June 2020 - nexa - server-nexa.polito.it

Letter to Facebook on "Content control by employers"
by Giacomo Tesio June 12, 2020

June 12, 2020

https://www.etuc.org/en/document/letter-facebook-content-control-employers Dear Ms Martin The European Trade Union Confederation (ETUC), recognised European social partner under the EU Treaties and comprising 90 national trade union confederations in 38 European countries (plus 10 sectoral European trade union federations), was informed today of Facebook’s recent trade union busting experiments via your ‘Facebook Workplace’ application and which allows for so-called “content control” by employers to remove and block certain topics among employees and to have words like “unionize” blacklisted. ETUC firmly opposes these practices and would like to remind Facebook that union busting and other discriminatory activities towards trade unions, their representatives and workers (like blocking access to the (digital) workplace or blacklisting information on trade union activities and workers’ matters at the workplace) is in Europe absolutely prohibited by the international and European human rights standards European Member States have committed themselves to. Practices, like via your Facebook Workplace, are in clear cut violation with the freedom of association as recognized under the UN Covenant of Economic, Social and Cultural Rights (Article 8), the fundamental ILO Conventions n° 87 and 98 (on Freedom of Association and Collective Bargaining), the Council of Europe European Convention of Human Rights (Article 11) and European Social Charter (Articles 5 and 6). Moreover, in the EU context, such practices run fully against the trade union and workers’ rights as they are recognized in the EU Treaties, the EU Charter of Fundamental Rights (Article 11 and 27) and the European Pillar of Social Rights (Principle 8). ETUC therefore urges Facebook to stop such practices immediately and to give an assurance to the ETUC that the policy direction of Facebook will in future promote the fundamental human right to be able to belong and be active in your union without fear of reprisals and that Facebook will refrain from commercializing union busting tools or supporting companies or states to further develop their unacceptable and deplorable track-record when it comes to violating trade union and workers’ rights. I look forward to your early reply Yours sincerely Esther Lynch ETUC Deputy General Secretary

1 0

Re: [nexa] [Aisa.circuli] Teledidattica e GARR: un (piccolo?) enigma
by Federico Leva (Nemo) June 12, 2020

June 12, 2020

Non conosco la risposta ma applico il rasoio di Hanlon. Paola Pisano pare sappia dell'esistenza del GARR dato che è andata a un loro evento <https://www.eventi.garr.it/it/conf19/programma/blog/414-paola-pisano>; Lucia Azzolina presumibilmente sa che esiste quantomeno da questa riunione del 6 maggio dove hanno dato qualche soldo al GARR <https://innovazione.gov.it/CoBUL-sbloccati-fondi-piano-scuole-voucher/>. Non so dire invece se abbiano letto di questo articolo di Arturo Di Corinto del 24 marzo che segnalava i servizi in questione: <https://www.repubblica.it/tecnologia/2020/03/24/news/videoconferenze_parte_…> Né chi ai due ministeri abbia respinto la proposta di includere nelle apposite pagine ministeriali questa pagina dove si segnalavano i servizi di iorestoacasa e altri: <https://it.wikibooks.org/wiki/Software_libero_a_scuola/Solidariet%C3%A0_dig…> Federico Maria Chiara Pievatolo, 01/06/20 10:04: > Salve. > > Segnalo anche qui quanto ho scritto altrove, nella speranza che qualcuno > sia in grado di rispondermi. > > Perché buona parte delle università (e delle scuole) hanno affidato la > teledidattica a piattaforme proprietarie basate su datacenter esteri, > quando il consorzio GARR, dal 17 marzo, offre risorse gratuite di ottima > qualità? > > IL GARR è "un’associazione senza fini di lucro fondata sotto l’egida del > Ministero dell’Istruzione, dell’Università e della Ricerca. I soci > fondatori sono CNR, ENEA, INFN e Fondazione CRUI, in rappresentanza di > tutte le università italiane" (https://www.garr.it/it/chi-siamo) > > La privacy dei suoi servizi si vede qui: > https://cloud.garr.it/terms/#privacy e qui: > https://www.garr.it/it/chi-siamo/informazioni-utili/informativa-privacy > E fra le istanze Jitsi in http://iorestoacasa.work quella del GARR è la > migliore di quelle da me sperimentate. Però buona parte delle > università, salvo eccezioni > (https://poliflash.polito.it/in_ateneo/il_politecnico_digitale_al_via_con_su… > …) ha preferito MS e Google. > > Non era una scelta inevitabile o, se lo era, era giustificabile solo > all'inizio dell'emergenza, per i motivi che sono chiari, per esempio, al > governo francese: > https://www.numerique.gouv.fr/outils-agents/webconference-etat/ > > e che valgono a fortiori per una funzione delicata come l'insegnamento. > > Eppure, incredibilmente, le pagine dedicate del MIUR > (https://www.istruzione.it/coronavirus/didattica-a-distanza.html > "Piattaforme") indicano solo piattaforme commerciali, dando > l'impressione (fuorviante) di un paese talmente povero da non avere > un'infrastruttura telematica propria per la didattica e la ricerca e di > affidarsi a privati i cui termini di servizio su privacy e copyright > sono discutibili > (http://copyrightblog.kluweriplaw.com/2020/05/27/emergency-remote-teaching-a…) > > > Perché le istituzioni italiane, a partire dal M(i)ur, ignorano il Garr, > vale a dire se stesse, e consigliano piattaforme commerciali > proprietarie - cioè raccomandano il Tavernello del discount come se non > sapessero di avere in cantina dell'ottimo Barolo? > > Non è una domanda retorica: chiedo per sapere. > > A presto, > MCP > > > > > > > > > >

