April 2020 - nexa - server-nexa.polito.it

I giganti della tecnologia stanno usando questa crisi per colonizzare il sistema di welfare
by Roberto Resoli April 28, 2020

April 28, 2020

Segnalato da Bruno Saetta: https://www.jacobinmag.com/2020/04/tech-giants-coronavirus-pandemic-welfare… " ... Quanto gli Stati ricchi, indeboliti dalla crisi di COVID-19, coglieranno le nuove opportunità di welfare guidato dai dati non è, a questo punto, necessariamente chiaro. Ma ciò che appare evidente è che la malattia rappresenta un'ulteriore - particolarmente importante - opportunità per questa espansione. Alcuni mesi fa, queste aziende si sarebbero trovate sotto tiro se avessero cercato di usare i dati di miliardi di persone per tracciare un'epidemia di virus, come stanno facendo Facebook, Google e Apple. L'emergenza COVID-19 sembra aver improvvisamente reso auspicabile questo lavoro. Molti hanno sollevato questioni critiche sui pericoli di queste iniziative. Eppure la novità risiede meno in un particolare insieme di applicazioni o set di dati, o in ciò che accadrà loro dopo la pandemia, che nell'ipotesi che sia a questo nuovo tipo di potere aziendale, con la sua capacità globale senza precedenti di produrre nuove forme di conoscenza sociale per il controllo sociale, che dovremmo ora trasformare in un momento di crisi pubblica. Il risultato è meno che la Big Tech fornisca un nuovo tipo di utilità pubblica, e più che le risorse di dati delle aziende della Big Tech diventino essenziali per la continua autorità dello Stato e per l'ordine della vita sociale. Non saranno solo "piattaforme di social media," "motori di ricerca" e produttori di computer, ma - accanto ai governi - saranno i veri sostenitori del nostro benessere. ..." Traduzione italiana completa qui: https://pad.riseup.net/p/MKVlZEk01bP0_y8LLOCv rob

1 0

Convegno "Stato di diritto emergenza e tecnologia" - 4-5 maggio
by ermes＠unina.it April 28, 2020

April 28, 2020

Buonasera, sperando di fare cosa gradita, vi segnalo il convegno "Stato di diritto emergenza e tecnologia", che si terrà il 4 e 5 maggio su piattaforma Zoom. Per registrarsi e ottenere il link, è sufficiente scrivere a: ermes.unina(a)gmail.com. L'evento cercherà di intrecciare i profili giuridici con quelli tecnici, ponendosi in ascolto di questi tempi incerti. Mi auguro di incontrarvi numerosi/e. Per maggiori informazioni e il programma completo, si veda la pagina del Centro Ermes: http://www.ermes.unina.it/index.php/it/home-it-it. Cordialmente, Giovanna De Minico Prof.Diritto Costituzionale Dipartimento di Giurisprudenza Università degli Studi di Napoli Federico II https://www.docenti.unina.it/giovanna.deminico Direttore del Centro Interdipartimentale Ermes Via Nuova Marina, n. 33, cap.80133, Napoli, www.ermes.unina.it Visiting Professor at Max Planck Institute for Innovation and Competition Marstallplatz 1, 80539 Munich, Germany e-mail: g.deminico(a)virgilio.it

1 0

Why Am I Paying $60 for That Bag of Rice on Amazon.com? – The Markup
by Alberto Cammozzo April 28, 2020

