Quantcast
Channel: Hacker News
Viewing all 25817 articles
Browse latest View live

Lyft Set to Claim Third of U.S. Market in 2017

$
0
0

Lyft Inc. has gained significant ground on its rival, Uber Technologies Inc., and is expected to grab more market share in the U.S., according to a private Lyft investor document obtained by Bloomberg.

A major investor is projecting Lyft will have boosted its share of U.S. ride-hailing business some 61 percent by the end of the year, climbing to about a third of the market. The gains come as market-leader Uber’s reputation is in tatters following a string of scandals that culminated with the resignation of its chief executive officer in June. 

Projections outlined in the document depict a company that’s benefiting from the missteps and management turmoil that distracted Uber, its main rival, for most of the year. Lyft is not only gaining market share, but also boosting sales and getting closer to profitability, the document indicates. Even so, Lyft is seeking additional funding and ramping up spending -- making it unlikely to reach break-even as quickly as the company had predicted in the document, according to people with knowledge of the matter.

The document shows that Lyft projected it would escape the red for the first time next year. The San Francisco-based company was forecasting that its earnings, excluding expenses such as taxes and interest, would increase to $500 million in 2019 and $1 billion in 2020. However, Lyft has been spending at a faster rate than expected to take advantage of Uber’s weaker position and now is telling investors the company won’t break even by the end of next year, said the people who asked not to be identified discussing private financial information.

This year, Lyft is on pace for $1.5 billion in net revenue -- the amount of money it generates after paying drivers -- on losses of $400 million, according to the document, which was prepared at the end of the second quarter. Since then, Lyft has spent heavily on a nationwide marketing campaign, including TV spots with actor Jeff Bridges. Investors are now anticipating losses of close to $600 million in 2017, two people said.

Lyft is getting another injection of cash to maintain its growth trajectory -- some of it coming from backers of its arch-rival. Fidelity Investments, an Uber investor, is in talks to participate in a $1 billion financing round led by Alphabet Inc., another investor in Uber, that values Lyft at $11 billion, according to people familiar with the matter. Existing investors KKR & Co., Janus Capital Management LLC, and AllianceBernstein Holding LP also are planning to join the round, the people said. Lyft, KKR and Fidelity declined to comment.

Before this year’s crisis at Uber, Lyft’s share of ride-hailing spending in the U.S., the only country where it operates, was stuck in the low-to-mid teens, the investor document shows. Those estimates include some financial information on parts of Uber’s business, such its food-delivery service, that Lyft doesn’t have, according to a person familiar with the figures. Removing those sales, Lyft’s market share for 2016 was closer to 20 percent, said the person, who asked not to be identified discussing private matters.

Uber’s internal U.S. market share numbers relative to Lyft show Uber starting the year off at about 80 percent. Now Uber believes it has around 70 percent market share, according to a person familiar with the company’s analysis.

Uber’s new CEO Dara Khosrowshahi said at the New York Times DealBook conference Thursday that he believed his competitor was “spending very aggressively to gain share.”

“The U.S. is very competitive right now, between us and Lyft, so I don’t see the U.S. as being a particularly profitable market for the next six months,” Khosrowshahi said.

Khosrowshahi has said that he wants to move his company closer toward profitability with the hopes of taking Uber public by the end of 2019.

In 2016, Lyft lost $606 million on $708 million in net revenue, the documents show. The Lyft investor document predicts the company will reach $2.5 billion in net revenue next year, $3.5 billion in 2019 and $6 billion in 2020. The firm confirmed the document’s authenticity, but asked not to be identified because the financial information is private.

Uber, which operates globally, generated more than $3.3 billion in net revenue with losses of $1.4 billion in the first six months of the year, according to publicly released financial information.

Uber hasn’t publicly disclosed its third-quarter financial information and it’s not clear whether Khosrowshahi will continue the practice of releasing them publicly. Lyft, also a closely held company, has never publicly released its financials.

Uber and Lyft are in the middle of high-stakes financing rounds. Uber is trying to sign a deal with the Japanese technology conglomerate SoftBank Group Corp. The firm, along with a slate of other investors, is expected to invest at least $1 billion in Uber directly while spending billions more buying shares from existing investors. Lyft’s latest investment round has not closed.


A penetration tester’s guide to sub-domain enumeration

$
0
0

As a penetration tester or a bug bounty hunter, most of the times you are given a single domain or a set of domains when you start a security assessment. You’ll have to perform extensive reconnaissance to find interesting assets like servers, web applications, domains that belong to the target organisation so that you can increase your chances of finding vulnerabilities.

We wrote an extensive blog post on Open Source Intelligence Gathering techniques that are typically used in the reconnaissance phase.

Sub-domain enumeration is an essential part of the reconnaissance phase. This blog post covers various sub-domain enumeration techniques in a crisp and concise manner.

A gitbook will be released as a follow up for this blog post on the same topic where we cover these techniques in-depth. We covered some of these techniques in the “Esoteric sub-domain enumeration techniques” talk given at Bugcrowd LevelUp conference 2017.

What is sub-domain enumeration?

Sub-domain enumeration is the process of finding sub-domains for one or more domain(s). It is an essential part of the reconnaissance phase.

Why sub-domain enumeration?

  • Sub-domain enumeration can reveal a lot of domains/sub-domains that are in scope of a security assessment which in turn increases the chances of finding vulnerabilities
  • Finding applications running on hidden, forgotten sub-domains may lead to uncovering critical vulnerabilities
  • Often times the same vulnerabilities tend to be present across different domains/applications of the same organization
The famous Yahoo! Voices hack happened due to a vulnerable application deployed on a yahoo.com sub-domain

Sub-domain enumeration techniques

1. Search engines like Google and Bing supports various advanced search operators to refine search queries. These operators are often referred to as “Google dorks”.

  • We can use “site:” operator in Google search to find all the sub-domains that Google has found for a domain. Google also supports additional minus operator to exclude sub-domains that we are not interested in “site:*.wikimedia.org -www -store -jobs -uk”
Using site operator in Google search to find sub-domains
  • Bing search engine supports some advanced search operators as well. Like Google, Bing also supports a “site:” operator that you might want to check for any additional results apart from the Google search
Finding sub-domains using “site:” operator in Bing

2. There are a lot of the third party services that aggregate massive DNS datasets and look through them to retrieve sub-domains for a given domain.

  • VirusTotal runs its own passive DNS replication service, built by storing DNS resolutions performed when visiting URLs submitted by users. In order to retrieve the information of a domain you just have to put domain name in the search bar
Searching for sub-domains using virustotal
sub-domains found using VirusTotal
  • DNSdumpster is another interesting tools that can find potentially large number of sub-domains for a given domain
Searching for sub-domains using DNSdumpster
Sublist3r is a popular tool that’ll enumerate sub-domains using various sources. Sublist3r enumerates sub-domains using many search engines such as Google, Yahoo, Bing, Baidu, and Ask. Sublist3r also enumerates sub-domains using Netcraft, Virustotal, ThreatCrowd, DNSdumpster, and ReverseDNS.
sub-domain enumeration using Sublist3r

3. Certificate Transparency(CT) is a project under which a Certificate Authority(CA) has to publish every SSL/TLS certificate they issue to a public log. An SSL/TLS certificate usually contains domain names, sub-domain names and email addresses. This makes them a treasure trove of information for attackers. I wrote a series of technical blog posts on Certificate Transparency where I covered this technique in-depth, you can read the series here.

The easiest way to lookup certificates issued for a domain is to use search engines that collect the CT logs and let’s anyone search through them. Few of the popular ones are listed below -

  1. https://crt.sh/
  2. https://censys.io/
  3. https://developers.facebook.com/tools/ct/
  4. https://google.com/transparencyreport/https/ct/
Finding sub-domains of an organisation’s primary domain using crt.sh

We wrote few scripts to simplify the process of finding sub-domains using CT log search engines. The scripts are available in our github repo — https://github.com/appsecco/bugcrowd-levelup-subdomain-enumeration

Interesting sub-domain entry from CT logs for uber.com
The downside of using CT for sub-domain enumeration is that the domain names found in the CT logs may not exist anymore and thus they can’t be resolved to an IP address. You can use tools like massdns in conjunction with CT logs to quickly identify resolvable domain names.
# ct.py - extracts domain names from CT Logs(shipped with massdns)
# massdns - will find resolvable domains & adds them to a file
./ct.py icann.org | ./bin/massdns -r resolvers.txt -t A -q -a -o -w icann_resolvable_domains.txt -
Using massdns to find resolvable domain names

4. Dictionary based enumeration is another technique to find sub-domains with generic names. DNSRecon is a powerful DNS enumeration tool, one of it’s feature is to conduct dictionary based sub-domain enumeration using a pre-defined wordlist.

$ python dnsrecon.py -n ns1.insecuredns.com -d insecuredns.com -D subdomains-top1mil-5000.txt -t brt
Dictionary based enumeration using DNSRecon

5. Permutation scanning is another interesting technique to identify sub-domains. In this technique, we identify new sub-domains using permutations, alterations and mutations of already known domains/sub-domains.

  • Altdns is a tool that allows for the discovery of sub-domains that conform to patterns
$ python altdns.py -i icann.domains -o data_output -w icann.words -r -s results_output.txt 
Finding sub-domains that match certain permutations/alterations using AltDNS

6. Finding Autonomous System (AS) Numbers will help us identify netblocks belonging to an organization which in-turn may have valid domains.

Finding AS Number using IP address
$ nmap --script targets-asn --script-args targets-asn.asn=17012 > netblocks.txt
Finding netblocks using AS numbers — NSE script

7. Zone transfer is a type of DNS transaction where a DNS server passes a copy of full or part of it’s zone file to another DNS server. If zone transfers are not securely configured, anyone can initiate a zone transfer against a nameserver and get a copy of the zone file. By design, zone file contains a lot of information about the zone and the hosts that reside in the zone.

$ dig +multi AXFR @ns1.insecuredns.com insecuredns.com
Successful zone transfer using DIG tool against a nameserver for a domain

8. Due to the way non-existent domains are handled in DNSSEC, it is possible to “walk” the DNSSEC zones and enumerate all the domains in that zone. You can learn more about this technique from here.

  • For DNSSEC zones that use NSEC records, zone walking can be performed using tools like ldns-walk
$ ldns-walk @ns1.insecuredns.com insecuredns.com
Zone walking DNSSEC zone with NSEC records
  • Some DNSSEC zones use NSEC3 records which uses hashed domain names to prevent attackers from gathering the plain text domain names. An attacker can collect all the sub-domain hashes and crack the hashes offline
  • Tools like nsec3walker, nsec3map help us automate the collecting NSEC3 hashes and cracking the hashes. Once you install nsec3walker, you can use the following commands to enumerate sub-domains of NSEC3 protected zone
# Collect NSEC3 hashes of a domain
$ ./collect icann.org > icann.org.collect
# Undo the hashing, expose the sub-domain information.
$ ./unhash < icann.org.collect > icann.org.unhash
# Listing only the sub-domain part from the unhashed data
$ cat icann.org.unhash | grep "icann" | awk '{print $2;}'
del.icann.org.
access.icann.org.
charts.icann.org.
communications.icann.org.
fellowship.icann.org.
files.icann.org.
forms.icann.org.
mail.icann.org.
maintenance.icann.org.
new.icann.org.
public.icann.org.
research.icann.org.

9. There are projects that gather Internet wide scan data and make it available to researchers and the security community. The datasets published by this projects are a treasure trove of sub-domain information. Although finding sub-domains in this massive datasets is like finding a needle in the haystack, it is worth the effort.

  • Forward DNS dataset is published as part of Project Sonar. This data is created by extracting domain names from a number of sources and then sending an ANY query for each domain. The data format is a gzip-compressed JSON file. We can parse the dataset to find sub-domains for a given domain. The dataset is massive though(20+GB compressed, 300+GB uncompressed)
# Command to parse & extract sub-domains for a given domain
$ curl -silent https://scans.io/data/rapid7/sonar.fdns_v2/20170417-fdns.json.gz | pigz -dc | grep “.icann.org” | jq
Enumerating sub-domains using FDNS dataset

Sub-domain enumeration techniques — A comparison

We ran few of the discussed techniques against icann.org and compared the results. The bar chart below shows the number of unique, resolvable sub-domains each technique found for icann.org. Feel free to get in touch with us to know the methods we used to gather this information.

Number of unique, resolvable sub-domains each technique found for icann.org

Sub-domain enumeration — Reference

We created a simple reference for sub-domain enumeration techniques, tools and sources. This reference is created using a Github gist, feel free to fork, customise it— https://gist.github.com/yamakira/2a36d3ae077558ac446e4a89143c69ab

Quick reference for sub-domain enumeration

References

ESPN to lay off 100 employees after Thanksgiving: Report

$
0
0

ESPN (DIS) is preparing to lay off more than 100 employees after Thanksgiving amid subscriber losses and other business-related challenges for the Disney-owned brand, according to a report Thursday.

The layoffs will impact ESPN across several job descriptions, including on-air talent, producers, executives and others, Sports Illustrated’s Richard Deitsch reported, citing sources familiar with the situation. SportsCenter, the network’s flagship news program, is expected to see a large portion of the cuts.

The purported layoffs come months after ESPN cut ties with roughly 100 employees, including some of its most prominent on-air personalities. At the time, ESPN President John Skipper said the cuts were part of an “increased focus on versatility and value,” adding that ESPN would pour more resources into its digital and mobile programming. ESPN previously laid off about 300 employees in Oct. 2015.

ESPN has yet to comment on the purported layoffs.

Once the most profitable wing of Disney’s media properties, ESPN has struggled in recent years amid the rise of cord-cutting and cheaper digital streaming options like Netflix. The cable sports network has lost roughly 13 million paid subscribers since 2011, erasing tens of millions of dollars in annual revenue, while also paying record sums for television rights to NFL and NBA games.

More on this...

Disney is set to launch an ESPN-branded over-the-top subscription service next as part of its strategy to address the subscriber losses.

Continue Reading Below

At the same time, ESPN has faced allegations of political bias in its coverage. Network executives have repeatedly denied the accusations and earlier this month released a new social media policy for employees. The policy urges ESPN employees to avoid political discussions on social platforms.

Disney CEO Robert Iger remained supportive of ESPN’s efforts during an earnings call with analysts on Thursday. 

The Church of the SubGenius Finally Plays It Straight

$
0
0

After nearly forty years as one of the most charming put-ons to hit the counterculture, SubGenius founder Ivan Stang and filmmaker Sandy K. Boone reveal the true story of the long con.

By

In 1980, two smart, goofy nerds in Dallas decided to start their own religion. Their names were Doug and Steve, but in the grand tradition of charlatans everywhere, they invented new names for themselves as apostles of the deity of their made-up belief system: Reverend Ivan Stang (born Douglass St. Clair Smith) and Dr. Philo Drummond (Steve Wilcox), ready to educate the masses through the Church of the SubGenius about the great J.R. “Bob” Dobbs and to spread his gospel of “Slack.”

Somehow, against all odds, the Church of the SubGenius became a real thing, if not exactly a real religion. It spread well beyond Dallas, capturing the imaginations of a number of important counterculture figures of the era. Devo frontman Mark Mothersbaugh, actor Paul Reubens (known for his role as Pee-wee Herman), Talking Heads frontman David Byrne, cartoonist R. Crumb, gonzo bluesman Mojo Nixon, and more all claimed a SubGenius affiliation. All of them sought Slack, an unspecified philosophical state that the church maintained as its answer to enlightenment.

To be clear, all of this was something between a con job and an inside joke. But the people involved took perpetuating that joke seriously. The Church of the SubGenius published five books. One of them, The Book of the SubGenius, has remained in print for decades. People who wanted to play along with the gag launched radio shows in the 1980s (including The Puzzling Evidence Show in Berkeley, California, which has run for more than thirty years) and their own websites in the ’90s. But as a group that was defined by its arch sense of humor and its nesting-doll-style approach to playing with layers of facts, the true story of the people who defined the SubGenius was never told.

Until now, anyway. Filmmaker Sandy K. Boone—whose late husband, David Boone, was one of the first people to sign up for the SubGenius’s mailing list—announced in October a Kickstarter campaign to fund Slacking Toward Bethelhem, a documentary that would tell the true and unabridged story of the Church of the SubGenius for the first time. Boone, who collaborated with Austin Chronicle and SXSW founder Louis Black on the documentaries Jonathan Demme Presents: Made In Texas, Richard Linklater: Dream is Destiny, and Tower in recent years, along with St. Clair Smith, spoke with Texas Monthly without any of the in-character gags (well, almost) to discuss what the SubGenius means in the age of Trump, why the SubGenius mustn’t turn into Scientology, and what it feels like to stop keeping a straight face on your inside joke after nearly forty years.

Sandy Boone and Louis Black with pipes.

Photograph courtesy of Slacking Toward Bethlehem

Dan Solomon: Why is now the right time to make a documentary on the Church of the SubGenius?

Sandy K. Boone: My partner Louis [Black] and I were discussing what would be next, and he said, “You know, what about the SubGenius?” And I went, “Oh my goodness.” We were so disillusioned and frustrated by all the political stuff that’s been going on. It was right before Trump was voted into office. And he said, “it’s time,” in his funny way. “Slack is back. It’s time for Slack to come back.” That’s when it all began. We decided that we wanted to use humor to fight back, with our political points of view. And the attitude of the SubGenius has always been about a fun innocence and using humor to fight back, instead of weapons, against hate and isolation.

Douglass St. Clair Smith: I think we’ve been fairly good at keeping up the morale of some people who might otherwise just give up because they’re not having enough fun. So many anxieties. Which is really understandable, especially these days. I think that our style and the type of approach that we’ve used, which acknowledges the troubles, but casts them into a different light, allows you to take a step back and see, and allows you to count your blessings, if you have any. It’s the kind of thing a lot of people forget.

SKB: Exactly. And I think it’s hard to hate someone when you’re laughing. That’s a common remark that we say often.

DSCS: Well, you can still hate him, but as our friend Puzzling Evidence said, “Let’s get back to hating the conspiracy instead of ourselves.”

SKB: When the SubGenius was originally created, it was the trickle-down theory and Reaganomics. Those policies destroyed our middle class then, and it’s still affecting us today. And even though I didn’t believe in Reagan’s politics, I believed that he actually loved our country. This political leader does not. We were traveling from Europe, and I was crying, it was right before the election, and [Louis Black] said, “You’ve gotta stop crying, baby. You gotta do something.” And so, I thought, “Wow, this is the way. This is how we fought before, and it’s time to fight again.” Bring people, they’ll come in numbers. They’re using it right now in a lot of the night time skits and stuff—they’re using humor. And it’s reaching more people. That’s what we need. We need people to stand up and speak out.

DS: One of the things that defines the SubGenius is that it’s about an unreal-reality, with the ideas that the world is so much weirder than we think it is. How does that fit in with when the world really gets very weird in very real ways?

DSCS: There’s a vein of surrealism that runs through the SubGenius stuff, so that it kind of mirrors the real world, but through a filter of everything crazy. Of course “crazy” is a pretty subjective term. My early buddy Philo Drummond and I started out by collecting extremist pamphlets of all kinds. Religious extremists, political extremists, every kind of stripe. We weren’t picking on any one group. It was just all kinds of craziness mixed together, with monster movies and echoes of the really amazing radio preachers that were on the AM radio in Dallas then. Probably still are, I guess. It’s like Lenny Bruce used to say, “I’m not sick, it’s just a mirror of a sick society.” And we really are sick! But we’re funny about it.

SKB: In a time of profound absurdity, taking absurdity seriously adds to the problem. Confronting absurdity with absurdity is funny. That’s what the SubGenius does.

DSCS: And we’ve attracted so many weirdos! Village townspeople, a tiny smattering of celebrities, and mostly just a lot of artists who were I guess looking for a skeleton to hang some of their meat on. The SubGenius church format made for a good framework. Most of them had nine-to-five jobs, but they’re really creative artists at heart, and this was a place where they could get published. We were doing radio. There’s three weekly radio shows in three different towns. And of course we used to publish zines and we had five books. The book of the SubGenius is still in print. And then when the internet came along, of course, it kind of exploded all over again in a whole different way. So not only has it attracted all these interesting artists, it’s also attracted some actually crazy people. Which kind of has kept my life interesting. The people that take it all at face value. People who see a clip from The Onion on the internet and think it’s real news. There’s been times when we’ve had people who really honestly were looking for a weird mind control cult that was this crazy. It’s like, well they’re actually the ones we’re making fun of. It’s awkward when you realize the person you’re talking to is waiting to meet Bob Dobbs. It’s like, that guy is way too important. Plus every time he shows up in public, some SubGenius or another shoots him.

