May 2019 - nexa - server-nexa.polito.it

data activism | EU19 Tracking Exposed

by J.C. DE MARTIN

https://eu19.tracking.exposed/page/data-activism/ As the research that exposed the Volkswagen pollution scandal has revealed, how one is collecting data is so fundamental that it might make a difference between a critical analysis and the press review of a company. We, as free thinkers and researchers, want to be able to collect data from the bottom, as users, from users, for users. In other terms, not just for ourselves. We build tools that allow other researchers, or users themselves, to understand how the algorithm is having an impact on their life: in this challenge, the deception is personalized, and our solution is collective. (Sent from my wireless device; please excuse brevity and typos (if any))

May 11, 2019

Re: [nexa] Lockdown: The coming war on general-purpose computing / Boing Boing

by Stefano Quintarelli

vogliamo parlare della medicina ? o della produzione di generi alimentari ? o della farmaceutica ? il mondo e' troppo complicato per non avere specializzazioni con deleghe, norme, sanzioni, ecc. ed e' anche sano che ci siano outliers. IMHO On 11/05/2019 08:55, Alberto Cammozzo wrote: > Mi viene da paragonare quanto dici con un altro genere di "codice", > quello giuridico. > Anche se a scrivere le leggi sono degli specialisti, e pur essendo > formulate in italiano, sono a volte poco comprensibili e intrecciate in > modo intricato, preferisco che le leggi siano frutto di un processo > aperto e il più possibile trasparente che di uno chiuso e proprietario. > E i "malintenzionati" che introducono qualche "riga di codice" ad hoc > nella finanziaria ci sono sempre, no? Ma ci sono degli specialisti che > leggono anche quelle. With many eyeballs, all bugs are shallow... > > Se sono chiare, meglio, ma prima di tutto siano pubbliche. > Ciao, > Alberto > > > On May 10, 2019 9:32:15 PM UTC, Giacomo Tesio <giacomo(a)tesio.it> wrote: > > On 10/05/2019, Alberto Cammozzo <ac+nexa(a)zeromx.net> wrote: > > General-purpose computers are astounding. They're so astounding > that our > society still struggles to come to grips with them, what they're > for, > how to accommodate them, and how to cope with them. [...] > > This rule of thumb serves regulators well, by and large, but it is > rendered null and void by the general-purpose computer and the > general-purpose network—the PC and the Internet. > > We don't know how to build a general-purpose computer that is > capable of > running any program except for some program that we don't like, is > prohibited by law, or which loses us money. > > > Qualche giorno fa leggevo un articolo che mi ha proprio fatto pensare > a questo discorso: > > https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-se… > > Propone tutta una serie di considerazioni serissime sulla > (scarsissima) sicurezza dei processori e sistemi operativi (con > qualche piccolissima scivolata laddove confonde UEFI Runtime Services > e applicazioni UEFI) e fornisce ottime ragioni per cui tutto lo stack > dovrebbe essere software libero prodotto da compilazioni > riproducibili. > > Perché così possiamo capire cosa fa. > > Così possiamo. > > Noi. > > From the above, it’s pretty clear that for Rings -1 to 3, > we have the option to use open source software and have a > large amount of visibility and control over the software > we run. For the privilege levels under Ring -1, we have > less control but it is getting better with the open > source firmware community and projects. > > It’s counter-intuitive that the code that we have the > least visibility into has the most privileges. [...] > > Between Ring -2 and Ring -3 we have at least 2 and a > half other kernels in our stack as well as a bunch of > proprietary and unnecessary complexity. Each of these kernels > have their own networking stacks and web servers. > The code can also modify itself and persist across power cycles > and re-installs. We have very little visibility into what the > code in these rings is actually doing, which is horrifying > considering these rings have the most privileges. [...] > > They are horrifying when they happen though. Just to use > one as an example although I will let you find others on > your own, there was a bug in the web server of the Intel > Management Engine that was there for seven years without > them realizing. > > How can we make it better? > > > Chi sono questi "We"? > > Dopo qualche anno come sviluppatore di kernel io sono parte di questo "We"? > > Non ho problemi a leggere codice C e me la cavo decentemente con > l'Assembly: non dovrei avere grossi problemi con nessuno dei > componenti descritti... ma dove potrei mai trovare il tempo di > studiarli seriamente? Per debuggare una implementazione delle > specifiche UEFI o per il SMM? > > Temo di no. A meno di venire pagato a tempo pieno per farlo. > > E se non posso io, che ho gli "skill" adatti, come posso assumere che > altri lo facciano? > Ed infatti, come mostrò qualche anno fa chiaramente Heartbleed, nessuno lo fa. > Nessuno legge VERAMENTE i sorgenti. Una sbirciatina ogni tanto sì. > Profonda comprensione solo se costretti. > > Ma non è la maledizione del TL;DR. E proprio l'assenza di tempo libero. > > Tuttavia il marketing dell'Open Source è riuscito in qualche modo a > convincere il mondo di essere buono e di alta qualità per il solo > fatto di essere open. Di meritare fiducia. Per farlo ha giocato > sull'ambiguo rapporto con il software libero, dichiarandosene > successore nel momento stesso in cui marginalizzava gli hacker. Ma > anche sull'illusione che la trasparenza sia sufficiente a garantire la > qualità e... l'onestà. > Chi mai ruberebbe alla luce del sole? > > Ma la cosa più divertente è che in quel "We can" di Obamiana memoria > si riconoscono tutti. > > Anche coloro che non saprebbero nemmeno da dove iniziare a leggerlo un kernel. > > "Possiamo leggere il sorgente" è una affermazione valida solo per > coloro che effettivamente possono. > Ovvero che hanno le competenze e hanno il tempo. > > Tutti gli altri sono stati indotti a credere che si possono fidare > perché qualcuno, sul pianeta, ha le competenze ed il tempo per > studiare e debuggare i sorgenti del software libero che usano, non ha > di meglio da fare e sicuramente non userebbe mai eventuali > vulnerabilità, ma cercherebbe di correggerle prima che qualche > malintenzionato ne approfitti... > > > Ops! Possibile che i malintenzionati abbiano sia le competenze che il tempo? :-D > > E viene giù il castello di carte. > > > Lo scopo dell'articolo era sostenere l'importanza del firmware open source. > > Purtroppo però per la stragrande maggioranza della popolazione umana, > l'unica vera differenza fra open source e software proprietario è il > prezzo. > > > Perché tanto non vanno a leggere i sorgenti. > Perché anche quando hanno gli skill, non hanno il tempo. > > E devono fidarsi ciecamente. > > > Dunque ci troviamo di fronte ad una nuova forma di IP protection, > basata non più (o meglio, non solo) sulla legge, ma sulle barriere > socio-culturali. > > Basta per esempio scrivere software così complesso, che mettere su > l'infrastruttura per compilarlo da zero richiede giorni. > O che richiede mesi per essere compreso e debuggato in profondità. > O che richiederebbe decenni per essere sfidato da un concorrente (vedi > l'abbandono da parte di Microsoft del proprio web engine a favore di > Chromium!) > > Tuttavia questa nuova barriera è solo necessaria per scoraggiare gli hacker. > Per il resto della popolazione basta diffondere l'idea che > l'Informatica sia una cosa da specialisti. > > > Testi scritti da specialisti per essere eseguiti passo passo da > macchine generali. > > La "specialità" di chi sa ideare e realizzare soluzioni per un > qualsiasi problema... in modo generale. > > > Non è un po' troppo generale come specialità? > > Chi non sa PROGRAMMARE un computer in modo fluente è un ANALFABETA informatico. > Non è colpa sua, ma non dirlo chiaramente significa abbandonarlo alla > sua inconsapevole e manipolabile ignoranza. > > Saper usare la mail, o Excel non lo rende meno analfabeta, meno manipolabile. > > > Il firmware deve essere software libero. > Software leggibile e modificabile da TUTTI. > Se è leggibile e modificabile solo da una casta di eletti, non è libero affatto. > > E questo significa che dobbiamo renderlo più semplice. > Perché altrimenti seccature come DRM, Copyright e Brevetti > diventeranno sempre più secondarie rispetto alla scarsità di tempo e > competenze. > > > Giacomo > > > _______________________________________________ > nexa mailing list > nexa(a)server-nexa.polito.it > https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa > -- reserve your meeting with me at http://cal.quintarelli.it

