#lecturenote

Week 12 Lecture ) / The last lecture 😢

In this lecture, we skimmed through the last lectures we learned during this semester. How do people communicate? Andy introduced one picture in the social context of communication. The picture was from Zack Bornstein’s twitter, and he explained how the policemen signal to each other through white armbands in  U.S. They used it as a code. I found another photo in his twitter, and they changed it into another colour for maintaining their identity. On the other hand, I found many brands and individuals posted a black square for supporting black community. It is regarded as a virtual movement of silence. At this point, we should consider how to respond as a designer. 

What’s next for design? Karen introduced decolonising design and female designers. She stressed “We should celebrate and site designers of all races and genders that you find in your path and from all corner.” I was impressed by her words. We should celebrate what we study and what we received from our elders. I will look through after finishing all the assignments! 

Why we design? Why we study design? 

I’m still looking for answers. But I guess, as a creative practitioner we have a chances that we can change and direct people. We can make more brighter and cheerful future once we can gather and make things together. 

Andy and Karen, Thank you for the whole lecture !! :-)

Image Source:

https://twitter.com/ZackBornstein?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor

https://www.nbcnews.com/pop-culture/pop-culture-news/celebrities-warn-using-blm-blackout-tuesday-posts-could-hide-important-n1222106

Lecture 2 (13/03/2020)

Look Back : Lecture 2

We skimmed through the different shapes of communication again. Where does the design happen? How does it move around the place to place? We saw the post-internet language emoji. Goat is used sometimes to signify “Greatest of all time!” Also, the hand-clapping emoji used between words can signify emphasis. It’s a brand new language! Andy explained the ancient painting on the rock and cuneiforms on the clay tablet. It was interesting to hear the origin of the writing system. There were needs for documenting oxen, this encouraged people to formalize the writing system. New media doesn’t replace the old media, it absorbs it creates the hybrid outcome. We should have considered the relationship between materials and letter form. What is the design made of? What will be the next internet language? What will be the next tablet? (clay tablet-paper-digital tablet- and next?) 

image source:

https://emojipedia.org/goat/

https://babylonbee.com/news/study-statements-made-with-clapping-hand-emojis-cannot-be-refuted

Root Cause Analysis

Human Weaknesses: 

Honesty

Misdirection and limited focus

Similarity matching

Frequency gambling

Availability heuristic (可得性启发): The impact of an event will be magnified if the event just happened or happened on yourself

Confirmation bias: Once you confirmed something, you will try your best to find the evidence, even it’s wrong

Cognitive strain

Group-think syndrome

Developmental phases

System Error:

Belief event has only one significant cause

Plan for fewer contingencies than occur

Ability to control outcomes: the illusion of control.

Hindsight bias:  knowledge of outcome of the previous event increases perceived likelihood of that outcome (Things happened looks likely to happen, things didn't happen seems impossible to happen)

Complexity coherence coupling visibility: looks like defense-in-depth, but the failures of these measures are invisible 

Defense in depth

Automatic safety devices: you lose the ability to operate 

Homework: Learn about one of

Chernobyl

Bhopal

Diffie-Hellman Algorithm:

Format string

%s  pop the first thing in the stack and interpret it as string

%d  pop the first thing in the stack and interpret it as integer

%p  pop the first thing in the stack and interpret it as 0x + hex

%x pop the first thing in the stack and interpret it as hex  (no 0x in the front)

%n  pop the first thing in the stack and interpret it as address and put the number of characters printed before %n and stores it to the address poped

%11$s  %11$d  %11$n  

Instead of poping the first thing in the stack, use the 11th thing in the stack

printf(”%s\n, main)    (prints the binary code of main function)

printf(”%x\n”)

printf(”%3$p”)  (print the specifc argument of printf)

payload = p32(some address) + “%11$s”  (can print out anything in the specific address) (%11$s pops the address you entered)

