<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: What do you mean I forgot the security?</title>
	<atom:link href="http://www.chaosprg.com/blog/2009/02/what-do-you-mean-i-forgot-the-security/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.chaosprg.com/blog/2009/02/what-do-you-mean-i-forgot-the-security/</link>
	<description>Without creativity, the universe would just be columns of numbers.</description>
	<lastBuildDate>Sun, 05 Sep 2010 12:51:58 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=abc</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: irv</title>
		<link>http://www.chaosprg.com/blog/2009/02/what-do-you-mean-i-forgot-the-security/comment-page-1/#comment-16</link>
		<dc:creator>irv</dc:creator>
		<pubDate>Tue, 17 Feb 2009 16:01:16 +0000</pubDate>
		<guid isPermaLink="false">http://www.chaosprg.com/blog/?p=88#comment-16</guid>
		<description>Galileo studied gravity by rolling ball bearings down an incline (IIRC). That&#039;s called an experiment. That&#039;s part of scientific method. There&#039;s no myth in scientific method. Sure, insight is essential but then you have to develop some way of testing it or its not insight, just a guess. 

Einstein had the insight that perspective was relative years before he worked out the equations for relativity. He also had the insight that Heisenberg&#039;s uncertainty principle was silly and wasted years trying to prove it. It turns out he was wrong on that one. Solid math beats mere insight every time.

The real myth is that convincing the &quot;scientific community&quot; has anything to do with science. Your example of super string theory is a good one there. The community is convinced that super string theory will explain everything. They have no evidence to support this but they chase it anyway. Why? Because there&#039;s more money to be made in very complex math than in comparatively simple math. And because it&#039;s pretty (if you have the kind of mind that thinks math can be beautiful, anyway).

Entrail reading at its finest! Some day it may actually yield meaningful results. The fact that it hasn&#039;t yet tells me that there&#039;s probably (not definitely, but I think the probability is high) something wrong with the underlying assumptions. Dead ends are a part of science too. But the important part - the part that is hard even for an Einstein - is recognizing when you&#039;ve hit a dead end and being creative enough to think of something else to try.</description>
		<content:encoded><![CDATA[<p>Galileo studied gravity by rolling ball bearings down an incline (IIRC). That&#8217;s called an experiment. That&#8217;s part of scientific method. There&#8217;s no myth in scientific method. Sure, insight is essential but then you have to develop some way of testing it or its not insight, just a guess. </p>
<p>Einstein had the insight that perspective was relative years before he worked out the equations for relativity. He also had the insight that Heisenberg&#8217;s uncertainty principle was silly and wasted years trying to prove it. It turns out he was wrong on that one. Solid math beats mere insight every time.</p>
<p>The real myth is that convincing the &#8220;scientific community&#8221; has anything to do with science. Your example of super string theory is a good one there. The community is convinced that super string theory will explain everything. They have no evidence to support this but they chase it anyway. Why? Because there&#8217;s more money to be made in very complex math than in comparatively simple math. And because it&#8217;s pretty (if you have the kind of mind that thinks math can be beautiful, anyway).</p>
<p>Entrail reading at its finest! Some day it may actually yield meaningful results. The fact that it hasn&#8217;t yet tells me that there&#8217;s probably (not definitely, but I think the probability is high) something wrong with the underlying assumptions. Dead ends are a part of science too. But the important part &#8211; the part that is hard even for an Einstein &#8211; is recognizing when you&#8217;ve hit a dead end and being creative enough to think of something else to try.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Venkat</title>
		<link>http://www.chaosprg.com/blog/2009/02/what-do-you-mean-i-forgot-the-security/comment-page-1/#comment-15</link>
		<dc:creator>Venkat</dc:creator>
		<pubDate>Tue, 17 Feb 2009 14:02:03 +0000</pubDate>
		<guid isPermaLink="false">http://www.chaosprg.com/blog/?p=88#comment-15</guid>
		<description>Ah see, you&#039;ve bought into the big myth. Feyerabend&#039;s big contribution was to actually go back and look at how Galileo, Kepler and others actually worked. Rather than being great examples of the &#039;scientific method&#039; they were paragons of bumming around just figuring stuff out anyhow. How you *prove* things to a scientific community is where method comes in, not how you discover it. If you actually look at the processes of big name scientists who achieved a lot, most of them were operating by methods that look no better than entrail-reading... following their nose.