May 11, 2019

Re: [nexa] Lockdown: The coming war on general-purpose computing / Boing Boing

by Alberto Cammozzo

Mi viene da paragonare quanto dici con un altro genere di "codice", quello giuridico. Anche se a scrivere le leggi sono degli specialisti, e pur essendo formulate in italiano, sono a volte poco comprensibili e intrecciate in modo intricato, preferisco che le leggi siano frutto di un processo aperto e il più possibile trasparente che di uno chiuso e proprietario. E i "malintenzionati" che introducono qualche "riga di codice" ad hoc nella finanziaria ci sono sempre, no? Ma ci sono degli specialisti che leggono anche quelle. With many eyeballs, all bugs are shallow... Se sono chiare, meglio, ma prima di tutto siano pubbliche. Ciao, Alberto On May 10, 2019 9:32:15 PM UTC, Giacomo Tesio <giacomo(a)tesio.it> wrote: >On 10/05/2019, Alberto Cammozzo <ac+nexa(a)zeromx.net> wrote: >> General-purpose computers are astounding. They're so astounding that >our >> society still struggles to come to grips with them, what they're for, >> how to accommodate them, and how to cope with them. [...] >> >> This rule of thumb serves regulators well, by and large, but it is >> rendered null and void by the general-purpose computer and the >> general-purpose network—the PC and the Internet. >> >> We don't know how to build a general-purpose computer that is capable >of >> running any program except for some program that we don't like, is >> prohibited by law, or which loses us money. > >Qualche giorno fa leggevo un articolo che mi ha proprio fatto pensare >a questo discorso: > >https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-se… > >Propone tutta una serie di considerazioni serissime sulla >(scarsissima) sicurezza dei processori e sistemi operativi (con >qualche piccolissima scivolata laddove confonde UEFI Runtime Services >e applicazioni UEFI) e fornisce ottime ragioni per cui tutto lo stack >dovrebbe essere software libero prodotto da compilazioni >riproducibili. > >Perché così possiamo capire cosa fa. > >Così possiamo. > >Noi. > >> From the above, it’s pretty clear that for Rings -1 to 3, >> we have the option to use open source software and have a >> large amount of visibility and control over the software >> we run. For the privilege levels under Ring -1, we have >> less control but it is getting better with the open >> source firmware community and projects. >> >> It’s counter-intuitive that the code that we have the >> least visibility into has the most privileges. [...] >> >> Between Ring -2 and Ring -3 we have at least 2 and a >> half other kernels in our stack as well as a bunch of >> proprietary and unnecessary complexity. Each of these kernels >> have their own networking stacks and web servers. >> The code can also modify itself and persist across power cycles >> and re-installs. We have very little visibility into what the >> code in these rings is actually doing, which is horrifying >> considering these rings have the most privileges. [...] >> >> They are horrifying when they happen though. Just to use >> one as an example although I will let you find others on >> your own, there was a bug in the web server of the Intel >> Management Engine that was there for seven years without >> them realizing. >> >> How can we make it better? > >Chi sono questi "We"? > >Dopo qualche anno come sviluppatore di kernel io sono parte di questo >"We"? > >Non ho problemi a leggere codice C e me la cavo decentemente con >l'Assembly: non dovrei avere grossi problemi con nessuno dei >componenti descritti... ma dove potrei mai trovare il tempo di >studiarli seriamente? Per debuggare una implementazione delle >specifiche UEFI o per il SMM? > >Temo di no. A meno di venire pagato a tempo pieno per farlo. > >E se non posso io, che ho gli "skill" adatti, come posso assumere che >altri lo facciano? >Ed infatti, come mostrò qualche anno fa chiaramente Heartbleed, nessuno >lo fa. >Nessuno legge VERAMENTE i sorgenti. Una sbirciatina ogni tanto sì. >Profonda comprensione solo se costretti. > >Ma non è la maledizione del TL;DR. E proprio l'assenza di tempo libero. > >Tuttavia il marketing dell'Open Source è riuscito in qualche modo a >convincere il mondo di essere buono e di alta qualità per il solo >fatto di essere open. Di meritare fiducia. Per farlo ha giocato >sull'ambiguo rapporto con il software libero, dichiarandosene >successore nel momento stesso in cui marginalizzava gli hacker. Ma >anche