The climate emergency requires rapid system change to enable widespread and speedy adoption of more efficient and better ways of doing things. Governments should get on and do that, individuals should prioritise making them do that. However, while most of the victim blaming of individuals “your fault for not doing enough” is micro-consumerist nonsense, there are some choices that those with sufficient means and desire can make. Before starting doing any of the things on this list, write to your elected representatives. This post is about those things that worked for me and a couple of things that did not work for me.

No car. While all the adults in my household have driving licenses, we have never owned a car and have repeatedly refused offers of “free car” from others. We could never have afforded our mortgages if we also had to pay the running cost of a car. Instead we have made use of car clubs, Zipcar, Enterprise, and now Co-wheels, which has the best coverage in Glasgow and is not blatantly out to get you like Enterprise is. We also hire cars when we need them for a week or so and this works out much cheaper than running a car and means we have one when we need one. Cycling is our main means of travel with bus and train doing most of the rest and we only need a car at all a handful of times a year. Choosing to live in an area with (relatively) good public transport helps as if I cannot cycle to work for some reason I have multiple public transport options.

Electric cargo bike. We have an electric cargo bike which removes the need for a car and has very low running costs, can move all sorts of things, and cope with Glasgow’s steep hills. These have started to take off in Glasgow with parents moving children and businesses delivering packages. In Scotland interest free loans are available from the Energy Saving Trust.

Hopefully no flying. I hope never to fly again and have not flown for several years. This can be a bit difficult as an academic and I may eventually be forced to fly somewhere, but the option of not doing so is becoming easier. Train and ferry to the European continent works pretty well and looks to be improving with more sleeper train provision. Further afield, well, I try to make choices that avoid that being necessary.

Local veg box delivery. We get most of our fruit and veg from Locavore and this was particularly great during lockdown as we knew they had a reliable supply of food (direct relationships with local suppliers) and so no issues with panic buying at supermarkets. They also handle all the complexities of making sure the food is environmentally friendly as possible so I can just trust them to handle all of that for me. Locavore also have a filling up shop which cuts down on packaging.

Reusable glass bottle milk delivery (including of oat milk). Another great help during lockdown and removes a huge amount of plastic waste. Oat milk tastes great and is my preference for most milk purposes and is also available in glass bottles.

Reduced meat and dairy. We are not quite vegan yet but have progressively cut down on meat and dairy and it really is not that hard. There are now substantially more appetising options and we have a wide range of tasty recipes to use. Locavore’s veg box means we keep experimenting and trying new things. Glasgow has some truly excellent food and that includes plenty of vegan options.

Bars of shampoo. Removing the shampoo plastic bottle waste by using bars of shampoo instead has worked just fine but some are rather better than others so don’t give up if the first one you try does not work well for you.

Reusable rub on deodorant. Replacing my previous aerosol can with Wild’s reusable applicator and compostable cardboard cartridges of deodorant has worked well and removed the use of both propellants and hard to recycle cans.

Second hand stuff. I have been particularly disappointed with the quality of clothes bought new recently from supposedly reputable shops, which fall apart before the older clothes they were supposed to replace. Pleased with some second hand purchases that seem like they will last longer than current products bought new. Why buy new when there is older stuff, which is better (and yet cheaper)?

Mending things and keeping things longer. We try to keep using things until either we do not need them (then give them/sell them to someone who can use them) or they break, at which point we try to mend them. I consequently have a box full of bits of electronics I need to get around to mending and regularly fix other kinds of item. I have been much more conscious about trying to buy things that will last and be repairable recently and am very pleased with my Fairphone 3+ in that respect.

Borrowing rather than buying. The Southside Tool Library means that there are a lot of tools that I don’t need to buy as I can just borrow them.

Swapping things with neighbours. Lockdown has been great for this with active local online communities of people to take away things you do not want and provide all sorts of useful things you do need, usually for free.

Less Christmas gifting. Getting a smaller number of nice things people actually want for a smaller number of people means less stress and less waste.

Shopping local. In a city like Glasgow there are loads of small local independent shops with great products within easy reach by walking or cycling and this reduces travel requirements and builds the local economy. Some local shops experimented with online stores during lockdown but this did not work that well.

Avoiding unnecessary packaging. This is often quite difficult (and requires proper government action) but filling up shops helps and more recently there are often much better options as companies realise it is something customers want.