DS: How did the internet, social media, and the ability of people to communicate much more quickly than when you started change how the SubGenius does what it does?

DSCS: It kept us going, is what it did. In the ‘90s, we’d been around for a long time. We started in 1980, and were really pretty well-known and popular around 1984. References were popping up all the time in pop culture. People would mention it in interviews. Things like that. But it wasn’t supporting my family. I was serving too many masters. I was trying to have this documentary film career and do the Church of the SubGenius and raise a family at the same time, and it was about to just about kill me. But then the internet opened up the market for niche things like SubGenius. It unfortunately also opened up the niche markets for white supremacy and all kinds of horrible things. I don’t know that it really changed it all that much, except that it brought in a lot of newer and younger people, of course. And many of whom who are not so young anymore, who have been with us a long time, and others come and go.

Ivan Stang hosts the 999 Club on November 20, 1981.

Photograph courtesy of Slacking Toward Bethlehem

DS: The SubGenius has been a put-on for so long. What’s it like to drop that mask and tell the story in a real way now?

DSCS: It’s fun for me. I’ve been keeping a straight face for thirty-five years. Your face gets tired. I really would not drop character for a long, long time. And that also increased the number of crazies, in a way. The books are labeled “humor,” but the book isn’t always the first thing you run into. And of course nowadays, it’s really not. You run into web pages and Facebook pages instead. It’s easy for people to take it the wrong way. And besides, it really is an interesting story. There are interesting characters, and we’re not going to be around forever. I’m 64, and I’m doing great, but we’ve lost a lot of us. They aren’t going to get to be in the movie. They boarded the saucers prematurely. It’s good to document this stuff and get it down in the real words.

Another thing is, look what happened to other put-ons when nobody was around to say, “Hey look, this started as a put-on.” Scientology, the Mormons, the entire New Age basically sprang from joke pamphlets done by a couple guys with fake names four hundred years ago. A lot of people don’t know that history. I’m acutely aware of it, and I don’t want the church of the SubGenius to turn into Scientology. There’s people who would do that. Who would actually try to make it into a little army, where certain types of thinking is correct and incorrect. It really has a lot more in common with the underground comic books of the late ‘60s and early ‘70s than it does with any mystic fellowships. And I feel a lot of responsibility for that. I’ve seen people take it the wrong way. I’ve spent the last several years of my career making sure people understand where this really came from. It actually is not magic. It actually is a lot of hard working artists, most of them severely underpaid.

SKB: I really want people to understand that these are real people behind all these characters and they had other lives. And you’ll see that in the documentary. Men and women that went on to do many things in all different fields. It’s just amazing the different types of people that were involved in this. Not only artists and filmmakers. We have a neuroscientist! They all just needed a release. It helped them relax. It really was about making each other laugh, because they realized we’re very serious. The people getting Slack were some of the hardest working people I ever met.

DSCS: For some of us, Slack is not actually sitting around watching TV with a beer in hand. For some of us, Slack is doing the work, but the work we wanted to do. I basically am now doing what I’d be doing anyway, so I feel real good about my situation. But we’ve been really lucky in that it attracted nerds. Well, in the ‘90s, nerds were the best people to know because they were running this new thing called the internet. Before most people even knew what the internet was, we had a presence there. I got a phone call in 1994 from a guy at the University of North Carolina saying, “Do you know what a website is?” and I said, “No.” And he said, “Good! You’re just what we’re looking for! We’re gonna give you a website, because we want to see what people who don’t know anything about this stuff would do with it.” They did the same thing with Negativland, the band. In both cases, it was like, “Here, let’s just throw this sock with an orange in it to these monkeys and see what they do with it.” We had a lot of fun with that sock, with the orange in it. I knew that the internet would eventually become more controlled. I thought, well, we ought to take advantage of this like it’s the Wild West. And we did. It was really a free-for-all. We didn’t really make a ton of money doing that, because I’m afraid none of us were ever very good at being business people. For some reason, we didn’t have any CPAs or lawyers involved. Maybe lawyers, but never the right kind of lawyer.

Archive dump from the Galileo magnetometer patch

$
0
0

README

GLL - A patch for the Galileo magnetometer

See https://news.ycombinator.com/item?id=12037548

In 1993 I worked on a project to produce a software patch for the
magnetomer instrument on the Galileo spacecraft, then in orbit around
Jupiter.  The magnetometer had developed a bad RAM byte.  Unfortunately,
the development system that had been used to program the instrument had
been decommissioned.  I wrote a new development system from scratch using
Macintosh Common Lisp (now Clozure Common Lisp) and used it to develop
a patch for the magnetometer code.

This is a raw dump of my archive from that project.  I have not looked
at this code in 25 years and I don't remember much in the way of details
about exactly what needed to be done or why.  I'm putting this out there
simply because some people have expressed interest in it.

This code was written while I was an employee of JPL in 1993.  I don't
know what its copyright status is.  If you want to do anything more with
it than study it academically you should probably contact the JPL public
information office and get permission.

Inside a low-budget consumer hardware espionage implant

$
0
0
Inside a low budget consumer hardware espionage implant

The following analysis was performed on a S8 data line locator which replied to the hidden SMS command for version query (*3646655*) with:

Ver=MTK6261M.T16.17.01.10
build=2017/01/10 17:33

A while back Joe Fitz tweeted about the S8 data line locator. He referred to it as “Trickle down espionage” due to its reminiscence of NSA spying equipment.

The S8 data line locator is a GSM listening and location device hidden inside the plug of a standard USB data/charging cable. It supports the 850, 900, 1800 and 1900 MHz GSM frequencies.

Its core idea is very similar to the COTTONMOUTH product line by the NSA/CSS [1] in which an RF device is hidden inside a USB plug. Those hidden devices are referred to as implants.

The device itself is marketed as a location tracker usable in cars, where a thief would not be able to identify the USB cable as a location tracking device. Its malicious use-cases can, however, not be denied. Especially since it features no GPS making its location reporting very coarse (1.57 km deviation in my tests). It can, e.g., be called to listen to a live audio feed from a small microphone within the device, as well as programmed to call back if the sound level surpasses a 45 dB threshold. The fact that the device can be repackaged in its sliding case, after configuring it, i.e. inserting a SIM, without any noticeable marks to the packaging suggests its use-case: covert espionage.

S8 data line locator sliding case packaging.

S8 data line locator capabilities

The S8 data line locator has several eavesdropping, espionage and spying capabilities. A SMS message log could look like this:

S8 data line locator hidden commands.

Listen in

Calling the S8 data line locator for 10 seconds establishes a call and allows you to listen to the microphone feed from the device.

Call back

Sending 1111 via SMS to the device enables voice activated call back. It is acknowledged via the following SMS reply:

DT: Set voice monitoring, voice callback and sound sensitivity:400

Once the audio level goes above 40 dB the device calls back the number that send the 1111 command.

Sending 0000 disables the audio triggered call back. It is replied by:

DT: Voice monitoring cancelled successfully.

Query location

Accoding to the manual sending ‘dw’ via SMS to the device yields a reply SMS with the location. This reply is in the form:

Loc:Street, ZIP City, Country
http://gpsui.net/u/xxxx Battery: 100%

The ‘xxxx’ are replaced with characters ‘0-9,A-Z,a-z’ and the Street, ZIP City, Country line with the appropriate street, ZIP, city and country. The link to http://gpsui.net can be accessed without authorization. It forwards to Google maps.

The location was never more accurate than 1.57 km off.

During the query the device will use a mobile data connection to an unknown endpoint (presumably gpsui.net). This is confirmed by a “MMS/Internet” charge by my provider. My provider does not discern MMS and Internet, but it is save to assume there is an Internet connection established during location query.

This issue was the stepping stone for this analysis. Because the device sends unknown data to an unknown third party it can not - at least with a clear conscious - be used in, e.g., a penetration test. You simply can not use a potentially pre-owned tool.

I therefore tried to analyze and eliminate this phone-home “feature”.

To gain access to the devices innards we first tear of the metal shield of the USB connector: S8 data line locator removing USB connector shield.

Next, we remove the plastic cover: S8 data line locator removing USB connector shield.

Chips

After opening the device we can identify the chips:

S8 data line locator board with MT6261MA and RDA 6625e chips.

It features:

  • MediaTek MT6261MA: Low budget chip often used in cheap Chinese smartwatches. No official documentation nor information about the chip is available from MediaTek.
  • RDA 6626e: “a high-power, high-efficiency quad-band front-end Module […] designed for GSM850, EGSM900, DCS1800, PCS1900 handheld digital cellular equipment.”

Connections

So far I could identify 3 different avenues to connect to the device:

USB (passthrough)

The USB A-connector and the Micro-B cable are not connected to the MT6261MA. They merely pass the signal from one to the other:

S8 data line locator USB passthrough.

UART

The next connection is a UART:

S8 data line locator UART.

Interfacing with it yields, approximately 3 seconds after booting the device:

screen /dev/ttyUSB0 115200 # 8N1

F1: 0000 0000
V0: 0000 0000 [0001]
00: 1029 0001
01: 0000 0000
U0: 0000 0001 [0000]
G0: 0002 0000 [0000]
T0: 0000 0C73
Jump to BL




~~~ Welcome to MTK Bootloader V005 (since 2005) ~~~
**===================================================**


Bye bye bootloader, jump to=0x1000a5b0

However, the output stops there. Input to the device is ignored.

It is likely there exist a different firmware version that accepts AT modem commands. The boot banner of that alternate firmware references “ZhiPu” (some file names of the FAT12 in the firmware flash of my device contain this string as well, so the device firmware is likely related to that other firmware).

USB (MTK)

The DP and DM pads on the USB connector are not connected to the D+ and D- lines of the USB connector. However, the V and GND pads are. The DP and DM pads are instead routed to the MT6261MA processor as illustrated here:

S8 data line locator MTK USB.

Next, a USB cable must be soldered to these connectors as follows:

S8 data line locator MTK USB soldered.

The device will then be recognized as an MediaTek phone USB endpoint with the following data:

ID 0e8d:0003 MediaTek Inc. MT6227 phone

This is often called the “MTK boot repair”, “MTK DM DP flash”, etc. It will allow us to interface with the device and dump the firmware ROM and flash.

To dump the firmware I use the open source Fernvale research OS [2]. It was initially targeted for the MT6260 processor. It has, however, been ported to the MT6261 and also works on the MT6261MA.

Obtaining and building fernly’s MT6261 branch

A suitable fork of fernly by Urja “urjaman” Rannikko can be obtained and build as follows:

git clone https://github.com/urjaman/fernly
git clone https://github.com/robertfoss/setup_codesourcery.git
sudo setup_codesourcery/setup.sh
/usr/local/bin/codesourcery-arm-2014.05.sh
cd fernly
git checkout fernly6261
make CROSS_COMPILE=arm-none-eabi-
exit
cp 95-fernvale-simple.rules /etc/udev/rules.d/.

Dumping ROM

To dump the flash we run:

echo "data = [" > rom.py
fernly/build/fernly-usb-loader /dev/fernvale fernly/build/dump-rom-usb.bin >> rom.py
echo "
]
f = open('rom.bin','wb')
for s in data:
  f.write(chr(int(s,16)))
f.close()
" >> rom.py
python rom.py

The file rom.bin will now (at least according to the fernly repository documentation) contain the devices ROM.

Dumping flash

To dump the flash of the device we need to patch flashrom as follows:

git clone https://github.com/flashrom/flashrom
cd flashrom/
git checkout c8305e1dee66cd69bd8fca38bff2c8bf32924306
patch -p0 < ../fernly/flashrom-fernvale.patch
# manually fix Makefile.rej to complete patching

The patch does not cleanly apply so you need to fix the rejected Makefile (Makefile.rej) manually yourself.

Once this was done we can first load the fernly firmware into the devices RAM via:

fernly/build/fernly-usb-loader -w /dev/fernvale fernly/build/stage1.bin fernly/build/firmware.bin

Next, we can use the fernvale_spi programmer we patched into flashrom.

We first let it recognize the flash via:

flashrom/flashrom --programmer fernvale_spi:dev=/dev/fernvale

And then read the flash via:

flashrom/flashrom --programmer fernvale_spi:dev=/dev/fernvale -c "MX25L3205(A)" --read flash.dat

flash.dat will now contain the devices flash memory.

Writing flash attempt

Writing the flash can be performed via:

flashrom/flashrom --programmer fernvale_spi:dev=/dev/fernvale -c "MX25L3205(A)" --write flash.dat

However, the flash seems to be block protected and the block protect bits can not be disabled by flashrom. I have not (yet) found a way to disable the block protect.

Mostly for my personal education I did some more analysis then the obligatory firmware dump.

SIM sniffing (via SIMtrace)

SIM sniffing against S8 data line locator via SIMtrace.

First, I sniffed the communication between the device and the SIM. Interestingly, it accessed all records of the telephone book and SMS storage. More specifically it accesses the following files, which are not needed to provide the services rendered by the device itself:

  • ADF
  • DF(TELECOM)
    • DF(PHONEBOOK)
      • EF(ADN)
      • EF(ANRA1)
      • EF(SMS)

Other SIM accesses seems to be normal.

This is probably not an elaborate scheme to harvest phone numbers and send them to China, but rather the way the default manufactured SIM code was implemented and it was never trimmed down to the needs of this device. Nevertheless, I found it interesting seeing how the device is accessing virtually everything on the SIM.

GPRS sniffing attempt (via OpenBTS)

S8 data line locator connected to OpenBTS.

Next, I tried to sniff the Internet traffic to figure out what is send to whom via the mobile data connection. To this end, I used a Ettus B100 with OpenBTS.

Unfortunately, the S8 data line locator did not connect to the GPRS. This caused the following alternative response to the dw location command:

Loc:Please link:http://gpsui.net/smap.php?lac=1000&cellid=10&c=901&n=70&v=7100 Battery:67%

Flash contents

The most interesting things could be found in the dumped flash.

OS

Strings in the flash.dat suggest the device is probably running Nucleus RTOS:

$ strings -a flash.dat
Copyright (c) 1993-2000 ATI - Nucleus PLUS - Version ARM 7/9  1.11.19

Other strings that may help identify the OS are:

$ strings -a flash.dat | grep "\.c"
psss\components\src\bl_Secure_v5.c
psss\components\src\SSS_secure_shared_v5.c
hal\system\bootloader\src\bl_Main.c
hal\system\bootloader\src\bl_Main.c
hal\system\bootloader\src\bl_FTL.c
hal\system\bootloader\src\bl_FTL.c
hal\system\bootloader\src\bl_FTL.c
hal\storage\flash\mtd\src\flash_disk.c
hal\system\bootloader\src\bl_Main.c
hal\peripheral\src\dcl_pmu6261.c
hal\system\cache\src\cache.c
hal\peripheral\src\dcl_rtc.c
hal\peripheral\src\dcl_pmu6261.c
hal\system\bootloader\src\bl_FTL.c
hal\system\bootloader\src\bl_FTL.c
hal\peripheral\src\rtc.c
hal\peripheral\src\rtc.c
hal\peripheral\src\rtc.c
hal\peripheral\src\rtc.c
hal\peripheral\src\rtc.c
hal\peripheral\src\rtc.c
hal\storage\flash\mtd\src\flash_mtd_sf_dal.c
hal\peripheral\src\dcl_pmu_common.c
hal\peripheral\src\dcl_f32k_clk.c
hal\peripheral\src\dcl_f32k_clk.c
hal\peripheral\src\dcl_gpio.c
hal\peripheral\src\dcl_pmu_common.c
hal\system\cache\src\cache.c
hal\peripheral\src\dcl_f32k_clk.c
hal\peripheral\src\dcl_gpio.c
hal\peripheral\src\gpio.c
hal\system\bootloader\src\bl_FTL.c
hal\peripheral\src\rtc.c
hal\peripheral\src\bmt_hw.c
hal\peripheral\src\dcl_pmu6261.c
hal\storage\flash\mtd\src\flash_mtd.c
hal\peripheral\src\gpio.c
custom\common\hal\combo_flash_nor.c
hal\peripheral\src\dcl_rtc.c
hal\peripheral\src\dcl_rtc.c
hal\storage\flash\mtd\src\flash_disk.c
custom\common\hal\combo_flash_nor.c
hal\storage\flash\mtd\src\flash_mtd_sf_dal.c
hal\system\emi\src\emi.c
sss\components\src\SSS_secure_shared_common.c
alice.c
ddload.c
plutommi\Framework\GDI\gdisrc\gdi.c
C.cKi
hal\audio\src\v1\audio_service.c
ddload.c
ddload.c
plutommi\Framework\GDI\gdisrc\gdi_image_hwjpg_v2.c
plutommi\Framework\GDI\gdisrc\gdi_image_hwjpg_v2.c
plutommi\Framework\GDI\gdisrc\gdi_util.c
plutommi\Framework\GDI\gdisrc\gdi_util.c
hal\audio\src\v1\audio_service.c
ddload.c

FAT12 filesystems (?)

Searching the flash.dat for the FAT12 file systems that are supposedly present in on MediaTek phones, we get:

$ hexdump -C flash.dat
002c1e20  00 00 00 00 00 00 00 00  00 ef cd 4e 4f 20 4e 41  |...........NO NA|
002c1e30  4d 45 20 20 20 20 46 41  54 31 32 20 20 20 00 00  |ME    FAT12   ..|
002c1e40  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
002c1e50  00 00 00 00 00 00 00 00  00 00 4d 4d 4d 4d 4d 4d  |..........MMMMMM|
002c1e60  4d 4d 4d 4d 4d 4d 4d 4d  4d 4d 4d 4d 4d 4d 4d 4d  |MMMMMMMMMMMMMMMM|
*
002c1ff0  4d 4d 4d 4d 4d 4d 4d 4d  4d 4d 4d 4d 4d 4d 55 aa  |MMMMMMMMMMMMMMU.|
[...]
002d8400  eb 58 90 46 69 6c 65 53  79 73 20 00 02 01 01 00  |.X.FileSys .....|
002d8410  01 80 00 9b 01 f8 02 00  01 00 01 00 01 00 00 00  |................|
002d8420  9b 01 00 00 80 00 29 00  00 21 30 4e 4f 20 4e 41  |......)..!0NO NA|
002d8430  4d 45 20 20 20 20 46 41  54 31 32 20 20 20 00 00  |ME    FAT12   ..|
002d8440  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
002d8450  00 00 00 00 00 00 00 00  00 00 4d 4d 4d 4d 4d 4d  |..........MMMMMM|
002d8460  4d 4d 4d 4d 4d 4d 4d 4d  4d 4d 4d 4d 4d 4d 4d 4d  |MMMMMMMMMMMMMMMM|
*
002d85f0  4d 4d 4d 4d 4d 4d 4d 4d  4d 4d 4d 4d 4d 4d 55 aa  |MMMMMMMMMMMMMMU.|
[...]
002dbc00  ff ff ff ff ff de 9e 68  00 00 00 00 00 50 ba ff  |.......h.....P..|
002dbc10  55 93 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |U...............|
002dbc20  00 00 00 00 00 00 00 00  00 ef cd 4e 4f 20 4e 41  |...........NO NA|
002dbc30  4d 45 20 20 20 20 46 41  54 31 32 20 20 20 00 00  |ME    FAT12   ..|
002dbc40  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
002dbc50  00 00 00 00 00 00 00 00  00 00 4d 4d 4d 4d 4d 4d  |..........MMMMMM|
002dbc60  4d 4d 4d 4d 4d 4d 4d 4d  4d 4d 4d 4d 4d 4d 4d 4d  |MMMMMMMMMMMMMMMM|
*
002dbdf0  4d 4d 4d 4d 4d 4d 4d 4d  4d 4d 4d 4d 4d 4d 55 aa  |MMMMMMMMMMMMMMU.|

However, two of the partitions do not appear to be valid FAT12 file systems:

$ fls -o 5646 flash.dat -f fat12
Invalid magic value (Not a FATFS file system (magic))
$ fls -o 5826 flash.dat -f fat12
v/v 6531:   $MBR
v/v 6532:   $FAT1
v/v 6533:   $FAT2
d/d 6534:   $OrphanFiles
$ fls -o 5853 flash.dat -f fat12
Invalid magic value (Not a FATFS file system (magic))

And the middle FAT12 block seems to be corrupted as well, i.e. only orphan files:

$ fls -o 5826 flash.dat -rp -f fat12
v/v 6531:   $MBR
v/v 6532:   $FAT1
v/v 6533:   $FAT2
d/d 6534:   $OrphanFiles
-/r * 469:  $OrphanFiles/MP0B_001
-/r * 470:  $OrphanFiles/ST33A004
-/r * 471:  $OrphanFiles/ST33B004
[...]

An attempt was made to extract the files:

fls -o 5826 flash.dat -Frp -f fat12 | while read line; do
    path=$(echo "$line" | awk -F':' '{print $2}')
    mkdir -p $(dirname $path);
    icat -o 5826 flash.dat $(echo "$line" | grep -oE "[0-9]+" | head -n1) > $path
done

But most files are empty. The results are also very inconsistent, i.e., when changing SIM cards there are significant changes to the files listed by The Sleuthkit. This indicates that those are either not FAT12 partitions or a modified FAT12 variant.

Further analysis was hence done using hexdump.

Configuration data

The flash also contained some configuration data. First, the IMSI of the inserted SIM and the number that is used to remote control the device could be found in the flash:

$ hexdump -C flash.dat
002e2ad0  00 00 00 00 32 xx xx xx  xx xx xx xx xx xx xx xx  |....2xxxxxxxxxxx|
002e2ae0  xx xx 37 00 00 01 00 01  00 00 00 00 00 00 00 00  |xx7.............|
002e2af0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
002e2b10  00 00 00 00 00 00 00 00  00 00 00 2b 34 39 31 xx  |...........+491x|
002e2b20  xx xx xx xx xx xx xx xx  00 00 00 00 00 00 00 00  |xxxxxxxx........|
002e2b30  00 00 00 00 00 00 00 00  00 00 00 00 00 67 70 73  |.............gps|
002e2b40  75 69 2e 6e 65 74 00 00  00 00 00 00 00 00 00 00  |ui.net..........|
002e2b50  00 00 00 00 00 00 00 00  00 00 00 00 00 67 70 73  |.............gps|
002e2b60  75 69 2e 6e 65 74 00 00  00 00 00 00 00 00 00 00  |ui.net..........|
002e2b70  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*

In the above flash segment you can also see a reference to gpsui.net. This is presumably the remote server which is contacted to turn the MCC, MNC, LAI and CID codes into street, city and country information as well as the link to gpsui.net which forwards to Google maps. However, because writing to the flash could not be achieved this hypothesis could not be confirmed.

Hidden commands

Eventually, there was a small find potentially making this effort worthwhile. Searching the flash.dat for the dw,1111 and 0000 commands reveals more hidden commands:

$ hexdump -C flash.dat
00069530  8c ae 00 00 8d ae 8e ae  72 65 73 74 6f 72 65 00  |........restore.|
00069540  00 00 00 00 00 00 00 00  01 00 00 00 68 68 68 00  |............hhh.|
00069550  00 00 00 00 00 00 00 00  00 00 00 00 02 00 00 00  |................|
00069560  69 6d 73 69 00 00 00 00  00 00 00 00 00 00 00 00  |imsi............|
00069570  03 00 00 00 74 69 6d 65  7a 6f 6e 65 00 00 00 00  |....timezone....|
00069580  00 00 00 00 04 00 00 00  74 69 6d 65 00 00 00 00  |........time....|
00069590  00 00 00 00 00 00 00 00  05 00 00 00 61 71 65 00  |............aqe.|
000695a0  00 00 00 00 00 00 00 00  00 00 00 00 06 00 00 00  |................|
000695b0  61 71 63 00 00 00 00 00  00 00 00 00 00 00 00 00  |aqc.............|
000695c0  07 00 00 00 73 65 72 76  65 72 00 00 00 00 00 00  |....server......|
000695d0  00 00 00 00 08 00 00 00  64 64 64 00 00 00 00 00  |........ddd.....|
000695e0  00 00 00 00 00 00 00 00  09 00 00 00 72 65 67 00  |............reg.|
000695f0  00 00 00 00 00 00 00 00  00 00 00 00 0a 00 00 00  |................|
00069600  61 71 62 00 00 00 00 00  00 00 00 00 00 00 00 00  |aqb.............|
00069610  0b 00 00 00 71 71 71 00  00 00 00 00 00 00 00 00  |....qqq.........|
00069620  00 00 00 00 0c 00 00 00  64 77 00 00 00 00 00 00  |........dw......|
00069630  00 00 00 00 00 00 00 00  0d 00 00 00 6c 6f 63 00  |............loc.|
00069640  00 00 00 00 00 00 00 00  00 00 00 00 0e 00 00 00  |................|
00069650  66 61 61 00 00 00 00 00  00 00 00 00 00 00 00 00  |faa.............|
00069660  0f 00 00 00 66 66 66 00  00 00 00 00 00 00 00 00  |....fff.........|
00069670  00 00 00 00 10 00 00 00  31 31 31 31 00 00 00 00  |........1111....|
00069680  00 00 00 00 00 00 00 00  11 00 00 00 30 30 30 30  |............0000|
00069690  00 00 00 00 00 00 00 00  00 00 00 00 12 00 00 00  |................|
000696a0  72 70 74 00 00 00 00 00  00 00 00 00 00 00 00 00  |rpt.............|
000696b0  13 00 00 00 67 62 72 70  74 00 00 00 00 00 00 00  |....gbrpt.......|
000696c0  00 00 00 00 14 00 00 00  74 72 61 63 6b 00 00 00  |........track...|
000696d0  00 00 00 00 00 00 00 00  15 00 00 00 6d 6f 6e 69  |............moni|
000696e0  74 6f 72 00 00 00 00 00  00 00 00 00 16 00 00 00  |tor.............|
000696f0  73 6f 73 6f 6e 00 00 00  00 00 00 00 00 00 00 00  |soson...........|
00069700  17 00 00 00 73 6f 73 6f  66 66 00 00 00 00 00 00  |....sosoff......|
00069710  00 00 00 00 18 00 00 00  73 6f 73 00 00 00 00 00  |........sos.....|
00069720  00 00 00 00 00 00 00 00  19 00 00 00 71 63 73 6f  |............qcso|
00069730  73 00 00 00 00 00 00 00  00 00 00 00 1a 00 00 00  |s...............|
00069740  6c 65 64 6f 6e 00 00 00  00 00 00 00 00 00 00 00  |ledon...........|
00069750  1b 00 00 00 6c 65 64 6f  66 66 00 00 00 00 00 00  |....ledoff......|
00069760  00 00 00 00 1c 00 00 00  66 6c 69 67 68 74 6f 6e  |........flighton|
00069770  00 00 00 00 00 00 00 00  1d 00 00 00 66 6c 69 67  |............flig|
00069780  68 74 6f 66 66 00 00 00  00 00 00 00 1e 00 00 00  |htoff...........|
00069790  65 73 69 6f 6e 6f 77 00  00 00 00 00 00 00 00 00  |esionow.........|
000697a0  1f 00 00 00 65 73 69 6f  61 64 64 72 00 00 00 00  |....esioaddr....|
000697b0  00 00 00 00 20 00 00 00  68 62 74 6f 6e 00 00 00  |.... ...hbton...|
000697c0  00 00 00 00 00 00 00 00  21 00 00 00 68 62 74 6f  |........!...hbto|
000697d0  66 66 00 00 00 00 00 00  00 00 00 00 22 00 00 00  |ff.........."...|
000697e0  65 73 69 6f 6c 6f 63 61  74 65 74 79 70 65 00 00  |esiolocatetype..|
000697f0  23 00 00 00 65 65 65 00  00 00 00 00 00 00 00 00  |#...eee.........|
00069800  00 00 00 00 24 00 00 00  73 6e 64 73 74 6f 70 00  |....$...sndstop.|
00069810  00 00 00 00 00 00 00 00  25 00 00 00 64 64 65 00  |........%...dde.|
00069820  00 00 00 00 00 00 00 00  00 00 00 00 26 00 00 00  |............&...|
00069830  66 6f 72 6d 61 74 74 66  00 00 00 00 00 00 00 00  |formattf........|
00069840  27 00 00 00 68 65 6c 70  00 00 00 00 00 00 00 00  |'...help........|
00069850  00 00 00 00 28 00 00 00  2a 65 38 31 2a 00 00 00  |....(...*e81*...|
00069860  00 00 00 00 00 00 00 00  29 00 00 00 2a 65 38 30  |........)...*e80|
00069870  2a 00 00 00 00 00 00 00  00 00 00 00 2a 00 00 00  |*...........*...|
00069880  2a 72 65 62 6f 6f 74 2a  00 00 00 00 00 00 00 00  |*reboot*........|
00069890  2b 00 00 00 2a 33 36 34  36 36 35 35 2a 00 00 00  |+...*3646655*...|
000698a0  00 00 00 00 2c 00 00 00  69 6d 65 69 73 65 74 00  |....,...imeiset.|

However, most of those commands do not function correctly. It seems the devices firmware is shared among several such location tracking and listening devices, e.g., there are commands referring to LEDs and a TF card, both of which this device do no feature, however, other devices available online do.

An incomplete list of the found commands and there replies is:

  • help: replies with the following commands:
    • dw: Locate
    • qqq: Device binding
    • 1111: Sound Alarm Monitor on
    • 0000: Sound Alarm Monitor off
    • ddd: Reset all tasks
    • aqb: Get Username Password
    • eee: Recording saved
    • dde: Cleanup TF card
    • hhh: Device status
  • loc: same as dw
  • imsi: Query IMEI and IMSI
  • faa: “DTMG: Set voice monitoring, SMS reply and sound sensitivity successfully:40”, “DTMG: Unusual sound detected”
  • fff: “DT: Set voice monitoring, voice callback and sound sensitivity successfully:40”
  • 1111: “DT: Set voice monitoring, voice callback and sound sensitivity successfully:400”
  • 0000: “DT: Voice monitoring cancelled successfully.”
  • gbrpt: “Report:Location the continuous escalation has been closed.”
  • track: “Track:Caller answer mode the device is set to reply location.”
  • hbton: “Hbt:Device is turned on real-time online”
  • hbtoff: “Hbt: Device online has been closed”
  • esionow: “…” ?
  • esioaddr: “Setting esio addr and port fail!”
  • esiolocatetype: “Esio:Reporting location type has been updated to 0.”
  • server: “Setting server addr and port fail!”
  • reg: “…” ?
  • monitor: “Monitor:Caller answer mode the device is set to automatically answer.”
  • eee: “Tf-Card check fails of is insufficient free space!”
  • sndstop: “Cam:No task is running, cancel failed!”
  • *e81*: “…” ?
  • *e80*: “…” ?
  • soson, sosoff, sos, qcsos: ?
  • ledon, ledoff: ?
  • flighton, flightoff: ?
  • aqe: “Setting apn fail!”
  • imeiset: “…” does not seem to set the IMEI
  • restore: “Restore ok!”
  • formattf: ?
  • time: “…” ?
  • timezone: “Setting time zone ok. Current time zone 0”
  • age: “…” ?
  • *3646655*: queries for version information
  • *reboot*: reboots the device

Interestingly the reply strings could not be found in the flash in plaintext. This suggests that some of the data is compressed.

The message log of me trying some of the found hidden commands to populate the above list is as follows:

S8 data line locator hidden commands.

It seems that we can use esioaddr to change the address used to lock up the location information. However, no connection to a given domain nor IP is actually made. The device will simply report the addr invalid in the location report.

The server command sets a different server. Changing it does not result in the addr invalid responses, as can be seen from this second message log:

S8 data line locator hidden commands.

Provider call logs and itemized bill

Because the GPRS sniffing failed I resort to the billing of my provider to further analyze the communication habits of the S8 data line locator.

Obviously reply SMS are billed. More interesting is the Internet access patterns.

dw or loc commands and during idle

During location queries the device will use “MMS/Internet” service. The following is a segment in which first repeated location queries were performed, then the devices was left idle:

Provider call logs and itemized bill during location queries.

Even during idle the device sometimes uses the “MMS/Internet” service.

Even though I deactivated all tracking features that I may have activated during my previous testing, I can not be 100 % sure that this is not something that I activated, maybe while stumbling through the gpsui.net website. However, I regardless of whether I activated this “feature” or not, I do not want it and would like to know what data is actually send and how to deactivate it.

gpsui.net

Going deeper into the gpsui.net website would probably result in a new writeup in itself. It is a very big surveillance hub, just replace the xxxx in http://gpsui.net/u/xxxx with some letters and numbers and you can see random people’s locations.

The website also makes a reference to ZhiPu:

gpsui.net

It seems this is the company that makes these trackers.

You can get your credentials for login by texting aqb to your S8 data line monitor. The username as well as the password are 6 digit numbers. They are also located in the flash right before the IMSI.

Detection

When sending data the S8 data line locator can be detected with a CC308+ (a cheap Chinese RF detector):

CC308+ detecting the S8 data line locator.

The S8 data line locator seems to be badly shielded. A location request via the dw command causes noticeable electronic noise by the device. It seems in general to cause all sorts of RF interference.

While I did not (yet) succeed with my original goal to disable the mobile data phone home “feature’, it was nevertheless a fun exercise and hopefully someone finds this useful or at least educational.

Future work needs to be done on several things:

Issues

I was not able yet to write new firmware via flashrom because I was not able to disable block protection on the flash, yet. Maybe a different avenue for flashing new firmware could be the SPFlash tool and/or the Flash tool. However, that would not be open source. If know something about the weird FAT12 file system used in the device or are able to flash your S8 data line locator please contact me with details!

Further, I tried to capture the GPRS data connection of the device, but was unable to do so. It would not use GPRS when connected to my network. Currently, I do not know how the APN is configured. The SIM trace does not indicate that the EF(ACL) is ever accessed. However, as I found the correct APN configuration stored in the devices flash, this suggests the device acquires this information via a setup SMS by the service provider.

Ideas

Dremel the board smaller, e.g., you don’t need the USB connector. This way the S8 data line locator could be turned into a “modular” bug that could be placed where ever there is a 5 V 1 A power source.

No writeup would be complete without at least one fuck up. So here it is:

While using the S8 data line locator with OpenBTS I provisioned imaginary numbers. When switching SIM cards I forgot to turn of the voice activated callback.

So long story short, some guy with the number 3333333 listend in on me for 2 minutes:

Provider call log fail.

I did not notice this until I reviewed the logs!

So my resume on these little hardware espionage implants: They are stealthy and dangerous as fuck!

Bill Gates buys land in Arizona to build 'smart city'

$
0
0

PHOENIX - One of Bill Gates' investment firms has spent $80 million to kickstart the development of a brand-new community in the far West Valley.

The large plot of land is about 45 minutes west of downtown Phoenix off I-10 near Tonopah.

The proposed community, made up of close to 25,000 acres of land, is called Belmont. According to Belmont Partners, a real estate investment group based in Arizona, the goal is to turn the land into its own "smart city."

"Belmont will create a forward-thinking community with a communication and infrastructure spine that embraces cutting-edge technology, designed around high-speed digital networks, data centers, new manufacturing technologies and distribution models, autonomous vehicles and autonomous logistics hubs," Belmont Partners said in a news release.

Ronald Schott, executive emeritus at the Arizona Technology Council, says the land Gates' company purchased is in a good spot, in part due to the proposed I-11 freeway, which would run right through Belmont and connect to Las Vegas.

"Bill Gates is known for innovation and those kind of things and I think he picked the right place. He's coming to Arizona," Schott said.

According to Belmont Partners, 3,800 acres will go towards office, commercial and retail space. Then, 470 acres will be used for public schools. Plus, there's room for 80,000 residential units.

"Comparable in square miles and projected population to Tempe, Arizona, Belmont will transform a raw, blank slate into a purpose-built edge city built around a flexible infrastructure model," said Belmont Properties.

"Finally Arizona's getting recognized for being a place for innovation," added Schott.

So far, there's no word on when construction will start.

Copyright 2017 KPNX

Jōyō kanji variants: The curious case of 叱 and 𠮟 (2016)

$
0
0

I’m working on a reliable, machine-readable edition of the Jōyō kanji data, and this came up. Can you spot the difference between 𠮟 and 叱? Me neither. Let’s look at the reference image:

Comparison between  and 叱 (Joyo Kanji-hyo reference image

…Welp. The left one is a left-to-right stroke stopping at the end, in the model of 七 “seven”; the right one is right-to-left, sweeping at the end, as in 匕 “spoon / sitting person”. But, still. These government people are very through, to list these minor variant glyphs of the same character.

