AI systems to make more human-like mistakes, particularly by penalizing them more for mistakes that are less intelligible.
When it comes to catching AI mistakes, some of the systems that we use to prevent human mistakes will help. To an extent, forcing LLMs to double-check their own work can help prevent errors. But LLMs can also confabulate seemingly plausible, but truly ridiculous, explanations for their flights from reason.
Other mistake mitigation systems for AI are unlike anything we use for humans. Because machines can’t get fatigued or frustrated in the way that humans do, it can help to ask an LLM the same question repeatedly in slightly different ways and then synthesize its multiple responses. Humans won’t put up with that kind of annoying repetition, but machines will.
Understanding Similarities and Differences
Researchers are still struggling to understand where LLM mistakes diverge from human ones. Some of the weirdness of AI is actually more human-like than it first appears. Small changes to a query to an LLM can result in wildly different responses, a problem known as prompt sensitivity. But, as any survey researcher can tell you, humans behave this way, too. The phrasing of a question in an opinion poll can have drastic impacts on the answers.
LLMs also seem to have a bias towards repeating the words that were most common in their training data; for example, guessing familiar place names like “America” even when asked about more exotic locations. Perhaps this is an example of the human “availability heuristic” manifesting in LLMs, with machines spitting out the first thing that comes to mind rather than reasoning through the question. And like humans, perhaps, some LLMs seem to get distracted in the middle of long documents; they’re better able to remember facts from the beginning and end. There is already progress on improving this error mode, as researchers have found that LLMs trained on more examples of retrieving information from long texts seem to do better at retrieving information uniformly.
In some cases, what’s bizarre about LLMs is that they act more like humans than we think they should. For example, some researchers have tested the hypothesis that LLMs perform better when offered a cash reward or threatened with death. It also turns out that some of the best ways to “jailbreak” LLMs (getting them to disobey their creators’ explicit instructions) look a lot like the kinds of social engineering tricks that humans use on each other: for example, pretending to be someone else or saying that the request is just a joke. But other effective jailbreaking techniques are things no human would ever fall for. One group found that if they used ASCII art (constructions of symbols that look like words or pictures) to pose dangerous questions, like how to build a bomb, the LLM would answer them willingly.
Humans may occasionally make seemingly random, incomprehensible, and inconsistent mistakes, but such occurrences are rare and often indicative of more serious problems. We also tend not to put people exhibiting these behaviors in decision-making positions. Likewise, we should confine AI decision-making systems to applications that suit their actual abilities—while keeping the potential ramifications of their mistakes firmly in mind.
This essay was written with Nathan E. Sanders, and originally appeared in IEEE Spectrum.
EDITED TO ADD (1/24): Slashdot thread.
Crank (person)
Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2648
This is the bare text of an article in Wikipedia, deleted about an year ago.
I believe that it is significant – in fact, highly significant these days – and have put the text here to preserve it. Like all content of Wikipedia, it is licensed under CC-BY-SA, giving me the right to do so.
Authorship goes to the respective authors.
—-
Crank is a pejorative term used for a person who holds an unshakable belief that most of their contemporaries consider to be false.[1] Common synonyms for crank include crackpot and kook. A crank belief is so wildly at variance with those commonly held that it is considered ludicrous. Cranks characteristically dismiss all evidence or arguments which contradict their own unconventional beliefs, making any rational debate a futile task and rendering them impervious to facts, evidence, and rational inference.
A crank differs from a fanatic in that the subject of the fanatic’s obsession is either not necessarily widely regarded as wrong or not necessarily a “fringe” belief. Similarly, the word quack is reserved for someone who promotes a medical remedy or practice that is widely considered to be ineffective; this term, however, does not imply any deep belief in the idea or product they are attempting to sell.
Although experts in the field find a crank’s beliefs ridiculous, cranks are sometimes very successful in convincing non-experts of their views. A famous example is the Indiana Pi Bill, by which a state legislature nearly wrote into law a crank result in geometry.
Common characteristics
The second book of the mathematician and popular author Martin Gardner was a study of crank beliefs, Fads and Fallacies in the Name of Science. More recently, the mathematician Underwood Dudley has written a series of books on mathematical cranks, including The Trisectors, Mathematical Cranks, and Numerology: Or, What Pythagoras Wrought. And in a 1992 UseNet post, the mathematician John Baez humorously proposed a checklist, the Crackpot index, intended to diagnose cranky beliefs regarding contemporary physics.[2]
According to these authors, virtually universal characteristics of cranks include:
– Cranks overestimate their own knowledge and ability, and underestimate that of acknowledged experts.