sull'illusione che la trasparenza sia sufficiente a garantire la >qualità e... l'onestà. >Chi mai ruberebbe alla luce del sole? > >Ma la cosa più divertente è che in quel "We can" di Obamiana memoria >si riconoscono tutti. > >Anche coloro che non saprebbero nemmeno da dove iniziare a leggerlo un >kernel. > >"Possiamo leggere il sorgente" è una affermazione valida solo per >coloro che effettivamente possono. >Ovvero che hanno le competenze e hanno il tempo. > >Tutti gli altri sono stati indotti a credere che si possono fidare >perché qualcuno, sul pianeta, ha le competenze ed il tempo per >studiare e debuggare i sorgenti del software libero che usano, non ha >di meglio da fare e sicuramente non userebbe mai eventuali >vulnerabilità, ma cercherebbe di correggerle prima che qualche >malintenzionato ne approfitti... > > >Ops! Possibile che i malintenzionati abbiano sia le competenze che il >tempo? :-D > >E viene giù il castello di carte. > > >Lo scopo dell'articolo era sostenere l'importanza del firmware open >source. > >Purtroppo però per la stragrande maggioranza della popolazione umana, >l'unica vera differenza fra open source e software proprietario è il >prezzo. > > >Perché tanto non vanno a leggere i sorgenti. >Perché anche quando hanno gli skill, non hanno il tempo. > >E devono fidarsi ciecamente. > > >Dunque ci troviamo di fronte ad una nuova forma di IP protection, >basata non più (o meglio, non solo) sulla legge, ma sulle barriere >socio-culturali. > >Basta per esempio scrivere software così complesso, che mettere su >l'infrastruttura per compilarlo da zero richiede giorni. >O che richiede mesi per essere compreso e debuggato in profondità. >O che richiederebbe decenni per essere sfidato da un concorrente (vedi >l'abbandono da parte di Microsoft del proprio web engine a favore di >Chromium!) > >Tuttavia questa nuova barriera è solo necessaria per scoraggiare gli >hacker. >Per il resto della popolazione basta diffondere l'idea che >l'Informatica sia una cosa da specialisti. > > >Testi scritti da specialisti per essere eseguiti passo passo da >macchine generali. > >La "specialità" di chi sa ideare e realizzare soluzioni per un >qualsiasi problema... in modo generale. > > >Non è un po' troppo generale come specialità? > >Chi non sa PROGRAMMARE un computer in modo fluente è un ANALFABETA >informatico. >Non è colpa sua, ma non dirlo chiaramente significa abbandonarlo alla >sua inconsapevole e manipolabile ignoranza. > >Saper usare la mail, o Excel non lo rende meno analfabeta, meno >manipolabile. > > >Il firmware deve essere software libero. >Software leggibile e modificabile da TUTTI. >Se è leggibile e modificabile solo da una casta di eletti, non è libero >affatto. > >E questo significa che dobbiamo renderlo più semplice. >Perché altrimenti seccature come DRM, Copyright e Brevetti >diventeranno sempre più secondarie rispetto alla scarsità di tempo e >competenze. > > >Giacomo

May 11, 2019

Re: [nexa] Una notizia, in fondo è solo una notizia... o no?

by Giacomo Tesio

On 10/05/2019, M. Fioretti <mfioretti(a)nexaima.net> wrote: > Confondere educazione e formazione professionale, cioè l'idea stessa "la > scuola deve preparare al **lavoro**" mi sembra sempre più un errore > gravissimo. Sono assolutamente d'accordo. Non a caso il Programma del "Piano di Rinascita Democratica" della P2 sottolineava l'importanza di evitare "una forte e pericolosa disoccupazione intellettuale" riservando "il diritto allo studio superiore per i più meritevoli"! Poche menti pensanti sono più deboli e manipolabili di tante menti pensanti. Ed il loro presunto "merito", le rende facili vittime di un elitismo miope ed arrogante che è fondamentale per il diffondersi dei populismi! Tuttavia educazione civica ed istruzione sono la stessa cosa. Non si può essere pienamente cittadini senza conoscere veramente la storia del proprio Paese o senza saper leggere, scrivere, nonché conoscere la matematica e l'informatica. La formazione professionale potremmo lasciarla/imporla alle aziende, sul campo. Ma fino al raggiungimento della maggiore età, fino all'assunzione del dovere politico che il diritto al voto realizza, lo Stato dovrebbe garantire a tutti i cittadini la Cultura necessaria ad adempiere a tale dovere in modo libero, critico, autonomo e responsabile. L'educazione non fornisce forse una soluzione definitiva ai problemi economici. Ma è l'unico strumento che abbiamo per preservare e diffondere la Democrazia. Giacomo

