Newshot Friday Squid Blogging: New Jurassic Squid Predecessors
News story: “Scientists discover a bizarre Jurassic ‘squid’ unlike anything ever seen.”
Scientists have identified the “fattest” belemnite ever discovered, a bizarre, barrel-shaped squid relative that lived in Wyoming’s ancient seas 160 million years ago. The exceptionally rare fossils reveal a creature unlike anything previously known, potentially a predator of smaller squid-like animals and a surprising survivor of a supposedly vanished family.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy.
Posted on November 6, 2026 at 5:05 PM • 34 Comments
Comments
Clive Robinson • November 6, 2026 7:23 PM
@ Bruce, ALL,
More Apple backdoor censorship?
Apple was in effect the first mobile phone OS developer to put into their OS the foundations of “Client Side Scanning”(CSS) under increasing pressure from US legislators and law enforcement agencies.
Apple received a lot of bad press over it and slid some of it backwards.
Importantly though it emphasised the point that the US Gov had finally accepted the impossibility of NOBUS backdoors in “End to End Encryption”(E2EE) even though it had been repeatedly pointed out by those involved with ICTsec.
Thus the USG move to attack privacy on the other side of the “security end point” via CSS as an “end run attack”.
Something pointed out on this blog back in the very early days of “Secure Messaging Apps” and the weak links in the security chains on consumer and commercial systems.
Hence the argument for taking the “security end point” off the device that is the “communications end point” (and why I gave the basics of the design of how to build a “Deniable Encryption” system on this blog).
Well Apple have a new less obvious nod in the direction of “Client Side Censorship”(CSC).
Investigators have discovered quite deliberate censorship in the user side “autocomplete” text entry system,
Apple’s autocomplete restrictions include ‘Dictator Trump’ and ‘Sleepy Joe,’ researcher finds Apple has an undisclosed multilingual gray list of tens of thousands of words and phrases that its iOS keyboard will not autocomplete or swipe-type, a researcher said on Friday. “The list is not a ban. iPhone users can still type what they like when drafting emails and texts. But the words on the list will not be suggested to users via autocomplete or swipe-typing in most cases. The researcher, Derik Kauffman, said the find opens a window into how Apple manages the tradeoff between anticipating what hundreds of millions of iPhone users are trying to say and preventing the devices from offering offensive or politically charged suggestions to users – something he said could quietly shape how they communicate. “It’s a very light-touch form of censorship,” said Kauffman. “But at the scale that Apple is operating, it only takes a light touch to have a big impact.”“
Apple’s autocomplete restrictions include ‘Dictator Trump’ and ‘Sleepy Joe,’ researcher finds
Apple has an undisclosed multilingual gray list of tens of thousands of words and phrases that its iOS keyboard will not autocomplete or swipe-type, a researcher said on Friday.
“The list is not a ban. iPhone users can still type what they like when drafting emails and texts. But the words on the list will not be suggested to users via autocomplete or swipe-typing in most cases. The researcher, Derik Kauffman, said the find opens a window into how Apple manages the tradeoff between anticipating what hundreds of millions of iPhone users are trying to say and preventing the devices from offering offensive or politically charged suggestions to users – something he said could quietly shape how they communicate.
“It’s a very light-touch form of censorship,” said Kauffman. “But at the scale that Apple is operating, it only takes a light touch to have a big impact.”“
https://www.reuters.com/business/retail-consumer/apples-predictive-text-restrictions-include-dictator-trump-sleepy-joe-researcher-2026-11-06/
Not only is it a first step “light-touch censorship” system, it also opens up fingerprinting users via their typing cadence and word / symantec usage.
cybershow • November 7, 2026 2:18 AM
@Clive re: Apple auto-complete
Complexity is the tyrant’s friend
Apple’s actions remind us that anyone making at-scale technology for use by a significant cohort has the opportunity to exercise subtle soft power and influence. If fully in control of the system and channels, one can delay, discard or distort messages, with plausible deniability. Though scientists spent decades on communications and storage protocols to avoid or correct integrity failure, we see strategic errors nefariously injected at the application layer. These can always be blamed on illegible system behaviours for which no human seems accountable. Indeed this is a ‘feature’ of complex and opaque systems that serve power, and why simple and open systems are resisted.
Apple, with its closed, tightly integrated ecosystem is especially problematic in this regard.
