May 2020 - nexa - server-nexa.polito.it

Phenomenal World | Digital Scab, Digital Snitch
by J.C. DE MARTIN May 28, 2020

May 28, 2020

https://phenomenalworld.org/analysis/digital-scab-digital-snitch (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

notizia falsa sul tracciamento di Google su Covid_19
by Aldo Pedico May 28, 2020

May 28, 2020

Chiedo conferma a tutti voi sulla veridicità di questa notizia espressa dal giornalista, Edoardo Gagliardi, nella parte iniziale del messaggio video. Il giornalista presenta una notifica inviata sull’account di posta dello smartphone da Google, spiegando che Google, a fronte di questa notifica, abbia installato un’applicazione per il tracciamento Covid_19, a insaputa del proprietario dell’apparato e che questa app non sia disinstallabile. Inoltre, questa app fa uso del protocollo Bluetooth e non di posizione o altro. https://www.youtube.com/watch?v=92pPKqGnt8k&feature=youtu.be Il messaggio di posta nel mio smartphone c’è ma è semplicemente una notifica e non esiste nessuna applicazione. Mi sbaglio? Aldo

4 3

Commissione cultura della Camera - risoluzione editoria - diritto d'autore
by Roberto Caso May 28, 2020

May 28, 2020

Buongiorno, segnalo la risoluzione sull'editoria della Commissione Cultura della Camera: https://ilmanifesto.it/la-risoluzione-unitaria-della-commissione-cultura-de… Estraggo 2 punti: "8) ad adottare iniziative normative, con urgenza, per il recepimento della direttiva europea 2019/790 sul diritto d’autore e sui diritti connessi nel mercato unico digitale, in particolare le normative riguardanti i diritti connessi di editori, giornalisti e autori, nonché la conseguente remunerazione e la responsabilità dei prestatori di servizi della società dell’informazione per violazioni del diritto d’autore relative a materiali postati dagli utilizzatori, prevedendo inoltre sistemi a garanzia della concreta applicazione della nuova disciplina e tutelando il principio della libera circolazione dell’informazione in rete; 13) con riferimento al fenomeno della pirateria editoriale, a promuovere un’iniziativa normativa idonea a dotare il nostro ordinamento di più adeguati strumenti per la difesa della proprietà intellettuale e dei contenuti editoriali;" A presto, rc -- Roberto Caso Professore Associato di Diritto Privato Comparato Università di Trento - Facoltà di Giurisprudenza La rivoluzione incompiuta. La scienza aperta tra diritto d'autore e proprietà intellettuale, Milano, Ledizioni, 2020 <https://www.robertocaso.it/2019/12/13/la-rivoluzione-incompiuta/> http://www5.unitn.it/People/it/Web/Persona/PER0000633 http://www.lawtech.jus.unitn.it/index.php/people/roberto-caso https://www.robertocaso.it/ https://twitter.com/RobertoCaso

1 0

Qatari contact-tracing app 'put 1m people's sensitive data at risk' | World news | The Guardian
by Alberto Cammozzo May 28, 2020

May 28, 2020

<https://www.theguardian.com/world/2020/may/27/qatar-contact-tracing-app-1m-…> A security flaw in Qatar’s coronavirus contact-tracing app put the sensitive personal details of more than a million people at risk, according to an investigation by Amnesty International. The app, which is mandatory for Qatari residents to install, was configured in a way that would have allowed hackers “to access highly sensitive personal information, including the name, national ID, health status and location data of more than 1 million users”, according to Amnesty International’s security lab. Claudio Guarnieri, the lab’s head, said the flaws, fixed following their discovery, “should act as a warning to governments around the world rushing out contact tracing apps that are too often poorly designed and lack privacy safeguards”. The Qatari app uses a mixture of GPS and Bluetooth technology to track Covid-19 cases and warn people who may have been exposed to an infectious person. Like the UK’s app, it operates on a centralised model allowing the country’s interior ministry access to the information it gathers. [...]

