6 ms·

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones

It's a real shame that the people who came up with this exploit are working for NSO and not on solving P = NP or something. I'm sure if we got them and the ones working on crypto at NSA in a room together, we'd have it and clean unlimited energy in a week. I often feel sad thinking about how many brilliant engineers are dedicating their time to helping governments spy on people or other governments.

xxpor 5y ago
Kind of ironic to use P = NP as an example of something to work on considering the biggest implications of proving P = NP :)
- detritus 5y ago
  Forgive my ignorance, but what would they be - the complete implosion of all forms of known security, or something else? This is a bit beyond my ken :)
  - snarf21 5y ago
    Among other things, mostly encryption. Most of our current methods depends on P != NP. So no need for 0 days if you can just read at encrypted data as if it wasn't.
    - Dylan16807 5y ago
      > Most of our current methods depends on P != NP. Not really. They depend on guessing being slow. P, just P, can do slow. P can be bigger than the universe even with low values of n.
  - kingaillas 5y ago
    Well for one, the safety of encryption rests on certain problems being intractable. (In a theoretical sense; there are always implementation bugs that destroy security). If P=NP, then those previously thought to be intractable problems, are actually tractable. And the foundation of a lot of security-related engineering collapses.
    - nafey 5y ago
      Is proving P = NP equivalent to knowing how any intractable problem can be solved? Is it possible for P=NP and yet a class of intractable problems to remain unsolved?
      - kingaillas 5y ago
        It would mean that a large class of problems that have solutions that can be verified quickly can be solved quickly. Which cuts both ways. While that means most protocols used for cryptography would need to be replaced (hashing, digital signatures, etc) it also means other combinatorics algorithms (traveling salesman, protein structure prediction) would become solvable which may been boon for logistics and/or computational science. (I think this is correct) If P=NP there will still be intractable problems; they would be ones where the solutions can't be verified in polynomial time... along the lines of verifying the solution is correct is as complicated as brute forcing the solution. Note: it's been a while since my computation theory class. ;) I am reading over https://en.wikipedia.org/wiki/P_versus_NP_problem https://en.wikipedia.org/wiki/P_versus_NP_problem and relearning the fine house of cards theoreticians have divided this problem into. There is a "consequences of P=NP" towards the bottom that sums it up better than I can.
        xxpor 5y ago
        There's also the chance that while we may be able to come up with a polynomial algorithm for integer factorization, it's not actually practical to run still. Remember computational complexity discards the constants on that polynomial. Practically speaking x^2 + x is a lot different from 2^64x^2 + 2^32x + 2^16 :)
        Dylan16807 5y ago
        'quickly' is doing a lot of work in that sentence. "A proof that P = NP could have stunning practical consequences if the proof leads to efficient methods for solving some of the important problems in NP." Note the "if". It is extremely important to the meaning. It's very possible for P to equal NP, but for that "if" to be false.
  - r00fus 5y ago
    Yes. Just like in that movie Sneakers
jack_pp 5y ago
Why do you think some random hacker is smarter than all the academics we have? Somehow clean unlimited energy isn't achieved because people are working on exploits or optimizing ad revenue? I doubt it.
- that_guy_iain 5y ago
  Because they were smart enough to go where the money is?/s
futharkshill 5y ago
You would be surprised at the skills at the highest level of academia.
inter_netuser 5y ago
Dear sir, the entire NSA staff are currently plugging away on that pesky P=NP problem, including datacenter janitors.
- teh_infallible 5y ago
  I have suspected for awhile now that the bitcoin blockchain is actually an attempt to break SHA-256. Bitcoin is built around incentives, and it has created an incentive for people all over the world to basically brute force this algorithm and maintain a recursive set of low entropy outputs. Which would make the btc blockchain an incredibly expensive and valuable data set, for someone armed with the right mathematical theory.
  - randomhodler84 5y ago
    Part of Security is knowing your adversaries power. I think you might be on the right track. You can’t put a price on the security of an algorithm. However, Satoshi gave us a very good metric for calculating it.
  - chockablock 5y ago
    How could you break it without destroying its value?
    - jaywalk 5y ago
      Why would the NSA care about destroying Bitcoin's value?
ASalazarMX 5y ago
If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.
- sterlind 5y ago
  kinda like Werner von Braun, maybe. he just wanted to make rockets. whether they were for Nazi Germany or the US didn't matter, whether they were missiles or spacecraft didn't matter, he just wanted to build them.
  - earthscienceman 5y ago
    Which we have a descriptive word for: unethical. The colorful word would be: disgusting
    - sterlind 5y ago
      "When the rockets go up, who cares where they come down? That's not my department, says Werner von Braun." ~ Tom Lehrer
      - ASalazarMX 5y ago
        "Don't say that he's hypocritical, Say rather that he's apolitical"