Except these are supposed to be different characters altogether.

Let’s recap: a character is an abstract entity, and a glyph is a variation of the same character. The shapes ‘a’, ‘a‘ and ‘a‘ are different glyphs of the character LATIN SMALL LETTER A, and font designers can come up with literally infinite more shapes. The text standard for computers, Unicode, assigns one number (“code point”) to each character, not to each glyph; glyph variations are decided by fonts.

However, in the case of Chinese characters, things get blurry. If a character had variants with significantly different shapes (such as 兑 vs. 兌), it was given one code point for each. Only very minor variations were “unified” in the same code point. Unfortunately, these minor variations tend to be bound to locales – The Japanese cross the blade in 刃, the Koreans don’t ­– which means that even the timid unification was hugely controversial. One can, of course, use their country’s version of the characters simply by choosing an appropriate font; but computers don’t always choose the appropriate font, which means that from time to time Taiwanese people would stumble upon Japanese-style glyphs with are obviously completely wrong and unnaceptable (or the other way around).

A mechanism was designed to pacify this, which is the variant forms. Special, invisible control characters can be added to tell the computer which graphical variant is intended. However, most software don’t support this mechanism yet.

The Jōyō Kanji standard has a thing for telling people that the glyphs they’re using are wrong. There are two kinds of variants in the document. One are the “acceptable character forms” 許容字体. These are five characters (餌, 遡, 遜, 謎, and 餅) where the de facto glyphs in modern society differ from what they say it’s the standard. So the popular glyphs are listed in the table (between brackets) as acceptable. These variants are unified in Unicode, and selectable only by variation selectors; I added the relevant variation sequences to JoyoDB, though, again, most computers won’t display them as of 2016. If you want to try, here are them:

Variant unspecifiedStandard variantAccepted variant
U+990CU+990C,U+E0103餌󠄃U+990C,U+E0100餌󠄀
U+9061U+9061,U+E0101遡󠄁U+9061,U+E0100遡󠄀
U+905CU+905C,U+E0101遜󠄁U+905C,U+E0100遜󠄀
U+8B0EU+8B0E,U+E0101謎󠄁U+8B0E,U+E0100謎󠄀
U+9905U+9905,U+E0101餅󠄁U+9905,U+E0100餅󠄀

If they look the same to you, that’s too bad. Come back to this post in 10 years. Meanwhile, here are the reference images of what they should look like:

Standard variantAccepted variant
U+990C,U+E0103餌 󠄃U+990C,U+E0100餌󠄀
U+9061,U+E0101遡 󠄁U+9061,U+E0100遡 󠄀
U+905C,U+E0101遜 󠄁U+905C,U+E0100遜󠄀
U+8B0E,U+E0101謎 󠄁U+8B0E,U+E0100謎󠄀
U+9905,U+E0101餅 󠄁U+9905,U+E0100餅󠄀

So it’s just a matter of a) whether the “moving feet”(shin’nyō) component has one 辶 or two 辶 drops, and b) whether the “food” component, 食, is drawn “square” or in simplified cursive 飠.

The other kind of variant are the “popular-use character forms” 通用字体. These are non-unified characters; they got their own, distinct Unicode codepoints. Still, no one uses the recommended forms, so the Introduction gives a passing nod to the existence of the popular alternatives. This is related to the Japanese JIS character sets; the popular characters are the ones that were encoded in the first JIS releases, from whence they became well-established after the digital revolution.

StandardPopular
U+5861U+586b
U+525dU+5265
U+9830U+982c

Since these are different Unicode codepoints, the difference will show up in all computers; however, they’re still graphical variations of the same fundamental Chinese character.

And then there’s 𠮟 vs. 叱: U+20B9F vs. U+53F1. At first sight it seems to be the same case as the three characters above. However, the Joyo document insists that U+53F1 is not the well-known Jōyō character with the readings shitsu and shi(karu) (“to scold”). One can confirm that they’re distinct characters in the classic Kangxi dictionary, page 173. Here’s what they were supposed to be:

CodepointOnPhoneticKunMeaning
𠮟U+20B9Fshitsushi(karu)to scold
U+53F1ka匕(< 化)to open the mouth

What happened was that early computer practice had the shitsu/shikaru character drawn like the ka character. Ka isn’t used in modern Japanese, so no one cared. By the time they codified the distinction, people had already became used to 叱 (with a diagonal-stroked 匕) in the role of shitsu. What’s more, computers are more used to it; U+20B9F is a newer kind of Unicode character, outside the Basic Multilingual Plane (BMP), and software support to this day is still icky (this very blog system was giving me trouble to preserve it in the main text, and adding it to the title broke everything horribly) – not to mention the lack of font glyphs. Current input methods will choose U+53F1 for shitsu or shikaru, not for ka; and they won’t bring up U+20B9F at all.

Finally, even if the Japanese standards declare that this character shape is meant for ka/”open mouth”, the Unicode standard declares that the codepoint represents shitsu/shikaru“to scold”– the only concession for the original use being the data field kHanyuPinyin, which draws from the Hànyǔ Dà Zìdiǎn dictionary.

In effect, the two characters were accidentally unified as “to scold”, with the earlier “open mouth” meaning rendered obsolete. The Joyo Kanji document recognizes this, saying that now 叱/ka has become a graphical variant (異体字) of 𠮟/shitsu.


Can a Human See a Single Photon? (1996)

$
0
0
The Human Eye and Single Photons

[Physics FAQ] -[Copyright]

Original by Philip Gibbs 1996.

The human eye is very sensitive but can we see a single photon?  The answer is that the sensors in the retina can respond to a single photon.  However, neural filters only allow a signal to pass to the brain to trigger a conscious response when at least about five to nine arrive within less than 100 ms.  If we could consciously see single photons we would experience too much visual "noise" in very low light, so this filter is a necessary adaptation, not a weakness.

Some people have said that single photons can be seen and quote the fact that faint flashes from radioactive materials (for example) can be seen.  This is an incorrect argument.  Such flashes produce a large number of photons.  It is also not possible to determine sensitivity from the ability of amateur astronomers to see faint stars with the naked eye.  They are limited by background light before the true limits are reached.  To test visual sensitivity a more careful experiment must be performed.

The retina at the back of the human eye has two types of receptors, known as cones and rods.  The cones are responsible for colour vision, but are much less sensitive to low light than the rods.  In bright light the cones are active and the iris is stopped down.  This is called photopic vision.  When we enter a dark room, the eyes first adapt by opening up the iris to allow more light in.  Over a period of about 30 minutes, there are other chemical adaptations that make the rods become sensitive to light at about a 10,000th of the level needed for the cones to work.  After this time we see much better in the dark, but we have very little colour vision.  This is known as scotopic vision.

The active substance in the rods is rhodopsin.  A single photon can be absorbed by a single molecule that changes shape and chemically triggers a signal that is transmitted to the optic nerve.  Vitamin A aldehyde also plays an essential role as a light-absorbing pigment.  A symptom of vitamin A deficiency is night blindness because of the failure of scotopic vision.

It is possible to test our visual sensitivity by using a very low level light source in a dark room.  The experiment was first done successfully by Hecht, Schlaer and Pirenne in 1942.  They concluded that the rods can respond to a single photon during scotopic vision.

In their experiment they allowed human subjects to have 30 minutes to get used to the dark.  They positioned a controlled light source 20 degrees to the left of the point on which the subject's eyes were fixed, so that the light would fall on the region of the retina with the highest concentration of rods.  The light source was a disk that subtended an angle of 10 minutes of arc and emitted a faint flash of 1 millisecond to avoid too much spatial or temporal spreading of the light.  The wavelength used was about 510 nm (green light).  The subjects were asked to respond "yes" or "no" to say whether or not they thought they had seen a flash.  The light was gradually reduced in intensity until the subjects could only guess the answer.

They found that about 90 photons had to enter the eye for a 60% success rate in responding.  Since only about 10% of photons arriving at the eye actually reach the retina, this means that about 9 photons were actually required at the receptors.  Since the photons would have been spread over about 350 rods, the experimenters were able to conclude statistically that the rods must be responding to single photons, even if the subjects were not able to see such photons when they arrived too infrequently.

In 1979 Baylor, Lamb and Yau were able to use toads' rods placed into electrodes to show directly that they respond to single photons.

References

Julie Schnapf, "How Photoreceptors Respond to Light", Scientific American, April 1987

S. Hecht, S. Schlaer and M.H. Pirenne, "Energy, Quanta and vision."  Journal of the Optical Society of America, 38, 196-208 (1942)

D.A. Baylor, T.D. Lamb, K.W. Yau, "Response of retinal rods to single photons."  Journal of Physiology, Lond. 288, 613-634 (1979)

List of price of medieval items (2006)

$
0
0
Medieval Price List

Courtesy of Kenneth Hodges (hodges@jif.berkeley.edu)

The list of medieval prices which follows is by no means complete or thoroughly researched; I merely extracted references from some of the books I have, and I thought others might like to inspect it. The sources I used are listed at the end. If an item is listed several times, it is because I had several references I wished to record.


Money goes as follows:
 1 pound (L) = 20 shillings (s)

 1 crown = 5 shillings
 1 shilling = 12 pence (d)
 1 penny = 4 farthings
 1 mark = 13s 4d

The French Livre, sou, and denier are equivalent to the pound, shilling and penny (Latin liber, solidus, and denarius).

For ease, I've divided this list into the following sections: tools, horses, food and livestock, books and education, buildings, cloth and clothing, armor, weapons, marriage, funerals, travel, miscellaneous goods, and wages.

Of course, a price list is a misleading guide to a feudal economy, because so many goods were either produced within a household, or supplied by a lord. Retainers could get money, but they would also get food, lodging, weapons (sometimes), and cloth. Knights Templar were provided with clothes, horses, and armor.


                                  TOOLS
Item                            Price       Date        Source  Page
2 yokes                         4s          c1350       [3]     170
Foot iron of plough             5d            "          "       "
3 mason's tools (not named)     9d            "          "       "
1 spade and shovel              3d          1457         "       "
1 axe                           5d            "          "       "
1 augur                         3d            "          "       "
1 vise                          13s 4d      1514        [5]     27-28
Large biciron                   60s           "          "        "
Small biciron                   16s           "          "        "
Anvil                           20s           "          "        "
Bellows                         30s           "          "        "
Hammers                         8d-2s 8d      "          "        "
2 chisels                       8d            "          "        "
Compete set of armorer's tools  £13 16s 11d   "          "        "
Spinning Wheel                  10 d         1457       [3]     170

                                  HORSES
Item                            Price       Date        Source  Page
War Horse                       up to 50s   12 cen  (?) [7]     30
War Horse                       up to £80   13 cen      [3]     72
Knight's 2 horses               £10         1374         "      76
High-grade riding horse         £10         13th cen     "      72
Draught horse                   10s-20s     13th cen     "       "

Note: Horse prices varied dramatically; for instance, they doubled 
between 1210 and 1310.  ([3], p. 37).                               

                            FOOD AND LIVESTOCK                      
Item                            Price       Date        Source  Page
Wine:
  Best Gascon in London         4d/gallon   1331        [2]     194
  Best Rhenish in London        8d/gallon     "          "       "
Wine:
  Cheapest                      3d-4d/gal   Late 13 cen [3]     62
  Best                          8d-10d/gal    "          "       "
Ale (beer comes later):
  Good                          1.5d/gal    14 cen      [2]     201
  Medium                        1d/gal        "          "       "
  Poor                          .75d/gal      "          "       "
Ale:
  First-rate                    1-1.25d/gal 1320-1420   [3]     58
  Second-rate                   .75-1d/gal    "          "       "
Ale (best):
  Somerset                      .75d        1338        [3]     210
  London                        1.25d        "           "       "
Beer, good                      1d/quart    late 16 cen [8]     xx
Dried Fruit (eg raisins, dates, 1-4d/lb, up
  figs, prunes), almonds, rice  to 6d rare  14 cen(?)   [3]     62-63
Spices (cinnamon, cloves, mace,
  pepper, sugar, etc).          1-3s/lb       "          "        "
Pepper                          4s/lb       mid 13 cen  [9]     218
Pepper                          6d/.5lb     1279-1280   [3]     11
Saffron                         12s-15s/lb  14 cen(?)   [3]     62-63
Cow (good)                      10s         12 cen(?)   [7]     30
Cow                             9s 5d       mid 14th    [1]     99
Cow                             6s          1285-1290   [3]     206
Ox                              13s 1.25d   mid 14 cen  [1]     99
Sheep                           1s 5d         "          "       "
Wether (castrated ram):
  Somerset                      9d-10d      1338        [3]     210
  London                        1s 5d        "           "       "
Pig:
  Somerset                      2s          1338        [3]     210
  London                        3s           "           "       "
Fowl                            1d            "          "       "
2 Chickens                      1d          14 cen      [4]     78
2 Dozen Eggs                    1d            "          "       "
Goose (in London)               6d (legal)
                                7d-8d asked 1375        [2]     198
80 lb cheese                    3s 4d       late 13 cen [3]     114
Salted herring (wholesale)      5-10/1d     1382        [2]     198-199
Salt conger                     6d each     1422-1423   [3]     69
Oats:                            
  Somerset                      1s/quarter  1338         "      210
  London                        2s 2d per    "           "       "
                                 quarter
Cost of feeding a knight's or   £30-£60,    15 cen      [3]     199
  merchants household per year  up to £100

Related note: around 1380, these are the average costs per day of feeding 
people on an estate ([3], p. 65): lord, 7d; esquire, 4d; yeoman, 3d; and 
groom, 1d.

                           BOOKS AND EDUCATION

Item                            Price       Date        Source  Page
Monastary School                £2 (approx) 1392-1393   [3]     75
                                per year
Schoolmaster at Croyden:
  Board                         2s/week*    1394        [2]     186
  Instruction                   13s 4d/year  "           "       "
Oxford:
  Board                         104s/year   1374         "       "
  Clothing                      40s/year     "           "       "
  Instruction                   26s 8d/year  "           "       "
University:                     
  Minimum                       £2£L3/year  Late 14 cen [3]     75
  Student of good birth         £4£L10/year  "           "       "
Fencing Instruction             10s/month   Late 16 cen [8]     xx
7 Books                         £5 (approx) 1479        [3]     76
126 Books                       £113        1397        [3]     77
To Rent a book                  .5d-1d per  mid 13 cen  [9]     172
                                pecia**

* Source says 2s/day.  This is not only insanely high, but the text also 
claims that the board was the same as at Oxford--i.e., 2s/week or 
104s/year.

** A pecia is 16 columns of 62 lines of 32 letters, i.e., 31 744 letters, 
or about 7 500 - 8 000 words.  Rental period is not specified, but I 
would guess a year; books were rented to be copied, and copying the Bible 
took 15 months.  See [9], p. 172.

                                BUILDINGS
Item                            Price       Date        Source  Page
Rent per annum for 138 shops on
  London Bridge                 £160 4s     1365        [2]     114
Rent for the three London 
  taverns with the exclusive
  right to sell sweet wines
  (hippocras, clarry, piments)  £200        1365-1375   [2]     195-196
Rent cottage                    5s/year     14 cen(?)   [3]     208
Rent craftsman's house          20s/year     "           "       "
Rent merchant's house           £2£L3/year   "           "       "
Cottage (1 bay, 2 storeys)      £2          early 14 cen "      205
Row house in York (well built)  up to £5     "           "       "
Craftsman's house (i.e., with
  shop, work area, and room
  for workers) with 2-3 bays
  and tile roof                 £10£L15     early 14 cen [3]    205
Modest hall and chamber, not
  including materials           £12         1289        [3]     79-80
Merchant's house                £33£L66     early 14 cen [3]    205
House with courtyard            £90+         "           "       "
Goldsmiths' Hall (in London,
  with hall, kitchen, buttery,
  2 chambers)                   £136        1365        [2]     114
Large tiled barn                £83         1309-1310   [3]     79
Wooden gatehouse (30' long),
  barn, and drawbridge:
  Contract                      £5 6s 8d +  1341        [3]     81
                                builder's 
                                clothing
  Estimated total               £16          "           "       "
Stone Gatehouse (40' X 18'):
  with all except stone         £16 13s 4d  1313        [3]     79-80
  estimated with stone          £30          "           "        "
Tower in castle's curtain wall  £333, L395  late 14 cen  "        "
Castle & college at Tattershall £450/annum  1434-1446    "      81
                                for 13 years
Transept of Gloucester Abbey    £781        1368-1373   [3]     79-80
Stonework of church (125', no   £113        13 cen(?)    "        "
  tower)                        (contract)

note: tithes were often calculated at 1d a week for every 20s of annual 
rent paid (4, p. 208).

The following are the estimates of raw materials and labor that went into 
the tower of Langeais, a rectangular, tapering stone tower built in 992-
994.  The source is [6], pp. 47ff.  The dimensions at the base were 17.5 
meters by 10 meters; the height was 16m (3 floors); the walls were 1.5m 
thick, made of two shells filled with loose rock. 
Limestone in building: about 1050 cubic meters, or 2 600 000 kg
Wood in building: 47.5 cubic meters, or 34 600 kg
Nails: 3 400, or 50 kg
Mortar: 350 cubic meters.
To make the mortar:
  sand: 225 cubic meters, or 360 000 kg
  limestone: 40 cubic meters, or 160 000 kg
  green wood: 540 cubic meters, or 286 000 kg
Labor Costs, in Average Working Days (AWD):
  procurement: 14 250
  transport: 2 880
  labor:
    unskilled: 63 500
    mason: 12 700
    smith: 1 600

                            CLOTH AND CLOTHING
Item                            Price       Date        Source  Page
Fashionable gown                easily £10, late 14 cen [2]     53
                                up to £50
Gentry:
  Shoes                         4d          1470s       [3]     79
  Boots                         6d            "          "       "
  Purse                         1.5d          "          "       "
  Hat                           10d, 1s 2d    "          "       "
Craftsman's tabard and super-
  tunic                         3s          1285-1290   [3]     206
Reeve's murrey (dark brown) robe 6s 4d      1349-1352    "      176
Reeve's red robe                5s 3d           "        "       "
Peasants (wealthy):
  Linen Chemise                 8d          1313        [3]     175
  Shoes                         6d           "           "       "
  Woolen garment                3s           "           "       "
  Fur-lined garments            6s 8d       early 14 cen "       "
  Tunic                         3s           "           "       "
  Linen                         1s           "           "       "
Landless serfs' tunics          1d-6d       mid 14 cen   "      176
Cloth for peasant tunics        8d-1s 3d    early 14 cen "       "
                                per yard
Best Wool                       5s/yard     1380        [3]     78
"Tawny and russet"              6s/yard     1479-1482    "      "
Silk                            10s-12s     15 cen(?)    "      " 
                                per yard
Furs added to garment           +£2-£3 to   15 cen(?)   "       79
                                garment
The worth of cloth provided
  yearly by a lord to:
  esquires                      2s 11d/yard 1289-1290   [3]     78
  yeomen                        2s/yard         "        "       "
  lesser servants               1s 7d/yard      "        "       "

Note: loose tunics take 2.25-2.5 yards.  In the late 14th century, 
shorter doubled (lined) tunics, known as doublets, became fashionable, 
requiring 4 yards ([3], pp 175,176). 

                                  ARMOR
Item                            Price       Date        Source  Page
Mail                            100s        12 cen(??   [7]     30
Ready-made Milanese armor       £8 6s 8d    1441        [4]     112
Squire's armor                  £5-£6 16s 8d "           "       "
Armor for Prince of Wales, 
  "gilt and graven"             £340        1614        [5]     20
Complete Lance Armor            £3 6s 8d    1590        [5]     185
Complete corselets              30s          "           "       "
Cuirass of proof with pauldrons 40s          "           "       "
Normal cuirass with pauldrons   26s 8d       "           "       "
Target of proof                 30s          "           "       "
Morion                          3s 4d        "           "       "
Burgonet                        4s           "           "       "
Cuirass of pistol-proof with
  pauldrons                     £1 6s       1624        [5]     189-190
Cuirass without pauldrons       £1           "           "         "
Lance Armor                     £4           "           "         "
Targets of Proof                24s          "           "         "
Cuirass with cap                £4           "           "         "
Armor of proof                  £14 2s 8d   1667         "      68
Bascinet                        13s 4d +    1369         "      88
                                3s 4d to
                                line it
Armor in a merchant's house
  (leather?)                    5s          1285-1290   [3]     206
Total Armor owned by a knight   £16 6s 8d   1374         "      76
Armor in house of Thomas of
  Woodstock, duke of Gloucester £103        1397         "      77
Fee for cleaning rust off
  corselets                     5d each     1567        [5]     80
Fee for varnishing, replacing
  straps, and rivetting helmet
  and corselet                  1s 4d       1613        [5]     90
Barrel for cleaning mail        9d          1467        [5]     79 
Note: mail is chainmail; almost all the rest is plate-armor. The armor of the knight in 1374 was probably mail with some plates; same for Gloucester's. Mail was extremely susceptible to rust, and was cleaned by rolling it in sand and vinegar in a barrel. Pauldrons are shoulder plates; morions are open helms, burgonets and bascinets closed helms; and a target refers to any of a number different kind of shields. Armor of proof is tested during the making with blows or shots from the strongest weapons of the time; if a weapon is listed, the armor does not claim to be proof against everything, only that it is proof up to that weapon's strength (eg pistol proof is not musket proof, but may be sword proof). All plate armor was lined with cloth, to pad the wearer, quiet the armor, and reduce wear between the pieces. This, along with the necessary straps, was a significant amount of the expense. An armorer asking for money to set up shop in 1624 estimated production costs and profit for a number of different types of armor: I give two examples below ([5], pp. 189-190).

