August 2020 - nexa - server-nexa.polito.it

Quanto costa affidare a Microsoft le email della scuola italiana - Wired
by Antonio Vetro' Aug. 27, 2020

Aug. 27, 2020

https://www.wired.it/internet/web/2020/08/27/microsoft-email-scuola-costi/ av

2 1

Wired.it: Quanto costa affidare a Microsoft le email della scuola italiana
by don Luca Peyron Aug. 27, 2020

Aug. 27, 2020

Buona lettura, Dl Wired.it: Quanto costa affidare a Microsoft le email della scuola italiana. https://www.wired.it/internet/web/2020/08/27/microsoft-email-scuola-costi/

1 0

How to destroy Surveillance Capitalism
by Giacomo Tesio Aug. 26, 2020

Aug. 26, 2020

The most surprising thing about the rebirth of flat Earthers in the 21st century is just how widespread the evidence against them is. You can understand how, centuries ago, people who’d never gained a high-enough vantage point from which to see the Earth’s curvature might come to the commonsense belief that the flat-seeming Earth was, indeed, flat. But today, when elementary schools routinely dangle GoPro cameras from balloons and loft them high enough to photograph the Earth’s curve — to say nothing of the unexceptional sight of the curved Earth from an airplane window — it takes a heroic effort to maintain the belief that the world is flat. Likewise for white nationalism and eugenics: In an age where you can become a computational genomics datapoint by swabbing your cheek and mailing it to a gene-sequencing company along with a modest sum of money, “race science” has never been easier to refute. We are living through a golden age of both readily available facts and denial of those facts. Terrible ideas that have lingered on the fringes for decades or even centuries have gone mainstream seemingly overnight. When an obscure idea gains currency, there are only two things that can explain its ascendance: Either the person expressing that idea has gotten a lot better at stating their case, or the proposition has become harder to deny in the face of mounting evidence. In other words, if we want people to take climate change seriously, we can get a bunch of Greta Thunbergs to make eloquent, passionate arguments from podiums, winning our hearts and minds, or we can wait for flood, fire, broiling sun, and pandemics to make the case for us. In practice, we’ll probably have to do some of both: The more we’re boiling and burning and drowning and wasting away, the easier it will be for the Greta Thunbergs of the world to convince us. The arguments for ridiculous beliefs in odious conspiracies like anti-vaccination, climate denial, a flat Earth, and eugenics are no better than they were a generation ago. Indeed, they’re worse because they are being pitched to people who have at least a background awareness of the refuting facts. [...] Surveillance capitalism assumes that because advertisers buy a lot of what Big Tech is selling, Big Tech must be selling something real. But Big Tech’s massive sales could just as easily be the result of a popular delusion or something even more pernicious: monopolistic control over our communications and commerce. [...] To understand why you shouldn’t worry about mind-control rays — but why you should worry about surveillance and Big Tech — we must start by unpacking what we mean by “persuasion.” Google, Facebook, and other surveillance capitalists promise their customers (the advertisers) that if they use machine-learning tools trained on unimaginably large data sets of nonconsensually harvested personal information, they will be able to uncover ways to bypass the rational faculties of the public and direct their behavior, creating a stream of purchases, votes, and other desired outcomes. The impact of dominance far exceeds the impact of manipulation and should be central to our analysis and any remedies we seek. [...] Rather than finding ways to bypass our rational faculties, surveillance capitalists like Mark Zuckerberg mostly do one or more of three things: 1. Segmenting [...] 2. Deception [...] 3. Domination [...] 4. Bypassing our rational faculties This is the good stuff: using machine learning, “dark patterns,” engagement hacking, and other techniques to get us to do things that run counter to our better judgment. This is mind control. Some of these techniques have proven devastatingly effective (if only in the short term). The use of countdown timers on a purchase completion page can create a sense of urgency that causes you to ignore the nagging internal voice suggesting that you should shop around or sleep on your decision. The use of people from your social graph in ads can provide “social proof” that a purchase is worth making. Even the auction system pioneered by eBay is calculated to play on our cognitive blind spots, letting us feel like we “own” something because we bid on it, thus