– Cranks insist that their alleged discoveries are urgently important.
– Cranks rarely, if ever, acknowledge any error, no matter how trivial.
Cranks love to talk about their own beliefs, often in inappropriate social situations, but they tend to be bad listeners, being uninterested in anyone else’s experience or opinions.
Some cranks lack academic achievement, in which case they typically assert that academic training in the subject of their crank belief is not only unnecessary for discovering the truth, but actively harmful because they believe it poisons the minds by teaching falsehoods. Others greatly exaggerate their personal achievements, and may insist that some achievement (real or alleged) in some entirely unrelated area of human endeavor implies that their cranky opinion should be taken seriously.
Some cranks claim vast knowledge of any relevant literature, while others claim that familiarity with previous work is entirely unnecessary.
In addition, the overwhelming majority of cranks:
– seriously misunderstand the mainstream opinion to which they believe that they are objecting,
stress that they have been working out their ideas for many decades, and claim that this fact alone shows that their belief cannot be dismissed as resting upon some simple error,
– compare themselves with luminaries in their chosen field (often Galileo Galilei, Nicolaus Copernicus, Leonhard Euler, Isaac Newton, Albert Einstein or Georg Cantor),[citation needed] implying that the mere unpopularity of some belief is not good reason for it to be dismissed,
– claim that their ideas are being suppressed, typically backed up by conspiracy theories invoking intelligence organizations, mainstream science, powerful business interests, or other groups which, they allege, are terrified by the possibility of their revolutionary insights becoming widely known,
appear to regard themselves as persons of unique historical importance.
Cranks who contradict some mainstream opinion in some highly technical field, (e.g. mathematics, cryptography, physics) may:
– exhibit a marked lack of technical ability,
– misunderstand or not use standard notation and terminology,
– ignore fine distinctions which are essential to correctly understand mainstream belief.
That is, cranks tend to ignore any previous insights which have been proven by experience to facilitate discussion and analysis of the topic of their cranky claims; indeed, they often assert that these innovations obscure rather than clarify the situation.[3]
In addition, cranky scientific theories often do not in fact qualify as theories as this term is commonly understood within science. For example, crank theories in physics typically fail to result in testable predictions, which makes them unfalsifiable and hence unscientific. Or, cranks may present their ideas in such a confused, not even wrong manner that it is impossible to determine what they are actually claiming.
Internet cranks
(See also: Usenet personality)
The rise of the Internet has given another outlet to people well outside the mainstream who may get labeled cranks due to internet postings or websites promoting particular beliefs. There are a number of websites devoted to listing people as cranks. Community-edited websites like Wikipedia have been described as vulnerable to cranks.[4][5]
Science fiction author and critic Bruce Sterling noted in his essay in CATSCAN 13:
Online communication can wonderfully liberate the tender soul of some well-meaning personage who, for whatever reason, is physically uncharismatic. Unfortunately, online communication also fertilizes the eccentricities of hopeless cranks, who at last find themselves in firm possession of a wondrous soapbox that the Trilateral Commission and the Men In Black had previously denied them.[6]
There are also newsgroups which are nominally devoted to discussing (alt.usenet.kooks) or poking fun at (alt.slack, alt.religion.kibology) supposed cranks.
Crank magnetism
The term crank magnetism was coined by physiologist and blogger Mark Hoofnagle on the Denialism Blog in 2007 to refer to the tendency for cranks to be attracted to claims made by other cranks.[7] Crank magnetism may be considered to operate wherever a single person propounds a number of unrelated denialist conjectures, poorly supported conspiracy theories, or pseudoscientific claims. Thus, some of the common crank characteristics—such as the lack of technical ability, ignorance of scientific terminology, and claims that alternative ideas are being suppressed by the mainstream—may be operating on and manifested in multiple orthogonal assertions.