Where they left entrail reading behind is in what they did after stumbling on a key insight of course.

That said though, there is also a bigger effect of science itself becoming something of an entrail-reading religion that delegitimizes other ways of knowing. 

The shoulders of a giant thing doesn&#039;t necessarily conflict... IMHO Newton was actually smarter than Galileo and Kepler, that&#039;s why he was able to climb up there. False humility. Einstein was more of a shallow-eyeball bug fixer whose big claim to fame is not smarts but courage to &#039;see&#039; differently. 

But entropy and complexity accumulate, and in physics, you are now at a point where superstring theory has become something of an unfalsifiable and arcane religion unto itself that you need 10 years of grad school to even learn how to critique (http://www.ribbonfarm.com/2007/07/04/book-reviews-the-trouble-with-physics-not-even-wrong/). By contrast, the basics of relativity take only high school math. So the bar is slowly rising to &#039;top&#039; the last big achievement. It COULD be that physics is already at the human limit, and superstring theory is the final buggy religion that nobody can improve on.

As for friendly AI, yeah, emotions are a a fast-track control mechanism, as us control engineers have been saying for 50 years, and AI people found out only about 10 years ago (the field is called &#039;affective&#039; computing...). But Yudkowsky takes a more axiomatic, Asimov&#039;s laws of robotics type approach I think.</description>
		<content:encoded><![CDATA[<p>Ah see, you&#8217;ve bought into the big myth. Feyerabend&#8217;s big contribution was to actually go back and look at how Galileo, Kepler and others actually worked. Rather than being great examples of the &#8217;scientific method&#8217; they were paragons of bumming around just figuring stuff out anyhow. How you *prove* things to a scientific community is where method comes in, not how you discover it. If you actually look at the processes of big name scientists who achieved a lot, most of them were operating by methods that look no better than entrail-reading&#8230; following their nose.</p>
<p>Where they left entrail reading behind is in what they did after stumbling on a key insight of course.</p>
<p>That said though, there is also a bigger effect of science itself becoming something of an entrail-reading religion that delegitimizes other ways of knowing. </p>
<p>The shoulders of a giant thing doesn&#8217;t necessarily conflict&#8230; IMHO Newton was actually smarter than Galileo and Kepler, that&#8217;s why he was able to climb up there. False humility. Einstein was more of a shallow-eyeball bug fixer whose big claim to fame is not smarts but courage to &#8217;see&#8217; differently. </p>
<p>But entropy and complexity accumulate, and in physics, you are now at a point where superstring theory has become something of an unfalsifiable and arcane religion unto itself that you need 10 years of grad school to even learn how to critique (<a href="http://www.ribbonfarm.com/2007/07/04/book-reviews-the-trouble-with-physics-not-even-wrong/" rel="nofollow">http://www.ribbonfarm.com/2007/07/04/book-reviews-the-trouble-with-physics-not-even-wrong/</a>). By contrast, the basics of relativity take only high school math. So the bar is slowly rising to &#8216;top&#8217; the last big achievement. It COULD be that physics is already at the human limit, and superstring theory is the final buggy religion that nobody can improve on.</p>
<p>As for friendly AI, yeah, emotions are a a fast-track control mechanism, as us control engineers have been saying for 50 years, and AI people found out only about 10 years ago (the field is called &#8216;affective&#8217; computing&#8230;). But Yudkowsky takes a more axiomatic, Asimov&#8217;s laws of robotics type approach I think.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: irv</title>
		<link>http://www.chaosprg.com/blog/2009/02/what-do-you-mean-i-forgot-the-security/comment-page-1/#comment-14</link>
		<dc:creator>irv</dc:creator>
		<pubDate>Mon, 16 Feb 2009 01:21:34 +0000</pubDate>
		<guid isPermaLink="false">http://www.chaosprg.com/blog/?p=88#comment-14</guid>
		<description>Remember Newton&#039;s comment about standing on the shoulders of giants? That means that you don&#039;t have to be the smartest guy in the world to produce even more than some other smart guy did. You just need to know how he got to where he did and pick up from there.