4 4

Facebook Pitched New Tool Allowing Employers to Suppress Words Like “Unionize” in Workplace Chat Product
by Giacomo Tesio June 12, 2020

June 12, 2020

During an internal presentation at Facebook on Wednesday, the company debuted features for Facebook Workplace, an intranet-style chat and office collaboration product similar to Slack. On Facebook Workplace, employees see a stream of content similar to a news feed, with automatically generated trending topics based on what people are posting about. One of the new tools debuted by Facebook allows administrators to remove and block certain trending topics among employees. The presentation discussed the “benefits” of “content control.” And it offered one example of a topic employers might find it useful to blacklist: the word “unionize.” Facebook Workplace is currently used by major employers such as Walmart, which is notorious for its active efforts to suppress labor organizing. The application is also used by the Singapore government, Discovery Communications, Starbucks, and Campbell Soup Corporation. The suggestion that Facebook is actively building tools designed to suppress labor organizing quickly caused a stir at the Menlo Park, California-based company. Facebook employees sparked a flurry of posts denouncing the feature, with several commenting in disbelief that the company would overtly pitch “unionize” as a topic to be blacklisted. The following day, the company presentation was taken down. [...] Un bell'esempio della cultura dei GAFAM (censura della presentazione inclusa) che continua qui https://theintercept.com/2020/06/11/facebook-workplace-unionize/ Giacomo

1 0

OT: esperienze su Big Blue Button
by Roberto Resoli June 12, 2020

June 12, 2020

Salve, Scusate la (forse parziale) incongruenza con il tema di questa lista, ma chiedo qui dato che credo che sia letta da più di qualche sistemista. Un amico con una certa esperienza sistemistica sta raccogliendo informazioni per installare BBB per la propria scuola, ma preferirebbe usare come base Debian invece che la Ubuntu obsoleta suggerita in documentazione. Chi volesse suggerire un percorso o segnalare la propria esperienza può scrivermi in privato. Grazie, rob

1 0

After 10 Years in Tech Isolation, I'm Now Outsider to Things I Once Had Mastered | forklog.media
by Alberto Cammozzo June 10, 2020