encouraging us to bid again when we are outbid to ensure that “our” things stay ours. Games are extraordinarily good at this. “Free to play” games manipulate us through many techniques, such as presenting players with a series of smoothly escalating challenges that create a sense of mastery and accomplishment but which sharply transition into a set of challenges that are impossible to overcome without paid upgrades. Add some social proof to the mix — a stream of notifications about how well your friends are faring — and before you know it, you’re buying virtual power-ups to get to the next level. [...] From the surveillance capitalist’s point of view, our adaptive capacity is like a harmful bacterium that deprives it of its food source — our attention — and novel techniques for snagging that attention are like new antibiotics that can be used to breach our defenses and destroy our self-determination. [...] Not everyone, of course. Some people never adapt to stimulus, just as some people never stop hearing the hum of the refrigerator. This is why most people who are exposed to slot machines play them for a while and then move on while a small and tragic minority liquidate their kids’ college funds, buy adult diapers, and position themselves in front of a machine until they collapse. [...] Zuboff puts enormous and undue weight on the persuasive power of surveillance-based influence techniques. Most of these don’t work very well, and the ones that do won’t work for very long. The makers of these influence tools are confident they will someday refine them into systems of total control, but they are hardly unbiased observers, and the risks from their dreams coming true are very speculative. By contrast, Zuboff is rather sanguine about 40 years of lax antitrust practice that has allowed a handful of companies to dominate the internet, ushering in an information age with, as one person on Twitter noted, five giant websites each filled with screenshots of the other four. [...] If our concern is that markets cease to function when consumers can no longer make choices, then copyright locks should concern us at least as much as influence campaigns. An influence campaign might nudge you to buy a certain brand of phone; but the copyright locks on that phone absolutely determine where you get it serviced, which apps can run on it, and when you have to throw it away rather than fixing it. [...] firms continue to over-collect and over-retain our data for three reasons: 1. They are locked in the aforementioned limbic arms race with our capacity to shore up our attentional defense systems to resist their new persuasion techniques. [...] 2. They believe the surveillance capitalism story. [...] 3. The penalties for leaking data are negligible. [...] Technology exceptionalism is a sin, whether it’s practiced by technology’s blind proponents or by its critics. Both of these camps are prone to explaining away monopolistic concentration by citing some special characteristic of the tech industry, like network effects or first-mover advantage. The only real difference between these two groups is that the tech apologists say monopoly is inevitable so we should just let tech get away with its abuses while competition regulators in the U.S. and the EU say monopoly is inevitable so we should punish tech for its abuses but not try to break up the monopolies. [...] the problem with monopolies is monopolism — the concentration of power into too few hands, which erodes our right to self-determination. If there is a monopoly, the law wants it gone, period. Sure, get rid of monopolies that create “consumer harm” in the form of higher prices, but also, get rid of other monopolies, too. Continua (a lungo) su https://onezero.medium.com/how-to-destroy-surveillance-capitalism-8135e6744… (anche su https://archive.is/fJTvQ ) Si tratta sostanzialmente di una interessante serie di obiezioni alla prospettiva della Professoressa Zuboff sul capitalismo di sorveglianza che lo riconduce ad un problema economico: la tendenza del capitalismo globale a generare enormi monopoli planetari che erodono le libertà dei consumatori per concentrare sempre più potere in poche mani. Tale potere da un lato impedisce ogni forma di regolamentazione, dall'altro innalza enormi barriere di ingresso per limitare la concorrenza. Per quanto condivisibile, credo sia una visione parziale (e forse ingenua) della questione: come altri prima di lui, Doctorow non considera gli enormi vantaggi politici, economici e militari che questi monopoli planetari forniscono agli U.S.A. Giacomo

1 0

Police Want Your Smart Speaker—Here's Why | WIRED
by J.C. DE MARTIN Aug. 26, 2020

Aug. 26, 2020

https://www.wired.com/story/star-witness-your-smart-speaker/ (Sent from my wireless device; please excuse brevity and typos (if any))