April 28, 2020

<https://themarkup.org/ask-the-markup/2020/04/28/why-am-i-paying-60-for-that…> After hovering at around $10 consistently, the price of a five-pound bag of Nishiki medium grain rice shot up to $30 on Amazon.com in March and hit a peak of $59.99 at 9 p.m. on Saturday, March 21, according to the Amazon price tracker Keepa. As of Friday, April 24, the bag of rice was priced at around $20. Some prices have shifted wildly since COVID-19 hit the U.S. Prices on Amazon have been volatile since the outbreak of COVID-19 in the United States. By the end of March, Keepa’s data revealed, an eight-pack of Barilla spaghetti, whose price normally hovers around $10, shot up to $49.25. The cost of an eight-pack of Skippy Superchunk Peanut Butter nearly quadrupled, from $12.52 to $45. COVID-19 has made the public more aware of price fluctuations on basics like toilet paper, hand sanitizer, and dried goods, as demand for those products surged beyond expectations. But limited inventory is not the only reason that the price of pasta (or toilet paper, peanut butter, and rice) is shifting so drastically on Amazon. Experts say the fluctuations on Amazon are often a result of the algorithms sellers use to optimize their sales. How Does Dynamic Pricing Work? Dynamic pricing (or algorithmic pricing) relies on algorithms that can synthesize lots of information about the marketplace and then change the price of something based on what’s happening hour to hour or even minute to minute. Dynamic pricing is already common for items like plane tickets and hotel rooms. As the supply gets smaller or if there’s more demand—a big conference is going to be in town that weekend, for example—then prices go up. If demand goes down because, say, a pandemic has stopped people from traveling, then prices drop. But dynamic pricing isn’t quite that simple on Amazon because of its Buy Box. When shoppers click the “Buy Now” or “Add to Cart” button, they are selecting a specific vendor. There’s usually an option to consider other vendors, but most users—by some estimates 80 percent—make their purchase through the Buy Box. To determine who “wins” the box, Amazon uses its own algorithm, which it does not reveal to the public but which observers say includes more than price. “The Buy Box depends on fulfillment speed, channel, your reviews and rating, availability within a certain period of time,” Victor Rosenman, CEO of Feedvisor, a company that creates algorithms for Amazon sellers, said in an interview. Amazon does provide tools that help sellers use dynamic pricing on the Amazon marketplace. Sellers can set pricing rules based on the Buy Box or on the lowest price for that item, and they can change those rules based on the fulfillment channels of their competitors. There are also independent companies like Feedvisor and Sellery that create pricing algorithms for Amazon third-party sellers. In 2016, researchers at Northeastern University tracked the prices of more than 16,000 of the most popular items on Amazon and collected information about the top sellers for those products, including their ratings. While sellers who use traditional pricing methods rarely change prices, this study found that the more than 500 sellers who do use dynamic pricing would change their prices tens or even hundreds of times every day as they wrestled for the Buy Box. Those sellers were more likely to win the Buy Box and to earn revenue. [...]

1 0

Nine million logs of Brits' road journeys spill onto the internet from password-less number-plate camera dashboard - Democratising mass surveillance, one snafu at a time
by Giacomo Tesio April 28, 2020