Shellcode 

Change the return address to let the program jumps to your shellcode (runs the shell), so you have the control of the computer

Nop sled

Instead of knowing where exactly the return address is and overwriting it, we could instead put a lot of nops in the memory, so no matter what the address is changed to, it will probably point to the nop instruction in the memory, and hence sled to the shellcode

Identify the assets you want to protect: people always forget what assets they really want to protect

Team America

Richard’s wallet vs Richard’s AIDS

Types of assets:

Tangible Assets 

Intangible Assets

Man in the middle: prevent someone from changing the public key in the middle of the connection

Web of trust (PgP)

- the motto of last week: "every contact leaves a trace"

- WEP: Wired Equivalent Privacy (So many flaws, a joke)

- Exclusive Or:

EOR two same messages will give all 0s

EOR a message with a random number will give a random number as well

- Hash: 

MD5 - 1991 - Rivest - 128 bits BROKEN

SHA0 - replaced almost immediately with... BROKEN

SHA1 - 1995 - NSA - 160 bits BROKEN

SHA2 - 2001 - NSA - 224/256/384/512 bits NOT YET

SHA3 - 2015 (standard accepted) - NIST competition (started 2006) - 224/256/384/512 bits NOT YET

Merkle-damgard construction:

Hash extension attack

Digital Signatures RSA DSA: 

Encrypt the message with your private key

Collison attack: can fake you like another person that is trustworthy (hash)

- Difference between what is, and what should be

- Risk is invisible, and humans are bad at assessing

- Compliance: checkboxes, could help, but not all. 

- Approaches to dealing with risks:

Prevention

Limit

Passing the risk to a 3rd party

Wear

- Bits of information:

Venus: Women tell the truth, men lie

Mars: Women from Mars lie, men tell the truth

You can’t tell the gender and where they from by their appearance

Questions:

Ask one question to tell the gender 

Ask one question to tell where it from

Ask one question to tell both

Solutions:

Ask whether “it” is from Mars or not: all the men will answer YES, all the women will answer NO

Ask whether “it” is a man or a woman: all the Venusians will answer NO, all the Martians will answer YES

Impossible to answer, as the answer is only 1 bit (2 possible answers), while the question is a 2-bit question (there’re 4 possible answers).

- Key problem: If every pair of people has a key, then when there’re lots of people, the number of keys might explode.

Solution: Public Key: All the others use the public key to encode the text, and only the private key can decode it.

- RSA (short for 3 persons’ name): is an algorithm to generate the public and private key

- 4 key things you need to understand inside and out to be a professional. The primary colors:

Trust  

Secret

Human  

Engineering 

- Engineering is about how far you can get given limited time and resource, as there’s no perfection

- Defense in depth: multiple layers, so one layer fails not all layers fail, using tracks between the layers, prevent from single points of failure (one part of the system fail, then the entire system fails)

- Apes and Ant:

Ants themselves are simple, but the network is complex, in fact, the ant castle as a whole is a creature

Apes themselves are complex creatures already, they could break the rules, and follow their wills

- Bell Lapadula model:

Confidentiality model

Information flow model where information cannot flow to an object of lesser or non-comparable classification

(From youtube Rezky Wulandari)

- Side-channel attack:  any attack based on information gained from the implementation of a computer system, rather than weaknesses in the implemented algorithm itself. (Wikipedia): 

power analysis

- Physical security: Computer security is built on physical security and depends on physical security, so it is weaker than physical security.  

- Vignere:  Caesar + password, each letter does not shift the same amount according to the password

- Kasiski test: To figure out the length of the key by observing the average gap between repeating letter combinations. The length of the key is usually a factor of the gap

- Index of coincidence (重合指数): Frequency analysis of the alphabets, can detect the language of the monoalphabetic substitution cipher

- Otp: One-time pad. The key size is the same as the length of the text. Secure but hard to send keys.

- Type 1 and type 2 errors:   When the prediction is different from the reality