That&#039;s science. It&#039;s not &quot;whatever works.&quot; Organized inquiry works better than reading entrails. That&#039;s why reading entrails has mostly fallen in to disfavor (aside from the ickiness factor, I mean). That also leaves out something I vaguely remember hearing about Newton writing that comment in a letter to a hunchback. Apparently, he meant it in a not very nice way. Go figure!

Personally, I think friendly AI is entirely possible, especially once people realize that emotions are not just a drag on logic but also a very effective control mechanism. I LIKE the idea of computers being terrified to hurt humans. I also think it&#039;s very likely that secure AI may be much longer in coming. The prospect of rival Skynets hacking each other is scary.</description>
		<content:encoded><![CDATA[<p>Remember Newton&#8217;s comment about standing on the shoulders of giants? That means that you don&#8217;t have to be the smartest guy in the world to produce even more than some other smart guy did. You just need to know how he got to where he did and pick up from there.</p>
<p>That&#8217;s science. It&#8217;s not &#8220;whatever works.&#8221; Organized inquiry works better than reading entrails. That&#8217;s why reading entrails has mostly fallen in to disfavor (aside from the ickiness factor, I mean). That also leaves out something I vaguely remember hearing about Newton writing that comment in a letter to a hunchback. Apparently, he meant it in a not very nice way. Go figure!</p>
<p>Personally, I think friendly AI is entirely possible, especially once people realize that emotions are not just a drag on logic but also a very effective control mechanism. I LIKE the idea of computers being terrified to hurt humans. I also think it&#8217;s very likely that secure AI may be much longer in coming. The prospect of rival Skynets hacking each other is scary.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Venkat</title>
		<link>http://www.chaosprg.com/blog/2009/02/what-do-you-mean-i-forgot-the-security/comment-page-1/#comment-13</link>
		<dc:creator>Venkat</dc:creator>
		<pubDate>Sun, 15 Feb 2009 23:58:46 +0000</pubDate>
		<guid isPermaLink="false">http://www.chaosprg.com/blog/?p=88#comment-13</guid>
		<description>For an anarchist&#039;s critique of the so-called scientific method, try Paul Feyerabend&#039;s &quot;Against Method.&quot; His basic thesis is that there is no privileged method for getting towards truth, however you define it. Reading tea-leaves or entrails is no more or less justified than the &#039;observation-hypothesis-experiment-theory&#039; process more honored in the breach than the observance. The scientific method is &quot;whatever works.&quot; 

More specifically, is there a science behind security? At one extreme, you could argue that the basics of information theory of the fundamental Shannon variety, has scuttled all hopes for a general theory. The trite idea that &#039;no security system is perfect&#039; actually has a depth probably equal to that of the 2nd law of thermodynamics.

At a slightly more pragmatic level, the entire potential science of security probably rests on the P NP conjecture. There was some mild panic when it was proved that primality testing is P, and then people realized that RSA was still safe, since it relied on factorization rather than primality testing. If it turns out P=NP, entropy, evil and anarchy will win quickly, permanently and decisively.

At the most practical level, I think the science of security rests on the axiom that it takes more brains to fix a bug than it does to code the program in the first place. But exploitation probably does not require smarter-than-original-coder status. Add the idea that bugs and exploits can be discovered accidentally (the &#039;many eyeballs&#039; argument, which is basically a Monte Carlo by a crowd of humans in the space of user experience instances...). Result: a practical argument that there is no fundamental theory of security, only temporary wins in battles, and an assured final win for the Dark Side. Here&#039;s a sorta proof by story.