1 0

Coronavirus e RPA (Robotic Process Automation): riflessioni...
by ivan May 27, 2020

May 27, 2020

In questi tempi di emergenze tutte le istituzioni cercano di impegnarsi il più possibile per contribuire combattere la pandemia, ed in particolare mi ha colpito questo avviso: Avviso di consultazione pubblica per la preliminare verifica della ricorrenza delle condizioni per esperire procedura negoziata senza previa pubblicazione di un bando di gara. Acquisizione di un sistema di Robotic Process Automation (RPA) per allineamento continuo dei dati relativi ai tamponi in relazione al Laboratory Information Management System (LIMS/LIS) del laboratorio finalizzata alla ricerca molecolare del virus SARS-CoV 2 https://www.arpa.piemonte.it/lavora-con-noi/gare-e-appalti/11-2020 Leggendo la relazione (in allegato) mi ha colpito il fatto si debba implementare un RPA per far scambiare dati tra due Web Software della Pubblica Amministrazione per la modica cifra di 60000 euro. Ingenuamente mi sarei aspettato soluzioni differenti per allineare dei dati fra due database... ma non sono un esperto in materia e quindi mi astengo da ulteriori commenti. Voi cosa ne pensate? Cordiali saluti

1 0

Nadim Kobeissi on Twitter: "Wow really impressed by StopCovid's commitment to privacy 👌 https://t.co/zFDwDwTJpE" / Twitter
by Alberto Cammozzo May 27, 2020

May 27, 2020

<https://twitter.com/kaepora/status/1265586688128159747> La pagina "Confidentialitè" della app StopCovid mostra "Lorem Ipsum...". Privacy by design?

3 2

Hacking Team Founder: ‘Hacking Team is Dead’
by Giacomo Tesio May 27, 2020

May 27, 2020

https://www.vice.com/en_us/article/n7wbnd/hacking-team-is-dead The company's former CEO posted a bizarre obituary on LinkedIn saying the infamous surveillance firm is "definitely dead." David Vincenzetti posted a short message saying “Hacking Team is dead” on Tuesday, more than a year after the Italian company was acquired by another cybersecurity firm and rebranded as Memento Labs. As Motherboard reported earlier this year, Memento Labs is struggling to take off after several key Hacking Team employees have left, slowing down the development of new products that it would need to compete with companies such as NSO Group. Vincenzetti did not respond to a request for comment via email. Paolo Lezzi, the CEO of Memento Labs, also did not immediately reply to an email asking for comment. While Hacking Team has formally ceased to exist when it got acquired and rebranded in 2019, Vincenzetti’s post is the last nail in the coffin, and the final chapter in the company’s fall from grace. Hacking Team was founded in 2003, and was among the very first companies to focus solely on developing software designed to hack and spy on computers, and later mobile phones. The company was one of the pioneers of the so-called lawful intercept industry, a market where firms provide these kinds of tools exclusively to law enforcement and intelligence agencies. In the 2000s, Hacking Team went from selling only to Italian agencies to selling to Spain’s national intelligence agency, and later to cops and spies in 41 different countries in its heyday in 2015. That year, a hacktivist known as Phineas Fisher broke into Hacking Team’s servers, stole gigabytes of sensitive data and posted it online, dealing the company with what would eventually become a deadly blow. Claudio Guarnieri, a security researcher that was among the very first to discover Hacking Team’s malware at the beginning of the last decade reacted to the post with irony. “So long and thanks for all the phish,” he said in an online chat, using the infosec lingo for phishing attacks, one of the most popular methods used by Hacking Team customers to hack targets. A former employee previously told Motherboard that Hacking Team without Vincenzetti is “like Nirvana without Kurt Cobain.” “Poor Vincenzetti,” the former employee said. “He’s flipping out. I’m really sorry to see him like this.”

1 0

Privacy policy search engine
by Antonio Vetro' May 27, 2020

May 27, 2020

Copio qui sotto un messaggio apparso in lista DBWORLDk su una iniziativa che mi pare potenzialmente di interesse anche per questa lista, rispetto ai temi trattati e alle persone che li discutono: We are pleased to announce the release of PrivaSeer, our public search engine for the privacy policies of 1,005,781 English language websites. http://privaseer.ist.psu.edu/ <http://privaseer.ist.psu.edu/> We are continuing to improve it and welcome any feedback. You can also find the ArXiv paper about collecting the privacy policy corpus at: https://arxiv.org/abs/2004.11131 <https://arxiv.org/abs/2004.11131> av

1 0

la madre di tutte le vulnerabilità: memory unsafety.
by Giovanni Biscuolo May 26, 2020

