Veserv

Why are you deceptively bringing up the Space Shuttle? That was never intended to be a serious cost-effective launch vehicle. Also, why are you deceptively talking about 97% and 99% like the difference between 30x and 100x is not a factor of 3?

The Ariane 5, first launching in 2003 which is 7 years earlier than the first Falcon 9 launch, had a launch cost of ~150 M$ in 2015 with a payload to LEO of ~16,000 kg for a cost of 10,000 $/kg. The Soyuz-2, first launching in 2004 which is 6 years earlier than the first Falcon 9 launch, had a launch cost of ~35 M$ with a payload to LEO of ~8,000 kg for a cost of ~4,500 $/kg.

The truth is 3-6% of your claim of 100x cost improvement.

Yes, he was [1] director of AI and Autopilot Vision at Tesla, directly poached and reporting to Elon Musk on the most important headline feature of Tesla directly managed by Elon Musk.

He had both the technical and executive authority to determine if the product was fit for customer usage. He had direct executive responsibility for the product on the road between 2017-2022.

If he, the lead architect and executive responsible felt the product was dangerous and then he was overridden, he can not get away with claiming he was “just following orders”, he had a moral duty to not sign-off or quit otherwise he is clearly complicit in deploying a dangerous product for his own self-enrichment.

When people talk about engineering ethics, this is literally a completely uncontroversial textbook example. The only way you accept this is if you do not want ethics in engineering.

Furthermore, he was extremely hireable with numerous job opportunitys available to him. He would not be destitute or even particularly worse off if he did quit for ethical reasons. Any self-preservation defense is also invalid.

[1] https://techcrunch.com/2017/06/20/tesla-hires-deep-learning-...

I mean, you would think that all those people he killed as the person in charge of deploying knowingly dangerously defective self-driving software for profit would have had a impact. But executives seem to just skate on killing customers to line their own pockets these days. Just "following orders" I guess.

A order of magnitude is a factor of 10x. Multiple orders of magnitude is at least 100x.

SpaceX Falcon 9 has a launch cost of 74 M$ with a payload to LEO of 22,800 kg for a launch cost of ~3,200 $/kg to LEO.

So you are incorrectly claiming that space launch costs were 320,000 $/kg. Elon Musk is a habitual liar, but you should try not to be one as well as it demonstrates your argument to be based in ignorance and deception.

Your communication channel between Alice and Bob is, itself, a capability (or a collection of capabilitys) that grants Bob memory write, Alice memory read, but does not grant the ability to transmit a capability from Bob to Alice.

Absent a misunderstanding on your part, the only way I can coherently interpret your argument is that you are arguing that the presence of kernel data structures mediating the handles somehow makes it not a capability system. That there is some background element mediating the validity of your capability representation and thus that is just a MAC layer; unless you can write the byte representation of your handle into memory and somebody else can read it out and then have access to that resource it is not a capability.

One, that allows forging capabilitys unless they are cryptographically secure against collisions.

Two, the actual essence of capabilitys is not being bearer tokens, it is non-construction. Capabilitys are derived from existing capabilitys, not manifested into existence. They have provenance. It is the OS equivalent of not allowing programs to cast arbitrary integers to pointers and thus manifesting pointers into existence which breaks basically every high level memory safety guarantee. You do not allow programs to cast arbitrary data into handles to resources which is what ambient authority systems effectively require.

The difference between ambient authority systems, like Windows and Linux, and capability systems is the difference between a program that only uses global variables and a program that uses local variables and function parameters.

In a capability system, you pass resource capabilitys to subsystems. You can not use resource handles that were not passed to you just like a function can not access variables that were not passed to it (except for explicit global variables.

In ambient authority systems, as a common example, you can just blindly convert what are effectively strings into resource handles (the metaphorical equivalent of casting integers to raw pointers). Your access is mediated by a orthogonal system that tells you which resource handles/pointers you are allowed to use. That is like having a program that runtime checks every pointer access is allowed instead of just preventing you from manufacturing pointers.

You coordinate across subsystems by naming certain resources in the global ambient space in a coordinated fashion (effectively a global variable which is basically just a named memory location in the common memory space). That way the subsystem knows the global you put their parameters/resources in.