Cuirass of proof with pauldrons: plates: 5s 6d finishing, rivets, and straps: 7s 6d selling price 26s Lance armor: plates 14s 5d finishing, et cetera 40s selling price 80s WEAPONS Item Price Date Source Page Cheap sword (peasant's) 6d 1340s [3] 174 Pair of wheel-lock pistols, with tools for them £2 16s mid 17th [4] 208 Holsters for pistols 6d " " " Wheel-lock carbine £1 10s " " " Shoulder belt for carbine 1s " " " Pair of flintlock pistols £2 5s " " " Flintlock carbine £1 2s " " " Musket 16s 6d-18s 6d " " "

Note: Sorry, folks, that's all I found. It was mandatory in England for all freemen to own certain types of weapons and armor. (In 1181 every freeman having goods worth 10 marks (1 mark = 13s 4d) had to have a mail shirt, a helmet, and a spear. All other freemen should have helmet, spear, and gambeson (quilted armor) [4], p. 39.) Later, the government stored arms and armour in churches for use; in the 13th century anyone with an income of £2-£5 (wealthy peasants) had to have bows; archery practice became compulsory on Sundays and holidays. You may know that the extreme range of the longbow was 400 yards, but did you know that a statute of Henry VIII no one over 24 could practice at a range of less than 220 yards? (See [4], p. 95 and elsewhere). Note: for guessing prices, see the section on tools (an axe for 5d). An armorer might make 24s a month; say a week to make a decent sword, and you might get a price that way. See the section on books and education for fencing instruction.

MARRIAGE Item Price Date Source Page Sample peasant dowries: 13s 4d, 14 cen(?) [3] 179 35s 11d, 57s, 63s 4d For serfs, mechet (fees) to lord, depending on wealth 1s-13s 4d 14 cen(?) [3] 179 Wedding feast, wealthy peasant 20s " " " Wealthy peasant wedding total £3-£4 " " " Dowry for esquire's daughter up to £66 15 cen " 84 13s 4d Dowry for baron's daughter £1000 + " " " London parents (both sets) each offered couple £100 1385 [2] 154 Note: these costs will be wildly varying depending on circumstance. FUNERALS Item Price Date Source Page Cheap gentlewoman's funeral (bell-ringing, clergy, food) £7 1497 [3] 85 Brass monument, with a figure incised, on marble base-- fitting for lesser aristocrat £8 early 14 cen " " Bishop Mitford's funeral (with 1450 guests!) £130+ 1407 " " Memorial Chapel for Richard Beauchamp, earl of Warwick £2481 1439-1463 " " Bronze effigy on guilded tomb £400 " " " Note: Christopher Dyer gives as a rough rule of thumb 1 year's income for a funeral ([3], p. 85) TRAVEL Item Price Date Source Page Queen's chariot £400 14 cen [1] 99 Lady Eleanor's chariot £1000 14 cen [1] 99 Chariot £8 1381 [3] 72 Chariot maintence 1-3s/year 14 cen " " Barge £10 " " " Iron-bound cart 4s c1350 " 170 Guide for a night 1d 14 cen [1] 129 Ferry ride per horseman 1d " " " Keeping an earl's warhorse 82 days in summer 36s 9.5d 1287 [3] 71 Note: [1], pp 126-129, gives the following prices at an inn in 1331. For one day, 3 men with 4 servants spent: Bread, 4d; beer, 2d; wine 1.25d; meat, 5.5d; potage, .25d; candles, .25d; fuel, 2d; beds, 2d; fodder for horses, 10d. The four servants staying alone sleep 2 nights for 1d. Generally, all 7 spend 2d a night on beds; in London, it is 1d per head. MISCELLANEOUS Item Price Date Source Page 6 silver spoons 14s 1382 [2] 24 2 gold rings with diamonds £15 " " " Gold Ring with ruby 26s 8d " " " 3 strings of pearls 70s " " " 6 gold necklaces 100s " " " Fee to enroll an apprentice: with mercers (cloth dealers) 2s 14 cen [2] 111 with carpenters 1s " " " Fee to join guild at end of apprenticeship: with mercers 20s " [2] 111 with carpenters 3s 4d " " " Fee to join guild 6s 8d-£3 14 cen(?) [3] 208 Fee to gain freedom of a town (to enjoy its exemption from feudal duties) 3s 4d-20s 14 cen(?) [3] 208 To empty a cesspit in a city 6s 8d 15 cen(?) [3] 209 Candles Somerset 1.5d/lb 1338 [3] 210 London 2d-2.5d/lb " " " Candles tallow 1.5d/lb 15 cen(?) [3] 74 wax 6.5d/lb 1406-1407 " " Vat 4d 1457 [3] 170 Barrel 3d " " " Bottle 4d " " " 2 buckets 1s " " " 1 sheet 4d " " " 1 mattress 2d " " " 4 pillows 4d " " " 3 boards for a bed 4d " " " 2 sheets, 4 blankets 5s 8p 1349-1352 " " 16 bedspreads, 20 sheets, 8 featherbeds £3 1s 1285-1290 [3] 206 Duke's bed of cloth of gold, with blue satin canopy £182 3s 1397 [3] 77 Table 6d 1457 [3] 170 Chair 3d " " " Chest with necessaries thereto 2s 2d " " " 2 chests 6d each " " " Metal ewer 6d 1349-1352 " " Brass pot 2s " " " Basin and ewer 8d " " " Basin and ewer 2s 8d " " " Towel 6d " " " Coffer 1s " " " 2 stools 8d " " " Ceramic cooking pot .5d 1340s " 174 Note: most of these come from inventories of peasants' belongings. The fine goods would be more expensive. Note about lighting: great houses could use 100 lb of wax and tallow in a single winter night ([3], p. 74). Others, not as rich, would go to sleep earlier. WAGES Profession Wage Date Source Page Mercenaries: knight banneret 4s/day 1316 [4] 78 knight 2s/day " " " man-at-arms or squire 1s/day " " " Regular Army Esquires, constables, and centenars 1s/day 1346 [4] 79 Mounted archers, armored infantry, hobilars, vintenars 6d/day " " " Welsh vintenars 4d/day " " " Archers 3d/day " " " Welsh infantry 2d/day " " " Captain 8s/day late 16 cen [4] 181 Lieutenant 4s/day " " " Ensign 2s/day " " " Drummer or trumpeter 20d/day " " " cavalryman 18d/day " " " infantry 8d/day " " " Laborer £2/year max c1300 [3] 29 Crown revenues (at peace) £30 000 c1300 " " Barons per year £200-500+ c1300 " " Earls per year £400-£11000 c1300 " " Sergeant at Law (top lawyer) £300/year 1455 " 47 Chief armorer 26s 8d/month 1544 [5] 182 Other armorers in same shop 24s/month 1544 " " except "Old Martyn" who made 38s 10d/month 1544 " " Apprentices in same shop 6d/day 1544 " " Master mason 4d/day 1351 [2] 24 Master carpenter 3d/day " " " Carpenters' Guild stipend to a sick member 14d/week 1333 [2] 156 Weavers 5d/day, no 1407 [2] 146 food Chantry priest per year £4 13s 4d 1379 [2] 24 Squires per annum 13s 4d-£1 14 cen [1] 116-117 Carters, porters, falconers 5s-8s 8d 14 cen [1] 116-117 grooms, messengers per year Kitchen servants 2s-4s/year 14 cen [1] 116-117 Boys and pages 1s-6s/year 14 cen [1] 116-117 Wardens of London Bridges £10/year 1382 [2] 128 Note: sheriffs of London paid 300 £s per year, hoping to make a profit from the fines they collected. Note: 30 adult sheep could produce about 20s of wool per year in 1299 ([3], p. 114). Note: To get a VERY ROUGH sense of money, I reproduce the following chart from Dyer ([3], p. 206). These are averages of daily wages in pence. Decade Thatcher Thatcher's mate 1261-70 2 - 1271-80 2.5 1 1281-90 2.25 1 1291-1300 2.5 1 1301-10 2.5 1 1311-20 3 1.25 1321-30 3 1 1331-40 3 1.25 1341-50 3 1.25 1351-60 3.5 2 1361-70 3.5 2 1371-80 4.25 2.5 1381-90 4 2.25 1391-1400 4.25 2.75 1401-10 4.5 3 1411-20 4.75 3 1421-30 4.5 3 1431-40 4.5 3.25 1441-50 5.25 4 1451-60 5.5 3.25 1461-70 4.75 3.75 1471-80 5.25 3.75 1481-90 6 3.75 1491-1500 5.5 3.5 1501-10 5.75 4 1511-20 5.25 4


[1] English Wayfaring Life in the XIVth Century, J. J. Jusserand, trans Lucy Smith, Putnam's Sons, New York,1931 (Orig. 1889).

[2] London in the Age of Chaucer, A. R. Myers, University of Oklahoma Press, Norman, 1972

[3] Standards of Living in the Later Middle Ages, Christopher Dyer, Cambridge University Press, 1989

[4] English Weapons & Warfare, 449-1660, A. V. B. Norman and Don Pottinger, Barnes & Noble, 1992 (orig. 1966)

[5] The Armourer and his Craft from the XIth to the XVIth Century, Charles ffoulkes, Dover, 1988 (orig. 1912)

[6] "The Cost of Castle Building: The Case of the Tower at Langeais," Bernard Bachrach, in The Medieval Castle: Romance and Reality, ed. Kathryn Reyerson and Faye Powe, Kendall/Hunt, Dubuque, Iowa, 1984

[7] The Knight in History, Frances Gies, Harper & Row, New York, 1984

[8] Methods and Practice of Elizabethan Swordplay, Craig Turner and Tony Soper, Southern Illinois University Press, Carbondale, 1990

[9] Life in a Medieval City, Joseph and Frances Gies, Harper & Row, New York, 1969

Trip report: Fall ISO C++ standards meeting

$
0
0

A few minutes ago, the ISO C++ committee completed its fall meeting in Albuquerque, New Mexico, USA, hosted with our thanks by Sandia National Laboratories. We had some 140 people at the meeting, representing 10 national bodies. As usual, we met for six days Monday through Saturday, including several evenings.

The following are some highlights of what we achieved this week. You can find a brief summary of ISO procedures here. The main things to note are:

  • “IS” means “international standard.” In our case, it’s the core C++ standard itself. Think of this as “trunk.”
  • “TS” means “technical specification,” a document separate from the main standard where we can gain experience with new features before putting them into the IS. We have several of these, summarized on the status page. Think of these as “beta branches.”

Modules TS ballot comments: Almost done

A primary goal of the meeting was to address the comments received from national bodies in the Modules TS’s comment ballot that ran this summer. We managed to address them all in one meeting, as well as deal with most of the specification wording issues discovered in the process of responding to the national comments; we discovered one or two areas where the TS wording did not quite match the approved design intent, and so the plan is to finish addressing those and to approve the Modules TS for publication in between meetings via a teleconference, rather than wait for our next face to face meeting in March.

It will be great to get the TS published, and continue getting experience with implementations now in progress, at various stages, in all of Visual C++, Clang, and gcc as we let the ink dry and hammer out some remaining design issues, before starting to consider adopting modules into the C++ draft standard itself. I do not know whether modules will make the feature cutoff for C++20, but a lot of people are working hard to maximize the chances… we’ll know in another 12-18 months when we reach the C++20 feature cutoff.

Second meeting for C++20

This was also the second meeting where we could vote changes into Draft C++20. And we did!

Here are some of the features that were added to C++20 at this meeting. Note: These links currently find the most recent pre-meeting papers and so may not reflect the exact wording adopted at the meeting, but the links will light up to the post-meeting versions of the papers that were actually adopted as soon as those are available in the post-meeting mailing about three weeks from now.

Range-based for statements with initializer (Thomas Köppe). In C++17, we already allowed initialization of if-scoped and switch-scoped variables, just like the ordinary for loop has already had for years. Today, we added the same for the range-based for loop, which gives the same benefit: It enables and encourages locally scoped variables without the programmer having to introduce a scope manually. To take an example from the paper, in C++17 we might write the following to get a variable thing that exists just as long as is needed for the for loop, which avoids a bad pitfall (do you see why the “WRONG” comment is wrong?):

{
  T thing = f();
  for (auto& x : thing.items()) {
    // Note: “for (auto& x : f().items())” is WRONG
    mutate(&x);
    log(x);
  }
}

and now in draft C++20 we can write the recommended local scoping directly with less ceremony of { } and indenting, and follow the C++ Core Guidelines scoping recommendations now also for range-for, as just:

for (T thing = f(); auto& x : thing.items()) {
  mutate(&x);
  log(x);
}

Bit-casting object representations (JF Bastien). This proposal gives a way to copy the bits of an object in a consistent and simple manner. It adds the new header <bit>, and provides bit_cast for trivially-copyable “bag-o-bits” objects, to easily copy the bits of any such object to another of the same size (the types need not be the same). Note: Yes, we already have memcpy, but bit_cast is safer and also can run at compile time.

Lots of other cleanup. We did various smaller features and cleanup, sometimes to fix bugs, sometimes to improve consistency and generality, and sometimes to make the language a little simpler to use.

  • Example of bug fixes: Draft C++20 sets forth more precisely where constexpr functions are defined (core issue 1581).
  • Examples of consistency and generality: Draft C++20 now supports concepts requires-clauses in more places including lambdas (P0857, Thomas Köppe). Also, stateless (non-capturing) lambdas are now default constructible and assignable, which makes them more convenient to create and use (P0624, Louis Dionne).

Operator <=>, aka “spaceship” (myself). Beyond those, my personal favorite is that the committee adopted my own proposal for the <=> “spaceship” three-way comparison operator (language wording; library wording). Many thanks to all the proposal’s reviewers, including all the authors of previous proposals in this area and especially Jens Maurer and Walter Brown for standardese wording help. This will greatly simplify how to write comparisons.

For example, in C++17 if we want to have a case-insensitive string type CIString that supports comparisons between two CIStrings and between a CIString and a C-style char* string, we would have to write something like the following 18 nonmember friend functions:

class CIString {
  string s;
public:
  // ...

  friend bool operator==(const CIString& a, const CIString& b) { return ci_compare(a.s.c_str(), b.s.c_str()) != 0; }
  friend bool operator< (const CIString& a, const CIString& b) { return ci_compare(a.s.c_str(), b.s.c_str()) <  0; }
  friend bool operator!=(const CIString& a, const CIString& b) { return !(a == b); }
  friend bool operator> (const CIString& a, const CIString& b) { return b < a; }
  friend bool operator>=(const CIString& a, const CIString& b) { return !(a < b); }
  friend bool operator<=(const CIString& a, const CIString& b) { return !(b < a); }

  friend bool operator==(const CIString& a, const char* b) { return ci_compare(a.s.c_str(), b) != 0; }
  friend bool operator< (const CIString& a, const char* b) { return ci_compare(a.s.c_str(), b) <  0; }
  friend bool operator!=(const CIString& a, const char* b) { return !(a == b); }
  friend bool operator> (const CIString& a, const char* b) { return b < a; }
  friend bool operator>=(const CIString& a, const char* b) { return !(a < b); }
  friend bool operator<=(const CIString& a, const char* b) { return !(b < a); }

  friend bool operator==(const char* a, const CIString& b) { return ci_compare(a, b.s.c_str()) != 0; }
  friend bool operator< (const char* a, const CIString& b) { return ci_compare(a, b.s.c_str()) <  0; }
  friend bool operator!=(const char* a, const CIString& b) { return !(a == b); }
  friend bool operator> (const char* a, const CIString& b) { return b < a; }
  friend bool operator>=(const char* a, const CIString& b) { return !(a < b); }
  friend bool operator<=(const char* a, const CIString& b) { return !(b < a); }
};

With this proposal, the class’s comparisons could instead be implemented as just two ordinary member functions (vs. the 18 that had to be nonmember friends above):

class CIString {  string s;
public:
   // ...

  std::weak_ordering operator<=>(const CIString& b) const
      { return ci_compare(s.c_str(), b.s.c_str()); }
  std::weak_ordering operator<=>(const char* b) const
      { return ci_compare(s.c_str(), b); }
};

and objects of this type can still be used just as flexibly and efficiently as if the class author had written all of the above two-way operators in the first version, because now the compiler will rewrite expressions like s1<s2 to (s1<=>s2 < 0) for you automatically. Additionally, unlike the first attempt, this version also documents in code that the kind of ordering being returned is a weak ordering, not a strong (total) ordering. I’m a fan of writing less code to say more, and to say it more accurately. Please see the paper linked above for more details.

In related news, at this meeting the Library Evolution subgroup also began considering David Stone’s proposal to apply operator<=> to the standard library, and it got a warm reception and is expected to progress over the coming meetings. If it succeeds, we hope it may possibly let us get a small reduction in the size of the standard library specification as well as a result. Additionally, at this meeting we discovered that having <=> opens an unanticipated door for language evolution: Because the default operator<=> is guaranteed to be memberwise, so that we can know those are its semantics at compile time, a brand-new proposal by Jeff Snyder can leverage it to solve the remaining problems that before prevented us from using non-built-in types as non-type template parameters; we’ll see more of his proposal at our next meeting. That’s a good sign of a feature that is generally useful in the language beyond just its intended use cases.

We also approved extensions to the standard library:

atomic<shared_ptr<T>> (myself, Alisdair Meredith): This was originally my proposal and I got it into the Concurrency TS; many thanks to Alisdair Meredith who got it the rest of the way into draft C++20 over the past two meetings. There are changes since it appeared in the Concurrency TS, including to make it use the name I originally proposed (and not “atomic_shared_ptr<T>”).

Here’s more that we got at this meeting on the standard library side. If you notice “constexpr” being mentioned a few times above already, and some more below, that’s no accident; in Library subgroup chair Marshall Clow’s words, “the future of constexpr is bright.” The following other progress also includes more work on enabling features to work at compile time, including most of the rest of the standard algorithms:

(Aside: At this meeting, the Evolution subgroup also provisionally allowed constexpr (compile-time) new, vector, and string. Stop a moment, and think about what that means. — That is not yet in C++20, but it’s on its way and could be approved for draft C++20 in another few meetings… and if this all reminds you of the CppCon “constexpr all the things!” talk title, you’re exactly right.)

And much more. Thanks to all those proposal authors and the issues list proposed wording contributors and all their helpers, without which this team effort would not succeed meeting after meeting. None of the proposers could get it done without all the contributions of many people who work tirelessly all the way from design feedback to detailed wording review, usually for no public glory, and we appreciate their indispensable help. For any of the above papers you happen to have interest to click on, please be sure to look also at the Acknowledgments section, many of which are quite extensive and deservedly so.

We also continued incubating other work. In particular, the Reflection study group had presentations, and gave direction and feedback, on static reflection for functions, as well as design feedback on Section 5 of my metaclasses paper. The Undefined/Unspecified Behavior study group met for two days with our sister committee WG23 (Vulnerabilities) co-located at the same venue to start work on a C++-specific document about programming language vulnerabilities and guidance, in conjunction with (and already providing new feedback for) the C++ Core Guidelines.

What’s next

Here’s an updated snapshot of our status:

Thank you again to the 140 experts in Albuquerque this week, and the many more who participate in standardization through their national bodies! Have a good winter… we look forward now to our next meetings in March (Jacksonville, Florida, USA) and June (Rapperswil, Switzerland).

‘Null’ research findings aren’t empty of meaning. Let’s publish them

$
0
0

E

very medical researcher dreams of doing studies or conducting clinical trials that generate results so compelling they change how diseases are treated or health policy is written. In reality, we are lucky if the results are even a little bit positive, and often end up with “null” results, meaning that the effect of a policy, drug, or clinical intervention that we tested is no different than that of some alternative.

“Null” comes from the null hypothesis, the bedrock of the scientific method. Say I want to test whether the switch to daylight saving time affects the outcomes of surgery because surgeons may be slightly more fatigued in the days following the transition due to lost sleep. I set up a null hypothesis — surgery-related deaths are no different in the days immediately before the switch to daylight saving time compared to the days immediately after it — and then try to nullify, or disprove, it to show that there was indeed a difference. (Read on to see the answer, though you can probably guess from the headline what it is.) Disproving the null hypothesis is standard operating procedure in science.

Null results are exceedingly common. Yet they aren’t nearly as likely to get published as “positive” results, even though they should be. In an analysis of nearly 30,000 presentations made at scientific conferences, fewer than half were ultimately published in peer-reviewed journals, and negative or null results were far less likely to be published than positive results. Clinical trials with positive findings are published more often and sooner than negative or null trials.

advertisement

That’s a shame, because publishing null results is an important endeavor. Some null results represent potentially important discoveries, such as finding that paying hospitals for performance based on the quality of their outcomes has no effect on actually improving quality. The majority of research questions, though, don’t fall into this category. Leaving null results unpublished can also result in other researchers conducting the same study, wasting time and resources.

Some unpublished null findings are on important topics, like whether public reporting of physician’s outcomes leads physicians to “game the system” and alter the care that they provide patients. Others come from explorations of quirkier topics.

Here are a few of each from my own unpublished research.

Daughters and life expectancy. Daughters are more likely than sons to provide care to their ailing parents. Does that mean being blessed with a daughter translates into greater life expectancy? Using data from the U.S. Health and Retirement Study, I compared mortality rates among adults with one daughter versus those with one son. There was no difference. Ditto for families with two daughters versus two sons.

Daylight saving time and surgical mortality. The switch to daylight saving time in the spring has been linked to increased driving accidents immediately after the transition, attributed to fatigue from the hour of lost sleep. I investigated whether this time switch affects the care provided by surgeons by studying operative mortality in the days after the transition. U.S. health insurance claims data from 2002 to 2012 showed no increase in operation-related deaths in the days after the transition to daylight saving time compared to the days just before it.

Tubal ligations and son preference. A preference for sons has been documented in developing countries such as China and India as well as in the United States. When I was a medical student rotating in obstetrics, I heard a patient ask her obstetrician, “Please tie my tubes,” because she had finally had a son. Years later, I investigated whether that observation could be systematically true using health insurance claims data from the U.S. Among women who had recently given birth, there was no difference in later tubal ligation rates between those giving birth to sons versus daughters.

Gaming the reporting of heart surgery deaths. One strategy for improving the delivery of health care is public reporting of doctors’ outcomes. Some evidence suggests that doctors may game the system by choosing healthier patients who are less likely to experience poor outcomes. One important metric is 30-day mortality after coronary artery bypass graft surgery or placement of an artery-opening stent. I wanted to know if heart surgeons were trying to avoid bad scores on 30-day mortality by ordering intensive interventions to keep patients who had experienced one or more complications from the procedure alive beyond the 30-day mark to avoid being dinged in the publicly reported statistics. I hypothesized that in states with public reporting, such as New York, deaths would be higher on post-procedure days 31 to 35 than on days 25 to 29 if doctors chose to keep patients alive by extreme measures. The data didn’t back that up — there was no evidence that cardiac surgeons or cardiologists attempt to game public reporting in this way.

Halloween and hospitalization for high blood sugar. Children consume massive amounts of candy on and immediately after Halloween. Does this onslaught of candy consumption increase the number of episodes of seriously high blood sugar among children with type 1 or type 2 diabetes? I looked at emergency department use and hospitalization for hyperglycemia (high blood sugar) among children between the ages of 5 and 18 years in the eight weeks before Halloween versus the eight weeks after, using as a control group adults aged 35 and older to account for any seasonal trends in hospitalizations. There was no increase in emergency visits for hyperglycemia or hospitalizations for it among either adults or children in the days following Halloween.