April 28, 2020

Exclusive In a blunder described as "astonishing and worrying," Sheffield City Council's automatic number-plate recognition (ANPR) system exposed to the internet 8.6 million records of road journeys made by thousands of people, The Register can reveal. The ANPR camera system's internal management dashboard could be accessed by simply entering its IP address into a web browser. No login details or authentication of any sort was needed to view and search the live system – which logs where and when vehicles, identified by their number plates, travel through Sheffield's road network. Britain's Surveillance Camera Commissioner Tony Porter described the security lapse as "both astonishing and worrying," and demanded a full probe into the snafu. He told us: "As chair of the National ANPR Independent Advisory Group, I will be requesting a report into this incident. I will focus on the comprehensive national standards that exist and look towards any emerging compliance issues or failure thereof." Eugene Walker, Sheffield City Council's executive director of resources, together with Assistant Chief Constable David Hartley of South Yorkshire Police, told us: > We take joint responsibility for working to address this data breach. > It is not an acceptable thing to have occurred. However, it is > important to be very clear that, to the best of our knowledge, > nobody came to any harm or suffered any detrimental effects > as a result of this breach. The Register learned of the unprotected dashboard from infosec expert and author Chris Kubecka, who stumbled across it using search engine Censys.io. She said: "Was the public ever told the system would be in place and that the risks were reasonable? Was there an opportunity for public discourse – or, like in Hitchhiker's Guide to the Galaxy, were the plans in a planning office at an impossible or undisclosed location?" The unsecured management dashboard could have been used by anyone who found it to reconstruct a particular vehicle's journey, or series of journeys, from its number plate, right down to the minute with ease. A malicious person could have renamed the cameras or altered key metadata shown to operators, such as a camera's location, direction, and unique identifying number. Privacy International's Edin Omanovic lamented over the privacy-busting potential of the system, telling The Register: "Time and again we've seen the introduction of surveillance tech for very specific purposes, only to creep into other areas of enforcement." Omanovic continued: > ANPR use must be proportionate to the problem > it's trying to address – it's not supposed to be a > tool of mass surveillance. Both the council and police > have a responsibility to ensure their use is proportionate > and subject to a data protection impact assessment. > They must both now explain how exactly they are > using this system, how their use is consistent with > data protection rules, how it came to be that this data > was exposed, and what changes they've made to ensure > it never happens again. The dashboard was taken offline within a few hours of The Register alerting officials. Sheffield City Council and South Yorkshire Police added: "As soon as this was brought to our attention we took action to deal with the immediate risk and ensure the information was no longer viewable externally. Both Sheffield City Council and South Yorkshire Police have also notified the Information Commissioner's Office. We will continue to investigate how this happened and do everything we can to ensure it will not happen again." A total of 8,616,198 records of vehicle movements, by time, location, and number plate, could be searched through the dashboard last week, The Register understands. This number constantly grew as more and more number plates were captured by the 100 live cameras feeding the system, and locations of vehicles were logged along with timestamps. One camera alone recorded at least 13,000 number plates on Thursday, April 13 – having previously captured 21,000 on Monday, February 24, before the UK entered its coronavirus lockdown, we understand. The exposed dashboard was in active use, we were reliably told, with entries in the logs being processed and marked as "cleared" as recently as last Wednesday (22nd April). We understand some links on the publicly exposed dashboard, however, returned error messages when clicked on, such as the so-called "hot list." Continua su https://www.theregister.co.uk/2020/04/28/anpr_sheffield_council/ Nessuno degli informatici in lista sarà particolarmente sorpreso. E magari chissà... è una "discreta drammatizzazione". ;-) Giacomo

1 0

Experts warn there are still legal ways the US could obtain COVIDSafe data
by Giacomo Tesio April 28, 2020

April 28, 2020

Key points: - Data from the Government's new COVIDSafe tracing app may be currently obtainable by US law enforcement via the CLOUD Act - While COVIDSafe data will remain in Australia, it is held by US-based company Amazon, which can be legally compelled to provide that data to US law enforcement - Amazon was awarded the contract for the COVIDSafe app data storage over several Australian-based cloud services Global tech giant Amazon may not be able to protect Australian Government data held in its Australian servers — including data gathered by the COVID-19 tracing app released on Sunday — from US subpoenas, according to legal experts and crossbenchers. The COVIDSafe app is designed to help identify who a COVID-19 positive person has met while infected, speeding up the contact-tracing process. The Government has defended its decision, revealed last week by the ABC, to award the app's data-storage contract to Amazon cloud subsidiary Amazon Web Services (AWS), a US-incorporated business subject to the US CLOUD Act. The CLOUD Act is a 2018 US law which requires American cloud services to produce, under subpoena, data held by them regardless of where in the world that data is stored. The Australian Government initially told ABC News data held by Amazon would be protected from the CLOUD Act, but Australia's peak legal body, the Law Council, disagreed, saying that under current arrangements the appeal avenues under the CLOUD Act "would not have application" in Australia. [...] The Government rejected the concerns, saying its data held by AWS would be protected because of a provision in the CLOUD Act that allowed US companies to apply to refuse or modify US subpoenas seeking the data of foreign governments, if providing such information violated the law in that foreign country. However, such appeals are only available if a country is designated under the US CLOUD Act as a "qualifying foreign government". A spokesman for the Prime Minister confirmed over the weekend that Australia was not yet designated a "qualifying" jurisdiction under US law but insisted the data would remain in Australia. [...] To be recognised as a "qualifying foreign government", Australia and the US are required to sign a so-called "executive agreement" under the CLOUD Act, which must involve special legislation in Australia. Negotiations for that agreement were first made public during a meeting between Home Affairs Minister Peter Dutton and US Attorney-General William Barr on October 7 last year. "This is the way of the future between like-minded countries," Mr Dutton announced in a statement that day. Continua su: https://www.abc.net.au/news/2020-04-28/covidsafe-tracing-app-data-may-not-b… Ma nel frattempo, indovinate un po' chi sta inviando proprio ad Amazon i voti, i compiti, le grafie etc... di milioni di bambini, ragazzi e giovani italiani? REGEL! Il Registro Elettronico più diffuso nella scuola italiana! TUTTI i registri elettronici dei diversi istituti sono ospitati da AWS e nemmeno si sono scomodati a comprare dei certificati TLS seri, si basano tutti su certificati LetsEncrypt rilasciati a *.regel.it! Noi ce l'abbiamo un "qualifying foreign government"? L'Italia è abbastanza like-minded con gli USA? Insomma, siamo stati bravi coloni o no? Giacomo