    - flyinglizard 5y ago
      There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.
      - FridayoLeary 5y ago
        I think it's beyond barbaric to calmly send a request for more slaves (Jews other minorities) for the factory work, due to them inconveniently dying too fast. Because of the inhuman working conditions. I read that he did that all. He wasn't merely a patriotic, unaffected scientist, he played a part in the holocaust.
NmAmDa 5y ago
I am not sure what do you mean with unlimited energy here, is it literal or metaphor but I sense a second law of thermodynamics violation.
rowanG077 5y ago
I feel the opposite. All this stuff and even more hardcore crypto stuff is all relatively simple math. It's not even close to comparable to the things mathematicians do. Or even what physicist have achieved with LHC or fusion research.
- vore 5y ago
  Surely cracking cryptographic algorithms is pretty hard math given people don't have that much success with it, even with a huge incentive (decrypting all communications worldwide)?
  - rowanG077 5y ago
    It's considered to be impossible. I doubt there is much (if any) serious research going on to mathematically crack RSA or ECC. Besides that is not what OP was talking about. That was about hackers finding standard vulnerabilities in code and exploiting it. Not about any mathematical flaws in crypto.
vmception 5y ago
It just is another example that bug bounties are undervalued and the experience doing anything “white hat” is too disastrous to be worth it. Responsible disclosure is for the gullible. The market keeps saying “this is what its worth”
- mrtesthah 5y ago
  What if vulnerabilities’ PR cost to companies will always be less than the price on the black market for exploits?
tester756 5y ago
People of this caliber are avaliable here: https://ctftime.org/ https://ctftime.org/ Here you have a list of decade of performance of experts/top competitors in: security, reverse engineering, crypto, low lvl, malware analysis, OS internals, memory corruption some of them even work at Google Project Zero :)
- marcan_42 5y ago
  And some of them work at NSO...
inasio 5y ago
I don't see anything fundamentally novel here, other than we're not going to be just laughing at weird things that turn out to be Turing complete, they're all practical intrusion vectors now.
eevilspock 5y ago
“The best minds of my generation are thinking about how to make people click ads. That sucks.” ~ Jeff Hammerbacher, fmr. Manager of Facebook Data Team, founder of Cloudera This quote isn't just about people working directly on ad tech and ad targeting algorithms, but any product that is "free" and ad supported.
- cycomanic 5y ago
  As a side note I just went to the Cloudera website, because I did not know about the company. After selecting "Reject all" in the cookie dialog, the cookie was literally spinning (they have a spinning wheel animation for processing your cookie response!) for >5s on "We are processing your cookie settings request". If this is what the best minds of our generation are achieving then help us god!
- rvnx 5y ago
  It's not really true, this was true 15 years ago when the smartest people worked at Google (whose goal is to get people to click on ads), but now a lot of very smart people found other business.
drorco 5y ago
I think you could also say the same about gambling, porn and other questionable industries. The thing is, it's usually much easier making money off these things then making money from solving impactful problems. If you're a regular joe and you could spend your next 5 years with a 100% chance of making millions for finding exploits, or a 0.01% chance of solving P=NP, I think the irrational decision would be picking the latter.
- octoberfranklin 5y ago
  The problem isn't that they spend 5 years making fuck-you money. The problem is that they don't realize that they can stop once they have it.
  - drorco 5y ago
    I don't know what's the quantitative trend. I do know of several founders whose first company was a nasty ad-tech company (spyware), and after making their millions, their second company is a much more honorable digital health company. You probably can find examples where such people can keep on creating nasty companies, so it would be interesting to see if there was a research about whether or not people pursue more honorable goals after they get lots of cash.
medion 5y ago
I feel the same way about all the smart engineers solving problems for Facebook, Twitter, etc...
- thruway516 5y ago
  Those engineering problems are trivial compared to many real problems. Turning out all those engineers to work on say cancer wouldn't necessarily result in any new breakthroughs . Case in point: all the brilliant software engineers who thought they could solve Covid (https://www.protocol.com/Newsletters/pipeline/very-venture-capital-approach-to-covid https://www.protocol.com/Newsletters/pipeline/very-venture-c...) only to find themselves out of their depth. The software engineering approach doesn't translate to all things and can even be harmful in some fields (cough Theranos). Physicists are another group that tend to have this conceit -i.e if they weren't so busy solving physics problems they would solve the economy and world peace
  - rvnx 5y ago
    Usually software developers have big egos, but in reality it's much more difficult to handle DNA meaningfully than scaling computers
fnord77 5y ago
all the other best minds of our generation are working on getting people to click more ads
soheil 5y ago
What if they are working on both?