May 10, 2019

Re: [nexa] Lockdown: The coming war on general-purpose computing / Boing Boing

by Giacomo Tesio

On 10/05/2019, Alberto Cammozzo <ac+nexa(a)zeromx.net> wrote: > General-purpose computers are astounding. They're so astounding that our > society still struggles to come to grips with them, what they're for, > how to accommodate them, and how to cope with them. [...] > > This rule of thumb serves regulators well, by and large, but it is > rendered null and void by the general-purpose computer and the > general-purpose network—the PC and the Internet. > > We don't know how to build a general-purpose computer that is capable of > running any program except for some program that we don't like, is > prohibited by law, or which loses us money. Qualche giorno fa leggevo un articolo che mi ha proprio fatto pensare a questo discorso: https://blog.jessfraz.com/post/why-open-source-firmware-is-important-for-se… Propone tutta una serie di considerazioni serissime sulla (scarsissima) sicurezza dei processori e sistemi operativi (con qualche piccolissima scivolata laddove confonde UEFI Runtime Services e applicazioni UEFI) e fornisce ottime ragioni per cui tutto lo stack dovrebbe essere software libero prodotto da compilazioni riproducibili. Perché così possiamo capire cosa fa. Così possiamo. Noi. > From the above, it’s pretty clear that for Rings -1 to 3, > we have the option to use open source software and have a > large amount of visibility and control over the software > we run. For the privilege levels under Ring -1, we have > less control but it is getting better with the open > source firmware community and projects. > > It’s counter-intuitive that the code that we have the > least visibility into has the most privileges. [...] > > Between Ring -2 and Ring -3 we have at least 2 and a > half other kernels in our stack as well as a bunch of > proprietary and unnecessary complexity. Each of these kernels > have their own networking stacks and web servers. > The code can also modify itself and persist across power cycles > and re-installs. We have very little visibility into what the > code in these rings is actually doing, which is horrifying > considering these rings have the most privileges. [...] > > They are horrifying when they happen though. Just to use > one as an example although I will let you find others on > your own, there was a bug in the web server of the Intel > Management Engine that was there for seven years without > them realizing. > > How can we make it better? Chi sono questi "We"? Dopo qualche anno come sviluppatore di kernel io sono parte di questo "We"? Non ho problemi a leggere codice C e me la cavo decentemente con l'Assembly: non dovrei avere grossi problemi con nessuno dei componenti descritti... ma dove potrei mai trovare il tempo di studiarli seriamente? Per debuggare una implementazione delle specifiche UEFI o per il SMM? Temo di no. A meno di venire pagato a tempo pieno per farlo. E se non posso io, che ho gli "skill" adatti, come posso assumere che altri lo facciano? Ed infatti, come mostrò qualche anno fa chiaramente Heartbleed, nessuno lo fa. Nessuno legge VERAMENTE i sorgenti. Una sbirciatina ogni tanto sì. Profonda comprensione solo se costretti. Ma non è la maledizione del TL;DR. E proprio l'assenza di tempo libero. Tuttavia il marketing dell'Open Source è riuscito in qualche modo a convincere il mondo di essere buono e di alta qualità per il solo fatto di essere open. Di meritare fiducia. Per farlo ha giocato sull'ambiguo rapporto con il software libero, dichiarandosene successore nel momento stesso in cui marginalizzava gli hacker. Ma anche sull'illusione che la trasparenza sia sufficiente a garantire la qualità e... l'onestà. Chi mai ruberebbe alla luce del sole? Ma la cosa più divertente è che in quel "We can" di Obamiana memoria si riconoscono tutti. Anche coloro che non saprebbero nemmeno da dove iniziare a leggerlo un kernel. "Possiamo leggere il sorgente" è una affermazione valida solo per coloro che effettivamente possono. Ovvero che hanno le competenze e hanno il tempo. Tutti gli altri sono stati indotti a credere che si possono fidare perché qualcuno, sul pianeta, ha le competenze ed il tempo per studiare e debuggare i sorgenti del software libero che usano, non ha di meglio da fare e sicuramente non userebbe mai eventuali vulnerabilità, ma cercherebbe di correggerle prima che qualche malintenzionato ne approfitti... Ops! Possibile che i malintenzionati abbiano sia le competenze che il tempo? :-D E viene giù il castello di carte. Lo scopo dell'articolo era sostenere l'importanza del firmware open source. Purtroppo però per la stragrande maggioranza della popolazione umana, l'unica vera differenza fra open source e software proprietario è il prezzo. Perché tanto non vanno a leggere i sorgenti. Perché anche quando hanno gli skill, non hanno il tempo. E devono fidarsi ciecamente. Dunque ci troviamo di fronte ad una nuova forma di IP protection, basata non più (o meglio, non solo) sulla legge, ma sulle barriere socio-culturali. Basta per esempio scrivere software così complesso, che mettere su l'infrastruttura per compilarlo da zero richiede giorni. O che richiede mesi per essere compreso e debuggato in profondità. O che richiederebbe decenni per essere sfidato da un concorrente (vedi l'abbandono da parte di Microsoft del proprio web engine a favore di Chromium!) Tuttavia questa nuova barriera è solo necessaria per scoraggiare gli hacker. Per il resto della popolazione basta diffondere l'idea che l'Informatica sia una cosa da specialisti. Testi scritti da specialisti per essere eseguiti passo passo da macchine generali. La "specialità" di chi sa ideare e realizzare soluzioni per un qualsiasi problema... in modo generale. Non è un po' troppo generale come specialità? Chi non sa PROGRAMMARE un computer in modo fluente è un ANALFABETA informatico. Non è colpa sua, ma non dirlo chiaramente significa abbandonarlo alla sua inconsapevole e manipolabile ignoranza. Saper usare la mail, o Excel non lo rende meno analfabeta, meno manipolabile. Il firmware deve essere software libero. Software leggibile e modificabile da TUTTI. Se è leggibile e modificabile solo da una casta di eletti, non è libero affatto. E questo significa che dobbiamo renderlo più semplice. Perché altrimenti seccature come DRM, Copyright e Brevetti diventeranno sempre più secondarie rispetto alla scarsità di tempo e competenze. Giacomo

