April 2019 - nexa - server-nexa.polito.it

How Germany's anti-trust watchdog could change the way Facebook works - The Listener

by J.C. DE MARTIN

https://www.noted.co.nz/tech/germany-anti-trust-watchdog-could-change-way-f… (Sent from my wireless device; please excuse brevity and typos (if any))

April 13, 2019

Re: [nexa] Safari link tracking can no longer be disabled

by Giacomo

On April 9, 2019 10:14:49 AM UTC, Giacomo Tesio <giacomo(a)tesio.it> wrote: >https://lapcatsoftware.com/articles/Safari-link-tracking.html > >E tanto via JS il server può fare lo stesso. > >Si chiama "Insecurity through Obscurity". >Ed è uno standard! Per chi fosse interessato WebKit ha confermato quanto sopra elencando diversi altri modi (standard e non) con cui è possibile tracciare i click dell'utente. https://webkit.org/blog/8821/link-click-analytics-and-privacy/ La prima tecnica in realtà può essere resa molto più efficiente e "trasparente" con un semplice IFrame cui delegare le chiamate sincrone, ma immagino che non gli sia venuto in mente (e comunque avrebbe mostrato quanto è debole l'argomento della performance). Ripiegare sui content blocker è naturalmente un modo elegante per dire che privacy e sicurezza non sono un diritto ma un privilegio, per chi sa, per chi se la merita. Varrebbe la pena rileggere la Dichiarazione Universale dei Diritti dell Uomo. Ma e lunga... e in Silicon Valley non hanno tempo, poverini... Giacomo

April 12, 2019

Re: [nexa] Matrix.org: We have discovered and addressed a security breach.

by Giacomo Tesio

PS: la riga "Homeservers other than matrix.org are unaffected." significa che coloro che usavano il software sulle proprie macchine non sono stati compromessi. Questa è l'informazione più interessante per questa lista. Per quanto importanti siano le normative, nessuna legge può rendere sicuri i vostri dati. Solo un server sotto il vostro diretto (e _competente_) controllo può veramente garantirvi privacy e sicurezza. Giacomo On 12/04/2019, Giacomo Tesio <giacomo(a)tesio.it> wrote: > Matrix è (era?) un bel progetto open source. > > Al di là dei problemi di sicurezza del loro sistema che hanno permesso > la compromissione, il fatto che abbiano rimosso le issue create su > GitHub dall'hacker che li ha bucati (che spiegava come ha fatto e > suggeriva correzioni al sistema) rappresenta uno splendido esempio di > come NON gestire un breach di sicurezza. > > Ora matrixnotorg è stato rimosso da GitHub ma potete dare un occhiata > sulla WaybackMachine > > https://web.archive.org/web/20190412145208/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145145/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145122/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145058/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145035/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… > https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… > > > > Segue un estratto dalla disclosure su > https://matrix.org/blog/2019/04/11/security-incident/ > > > TL;DR: An attacker gained access to the servers hosting Matrix.org. > The intruder had access to the production databases, potentially > giving them access to unencrypted message data, password > hashes and access tokens. As a precaution, if you're a matrix.org > user you should change your password now. [...] > > # The security breach is not a Matrix issue. > > The hacker exploited a vulnerability in our production infrastructure > (specifically a slightly outdated version of Jenkins). > > Homeservers other than matrix.org are unaffected. [...] > > # What user data has been accessed? > > Forensics are ongoing; so far we've found no evidence of > large quantities of data being downloaded. The attacker did > have access to the production database, so unencrypted > content (including private messages, password hashes and > access tokens) may be compromised. [...] > > # Update 2019-04-12 > > The rebuilt infrastructure itself is secure, however, and the > DNS issue has been solved without further abuse. If you have > already changed your password, you do not need to do so again. [...] > > The attacker has also posted github issues detailing some of > their actions and suggested remediations at > https://github.com/matrix-org/matrix.org/issues/created_by/matrixnotorg. > > This confirms that GPG keys used for signing packages were compromised. >

April 12, 2019

Matrix.org: We have discovered and addressed a security breach.

by Giacomo Tesio

Matrix è (era?) un bel progetto open source. Al di là dei problemi di sicurezza del loro sistema che hanno permesso la compromissione, il fatto che abbiano rimosso le issue create su GitHub dall'hacker che li ha bucati (che spiegava come ha fatto e suggeriva correzioni al sistema) rappresenta uno splendido esempio di come NON gestire un breach di sicurezza. Ora matrixnotorg è stato rimosso da GitHub ma potete dare un occhiata sulla WaybackMachine https://web.archive.org/web/20190412145208/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145145/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145122/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145058/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145035/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… Segue un estratto dalla disclosure su https://matrix.org/blog/2019/04/11/security-incident/ TL;DR: An attacker gained access to the servers hosting Matrix.org. The intruder had access to the production databases, potentially giving them access to unencrypted message data, password hashes and access tokens. As a precaution, if you're a matrix.org user you should change your password now. [...] # The security breach is not a Matrix issue. The hacker exploited a vulnerability in our production infrastructure (specifically a slightly outdated version of Jenkins). Homeservers other than matrix.org are unaffected. [...] # What user data has been accessed? Forensics are ongoing; so far we've found no evidence of large quantities of data being downloaded. The attacker did have access to the production database, so unencrypted content (including private messages, password hashes and access tokens) may be compromised. [...] # Update 2019-04-12 The rebuilt infrastructure itself is secure, however, and the DNS issue has been solved without further abuse. If you have already changed your password, you do not need to do so again. [...] The attacker has also posted github issues detailing some of their actions and suggested remediations at https://github.com/matrix-org/matrix.org/issues/created_by/matrixnotorg. This confirms that GPG keys used for signing packages were compromised.