The “perfect” system for the soft censor or manipulator is a demonstrably imperfect one. A fine example is Google’s elaborate and precarious mail delivery system. Its ever-changing and proprietary interpretation of SPF, DKIM, spam scores, and “user defined delivery options” makes it a seemingly non-deterministic beast. However, it’s tedious but amusing to me which messages – to certain people on certain subjects – are prone to mysterious delivery problems whereas others are not. The fact that malfeasance is unfalsifiable even in principle adds another ‘feature’ of gaslighting to the arsenal. One always falls under the accusation/suspicion of paranoia, lack of understanding or making spiteful claims. In such systems there is always a “rational explanation”, albeit one that nobody can name or explain why an error happened on that particular occasion.
It is not until investigative hackers fully reverse engineer and expose the code of these systems that the truth gets out.
Things like LLMs and auto-complete serve to amplify this mischief because we’ve accepted and internalised that Big Tech computer systems may misinterpret, randomly delay, discard or alter our messages. We should help people understand that one of the less well understood problems with all “AI” is that it is an intervention. As interpreter/translator (transformers were developed for mapping problems) it is a potentially defective agent.
Anonymous • November 7, 2026 6:35 AM
- These muscle-reading wearables let you use voice input without speaking a word https://www.media.mit.edu/articles/these-muscle-reading-wearables-let-you-use-voice-input-without-speaking-a-word/
- Project AlterEgo https://www.media.mit.edu/projects/alterego/overview/
“AlterEgo is a non-invasive, wearable, peripheral neural interface that allows humans to converse in natural language with machines, artificial intelligence assistants, services, and other people without any voice—without opening their mouth, and without externally observable movements—simply by articulating words internally. The feedback to the user is given through audio, via bone conduction, without disrupting the user’s usual auditory perception, and making the interface closed-loop. This enables a human-computer interaction that is subjectively experienced as completely internal to the human user—like speaking to one’s self.”
Rontea • November 7, 2026 9:27 AM
From Dave Taylor:
Google announced that it’s changing how schools can restrict access to its AI tools. But, as Google explained to The New York Times, if schools block AI completely, “they will not have access to search” either. Google Search seems like an essential tool in the digital age, regardless of a school’s position on AI. It’s concerning that Google can dictate how schools incorporate AI into their curricula.
freedom • November 7, 2026 12:50 PM
Google Search seems like an essential tool in the digital age,
Does it? t’s a very low quality service that exists to spy on people and feed them propaganda. It can be trivially replaced by a real decentralized search systems.
Also the fact that government schools are accomplices of google, letting google spy on children should be kind of a red flag…
lurker • November 7, 2026 5:13 PM
@Rontea, ALL
“if schools block AI completely, they will not have access to search”
This is bully behaviour we might expect of a monopolist. But surely Google is aware that there are other search engines available. The sad part is that many schools who should know better, are not aware how easy it is to use alternate search.
Clive Robinson • November 7, 2026 7:18 PM
First off, thanks for the “shout out” I suspect @Bruce is likewise pleased with the “hat-tip”.
With regards,
“It is not until investigative hackers fully reverse engineer and expose the code of these systems that the truth gets out.”
I’m of the view that,
1, Just observing malfeasance in EMail etc is enough to go into full on avoidance mode (it’s why I don’t personally “do email” or similar).
The reason, “Because waiting on the ‘never never’ of “reverse engineering” for proof can do you a great deal of harm in the meantime.
2, All communications channels have redundancy to transfer information. Anywhere there is redundancy you can open up a channel within a channel[1].
3, Where there is redundancy you can make what appears random look like innocent plain text. Thus you can use the “observer problem” to your advantage.
Hence “Deniable encryption” that has Shannon “Perfect Secrecy” via “all messages are equiprobable” can give you a covert channel inside “What is to an observer a plaintext message” that also has other useful properties / features.
4, You should always take the “security end point” and UI off of the device with the “communications end point”
Because with a little thought it kills “Client Side Scanning” and with care gets around “soft-censorship”.
Interestingly “deniable encryption” is something you can get an LLM System to do…
Which is proof enough that guardrails at an LLMs input and output will always be subject to being bypassed thus fail… And by extension any LLM Agent in a “sandbox” that still has external communications will be insecure at best thus fail.