May 10, 2019

Lockdown: The coming war on general-purpose computing / Boing Boing

by Alberto Cammozzo

<https://boingboing.net/2012/01/10/lockdown.html> By Cory Doctorow This article is based on a keynote speech to the Chaos Computer Congress in Berlin, Dec. 2011. General-purpose computers are astounding. They're so astounding that our society still struggles to come to grips with them, what they're for, how to accommodate them, and how to cope with them. This brings us back to something you might be sick of reading about: copyright. But bear with me, because this is about something more important. The shape of the copyright wars clues us into an upcoming fight over the destiny of the general-purpose computer itself. In the beginning, we had packaged software and we had sneakernet. We had floppy disks in ziplock bags, in cardboard boxes, hung on pegs in shops, and sold like candy bars and magazines. They were eminently susceptible to duplication, were duplicated quickly, and widely, and this was to the great chagrin of people who made and sold software. Enter Digital Rights Management in its most primitive forms: let's call it DRM 0.96. They introduced physical indicia which the software checked for—deliberate damage, dongles, hidden sectors—and challenge-response protocols that required possession of large, unwieldy manuals that were difficult to copy. These failed for two reasons. First, they were commercially unpopular, because they reduced the usefulness of the software to the legitimate purchasers. Honest buyers resented the non-functionality of their backups, they hated the loss of scarce ports to the authentication dongles, and they chafed at the inconvenience of having to lug around large manuals when they wanted to run their software. Second, these didn't stop pirates, who found it trivial to patch the software and bypass authentication. People who took the software without paying for it were untouched. Typically, the way this happened is a programmer, with possession of technology and expertise of equivalent sophistication to the software vendor itself, would reverse-engineer the software and circulate cracked versions. While this sounds highly specialized, it really wasn't. Figuring out what recalcitrant programs were doing and routing around media defects were core skills for computer programmers, especially in the era of fragile floppy disks and the rough-and-ready early days of software development. Anti-copying strategies only became more fraught as networks spread; once we had bulletin boards, online services, USENET newsgroups and mailing lists, the expertise of people who figured out how to defeat these authentication systems could be packaged up in software as little crack files. As network capacity increased, the cracked disk images or executables themselves could be spread on their own. This gave us DRM 1.0. By 1996, it became clear to everyone in the halls of power that there was something important about to happen. We were about to have an information economy, whatever the Hell that was. They assumed it meant an economy where we bought and sold information. Information technology improves efficiency, so imagine the markets that an information economy would have! You could buy a book for a day, you could sell the right to watch the movie for a Euro, and then you could rent out the pause button for a penny per second. You could sell movies for one price in one country, at another price in another, and so on. The fantasies of those days were like a boring science fiction adaptation of the Old Testament Book of Numbers, a tedious enumeration of every permutation of things people do with information—and what might be charged for each. Unfortunately for them, none of this would be possible unless they could control how people use their computers and the files we transfer to them. After all, it was easy to talk about selling someone a tune to download to their MP3 player, but not so easy to talk about the the right to move music from the player to another device. But how the Hell could you stop that once you'd given them the file? In order to do so, you needed to figure out how to stop computers from running certain programs and inspecting certain files and processes. For example, you could encrypt the file, and then require the user to run a program that only unlocked the file under certain circumstances. But, as they say on the Internet, now you have two problems. You must now also stop the user from saving the file while it's unencrypted—which must happen eventually— and you must stop the user from figuring out where the unlocking program stores its keys, enabling them to permanently decrypt the media and ditch the stupid player app entirely. Now you have three problems: you must stop the users who figure out how to decrypt from sharing it with other users. Now you've got four problems, because you must stop the users who figure out how to extract secrets from unlocking programs from telling other users how to do it too. And now you've got five problems, because you must stop users who figure out how to extract these secrets from telling other users what the secrets were! That's a lot of problems. But by 1996, we had a solution. We had the WIPO Copyright Treaty, passed by the United Nations World Intellectual Property Organization. This created laws that made it illegal to extract secrets from unlocking programs, and it created laws that made it illegal to extract media (such as songs and movies) from the unlocking programs while they were running. It created laws that made it illegal to tell people how to extract secrets from unlocking programs, and it created laws that made it illegal to host copyrighted works or the secrets. It also established a handy streamlined process that let you remove stuff from the Internet without having to screw around with lawyers, and judges, and all that crap. And with that, illegal copying ended forever, the information economy blossomed into a beautiful flower that brought prosperity to the whole wide world; as they say on the aircraft carriers, “Mission Accomplished". That's not how the story ends, of course, because pretty much anyone who understood computers and networks understood that these laws would create more problems than they could possibly solve. After all, these laws made it illegal to look inside your computer when it was running certain programs. They made it illegal to tell people what you found when you looked inside your computer, and they made it easy to censor material on the internet without having to prove that anything wrong had happened. In short, they made unrealistic demands on reality and reality did not oblige them. Copying only got easier following the passage of these laws—copying will only ever get easier. Right now is as hard as copying will get. Your grandchildren will turn to you and say “Tell me again, Grandpa, about when it was hard to copy things in 2012, when you couldn't get a drive the size of your fingernail that could hold every song ever recorded, every movie ever made, every word ever spoken, every picture ever taken, everything, and transfer it in such a short period of time you didn't even notice it was doing it." Reality asserts itself. Like the nursery rhyme lady who swallows a spider to catch a fly, and has to swallow a bird to catch the spider, and a cat to catch the bird, so must these regulations, which have broad general appeal but are disastrous in their implementation. Each regulation begets a new one, aimed at shoring up its own failures. It's tempting to stop the story here and conclude that the problem is that lawmakers are either clueless or evil, or possibly evilly clueless. This is not a very satisfying place to go, because it's fundamentally a counsel of despair; it suggests that our problems cannot be solved for so long as stupidity and evilness are present in the halls of power, which is to say they will never be solved. But I have another theory about what's happened. It's not that regulators don't understand information technology, because it should be possible to be a non-expert and still make a good law. MPs and Congressmen and so on are elected to represent districts and people, not disciplines and issues. We don't have a Member of Parliament for biochemistry, and we don't have a Senator from the great state of urban planning. And yet those people