The 2008 stock market crash and surgeons’ quality of care. During a three-week period in 2008, the Dow Jones Industrial Average fell 3,000 points, or nearly 25 percent of the Dow’s value. The sharp, massive decline in wealth for many Americans, particularly those with enough money to be heavily invested in stocks, had the potential to create immediate and significant stress. Was this acute, financial stress large enough to throw surgeons off their game? Using U.S. health insurance claims data for 2007 and 2008 that included patient deaths, I analyzed whether weekly 30-day postoperative mortality rates rose in the month following the crash, using 2007 as a control for seasonal trends. There were nearly identical 30-day mortality rates by week in both 2007 and 2008, suggesting that the stock market crash, while stressful, did not distract surgeons from their work.

Not reporting null research findings likely reflects competing priorities of scientific journals and researchers. With limited resources and space, journals prefer to publish positive findings and select only the most important null findings. Many researchers aren’t keen to publish null findings because the effort required to do so may not ultimately be rewarded by acceptance of the research into a scientific journal.

There are a few opportunities for researchers to publish null findings. For example, the Journal of Articles in Support of the Null Hypothesis has been publishing twice a year since 2002, and the Public Library of Science occasionally publishes negative and null results in its Missing Pieces collection. Perhaps a newly announced prize for publishing negative scientific results will spur researchers to pay more attention to this kind of work. The 10,000 Euro prize, initially aimed at neuroscience, is being sponsored by the European College of Neuropsychopharmacology’s Preclinical Data Forum.

For many researchers, though, the effort required to publish articles in these forums may not be worth the lift, particularly since the amount of effort required to write up a positive study is the same as for a null study.

The scientific community could benefit from more reporting of null findings, even if the reports were briefer and had less detail than would be needed for peer review. I’m not sure how we could accomplish that, but would welcome any ideas.

Anupam B. Jena, MD, is an economist, physician, and associate professor of health care policy and medicine at Harvard Medical School. He has received consulting fees from Pfizer, Hill Rom Services, Bristol Myers Squibb, Novartis Pharmaceuticals, Vertex Pharmaceuticals, and Precision Health Economics, a company providing consulting services to the life sciences industry.

WAM-CL: Common Lisp in Prolog

$
0
0

 A new Common Lisp compiler/interpreter

   https://github.com/TeamSPoon/wam_common_lisp/tree/master/prolog/wam_cl

   About this Lisp:

* Translates Lisp source files into Prolog source files.  ( compilation is done to Translated source)

* At the REPL, forms are converted from Lisp to Prolog then call/1d
Being written as an SWI-Prolog "pack"

* Continue to ensure can run in YAP (which Lisp to Prolog benchmarking shows about 4x speedup)

* One small code so far seems to run much faster than ECL, ABCL, CLISP  but about ¼ the speed of SBCL

* Picks up freebies .. whatever the host prolog system offers such as
**Makes  Executables and. So files
**Garbage Collection
**Memoization
**Embedding (from C/C++/Python/C#/Mono/Java)

* Gives back OO to Prolog programmers .. to keep later copy_term's cheap, it passes entire object references as atoms  (nb_current/2 allows access to the object's property map)
….

Roadmap Items
*Expect to pass most all CL-ANSI tests
*Using SWICLI as FFI (SWICLI itself still needs work)
*ASDF
*Quicklisp
….

   I've only spent a week on it ...    I hope to recruit people that seem to know both Lisp and Prolog languages.

       The main purpose is this impl is it to run prolog-in-lisp 1000x  faster than the fastest lisps (like SBCL)
    Be at least in the top 3 impls for speed …   Also the type of lisp programs I like to run (SWALE, DAYDREAMER) are buggy partial impl of Greenspun's rule as applied to Prolog (Instead of Lisp)

- Douglas Miles

Where star scientists choose to locate: the impact of US state taxes

$
0
0

The impact of state taxes on the ability of different parts of the United States to attract firms and jobs is prominent in public policy debates. Many states routinely advertise their favourable tax environments with the explicit goal of attracting workers and business activity to their jurisdiction.

For example, between 2012 and 2014, Texas ran TV ads in California, Illinois and New York urging businesses and high-income taxpayers to relocate. Governor Rick Perry visited dozens of California companies to pitch his state’s low taxes, famously declaring: ‘Texas rewards success with no state income tax.’

Similarly, Kansas has paid for billboards in Mid-Western states to advertise its recent tax cuts. Wisconsin Governor Scott Walker has called on employers in Illinois and Minnesota to ‘escape to Wisconsin’. And Indiana and Louisiana have followed similar strategies.

Variations in personal and business tax rates

Despite the attention of policymakers and voters, there is little systematic evidence on the effect of state taxes. Economic research on taxes and the labour market has tended to focus mainly on how taxes affect labour supply; by and large, it ignores how they might affect the location decisions of workers and firms.

This paucity of evidence is surprising given the enormous geographical variations in personal taxes, particularly for high earners (see Figure 1). For example, in 2010, the average tax rates facing a taxpayer with income at the 99th percentile of the national income distribution were 8.1% in California, 7.7% in Maine and 9.1% in Oregon. By contrast, Florida, Texas, Washington and six other states had no state income tax at all.

There are also big differences in business taxes (see Figure 2). For example, in 2010, Iowa, Minnesota and Pennsylvania had corporate income tax rates of 12%, 9.8% and 9.99% respectively, while Nevada, Washington and three other states had no corporate tax.

Tax rates not only vary considerably across states but also within states over time. Given the ease with which US workers and firms can relocate, these differences over time and place could have significant effects on the geographical allocation of highly skilled workers and employers across the country.

Figure 1. State average tax rate at 99th income percentile, 2010

image003

Note: The figure shows each US state’s individual income average tax rate, excluding federal taxes, in 2010, calculated for a taxpayer with income at the 99th percentile of the national income distribution.

Figure 2. Average tax rate – corporate income, 2010

image005

Location decisions of star scientists

Our work seeks to quantify the sensitivity of high-skilled workers to differences in personal and business taxes across US states. We focus on star scientists, defined as those with patent counts in the top 5% of the distribution. They are important for at least two reasons:

  • First, star scientists earn high incomes: most of them are likely to be in the top 1% of the income distri­bution. By definition, they are exceptionally productive. By studying them, we hope to shed light on the location decisions of other well-educated, highly pro­ductive, high-income workers.
  • Second, the presence of star scientists has potentially large consequences for local job creation. Unlike professional athletes, movie stars and rich heirs, star sci­entists are typically associated with research and produc­tion facilities and, in some cases, with entire industries.

Using data on the universe of US patents filed between 1976 and 2010, we identify these scientists’ state of residence and compute bilateral migration flows for every pair of states for every year. We then relate bilateral out-migration to the differential between the destination and origin state in personal and business taxes in each year.

Our empirical analysis uncovers large effects of personal and business taxes on star scientists’ migration patterns. The probability of moving from an origin state to a destination state increases when the ‘net-of-tax rate’ (after-tax income) in the latter increases relative to the former.

Figure 3 shows this graphically. Each panel plots out-migration (measured as the log of the ratio of out-migrants to non-movers) against the net-of-tax rate (which is simply one minus the tax rate, thereby representing the share of a dollar’s income that is retained after taxes). The data underlying the figures represent changes in out-migration and changes in net-of-tax rates relative to their average levels over 1977-2000.

Figure 3. Outmigration vs. net-of-tax rates

image001

Consistent with the hypothesis that workers and firms are deterred by high taxes (and attracted by high after-tax income), we see more out-migration from origin states that have lowered net-of-tax rates (left two panels) and to destination states that have raised net-of-tax rates (middle two panels).

The right two panels show that bilateral migration from a given origin state to a given destination state rises along with increases in the net-of-tax rate differential between the destination state and the origin state. In other words, when the tax differential between two states changes, the migration flow of star scientists between the two states shifts in favour of the state that lowered its tax rate relative to the other.

When the tax differential between two states changes, the migration flow of star scientists shifts to the lower-tax state.

These findings hold for both individual and business tax rates, indicating that the effect reflects both labour supply (individual) and labour demand (business) decisions.

Measuring the size of the effects

We conduct a more formal regression analysis to quantify these effects. For the average tax rate faced by an individual at the 99th percentile of the national income distribution, we find a long-run elasticity of 1.8. This means that a 1% increase in after-tax income in a destination state relative to an origin state is associated with a 1.8% long-run increase in the net flow of star scientists moving from origin state to destination state.

The elasticity of the stock of scientists in a given state to a change in that state’s average tax rate is naturally lower given that the base is larger. To be clear: the flow elasticity implies that if after-tax income in a state increases by 1% due to a cut in personal income taxes, the stock of scientists in the state experiences a percentage increase of 0.4% per year until relative taxes change again.

We find a similar elasticity for state corporate income taxes as well as the investment tax credit (in the opposite direction), while the elasticity for the research and development (R&D) credit rate is smaller. In all, our estimates suggest that both the supply and demand for star scientists are highly sensitive to state taxes.

We cannot rule out that our estimates are biased by unobserved shocks to the demand or supply of scientists, but the weight of the evidence lends credibility to our esti­mates:

  • First, when we focus on the timing of the effects, we find that changes in mobility follow changes in taxes, rather than preceding them. The effect on mobility tends to grow over time, presumably because it takes time for firms and workers to relocate.
  • Second, we find no evidence that changes in state taxes are correlated with changes in the fortunes of the innovation sector in the years leading up to the tax change, suggesting that states do not strategically change taxes to help local patenters at times when they are struggling (or thriving).

It is still possible that changes in economic policies other than taxes could be correlated with taxes. For example, a pro-business state legislature could both cut taxes and relax state-level regulations on labour and the environment. It is also possible that states tend to raise personal income taxes during local recessions, which also affect mobility.

But our estimated elasticities do not change when we control for differences in the local business cycle and differences in time-varying policies across origin or destination states.

Testing the validity of the results

We conduct a number of additional tests to check the validity of our estimates:

  • First, star scientists are likely to be among the top earners in a state. Thus, if our approach is valid, we should see that their loca­tion decisions are more sensitive to changes in tax rates for high-income brackets than for middle-income brackets. Consistent with our assumption, we find that migration flows of star scientists are sensitive to chang­es in the 99th percentile marginal tax rate but insensitive to changes in the 50th percentile marginal tax rate.
  • Second, corporate taxes should affect the demand for scientists in the private sector but not for aca­demic or government scientists. Indeed, we find that the effect of corporate income taxes is concentrated among inventors in the private sector. In addition, while individual inventors are not subject to corporate taxes, they can take advantage of R&D credits. We find that individual inventors are not sensitive to corporate taxes but they are sensitive to R&D tax credits.

Individual inventors are not sensitive to corporate taxes but they are sensitive to R&D tax credits.

  • Third, corporate taxes should only matter in states where the wage bill has a non-trivial weight in the state’s statutory formula for apportioning multi-state income. Empirically, corporate taxes have no effect on star scientists’ migration in states that apportion a firm’s income based only or primarily on sales, in which case the location of labour has little or no effect on the tax bill.

Conclusion

Overall, we conclude that state taxes have a significant effect on the location of star scientists. While many fac­tors determine where innovative individuals and companies decide to locate, enough firms and workers are at the margin that relative taxes do matter. Local policy-makers would do well to consider this previously unrecognized cost of high taxes when deciding whom, and how much, to tax.

This column summarizes ‘The Effect of State Taxes on the Geographical Location of Top Earners: Evidence from Star Scientists’ by Enrico Moretti (University of California, Berkeley) and Daniel J. Wilson (Federal Reserve Bank of San Francisco), published in the American Economic Review in 2017.

Show HN: GDH – Generalized Diffie-Hellman key exchange Java implementation

$
0
0

README.md

Travis CI
Quality Gate
Code Coverage

A Diffie-Hellman key exchange library for multiple parties built on top of the asynchronous, event-driven Vert.x framework.

Diffie-Hellman has been the de-facto standard for key exchange for many years. Two parties who want to communicate on an insecure channel, can use it to generate symmetric keys, and encrypt the messages between them. Diffie-Hellman (or derivatives of it, e.g. Elliptic Curve Diffie-Hellman) is commonly used in many authentication protocols and confidential tunneling schemes such as SSL/TLS, SSHv2, SNMPv3, and many more. The most common and general scenario for the use of Diffie-Hellman is two parties that want to exchange messages over an insecure network. Common use-cases are client to web-server or peer-to-peer file-sharing communication. However, the case where multiple parties need to share a secret key is rarely addressed. Such cases may arise in complex distributed systems where participants are located on different machines, and need to communicate with each other directly, rather than through one central entity. Instead of generating a secret key for each pair of participants, it is possible to generate a single secret key shared by all participants, in a manner which is resistable to eavesdropping and Man-In-The-Middle attacks. This is where Generalized Diffie-Hellman comes in.

The following sequence diagram illustrates how the key exchange is performed. At first, two large numbers are distributed among the participants in plaintext. These numbers are the cyclic group generator (g) and a large prime(N). Then the participants come up with their secret numbers (a,b,c) which they do not reveal to anyone. They then begin a series transactions at the end of which, they can each calculate the same secret key, without it ever being transmitted on the wire. In old-style Diffie-Hellman we would have 3 different keys produced, one per each couple of participants. This scheme can be performed for any number of participants. The number of messages needed for N participants to complete a key exchange is N(N-1).

Written in Java 8.

Built with Gradle.

The basic usage of the library is spinning up verticles and initiating a key exchange between them. Once you have the key you can start encrypting/decrypting messages safely between the verticles. Note this library only provides a key exchange platform and utility methods for encryption/decryption. The network layer (e.g messaging protocol) must be implemented by the user.

The basic object used for deploying and undeploying verticles is the PrimaryVertex.

PrimaryVertex pv =newPrimaryVertex();

The verticle object participating in the key exchange is the GDHVertex. Let's define our first GDHVertex and call it activeVertex as it will be the one who initiates key exchanges. All other verticles will be passive.

GDHVertex activeVertex =newGDHVertex();

Define a Configuration for the verticle:

Configuration config =newConfiguration();// add parameters to the Configuration
config.setIP("localhost").setPort("5000").setRetries(5).setLogLevel(Level.OFF);// assign the configuration to the verticle
activeVertex.setConfiguration(config);

Now let's define another verticle to participate in the key exchange.

GDHVertex passiveVertex =newGDHVertex();Configuration config2 =newConfiguration();
config2.setIP("localhost").setPort("5001").setExchangeTimeout(5000).setLogLevel(Level.OFF);
passiveVertex.setConfiguration(config2);

Once we have all participants defined, we can go ahead and form a group with the Configuration of one of the verticles. The id of the group is determined by its nodes, so if you construct 2 groups with the same nodes it will essentially be the same group.

Group g =newGroup(config,newNode("localhost","5000"),newNode("localhost","5001"));

Now it's all set up and you can run the verticles and initiate a key exchange. The most important rule when developing with Vert.x (or any asynchronous platform) is DO NOT BLOCK THE EVENT LOOP! So remember not to perform blocking operations inside the asynchronous calls.

pv.run(passiveVertex,deployment1 -> {if (deployment1.succeeded()) {
        pv.run(activeVertex,deployment2 -> {if (deployment2.succeeded()) {
        		activeVertex.exchange(g.getGroupId(), exchange -> {if (exchange.succeeded()) {// the key is available in this context and also later as a Future objectSystem.out.println("Got new key: "+ exchange.result());
        			}else {System.out.println("Error exchanging!");
        			}
        		}
        	}else {System.out.println("Error deploying!");
        	}
        }
    }else {System.out.println("Error deploying!");
    }
}        	

You can also use blocking code for key exchange:

pv.run(passiveVertex,deployment1 -> {if (deployment1.succeeded()) {
        pv.run(activeVertex,deployment2 -> {if (deployment2.succeeded()) {// get the key as a Future. Do not block inside the asynchronous callCompletableFuture<BigInteger> futureKey = activeVertex.exchange(g.getGroupId());
            }else {System.out.println("Error deploying!");
            }
        }
    }else {System.out.println("Error deploying!");
    }
}           

You can even use blocking code for the deployments. The verticle which initiates key exchanges should still be deployed using an asynchronous call (Otherwise you have to busy wait on it with a while loop!). All other nodes will participate in the exchange once they are up and running.

pv.run(activeVertex,deployment1 -> {if (deployment1.succeeded()) {
        pv.run(passiveVertex);// get the key as a Future. Do not block inside the asynchronous callCompletableFuture<BigInteger> futureKey = activeVertex.exchange(g.getGroupId());
    }else {System.out.println("Error deploying!");
    }
} 

At any point you can access the exchanged key as a CompletableFuture object from any verticle. This object is a representation of the key. The actual key might not be available at this moment in time, but will be made available as soon as the exchange finishes. Here are just a handful of options you have with the CompletableFuture:

CompletableFuture<BigInteger> key = passiveVertex.getKey(g.getGroupId());// Wait for the key exchange to complete and get the final keyBigInteger fin = key.get();// Wait for the key for a bounded time and throw Exception if this time is exceededBigInteger fin = key.get(1000, TimeUnit.MILLISECONDS);// Get the key immediately. If it's not available return the default value given as a parameter (null)BigInteger fin = key.getNow(null);

Don't forget to kill the verticles when you're finished with them. As in the deployment, you can use either asynchronous calls or blocking code:

pv.kill(activeVertex,undeployment1 -> {if (undeployment1.succeeded()) {System.out.println("First undeployment successful!");
		pv.kill(passiveVertex,undeployment2 -> {if (undeployment2.succeeded()) {System.out.println("Second undeployment successful!");
                }else {System.out.println("Error undeploying!");
                }
        }      
	}else {System.out.println("Error undeploying!");
	}
}      

This project is analyzed on Sonarcloud. Every build the code runs through a couple of static code analyzers (PMD and findbugs) to ensure code quality is maintained. Each push to the Github repository triggers a cloud build via TravisCI, which in turn pushes the code into another cloud code analyzer (Sonarcloud). If anything goes wrong during any of these steps the build fails.

The code is tested by both unit tests and integration tests. The integration testing involves actual spinning up of verticles, performing exchanges and checking the correctness and security of the transactions. Testing must cover at least 80% of the code, otherwise the quality gate of Sonarcloud fails.

Published under the MIT License. This basically means the software is free and anyone can use it however they wish. No liability or warranty.


Portuguese trawler nets 'prehistoric shark'

$
0
0
Frilled shark caught off Portuguese coastImage copyrightSIC Noticias
Image caption Nasty big pointy teeth

Portuguese scientists have captured a "shark from the age of the dinosaurs" off the Algarve coast.

Researchers caught the rare frilled shark aboard a trawler, where they were working on a European Union project to "minimise unwanted catches in commercial fishing", Sic Noticias TV reports.

The scientists from the country's Institute for the Sea and Atmosphere dubbed the shark a "living fossil" because remains have been dated back 80 million years, making it one of very few species of such antiquity still around today.

The Institute said the male fish measured 1.5 metres (5ft) in length and was caught at a depth of 700 metres (2,300 ft) in waters off the resort of Portimao.

The shark, which has a long, slim, snake-like body, is "little known in terms of its biology or environment", according to the scientists, because it lives at great depths in the Atlantic and off the coasts of Australia, New Zealand and Japan.

It is rarely caught, and even then examples do not often make it to research laboratories. There is also little footage of the shark in its natural habitat.

Professor Margarida Castro of the University of the Algarve told Sic Noticias that the shark gets its name from the frilled arrangement of its 300 teeth, "which allows it to trap squid, fish and other sharks in sudden lunges".

The reporter dubbed it a "monster of the deep", and it is true that Samuel Garman, the first scientist to study the frilled shark, thought its snake-like movements may have inspired sailors' stories of sea serpents.

Image copyrightSIC Noticias
Image caption Inspiration for sea serpents?

Reporting by Martin Morgan

Next story: Russian scientists take aim at paranormal TV shows

Use #NewsfromElsewhere to stay up-to-date with our reports via Twitter.

Security Breach and Spilled Secrets Have Shaken the N.S.A.

$
0
0

With a leak of intelligence methods like the N.S.A. tools, Mr. Panetta said, “Every time it happens, you essentially have to start over.”