While you can still program like that, everybody now knows it is a terrible way to live. Parameter passing and local variables with explicit global variables is almost always the way to go. That same lesson should be learned for operating systems.

Sure, but that is not related to anything I said.

I said that “protects against state actors” means the cost of finding a exploit as generally applicable and powerful as a zero-click RCE needs to cost on the order of hundreds of millions to billions of dollars per exploit to be problematic for state actors to field.

That amount of resources is a competent team of 100 skilled individuals finding zero zero-click RCEs after 3 years of full time investigation. That could credibly be called secure against state actors, though would still not be out of reach of a real military operation as a hundred million dollars is still just the cost of a single jet fighter.

Nah, Elon Musk faked the demo [1] so he could defraud Tesla investors into bailing out his cousins.

[1] https://mansionengineer.com/2018/08/10/elon-musk-tesla-and-t...

> Smallpox was much less deadly to Europeans than the Indians. Indians fell like flies to European diseases.

That does not support your argument that there is a adaptive advantage for reduced deadliness. The fact that it was exceedingly deadly to non co-evolved hosts indicates it was not the disease that became less deadly, but that the co-evolved hosts developed better defenses.

> Our bodies are full of bugs that have evolved into peaceful coexistence.

That is a argument that there is a continuous adaptive advantage to reduced deadliness down to ~0%. Again, Rabies had and continues to have a nearly 100% fatality rate in co-evolved hosts for thousands of years. Smallpox had a 10-30% fatality rate. Any magical inherent adaptive advantage for reduced deadliness failed to materialize to continue pushing down their deadliness.

Or put another way, a disease can have a 30% mortality rate and still do a really bang-up job at propagation with limited adaptive pressure to reduce that further for thousands of years. Peaceful coexistence is more likely a artifact of the specific dynamic than any sort of meaningful fundamental advantage to reduced deadliness.

Deadly diseases losing their deadliness over time is possible, but hardly guaranteed even at the species/population level. Rabies has effectively a 100% fatality rate in host species. Smallpox, which is human-specific with no animal reservoir so must have been spread consistently and entirely within humans, had a fatality rate on the order of 10-30% even after thousands of years of co-evolution.

That is a total strawman. The standard of “effective” being used by the person I was responding to and Apple themselves is “protects against state actors targeting you”, not “has any benefit whatsoever” or even “has a material benefit”.

Protecting against state actors is not a instantaneous property of the present. It demands durable protection against compromise by state actors who can easily spend tens to hundreds of millions of dollars on teams of hundreds for multiple years to develop novel, durable exploits known only to them. To the extent that compromises exist, they would require expected resource expenditure in excess of what state actors can deploy or are in excess of the value derivable by state actors which is going to be in the hundreds of millions to billions of dollar range to constitute as being "effective against state actors targeting you".

Protecting against state actors means secure against Iran, Saudi Arabia, China, and the NSA. That is the unsupported marketing bullshit I am calling out.

"Recall" is a technical term meaning: "public dangerous defect notice".

A "recall" is stating that the defective version of the product in the field must be "removed/recalled" and replaced/updated with a non-defective version at the manufacturer's expense. It just so happens that the removal and replacement of defective software from the field can occur remotely.

The important part is that the manufacturer delivered a defective product that risks your safety, that fixing that safety defect is the responsibility of the manufacturer, and the system is unsafe until that occurs.

Again, no. You do not need to spend 10 million on a exploit if you are working with a company like NSO Group who sells white-glove access to target individual as a service. The cost lower bound is going to be on the order of ((cost of exploit) / (number of times exploit can be used)) and the denominator there is going to easily be in the hundreds to thousands. Of course prices are likely to be higher than the minimum due to profit margins.

To, once again, use the same example of NSO Group as it is infamous and well-documented [1]. In 2016 it was 500,000 $ upfront and 650,000 $/year for 10 devices. That article claims Saudi Arabia was monitoring 15,000 phones at a average cost of 10,000 $/phone. In [2] it was 7 million $ for 15 devices, but the upfront versus marginal cost per device is not broken down. And this was a relatively "above-board" company in the sense that they were a legitimate business entity with government deals which commands a premium relative to random unknown blackhat organization with no reputation.

