August 2018 - nexa - server-nexa.polito.it

Re: [nexa] Google’s snooping proves big tech will not change – unless governments step in

by Stefano Quintarelli

Aka #deviceneutrality In data 15 agosto 2018 4:50:20 AM Alberto Cammozzo <ac+nexa(a)zeromx.net> ha scritto: > I dispositivi Android devono poter funzionare anche senza Google Apps > anche se l'utente non è un hacker. > > > <https://www.theguardian.com/commentisfree/2018/aug/14/googles-snooping-prov…> > > A recent investigation by the Associated Press has revealed that > Google records your movements regardless of whether you have disabled > the “location history” setting. This is egregious, especially > considering Google’s support page on the issue states: “With location > history off, the places you go are no longer stored.” > > While it is possible to prevent Google from time-stamping your every > digital footstep, it is not exactly intuitive. You must log in to your > Google account, go to the “manage your Google activity” section, open > “activity controls” and disable the permissions there, which are enabled > by default. This stops apps such as Google Maps and browsers from > recording your location. However, it doesn’t wipe your past location > data; more steps are needed to delete that. > > Going through the above is a hassle with which most people won’t bother > – as I imagine Google knows well. Who cares about privacy these days, > after all? It seems big tech has realised it can afford constant > data-based scandals, because not enough people care that the minutiae of > their daily existence is being relentlessly mined and monetised without > their informed consent. This apathy is, in part, attributable to the > fact we are told we shouldn’t care about privacy if we have nothing to > hide. Google has helped propagate this notion. The company’s former CEO > Eric Schmidt once said: “If you have something that you don’t want > anyone to know, maybe you shouldn’t be doing it in the first place.” > > [...] > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Aug. 15, 2018

OK, Be Evil

by Alberto Cammozzo

Google Removes 'Don't Be Evil' Clause From Its Code of Conduct <https://gizmodo.com/google-removes-nearly-all-mentions-of-dont-be-evil-from…> Google’s unofficial motto has long been the simple phrase “don’t be evil.” But that’s over, according to the code of conduct that Google distributes to its employees. The phrase was removed sometime in late April or early May, archives hosted by the Wayback Machine show. “Don’t be evil” has been part of the company’s corporate code of conduct <https://abc.xyz/investor/other/google-code-of-conduct.html> since 2000. When Google was reorganized under a new parent company, Alphabet, in 2015, Alphabet assumed a slightly adjusted version <https://www.engadget.com/2015/10/02/alphabet-do-the-right-thing/> of the motto, “do the right thing.” However, Google retained its original “don’t be evil” language until the past several weeks. The phrase has been deeply incorporated into Google’s company culture—so much so that a version of the phrase has served as the wifi password on the shuttles that Google uses to ferry its employees to its Mountain View headquarters, sources told Gizmodo. Here’s the relevant section of the old code of conduct, as archived by the Wayback Machine on April 21, 2018 <https://web.archive.org/web/20180421105327/https://abc.xyz/investor/other/g…>: “Don’t be evil.” Googlers generally apply those words to how we serve our users. But “Don’t be evil” is much more than that. Yes, it’s about providing our users unbiased access to information, focusing on their needs and giving them the best products and services that we can. But it’s also about doing the right thing more generally – following the law, acting honorably, and treating co-workers with courtesy and respect. The Google Code of Conduct is one of the ways we put “Don’t be evil” into practice. It’s built around the recognition that everything we do in connection with our work at Google will be, and should be, measured against the highest possible standards of ethical business conduct. We set the bar that high for practical as well as aspirational reasons: Our commitment to the highest standards helps us hire great people, build great products, and attract loyal users. Trust and mutual respect among employees and users are the foundation of our success, and they are something we need to earn every day. So please do read the Code, and follow both its spirit and letter, always bearing in mind that each of us has a personal responsibility to incorporate, and to encourage other Googlers to incorporate, the principles of the Code into our work. And if you have a question or ever think that one of your fellow Googlers or the company as a whole may be falling short of our commitment, don’t be silent. We want – and need – to hear from you. And here’s the updated version, first archived by the Wayback Machine on May 4, 2018 <https://web.archive.org/web/20180504211806/https://abc.xyz/investor/other/g…>: The Google Code of Conduct is one of the ways we put Google’s values into practice. It’s built around the recognition that everything we do in connection with our work at Google will be, and should be, measured against the highest possible standards of ethical business conduct. We set the bar that high for practical as well as aspirational reasons: Our commitment to the highest standards helps us hire great people, build great products, and attract loyal users. Respect for our users, for the opportunity, and for each other are foundational to our success, and are something we need to support every day. So please do read the Code and Google’s values, and follow both in spirit and letter, always bearing in mind that each of us has a personal responsibility to incorporate, and to encourage other Googlers to incorporate, the principles of the Code and values into our work. And if you have a question or ever think that one of your fellow Googlers or the company as a whole may be falling short of our commitment, don’t be silent. We want – and need – to hear from you. Despite this significant change, Google’s code of conduct says it has not been updated since April 5, 2018.