Hoofnagle’s fellow blogger David Gorski has discussed crank magnetism in relation to the writings of British columnist Melanie Phillips, who he alleges denies anthropogenic global warming while promoting intelligent design and the discredited view that the MMR vaccine causes autism in children.[8] Blogger Luke Scientiæ has commented on the relationship between the number of unrelated claims that magnetic cranks make and the extent of their open hostility to science.[9] He has also coined the phrase “magnetic hoax” in relation to hoax claims that attract multiple crank interpretations.[10]
Studies
One study, NASA faked the moon landing—Therefore (Climate) Science is a Hoax: An Anatomy of the Motivated Rejection of Science, gave evidence that climate change denial correlated with moon landing and 9/11 conspiracy theories, staunch beliefs in laissez-faire free-market capitalism, denial of the link between tobacco smoking and lung cancer, HIV/AIDS denialism and MLK death conspiracy theories:[11]
Although nearly all domain experts agree that human CO2 emissions are altering the world’s climate, segments of the public remain unconvinced by the scientific evidence. Internet blogs have become a vocal platform for climate denial, and bloggers have taken a prominent and influential role in questioning climate science. We report a survey (N > 1100) of climate blog users to identify the variables underlying acceptance and rejection of climate science. Paralleling previous work, we find that endorsement of a laissez-faire conception of free-market economics predicts rejection of climate science (r ‘ .80 between latent constructs). Endorsement of the free market also predicted the rejection of other established scientific findings, such as the facts that HIV causes AIDS and that smoking causes lung cancer. We additionally show that endorsement of a cluster of conspiracy theories (e.g., that the CIA killed Martin-Luther King or that NASA faked the moon landing) predicts rejection of climate science as well as the rejection of other scientific findings, above and beyond endorsement of laissez-faire free markets. This provides empirical confirmation of previous suggestions that conspiracist ideation contributes to the rejection of science. Acceptance of science, by contrast, was strongly associated with the perception of a consensus among scientists.[11]
Another study titled Dead and Alive: Beliefs in Contradictory Conspiracy Theories managed to show that not only will cranks be attracted to and believe in numerous conspiracy theories all at once, but will continue to do so even if the theories in question are completely and utterly incompatible with one another.[12] For instance, the study showed that: “… the more participants believed that Princess Diana faked her own death, the more they believed that she was murdered [and that] … the more participants believed that Osama Bin Laden was already dead when U.S. special forces raided his compound in Pakistan, the more they believed he is still alive,” and that “Hierarchical regression models showed that mutually incompatible conspiracy theories are positively associated because both are associated with the view that the authorities are engaged in a cover-up”.[12]
Studies such as Belief in Conspiracy Theories state that conspiracy theories relating to the assassination of JFK, the moon landing and the September 11th attacks are united by a common thread: distrust of the government-endorsed story. This leads the believer to attach other conspiracies as well. Someone with a distrust of the government will likely reject any stories or reports directly issued by state agencies or other authorities that are seen as part of the establishment. Thus, any conspiracy will seem more plausible to the conspiracy theorist because this fits with their worldview.[13]
Cultic milieu
In academic sociology, a similar notion to crank magnetism exists, namely Colin Campbell’s concept of the cultic milieu, which he used:
…to refer to a society’s deviant belief systems and practices and their associated collectivities, institutions, individuals, and media of communication. He described it as including “the worlds of the occult and the magical, of spiritualism and psychic phenomena, of mysticism and new thought, of alien intelligences and lost civilizations, of faith healing and nature cure” (Campbell 1972:122), and it can be seen, more generally, to be the point at which deviant science meets deviant religion. What unifies these diverse elements, apart from a consciousness of their deviant status and an ensuing sense of common cause, is an overlapping communication structure of magazines, pamphlets, lectures, and informal meetings, together with the common ideology of seekership.[14]
See also:
Creativity and mental illness
Eccentricity (behavior)
Illusory superiority
Dunning–Kruger effect
List of topics characterized as pseudoscience
Paranoia
Pseudophysics
Pseudoscholarship
Tallinna narrid ja narrikesed
Spoofs
Kibo
Psychoceramics
References:
Crank at Merriam-Webster Online Dictionary
John Baez, New improved crackpot index an update to the 1992 list, 26 August 1998, sci.physics (archived message on Google Groups).
Hodges, Wilfrid (1998). “An Editor Recalls Some Hopeless Papers”. The Bulletin of Symbolic Logic. 4 (1): 1–16. CiteSeerX 10.1.1.27.6154. doi:10.2307/421003. JSTOR 421003. S2CID 14897182. A paper describing several attempts at disproving Cantor’s diagonal argument, looking at the flaws in their arguments and reasoning.