And again, my original comment was discussing commercial profit-motivated attackers for which 1 million $ is easily within reach and just a cost of doing business to unlock greater amounts of profit. That is less than the cost of setting up a McDonalds. There is a vast, vast gap spanning factors of millions between Joe Schmo and commercial actors and a even vaster gap to state actors. There is no evidence that Lockdown mode is adequate against even commercial actors, let alone the vastly more capable state actors.

[1] https://prodefence.io/news/pegasus-spyware-operating-costs-c...

[2] https://www.reuters.com/business/media-telecom/meta-suit-aga...

... really? Zero-click RCEs can be used on arbitrarily many phones until they are discovered which usually takes on the order of months. You do not need to burn them on every individual target.

As a example of how they might be used in that fashion for profit, NSO group had a revenue of 240 million dollars in 2020. Many of their customers were governments who wanted to spy on activists and journalists. NSO group was in the business of economies of scale to democratize access to journalist devices by reusing a small stockpile of exploits across many targets with enough revenue to assure a steady stream of new exploits as fast as they were burned.

LARPing is imagining that Lockdown mode protects you from state-level actors. It is frankly baffling why a industry that has been laughing for literal decades at even the possibility of stopping state-level actors just turns around and uncritically believes Apple's marketing team with literally zero support, evidence or proof except for a long track record of failure. You would think that extraordinary claims would demand extraordinary evidence.

We have seen multiple software hacks resulting in >10 million dollar payouts. Apple's bug bounty program only pays out 4 million dollars (2 million dollars (2x) more than non-Lockdown) for a zero-click total compromise that can trivially worm to take down hundreds of millions of iPhones simultaneously. Even at the low end of that cyberattack payout range that is still a >2x ROI if your successful cyberattack depends on a iPhone zero-click, with many publicly known attacks being in the 10x ROI range. Lockdown mode, at best, raises the bar slightly for commercial profit-motivated attackers and reduces their profit margin from wildly profitable to slightly less, but still, wildly profitable.

And of course I am using the Apple bug bounty program as merely a available metric with at least some semblance of objective support. There are zero certifications, audits, or analysis that Apple has even attempted that would confirm any claim of protection against state level actors.

I am absolutely baffled by your response.

I was pointing out how even Apple, a entity who by all rights should have top-notch security, is still absolutely hopeless in the face of commonplace commercial, profit-motivated attackers.

Massive, extremely well-resourced divisions supported by management in a technically competent organization that is actually trying to solve the problem struggle to produce at best middling security that is inadequate against commonplace threats. This is not a prioritization problem; even if you do “everything right” you are still vulnerable to run-of-the-mill commercial attackers. This is a fundamental capability problem, like how we can not make a net positive fusion reactor right now.

It is actually unfair to blame these companies for not having a fusion reactor because they “were not trying hard enough”. Actual security is not a easy problem, and it is a great disservice to portray it as one that is only unsolved due to dunderheads being in charge since it leads to underestimating what actually needs to be done.

That is not to say that you can not do dramatically worse than the “gold standard” and also that most organizations are actually incompetent; but the “gold standard” is still objectively grossly inadequate. You need to be dramatically better than the 4 trillion dollar software company to reach adequate against prevailing threats.

1 Gb/s is only ~100,000 packets/s at standard MTU. You literally get 10 us/packet which is a eternity. Normal fast-path router operation only really needs to consider the header of <100 bytes/packet, so you are getting ~100 ns of compute per byte of considered data and on even a 1 Ghz processor you are getting over 100 instructions per byte of considered data. Failure to achieve a measly 1 Gb/s really says more about those software implementations than it says anything about the impossibility or difficulty of the problem.

That is actually unfair. Most companys spend enormous amounts on security with vast armys of security employees. Not that it is effective, but it is not for lack of resources or trying.

I mean we are literally in a thread about how the 4 trillion dollar company, literally the 3rd most valuable company in the world, with a core competency in software has, yet again, released a core product riddled with security defects for the 50th year in a row.

Commercial IT security is a industry that is incapable to a fault and has, so far, faced basically zero consequences for it.

I made only a claim that there is no evidence that Apple provided encryption is secure, based on the absence of evidence for it. That's a negative claim. Pointing out a standard argument is fallacious is a meaningful contribution.