3 3

Using Google's location tracking can put innocents in jail.
by Giacomo Tesio Aug. 26, 2020

Aug. 26, 2020

Geofencing requests - despite violating privacy rights - are being issued more frequently in the US every year. [...] The most recent example is Zachary McCoy, who was the prime suspect in a case of burglary due to a bike ride. Data from his fitness app showed that he had passed a burglarized home in his neighborhood three times during the timeframe of the burglary. As police had no clue who might have been the burglar, they sent a geofencing warrant to Google. [...] Being scared, his parents dipped into their savings to pay thousands of dollars to a lawyer to make sure their son would not go to prison for a crime that he never committed. The case against Zachary was eventually closed, but it shows that even when being innocent, you can still be in the wrong place at the wrong time - and in some cases you can even get jailed for being at the wrong place as another example from Arizona shows. # Being jailed because of Google data In 2018 an innocent man was jailed for six days in Avondale, Arizona, because his Google data showed that he had been at the scene of a shooting where one person was murdered. To make things worse his car had been spotted on surveillance cameras in the area as well. Later it turned out that the suspect's stepfather had used his car and had a device with him, on which the suspect's Google credentials where logged in. By now, the innocent suspect has filed a lawsuit against the authorities because while prosecutors never pursued charges against him, he lost his job, his car and his reputation due to the investigation, during which the police also released his full name in a press release. He was also unable to find a new job because a quick Google search showed that he had been investigated for murder so he did not pass background checks. # Tracking and geofencing The two cases show one thing very clearly: Al data that is accessible, is being used - whether you like it or not, even whether Google likes it or not. Google has to comply with warrants as any other company in the world. The problem is that today much more data about us exists than we can even imagine. The authorities are quickly learning how to get hold of this data, and despite the fact that general geofencing warrants are violating privacy rights, these are widely issued by judges in the US. # Fishing expeditions by the police Google said in a court filing last year that the requests from state and federal law enforcement authorities were increasing rapidly: by more than 1,500 percent from 2017 to 2018, and by 500 percent from 2018 to 2019. "This fishing expedition infringes on the privacy rights of so many possible people who had the misfortune of being in an area where a crime is alleged to be committed," said Jerome Greco, staff attorney at the Legal Aid Society to Forbes. "We should not allow for such broad access to the data of so many on the mere speculation that a suspect may have used a cellphone near the location of the crime." Police officers described the data they obtained from Google as "incredible". People would not realize to what extent they are being tracked - not by the government, but by private companies such as Google. Continua su https://tutanota.com/blog/posts/google-tracking-suspect/ Giacomo

1 0

US Border Patrol Says They Can Create Central Repository Of Traveler Emails, Keep Them For 75 Years
by Giovanni Biscuolo Aug. 25, 2020