Less chemical cleaning products. Mild eco friendly cleaning products or just a vinegar&water or bicarbonate of soda mix are often quite sufficient for cleaning.

Things that did not work so well

Green energy supply. It turned out that Bulb was not as green as it made itself out to be, which was very frustrating to discover. When choosing suppliers it was indistinguishable from Ecotricity on eco credentials but much cheaper in price. Turns out that was because Ecotricity was doing things properly. When the dust settles on the current energy crisis I will try again but no one wants new customers at the moment.

Eco toothpaste. Some eco toothpastes are rather less good as toothpastes than standard commercial options and if you do not realise they are missing vital ingredients (fluoride) then you may gain an additional visit to the dentist and so destroy any gains of not using toothpaste tubes. Will likely try again but burnt once.

Things currently under evaluation

Replacing shaving foam can with shaving cream and brush. Going OK so far.

Retrofitting home for improved insulation. Excited about Loco Home Retrofit‘s work in this space. Some success so far filling gaps with sheep wool insulation (so nice to work with) and replacing a broken blind with an energy saving one.

I am leaving Google and similar companies cloud services and moving to my own infrastructure for my personal data. This process is going to take a while and I am going to document it here to make it easier for others. However the obvious question is why move from free cloud services which already exist and are easy to use to paying for my own infrastructure and configuring it myself? Well partly I do not want to be the product any more which is being sold, I want to be the customer not merely a user who is being sold to advertisers. Since there is no way to pay Google to stop selling me I have to go elsewhere. I could go to someone like MyKolab which claims to care about privacy and do things properly – and people who cannot roll their own probably should think about it – but I get better guarantees from rolling my own and it should be a good learning experience.

Also Snowden. My aim is to make it such that if anyone (including state actors) want my data, then the easiest way of gaining access to it is to come and ask me nicely, we can discuss it like civilised people over tea and cake and if you make a sensible argument then you can have it. If not come back with a warrant. I am not a criminal or a terrorist and I do not expect to be treated like one with all my communications being intercepted. My data includes other people’s personally identifying information (PII) and so can only be disclosed to people who they would expect it to be given to for the purpose for which it was provided. That does not include GCHQ etc. and so I am not following the spirit of the Data Protection Act (DPA) if I make it possible for other people to obtain it without asking.

Similarly some of my friends work for Christian, environmental, aid or democracy organisations, sometimes in countries where doing so is dangerous. Information which might compromise their security is carefully never committed to computer systems (such operational security has been common in Christian circles for 2000 years) but sometimes people make mistakes, particularly when communicating internally in ‘safe’ countries like the UK. However no countries have clean records on human rights etc. and data collected by the ‘five eyes’ is shared with others (e.g. unfiltered access is given to Israel) and there are countries who are our allies in the ‘war on terror’ but which also persecute (or have elements of their security forces who persecute) minorities or groups within their country. I might in some sense be willing to trust the NSA and GCHQ etc. (because they have no reason to be interested in me) but I cannot because that means trusting 800,000 people in the US alone, some of whom will be working for bad governments.

Similarly while our present government is mostly trying to be good if frequently foolish. It is very easy for that to change. So we need to ensure that the work required to go from where we are to a police state is huge so that we have enough time to realise and do something about it. Presently the distance to cover in terms of infrastructure is far too small, being almost negligible. It is our duty as citizens to grow that gap and to keep it wide.

So I am going to try and find solutions which follow best practises of current computer security, following the principle of least privilege and using compartmentalisation to limit the damage that the compromise of any one component can cause. I am going to document this so that you can point out the holes in it so that we can learn together how to do this properly.

Maybe some of this might even help towards my PhD…

Summary: The architecture for David Cameron’s filtering plans is wrong and has a negative consequences, however there are alternative architectures which might work.

There has been much news coverage about David Cameron’s plans for opt-out filters for all internet users in the UK. With opt-in systems barely anyone will opt-in and with opt-out systems barely anyone will opt-out and so this is a proposal for almost everyone to have a filter on their internet traffic. Enabling households to easily filter out bad content from their internet traffic is useful in that there are many people who do want to do this (such as myself[1]). However the proposed architecture has a number of significant flaws and (hopefully unintended) harmful side effects.

Here I will briefly recap what those flaws and side-effects are and propose an architecture which I claim lacks these flaws and side-effects while providing the desired benefits.