xxpor 5y ago

Kind of ironic to use P = NP as an example of something to work on considering the biggest implications of proving P = NP :)

detritus 5y ago
Forgive my ignorance, but what would they be - the complete implosion of all forms of known security, or something else? This is a bit beyond my ken :)
- snarf21 5y ago
  Among other things, mostly encryption. Most of our current methods depends on P != NP. So no need for 0 days if you can just read at encrypted data as if it wasn't.
  - Dylan16807 5y ago
    > Most of our current methods depends on P != NP. Not really. They depend on guessing being slow. P, just P, can do slow. P can be bigger than the universe even with low values of n.
- kingaillas 5y ago
  Well for one, the safety of encryption rests on certain problems being intractable. (In a theoretical sense; there are always implementation bugs that destroy security). If P=NP, then those previously thought to be intractable problems, are actually tractable. And the foundation of a lot of security-related engineering collapses.
  - nafey 5y ago
    Is proving P = NP equivalent to knowing how any intractable problem can be solved? Is it possible for P=NP and yet a class of intractable problems to remain unsolved?
    - kingaillas 5y ago
      It would mean that a large class of problems that have solutions that can be verified quickly can be solved quickly. Which cuts both ways. While that means most protocols used for cryptography would need to be replaced (hashing, digital signatures, etc) it also means other combinatorics algorithms (traveling salesman, protein structure prediction) would become solvable which may been boon for logistics and/or computational science. (I think this is correct) If P=NP there will still be intractable problems; they would be ones where the solutions can't be verified in polynomial time... along the lines of verifying the solution is correct is as complicated as brute forcing the solution. Note: it's been a while since my computation theory class. ;) I am reading over https://en.wikipedia.org/wiki/P_versus_NP_problem https://en.wikipedia.org/wiki/P_versus_NP_problem and relearning the fine house of cards theoreticians have divided this problem into. There is a "consequences of P=NP" towards the bottom that sums it up better than I can.
      - xxpor 5y ago
        There's also the chance that while we may be able to come up with a polynomial algorithm for integer factorization, it's not actually practical to run still. Remember computational complexity discards the constants on that polynomial. Practically speaking x^2 + x is a lot different from 2^64x^2 + 2^32x + 2^16 :)
      - Dylan16807 5y ago
        'quickly' is doing a lot of work in that sentence. "A proof that P = NP could have stunning practical consequences if the proof leads to efficient methods for solving some of the important problems in NP." Note the "if". It is extremely important to the meaning. It's very possible for P to equal NP, but for that "if" to be false.
- r00fus 5y ago
  Yes. Just like in that movie Sneakers

jack_pp 5y ago

Why do you think some random hacker is smarter than all the academics we have? Somehow clean unlimited energy isn't achieved because people are working on exploits or optimizing ad revenue? I doubt it.

that_guy_iain 5y ago
Because they were smart enough to go where the money is?/s

futharkshill 5y ago

You would be surprised at the skills at the highest level of academia.

inter_netuser 5y ago

Dear sir, the entire NSA staff are currently plugging away on that pesky P=NP problem, including datacenter janitors.

teh_infallible 5y ago
I have suspected for awhile now that the bitcoin blockchain is actually an attempt to break SHA-256. Bitcoin is built around incentives, and it has created an incentive for people all over the world to basically brute force this algorithm and maintain a recursive set of low entropy outputs. Which would make the btc blockchain an incredibly expensive and valuable data set, for someone armed with the right mathematical theory.
- randomhodler84 5y ago
  Part of Security is knowing your adversaries power. I think you might be on the right track. You can’t put a price on the security of an algorithm. However, Satoshi gave us a very good metric for calculating it.
- chockablock 5y ago
  How could you break it without destroying its value?
  - jaywalk 5y ago
    Why would the NSA care about destroying Bitcoin's value?

ASalazarMX 5y ago

If they solved P = NP, their first intention would be selling it to the highest bidder. NSO hackers are the digital equivalent of mercenary soldiers.

sterlind 5y ago
kinda like Werner von Braun, maybe. he just wanted to make rockets. whether they were for Nazi Germany or the US didn't matter, whether they were missiles or spacecraft didn't matter, he just wanted to build them.
- earthscienceman 5y ago
  Which we have a descriptive word for: unethical. The colorful word would be: disgusting
  - sterlind 5y ago
    "When the rockets go up, who cares where they come down? That's not my department, says Werner von Braun." ~ Tom Lehrer
    - ASalazarMX 5y ago
      "Don't say that he's hypocritical, Say rather that he's apolitical"
  - flyinglizard 5y ago
    There’s nothing unethical about a scientist working on weapon development for their country in the middle of a war. Imagine it’s 1935 and you lack the modern perspective. I mean you might not like it, but I don’t think there’s an ethical violation here.
    - FridayoLeary 5y ago
      I think it's beyond barbaric to calmly send a request for more slaves (Jews other minorities) for the factory work, due to them inconveniently dying too fast. Because of the inhuman working conditions. I read that he did that all. He wasn't merely a patriotic, unaffected scientist, he played a part in the holocaust.