1 0

Israel suspends cellphone-tracking for coronavirus quarantine enforcement - Reuters
by Alberto Cammozzo April 27, 2020

April 27, 2020

<https://www.reuters.com/article/us-health-coronavirus-israel-police-idUSKCN…> JERUSALEM (Reuters) - An Israeli parliamentary oversight committee on Wednesday suspended police use of cellphone data to enforce coronavirus quarantines, with one lawmaker citing privacy concerns. Prime Minister Benjamin Netanyahu’s government last month empowered the police to requisition cellphone roaming data on those ordered to self-isolate as suspected or confirmed coronavirus carriers, to confirm that they were not straying. The measure, and a parallel decision to use counter-terrorist technology developed by the Shin Bet security agency to map out carriers’ movements and infection patterns, prompted Supreme Court challenges by civil liberties groups. Having invoked emergency coronavirus regulations to expand police access to cellphone data for a month, the government pledged that any extension would require parliamentary approval. But, with the initial month due to expire on Wednesday, the Knesset Foreign Affairs and Defence Committee voted to block an extension bill filed by the government. “The utility offered by this (cellphone tracking) is outweighed by the great harm inflicted to privacy,” committee member Ayelet Shaked said on Twitter, arguing that police could make do with visits to quarantine homes. []

3 6

Uno sguardo di sistema sulla "Contact Tracing App"
by Antonio Vetro' April 27, 2020

April 27, 2020

Dalla prospettiva dell’ingegneria del software e dei sistemi informativi: https://gist.github.com/mtorchiano/eb6405915aa668b1fa059ccc24e7876c <https://gist.github.com/mtorchiano/eb6405915aa668b1fa059ccc24e7876c> Le dimensioni commentate sinteticamente: modelli epidemiologici tecnologia qualità dei dati sviluppo software adozione ed efficacia processi e logistica di supporto impatto sociale e giuridico Un caro saluto, Antonio

1 0

lo SPAM ai tempi del covid-19
by Giovanni Biscuolo April 27, 2020

April 27, 2020

Buongiorno nexiani, perdonatemi se "spammo" a mia volta (azienda anonimizzata), condivido con voi questo SPAM per la tecnosorveglianza di "Sicurezza & Prevenzione" con riconoscimento facciale: una caduta di stile o la misura del mondo che ci aspetta nel prossimo futuro? ...sempre per la nostra salute, si intende! Lo riporto verbatim, perché ogni parola pesa come un macigno: --8<---------------cut here---------------start------------->8--- La verifica della temperatura corporea e' determinante per contrastare la trasmissione del virus. Come dichiarato profusamente dagli esperti, l'arma principale che abbiamo a disposizione per combattere il contagio da CoronaVirus e' la limitazione dei contatti con persone contagiate Dispositivo di rilevazione temperatura corporea e riconoscimento facciale. Prepara la tua azienda ad una ripresa delle attivita' in sicurezza. La tecnologia TERMOGRAFICA e' l'unica ARMA che oggi ci permette di monitorare a distanza di sicurezza gli avventori in modo efficace. Ti proponiamo la piu' ampia e professionale gamma di sistemi PER LA RILEVAZIONE DELLA TEMPERATURA CORPOREA E RICONOSCIMENTO FACCIALE. Come richiesto dalle ultime ordinanze e come misura preventiva per la salute dei clienti e collaboratori. Ora come non mai e' fondamentale affidarsi ai veri specialisti per la scelta del giusto apparato. Trattasi di un dispositivo di Sicurezza & Prevenzione il cui utilizzo non deve considerarsi limitatamente al periodo attuale e ai soli effetti del Covid-19, bensi' resta uno strumento valido negli anni per salvaguardare l'azienda ed il proprio personale. --8<---------------cut here---------------end--------------->8--- Evidenzio: «RILEVAZIONE DELLA TEMPERATURA CORPOREA E RICONOSCIMENTO FACCIALE. Come richiesto dalle ultime ordinanze [...]» Le ordinanze... ne vedremo delle belle. Saluti, Giovanni P.S.: il messaggio è pure "firmato", ovvero - per chi sa cosa vuol dire - ha un record SPF e una firma DKIM valide -- Giovanni Biscuolo