At some point within the next decade I suspect most people will have caught up with this information.
And as we saw with the end of the “war on E2EE” which triggered the push for “Client Side Scanning”. CSS will likewise be over for those who prefer to excercise both caution and care over convenience.
Thus it’s time to start thinking about the next battle within the war of “peoples right to privacy” v “authoritarians you have no rights”.
Sometimes you have to apprentice as a Poacher to become a good Gamekeeper[2]…
[1] See the papers of Claude Shannon and Gustav Simmons for the proofs.
[2] This Poacher to Gamekeeper transition is something the less than bright managers towards the top of large companies have yet to wake upto with regards AI. As many in the software game know unless you are a lot smarter than AI then the result of using AI to produce code will be,
“Well over priced AI slop”
Thus the question will arise fairly soon of,
“Where do we get smart people?”
The answer that most senior managers do not want to hear is,
“By training them up for 20,000 hours.”
For which people will expect decent renumeration befitting skills that few others will ever acquire.
And No “Current AI LLM and ML System” will even get close to those required skill levels no matter how the Altman and Amodei types, their genuflecting employes and servile shills spout otherwise.
Ismar • November 8, 2026 1:11 AM
I feel like i should say something here even if it might not resonate with most of the readers. Namely, the reason why companies like Google and OpenAI run the most of the world today is not because they are right or wrong per say but because they have taken the risk and put time and effort into being first in their field pushing for services they think people will want to use and also as much effort in convincing people they need to use them. Us , here, on the other hand, are not ready to take the same risks in providing alternatives going no further than pointing out all the shortcomings of the ‘easy’ ones.
Apokrif • November 8, 2026 2:59 AM
https://arstechnica.com/security/2026/11/british-soldier-ignored-order-to-pull-his-sim-card-then-got-blackmailed/
“An Estonian newspaper recently revealed that a British soldier disobeyed a direct order to remove the SIM card from his cellphone before being deployed to a part of Estonia, approximately 90 miles west of the Russian border.
As a result of his refusal to engage in this element of operational security (opsec), the soldier, Daniel Barton-Kennedy, had his phone hacked, and nude photos of himself were stolen and used as blackmail against him”
KY • November 8, 2026 9:35 AM
Google Search seems like an essential tool in the digital age
Is it? It’s shite, it’s heavily censored and it has been declining in quality for at least a decade now.
I don’t know if it’s el goog’s intentional policy though.
Clive Robinson • November 8, 2026 12:09 PM
With regards the ARS story you might want to know about,
https://www.iclr.co.uk/document/2026009098/2026ewcacrim1228_TNA/html
The soldier was found guilty at level 1A which starts at a 12month imprisonment and goes upwards from there and this is what the sentence handed out by the Court Martial despite mitigating circumstances.
The appeal basically gave a “two finger salute” before “rubber stamping” the court martial sentencing.
Now look the other way…
You will see the 1A Level is not actually about the “offence” but the “potential harms” that might arise.
Think on that for a moment, befor considering,
1, The behaviour of the court martial and appeals judges has been the expected “might is right” and “justice must be seen to be done” nonsense.
2, The behaviour of these courts has now made very public the Who, What, When of the events along with identifying other forces personnel and their roles to the world.
3, Thus those who hacked the phone now have information available from the courts that they probably did not have before.
4, Now think about that in terms of “harms committed”, they meet or exceed the Level 1A threshold and that of the original offense.
So now considering the imbalance in the harms the courts have committed, what punishment do you think should be handed down to them?
There is an old saying that many know but bares repeating,
“Military Intelligence is an oxymoron.”
https://quoteinvestigator.com/2013/10/02/oxymoron-intelligence/
With the original source appearing “authorative” on the matter…
Clive Robinson • November 8, 2026 1:17 PM
@ Cavin, ALL,
With regards your gentle humour of,
Stop wasting our time by constantly directing our attention to things we can’t control.”
I should note for @ALL whilst there is much in life we feel we “can’t control” the reality is,
“We should at least take steps to minimise how we are impacted, where we can.”
Hence in our ordinary lives we acquire when we can, home and vehicle insurance as well as pensions, life insurance, and even medical insurance… Mostly on the hope they will “pay up” if and when needed.
The thing is we only get them because “we’ve been made aware” of what can happen.