“Fact or fiction? Who contributes to Wikipedia? Despite … Archived 2009-01-12 at the Wayback Machine”, Global Agenda, March 12, 2007, Retrieved 23 April 2010
“Wikipedia.(Brief Article)”. Booklist. September 15, 2002. Archived from the original on January 12, 2009. Retrieved May 11, 2008.
CATSCAN 13: “Electronic Text” Archived 2012-04-06 at the Wayback Machine (Bruce Sterling, SF Eye) Retrieved 8 August 2012
Hoofnagle, Mark. “Crank Magnetism”. Retrieved 25 November 2015.
Gorski, David (6 May 2009). “Melanie Phillips: Crank magnetism in action on evolution and vaccines”. Respectful Insolence. Retrieved 25 November 2015.
Luke Scientiæ. “A Few Comments on Crank Magnetism”. Retrieved 15 August 2011.[permanent dead link]
Luke Scientiae. “The Magnetic Hoax: The Giant Hoax as an Example”. Retrieved 15 August 2011.[permanent dead link]
Stephan Lewandowsky, Klaus Oberauer, Gilles Gignac. “NASA faked the moon landing – Therefore (Climate) Science is a Hoax: An Anatomy of the Motivated Rejection of Science.” Archived 31 July 2019 at the Wayback Machine Psychological Science (in press)
Michael J. Wood, Karen M. Douglas, Robbie M. Sutton. “Dead and Alive: Beliefs in Contradictory Conspiracy Theories” Archived 2018-01-05 at the Wayback Machine Social Psychological and Personality Science (in press)
Ted Goertzel. Belief in Conspiracy Theories. International Society of Political Psychology, vol. 15, no. 4, 1994. doi:10.2307/3791630
“Cult Archived 2016-03-04 at the Wayback Machine” William H. Swatos, Jr. Editor. Encyclopedia of Religion and Society, Hartford Institute for Religion Research.
Further reading
Dudley, Underwood (1987). A Budget of Trisections. New York: Springer-Verlag. ISBN 0387965688.
Dudley, Underwood (1992). Mathematical Cranks. Washington, D.C.: Mathematical Association of America. ISBN 0883855070.
Dudley, Underwood (1996). The Trisectors. Washington, D.C.: Mathematical Association of America. ISBN 0883855143.
Dudley, Underwood (1997). Numerology: Or, What Pythagoras Wrought. Washington, D.C.: Mathematical Association of America. ISBN 0883855240.
Dudley, Underwood (2008). On Jargon: How to Call a Crank a Crank (and Win If You Get Sued) (PDF). The UMAP Journal, 29.1.[permanent dead link]
Eves, Howard (1972). Mathematical Circles Squared; A Third Collection of Mathematical Stories and Anecdotes. Boston: Prindle, Weber & Schmidt. ISBN 0871501546.
Gardner, Martin (1957). Fads and Fallacies in the Name of Science. New York: Dover. ISBN 0486203948. LCCN 57003844.
Williams, William F. (Editor) (2000). Encyclopedia of Pseudoscience: From Alien Abductions to Zone Therapy Facts on File ISBN 081603351X
Kossy, Donna. Kooks: A Guide to the Outer Limits of Human Belief, Los Angeles: Feral House, 2001 (2nd ed. exp. from 1994). (ISBN 978-0922915675)
Kruger, Justin; David Dunning (1989). “Unskilled and Unaware of It: How Difficulties in Recognizing One’s Own Incompetence Lead to Inflated Self-Assessments” (PDF). J. Pers. Soc. Psychol. 71 (6): 1121–1134. doi:10.1037/0022-3514.77.6.1121. PMID 10626367.
External links:
Crank Dot Net: Cranks and their theories listed and categorised.
Biden Signs New Cybersecurity Order
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/biden-signs-new-cybersecurity-order.html
President Biden has signed a new cybersecurity order. It has a bunch of provisions, most notably using the US governments procurement power to improve cybersecurity practices industry-wide.
Some details:
The core of the executive order is an array of mandates for protecting government networks based on lessons learned from recent major incidents—namely, the security failures of federal contractors.
The order requires software vendors to submit proof that they follow secure development practices, building on a mandate that debuted in 2022 in response to Biden’s first cyber executive order. The Cybersecurity and Infrastructure Security Agency would be tasked with double-checking these security attestations and working with vendors to fix any problems. To put some teeth behind the requirement, the White House’s Office of the National Cyber Director is “encouraged to refer attestations that fail validation to the Attorney General” for potential investigation and prosecution.