May 26, 2020

Buongiorno nexiani, <premessa> molti di voi sanno già di cosa si tratta ma per coloro che non sanno di cosa si tratta mi permetto una brevissima spiegazione del concetto opposto - la memory safety - estrapolata e tradotta da Wikipedia [1] --8<---------------cut here---------------start------------->8--- La memory safety (sicurezza della memoria) è la condizione di essere protetti da svariati errori software e vulnerabilità di sicurezza quando si gestisce l'accesso alla memoria --8<---------------cut here---------------end--------------->8--- Esistono linguaggi di programmazione che sono storicamente memory unsafe, tra questi il C/C++, e ne esistono altri che sono memory safe, tra questi Java, Rust e molti altri. Quando si verificano errori di programmazione nella gestione della memoria in linguaggi memory unsafe, succede che i programmi abortiscono, nel migliore dei casi, oppure espongono il sistema alle vulnerabilità di sicurezza che possono essere usate da un attaccante a proprio vantaggio. Con in linguaggi memory safe questi problemi non si verificano perché hanno meccanismi di individuazione degli errori prima che il programma scriva effettivamente in locazioni della memoria che non deve usare. (Se mi sbaglio mi corrigerete) </premessa> Perdonate la piccola divagazione, torno al punto. Un amico mi segnala questo documento di Google (non trovo a quando è aggiornato): https://www.chromium.org/Home/chromium-security/memory-safety: --8<---------------cut here---------------start------------->8--- The Chromium project finds that around 70% of our serious security bugs are memory safety problems. Our next major project is to prevent such bugs at source. [...] Around 70% of our high severity security bugs are memory unsafety problems (that is, mistakes with C/C++ pointers). Half of those are use-after-free bugs. [...] we are reaching the limits of sandboxing and site isolation. [...] We can no longer derive sufficient innovation from more processes or stronger sandboxes (though such things continue to be necessary). [...] We’re tackling the memory unsafety problem — fixing classes of bugs at scale, rather than merely containing them — by any and all means necessary, including: [...] Using safer languages anywhere applicable --8<---------------cut here---------------end--------------->8--- Poi c'è un grafico che tradurrei così: - minor costo, minor miglioramento: migliorare il codice C++ eliminando gli errori - maggior costo, maggior miglioramento: usare componenti in Rust (un linguaggio memory safe) La memory unsafety è la bestia nera della sicurezza software... da sempre, praticamente da quando si programma; per dare un'idea di quanto pesa, cito https://alexgaynor.net/2019/aug/12/introduction-to-memory-unsafety-for-vps-…: --8<---------------cut here---------------start------------->8--- A recent study found that 60-70% of vulnerabilities in iOS and macOS are caused by memory unsafety. Microsoft estimates that 70% of all vulnerabilities in their products over the last decade have been caused by memory unsafety. Google estimated that 90% of Android vulnerabilities are memory unsafety. An analysis of 0-days that were discovered being exploited in the wild found that more than 80% of the exploited vulnerabilities were due to memory unsafety. [...] These vulnerabilities are exploited, to the peril of hospitals, human rights dissidents, and health policy experts [...] --8<---------------cut here---------------end--------------->8--- Una classe di software dove i problemi di memory safety sono all'ordine del giorno e un rischio costante per gli utenti sono i browser web, perché sono maledettamente complessi e _soprattutto_ perché interpretano codice Javascript scaricato dalle pagine che si visitiamo (se non glielo si impedisce, con evidenti conseguenze sull'esperienza utente nella navigazione). Non vorrei aprire qui una flamewar sui linguaggi di programmazione, l'argomento è complesso e non può essere discusso efficacemente via email: dico solo che ho studiato ed è da quando ho iniziato a studiare c'è sempre qualcuno che sostiene che con la buona pratica egli è capace di evitare errori di memoria in C/C++ e sono gli altri che non sono capaci di programmare. Riporto qui la **provocazione** di Gaynor (non è il solo ad aver scritto cose analoghe): --8<---------------cut here---------------start------------->8--- Using C and C++ is bad for society, bad for your reputation, and it’s bad for your customers. --8<---------------cut here---------------end--------------->8--- La questione potrebbe essere riassunta così, secondo quanto ho capito fino ad ora: 1. per diversi "componenti" di basso livello (per esempio il kernel) il vantaggio competitivo di C è ancora alto (soprattutto per la quantità di codice già scritto) e forse vale la pena investire molte ore/uomo per eliminare gli errori di gestione della memoria; 2. per i componenti più ad alto livello (applicativi) varrebbe la pena cominciare a investire seriamente sulla riscrittura del software con linguaggi memory safe. Perché lo dico qui? Perché sul software c'è ancora una mole imponente di lavoro da fare e in questa mole buona parte dello spazio è occupata dalla soluzione di questa classe di problemi che *quotidianamente* rendono insicuri i nostri sistemi digitali. Se anche Google valuta che continuare a buttare via ore e ore di sessioni di debugging per risolvere i problemi di memoria costa meno che riscrivere il (o almeno parti del) software in linguaggi memory safe, se la stessa cosa sono costretti a fare in centinaia di aziende grandi e piccole, significa che abbiamo un problema che *forse* il mercato per come è strutturato oggi non riesce a risolvere da solo. Io non lo so qual'è la soluzione, sempre che esista una soluzione applicabile (actionable). Questo dibattito però non deve rimanere "confinato" agli specialisti e TANTOMENO essere declassato a una questione di "gusti" dei programmatori sul linguaggio che preferiscono: anche i non programmatori _devono_ sapere di cosa si tratta e questo dibattito dovrebbe diventare pubblico, dovrebbe diventare **politico**; oltre che di competenze qui si tratta di avere anche adeguate risorse per affrontare questi problemi, che NON SONO dei programmatori, sono di tutti noi, sono _anche_ di sicurezza nazionale. ...però mi rendo conto di essere anche piuttosto ingenuo nello sperare che questo possa diventare un dibattito politico :-D Cordiali saluti. Giovanni. [1] https://en.wikipedia.org/wiki/Memory_safety -- Giovanni Biscuolo