And that is why I mention much of what I have done over the years.
Which is why I was one of the first to advise “turn off Flash and JavaScript” and why I haven’t had “Personal Email” for a very long time, and never had “Social Media” accounts. Also why I advise against Secure Messaging Apps and the likes of Tor.
Yes they have advantages but the flip side is they all have harms as well, and “being aware” can help avoid the potential pain.
Whilst my observations and suggestions has upset many people over the years, it looks like many more are now following the increasingly beaten trail…
But it’s also why where I can, I normally try to offer alternatives or mitigations with better OpSec much greater Privacy / confidentiality, if unfortunately they are “less convenient”.
Convenience is I think the biggest danger to the ordinary person currently. And why many criminals and worse take advantage of it.
Some see “convenience” as a way to,
1, Externalise cost. 2, Externalise risk. 3, Avoid legal obligations. 4, Apply unlawful surveillance to all.
All for their profit / benefit at your expense at least twice over.
And the advent of Current AI LLM and ML Systems just makes it all worse much much worse…
Whilst I can not stop the criminals and worse doing what they do, I can encourage people to make it less easy for them thus hopefully less profitable.
lurker • November 8, 2026 2:00 PM
The MAGA footgun fires again: new FCC Rules ban foreign testing labs (mostly Chinese) from certifying equipment for the US market. This will increase costs and time to market for imported equipment, dragging it up to US levels of inefficiency.
Under US rules, all electronic devices that emit radio frequencies must be certified by an FCC-recognized lab before they can be sold in the American market. As of September 8, China had 175 FCC-recognized labs, more than the number of testing labs in the US, and handled about 75% of FCC-recognized testing, according to China’s STDaily.com.
https://asiatimes.com/2026/10/fcc-product-testing-ban-deepens-us-china-tech-decoupling/
Joseph Kanowitz • November 8, 2026 4:43 PM
For whatever Great Firewall state propping up of the simulation of this industry is left, the arms race has become the RAT race for more than five years now, yet all we’ve got is warm freezers in France reminding them they’re “spoiled” children paying off Catholic farmers to restock, and nobody’s bumping this on the PA system at their cheese warehouses: https://youtu.be/FTEoGK1omug
Lame future. Let me know when Disney-Pixar’s “RAT: a to e” hits documents as badly as Xerox did twenty years ago.
freedom • November 8, 2026 9:48 PM
the reason why companies like Google and OpenAI run the most of the world today is not because they are right or wrong per say but because they have taken the risk and put time and effort
those “companies” are criminal organizations and simply proxies of the U.S. government. Those criminal organizations are just parts of the global police-surveillance state run by the U.S. That’s why the “run” the world.
freedom • November 8, 2026 10:05 PM
new FCC Rules ban foreign testing labs (mostly Chinese)
Well, you know, the U.S. is the supreme champion of “free trade” as long as they monopolize all trade.
Clive Robinson • November 8, 2026 10:34 PM
@ lurker, ALL,
With regards the FCC and testing radio equipment it’s actually quit involved.
Officially the party line is about “reciprocal testing” but the reality is the Executive has designated much communications equipment such that it can not be “Exported to China” (kind of like the GPU issue).
So there are no US companies wanting to export to China because they are not allowed to do so. Which means no US company wants to have equipment tested to China’s standards. So there is no requirement for reciprocal testing…
Thus the executive can claim a bunch of nonsense.
But it gets more interesting the FCC want all Chinese comms equipment to be “specific to part” not “general to many parts”
So GMRS equipment has to be specific to the part regulations for GMRS and tested as such. Even though identical electronics will do GMRS, PMR, and Ham bands without circuit modification (just change a file contents used by the software). Similar applies to FRS etc.
But the FCC is talking about having any change require “full certification testing” even if it’s not electrical / electronic just a change of knob design or case colour etc.
They are even talking about changing requirements so that you can not have common fitting removable batteries, so all cases have to be different… As well as requiring antenna connectors that are Copyright to US Corps and that can not be made outside of the US or for that matter sold into China.
The thing is that the result will not bring manufacturing of radio communications equipment “back to the US” as the market is not there. Because few people would pay well over the odds for what will be substandard limited capability equipment, compared to what is made in what the US calls “Asia” and most others call the Far East.