June 10, 2020

<https://forklog.media/after-10-years-in-tech-isolation-im-now-outsider-to-t…> [...] In the aftermath of serving a lengthy prison sentence, I witnessed first-hand just how much technology has evolved, and it felt like stepping out of a time-machine. I had been an exile in time, excommunicado from the evolution of new technologies and how our global society has evolved with it. As a hacker, I was the founder and leader of the hacker group known as the Electronik Tribulation Army. I used to stay parallel to the latest gadgets, exploits, and socio-technological trends. I used to reverse engineer malware, perform incident responses, and hack pretty much anything left unattended. I read about these technological advancements in newspapers and magazines while I served my sentence, but when it comes down to it, I am now a foreigner, an outsider to the very things I once had mastered. To say that the teacher has now become the student is quite the understatement. Recently, I was given a new Dell Inspiron laptop. Fresh out of its packaging it feels and looks like a familiar friend to me. But as soon as I booted it up, I was greeted with Windows 10, my new enemy. It only seems like yesterday that the Windows 7 beta was just released. Windows 10 is confusing and weird to me. It has a new file system and I’m not even the slightest curious about how it works. I just want my Windows XP back with my dual boot option of Ubuntu Linux and Backtrack 3. The only solution to making me happy again would seem to download Ubuntu, mount it to a USB thumb drive, and get it installed. Had I known that Windows 10 doesn’t utilize BIOS, but has replaced it with UEFI (Unified Extensible Firmware Interface), which is a secure boot option that validates programs before giving them permission to run, I wouldn’t have wasted two more days of my life trying to install my favorite operating system. Windows has seized control. Point being: I am no longer in control, and I hate it. I can spend hours on Google troubleshooting through this frustrating dilemma, and still get nowhere. I have to walk away every time, defeated. [...]

1 0

In università va promossa sempre la centralità dell’apprendimento dello studente, non l’insegnamento del docente.
by don Luca Peyron June 10, 2020

June 10, 2020

Considerazioni - a mio avviso - intelligenti a margine della DAD. Buona lettura dl https://www.cattolicanews.it/il-circolo-virtuoso-della-formazione?fbclid=Iw… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1

in browser port scanning... altro?
by Giovanni Biscuolo June 10, 2020

June 10, 2020

Cari nexiani, un amico molto tecnico mi segnala questo articolo molto tecnico, che in buona sostanza rivela come Ebay e molti altri clienti di LexisNexis utilizzino *anche* la tecnica del port scanning del PC sul quale funziona il browser (via Javascript) per profilare i visitatori. Il port scanning è una tecnica che serve per sapere quali porte sono "aperte" su un host e di conseguenza stabilire quali servizi sono in funzione sul quell'host. Siamo sicuri che una tecnica analoga non possa essere usata anche per **esporre** un'intera rete locale attraverso un reverse tunnell "in browser" sfruttando questa tecnica: https://github.com/MDSLab/wstun?!? (chiedo scusa se ai non addetti ai lavori sembra arabo) Qualche esperto websocket/Javascript in lista può dirmi se sono eccessivamente paranoico? «Ebay is port scanning visitors to their website - and they aren't the only ones», by Dan Nemec, 24 May 2020 https://blog.nem.ec/2020/05/24/ebay-port-scanning/ --8<---------------cut here---------------start------------->8--- [...] actually discussing a different type of port scanning, one initiated directly by a website the target loads in their browser. It’s an ingenius, if not insidious, technique that allows would-be port scanners to paradrop straight into an internal network and scan it using Javascript from within the browser context. As an aside, this is something that a browser extension could block, however the company behind the port scanning uses techniques to prevent widespread blocking of their trackers, as we’ll see later. How Browser Port Scanning Works While modern browsers allow Javascript to make requests to other domain names than the one you’re currently visiting (e.g. www.ebay.com) they layer on security controls to ensure the target data allows the calling website to access it. This prevents, for example, a malicious website from requesting the account details from you bank’s website. However, even without knowing the contents of the remote site, details about the connection itself (such as the time it takes to connect or time out) can be used to infer whether or not a website exists at the given host and port. A bit of Javascript code can wrap that into a package and allow any site to scan a user’s internal network, determining which IP addresses and ports have services running. Further, because many well-known services are commonly available on the same port (there is a registration page, but it’s more of a guideline than a hard and fast rule), it’s possible to also infer some programs that a user may be running on their network depending on whether the port is open or not. [...] In trying to load Ebay locally I found that I couldn’t replicate the behavior in Linux even after spoofing a Windows User Agent and disabling all of my extensions. There must be some check hidden in the Javascript, but as of yet I haven’t found one. After that, I loaded a Windows VM, installed the latest Edge, fired up https://www.ebay.com, and I finally replicated the port scanning behavior. However, I had some trouble replicating the behavior reliably, and after some trial and error I found that https://signin.ebay.com/ was far more reliable for triggering the port scanning. [...] To summarize what we’ve found so far: * Ebay collects data on whether certain ports are open on your local PC * This data is shipped to an Ebay domain, but does not seem to be used * otherwise Additional data like User Agent and IP are also sent [...] the domain where data is exfiltrated is not a subdomain of ebay.com - it’s ebay-us.com. Still, a quick check shows that it’s owned by somebody at Ebay, so at the very least it isn’t phishing malware. Twitter user Armchair IR pointed out that similar behavior has been seen by Facebook and it traced to a company called ThreatMetrix, an identity tracking/anti-fraud company. Checking the DNS records for src.ebay-us.com, sure enough it’s a CNAME to h-ebay.online-metrix.net, a domain owned by ThreatMetrix Inc. [...] It’s not just Ebay scanning your ports, there is allegedly a network of 30,000 websites out there all working for the common aim of harvesting open ports, collecting IP addresses, and User Agents in an attempt to track users all across the web. And this isn’t some rogue team within Ebay setting out to skirt the law, you can bet that LexisNexis lawyers have thoroughly covered their bases when extending this service to their customers (at least in the U.S.). --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. -- Giovanni Biscuolo