The order gives the Department of Commerce eight months to assess the most commonly used cyber practices in the business community and issue guidance based on them. Shortly thereafter, those practices would become mandatory for companies seeking to do business with the government. The directive also kicks off updates to the National Institute of Standards and Technology’s secure software development guidance.
Friday Squid Blogging: Opioid Alternatives from Squid Research
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/friday-squid-blogging-opioid-alternatives-from-squid-research.html
Is there nothing that squid research can’t solve?
“If you’re working with an organism like squid that can edit genetic information way better than any other organism, then it makes sense that that might be useful for a therapeutic application like deadening pain,” he said.
[…]
Researchers hope to mimic how squid and octopus use RNA editing in nerve channels that interpret pain and use that knowledge to manipulate human cells.
Social Engineering to Disable iMessage Protections
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/social-engineering-to-disable-imessage-protections.html
I am always interested in new phishing tricks, and watching them spread across the ecosystem.
A few days ago I started getting phishing SMS messages with a new twist. They were standard messages about delayed packages or somesuch, with the goal of getting me to click on a link and entering some personal information into a website. But because they came from unknown phone numbers, the links did not work. So—this is the new bit—the messages said something like: “Please reply Y, then exit the text message, reopen the text message activation link, or copy the link to Safari browser to open it.”
I saw it once, and now I am seeing it again and again. Everyone has now adopted this new trick.
One article claims that this trick has been popular since last summer. I don’t know; I would have expected to have seen it before last weekend.
Serverless ICYMI Q4 2024
Post Syndicated from Eric Johnson original https://aws.amazon.com/blogs/compute/serverless-icymi-q4-2024/
Welcome to the 27th edition of the AWS Serverless ICYMI (in case you missed it) quarterly recap. At the end of a quarter, we share the most recent product launches, feature enhancements, blog posts, webinars, live streams, and other interesting things that you might have missed!
In case you missed our last ICYMI, check out what happened in Q2 here.
Serverless at re:Invent 2024
AWS re:Invent 2024 had 60,000 in-person attendees and 400,000 online viewers for the keynotes. The conference delivered 1,900 sessions from 3,500 speakers and included 546 AWS service and feature announcements.
The serverless content consisted of two tracks: Serverless (SVS) and App Integration (API). These tracks included 70 unique sessions and attracted nearly 11,000 attendees. Serverlesspresso, the coffee shop powered by serverless technology, operated in two locations during the event: the Expo Hall and the certification lounge.
Videos are available on Serverless Land YouTube.
AWS Lambda and Amazon Elastic Container Service (Amazon ECS) 10-year anniversary.
AWS marked significant milestones in serverless computing, celebrating 10 years of AWS Lambda and Amazon ECS. Lambda now serves over 1.5 million monthly customers and processes tens of trillions of requests each month. Amazon ECS launches more than 2.4 billion container tasks weekly and is used by over 65% of new AWS container customers.
AWS is commemorating this anniversary with insights from AWS Serverless Heroes, product leads, principal engineers, and AWS leadership sharing their perspectives on serverless evolution and future directions. These stories and insights are available at https://aws.amazon.com/serverless/10th-anniversary/.
AWS Lambda
The AWS Lambda team has spent a significant amount of time improving the Lambda development experience. Several enhancements have been made in the console as well as the local development experience.
Lambda has launched a significant upgrade to its console by integrating Code-OSS, the open-source version of Visual Studio Code, delivering a familiar development experience directly in the cloud. The new Lambda Code Editor supports viewing larger function packages up to 50 MB, features a split-screen interface for simultaneous code editing and testing, and includes built-in Amazon Q Developer AI assistance for real-time coding suggestions. This enhancement comes at no additional cost and prioritizes accessibility with features like screen reader support and keyboard navigation. The update bridges the gap between cloud and local development by simplifying the process of downloading function code and AWS SAM templates, ultimately providing developers with a more streamlined and familiar serverless development experience. Watch the video explaining the changes in detail.
Additionally, the Lambda console enhances developer experience with two new features: a built-in CloudWatch Metrics Insights dashboard that surfaces key function metrics, and CloudWatch Logs Live Tail support for real-time log streaming and analysis, enabling faster troubleshooting without leaving the Lambda environment.
Lambda now supports native JSON structured logging for .NET managed runtime applications, improving log searchability and analysis capabilities without requiring manual configuration of logging libraries.