The problem the FCC has at the moment is that of the commission seats, there is only one Democrat and they are in effect end of term. Brendan Carr is pushing to make all seats Republican. The legality of which has been called into question,
‘https://broadbandbreakfast.com/wyden-an-all-gop-fcc-would-be-unlawful/
How it will pan out on the “lame duck exit” in the two houses prior to January will prove interesting,
‘https://broadbandbreakfast.com/democratic-congress-could-put-new-pressure-on-fcc-chairman-brendan-carr/
Speaking of illegal / unlawful Brendan Carr was bring his position into disrepute yet again,
‘https://broadbandbreakfast.com/rachel-goodman-baseless-election-interference-threats-from-the-fcc/
lurker • November 9, 2026 12:50 AM
@Clive Robinson, ALL
I started to read the FCC documents, and my eyes glazed over. It seems like the US has forgotten how to make anything except laws, and not very good laws at that. Some sources say that 82% of all “FCC approved” devices last year were approved by labs in China. What were they smoking when they decided the US, or Elbonia, or who would be able to pick up that work and run with it, inside 12 months?
https://www.techspot.com/news/114169-fcc-plans-force-electronics-testing-out-china-2028.html
And the week before, another ruling now bans the import to US of any device which contains a “logic bearing hardware component” made by any one of five Chinese chip makers. I haven’t yet got to the bottom of who (Huawei, ZTE, and 3 others) and how this will affect the mighty US automotive market, or internet connected toasters …
https://www.techtimes.com/articles/328987/20261014/fcc-rule-takes-effect-huawei-zte-chips-now-block-devices-us-authorization.htm
The isolationist policy continues in WC Docket No. 26-82 which threatens to remove the US from any communications system which is also used by several named Chinese entities.
ResearcherZero • November 9, 2026 12:50 AM
Even the CEO of Nvidia has trouble controlling his impulses.
While it may be difficult to take responsibility for your own actions, and you may even perhaps believe that your own behaviors are outside of your control, preparation, planning and a discipline will reduce the risk of exposure and compromise. What is, and what is not outside of one’s control, can be a choice if reasonable steps are taken to minimize the risks, rather than defer daily routines and responsibilities to the domains of convenience and denial.
Convenience and denial are commonly referred to as a “failure of imagination” in the political vernacular. Another known phrase, “not giving a s–t,” or the synonyms, stone-deaf, aloof, nonchalant, apathetic, disinterested, unconcerned, careless and complacent, may better describe attitudes which often lead to preventable harm and security failures.
Nvidia has decided to investigate if its CEO is the target of Chinese intelligence.
https://www.theregister.com/legal/2026/11/09/nvidia-ceo-jensen-huang-starring-in-possible-remake-of-the-spy-who-shagged-me/5308327
ResearcherZero • November 9, 2026 3:23 AM
A generation failed by society, policy, industry and institutions, without direction or any sense of security, acceptance and understanding. Essentially abandoned and unsupported.
There are some who are willing to offer a sense of certainty and belonging.
Adolescents experience a period of seeking out absolute certainty. This can expose them to dubious sources of information that offer certainty. The prefrontal cortex matures more slowly than the emotional center of the brain. This part of the brain governs impulse control and rational judgement.
As the emotional center develops more rapidly, with rational judgement and impulse control lagging behind, young people can be targeted by those experienced in exploiting these vulnerabilities. The radicalization process takes place over a long time, hijacking feelings of injustice, uncertainty and the belief of a threat facing the social group that the targeted individual belongs to. Recruiters work from a tried and tested handbook, ensnaring victims to drive them towards self-destruction.
Those who experience abuse and neglect during childhood are at greater risk of radicalization. The advent of social media and a fractured information environment, combined with a rapidly transforming society and economic upheaval, created a “perfect storm” in which large numbers of disaffected and disconnected youth are facing very significant risks. Dissatisfaction with institutions and political polices further adds fuel to the fire.
“the underlying factors pushing young people towards radicalization are are virtually identical, regardless of whether the ideology in question is Islamist, Christianist, left-wing, or right-wing.”
‘https://theins.press/en/politics/299189
There are millions of young people who face the risk of exploitation and radicalization. https://www.rand.org/pubs/perspectives/PEA4207-1.html
Anonymous • November 9, 2026 3:51 AM
Even the CEO of Nvidia has trouble controlling his impulses.