Aug. 25, 2020

Buongiorno, l'ennesimo capitolo della querelle in merito alla "Border Search Exeption" sulla perquisizione e copia integrale del contenuto dei dispositivi elettronici (fino a 100 miglia dal confine, all'interno ovviamente). [1] ...meno male che c'è "il cloud"! :-D «US Border Patrol Says They Can Create Central Repository Of Traveler Emails, Keep Them For 75 Years» https://viewfromthewing.com/us-border-patrol-says-they-can-create-central-r… --8<---------------cut here---------------start------------->8--- The U.S. government has taken the opportunity during the global pandemic, when people aren’t traveling out of the country much, to roll out a new platform for storing information they believe they are entitled to take from people crossing the border. A new filing reveals how the U.S. Border Patrol will store data from traveler devices centrally, keeping it backed up and searchable for up to 75 years. On July 30 the Department of Homeland Security published a privacy impact assessment detailing the electronic data that they may choose to collect from people crossing the border – and what happens to that data. * Border Patrol claims the right to search laptops, thumb drives, cell phones, and other devices capable of storing electronic information” and when they call it a ‘border search the can do this not just when you’re “crossing the U.S. border” in either direction (i.e. when you’re leaving, not just when you’re entering the country) but even “at the extended border” which generally means within 100 miles of the border, which encompasses where two-thirds of the U.S. population lives. * They needed an updated privacy impact assessment because of a new “enterprise-wide solution to manage and analyze certain types of information and metadata USBP collects from electronic devices” – and they they actually keep on file. Border Patrol will “acquire a mirror copy of the data on the device” they take from a traveler and store it locally. Before uploading it to their network they check to make sure there’s no porn on it (so they search your devices to find porn first). Then once they’ve determined it’s “clean” they transfer the data first to an encrypted thumb drive and then to the Border Patrol-side system called PLX. Examples of what they plan to keep from travelers’ devices include e-mails; videos and pictures; texts and chat messages; financial accounts and transactions; location history; web browser bookmarks; tasks list; calendar; call logs; contracts. Information is stored for 75 years although if it’s not related to any crime it may be deleted after 20 years. The government emphasizes they’ve been collecting this information, what’s changed is simply that they’ll be storing it in a central system where everything “will now by accessible to a larger number of USBP agents with no nexus” to suspected illegal activity. They promise, though, to restrict access and train staff not to do anything they aren’t supposed to. And they don’t see risk to privacy because they’ve published a notice (that I’m now writing about) telling you how your privacy may be violated. Electronic device searches have been on the rise. Between October 2008 and June 2010 6500 devices were searched. In 2016 there were 10,000 device searches, and 30,200 in 2017. It’s not clear though that these searches are all actually legal. In November 2019 a federal judge in Boston ruled that forensic searches of cell phones require at least reasonable suspicion “that the devices contain contraband.” --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. [1] https://en.wikipedia.org/wiki/Border_search_exception#Searching_of_electron… -- Giovanni Biscuolo

1 0

Uber and the lawlessness of 'sharing economy' corporates | Uber | The Guardian
by J.C. DE MARTIN Aug. 25, 2020

Aug. 25, 2020

Uber and the lawlessness of ‘sharing economy’ corporates Companies including Airbnb and Google compare themselves to civil rights heroes, while using their popularity among consumers to nullify federal law Frank Pasquale and Siva Vaidhyanathan Tue 28 Jul 2015 07.00 BST https://www.theguardian.com/technology/2015/jul/28/uber-lawlessness-sharing… (Sent from my wireless device; please excuse brevity and typos (if any))