You appear to have taken umbrage at me pointing out how your claims are unsupported and have already twice attempted to weaponize social norms to quash disagreement instead of presenting a argument.

> "If the only thing that will satisfy you is rolling your own encryption"

You have now made another fallacious argument by painting a strawman and then arguing that strawman is unreasonable and thus I am being unreasonable.

> "Nobody can demonstrably prove the security of Apple’s hardware platform."

You can, in fact, demonstrably prove the security of Apple's platform. I literally presented a uncontroversial criteria in my second response: "You need a competent, unbiased, third-party with demonstrated discriminatory power to support such a claim.". The key element here is demonstrated discriminatory power.

As you have implied that Apple provided encryption is secure against the NSA:

> "I don't see anything on the linked page that supports a conclusion that NSA has successfully broken the encryption at rest of an Apple device's storage since they introduced the secure element."

Please present a party who has previously ruled a system as secure against the NSA and was demonstrated to be correct. Hell, I will even accept it if you can present literally any technically competent executive in Apple who is even willing to claim their system is secure against the NSA, let alone actually proving it. If even Apple will not claim it, then there is no hope it is accidentally better than that as claimed by ignorant outsiders.

You will most likely then claim that the standard, which you yourself implied, is unreasonable as it has never been done. Which is, again, utterly false on multiple counts. First, standards drawn from objective criteria for success (e.g. secure against specific threats) are the gold standard of standards. Second, it has been done before, you are just ignorant of it.

The Common Criteria SKPP standard required NSA penetration tests until the NSA was satisfied that no defects would be discovered. The Common Criteria EAL7 standard requires a formal hardware specification with formal proofs of correctness, a standard generally believed to be "secure" and which I would accept if it covered the entirety of the hardware/software system. Absent that you need empirical demonstrations that specific security implementation choices consistently, empirically, and discriminatorily achieve the desired objective criteria for success.

Apple has done certifications, which they proudly present on their security page [1], to the absolute lowest levels of security you can even certify to. A level only fit for products where [2]: "some confidence in the correct operation is required, but the threats to security are not viewed as serious" which does not even require "demonstrating resistance to penetration attackers with a basic attack potential" [3]. A real vote of confidence in their implementations.

[1] https://support.apple.com/en-us/103027

[2] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 14

[3] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 16

We had secure cybersecurity? When?

I mean, there is some in the high assurance space, but that has never trickled into the broader consumer sphere. Are you referencing those systems? I am unaware of anything else.

Ah yes, you are arguing that you should continue to use vendor provided encryption because, by your own admission that you are making no positive claims, there is no positive evidence of its security or fitness for purpose.

> the fact that it's tied to a hardware secure element makes it pretty strong

Is that also a negative claim of some sort? Maybe if you say “not not pretty strong” you can randomly declare it a negative claim because it has the word “not” in it.

An argument consisting of only negative claims is not evidence for any position. As you have put forward a position, or at least implied one, you are either making unsupported positive claims or fallaciously attempting to use negative claims as support.

Present evidence of your claims of fitness for purpose in this security landscape. That is not some sort of a inherent birthright and must be demonstrated before being claimed. Otherwise you should provide no statement in favor of their usage as you have.

That is not how the burden of proof works. You have the burden to demonstrate your extraordinary claim of security adequate to stop the NSA, a claim that flies in the face of the overwhelming prevailing trend of insecurity both in the industry and Apple in particular.

Your claim has been made without evidence. It can be dismissed without evidence. And that is ignoring the fact that it is a claim actually made against the evidence, both ambient and particular.

And no, Apple marketing does not qualify as evidence. You need a competent, unbiased, third-party with demonstrated discriminatory power to support such a claim.

Ah yes, the bizarro world where systems are normally unhackable so the default assumption is impenetrable security and you need to prove they are insecure.

Thank god this is not the world where things get hacked all the time and where any claim of meaningful security is a extraordinary claim that demands extraordinary evidence and proof before credibly asserting it, but everybody just ignores that part and just pinky promises it and everybody just believes them for the 104th time without evidence.

I engineer and design network device drivers and network protocol stacks.