The apocalyptic scenario is this: the smartest guy in the world, X,  builds an important program. Call it Skynet (any resemblence to entities real or fictional is purely unintended and coincidental). Nobody is smart enough to find exploits by being smarter than X, but somebody _randomly_ does so, thanks to the many-eyeballs effect. He fat-fingers Skynet into a pathological state of &quot;permanent exploithood&quot;, but since X is the smartest guy in the world, nobody can fix it. Or build a smarter system to control it.

So the Society for Information Security gives up its mission and disbands. They go join the anti-Skynet crusade of a guy named (to pick a name at random) John Connor.

In a sense, the &quot;Singularity&quot; theory people of smarter-than-human AI reason this way. Try the blog of Elizier Yudkowsky at the Singularity institute. The guy developed (and believes in the possibility of) something called &quot;friendly AI.&quot; Haven&#039;t yet parsed his idea much, but he thinks you can get to Skynet without it turning rogue.

Alright, enough BS. That&#039;s actually my long-winded excuse for sloppiness and indiscipline :)</description>
		<content:encoded><![CDATA[<p>For an anarchist&#8217;s critique of the so-called scientific method, try Paul Feyerabend&#8217;s &#8220;Against Method.&#8221; His basic thesis is that there is no privileged method for getting towards truth, however you define it. Reading tea-leaves or entrails is no more or less justified than the &#8216;observation-hypothesis-experiment-theory&#8217; process more honored in the breach than the observance. The scientific method is &#8220;whatever works.&#8221; </p>
<p>More specifically, is there a science behind security? At one extreme, you could argue that the basics of information theory of the fundamental Shannon variety, has scuttled all hopes for a general theory. The trite idea that &#8216;no security system is perfect&#8217; actually has a depth probably equal to that of the 2nd law of thermodynamics.</p>
<p>At a slightly more pragmatic level, the entire potential science of security probably rests on the P NP conjecture. There was some mild panic when it was proved that primality testing is P, and then people realized that RSA was still safe, since it relied on factorization rather than primality testing. If it turns out P=NP, entropy, evil and anarchy will win quickly, permanently and decisively.</p>
<p>At the most practical level, I think the science of security rests on the axiom that it takes more brains to fix a bug than it does to code the program in the first place. But exploitation probably does not require smarter-than-original-coder status. Add the idea that bugs and exploits can be discovered accidentally (the &#8216;many eyeballs&#8217; argument, which is basically a Monte Carlo by a crowd of humans in the space of user experience instances&#8230;). Result: a practical argument that there is no fundamental theory of security, only temporary wins in battles, and an assured final win for the Dark Side. Here&#8217;s a sorta proof by story.</p>
<p>The apocalyptic scenario is this: the smartest guy in the world, X,  builds an important program. Call it Skynet (any resemblence to entities real or fictional is purely unintended and coincidental). Nobody is smart enough to find exploits by being smarter than X, but somebody _randomly_ does so, thanks to the many-eyeballs effect. He fat-fingers Skynet into a pathological state of &#8220;permanent exploithood&#8221;, but since X is the smartest guy in the world, nobody can fix it. Or build a smarter system to control it.</p>
<p>So the Society for Information Security gives up its mission and disbands. They go join the anti-Skynet crusade of a guy named (to pick a name at random) John Connor.</p>
<p>In a sense, the &#8220;Singularity&#8221; theory people of smarter-than-human AI reason this way. Try the blog of Elizier Yudkowsky at the Singularity institute. The guy developed (and believes in the possibility of) something called &#8220;friendly AI.&#8221; Haven&#8217;t yet parsed his idea much, but he thinks you can get to Skynet without it turning rogue.</p>
<p>Alright, enough BS. That&#8217;s actually my long-winded excuse for sloppiness and indiscipline <img src='http://www.chaosprg.com/blog/wp-includes/images/smilies/icon_smile.gif' alt=':)' class='wp-smiley' /> </p>
]]></content:encoded>
	</item>
</channel>
</rss>