Fifteen months into a wide-ranging investigation by the agency’s counterintelligence arm, known as Q Group, and the F.B.I., officials still do not know whether the N.S.A. is the victim of a brilliantly executed hack, with Russia as the most likely perpetrator, an insider’s leak, or both. Three employees have been arrested since 2015 for taking classified files, but there is fear that one or more leakers may still be in place. And there is broad agreement that the damage from the Shadow Brokers already far exceeds the harm to American intelligence done by Edward J. Snowden, the former N.S.A. contractor who fled with four laptops of classified material in 2013.

Mr. Snowden’s cascade of disclosures to journalists and his defiant public stance drew far more media coverage than this new breach. But Mr. Snowden released code words, while the Shadow Brokers have released the actual code; if he shared what might be described as battle plans, they have loosed the weapons themselves. Created at huge expense to American taxpayers, those cyberweapons have now been picked up by hackers from North Korea to Russia and shot back at the United States and its allies.

Photo
A screenshot taken as ransomware affected systems worldwide last summer. The Ukrainian government posted the picture to its official Facebook page.

Millions of people saw their computers shut down by ransomware, with demands for payments in digital currency to have their access restored. Tens of thousands of employees at Mondelez International, the Oreo cookie maker, had their data completely wiped. FedEx reported that an attack on a European subsidiary had halted deliveries and cost $300 million. Hospitals in Pennsylvania, Britain and Indonesia had to turn away patients. The attacks disrupted production at a car plant in France, an oil company in Brazil and a chocolate factory in Tasmania, among thousands of enterprises affected worldwide.

American officials had to explain to close allies — and to business leaders in the United States — how cyberweapons developed at Fort Meade in Maryland, came to be used against them. Experts believe more attacks using the stolen N.S.A. tools are all but certain.

Inside the agency’s Maryland headquarters and its campuses around the country, N.S.A. employees have been subjected to polygraphs and suspended from their jobs in a hunt for turncoats allied with the Shadow Brokers. Much of the agency’s cyberarsenal is still being replaced, curtailing operations. Morale has plunged, and experienced cyberspecialists are leaving the agency for better-paying jobs — including with firms defending computer networks from intrusions that use the N.S.A.’s leaked tools.

“It’s a disaster on multiple levels,” Mr. Williams said. “It’s embarrassing that the people responsible for this have not been brought to justice.”

In response to detailed questions, an N.S.A. spokesman, Michael T. Halbig, said the agency “cannot comment on Shadow Brokers.” He denied that the episode had hurt morale. “N.S.A. continues to be viewed as a great place to work; we receive more than 140,000 applications each year for our hiring program,” he said.

Compounding the pain for the N.S.A. is the attackers’ regular online public taunts, written in ersatz broken English. Their posts are a peculiar mash-up of immaturity and sophistication, laced with profane jokes but also savvy cultural and political references. They suggest that their author — if not an American — knows the United States well.

“Is NSA chasing shadowses?” the Shadow Brokers asked in a post on Oct. 16, mocking the agency’s inability to understand the leaks and announcing a price cut for subscriptions to its “monthly dump service” of stolen N.S.A. tools. It was a typically wide-ranging screed, touching on George Orwell’s “1984”; the end of the federal government’s fiscal year on Sept. 30; Russia’s creation of bogus accounts on Facebook and Twitter; and the phenomenon of American intelligence officers going to work for contractors who pay higher salaries.

Photo
The Shadow Brokers have mocked the N.S.A. in regular online posts and released its stolen hacking tools in a “monthly dump service.”

One passage, possibly hinting at the Shadow Brokers’ identity, underscored the close relationship of Russian intelligence to criminal hackers. “Russian security peoples,” it said, “is becoming Russian hackeres at nights, but only full moons.”

Russia is the prime suspect in a parallel hemorrhage of hacking tools and secret documents from the C.I.A.’s Center for Cyber Intelligence, posted week after week since March to the WikiLeaks website under the names Vault7 and Vault8. That breach, too, is unsolved. Together, the flood of digital secrets from agencies that invest huge resources in preventing such breaches is raising profound questions.

Have hackers and leakers made secrecy obsolete? Has Russian intelligence simply outplayed the United States, penetrating the most closely guarded corners of its government? Can a work force of thousands of young, tech-savvy spies ever be immune to leaks?

Some veteran intelligence officials believe a lopsided focus on offensive cyberweapons and hacking tools has, for years, left American cyberdefense dangerously porous.

“We have had a train wreck coming,” said Mike McConnell, the former N.S.A. director and national intelligence director. “We should have ratcheted up the defense parts significantly.”

America’s Cyber Special Forces

At the heart of the N.S.A. crisis is Tailored Access Operations, the group where Mr. Williams worked, which was absorbed last year into the agency’s new Directorate of Operations.

Photo
The N.S.A.’s headquarters at Fort Meade in Maryland. Cybertools the agency developed have been picked up by hackers from North Korea to Russia and shot back at the United States and its allies.Credit Jim Lo Scalzo/European Pressphoto Agency

T.A.O. — the outdated name is still used informally — began years ago as a side project at the agency’s research and engineering building at Fort Meade. It was a cyber Skunk Works, akin to the special units that once built stealth aircraft and drones. As Washington’s need for hacking capabilities grew, T.A.O. expanded into a separate office park in Laurel, Md., with additional teams at facilities in Colorado, Georgia, Hawaii and Texas.

The hacking unit attracts many of the agency’s young stars, who like the thrill of internet break-ins in the name of national security, according to a dozen former government officials who agreed to describe its work on the condition of anonymity. T.A.O. analysts start with a shopping list of desired information and likely sources — say, a Chinese official’s home computer or a Russian oil company’s network. Much of T.A.O.’s work is labeled E.C.I., for “exceptionally controlled information,” material so sensitive it was initially stored only in safes. When the cumulative weight of the safes threatened the integrity of N.S.A.’s engineering building a few years ago, one agency veteran said, the rules were changed to allow locked file cabinets.

The more experienced T.A.O. operators devise ways to break into foreign networks; junior operators take over to extract information. Mr. Williams, 40, a former paramedic who served in military intelligence in the Army before joining the N.S.A., worked in T.A.O. from 2008 to 2013, which he described as an especially long tenure. He called the work “challenging and sometimes exciting.”

T.A.O. operators must constantly renew their arsenal to stay abreast of changing software and hardware, examining every Windows update and new iPhone for vulnerabilities. “The nature of the business is to move with the technology,” a former T.A.O. hacker said.

Long known mainly as an eavesdropping agency, the N.S.A. has embraced hacking as an especially productive way to spy on foreign targets. The intelligence collection is often automated, with malware implants — computer code designed to find material of interest — left sitting on the targeted system for months or even years, sending files back to the N.S.A.

The same implant can be used for many purposes: to steal documents, tap into email, subtly change data or become the launching pad for an attack. T.A.O.’s most public success was an operation against Iran called Olympic Games, in which implants in the network of the Natanz nuclear plant caused centrifuges enriching uranium to self-destruct. The T.A.O. was also critical to attacks on the Islamic State and North Korea.

It was this cyberarsenal that the Shadow Brokers got hold of, and then began to release.

Like cops studying a burglar’s operating style and stash of stolen goods, N.S.A. analysts have tried to figure out what the Shadow Brokers took. None of the leaked files date from later than 2013 — a relief to agency officials assessing the damage. But they include a large share of T.A.O.’s collection, including three so-called ops disks — T.A.O.’s term for tool kits — containing the software to bypass computer firewalls, penetrate Windows and break into the Linux systems most commonly used on Android phones.

Evidence shows that the Shadow Brokers obtained the entire tool kits intact, suggesting that an insider might have simply pocketed a thumb drive and walked out.

But other files obtained by the Shadow Brokers bore no relation to the ops disks and seem to have been grabbed at different times. Some were designed for a compromise by the N.S.A. of Swift, a global financial messaging system, allowing the agency to track bank transfers. There was a manual for an old system code-named UNITEDRAKE, used to attack Windows. There were PowerPoint presentations and other files not used in hacking, making it unlikely that the Shadow Brokers had simply grabbed tools left on the internet by sloppy N.S.A. hackers.

Photo
After 15 months of investigation, officials still do not know what was behind the Shadow Brokers disclosures — a hack, with Russia as the most likely perpetrator, an insider’s leak, or both.

Some officials doubt that the Shadow Brokers got it all by hacking the most secure of American government agencies — hence the search for insiders. But some T.A.O. hackers think that skilled, persistent attackers might have been able to get through the N.S.A.’s defenses — because, as one put it, “I know we’ve done it to other countries.”

The Shadow Brokers have verbally attacked certain cyberexperts, including Mr. Williams. When he concluded from their Twitter hints that they knew about some of his hacks while at the N.S.A., he canceled a business trip to Singapore. The United States had named and criminally charged hackers from the intelligence agencies of China, Iran and Russia. He feared he could be similarly charged by a country he had targeted and arrested on an international warrant.

He has since resumed traveling abroad. But he says no one from the N.S.A. has contacted him about being singled out publicly by the Shadow Brokers.

“That feels like a betrayal,” he said. “I was targeted by the Shadow Brokers because of that work. I do not feel the government has my back.”

The Hunt for an Insider

For decades after its creation in 1952, the N.S.A. — No Such Agency, in the old joke — was seen as all but leakproof. But since Mr. Snowden flew away with hundreds of thousands of documents in 2013, that notion has been shattered.

The Snowden trauma led to the investment of millions of dollars in new technology and tougher rules to counter what the government calls the insider threat. But N.S.A. employees say that with thousands of employees pouring in and out of the gates, and the ability to store a library’s worth of data in a device that can fit on a key ring, it is impossible to prevent people from walking out with secrets.

The agency has active investigations into at least three former N.S.A. employees or contractors. Two had worked for T.A.O.: a still publicly unidentified software developer secretly arrested after taking hacking tools home in 2015, only to have Russian hackers lift them from his home computer; and Harold T. Martin III, a contractor arrested last year when F.B.I. agents found his home, garden shed and car stuffed with sensitive agency documents and storage devices he had taken over many years when a work-at-home habit got out of control, his lawyers say. The third is Reality Winner, a young N.S.A. linguist arrested in June, who is charged with leaking to the news site The Intercept a single classified report on a Russian breach of an American election systems vendor.

Mr. Martin’s gargantuan collection of stolen files included much of what the Shadow Brokers have, and he has been scrutinized by investigators as a possible source for them. Officials say they do not believe he deliberately supplied the material, though they have examined whether he might have been targeted by thieves or hackers.

But according to former N.S.A. employees who are still in touch with active workers, investigators of the Shadow Brokers thefts are clearly worried that one or more leakers may still be inside the agency. Some T.A.O. employees have been asked to turn over their passports, take time off their jobs and submit to questioning. The small number of cyberspecialists who have worked both at T.A.O. and at the C.I.A. have come in for particular attention, out of concern that a single leaker might be responsible for both the Shadow Brokers and the C.I.A.’s Vault7 breaches.

Then there are the Shadow Brokers’ writings, which betray a seeming immersion in American culture. Last April, about the time Mr. Williams was discovering their inside knowledge of T.A.O. operations, the Shadow Brokers posted an appeal to President Trump: “Don’t Forget Your Base.” With the ease of a seasoned pundit, they tossed around details about Stephen K. Bannon, the president’s now departed adviser; the Freedom Caucus in Congress; the “deep state”; the Alien and Sedition Acts; and white privilege.

“TheShadowBrokers is wanting to see you succeed,” the post said, addressing Mr. Trump. “TheShadowBrokers is wanting America to be great again.”

The mole hunt is inevitably creating an atmosphere of suspicion and anxiety, former employees say. While the attraction of the N.S.A. for skilled cyberoperators is unique — nowhere else can they hack without getting into legal trouble — the boom in cybersecurity hiring by private companies gives T.A.O. veterans lucrative exit options.

The New York Times would like to hear from readers who want to share messages and materials with our journalists.

Young T.A.O. hackers are lucky to make $80,000 a year, while those who leave routinely find jobs paying well over $100,000, cybersecurity specialists say. For many workers, the appeal of the N.S.A’s mission has been more than enough to make up the difference. But over the past year, former T.A.O. employees say an increasing number of former colleagues have called them looking for private-sector work, including “graybeards” they thought would be N.S.A. lifers.

“Snowden killed morale,” another T.A.O. analyst said. “But at least we knew who he was. Now you have a situation where the agency is questioning people who have been 100 percent mission-oriented, telling them they’re liars.”

Because the N.S.A. hacking unit has grown so rapidly over the past decade, the pool of potential leakers has expanded into the hundreds. Trust has eroded as anyone who had access to the leaked code is regarded as the potential culprit.

Some agency veterans have seen projects they worked on for a decade shut down because implants they relied on were dumped online by the Shadow Brokers. The number of new operations has declined because the malware tools must be rebuilt. And no end is in sight.

“How much longer are the releases going to come?” a former T.A.O. employee asked. “The agency doesn’t know how to stop it — or even what ‘it’ is.”

One N.S.A. official who almost saw his career ended by the Shadow Brokers is at the very top of the organization: Adm. Michael S. Rogers, director of the N.S.A. and commander of its sister military organization, United States Cyber Command. President Barack Obama’s director of national intelligence, James R. Clapper Jr., and defense secretary, Ashton B. Carter, recommended removing Admiral Rogers from his post to create accountability for the breaches.

But Mr. Obama did not act on the advice, in part because Admiral Rogers’ agency was at the center of the investigation into Russia’s interference in the 2016 election. Mr. Trump, who again on Saturday disputed his intelligence agencies’ findings on Russia and the election, extended the admiral’s time in office. Some former intelligence officials say they are flabbergasted that he has been able to hold on to his job.

A Shadow War With Russia?

Lurking in the background of the Shadow Brokers investigation is American officials’ strong belief that it is a Russian operation. The pattern of dribbling out stolen documents over many months, they say, echoes the slow release of Democratic emails purloined by Russian hackers last year.

But there is a more specific back story to the United States-Russia cyber rivalry.

Starting in 2014, American cybersecurity researchers who had been tracking Russia’s state-sponsored hacking groups for years began to expose them in a series of research reports. American firms, including Symantec, CrowdStrike and FireEye, reported that Moscow was behind certain cyberattacks and identified government-sponsored Russian hacking groups.

Photo
The Moscow headquarters of Kaspersky Lab, a Russian cybersecurity firm that hunted for N.S.A. malware.Credit Kirill Kudryavtsev/Agence France-Presse — Getty Images

In the meantime, Russia’s most prominent cybersecurity firm, Kaspersky Lab, had started work on a report that would turn the tables on the United States. Kaspersky hunted for the spying malware planted by N.S.A. hackers, guided in part by the keywords and code names in the files taken by Mr. Snowden and published by journalists, officials said.

Kaspersky was, in a sense, simply doing to the N.S.A. what the American companies had just done to Russian intelligence: Expose their operations. And American officials believe Russian intelligence was piggybacking on Kaspersky’s efforts to find and retrieve the N.S.A.’s secrets wherever they could be found. The T.A.O. hackers knew that when Kaspersky updated its popular antivirus software to find and block the N.S.A. malware, it could thwart spying operations around the world.

So T.A.O. personnel rushed to replace implants in many countries with new malware they did not believe the Russian company could detect.

In February 2015, Kaspersky published its report on the Equation Group — the company’s name for T.A.O. hackers — and updated its antivirus software to uproot the N.S.A. malware wherever it had not been replaced. The agency temporarily lost access to a considerable flow of intelligence. By some accounts, however, N.S.A. officials were relieved that the Kaspersky report did not include certain tools they feared the Russian company had found.

As it would turn out, any celebration was premature.

On Aug. 13 last year, a new Twitter account using the Shadow Brokers’ name announced with fanfare an online auction of stolen N.S.A. hacking tools.

“We hack Equation Group,” the Shadow Brokers wrote. “We find many many Equation Group cyber weapons.”

Inside the N.S.A., the declaration was like a bomb exploding. A zip file posted online contained the first free sample of the agency’s hacking tools. It was immediately evident that the Shadow Brokers were not hoaxsters, and that the agency was in trouble.

The leaks have renewed a debate over whether the N.S.A. should be permitted to stockpile vulnerabilities it discovers in commercial software to use for spying — rather than immediately alert software makers so the holes can be plugged. The agency claims it has shared with the industry more than 90 percent of flaws it has found, reserving only the most valuable for its own hackers. But if it can’t keep those from leaking, as the last year has demonstrated, the resulting damage to businesses and ordinary computer users around the world can be colossal. The Trump administration says it will soon announce revisions to the system, making it more transparent.

Mr. Williams said it may be years before the “full fallout” of the Shadow Brokers breach is understood. Even the arrest of whoever is responsible for the leaks may not end them, he said — because the sophisticated perpetrators may have built a “dead man’s switch” to release all remaining files automatically upon their arrest.

“We’re obviously dealing with people who have operational security knowledge,” he said. “They have the whole law enforcement system and intelligence system after them. And they haven’t been caught.”

Continue reading the main story

Quantum magic: A skeptical perspective (2011)

$
0
0
Abstract: Quantum mechanics (QM) has attracted a considerable amount of mysticism, in public opinion and even among academic researches, due to some of its conceptually puzzling features, such as the modification of reality by the observer and entanglement.
We argue that many popular "quantum paradoxes" stem from a confusion between mathematical formalism and physics; We demonstrate this by explaining how the paradoxes go away once a different formalism, usually inconvenient to perform calculations, is used. we argue that some modern developments, well-studied in the research literature but generally overlooked by both popular science and teaching-level literature, make quantum mechanics (that is, "canonical" QM, not extensions of it) less conceptually problematic than it looks at first sight.
When all this is looked at together, most "conceptual puzzles" of QM are not much different from the well-known paradoxes from probability theory. Consequently, "explanations of QM" involving physical action of consciouses or an infinity of universes are conceptually unnecessary
Comments:This article, written as a result of many debates with academic colleagues and non-academic friends, expresses the author's view of quantum mechanics and its interpretation. Any suggestions of where to submit it for publication would be much appreciated, please contact me by email
Subjects:History and Philosophy of Physics (physics.hist-ph); Popular Physics (physics.pop-ph)
Cite as: arXiv:1107.3800 [physics.hist-ph]
 (or arXiv:1107.3800v2 [physics.hist-ph] for this version)
From: Giorgio Torrieri [view email]
[v1] Tue, 19 Jul 2011 18:43:53 GMT (26kb)
[v2] Wed, 30 Nov 2011 15:53:12 GMT (31kb)

A Visual Guide to Evolution Strategies

$
0
0

Survival of the fittest.

In this post I explain how evolution strategies (ES) work with the aid of a few visual examples. I try to keep the equations light, and I provide links to original articles if the reader wishes to understand more details. This is the first post in a series of articles, where I plan to show how to apply these algorithms to a range of tasks from MNIST, OpenAI Gym, Roboschool to PyBullet environments.

Introduction

Neural network models are highly expressive and flexible, and if we are able to find a suitable set of model parameters, we can use neural nets to solve many challenging problems. Deep learning’s success largely comes from the ability to use the backpropagation algorithm to efficiently calculate the gradient of an objective function over each model parameter. With these gradients, we can efficiently search over the parameter space to find a solution that is often good enough for our neural net to accomplish difficult tasks.

However, there are many problems where the backpropagation algorithm cannot be used. For example, in reinforcement learning (RL) problems, we can also a train a neural network to make decisions to perform a sequence of actions to accomplish some task in an environment. However, it is not trivial to estimate the gradient of reward signals given to the agent in the future to an action performed by the agent right now, especially if the reward is realised many timesteps in the future. Even if we are able to calculate accurate gradients, there is also the issue of being stuck in a local optimum, which exists many for RL tasks.

Stuck in a local optimum.

A whole area within RL is devoted to studying this credit-assignment problem, and great progress has been made in recent years. However, credit assignment is still difficult when the reward signals are sparse. In the real world, rewards can be sparse and noisy. Sometimes we are given just a single reward, like a bonus check at the end of the year, and depending on our employer, it may be difficult to figure out exactly why it is so low. For these problems, rather than rely on a very noisy and possibly meaningless gradient estimate of the future to our policy, we might as well just ignore any gradient information, and attempt to use black-box optimisation techniques such as genetic algorithms (GA) or ES.

OpenAI published a paper called Evolution Strategies as a Scalable Alternative to Reinforcement Learning where they showed that evolution strategies, while being less data efficient than RL, offer many benefits. The ability to abandon gradient calculation allows such algorithms to be evaluated more efficiently. It is also easy to distribute the computation for an ES algorithm to thousands of machines for parallel computation. By running the algorithm from scratch many times, they also showed that policies discovered using ES tend to be more diverse compared to policies discovered by RL algorithms.