3 9

Spanish and French governments turn to open source video-conferencing platform
by Giacomo Tesio June 10, 2020

June 10, 2020

The Spanish and French governments have turned to an open-source solution, Jitsi Meet, to host online meetings and press conferences. Jitsi Meet is a video conferencing tool that doesn’t require the download of any software or the creation of an account. The French Inter-ministerial Directorate for Digital Affairs (Direction interministérielle du numérique, DINUM) has adopted Jitsi as an inter-ministerial web conferencing service promoting team cooperation across governmental bodies. DINUM built a custom video conferencing service, based on the open-source code of Jitsi Meet, deployed on governmental servers using advanced encryption. During the COVID-19 crisis, the Spanish government chose Jitsi to host their press conferences using the live chat feature of the tool to allow interactions between journalists and government officials. Continua su https://joinup.ec.europa.eu/collection/open-source-observatory-osor/news/op… Ora.. quali sono le nostre scuse? "Epperò abbiamo anche le nostre eccezioni^W eccellenze!" Giacomo

1 0

Developers renew push to get rid of objectionable code terms to make 'the world a tiny bit more welcoming' • The Register
by Alberto Cammozzo June 9, 2020

June 9, 2020

Major release nel codice semantico-informatico. Scordiamoci queste parole: master, slave, blackist, whitelist. "Server" per qualche motivo resiste ancora. <https://www.theregister.com/2020/06/08/developers_renew_push_to_get/> Amid the protests over the death of George Floyd, activists in the software community have taken the opportunity to remind people that they're trying to do away with terminology tied to racial oppression. On Monday, Scott Hanselman, a programmer and educator who happens to work at Microsoft, published a blog post about how to rename the "master" branch in code repositories created using Git version control software with a less loaded term. "The Internet Engineering Task Force (IEFT) points out that 'master-slave is an oppressive metaphor that will and should never become fully detached from history' as well as 'In addition to being inappropriate and arcane, the master-slave metaphor is both technically and historically inaccurate,'" he wrote. "There's lots of more accurate options depending on context and it costs me nothing to change my vocabulary, especially if it is one less little speed bump to getting a new person excited about tech." This comes from an IETF draft document published in 2018, the same year developers involved in Redis and Python made a push to purge "master/slave" terminology, not to mention Rails. That same year, the terms elicited a bug report in Google's Chromium project, one that has led to a series of changes since then, percolating down through various header and source files to change "blacklist" to a term without racial overtones, "blocklist," and "whitelist" to "allowlist." On Saturday, that effort led to a proposed name change for the classes in the components/blacklist directory, the effect of which can be seen in code diffs like this one. Put those empty boxes over there, by the stock photography lighting rig Redis does a Python, crushes 'offensive' master, slave code terms Google did not immediately respond to a request for comment, but these changes represent an attempt to comply with the company's code inclusivity guidelines for its Chromium project. Google is far from the only company dealing with this issue. Pivotal's LicenseFinder swapped "whitelist" for "permitted licenses" in January. Box is currently discussing a shift to "allowlist" and "denylist." Elixir nixed the terms about a week ago. OpenShift merged a pull request to adopt alternate language four days ago. Yelp modified its secret scanning code about two weeks ago. The osquery project is working on it. Among those contributing to the open source Git project, "master" terminology came up in a mailing list discussion last month about fixing the terminology in the Git source code. The proposal met with resistance, partly because of the amount of work it would entail. In response to a post arguing for revised wording, Brian Carlson, a developer at GitHub who also contributes to the Git codebase, acknowledged the concerns that have been raised about the terms and objections to making changes. He expressed willingness to review potential changes to Git source code that would purge the term but said he couldn't undertake the project himself. "It appears that if we made the obvious one-line change to builtin/init-db.c, we'd have 304 tests that fail, which is about a third of our test suite," he said. At GitHub, the GitHub CLI replaced "master" with "trunk" about two weeks ago and the GitHub Desktop software did the same in 2019. Despite significant support for these changes, there are also detractors who point out that Git's use of "master" hails from sound recording rather than slave owning (as opposed to the master/slave descriptors applied to device networking) and that "master" has other connotations, like expertise in a field. Google's guidance on inclusive coding, which focuses more on the use of gendered terms rather than racial ones, notes some of the potential problems with trying to apply inclusive language. For example, coders are advised to avoid the gendered pronoun "he," but "he" is okay if it refers to Helium, the ISO 639-1 language code for Hebrew or the first person conjugation of the Spanish verb "Haber." Hanselman acknowledges that vocabulary revision does not erase history or make people less racist. "All it does is make the world a tiny bit more welcoming," he said via Twitter.