1. All traffic goes through central servers which have to process it intensively. This makes bad things like analysing this traffic much easier. It also means that traffic cannot be so efficiently routed. It means that there can be no transparency about what is actually going on as no one outside the ISP can see.
2. There is no transparency or accountability. The lists of things being blocked are not available and even if they were it is hard to verify that those are the ones actually being used. If an address gets added which should not be (say that of a political party or an organisation which someone does not like) then there is no way of knowing that it has been or of removing it from the list. Making such lists available even for illegal content (such as the IWF’s lists) does not make that content any more available but it does make it easier to detect and block it (for example TOR exit nodes could block it). In particular it means having found some bad content it is easier to work out if that content needs to be added to the list or if it is already on it.
3. Central records must be kept on who is and who is not using such filters, really such information is none of anyone else’s business. They should not know or be able to tell, and they do not need to.

I am not going to discuss whether porn is bad for you though I have heard convincing arguments that it is. Nor will I expect any system to prevent people who really want to access such content from doing so. I also will not use a magic ‘detect if adult’ device to prevent teenagers from changing the settings to turn filters off.

Most home internet systems consist of a number of devices connected to some sort of ISP provided hub which then connects to the ISP’s systems and then to the internet. This hub is my focus as it is provided by the ISP and so can be provisioned with the software they desire and configured by them but is also under the control of the household and provides an opportunity for some transparency. The same architecture can be used with the device itself performing the filtering, for example when using mobile phones on 3G or inside web browsers when using TLS.

So how would such a system work? Well these hubs are basically just a very small Linux machine, like a Raspberry Pi and it is already handling the networking for the devices in the house, probably running a NAT[0] and doing DHCP, it should probably also be running a DNS server and using DNSSEC. It already has a little web server to display its management pages and so could trivially display web pages saying “this content blocked for you because of $reason, if this is wrong do $thing”. Then when it makes DNS requests for domains to the ISP’s servers then they can reply with additional information about whether this domain is known to have bad content and where to find additional information on that which the hub can then look up and use to as input to apply local policy.
Then the household can configure to hub that applies the policy they want and it can be shipped with a sensible default and no one knows what policy they chose unless they snoop their traffic (which should require a warrant).
Now there might want to be a couple of extra tweaks in here, for example there is some content which people really do not want to see but find very difficult not to seek out, for example I have friends who have struggled for a long time to recover from a pornography addiction. Hence providing the functionality whereby filter settings can be made read only such that a user can choose to make ‘impossible’ to turn off can be useful as in a stronger moment they can make a decision that prevents them being able to do something they do not want to in a weaker moment. Obviously any censorship system can be circumvented by a sufficiently determined person but self blocking things is an effective strategy to help people break addictions, whether to facebook in the run up to exams or to more addictive websites.

So would such a system actually work? I think that it is technically feasible and would achieve the purposes it is intended to and not have the same problems that the current proposed architecture has. However it might not work with currently deployed hardware as that might not have quite enough processing power (though not by much). However an open, well specified system would allow incremental roll out and independent implementation and verification. Additionally it does not provide the services for which David Cameron’s system is actually being built which is to make it easier to snoop on all internet users web traffic. This is just the Digital Economy bill all over again but with ‘think of the children’ rather than ‘think of the terrorists’ as its sales pitch. There is little point blocking access to illegal content as that can always be circumvented, much better to take the content down[2] and lock up the people who produced it, failing that, detect it as the traffic leaves the ISP’s network towards bad places and send round a police van to lock up the people accessing it. Then everything has to go through the proper legal process in plain sight.

[0]: in the case of Virgin Media’s ‘Super Hub’ doing so incredibly badly such that everything needs tunnelling out to a sane network.
[1]: Though currently I do not beyond using Google’s strict safe search because there is no easy mechanism for doing so, the only source of objectionable content that actually ends up on web pages I see is adverts, on which more later.
[2]: If this is difficult then make it easier, it is far too hard to take down criminal website such as phishing scams at the moment and improvements in international cooperation on this would be of great benefit.

Mass surveillance of the citizens of a country allows intelligence services to use ‘big data’ techniques to find suspicious things which they would not otherwise have found. They can analyse the graph structure of communications to look for suspicious patterns or suspicious keywords. However as a long term strategy it is fundamentally flawed. The problem is the effect of surveillance on those being watched. Being watched means not being trusted, being outside and other, separate from those who know best and under suspicion. It makes you foreign, alien and apart, it causes fear and apprehension, it reduces integration. It makes communities which feel that they are being picked on, distressed and splits them apart from those around them. This causes a feeling of oppression and unfairness, of injustice. This results in anger, which grows in the darkness and leads to death.