Google “Fang Fang” for semi-related information.
StephenM • November 9, 2026 5:57 AM
https://www.theguardian.com/commentisfree/2026/nov/09/british-people-palantir-nhs-health-data-us-tech-firm
“British people don’t trust Palantir – it’s not too late to reverse the NHS’s dependence on it”
lurker • November 9, 2026 11:15 AM
@StephenM “It won’t be easy, but next spring the job of clawing it back must begin”
Oh dear. The innocents believe that Palantir knows and respects the right to be forgotten.
Clive Robinson • November 9, 2026 12:37 PM
@ StephenM, lurker, ALL,
With regards Palantir and the NHS.
I’ve made comment before about Palantir and it’s,
“Pushing drugs at the school gate”
Style business practices.
The NHS records are supposed to be “siloed” from all other UK Central and local Government agencies / entities and any commercial organisation. As they are “special category”. That is they are treated as “confidential” or higher equivalent in secret “documentation classification” terms.
Well it turns out the part of the UK Gov that deals with pensions apparently has access to the data and has been handing it over to commercial organisations, who have then handed it on to others…
So the data is not siloed at all, and “scam phone calls” etc have resulted with people working for companies pretending they are employees by the Gov Dept and demanding bank and other financial details as “authentication”.
So whilst I’m sure some tell such people to take a flying one at themselves I also suspect some get scammed this way.
Which might account for why the UK has the highest scammed rates per head of those in or over their 60’s in the Western world…
Clive Robinson • November 9, 2026 1:14 PM
@ ResearcherZero, ALL,
With regards adolescents and your observation that they are in effect “cast adrift” thus easy prey for,
“There are some who are willing to offer a sense of certainty and belonging.”
It’s actually worse than most realise…
Back at the begining of this century there was terrorists arising from the Middle East. The reasons why there was and still is such terrorism can be laid fair and square at the doors of the US State Dept and those setting policy even against the directions of the US Executive and of other US politicians having a majority in one of the houses…
But the big issue on the ground was and still is in the area the “Strongly patriarchal society” in nearly everything not basic domestic.
The problem with this is that adolescents are “told what to do” in nearly all aspects of their lives, thus they do not develop “a moral compass”.
Which means when they move out of the homeland for education or as refugees etc they are in no way prepared for living equitably in the society they find themselves in.
The results can be disastrous as the UK has found the hard way. But if I say almost anything, I would be the one ending up in prison or dead.
The problem I in part identified back in the 1990’s is that adolescent males in education away from their patriarchal influence were easily recruited for many anti-social activities…
Not just cult like religion but all sorts of criminal activities including preying on girls and young women that were socially disadvantaged.
Both main political parties in the UK have been either in denial or just look the other way and ignore it mentality. The result is fringe political groups have gained much mileage from “stirring it up” and in some cases been strongly financed by the likes of those behind the US GOP…
So the issue is UK politicians have allowed a situation to arise that they could and should have prevented twenty to thirty years ago. But they chose for various “political milage” reasons not to. Now the situation is out of control unless certain types of very draconian measures are not just considered but put into place…
lurker • November 10, 2026 1:11 AM
Attribution is hsrd
but not if you’re French: Iran melted their fridges (set fire to a few), and CERT-FR has isued a report on it.
https://lanouvelletribune.info/2026/11/la-france-accuse-liran-davoir-sabote-les-frigos-de-700-supermarches/
ResearcherZero • November 10, 2026 1:17 AM
@Clive Robinson
At least The Lost Generation had World War I to look forward to.
Get-AppxPackage Paint -AllUsers| Remove-AppPackage –AllUsers -verbose
https://windowsreport.com/microsoft-paint-security-flaw-could-let-hackers-execute-malicious-code-but-the-fix-is-hard-to-find/
ResearcherZero • November 10, 2026 1:29 AM
Poor security practices by an Australian automotive firm left vehicles remotely accessible.
https://shubs.io/unlocking-any-car-from-x-brand-in-most-of-the-world/
The mobile apps used by the unnamed automakers had some serious problems. https://samcurry.net/forgerock
Andy • November 10, 2026 9:04 AM
Formal proof of algorithm correctness should be of significant interest to @Bruce, particularly given the example they pose. Proving the security of a cryptographic algorithm is a big deal. I recall attempts to do this with avionics code back in the 1990’s with only modest success.