NAT is a terrible network protocol. The correct protocol would have been a DHCP extension giving you a 49-bit address where your IPv4 address constitutes a /32 with a 17-bit unique local address.

1. IPv6 does have NAT [1], NAT66.

2. NAT is totally orthogonal to IP and addressing.

3. NAT (as in transparent packet modification to rewrite addresses) is utterly idiotic. Ephemeral, anonymous address allocation with inbound filtering is smart, but transparently rewriting packets to do that is one of the dumbest possible ways prone to horrible compatibility and ossification issues as has been proven empirically.

[1] https://www.ietf.org/archive/id/draft-mrw-nat66-00.html

High bandwidth memory (HBM) can deliver TB/s of memory bandwidth and has completely shattered the memory wall for individual cores/compute elements. The only way for compute to keep up is going wide and parallel as seen in GPUs.

Despite this, massively increased memory bandwidth does not translate to material performance improvements on non-parallel compute tasks because few tasks are actually memory bandwidth bound, instead being memory latency bound.

The best known general solutions for improving memory latency are per-compute element memory caches. Unfortunately, this increases the complexity and size of your compute elements forcing you to reduce the number of compute elements, but a large number of compute elements is the only way to saturate HBM memory bandwidth.

To keep up the best known techniques are either algorithmically batch which allows you to go wide using vector/batch instructions or you go the GPU route with memory latency-hiding parallelism.

"Improved" is a useless word. Is their security now adequate? Is it secure against the run-of-the-mill financially motivated threat actors we see regularly and orchestrating thousands of profitable attacks annually?

We regularly see attacks extorting tens of millions of dollars from major multinationals like Citadel. Is the cost of breaching their systems in excess of ten million dollars (which would net you a nice fat profit against multiple tens of millions extorted)? You get a team of 10 professionals for 1-3 years and you can not breach their systems?

That is the minimum standard of adequate against commonplace, prevailing threats for large multinationals. Even that ignores the fact that major corporations are frequently attacked by state actors, so really the minimum standard for protection against expected threats should include those as well, but I will leave that aside for now since the overwhelming sentiment is that protection against state actors is so utterly hopeless it is not even worth mentioning.

For that matter, can you point to literally any system in the entire world that is positively demonstrated (absence of evidence is not evidence of absence) to have reached that standard?

You can still do better by not doing any TSC to nanosecond conversion. Instead, you inject clock adjustments into your log stream allowing you to convert when you decode the logs rather than when you generate the logs.

Using the final version, you would just make the cache refresh() function emit the clock adjustment log entry instead of actually caching anything. Then, any later log entry TSC would implicitly be relative to that clock adjustment log entry when you decode the log. Worst case you would need to persist every clock adjustment entry even when sampling, but that would still only be on the order of a few KB/s at worst and you could still drop entrys with no non-clock adjustment entrys between them.

You are totally right. In accordance with the Tesla Referral Program contract a estimated ~250,000,000 $ in sales were referred to Tesla by major referrers earning those major referrers ~80 free Tesla Roadsters [1], announced as a 250,000 $ value and used a explicit contractual incentive to the program, in accordance with that legal contract. Having engaged in work on behalf of Tesla on the contractual guarantee of compensation and having earned that compensation in accordance with the contract, Tesla legally owes those fans ~20,000,000 $ in aggregate which it has so far rejected compensating for nearly 7 years.

I am not sure what term you use for having people work on your behalf according to the terms of a contract and then not paying the agreed upon compensation, but "theft" or "steal" would be the colloquial term. Only the intentionally biased would claim a trillion dollar company not paying fans for their work in accordance with their own contract is not "stealing" in common parlance.

I am sorry I was downplaying Tesla's bad behavior by just highlighting that individual fans were jilted out of hundreds of thousands of dollars of their work instead of pointing out how they screwed hundreds of their most loyal fans out of tens of millions of dollars of earned compensation. Anything other than praise for such a upstanding company is unwarranted and smearing their victims is the only unbiased move.

[1] https://electrek.co/2019/01/17/tesla-roadster-free-killed-re...

I find it funny how stealing 500,000 $ from a fan is a "debacle". In most places that would be considered a felony instead of a justification to smear the victim and call them a whiner.