Threats

7Predictability and Randomness

Engineers like predictability. It would be hard to build a Death Star if halfway through setting up the superstructure, gravity kicked in like a tractor beam. Attackers also like predictability. If your main program runs commands it stores in /tmp/setup.sh, then an attacker who can create that file gets to run their commands and is in the money. If your Sabbac game sets its card order based on the date each night at midnight, then an attacker who discovers that is really in the money.

It's important for you to understand when unpredictability or randomness matter, and it's important to understand that they are (predictably) different. You can have numbers that are difficult to predict from a few examples, or you can have ones that are random. For now, let's define random to mean even perfect knowledge of the system won't help you anticipate the next output. For example, well-shaken new dice are effectively random, and when those are used with carefully designed rules and operations, they can give the house a predictable advantage and pay for nice casinos like the ones in Las Vegas or Canto Bight.

Computers, however, are predictable. That predictability leads to threats from informed or brute-force guessing (and testing those guesses) and some surprising truths about the odds of those guesses succeeding. We'll also look at threats to time itself, or at least how technical systems track it. From there, we'll cover predictability in specific scenarios, ...