Clive Robinson • November 11, 2026 3:06 PM
@ Bruce, ALL,
The softer the science the more goats need to be sacrificed
People might have noticed two things of recent times,
1, More and more Soft science papers are being withdrawn or recanted. 2, Increasing numbers of Soft Science papers have no or massaged data, or the data is not believable.
It’s caused a bit of an outcry with paper authors blaming each other or saying they did not have involvement in the collection or analysis of the data.
The obvious question is,
“Why is this happening?”
It looks like the answer with soft science is it’s always been happening and the research money has payed people when publishing does not but does mean more grants come your way… The so called,
“Publish or Perish conundrum”
That has given rise to a sausage machine by which journals used to make a lot of money (the likes of Anna’s Archive and Sci-Hub are killing that and some journals are “watermarking” to track down contributers).
But why “Goat Sacrifice” well think of “reading the entrails” etc. This is once how humans “supposedly made decisions”…
A fun blog post on this,
We need more goat sacrifices OR: OJ A-OK “Before anybody enacts a major social policy or launches any philanthropic programs, they should sacrifice a goat. There ought to be an entire liturgy of grotesqueries, in fact—pricked fingers, names written in blood, robes, candles, chanting, obsidian blades, still-beating hearts, the whole shebang. The point of this ritual is not to signal our obeisance to the gods (although if any of them want to stop by and help us out, that would be cool), but to remind ourselves that we know nothing. This is procedurally-induced humility, which is desperately necessary, because an alarming number of our best-intentioned interventions do not work.“
We need more goat sacrifices
“Before anybody enacts a major social policy or launches any philanthropic programs, they should sacrifice a goat. There ought to be an entire liturgy of grotesqueries, in fact—pricked fingers, names written in blood, robes, candles, chanting, obsidian blades, still-beating hearts, the whole shebang.
The point of this ritual is not to signal our obeisance to the gods (although if any of them want to stop by and help us out, that would be cool), but to remind ourselves that we know nothing. This is procedurally-induced humility, which is desperately necessary, because an alarming number of our best-intentioned interventions do not work.“
https://www.experimental-history.com/p/we-need-more-goat-sacrifices
The point is a vast amount of money is being wasted and worse public policy gets based on this factless waste of resources and potentially delusion or fantasy…
Clive Robinson • November 11, 2026 11:52 PM
@ Bruce, ALL,
Hot in off the press…
eMudhra gives story about why ‘4 was a Magic Number
And apparantly it was all due to being only able to take one byte to chew on…
Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates Couldn’t get the hardware it needed to generate certs, so tried to code a workaround “Former certification authority eMudhra has claimed a buggy Python script is the main reason it issued laughably insecure digital certificates. … eMudhra aimed to create eight ECDSA P-384 private keys which should have been 48 bytes long. But the script contained what Kumar described as “a bug/defect in the import code [which] resulted in a read‑back from the unwrapped object that truncated the private value, so the certified public keys correspond to private scalars below the expected range and are recoverable from public information.” The truncation is the key problem here, because it appears that eMudhra ignored 47 of the 48 bytes, producing its infamously insecure single-byte keys such as the number four.“
Disgraced former CA eMudhra blames buggy script for hopelessly weak certificates
Couldn’t get the hardware it needed to generate certs, so tried to code a workaround
“Former certification authority eMudhra has claimed a buggy Python script is the main reason it issued laughably insecure digital certificates.
eMudhra aimed to create eight ECDSA P-384 private keys which should have been 48 bytes long. But the script contained what Kumar described as “a bug/defect in the import code [which] resulted in a read‑back from the unwrapped object that truncated the private value, so the certified public keys correspond to private scalars below the expected range and are recoverable from public information.”
The truncation is the key problem here, because it appears that eMudhra ignored 47 of the 48 bytes, producing its infamously insecure single-byte keys such as the number four.“
https://www.theregister.com/security/2026/11/12/disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates/5309244
“That as they say explains that!”
Or not if you are of a more questioning nature…
ResearcherZero • November 12, 2026 12:25 AM
@Clive Robinson
Why bother using HSMs at all if you can just knock up a script and do it in memory? What could possible go wrong with the insecure transfer of certificate authority keys using a script that was not checked to see if it performed the desired function correctly, and stored private keys in the memory of what ever systems they were using to transfer keys.