I would like to point out that even for the problem of identifying a machine learning model, such as designing a neural net’s architecture, is one where we cannot directly compute gradients. While RL, Evolution, GA etc., can be applied to search in the space of models, as well as their model parameters for tackling certain problems, in this post, I will focus only on applying these algorithms to search for parameters of a pre-defined model.

What is an Evolution Strategy?


Two-dimensional Rastrigin function has many local optima (Source: Wikipedia).

The diagrams below are top-down plots of shifted 2D Schaffer and Rastrigin functions, two of several simple toy problems used for testing continuous black-box optimisation algorithms. Lighter regions of the plots represent higher values of . As you can see, there are many local optimums in this function. Our job is to find a set of model parameters , such that is close as possible to the global maximum.

Although there are many definitions of evolution strategies, we can define an evolution strategy as an algorithm that provides the user a set of candidate solutions to evaluate a problem. The evaluation is based on an objective function that takes a given solution and returns a single fitness value. Based on the fitness results of the current solutions, the algorithm will then produce the next generation of candidate solutions that is more likely to produce even better results than the current generation. The iterative process will stop once the best known solution is satisfactory for the user.

Given an evolution strategy algorithm called EvolutionStrategy, we can use in the following way:


solver = EvolutionStrategy()

while True:

  # ask the ES to give us a set of candidate solutions
  solutions = solver.ask()

  # create an array to hold the fitness results.
  fitness_list = np.zeros(solver.popsize)

  # evaluate the fitness for each given solution.
  for i in range(solver.popsize):
    fitness_list[i] = evaluate(solutions[i])

  # give list of fitness results back to ES
  solver.tell(fitness_list)

  # get best parameter, fitness from ES
  best_solution, best_fitness = solver.result()

  if best_fitness > MY_REQUIRED_FITNESS:
    break


Although the size of the population is usually held constant for each generation, they don’t need to be. The ES can generate as many candidate solutions as we want, because the solutions produced by an ES are sampled from a distribution whose parameters are being updated by the ES at each generation. I will explain this sampling process with an example of a simple evolution strategy.

Simple Evolution Strategy

One of the simplest evolution strategy we can imagine will just sample a set of solutions from a Normal distribution, with a mean and a fixed standard deviation . In our 2D problem, and . Initially, is set at the origin. After the fitness results are evaluated, we set to the best solution in the population, and sample the next generation of solutions around this new mean. This is how the algorithm behaves over 20 generations on the two problems mentioned earlier:

In the visualization above, the green dot indicates the mean of the distribution at each generation, the blue dots are the sampled solutions, and the red dot is the best solution found so far by our algorithm.

This simple algorithm will generally only work for simple problems. Given its greedy nature, it throws away all but the best solution, and can be prone to be stuck at a local optimum for more complicated problems. It would be beneficial to sample the next generation from a probability distribution that represents a more diverse set of ideas, rather than just from the best solution from the current generation.

Simple Genetic Algorithm

One of the oldest black-box optimisation algorithms is the genetic algorithm. There are many variations with many degrees of sophistication, but I will illustrate the simplest version here.

The idea is quite simple: keep only 10% of the best performing solutions in the current generation, and let the rest of the population die. In the next generation, to sample a new solution is to randomly select two solutions from the survivors of the previous generation, and recombine their parameters to form a new solution. This crossover recombination process uses a coin toss to determine which parent to take each parameter from. In the case of our 2D toy function, our new solution might inherit or from either parents with 50% chance. Gaussian noise with a fixed standard deviation will also be injected into each new solution after this recombination process.

The figure above illustrates how the simple genetic algorithm works. The green dots represent members of the elite population from the previous generation, the blue dots are the offsprings to form the set of candidate solutions, and the red dot is the best solution.

Genetic algorithms help diversity by keeping track of a diverse set of candidate solutions to reproduce the next generation. However, in practice, most of the solutions in the elite surviving population tend to converge to a local optimum over time. There are more sophisticated variations of GA out there, such as CoSyNe, ESP, and NEAT, where the idea is to cluster similar solutions in the population together into different species, to maintain better diversity over time.

Covariance-Matrix Adaptation Evolution Strategy (CMA-ES)

A shortcoming of the both the Simple ES and Simple GA is that our standard deviation noise parameter is fixed. There are times when we want to explore more and increase the standard deviation of our search space, and there are times when we are confident we are close to a good optima and just want to fine tune the solution. We basically want our search process to behave like this:

Amazing isn’it it? The search process shown in the figure above is produced by Covariance-Matrix Adaptation Evolution Strategy (CMA-ES). CMA-ES an algorithm that can take the results of each generation, and adaptively increase or decrease the search space for the next generation. It will not only adapt for the mean and sigma parameters, but will calculate the entire covariance matrix of the parameter space. At each generation, CMA-ES provides the parameters of a multi-variate normal distribution to sample solutions from. So how does it know how to increase or decrease the search space?

Before we discuss its methodology, let’s review how to estimate a covariance matrix. This will be important to understand CMA-ES’s methodology later on. If we want to estimate the covariance matrix of our entire sampled population of size of , we can do so using the set of equations below to calculate the maximum likelihood estimate of a covariance matrix . We first calculate the means of each of the and in our population:

The terms of the 2x2 covariance matrix will be:

Of course, this resulting mean estimates and , and covariance terms , , will just be an estimate to the actual covariance matrix that we originally sampled from, and not particularly useful to us.

CMA-ES modifies the above covariance calculation formula in a clever way to make it adapt well an optimisation problem. I will go over how it does this step-by-step. Firstly, it focuses on the best solutions in the current generation. For simplicity let’s set to be the best 25% of solutions. After sorting the solutions based on fitness, we calculate the mean of the next generation as the average of only the best 25% of the solutions in current population , i.e.:

Next, we use only the best 25% of the solutions to estimate the covariance matrix of the next generation, but the clever hack here is that it uses the current generation’s , rather than the updated parameters that we had just calculated, in the calculation:

Armed with a set of , , , , and parameters for the next generation , we can now sample the next generation of candidate solutions.

Below is a set of figures to visually illustrate how it uses the results from the current generation to construct the solutions in the next generation :

  1. Calculate the fitness score of each candidate solution in generation .
  2. Isolates the best 25% of the population in generation , in purple.
  3. Using only the best solutions, along with the mean of the current generation (the green dot), calculate the covariance matrix of the next generation.
  4. Sample a new set of candidate solutions using the updated mean and covariance matrix .

Let’s visualize the scheme one more time, on the entire search process on both problems:

Because CMA-ES can adapt both its mean and covariance matrix using information from the best solutions, it can decide to cast a wider net when the best solutions are far away, or narrow the search space when the best solutions are close by. My description of the CMA-ES algorithm for a 2D toy problem is highly simplified to get the idea across. For more details, I suggest reading the CMA-ES Tutorial prepared by Nikolaus Hansen, the author of CMA-ES.

This algorithm is one of the most popular gradient-free optimisation algorithms out there, and has been the algorithm of choice for many researchers and practitioners alike. The only real drawback is the performance if the number of model parameters we need to solve for is large, as the covariance calculation is , although recently there has been approximations to make it . CMA-ES is my algorithm of choice when the search space is less than a thousand parameters. I found it still usable up to ~ 10K parameters if I’m willing to be patient.

Natural Evolution Strategies


Imagine if you had built an artificial life simulator, and you sample a different neural network to control the behavior of each ant inside an ant colony. Using the Simple Evolution Strategy for this task will optimise for traits and behaviours that benefit individual ants, and with each successive generation, our population will be full of alpha ants who only care about their own well-being.

Instead of using a rule that is based on the survival of the fittest ants, what if you take an alternative approach where you take the sum of all fitness values of the entire ant population, and optimise for this sum instead to maximize the well-being of the entire ant population over successive generations? Well, you would end up creating a Marxist utopia.


A perceived weakness of the algorithms mentioned so far is that they discard the majority of the solutions and only keep the best solutions. Weak solutions contain information about what not to do, and this is valuable information to calculate a better estimate for the next generation.

Many people who studied RL are familiar with the REINFORCE paper. In this 1992 paper, Williams outlined an approach to estimate the gradient of the expected rewards with respect to the model parameters of a policy neural network. This paper also proposed using REINFORCE as an Evolution Strategy, in Section 6 of the paper. This special case of REINFORCE-ES was expanded later on in Policy Exploring Policy Gradients (PEPG, 2009) and Natural Evolution Strategies (NES, 2014).

In this approach, we want to use all of the information from each member of the population, good or bad, for estimating a gradient signal that can move the entire population to a better direction in the next generation. Since we are estimating a gradient, we can also use this gradient in a standard SGD update rule typically used for deep learning. We can even use this estimated gradient with Momentum SGD, RMSProp, or Adam if we want to.

The idea to maximize the expected value of the fitness score of a sampled solution. If the expected result is good enough, then the best performing member within a sampled population will be even better, so optimising for the expectation might be a sensible approach. Maximizing the expected fitness score of a sampled solution is almost the same as maximizing the total fitness score of the entire population.

If is a solution vector sampled from a probability distribution function , we can define the expected value of the objective function as:

where are the parameters of the probability distribution function. For example, if is a normal distribution, then would be and . For our simple 2D toy problems, each ensemble is a 2D vector .

The NES paper contains a nice derivation of the gradient of with respect to . Using the same log-likelihood trick as in the REINFORCE algorithm allows us to calculate the gradient of :

In a population size of , where we have solutions , , , we can estimate this gradient as a summation:

With this gradient , we can use a learning rate parameter (such as 0.01) and start optimising the parameters of pdf so that our sampled solutions will likely get higher fitness scores on the objective function . Using SGD (or Adam), we can update for the next generation:

and sample a new set of candidate solutions from this updated pdf, and continue until we arrive at a satisfactory solution.

In Section 6 of the REINFORCE paper, Williams derived closed-form formulas of the gradient , for the special case where is a factored multi-variate normal distribution (i.e., the correlation parameters are zero). In this special case, are the and vectors. Therefore, each element of a solution can sampled from a univariate normal distribution .

The closed-form formulas for , for each individual element of vector on each solution in the population can be derived as:

For clarity, I use the index of , to count across parameter space, and this is not to be confused with superscript , used to count across each sampled member of the population. For our 2D problems, , , , , , in this context.

These two formulas can be plugged back into the approximate gradient formula to derive explicit update rules for and . In the papers mentioned above, they derived more explicit update rules, incorporated a baseline, and introduced other tricks such as antithetic sampling in PEPG, which is what my implementation is based on. NES proposed using the inverse of the Fisher Information Matrix into the gradient update rule. But the concept is basically the same as other ES algorithms, where we update the mean and standard deviation of a multi-variate normal distribution at each new generation, and sample a new set of solutions from the updated distribution. Below is a visualization of this algorithm in action, following the formulas described above:

We see that this algorithm is able to dynamically change the ’s to explore or fine tune the solution space as needed. Unlike CMA-ES, there is no correlation structure in our implementation, so we only don’t get the diagonal ellipse samples, only the vertical or horizontal ones, although in principle we can derive update rules to incorporate the entire covariance matrix if we needed to, at the expense of computational efficiency.

I like this algorithm because like CMA-ES, the ’s can adapt so our search space can be expanded or narrowed over time. Because the correlation parameter is not used in this implementation, the efficiency of the algorithm is so I use PEPG if the performance of CMA-ES becomes an issue. I usually use PEPG when the number of model parameters exceed several thousand.

OpenAI Evolution Strategy

In OpenAI’s paper, they implement an evolution strategy that is a special case of the REINFORCE-ES algorithm outlined earlier. In particular, is fixed to a constant number, and only the parameter is updated at each generation. Below is how this strategy looks like, with a constant parameter:

In addition to the simplification, this paper also proposed a modification of the update rule that is suitable for parallel computation across different worker machines. In their update rule, a large grid of random numbers have been pre-computed using a fixed seed. By doing this, each worker can reproduce the parameters of every other worker over time, and each worker needs only to communicate a single number, the final fitness result, to all of the other workers. This is important if we want to scale evolution strategies to thousands or even a million workers located on different machines, since while it may not be feasible to transmit an entire solution vector a million times at each generation update, it may be feasible to transmit only the final fitness results. In the paper, they showed that by using 1440 workers on Amazon EC2 they were able to solve the Mujoco Humanoid walking task in ~ 10 minutes.

I think in principle, this parallel update rule should work with the original algorithm where they can also adapt , but perhaps in practice, they wanted ot keep the number of moving parts to a minimum for large-scale parallel computing experiments. This inspiring paper also discussed many other practical aspects of deploying ES for RL-style tasks, and I highly recommend going through it to learn more.

Fitness Shaping

Most of the algorithms above are usually combined with a fitness shaping method, such as the rank-based fitness shaping method I will discuss here. Fitness shaping allows us to avoid outliers in the population from dominating the approximate gradient calculation mentioned earlier:

If a particular is much larger than other in the population, then the gradient might become dominated by this outliers and increase the chance of the algorithm being stuck in a local optimum. To mitigate this, one can apply a rank transformation of the fitness. Rather than use the actual fitness function, we would rank the results and use an augmented fitness function which is proportional to the solution’s rank in the population. Below is a comparison of what the original set of fitness may look like, and what the ranked fitness looks like:

What this means is supposed we have a population size of 101. We would evaluate each population to the actual fitness function, and then sort the solutions based by their fitness. We will assign an augmented fitness value of -0.50 to the worse performer, -0.49 to the second worse solution, …, 0.49 to the second best solution, and finally a fitness value of 0.50 to the best solution. This augmented set of fitness values will be used to calculate the gradient update, instead of the actual fitness values. In a way, it is a similar to just applying Batch Normalization to the results, but more direct. There are alternative methods for fitness shaping but they all basically give similar results in the end.

I find fitness shaping to be very useful for RL tasks if the objective function is non-deterministic for a given policy network, which is often the cases on RL environments where maps are randomly generated and various opponents have random policies. It is less useful for optimising for well-behaved functions that are deterministic, and the use of fitness shaping can sometimes slow down the time it takes to find a good solution.

MNIST

Although ES might be a way to search for more novel solutions that are difficult for gradient-based methods to find, it still vastly underperforms gradient-based methods on many problems where we can calculate high quality gradients. For instance, only an idiot would attempt to use a genetic algorithm for image classification. But sometimes such people do exist in the world, and sometimes these explorations can be fruitful!

Since all ML algorithms should be tested on MNIST, I also tried to apply these various ES algorithms to find weights for a small, simple 2-layer convnet used to classify MNIST, just to see where we stand compared to SGD. The convnet only has ~ 11k parameters so we can accommodate the slower CMA-ES algorithm. The code and the experiments are available here.

Below are the results for various ES methods, using a population size of 101, over 300 epochs. We keep track of the model parameters that performed best on the entire training set at the end of each epoch, and evaluate this model once on the test set after 300 epochs. It is interesting how sometimes the test set’s accuracy is higher than the training set for the models that have lower scores.

MethodTrain SetTest Set
Adam (BackProp) Baseline99.898.9
Simple GA82.182.4
CMA-ES98.498.1
OpenAI-ES96.096.2
PEPG98.598.0

We should take these results with a grain of salt, since they are based on a single run, rather than the average of 5-10 runs. The results based on a single-run seem to indicate that CMA-ES is the best at the MNIST task, but the PEPG algorithm is not that far off. Both of these algorithms achieved ~ 98% test accuracy, 1% lower than the SGD/ADAM baseline. Perhaps the ability to dynamically alter its covariance matrix, and standard deviation parameters over each generation allowed it to fine-tune its weights better than OpenAI’s simpler variation.

Try It Yourself

There are probably open source implementations of all of the algorithms described in this article. The author of CMA-ES, Nikolaus Hansen, has been maintaining a numpy-based implementation of CMA-ES with lots of bells and whistles. His python implementation introduced me to the training loop interface described earlier. Since this interface is quite easy to use, I also implemented the other algorithms such as Simple Genetic Algorithm, PEPG, and OpenAI’s ES using the same interface, and put it in a small python file called es.py, and also wrapped the original CMA-ES library in this small library. This way, I can quickly compare different ES algorithms by just changing one line:


import es

#solver = es.SimpleGA(...)
#solver = es.PEPG(...)
#solver = es.OpenES(...)
solver = es.CMAES(...)

while True:

  solutions = solver.ask()

  fitness_list = np.zeros(solver.popsize)

  for i in range(solver.popsize):
    fitness_list[i] = evaluate(solutions[i])

  solver.tell(fitness_list)

  result = solver.result()

  if result[1] > MY_REQUIRED_FITNESS:
    break


You can look at es.py on GitHub and the IPython notebook examples using the various ES algorithms.

In this IPython notebook that accompanies es.py, I show how to use the ES solvers in es.py to solve a 100-Dimensional version of the Rastrigin function with even more local optimum points. The 100-D version is somewhat more challenging than the trivial 2D version used to produce the visualizations in this article. Below is a comparison of the performance for various algorithms discussed:

On this 100-D Rastrigin problem, none of the optimisers got to the global optimum solution, although CMA-ES comes close. CMA-ES blows everything else away. PEPG is in 2nd place, and OpenAI-ES / Genetic Algorithm falls behind. I had to use an annealing schedule to gradually lower for OpenAI-ES to make it perform better for this task.

Final solution that CMA-ES discovered for 100-D Rastrigin function.
Global optimal solution is a 100-dimensional vector of exactly 10.

In the next post, I will look at applying ES to other experiments and more interest problems, so stay tuned.

Below are a few links to information related to evolutionary computing which I found useful or inspiring.

Image Credits of Bears Falling off a Cliff. Your results may vary when investing in ICOs.

CMA-ES: Official Reference Implementation on GitHub, Tutorial, Original CMA-ES Paper from 2001, Overview Slides

Simple Statistical Gradient-Following Algorithms for Connectionist Reinforcement Learning (REINFORCE), 1992.

Policy Exploring Policy Gradients, 2009.

Natural Evolution Strategies, 2014.

Evolution Strategies as a Scalable Alternative to Reinforcement Learning, OpenAI, 2017.

Risto Miikkulainen’s Slides on Neuroevolution.

A Neuroevolution Approach to General Atari Game Playing, 2013.

Kenneth Stanley’s Talk on Why Greatness Cannot Be Planned: The Myth of the Objective, 2015.

Neuroevolution: A Different Kind of Deep Learning. The quest to evolve neural networks through evolutionary algorithms.

Compressed Network Search Finds Complex Neural Controllers with a Million Weights.

Karl Sims Evolved Virtual Creatures, 1994.

Evolved Step Climbing Creatures.

Super Mario World Agent Mario I/O, Mario Kart 64 Controller using using NEAT Algorithm.

Ingo Rechenberg, the inventor of Evolution Strategies.

A Tutorial on Differential Evolution with Python.

My Previous Evolutionary Projects

PathNet: Evolution Channels Gradient Descent in Super Neural Networks

Neural Network Evolution Playground with Backprop NEAT

Evolved Neural Art Gallery using CPPN Implementation

Creatures Avoiding Planks

Neural Slime Volleyball

Evolution of Inverted Double Pendulum Swing Up Controller

Shoutem – A platform to build, publish, and manage React Native apps

$
0
0
  1. 1. Get a head start

    Backend, 40+ extensions, push, analytics

  2. 2. Customize

    No limits, powered by React Native

  3. 3. Automate maintenance

    Automated publishing and updates

When was the last time you’ve heard that someone built eCommerce website from scratch? Hm…, like never. So why would you build an app from scratch?

Viewing all 25817 articles
Browse latest View live




Latest Images