April 12, 2019

Re: [nexa] https://www.newyorker.com/tech/annals-of-technology/mark-zuckerberg-elizabeth-warren-and-the-case-for-regulating-big-tech

by Giacomo Tesio

On 12/04/2019, M. Fioretti <mfioretti(a)nexaima.net> wrote: > dei limiti della proposta Warren ho scritto pochi giorni fa qui: > > http://stop.zona-m.net/2019/04/breaking-up-facebook-einstein-would-not-be-h… Bell'articolo. > in evolutionary terms, unlike writing and “analog” > alphabets, digital protocols and file formats are still > so new that, as a species, we just have not realized > their nature yet. Questo è vero per l'intera informatica, purtroppo. > It is only because of this that startups based on > creating deliberately incompatible standards for > digital communication are still called “innovation”. Vero, ma parziale. Proprio perché non si può risolvere un problema con la stessa mentalità che l'ha causato. Se è vero che l'Informatica è ancora troppo primitiva, imporre una interoperabilità che imporrebbe protocolli progettati "by committee" è una soluzione miope, destinata a creare più problemi di quelli che promette di risolvere. Con questo non voglio dire che non si debba regolamentare e che la regolamentazione non debba imporre una apertura dei sistemi, ma invece che richiedere la definizione di protocolli condivisi bisognerebbe imporre l'apertura dei protocolli utilizzati (se non proprio del software... ma questa è un'altra storia :-D) e delle reti, e lasciare che chi vuole si federi implementando il protocollo proposto dall'azienda. Così si lascia aperta la possibilità che protocolli migliori emergano dal basso, come è successo con ActivityPub (che pure rimane UN possibile protocollo... e non il protocollo definitivo da utilizzare per tutti i social media.. la strada dell'Informatica è ancora lunga!). D'altronde, come osserva anche la Halpern nel suo articolo > There are numerous reasons for this. As we saw > from their fawning, elementary and sometimes inane > questions during those hearings, few members of > Congress understand the technology that they are > tasked with regulating. > [...] > legislators are under the sway of an army of lobbyists: > Google alone spent more than twenty-one million dollars > on lobbying last year; together, Google, Facebook, and > Amazon spent an unprecedented forty-eight million dollars, > which was an increase of seventeen per cent from the > previous year, much of it to stave off regulation. Purtroppo, questo non è un problema solo statunitense. Una regolamentazione affrettata (o etero diretta) finirebbe per supportare e rafforzare proprio le posizioni dominanti che promette di smantellare. Giacomo

April 12, 2019

BBC:"US lawmakers to probe algorithm bias"

by J.C. DE MARTIN

*US lawmakers to probe algorithm bias* 11 April 2019 Computer algorithms must show they are free of race, gender and other biases before they are deployed, US politicians have proposed. Lawmakers have drafted a bill that would require tech firms to test prototype algorithms for bias. Many organisations rely on coded instructions or algorithms for tasks such as showing users relevant ads, analysing behaviour or sorting data. Critics said the bill could limit the benefits of machine intelligence. [...] continua qui: https://www.bbc.com/news/technology-47894492

April 12, 2019

A German court forced us to remove part of a Wikipedia article’s ‘history.’ Here’s what that means.

by Giacomo Tesio

Brutto precedente. Estremamente pericoloso. Non solo si rimuove il contenuto diffamatorio, ma si riscrive la sua storia. Si cerca di cancellare la memoria invece di arricchirla di una nuova informazione (la constatazione di un tribunale che il contenuto offensivo era falso e dunque diffamatorio). https://wikimediafoundation.org/2019/04/11/a-german-court-forced-us-to-remo… Three months ago, a German court ruled that part of a Wikipedia article—found to be defamatory in a previous court decision—had to be removed from both the article and its associated revision tracker, known as a “history” page. (History pages allow anyone to see how a Wikipedia article has developed since they were created, in some cases going back all the way to 2001. We have a desktop-based tutorial on using these history pages in both English and German.) A German court ruled in September of last year that the content was in fact defamatory, largely because the source in question had been taken offline—what we call “link rot.” German volunteers quickly removed the text in question from the article but the article’s corresponding history page retained the statements. This is a common practice on Wikimedia projects. [...] Article histories are a useful tool for contributors, readers, and staff—even courts, on occasion— to see how an article has evolved over time. [...] In a case like this, deleting the article history may in fact inspire more curiosity, leading visitors to search for more information about the controversy. [...] Note that the issue in this case is distinct from the right to be forgotten. Here, the claim was that something in the article was false in the first place, that a source had made a mistake, and that the information harmed the individual’s reputation.