Lambda has expanded its runtime support by adding Python 3.13 and Node.js 22 as both managed runtimes and container base images, providing access to the latest language features and ensuring long-term support through October 2029 and April 2027, respectively.
Lambda SnapStart capability is now available for Python and .NET runtimes, delivering sub-second startup performance for latency-sensitive applications by caching initialized execution environments.
New CloudWatch metrics for Lambda Event Source Mappings provide enhanced visibility into event processing states for Amazon Simple Queue Service (SQS), Amazon Kinesis, and Amazon DynamoDB event sources, helping customers monitor and troubleshoot event processing issues.
Lambda introduces Provisioned Mode for Kafka event source mappings, allowing customers to optimize throughput by configuring dedicated event polling resources for applications with stringent performance requirements.
Finally, Lambda introduces an enhanced local development experience through the AWS Toolkit for Visual Studio Code, streamlining the serverless application development workflow. The update features a new Application Builder interface that guides developers through environment setup, offers sample applications, and provides quick-action buttons for common tasks like build, deploy, and invoke operations. Developers can now efficiently iterate on their code with features such as configurable build settings, step-through debugging, and the ability to sync local changes quickly to the cloud or perform full deployments. The toolkit integrates with AWS Infrastructure Composer for visual application building and includes comprehensive local testing capabilities with shareable test events. This enhancement simplifies the Lambda development process by enabling developers to author, test, debug, and deploy serverless applications without leaving their preferred IDE environment.
Amazon ECS and AWS Fargate
AWS enhances observability for containerized applications with CloudWatch Application Signals for Amazon ECS, adding infrastructure metrics correlation to existing traces and logs monitoring, enabling operators to identify and resolve performance issues across their application stack.
Amazon ECS adds service revision and deployment history tracking, allowing customers to monitor changes, track ongoing deployments, and debug deployment failures for long-running applications deployed after October 25, 2024.
Amazon ECS expands testing capabilities by supporting network fault injection experiments on AWS Fargate through AWS Fault Injection Service, enabling developers to verify application resilience using six different types of fault injection actions, including network disruptions and resource stress testing.
Amazon EventBridge
Amazon EventBridge announces significant performance improvements, reducing end-to-end latency by up to 94% from 2,235ms to 129.33ms at P99, enabling faster event processing for time-sensitive applications like fraud detection and gaming.
Amazon EventBridge and AWS Step Functions now integrate with private APIs through AWS PrivateLink and Amazon VPC Lattice, enabling secure connectivity between cloud and on-premises applications without custom networking code.
EventBridge API destinations introduces proactive OAuth token refresh for public and private authorization endpoints, helping prevent delays and errors by automatically refreshing tokens before expiration.
AWS Step Functions
AWS Step Functions introduces the ability to export workflows as CloudFormation or SAM templates directly from the AWS console, enabling repeatable provisioning across accounts. Developers can export and customize templates from existing workflows, and use AWS Infrastructure Composer to visually connect workflows with other AWS resources.
Step Functions also adds Variables and JSONata support to enhance workflow development. Variables allow data assignment and reference between states, simplifying payload management, while JSONata provides advanced data transformation capabilities, including date formatting and mathematical operations. These features reduce the need for custom code and intermediate states, making it easier to build distributed serverless applications. Watch the in depth video to learn more.
Amazon Kinesis
Amazon Kinesis introduces significant updates to its client libraries. The new Kinesis Client Library (KCL) 3.0 reduces compute costs by up to 33% through enhanced load balancing, while the Kinesis Producer Library (KPL) 1.0 improves performance and security. Both libraries now support AWS SDK for Java 2.x and eliminate dependencies on SDK for Java 1.x, enabling seamless upgrades without requiring application code changes.
KCL 3.0 metrics
Amazon MQ
Amazon MQ adds support for AWS PrivateLink, enabling customers to access Amazon MQ API endpoints directly from their VPC through interface VPC endpoints, eliminating the need for internet access and providing enhanced security through AWS’s internal network infrastructure.
Amazon Finch
AWS announces general availability of Linux support for Finch, an open source container development tool that simplifies building, running, and publishing Linux containers across all major operating systems. The release includes support for the Finch Daemon with Docker API compatibility and is available through RPM packages for Amazon Linux 2 and Amazon Linux 2023.