NmAmDa 5y ago

I am not sure what do you mean with unlimited energy here, is it literal or metaphor but I sense a second law of thermodynamics violation.

rowanG077 5y ago

I feel the opposite. All this stuff and even more hardcore crypto stuff is all relatively simple math. It's not even close to comparable to the things mathematicians do. Or even what physicist have achieved with LHC or fusion research.

vore 5y ago
Surely cracking cryptographic algorithms is pretty hard math given people don't have that much success with it, even with a huge incentive (decrypting all communications worldwide)?
- rowanG077 5y ago
  It's considered to be impossible. I doubt there is much (if any) serious research going on to mathematically crack RSA or ECC. Besides that is not what OP was talking about. That was about hackers finding standard vulnerabilities in code and exploiting it. Not about any mathematical flaws in crypto.

vmception 5y ago

It just is another example that bug bounties are undervalued and the experience doing anything “white hat” is too disastrous to be worth it. Responsible disclosure is for the gullible. The market keeps saying “this is what its worth”

mrtesthah 5y ago
What if vulnerabilities’ PR cost to companies will always be less than the price on the black market for exploits?

tester756 5y ago

People of this caliber are avaliable here: https://ctftime.org/ https://ctftime.org/ Here you have a list of decade of performance of experts/top competitors in: security, reverse engineering, crypto, low lvl, malware analysis, OS internals, memory corruption some of them even work at Google Project Zero :)

marcan_42 5y ago
And some of them work at NSO...

inasio 5y ago

I don't see anything fundamentally novel here, other than we're not going to be just laughing at weird things that turn out to be Turing complete, they're all practical intrusion vectors now.

eevilspock 5y ago

“The best minds of my generation are thinking about how to make people click ads. That sucks.” ~ Jeff Hammerbacher, fmr. Manager of Facebook Data Team, founder of Cloudera This quote isn't just about people working directly on ad tech and ad targeting algorithms, but any product that is "free" and ad supported.

cycomanic 5y ago
As a side note I just went to the Cloudera website, because I did not know about the company. After selecting "Reject all" in the cookie dialog, the cookie was literally spinning (they have a spinning wheel animation for processing your cookie response!) for >5s on "We are processing your cookie settings request". If this is what the best minds of our generation are achieving then help us god!
rvnx 5y ago
It's not really true, this was true 15 years ago when the smartest people worked at Google (whose goal is to get people to click on ads), but now a lot of very smart people found other business.

drorco 5y ago

I think you could also say the same about gambling, porn and other questionable industries. The thing is, it's usually much easier making money off these things then making money from solving impactful problems. If you're a regular joe and you could spend your next 5 years with a 100% chance of making millions for finding exploits, or a 0.01% chance of solving P=NP, I think the irrational decision would be picking the latter.

octoberfranklin 5y ago
The problem isn't that they spend 5 years making fuck-you money. The problem is that they don't realize that they can stop once they have it.
- drorco 5y ago
  I don't know what's the quantitative trend. I do know of several founders whose first company was a nasty ad-tech company (spyware), and after making their millions, their second company is a much more honorable digital health company. You probably can find examples where such people can keep on creating nasty companies, so it would be interesting to see if there was a research about whether or not people pursue more honorable goals after they get lots of cash.

medion 5y ago

I feel the same way about all the smart engineers solving problems for Facebook, Twitter, etc...

thruway516 5y ago
Those engineering problems are trivial compared to many real problems. Turning out all those engineers to work on say cancer wouldn't necessarily result in any new breakthroughs . Case in point: all the brilliant software engineers who thought they could solve Covid (https://www.protocol.com/Newsletters/pipeline/very-venture-capital-approach-to-covid https://www.protocol.com/Newsletters/pipeline/very-venture-c...) only to find themselves out of their depth. The software engineering approach doesn't translate to all things and can even be harmful in some fields (cough Theranos). Physicists are another group that tend to have this conceit -i.e if they weren't so busy solving physics problems they would solve the economy and world peace
- rvnx 5y ago
  Usually software developers have big egos, but in reality it's much more difficult to handle DNA meaningfully than scaling computers

fnord77 5y ago

all the other best minds of our generation are working on getting people to click more ads

soheil 5y ago

What if they are working on both?