2 1

Fwd: June 8 Talk on the ACM Code of Ethics with Don Gotterbarn and Marty Wolf
by Diego Latella May 26, 2020

May 26, 2020

> Begin forwarded message: > > From: ACM Learning Center <learning(a)acm.org> > Subject: June 8 Talk on the ACM Code of Ethics with Don Gotterbarn and Marty Wolf > Date: 26 May 2020 at 16:45:19 CEST > To: Diego Latella <diego.latella(a)CNR.IT> > > ACM TechTalks <https://learning.acm.org/techtalks> > May 26, 2020 > " > June 8 Talk on the ACM Code of Ethics with Don Gotterbarn and Marty Wolf > > Register now <https://webinars.on24.com/acm/gotterbarnwolf?partnerref=bull1> for the next free ACM TechTalk, "Leveraging the ACM Code of Ethics Against Ethical Snake Oil and Dodgy Development," presented on Monday, June 8 at 12:00 PM ET/9:00 AM PT by Don Gotterbarn, Professor Emeritus at East Tennessee State University and Co-Chair of the ACM Committee on Professional Ethics (COPE), and Marty J. Wolf, Professor at Bemidji State University and Co-Chair of the ACM Committee on Professional Ethics (COPE). Keith Miller, Professor at University of Missouri – Saint Louis, will moderate the questions and answers session following the talk. > > Leave your comments and questions with our speaker now and any time before the live event on ACM's Discourse Page <https://on.acm.org/t/leveraging-the-acm-code-of-ethics-against-ethical-snak…>. And check out the page after the webcast for extended discussion with your peers in the computing community, as well as further resources on computing ethics. > > (If you'd like to attend but can't make it to the virtual event, you still need to register to receive a recording of the TechTalk when it becomes available.) > > Note: You can stream this and all ACM TechTalks on your mobile device, including smartphones and tablets. > > We did it! The ACM revised, and with overwhelming support from its members, approved its updated Code of Ethics and Professional Conduct. Ethical champions enforcing the Code will make ethical lapses at tech companies a thing of the past. The Code has us covered. But, wait: THAT…IS…NOT…HOW…IT…WORKS! > > Computing professionals are masters at using specialized knowledge as they navigate the complex process of developing systems. It is unlike any other production process in history. Unfortunately, the nature of computing is such that it leads us to fail to notice significant ethical challenges and to know how to address them. > > The most insidious ethical challenges are those where there is unrecognized intentional harm. We identify some of the elements that contribute to unnoticed ethical challenges such as subtle privacy violations in COVID-19 tracking systems. We then suggest concrete strategies and specific proactive interventions that can be used by management, human resources, and developers to identify unnoticed ethical challenges and, importantly, address other serious challenges. These strategies change the software development process so that the odds of needing an ethical champion are lessened and, in the rare event that one is needed, odds are good that there are quite a few computing professionals around who know how to help. > > Duration: 60 minutes (including audience Q&A) > > Presenter: > Don Gotterbarn, Professor Emeritus, East Tennessee State University; Co-Chair, ACM Committee on Professional Ethics (COPE) > Don Gotterbarn has extensive experience both in academia and software systems development, working on systems for the U.S. Navy, the Saudi Arabian Navy, vote-counting machines, and missile defense. > > He has spent several decades promoting responsible computing practices, including as director of the Software Engineering Ethics Research Institute and as a visiting professor at the Centre for Computing and Social Responsibility in England. He has taught at institutions like the University of Southern California, at government agencies like NSA, the Australian Department of Defense, and was a visiting scientist Carnegie Mellon’s Software Engineering Institute. He led the 2018 update of the ACM Code of Ethics and the development of the IEEE/ACM Software Engineering Code of Ethics and Professional