Amazon Simple Queue Service (SQS)
Amazon SQS increases the in-flight message limit for FIFO queues from 20,000 to 120,000 messages, enabling higher concurrent message processing. This enhancement allows customers to scale their receivers and process up to six times more messages simultaneously, provided they have sufficient publish throughput.
Amazon Managed Streaming for Apache Kafka(Amazon MSK)
Amazon MSK now introduces Managed Streaming for Apache Flink blueprints to simplify real-time AI application development. The service enables vector-embedding generation through Amazon Bedrock, streamlining the integration of streaming data with generative AI models. Using a straightforward configuration process, users can generate and index vector embeddings in Amazon OpenSearch, while leveraging LangChain’s data chunking capabilities for enhanced data retrieval efficiency. The service handles all integration aspects between MSK, embedding models, and Amazon OpenSearch vector stores.
AWS Amplify
AWS Amplify launches the Amplify AI kit for Amazon Bedrock, providing fullstack developers with tools to integrate AI capabilities into web applications. The kit includes a customizable React UI component, secure Bedrock access, and context-sharing features, enabling developers to implement chat, search, and summarization functionalities without machine learning expertise.
AWS AppSync
AWS AppSync launches AppSync Events, enabling developers to broadcast real-time data to multiple subscribers through serverless WebSocket APIs. The service eliminates the need to build and manage WebSocket infrastructure while providing secure, scalable event broadcasting capabilities. Developers can create APIs that automatically scale and integrate with services like Amazon EventBridge. The system supports features such as channel namespaces, event handlers, and multiple authorization modes, and is available in all regions where AWS AppSync operates. Users only pay for API operations and real-time connection minutes used.
Amazon API Gateway
Amazon API Gateway released a significant enhancement to Amazon API Gateway, enabling customers to manage private REST APIs using custom private DNS names. This highly requested feature allows API providers to use user-friendly domain names like private.example.com, while maintaining TLS encryption for security. The implementation process involves creating a private custom domain, configuring certificates through AWS Certificate Manager (ACM), mapping private APIs, and setting resource policies. The feature supports cross-account sharing through AWS Resource Access Manager (AWS RAM) and is now available in all AWS Regions, including AWS GovCloud (US).
Serverless blog posts
October
- Designing Serverless Integration Patterns for Large Language Models (LLMs)
- Simplifying Lambda function development using CloudWatch Logs Live Tail and Metrics Insights
- Introducing an enhanced in-console editing experience for AWS Lambda
- Introducing an enhanced local IDE experience for AWS Lambda developers
November
- Python 3.13 runtime now available in AWS Lambda
- The serverless attendee’s guide to AWS re:Invent 2024
- Serverless containers at AWS re:Invent 2024
- Implementing custom domain names for private endpoints with Amazon API Gateway
- Node.js 22 runtime now available in AWS Lambda
- Introducing new Event Source Mapping (ESM) metrics for AWS Lambda
- How Infinitium reduced fraud detection time by 95% with Amazon ECS and AWS Fargate on AWS Graviton
- Improving deployment visibility for Amazon ECS services
- Simplifying developer experience with variables and JSONata in AWS Step Functions
- Automating event validation with Amazon EventBridge Schema Discovery
- Implementing transactions using JMS2.0 in Amazon MQ for ActiveMQ
- Optimize compute resources on Amazon ECS with Predictive Scaling
- Introducing Provisioned Mode for Kafka Event Source Mappings with AWS Lambda
- Transforming Istio into an enterprise-ready service mesh for Amazon ECS
Serverless Office Hours
October
- Oct 1 – Fullstack apps with Amplify Gen 2
- Oct 8 – Step Functions + containers
- Oct 22 – GraphQL fun with AppSync
- Oct 29 – Serverless testing with Pawel Zubkiewicz
November
- Nov 5 – Stripe event destinations
- Nov 12 – 10 years of Lambda & ECS
- Nov 19 – Enhancing Lambda DevEx
- Nov 25 – pre:Invent 2024
Still looking for more?
The Serverless landing page has more information. The Lambda resources page contains case studies, webinars, whitepapers, customer stories, reference architectures, and even more Getting Started tutorials.
You can also follow the Serverless Developer Advocacy team on X (formerly Twitter) to see the latest news, follow conversations, and interact with the team.
- Eric Johnson: @edjgeek
- Julian Wood: @julian_wood
- Marcia Villalba: @mavi888uy
- Romain Jourdan: @rjourdan_net
And finally, visit the Serverless Land for all your serverless needs.