That is not the way to deal with ‘terrorism’. Come, let us build our lives together as one community, not set apart and divided. Let us come together and talk of how we can build a better world for us and for our children. Inside we are all the same, it does not matter where we came from, only where we are going to and how we get there.
Come, let us put on love rather than fear, let us welcome rather than reject, let us build a country where freedom reigns and peace flows like a river through happy tree lined streets where children play.

I may be an idealist but that does not make this impossible, only really hard, and massively worth it. The place to begin is as always in my own heart for I am not yet ready to live in the country I want us to be. There is a long way to go, and so my friends: let us begin.

For the last couple of days I have been at the Security Protocols Workshop which was conveniently located a short cycle ride away. I thoroughly enjoyed it and will definitely be coming back next year (hopefully with a short paper to present). I want to mention some of my  favourite new (to me) ideas which were presented. I am only covering them briefly so if it looks interesting go and read the paper (when it comes out at some unspecified point in the future or find someone with a copy of the pre-proceedings).

Towards new security primitives based on hard AI problems – Bin B. Zhu, Jeff Yan

The core idea here is that if there are problems which computers can’t solve but humans can (e.g. 2D Captchas) then these can be used to allow humans to input their passwords etc. in such a way that a computer trying to input passwords in has no idea what password it is inputting (CaRP). This means that on each attempt the attacker gains nothing because they don’t know what password they tried as they just sent a random selection of click events which the server then interpreted as a password using information that the attacker does not have without human assistance. This helps against online brute force attacks, particularly distributed attacks which are hard to solve with blacklisting without also locking the legitimate user out. It also helps as part of the ‘authentication is machine learning‘ approach as accounts which are flagged as being used suspiciously can be required to login using a CaRP which requires human input and so mitigates automated attacks in a similar way to requiring the use of a mobile number and sending it a text (though it is less strong than that – it does require less infrastructure). Additionally I think that if a particular Captcha scheme is broken then the process of breaking each one will still be computationally intensive and so this should still rate limit the attacker.

Remote device attestation with bounded leakage of secrets – Jun Zhao, Virgil Gligor, Adrian Perrig, James Newsome

This is a neat idea where if the hardware of a device is controlled such that its output bandwidth is strictly limited then it is still possible to be certain that the software on it has not been compromised even if an attacker can install malware on it and has full control of the network. This works by having a large pool of secrets on the device which are updated in a dependent way each epoch and there is not enough bandwidth in an epoch to leak enough data to construct the pool of secrets outside the device. Then the verifier can send the device a new program to fill its working RAM and request a MAC over the memory and secrets storage and this cannot be computed off the device or on the device without filling the RAM with the requested content and so when the MAC is returned the verifier knows the full contents of the hardware’s volatile state and so if it was compromised it no longer is.

Spraying Diffie-Hellman for secure key exchange in MANETs – Ariel Stulman, Jonathan Lahav, and Avraham Shmueli

This idea is for use in providing confidentiality of communication on mobile ad-hoc networks. Since the network is always changing and comprised of many nodes it is hard for an attacker to compromise all the nodes on all paths between two nodes which wish to communicate confidentiality. The idea is to do Diffie-Hellman but split the message into multiple pieces with a hash and send each message via a different route to the recipient. If any one of those pieces gets through without being man-in-the-middled then the attack has failed. In a random dynamically changing network it is hard for an attacker to ensure that. Though not impossible and so a very careful analysis needs to be done to mitigate those risks in practice.

Layering authentication channels to provide covert communication – Mohammed H. Almeshekah, Mikhail Atallah, Eugene H. Spafford

The idea here is that some additional information can be put in the authentication information such as typing <password> <code word> rather than just <password> in the password field and hence transmitting <code word> to the bank which can have many meanings, e.g. have three different code words for 3 levels of access (read only, transactions, administrative) and one for coercion. I particularly liked the idea of being able to tell the bank ‘help someone is coercing me to do this, make everything look as normal but take steps to reverse things afterwards and please send the police’.