who are experts in policy and politics, not technical disciplines, still manage to pass good rules that make sense. That's because government relies on heuristics: rules of thumb about how to balance expert input from different sides of an issue. Unfortunately, information technology confounds these heuristics—it kicks the crap out of them—in one important way. The important tests of whether or not a regulation is fit for a purpose are first whether it will work, and second whether or not it will, in the course of doing its work, have effects on everything else. If I wanted Congress, Parliament, or the E.U. to regulate a wheel, it's unlikely I'd succeed. If I turned up, pointed out that bank robbers always make their escape on wheeled vehicles, and asked, “Can't we do something about this?", the answer would be “No". This is because we don't know how to make a wheel that is still generally useful for legitimate wheel applications, but useless to bad guys. We can all see that the general benefits of wheels are so profound that we'd be foolish to risk changing them in a foolish errand to stop bank robberies. Even if there were an epidemic of bank robberies—even if society were on the verge of collapse thanks to bank robberies—no-one would think that wheels were the right place to start solving our problems. However, if I were to show up in that same body to say that I had absolute proof that hands-free phones were making cars dangerous, and I requested a law prohibiting hands-free phones in cars, the regulator might say “Yeah, I'd take your point, we'd do that." We might disagree about whether or not this is a good idea, or whether or not my evidence made sense, but very few of us would say that once you take the hands-free phones out of the car, they stop being cars. We understand that cars remain cars even if we remove features from them. Cars are special-purpose, at least in comparison to wheels, and all that the addition of a hands-free phone does is add one more feature to an already-specialized technology. There's a heuristic for this: special-purpose technologies are complex, and you can remove features from them without doing fundamental, disfiguring violence to their underlying utility. This rule of thumb serves regulators well, by and large, but it is rendered null and void by the general-purpose computer and the general-purpose network—the PC and the Internet. If you think of computer software as a feature, a computer with spreadsheets running on it has a spreadsheet feature, and one that's running World of Warcraft has an MMORPG feature. The heuristic would lead you to think that a computer unable to run spreadsheets or games would be no more of an attack on computing than a ban on car-phones would be an attack on cars. And, if you think of protocols and websites as features of the network, then saying “fix the Internet so that it doesn't run BitTorrent", or “fix the Internet so that thepiratebay.org no longer resolves," sounds a lot like “change the sound of busy signals," or “take that pizzeria on the corner off the phone network," and not like an attack on the fundamental principles of internetworking. The rule of thumb works for cars, for houses, and for every other substantial area of technological regulation. Not realizing that it fails for the Internet does not make you evil, and it does not make you an ignoramus. It just makes you part of that vast majority of the world, for whom ideas like Turing completeness and end-to-end are meaningless. So, our regulators go off, they blithely pass these laws, and they become part of the reality of our technological world. There are, suddenly, numbers that we aren't allowed to write down on the Internet, programs we're not allowed to publish, and all it takes to make legitimate material disappear from the Internet is the mere accusation of copyright infringement. It fails to attain the goal of the regulation, because it doesn't stop people from violating copyright, but it bears a kind of superficial resemblance to copyright enforcement—it satisfies the security syllogism: “something must be done, I am doing something, something has been done." As a result, any failures that arise can be blamed on the idea that the regulation doesn't go far enough, rather than the idea that it was flawed from the outset. This kind of superficial resemblance and underlying divergence happens in other engineering contexts. I've a friend, who was once a senior executive at a big consumer packaged goods company, who told me what happened when the marketing department told the engineers that they'd thought up a great idea for detergent: from now on, they were going to make detergent that made your clothes newer every time you washed them! After the engineers had tried unsuccessfully to convey the concept of entropy to the marketing department, they arrived at another solution: they'd develop a detergent that used enzymes that attacked loose fiber ends, the kind that you get with broken fibers that make your clothes look old. So every time you washed your clothes in the detergent, they would look newer. Unfortunately, that was because the detergent was digesting your clothes. Using it would literally cause your clothes to dissolve in the washing machine. This was, needless to say, the opposite of making clothes newer. Instead, you were artificially aging them every time you washed them, and as the user, the more you deployed the “solution", the more drastic your measures had to be to keep your clothes up to date. Eventually, you would have to buy new clothes because the old ones fell apart. Today we have marketing departments that say things such as “we don't need computers, we need appliances. Make me a computer that doesn't run every program, just a program that does this specialized task, like streaming audio, or routing packets, or playing Xbox games, and make sure it doesn't run programs that I haven't authorized that might undermine our profits." On the surface, this seems like a reasonable idea: a program that does one specialized task. After all, we can put an electric motor in a blender, and we can install a motor in a dishwasher, and we don't worry if it's still possible to run a dishwashing program in a blender. But that's not what we do when we turn a computer into an appliance. We're not making a computer that runs only the “appliance" app; we're taking a computer that can run every program, then using a combination of rootkits, spyware, and code-signing to prevent the user from knowing which processes are running, from installing her own software, and from terminating processes that she doesn't want. In other words, an appliance is not a stripped-down computer—it is a fully functional computer with spyware on it out of the box. We don't know how to build a general-purpose computer that is capable of running any program except for some program that we don't like, is prohibited by law, or which loses us money. The closest approximation that we have to this is a computer with spyware: a computer on which remote parties set policies without the computer user's knowledge, or over the objection of the computer's owner. Digital rights management always converges on malware. In one famous incident—a gift to people who share this hypothesis—Sony loaded covert rootkit installers on 6 million audio CDs, which secretly executed programs that watched for attempts to read the sound files on CDs and terminated them. It also hid the rootkit's existence by causing the computer operating system's kernel to lie about which processes were running, and which files were present on the drive. But that's not the only example. Nintendo's 3DS opportunistically updates its firmware, and does an integrity check to make sure that you haven't altered the old firmware in any way. If it detects signs of tampering, it turns itself into a brick. Human rights activists have raised alarms over U-EFI, the new PC bootloader, which restricts your computer so it only runs “signed" operating systems, noting that repressive governments will likely withhold signatures from operating systems unless they allow for covert surveillance operations. On the network side, attempts to make a network that can't be used for copyright infringement always converge with the surveillance measures that we know from repressive governments. Consider SOPA, the U.S. Stop Online Piracy