HSMs are designed to generate and store cryptographic keys without exposing them outside the hardware, but you can’t do that without the hardware security modules themselves.
It is very reassuring to know that a certificate authority does not even require the necessary hardware on-site before it begins operation. Even the largest certificate authorities leave systems exposed to the public internet when they are reconfiguring their networks, and oops the server containing customer details is no longer behind the VPN.
How exactly eMudhra transferred “private” keys to these other firms is an open question. Maybe just popped them in an email as an attachment, and mailed them perhaps? Why not?
Dear HSM manufacturer,
Here are your new keys in the attachment below.
Yours sincerely,
Jon Doe, Head of Security – eMudhra
Segmentation, or redundancy in internal auditing and processes be damned. Just wing it. 😉
Clive Robinson • November 12, 2026 4:50 AM
@ ResearcherZero,
Yup and I can think of other security issues.
On first reading it my first thought was kind of,
“How long did it take them to knock up this nonsense…”
So yup the truth real story would be nice 😉
Clive Robinson • November 12, 2026 5:48 AM
@ Bruce, ALL,
Criticale RCE found in Apache
Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know Detect and mitigate CVE-2026-119618, a critical RCE vulnerability in Apache HTTP Server. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618. Immediate patching is advised. “A critical synchronization vulnerability (CVE-2026-119618) has been identified in Apache HTTP Server’s HTTP/2 module (mod_http2). The flaw stems from a concurrent execution race condition within the assign_headers() function when handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution (RCE).“
Critical RCE Vulnerability in Apache HTTP Server: Everything You Need To Know
Detect and mitigate CVE-2026-119618, a critical RCE vulnerability in Apache HTTP Server. According to Wiz data, 64% of cloud environments have resources vulnerable to CVE-2026-119618. Immediate patching is advised.
“A critical synchronization vulnerability (CVE-2026-119618) has been identified in Apache HTTP Server’s HTTP/2 module (mod_http2). The flaw stems from a concurrent execution race condition within the assign_headers() function when handling shared resources. If successfully exploited, a remote, unauthenticated attacker can corrupt heap memory to achieve arbitrary code execution (RCE).“
https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability
Apparently according to Wiz,
“As of the time of this blog’s publication, no exploit is available and there are no reports of exploitation in the wild. “
The question in this LLM age is,
“How long before there is?..”
It’s a subject that came up the other day as part of a discussion about “accidental disclosure” of vulnerabilities.
The answer to the question was another question,
“How long to type up as an input to an AI Agent?”
As you can probably guess in this case of CVE-2026-119618 it was found by using a “Frontier AI” LLM.
Two things to note,
Firstly, the vulnerability had been “hanging around for some time”. In effect just waiting for it to be found.
Secondly, note the magnitude of this years CVE numbers count so far… It’s likely to be up around 145,000 or more by year end.
There are now so many vulnerabilities being found –over 400/day– that it is now nolonger possible for individuals or even medium sized organisations security teams to take it onboard.
Thus a use for “local AI” would be to filter the CVE and other lists against organisational software deployment, and “network nocking” etc to detect potential attack targets.
The problem with this of course is “experience moving on”. Experienced actual staff will retire or move to other organisations two issues arise,
Firstly the organisational security knowledge and experience goes with them.
Secondly the bringing on of new experience means security teams need to be larger than most organisations would want.
And before people suggest it, no AI is not going to solve the experience problem.
Put simply LLM type systems are filters based on “known training data”, even with a stochastic mechanism what they are capable of is limited by “known training” that might be half a year or more out of date.
Some experienced humans however can in effect “see into the future” into the “what is possible but unknown domain”. Because their experience gives them ideas to test well beyond the fuzzing of “known training”.
In more traditional views they are “researchers” not “brut forcers”. Which gives humans who “are special” in this respect a significant edge over AI Agent swarms.
And that is before the cost savings the humans bring. Running AI Agents is very far from inexpensive and it’s going to get more and more expensive unless Frontier AI companies go bankrupt (which is getting more likely with each day that passes currently).
Subscribe to comments on this entry
Leave a comment Cancel reply
Blog moderation policy
Sidebar photo of Bruce Schneier by Joe MacInnis.
Powered by WordPress Hosted by Pressable