FBI Deletes PlugX Malware from Thousands of Computers
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/fbi-deletes-plugx-malware-from-thousands-of-computers.html
According to a DOJ press release, the FBI was able to delete the Chinese-used PlugX malware from “approximately 4,258 U.S.-based computers and networks.”
To retrieve information from and send commands to the hacked machines, the malware connects to a command-and-control server that is operated by the hacking group. According to the FBI, at least 45,000 IP addresses in the US had back-and-forths with the command-and-control server since September 2023.
It was that very server that allowed the FBI to finally kill this pesky bit of malicious software. First, they tapped the know-how of French intelligence agencies, which had recently discovered a technique for getting PlugX to self-destruct. Then, the FBI gained access to the hackers’ command-and-control server and used it to request all the IP addresses of machines that were actively infected by PlugX. Then it sent a command via the server that causes PlugX to delete itself from its victims’ computers.
Phishing False Alarm
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/phishing-false-alarm.html
A very security-conscious company was hit with a (presumed) massive state-actor phishing attack with gift cards, and everyone rallied to combat it—until it turned out it was company management sending the gift cards.
Upcoming Speaking Engagements
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/upcoming-speaking-engagements-42.html
This is a current list of where and when I am scheduled to speak:
- I’m speaking on “AI: Trust & Power” at Capricon 45 in Chicago, Illinois, USA, at 11:30 AM on February 7, 2025. I’m also signing books there on Saturday, February 8, starting at 1:45 PM.
- I’m speaking at Boskone 62 in Boston, Massachusetts, USA, which runs from February 14-16, 2025.
- I’m speaking at the Rossfest Symposium in Cambridge, UK, on March 25, 2025.
The list is maintained on this page.
The First Password on the Internet
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/the-first-password-on-the-internet.html
It was created in 1973 by Peter Kirstein:
So from the beginning I put password protection on my gateway. This had been done in such a way that even if UK users telephoned directly into the communications computer provided by Darpa in UCL, they would require a password.
In fact this was the first password on Arpanet. It proved invaluable in satisfying authorities on both sides of the Atlantic for the 15 years I ran the service during which no security breach occurred over my link. I also put in place a system of governance that any UK users had to be approved by a committee which I chaired but which also had UK government and British Post Office representation.
I wish he’d told us what that password was.
Microsoft Takes Legal Action Against AI “Hacking as a Service” Scheme
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/microsoft-takes-legal-action-against-ai-hacking-as-a-service-scheme.html
Not sure this will matter in the end, but it’s a positive move:
Microsoft is accusing three individuals of running a “hacking-as-a-service” scheme that was designed to allow the creation of harmful and illicit content using the company’s platform for AI-generated content.
The foreign-based defendants developed tools specifically designed to bypass safety guardrails Microsoft has erected to prevent the creation of harmful content through its generative AI services, said Steven Masada, the assistant general counsel for Microsoft’s Digital Crimes Unit. They then compromised the legitimate accounts of paying customers. They combined those two things to create a fee-based platform people could use.
It was a sophisticated scheme:
The service contained a proxy server that relayed traffic between its customers and the servers providing Microsoft’s AI services, the suit alleged. Among other things, the proxy service used undocumented Microsoft network application programming interfaces (APIs) to communicate with the company’s Azure computers. The resulting requests were designed to mimic legitimate Azure OpenAPI Service API requests and used compromised API keys to authenticate them.
Slashdot thread.
Friday Squid Blogging: Cotton-and-Squid-Bone Sponge
Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/friday-squid-blogging-cotton-and-squid-bone-sponge.html
News:
A sponge made of cotton and squid bone that has absorbed about 99.9% of microplastics in water samples in China could provide an elusive answer to ubiquitous microplastic pollution in water across the globe, a new report suggests.
[…]
The study tested the material in an irrigation ditch, a lake, seawater and a pond, where it removed up to 99.9% of plastic. It addressed 95%-98% of plastic after five cycles, which the authors say is remarkable reusability.
The sponge is made from chitin extracted from squid bone and cotton cellulose, materials that are often used to address pollution. Cost, secondary pollution and technological complexities have stymied many other filtration systems, but large-scale production of the new material is possible because it is cheap, and raw materials are easy to obtain, the authors say.
Research paper.