Act, which bans innocuous tools such as DNSSec—a security suite that authenticates domain name information— because they might be used to defeat DNS blocking measures. It blocks Tor, an online anonymity tool sponsored by the U.S. Naval Research Laboratory and used by dissidents in oppressive regimes, because it can be used to circumvent IP blocking measures. In fact, the Motion Picture Association of America, a SOPA proponent, circulated a memo citing research that SOPA might work because it uses the same measures as are used in Syria, China, and Uzbekistan. It argued that because these measures are effective in those countries, they would work in America, too! It may seem like SOPA is the endgame in a long fight over copyright and the Internet, and it may seem that if we defeat SOPA, we'll be well on our way to securing the freedom of PCs and networks. But as I said at the beginning of this talk, this isn't about copyright. The copyright wars are just the beta version of a long coming war on computation. The entertainment industry is just the first belligerents to take up arms, and we tend to think of them as particularly successful. After all, here is SOPA, trembling on the verge of passage, ready to break the Internet on a fundamental level— all in the name of preserving Top 40 music, reality TV shows, and Ashton Kutcher movies. But the reality is that copyright legislation gets as far as it does precisely because it's not taken seriously by politicians. This is why, on one hand, Canada has had Parliament after Parliament introduce one awful copyright bill after another, but on the other hand, Parliament after Parliament has failed to actually vote on each bill. It's why SOPA, a bill composed of pure stupid and pieced together molecule-by-molecule into a kind of “Stupidite 250" normally only found in the heart of newborn stars, had its rushed-through SOPA hearings adjourned midway through the Christmas break: so that lawmakers could get into a vicious national debate over an important issue, unemployment insurance. It's why the World Intellectual Property Organization is gulled time and again into enacting crazed, pig-ignorant copyright proposals: because when the nations of the world send their U.N. missions to Geneva, they send water experts, not copyright experts. They send health experts, not copyright experts. They send agriculture experts, not copyright experts, because copyright is just not as important. Canada's Parliament didn't vote on its copyright bills because, of all the things that Canada needs to do, fixing copyright ranks well below health emergencies on First Nations reservations, exploiting the oil patch in Alberta, interceding in sectarian resentments among French- and English-speakers, solving resources crises in the nation's fisheries, and a thousand other issues. The triviality of copyright tells you that when other sectors of the economy start to evince concerns about the Internet and the PC, copyright will be revealed for a minor skirmish—not a war. Why might other sectors come to nurse grudges against computers in the way the entertainment business already has? The world we live in today is made of computers. We don't have cars anymore; we have computers we ride in. We don't have airplanes anymore; we have flying Solaris boxes attached to bucketfuls of industrial control systems. A 3D printer is not a device, it's a peripheral, and it only works connected to a computer. A radio is no longer a crystal: it's a general-purpose computer, running software. The grievances that arise from unauthorized copies of Snooki's Confessions of a Guidette are trivial when compared to the calls-to-action that our computer-embroidered reality will soon create. Consider radio. Radio regulation until today was based on the idea that the properties of a radio are fixed at the time of manufacture, and can't be easily altered. You can't just flip a switch on your baby monitor and interfere with other signals. But powerful software-defined radios (SDRs) can change from baby monitor to emergency services dispatcher or air traffic controller, just by loading and executing different software. This is why the Federal Communications Commission (FCC) considered what would happen when we put SDRs in the field, and asked for comment on whether it should mandate that all software-defined radios should be embedded in “trusted computing" machines. Ultimately, the question is whether every PC should be locked, so that their programs could be strictly regulated by central authorities. Even this is a shadow of what is to come. After all, this was the year in which we saw the debut of open source shape files for converting AR-15 rifles to full-automatic. This was the year of crowd-funded open-sourced hardware for genetic sequencing. And while 3D printing will give rise to plenty of trivial complaints, there will be judges in the American South and mullahs in Iran who will lose their minds over people in their jurisdictions printing out sex toys. The trajectory of 3D printing will raise real grievances, from solid-state meth labs to ceramic knives. It doesn't take a science fiction writer to understand why regulators might be nervous about the user-modifiable firmware on self-driving cars, or limiting interoperability for aviation controllers, or the kind of thing you could do with bio-scale assemblers and sequencers. Imagine what will happen the day that Monsanto determines that it's really important to make sure that computers can't execute programs which cause specialized peripherals to output custom organisms which literally eat their lunch. Regardless of whether you think these are real problems or hysterical fears, they are, nevertheless, the political currency of lobbies and interest groups far more influential than Hollywood and big content. Every one of them will arrive at the same place: “Can't you just make us a general-purpose computer that runs all the programs, except the ones that scare and anger us? Can't you just make us an Internet that transmits any message over any protocol between any two points, unless it upsets us?" There will be programs that run on general-purpose computers, and peripherals, that will freak even me out. So I can believe that people who advocate for limiting general-purpose computers will find a receptive audience. But just as we saw with the copyright wars, banning certain instructions, protocols or messages will be wholly ineffective as a means of prevention and remedy. As we saw in the copyright wars, all attempts at controlling PCs will converge on rootkits, and all attempts at controlling the Internet will converge on surveillance and censorship. This stuff matters because we've spent the last decade sending our best players out to fight what we thought was the final boss at the end of the game, but it turns out it's just been an end-level guardian. The stakes are only going to get higher. As a member of the Walkman generation, I have made peace with the fact that I will require a hearing aid long before I die. It won't be a hearing aid, though; it will really be a computer. So when I get into a car—a computer that I put my body into—with my hearing aid—a computer I put inside my body—I want to know that these technologies are not designed to keep secrets from me, or to prevent me from terminating processes on them that work against my interests. Last year, the Lower Merion School District, in a middle-class, affluent suburb of Philadelphia, found itself in a great deal of trouble. It was caught distributing, to its students, rootkitted laptops that allowed remote covert surveillance through the computer's camera and network connection. They photographed students thousands of times, at home and at school, awake and asleep, dressed and naked. Meanwhile, the latest generation of lawful intercept technology can covertly operate cameras, microphones, and GPS tranceivers on PCs, tablets, and mobile devices. We haven't lost yet, but we have to win the copyright war first if we want to keep the Internet and the PC free and open. Freedom in the future will require us to have the capacity to monitor our devices and set meaningful policies for them; to examine and terminate the software processes that runs on them; and to maintain them as honest servants to our will, not as traitors and spies working for criminals, thugs, and control freaks.