4 5

Petizione di centinaia di esperti francesi di sicurezza informatica e criptografía
by Antonio Casilli April 27, 2020

April 27, 2020

Va un po' nel senso della lettera aperta Nexa (e c'è almeno un firmatario comune ;). https://attention-stopcovid.fr/ "Toutes ces applications induisent en fait des risques très importants quant au respect de la vie privée et des libertés individuelles. L'un d’entre eux est la surveillance de masse par des acteurs privés ou publics, contre laquelle l'Association Internationale de Recherche en Cryptologie (IACR) s'est engagée à travers la résolution de Copenhague. Cette surveillance de masse peut être effectuée via la collecte du graphe des interactions entre les individus, le graphe social. Elle peut intervenir au niveau des systèmes d’exploitation (OS) des téléphones portables. Non seulement les producteurs d'OS pourraient reconstruire le graphe social, mais l’État aussi, plus ou moins facilement suivant les solutions proposées."

2 1

#laScuolaNonSiFerma (?)
by Giacomo Tesio April 26, 2020

April 26, 2020

https://www.spreaker.com/user/runtime/dk-4x27 il ministro e i media la fanno facile con la #scuolaDigitale, #laScuolaNonSiFerma e le lezioni online, ma cosa significa in pratica? Una puntata speciale per presidi, docenti e genitori. ____ Sia chiaro: Walter Vannini non le manda a dire. Ma credo che questa puntata del suo podcast, pur nella sua inconsueta lunghezza, meriti veramente di essere ascoltata. Potrei descriverlo come un'analisi lucida di ciò che sta avvenendo nelle nostre case e delle sue prevedibili conseguenze per insegnanti ed alunni. Non solo da una prospettiva tecnica o politica, ma educativa. E' anche un accorato appello al buon senso. Un appello da un docente ai colleghi, ai genitori e ai presidi. Ma la puntata è stata registrata un mese fa. Oggi gli insegnanti iniziano a dare i voti, somministrando le verifiche attraverso Socrative, Google Forms, Edmodo... E i ragazzi stanno imparando che agli insegnanti (ovvero alla scuola, allo Stato... agli adulti) non frega niente di loro. Grazie a queste verifiche (la cui validità legale mi sorprende... approposito sono legalmente valide?) e alla plateale facilità con cui possono copiare. Capiscono benissimo che gli insegnanti SANNO. Ed imparano come gli adulti fanno finta di niente. Alcuni metodi per copiare, in barba alla randomizzazione di domande e risposte, sono ovvi: visto che la risposta giusta c'è sempre, il più bravo della classe fa il compito condividendo mano a mano screenshot sul gruppo di classe (ovviamente WhatsApp). Gli altri aspettano che finisca, e poi eseguono. Ovviamente quando non c'è un fratello più grande in casa a dare una mano. O quando non basta, banalmente, Google, o il libro. Il trucco più brillante cui sono giunto a conoscenza è avvenuto in una seconda media. Uno studente (che non è stato identificato) ha effettuato un test a nome falso, mettendo tutte le risposte a caso. Al termine del test ha visto le risposte giuste. A quel punto ha eseguito la verifica con il proprio nome. Io ammiro la passione degli insegnanti che, come Walter, cercano di supportare i ragazzi in un momento così difficile. MA... ho veramente l'impressione che la didattica a distanza, fatta così, sia diventata diseducativa. Oltre che terribilmente dannosa per il loro futuro a causa degli sciacalli cui è stata affidata. Giacomo

1 0