April 12, 2019

Re: [nexa] https://www.newyorker.com/tech/annals-of-technology/mark-zuckerberg-elizabeth-warren-and-the-case-for-regulating-big-tech

by M. Fioretti

On Thu, Apr 11, 2019 18:37:59 PM +0200, J.C. DE MARTIN wrote: > > https://www.newyorker.com/tech/annals-of-technology/mark-zuckerberg-elizabe… > dei limiti della proposta Warren ho scritto pochi giorni fa qui: http://stop.zona-m.net/2019/04/breaking-up-facebook-einstein-would-not-be-h… Marco -- M. Fioretti http://mfioretti.com http://stop.zona-m.net Your own civil rights and the quality of your life heavily depend on how software is used *around* you

April 12, 2019

Google AMP lowered our page speed, and there's no choice but to use it

by Giacomo Tesio

https://unlikekinds.com/article/google-amp-page-speed For those that don’t know, a very quick primer. AMP is a set of rules that publishers (typically news and analysis content providers) must abide by in order to appear in the “Top Stories” section of Google’s search results, a lucrative position at the top of the page. It’s also required for your content to appear as a “rich” result, meaning emphasized links with images, which can receive a lot more attention from users. AMP must be implemented by the publisher on their site, and it’s not trivial. Google puts the onus on publishers to, effectively, rejig large tracts of their websites layout, content, and functionality, in return for preferential treatment. [...] We didn’t really want to; our site is already fast because we made it fast, largely with a combination of clever caching and minimal code. But hey, maybe AMP would speed things up. Maybe Google’s new future is bright. It isn’t. [...] But Google already ranks websites by speed. [...] So you’d imagine that Google’s existing page speed ranking could easily be used to limit which sites appear in the carousel. Anything with a performance score below an 80 could appear as a performance issue in Google Search Console, and the site demoted. But no, Google insists you build your website with their technology. [...] # AMP isn’t about speed. It’s about control. AMP is an open source project. That evokes images of open, honest, collaboration amongst equals. But that’s not what’s happening. For a start, anyone contributing to AMP is required to sign a contributor license agreement (CLA) for their code to be accepted into the project. The CLA requires that you “grant to Google and to recipients of software distributed by Google a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license”. There’s also a clause for much the same regarding any patents. Note, you don’t grant these rights to the AMP Project, you grant them to Google. Google owns the code and patents. The issues on AMP’s GitHub page is littered with revolts. Most notorious was Google’s attempt to co-opt email itself. The issue is full of non-Google developers in open revolt against Google’s power-grab, with users describing it as misguided and user-hostile, complete with frequent use of the thumbs-down emoji. Google’s response? They’ve labeled the issue Priority 2: “Soon” and “INTENT TO IMPLEMENT”, and are powering ahead regardless. [...] This is the core of the problem. If you’re trying to build a brand with something unique or distinctive, Google forbids you. And let’s not forget, it’ll be served from a Google domain, further diminishing your brand. [...] Google’s in an incredible position of power. According to the Wall Street Journal: Publishers who are critical of AMP were reluctant to speak publicly about their frustrations, or to remove their AMP content. One executive said he would not comment on the record for fear that Google might “turn some knob that hurts the company.” Sure, there’s a technical steering committee. 3/7 of them are Google employees, and the others are platforms: Microsoft, Twitter, Pinterest, and Pantheon (a web host, for some reason) - not the people actually making the content. Not the publishers like the New York Times, just the gatekeepers. # Why can Google do this? Because they own the web. [...]

April 11, 2019

Decentralizing the Web with FreedomBox

by Giacomo Tesio

https://www.linkedin.com/pulse/decentralizing-web-freedombox-james-pemantel… In the Computer Underground of the 80's and 90's, there was an axiom "Knowledge is power; Information is freedom." Information is critical to our democracy and it has become apparent that popular technology can be used in ways -- both deliberately and passively -- that weaken democracy: - The way that news is presented on social media is designed to be addictive and provoke intense responses. - Geo-tracking features of social media platforms have been used to intimidate protesters and discourage dissent. - Voter manipulation via social media influenced recent US and UK national elections. - In some countries, the platforms are censored by governments and in other cases the propensity for information to "go viral" is exploited by the state to control users. The trend for popular technology is for it to be centralized on servers and controlled by someone else. At the advent of personal computing, it was the client that went into the home, not the server. FreedomBox is a non-profit project that is designed to decentralize the web by putting the control of one's information back into the hands of the user. It is a distribution of Debian GNU/Linux entirely comprised of Free Software with a web frontend that makes management and installation of software user-friendly.

April 11, 2019