May 10, 2019

After elderly tenant was locked in his apartment by his landlord's stupid "smart lock, " tenants win right to use actual keys to enter their homes

by Giacomo Tesio

https://boingboing.net/2019/05/10/latch-vs-keys.html Tenants in New York City have reached a settlement with their landlord requiring the landlord to install actual locks with actual keys on demand, rather than insisting that all tenants use locks from Latch, the leading Internet of Things "smart lock" vendor, whose products conduct fine-grained surveillance on their users, which the company reserves the right to share with third parties. The suit was brought by Mary Beth McKenzie, Tony Mysak, and a group of their fellow tenants against their Hell's Kitchen landlord after the landlord summarily swapped out their apartment building's locks and replaced them with Latch products. Mysak, a 93-year-old longtime resident of the building, was unable to operate the lock on his home and found himself locked in. The settlement gives the tenants a cause of action to sue their landlord in the event that the landlord deprives them of a physical key option in the future. Lisa Gallaudet, an attorney representing the landlords, insists that this is not a "victory" for the tenants, and says her client only settled because litigation would have been an expensive nuisance.

May 10, 2019

Re: [nexa] Una notizia, in fondo è solo una notizia... o no?

by M. Fioretti

"don Luca Peyron" <dluca.universitari(a)gmail.com> wrote: > "Secondo lo studio quasi il 14% dei lavoratori italiani ha bisogno di un training moderato (fino a > 1 anno) per sfuggire al rischio di automazione (media Ocse 10,9%) e un altro 4,2% avrebbe bisogno > fino a 3 anni di formazione per atterrare su lavori più sicuri". ancora spacciano la favola che basterà la formazione per risparmiare da *questa* ondata di automazione un numero significativo delle *specifiche* persone che ne subiranno l'effetto. D'altra parte, OCSE solo quella può avere di chiave di lettura e missione, non sarebbe nè realistico nè onesto chiedergli altro. A me sembra molto più realistico questo: http://stop.zona-m.net/it/2018/05/lavoro-4.0-o-cecita-0.0/ > Abbiamo bisogno di formazione dunque, a mio giudizio abbiamo ancora più bisogno di > educazione, che non esclude la prima, ma ne completa l'orizzonte di senso. Qui concordo in pieno, anzi rilancio. Le due cose DEVONO rimanere distinte e complementari, altrimenti non hanno senso. Confondere educazione e formazione professionale, cioè l'idea stessa "la scuola deve preparare al **lavoro**" mi sembra sempre più un errore gravissimo. La scuola dovrebbe dare solo o quasi esclusivamente educazione, cioè preparare a essere buoni *cittadini*. La formazione professionale deve preparare specificamente a svolgere un certo tipo di lavoro. è altra cosa, separata dall'educazione. L'educazione buona aiuta tutta la vita, la formazione professionale, per definizione, andrebbe rifatta da zero o quasi periodicamente... identificare educazione (=scuola) e formazione professionale è corretto solo se uno identifica la vita con il lavoro D'altra parte, lo dice pure Krugman che l'educazione non è la risposta (alla disoccupazione): http://stop.zona-m.net/it/2011/03/se-vogliamo-una-societa-piu-prospera-ed-e… Marco

May 10, 2019

Una notizia, in fondo è solo una notizia... o no?

by don Luca Peyron

"Secondo lo studio quasi il 14% dei lavoratori italiani ha bisogno di un training moderato (fino a 1 anno) per sfuggire al rischio di automazione (media Ocse 10,9%) e un altro 4,2% avrebbe bisogno fino a 3 anni di formazione per atterrare su lavori più sicuri". Abbiamo bisogno di formazione dunque, a mio giudizio abbiamo ancora più bisogno di educazione, che non esclude la prima, ma ne completa l'orizzonte di senso. Buona lettura dl https://www.ilsole24ore.com/art/finanza-e-mercati/2019-05-09/italia-bocciat… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

May 10, 2019

Opinion | It’s Time to Break Up Facebook - The New York Times

by J.C. DE MARTIN

It’s Time to Break Up Facebook By Chris Hughes Mr. Hughes, a co-founder of Facebook, is a co-chairman of the Economic Security Project and a senior adviser at the Roosevelt Institute. May 9, 2019 https://www.nytimes.com/2019/05/09/opinion/sunday/chris-hughes-facebook-zuc… (Sent from my wireless device; please excuse brevity and typos (if any))

May 9, 2019