My notes on information technology, technology, science and other matters, as taken from various podcasts, videos and other online flotsam. In effect, this page is a log of stuff I've learned over these past 30 days, often summarized on Twitter and later used in my day job as managing editor for The New Stack.

This month: A machine learning hack for corrupting AI models; the broken strand is not the cause of failure, how analog computers work; some tips about game theory; Linux’s Seccomp Notify extends out to file management; How software updates can be hijacked to infiltrate software supply chains; Monorepo or Multi Repo? The Scunthorpe Problem. And more!

Machine Learning

Machine learning hack: By changing a single bit in an artificial intelligence deep neural network model, an attacker can degrade the accuracy of that model from 99% to 57%. "A single bit flip can lead to significant amount of damage to the neural network model”-- Sanghyun Hong, ML security research, USENIX Enigma, 2021. (Slides)

Machine learning security isn't just about securing the models. ML data may be the crown jewel, but it is only a subset of a broader set of security concerns around bringing ML tools into the enterprise. "ML risk is outpacing ML security"--Microsoft's Hyrum Anderson, Usenix Enigma conference (Slides)

Security

Game Theory is really more of a mathematical language than a theory. "It's really good at describing various scenarios but it's not really good as a theory in itself because it isn't actually based on fact." --Kelly Shortridge, Black Hat 2017. (Video)

"You may think what you have is strength but in reality it's a weakness. That's a threat. If you think it's a weakness but it's actually a strength, that's an opportunity. Vice-versa for your opponent." --Kelly Shortridge on Game Theory, Black Hat 2017. (Video)

Of the 24 Zero Day security vulnerabilities in 2020, 9 were variants, or incomplete patches, of earlier vulnerabilities: "There's lot of ways to reach the vulnerability. We need to make sure the root of the vulnerability is fixed" --Google's Maddie Stone, Usenix Enigma conference. (Slides)

2/3rds of browser bugs come from memory safety errors today. A big part of security research over the next 10 years will be around memory segmentation and the use of memory-safe languages, such as Rust or WebAssembly --Google 's Chris Palmer on the future of sandboxing, Enigma conference, from Usenix. (Slides)

Studying 139 supply chain attacks, The Atlantic Council found 26% hijacked software updates, including 15 that compromised build systems. The single SolarWinds Hack compromised over 18,000 customers, including Microsoft--Trey Herr,the 2021 Usenix Enigma conference. (Slides)

The new Seccomp Notify mechanism of the Linux kernel (version 5.9) extends seccomp beyond its normal duties of filtering system calls so that it can work with files too (Thanks eBPF!). Use cases: Run VPN containers or unprivileged container builds within Kubernetes pods -- Kinvolk Lab's Alban Crequy, Aqua Webinar. (Slides)

"Vessels," Esteban Cabeza DeBaca (Click to see exhibit)

Operations

"The last strand breaking isn't the cause of the failure. The real cause is that the rope got too frayed. So we should be building resilient systems where we know how much margin we have. We can see how frayed our ropes are, in some sense."-- Adrian Cockcroft, speaking about system resilience at ChaosCarnival (Slides)

A Monorepo can be a single source of truth, though module maintenance overhead increases over time. A Multirepo better supports granular access control, enabling teams "to self-service and compose based on shared building blocks"-- Tracy P.Holmes, HashiCorp. (Post)

The Delos storage control plane, a Facebook project, offers the fault tolerance of ZooKeeper, and also MySQL's expressive API. A shared "virtual" log hides the notorious complexity of consensus-- Mahesh Balakrishnan, Usenix OSDI20. (Video)

Software Development

The Scunthorpe Problem "is the unintentional blocking of websites, e-mails, forum posts or search results by a spam filter or search engine because their text contains a string (or substring) of letters that appear to have an obscene ... meaning."-- Wikipedia

Jordan Casteel, at the New Museum

Surveillance Capitalism

Our collective attention is what keeps surveillance capitalism companies (Facebook, Google) alive, writes Cory Doctorow. Over time, we may grow immune from the addictive qualities of social media, though "From the surveillance capitalist’s point of view, our adaptive capacity is like a harmful bacterium that deprives it of its food source — our attention — and novel techniques for snagging that attention are like new antibiotics.”

Hardware

How Analog Computing Works: “The analog currents and voltages within this circuit implement continuously evolving state variables from the dynamical system. The computation is run by powering on the device and observing the evolution of the currents & voltages of interest over time.” --Sara Achour, ACM Special Interest Group on Programming Languages

So, 5G chips and lithium batteries don't play well together...

"Euphoric Concentation," Mary Dill Henry (Berry Campbell Gallery)

Writing

Writing errors may reveal early signs of Alzheimers, says The New York Times. Subjects would spell words wrong, or mis-capitalized words. Also, they used "telegraphic language," which omits subjects and words like 'the,' 'is' and 'are.'"

“The greater the attention to the sentence, the more laboriously the story flows.” —Elena Ferrante, Paris Review.

The “idea that tech journalism should support the tech industry ... interprets journalism as public relations, which it is not. Journalists are not supposed to cheerlead the industry; they’re supposed to cover it"-- Elizabeth Spiers, on the Slate Star Codex.

Toxic Masculinity

"If there’s one thing this upsetting and enlightening documentary reveals, it’s that a kind of casual sexism has been so baked into our coverage of female celebrities, we sometimes don’t even notice it."-- Max Weiss's review of "Framing Britney Spears."

Time

“Going to work, socializing with friends, and doing other activities outside the home help us regulate our mental and physical energy as well as give us a sense of time. Now that we’re lacking those things, time has lost meaning.” —Allison Hirschlag.

“Amid enforced inactivity, the apparition of the sun becomes a major event.”--Alex Ross, New Yorker.