Practice. These contributions to responsible computing have resulted in him being awarded the ACM Outstanding Contribution Award (2005), the International Society for Ethics and Information Technology Joseph Weizenbaum Award (2010), and the ACM Presidential Award (2018). > > Marty J. Wolf, Professor, Bemidji State University; Co-Chair, ACM Committee on Professional Ethics (COPE) > Marty J. Wolf is a Professor of Computer Science at Bemidji State University in Bemidji, Minnesota. He has over 30 years of experience teaching undergraduate computer science and has published research in theoretical computer science, bioinformatics, and graph theory. Over the last 20 years his research has focused on collaborative projects in computing and information ethics and the philosophy of computation. He has developed and taught a stand-alone computing ethics course to computer science undergraduates as well as computing ethics courses for non-CS majors. He is currently Co-chair of the ACM Committee on Professional Ethics and was part of the team that led the recent update to the ACM Code of Ethics. He has extensive experience on interdisciplinary projects that involve the teaching of computing ethics. He is currently co-PI on a grant from the Mozilla Foundation to develop mechanisms for computer science faculty to better incorporate social and ethical issues into standard computer science projects. > > Moderator: > Keith Miller, Professor, University of Missouri – Saint Louis > Keith W. Miller is the Orthwein Endowed Professor for Lifelong Learning in the Sciences at the College of Education of the University of Missouri – Saint Louis (UMSL). Prof. Miller also holds tenure in its Dept. of Computer Science. He has a PhD in Computer Science, an MS in Mathematics, and a BS in Education. Prof. Miller’s community partners include the Saint Louis Science Center, and Girls Inc. of St. Louis. Prof. Miller’s research interests include computer ethics, the use of technology in education, software testing, and (thanks to Don Gotterbarn) codes of ethics. He has authored or co-authored over 90 journal papers and hundreds of presentations. Because of Marty Wolf, Keith’s Erdos number is currently three. More information at http://learnserver.net/faculty/keithmiller/curriculum-vitae/ <http://learnserver.net/faculty/keithmiller/curriculum-vitae/>. > > Visit learning.acm.org/techtalks-archive <https://learning.acm.org/techtalks-archive> for our full archive of past TechTalks. > > > Association for > Computing Machinery > 1601 Broadway, 10th Floor, New York, NY 10019 > > > Copyright © 2020, ACM, Inc. All rights reserved > > You are subscribed with: diego.latella(a)cnr.it <mailto:diego.latella@cnr.it> > > Unsubscribe <https://optout.acm.org/unsubscribe.cfm?rm=FUNBIGLEAA02361345FC0FEBE7499C50B…> > > Connect with us: > > > <https://www.facebook.com/pages/ACM-Association-for-Computing-Machinery/1792…> <https://twitter.com/TheOfficialACM> <https://www.linkedin.com/company/association-for-computing-machinery?trk=na…> > <https://www.youtube.com/user/TheOfficialACM> <https://www.instagram.com/theofficialacm/> <https://www.flickr.com/photos/theofficialacm> <mailto:acmhelp@acm.org> > > Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat =================== I don't quite know whether it is especially computer science or its subdiscipline Artificial Intelligence that has such an enormous affection for euphemism. We speak so spectacularly and so readily of computer systems that understand, that see, decide, make judgments, and so on, without ourselves recognizing our own superficiality and immeasurable naivete with respect to these concepts. And, in the process of sospeaking, we anesthetise our ability to evaluate the quality of our work and, what is more important, to identify and become conscious of its end use. […] One can't escape this state without asking, again and again: "What do I actually do? What is the final application and use of the products of my work?" and ultimately, "am I content or ashamed to have contributed to this use?" -- Prof. Joseph Weizenbaum ["Not without us", ACM SIGCAS 16(2-3) 2–7, Aug. 1986]

1 0