Aug. 15, 2018

Google’s snooping proves big tech will not change – unless governments step in

by Alberto Cammozzo

I dispositivi Android devono poter funzionare anche senza Google Apps anche se l'utente non è un hacker. <https://www.theguardian.com/commentisfree/2018/aug/14/googles-snooping-prov…> A recent investigation by the Associated Press has revealed that Google records your movements regardless of whether you have disabled the “location history” setting. This is egregious, especially considering Google’s support page on the issue states: “With location history off, the places you go are no longer stored.” While it is possible to prevent Google from time-stamping your every digital footstep, it is not exactly intuitive. You must log in to your Google account, go to the “manage your Google activity” section, open “activity controls” and disable the permissions there, which are enabled by default. This stops apps such as Google Maps and browsers from recording your location. However, it doesn’t wipe your past location data; more steps are needed to delete that. Going through the above is a hassle with which most people won’t bother – as I imagine Google knows well. Who cares about privacy these days, after all? It seems big tech has realised it can afford constant data-based scandals, because not enough people care that the minutiae of their daily existence is being relentlessly mined and monetised without their informed consent. This apathy is, in part, attributable to the fact we are told we shouldn’t care about privacy if we have nothing to hide. Google has helped propagate this notion. The company’s former CEO Eric Schmidt once said: “If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place.” [...]

Aug. 15, 2018

The Unlikely Activists Who Took On Silicon Valley — and Won - The New York Times

by J.C. DE MARTIN

https://www.nytimes.com/2018/08/14/magazine/facebook-google-privacy-data.ht… The Unlikely Activists Who Took On Silicon Valley — and Won Facebook and Google made billions mining personal data, and fought off anyone who threatened to stop them. Then came a challenge in their own backyard. Aug. 14, 2018 (Sent from my wireless device; please excuse brevity and typos (if any))

Aug. 14, 2018

NEW BOOK Gobernanza y Regulaciones de Internet en América Latina

by Luca Belli

Buongiorno a tutti, Per chi fosse interessato agli sviluppi di governance e regolazione di Internet in America latina e/o cercasse qualcosa da leggere sotto l'ombrellone. Buon ferragosto! Luca Dear colleagues, I would like to draw your attention (particularly of the Spanish speakers amongst you) on the recent release of the book Gobernanza y Regulaciones de Internet en América Latina (Internet Governance and Regulations in Latin America), which is now available in open access here bit.ly/IGRlatam<https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Fbit.ly%2FI…> This is the first work collecting the opinions of academics, regulators, prosecutors, business representatives and civil society advocates that are shaping the evolution of Internet governance and its regulations in Latin America. The volume features 29 chapters dedicated to network infrastructure, connectivity models, privacy and cybersecurity, and emerging issues, and it also includes two prefaces by Vint Cerf (Google’s VP) and Raúl Echeberria (ISOC’s VP), and an excellent postface by Edison Lanza (OAS’ Rapporteur for freedom of expression). The book celebrates the 10th anniversary of the South School on Internet Governance (the main Internet Governance capacity-building initiative in the region) that, last year, was organised at FGV, gathering more than 250 experts and fellows. The Spanish edition of the volume was launched at LACIGF and the Portuguese version is currently being developed. We are also studying the feasibility of an English version. I will share further updates on these latter versions as soon as possible. With my best regards Luca [FGV Direito Rio] Luca Belli, PhD Senior Researcher Head of Internet Governance @ FGV<https://eur04.safelinks.protection.outlook.com/?url=http%3A%2F%2Finternet-g…> luca.belli(a)fgv.br +55 21 3799 5763 @1lucabelli<https://eur04.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.c…> [http://www.fgv.br/mailing/Direito_Rio/assinatura_email/Ondas.png]