6 8

The Brave web browser is hijacking links, and inserting affiliate codes
by Giacomo Tesio June 9, 2020

June 9, 2020

https://davidgerard.co.uk/blockchain/2020/06/06/the-brave-web-browser-is-hi… The Brave web browser sells itself on privacy, security and ad-blocking. It also has its own cryptocurrency, the Basic Attention Token. As such, it’s a favourite with crypto people — or ones who don’t know how to install uBlock Origin, anyway. # What Brave’s done this time Brave is very into affiliate marketing. Just in March this year, Brave was caught running eToro affiliate marketing without the legally-required disclaimers — and Brave staff were caught deleting all mention of this from the /r/brave_browser subforum on Reddit. [Github, archive] If you’re using Brave and try to go to the Binance crypto exchange, Brave hijacks the Binance link you typed in, and autofills with its own affiliate code. This was spotted by @cryptonator1337 on Twitter earlier today. [...] This ignores the legally required disclosures for affiliate links — the disclosures that Brave also ignored for the eToro links in March. In the US, the FTC has required full disclosure of affiliate marketing since 2009 — you have to put it right there on the page. Similar rules apply in the UK and the EU. (See my Amazon disclosure at the bottom-right of this post, for example.) However, Eich is very sorry that Brave got caught — again — and something will be changed in some manner to stop this behaviour, or at least obscure it. (Eich doesn’t say precisely what the totally fine thing Brave thought it was doing was, or what’s going to change here.) [...] # What should Brave do? I’d like to assume Eich is acting in good faith here — but this sort of nonsense keeps happening. When you see you’ve done something wrong, you should fix it — then explain what you got wrong, that you understand why your users are upset, and precisely how this happened, step by step. Then you don’t do it again. And you put systems into place so that you don’t do it again. What you don’t do is to rack up a chain of other unmarked affiliate advertising, or pull what looks remarkably like donation fraud. Then apologise each time, say you’ve fixed it … and then do it again. This is precisely what scammers do — they apologise, they swear they’ll fix it, and then they do it again. # What should I do, as a Brave user? There is no good reason to use Brave. Use Chromium — the open-source core of Chrome — with the uBlock Origin ad blocker. Or use Firefox with uBlock Origin — ‘cos it blocks more ads than the Chromium framework will let anything block Or [...] _________ Non condivido appieno le alternative suggerite. Anzitutto perché preferisco suggerire uMatrix ad uBlock Origin (anche se mi rendo conto che richiede un minimo di formazione per essere usato correttamente). E poi perché sia Chromium che Mozilla bilanciano la sicurezza degli utenti con gli interessi economici dei propri finanziatori. Giacomo

4 7