 

There were also lots of other interesting ideas some of which I had seen before in other contexts. I thought I made some useful contributions to discussions and so maybe this whole PhD in computer security thing might work out. There were some really friendly welcoming people there and I already knew a bunch of them as they were CL Security Group people.

Under our present economic system we are reasonably good at minimising costs and finding efficiencies that save companies money. However we do not price negative externalities. So companies and individuals can do things that are bad for other people, or which only become bad when lots of people do them. There is no actual incentive for them to not do this except when there is legislation in place which provides that incentive.
Companies and individuals are good at acting in their own short term best interest but much worse at considering the longer term and the wider system of which they are only a small part. One of the primary duties of government is to ensure that this short term best interest lines up with the long term best interest of the country and the wider world.

Currently various places have carbon trading schemes. These just do not work. Companies are granted the right to produce a certain quantity of carbon dioxide, if they produce less they can sell the spare to other companies, if they produce more they must buy some. The problem here is that if companies can persuade their governments that they need slightly more right to emit then they can then sell this right at a big profit. This also results in the particularly tiresome behaviour where deliberately inefficient systems are built, and then made more efficient and large quantities of money obtained for the efficiencies that have been made (yey carbon offsetting).

Market systems do work but require things to be properly priced, carbon trading doesn’t do that. Instead a carbon tax where each tonne of carbon dioxide equivalent is given a fixed price by a certain quantity of tax being due for its emission. Here I mean tax in terms of the manner of its collection (imposed by government) but what it is is an encapsulation of the actual cost of the emission. The money raised could not just be used for arbitrary purposes but only those which help deal with the problems caused by the emission (investment in renewable technologies, efficiency, retrofitting insulation etc.).

Of course none of that is new, it has all been said before.

However normal schemes would fail as it is not in the best short term ‘economic’ interests of a country to impose an additional tax on carbon dioxide equivalent production. This is because foreign imports will have lower costs due to their emissions not being paid for. Hence to avoid shooting themselves in the foot by destroying their local industries and just relocate the pollution to other countries where it is harder to legislate for its reduction but with moral responsibility for it still lying with the importer. Hence import taxes based on the carbon dioxide equivalent in the country of manufacture and of the transport of it are required.

Such import taxes would as I understand it be illegal under international agreements through the WTO[1]. Tedious. However this is not a normal ‘tax’ it does not exist to raise revenue for a particular government (it should probably be focused on ensuring developing countries move straight to clean technologies without an intermediate dirty state) or to protect industries in a particular country. It is an enforcement of an actual cost, as long as it gets paid it doesn’t matter where. So it could be charged by the government in the country of origin and kept by them and then the importer would not need to charge it. This should hopefully mean that governments don’t get so upset with each other.

I envision three classes of countries, those fully into carbon taxation for whom all production inside their countries and for them in other countries is properly costed. Those countries who export to the first class ones and charge the cost for those exports in their own country. Those third class countries which don’t charge anything and if exporting to first class ones see the import tax charged but don’t get the money from it.
The main additional requirement for first and second class countries is what they do with the money they collect – they must not use it to subsides the very industries they are taxing though they could use it to provide loans for efficiency improvements etc. – as otherwise it would not have the correct incentiveising effect and would be anti-competitive.

That would of course require a huge quantity of political will and is fairly unlikely to happen, however when enough people start dying politicians will be forced to take notice. Unfortunately this will likely be rather late in the day.

The main difficulties are in calculating the quantity emitted and in fixing the cost. Calculation by “assume the worst possible method unless proved otherwise” should give pretty good incentives to provide good proofs of efficient methods and this becomes much easier when these things are priced in at the beginning. For example application when petrol is first petrol rather than misc oil then it is destined to be burnt so apply the tax then. When some coal comes out of the ground – going to be burnt so apply tax. An additional incentive for encouraging people to apply these things early in the supply chain when it is easier is to have a linearly increasing cost where each second it gets ever so slightly more expensive. So we start from 0 and run up to 1 over the course of a year so as to get the bugs out of the system before particularly large quantities of money get involved (10 per household is not much) then draw a straight line between 1 and 100 in price between then and 2050. Picking the currency to price this in is hard as its value is built on rainbows and not tied down to anything. Using the euro of the dollar might make sense but I am not clear as to what the best method would be for this.

[1] Though we do apparently have a tax on the import of components but not finished products which helps destroy our manufacturing industry, see petition to change that.

This begins my series of “ideas I have had”. Time for you to find all the holes in it :-)