Aug. 14, 2018

In its battle with Amazon, Walmart tries to make it easier for online shoppers to return their unwanted purchases without upsetting sellers

by Luigi Scorca

https://www.cnbc.com/amp/2018/08/09/walmart-vs-amazon-walmartcom-makes-it-e…

Aug. 14, 2018

DeepLocker: How AI [anda facial recognition] Can Power a Stealthy New Breed of Malware

by Alberto Cammozzo

Appoggiandosi a un tool open source di reidintificazione su SN (Social Mapper <https://github.com/SpiderLabs/social_mapper>) IBM research dimostra la "fattibilità" di un cryptolocker (o cyberweapon generica) mirato sulla singola persona. In effetti ne sentivamo la mancanza... <https://securityintelligence.com/deeplocker-how-ai-can-power-a-stealthy-new…> [] IBM Research developed DeepLocker to better understand how several existing AI models can be combined with current malware techniques to create a particularly challenging new breed of malware. This class of AI-powered evasive malware conceals its intent until it reaches a specific victim. It unleashes its malicious action as soon as the AI model identifies the target through indicators like facial recognition, geolocation and voice recognition. You can think of this capability as similar to a sniper attack, in contrast to the “spray and pray” approach of traditional malware. DeepLocker is designed to be stealthy. It flies under the radar, avoiding detection until the precise moment it recognizes a specific target. This AI-powered malware is particularly dangerous because, like nation-state malware, it could infect millions of systems without being detected. But, unlike nation-state malware, it is feasible in the civilian and commercial realms. [] Penso che la cosa veramente nuova sia il tool di reidentificazione aperto (con licenza GPL). Se uno strumento di questo tipo sia o no una buona cosa per la privacy è una domanda che mi sono posto nel 2012 in questo paper <http://sedici.unlp.edu.ar/bitstream/handle/10915/23870/Documento_completo.p…> Comunque un ulteriore buon motivo per mascherare l'obiettivo della webcam.

Aug. 10, 2018

Re: [nexa] Let's Encrypt Root Trusted By All Major Root Programs

by Giacomo Tesio

Giusto per aggiungere carne al fuoco, nell'Italia dei miei sogni - posso andare all'anagrafe del mio comune per ottenere gratuitamente una firma della mia chiave pubblica PGP. - posso ottenere un certificato TLS di durata annuale, gratuitamente, per ciascuno dei server che ho a casa. - inviando una mail al Ufficiale preposto del comune (ma questo si potrebbe fare a livello nazionale) ottengo un "trusted timestamping" della mail stessa a fronte del pagamento di un bollo proporzionale alla dimesione della stessa. Servizi del genere avrebbero un costo relativamente limitato ma aprirebbero a potenzialità di sviluppo tecnologico enormi. Sia per le aziende che per i privati. Invece... mi ritrovo con la PEC. E se devo mandarne una ad un funzionario della ASL devo scrivere nell'oggetto "All'attenzione del Dottor Pinco Pallino" perché non ne hanno una ciascuno. E dunque immagino possano leggerla tutti. E non funziona da trusted timestamping. ... Deve proprio essere tanto frustrante? Giacomo 2018-08-08 17:51 GMT+02:00 Giacomo Tesio <giacomo(a)tesio.it>: > As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1 >> <https://letsencrypt.org/certificates/>, is directly trusted by >> Microsoft products. Our root is now trusted by all major root programs, >> including Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry. >> [...] >> While Let’s Encrypt is now directly trusted by almost all newer versions >> of operating systems, browsers, and devices, there are still many older >> versions in the world that do not directly trust Let’s Encrypt. Some of >> those older systems will eventually be updated to trust Let’s Encrypt >> directly. Some will not, and we’ll need to wait for the vast majority of >> those to cycle out of the Web ecosystem. We expect this will take at least >> five more years, so we plan to use a cross signature until then. >> > > https://letsencrypt.org/2018/08/06/trusted-by-all-major-root-programs.html > > > Riflettevo altrove che non riesco a decidere se Let's Encrypt sia una > benedizione o una minaccia. > > Da un lato fornisce certificati gratuiti permettendo di servire contenuti > sensibili (e stupidamente anche quelli non sensibili) via HTTPS. > Dall'altro costituisce una concorrenza tremenda per gli operatori del > settore e concentra un potere enorme in tutto il mondo. > > E' utile ricordare che la Linux Foundation (che sta dietro a Let's > Encrypt) è un consorzio di aziende che ne persegue gli interessi condivisi, > non un'associazione di volontariato a fini benefici. Con sede a San > Francisco. > > > D'altronde... a chi vuoi che importi? E gratis! > > > Giacomo >

Aug. 8, 2018

Let's Encrypt Root Trusted By All Major Root Programs

by Giacomo Tesio

> > As of the end of July 2018, the Let’s Encrypt root, ISRG Root X1 > <https://letsencrypt.org/certificates/>, is directly trusted by Microsoft > products. Our root is now trusted by all major root programs, including > Microsoft, Google, Apple, Mozilla, Oracle, and Blackberry. > [...] > While Let’s Encrypt is now directly trusted by almost all newer versions > of operating systems, browsers, and devices, there are still many older > versions in the world that do not directly trust Let’s Encrypt. Some of > those older systems will eventually be updated to trust Let’s Encrypt > directly. Some will not, and we’ll need to wait for the vast majority of > those to cycle out of the Web ecosystem. We expect this will take at least > five more years, so we plan to use a cross signature until then. > https://letsencrypt.org/2018/08/06/trusted-by-all-major-root-programs.html Riflettevo altrove che non riesco a decidere se Let's Encrypt sia una benedizione o una minaccia. Da un lato fornisce certificati gratuiti permettendo di servire contenuti sensibili (e stupidamente anche quelli non sensibili) via HTTPS. Dall'altro costituisce una concorrenza tremenda per gli operatori del settore e concentra un potere enorme in tutto il mondo. E' utile ricordare che la Linux Foundation (che sta dietro a Let's Encrypt) è un consorzio di aziende che ne persegue gli interessi condivisi, non un'associazione di volontariato a fini benefici. Con sede a San Francisco. D'altronde... a chi vuoi che importi? E gratis! Giacomo

Aug. 8, 2018

Re: [nexa] The no-platforming of Infowars is a watershed moment for the information age

by Giacomo Tesio

Visto che dopo il mio ultimo articolo sono stato accostato ad ufologi, no-vax e complottisti (e ne sono ancora profondamente... "infastidito"), mi limito ad osservare che "a handful of global, for-profit companies" hanno tutte sede nello stesso paese. Giacomo 2018-08-08 16:21 GMT+02:00 Alberto Cammozzo <ac+nexa(a)zeromx.net>: > "So if we are indeed witnessing international erasure on the basis of > political opportunism rather than a specified threshold of the rules being > breached, we should all have cause for concern." > > <https://medium.com/@silkiecarlo/the-no-platforming-of-infowars-is-a-watersh…> > > Always the trend-setter, Apple’s decisive action against Infowars has led to > an unprecedented domino effect. After Apple delisted podcast links from the > right-wing media outlet, Spotify soon followed. Facebook made a decision to > ‘unpublish’ Infowars’ pages hours later, before the group’s main home, > YouTube, said it had ‘terminated’ the group’s channel, watched by 2.5 > million subscribers. > > Hundreds of well-intentioned campaigners, commentators and even journalists > are celebrating the public hanging of Infowars — but this style of execution > benefits no one. > > The major internet platforms are increasingly society’s chief arbiters of > free speech. Our conversations, relationships, businesses and democracies > are increasingly mediated by a handful of global, for-profit companies. > > Those companies are within their rights to set their own rules about who can > and cannot share information on their sites — but Facebook and YouTube have > become de facto global information services. Of the world’s 3 billion > internet users, 2.2 billion are active Facebook users and 1.8 billion have > active YouTube accounts. When tech giants hold a monopoly on free speech > online, that responsibility must be taken particularly seriously. > > But the way in which the tech giants have dealt with Infowars doesn’t appear > to be serious at all. The industry-wide no-platforming appears to be a > herd-like PR exercise rather than a regulatory one. Despite the prevalence > of misogynistic, race-baiting and some frankly bonkers Infowars content, the > removals were not in relation to specific posts or videos and the reasons > given were generalised ones. Even Discus, Linkedin, Mailchimp and Pinterest > have rushed in to the industry dog-pile. > > It may be that Infowars exceeded a prescribed number of strikes or warnings > and therefore committed its own suicide — but it is vanishingly unlikely > that Apple, Spotify, Facebook and YouTube, not to mention the others, all > arrived at their own independent conclusions against Infowars at the same > time purely by coincidence. So if we are indeed witnessing international > erasure on the basis of political opportunism rather than a specified > threshold of the rules being breached, we should all have cause for concern. > > It is vital that the tech companies inspire public trust and confidence in > their judgements. They must take their responsibility to protect users from > violent and unlawful content as seriously as their duty to uphold and > promote free expression. Sensitive decisions about what is and is not > permissible speech or information need to be made transparently and > delivered honestly, objectively and equitably. The rules must be fair, and > where they are breached, there should be clear, foreseeable consequences. > > [] > > For the tech giants to collectively erase Infowars with little > explanation — despite the likely availability of multiple rule breaches, > some of which I had reported myself — risks the appearance of arbitrary > censorship, executed in concert. Surely the very worst way to convince > conspiracy theorists that there is no conspiracy is for the world’s most > powerful tech companies to simultaneously silence the most popular > conspiracy theorist? > > We cannot unconditionally trust profit-driven tech companies to censor > responsibly — public trust needs to be earned and procedural safeguards need > to be instituted. Just last week, it emerged that YouTube’s parent company > Google is building a Chinese state-approved news app and search engine > <https://twitter.com/bbw1984/status/1024953410326614016> to deliver a highly > censored world view to millions of citizens on behalf of the communist > dictatorship. Complicity with a totalitarian regime to oppress a population > would suggest that a regulatory system deserving of public trust is missing. > > [] > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa

Aug. 8, 2018