1 1

How I helped fix Canadaʼs COVID Alert app
by Alberto Cammozzo Aug. 25, 2020

Aug. 25, 2020

<https://seancoates.com/blogs/how-i-helped-fix-canadas-covid-alert-app> On July 31st, Canada's COVID Alert app was made available for general use, though it does not have support for actually reporting a diagnosis in most provinces, yet. In Quebec, we can run the tracing part of the app, and if diagnosis codes become available here, the app can retroactively report contact. It uses the tracing mechanism that Google and Apple created together, and in my opinion—at least for now—Canadians should be running this thing to help us all deal with COVID-19. I won't run it forever, but for now, it seems to me that the benefits outweigh the "government can track me" fear (it's not actually tracking you; it doesn't even know who you are), and it's enabled on my phone. But, before I decided to take this position and offer up my own movement data, I wanted to be sure the app is doing what it says it's doing—at least to the extent of my abilities to be duly diligent. (Note: it's not purely movement data that's shared—at least without more context—but it's actual physical interactions with other people whose phones are available within the radio range of Bluetooth LE.) Before installing the app on my real daily-carry phone, I decided to put it on an old phone I still have, and to do some analysis on the most basic level of communication: who is it contacting? In 2015, I gave a talk at ConFoo entitled "Inspect HTTP(S) with Your Own Man-in-the-Middle Non-Attacks", and this is exactly what I wanted to do here. The tooling has improved in the past 5 years, and firing up mitmproxy, even without ever having used it on this relatively new laptop, was a one-liner, thanks to Nix: nix-shell -p mitmproxy --run mitmproxy This gave me a terminal-based UI and proxy server that I pointed my old phone at (via the Wifi Network settings, under HTTP proxy, pointed to my laptop's local IP address). I needed to have mitmproxy create a Certificate Authority that it could use to generate and sign "trusted" certificates, and then have my phone trust that authority, by visiting http://mitm.it/ in mobile Safari, and doing the certificate acceptance dance (this is even more complicated on the latest versions of iOS). Worth noting also, is that certain endpoints such as the Apple App Store appear to use Certificate Pinning, so you'll want to do things like install the COVID Alert app from the App Store before turning on the proxy. Once I was all set up to intercept my own traffic, I visited some https:// URLs and saw the request flows in mitmproxy. I fired up the COVID Alert app again, and noticed something strange… something disturbing: shows that the app is accessing clients.google.com In addition to the expected traffic to canada.ca (I noticed it's using .alpha.canada.ca, but I suspect that's due to the often-reported unbearably-long bureaucratic hassle in getting a .canada.ca TLS certificate, but that's another story), my phone, when running COVID Alert, was contacting Google. HEAD https://clients4.google.com/generate_204 A little web searching helped me discover that this is a commonly-used endpoint that helps developers determine if the device is behind a "captive portal" (an interaction that requires log-in or payment, or at least acceptance of terms before granting wider access to the Web). I decided that this was probably unintended by the developers of COVID Alert, but it still bothered me that an app, designed for tracking interactions between people['s devices], that the government wants us to run is telling Google that I'm running it, and disclosing my IP address in doing so: shows that the User Agent header identifies the app as (Note that the app clearly identifies itself in the User-Agent header.) A bit more quick research turned up a statement by Canada's Privacy Commissioner: An Internet Protocol (IP) address can be considered personal information if it can be associated with an identifiable individual. For example, in one complaint finding, we determined that some of the IP addresses that an internet service provider (ISP) was collecting were personal information because the ISP had the ability to link the IP addresses to its customers through their subscriber IDs. It's not too difficult to imagine that Google probably has enough data on Canadians for this to be a real problem. I discovered that this app is maintained by the Canadian Digital Service, and that the source code is on GitHub, but that the code itself didn't directly contain any references to clients3.google.com. [...]

1 0

Who’s been editing the Ripple CEO’s Wikipedia page?
by Giacomo Tesio Aug. 24, 2020

Aug. 24, 2020

Ripple is a cutting-edge Silicon Valley tech start-up with ambitions to one day be “to payments as Amazon was to books”. [...] Spanish bank Santander, a Ripple investor and what the company calls “one of our largest and most important customers”, recently chose not to use Ripple’s XRP currency for its new international payment network. [...] ..it’s come to FT Alphaville’s attention recently that some Wikipedia users — two in particular — have been repeatedly editing Ripple CEO Brad Garlinghouse’s Wikipedia page to remove some less positive aspects of the entry. Specifically, these two users have been removing text under the “Controversies” section of the page, and one of them in fact removed the whole section entirely, before it was reinstated by a different Wikipedia editor. The Controversies section includes the fact that Garlinghouse had claimed multiple times that the published error rate for SWIFT messaging was at least six per cent (a claim that has been proven to be false in a great piece by Martin Walker published by the London School of Economics Business Review); the fact that he’d been personally named in a group of class actions against Ripple that claim the company has breached various securities laws; and the fact he’d admitted that, without sales of the XRP cryptocurrency, Ripple would be lossmaking [...] # Crypto propaganda wars So there’s been something of an “edit war” on the page, with multiple removals and reinstatements of text since May. [...] Continua su https://ftalphaville.ft.com/2020/08/20/1597909956000/Who-s-been-editing-the… o su https://technocodex.com/whos-been-editing-the-ripple-ceos-wikipedia-page/ La questione è interessante non tanto per le manomissioni di Wikipedia a fini propagandistici (piuttosto consueti nel mondo politico in prossimità delle elezioni) ma perché Ripple è spesso citato come esempio di blockchain "enterprise", addirittura uno strumento b2b per banche, un esempio "virtuoso" a riprova della serietà della fuffa blockchain. Giacomo

1 0

Re: [nexa] ARM
by Giuseppe Attardi Aug. 24, 2020

Aug. 24, 2020

Dietro mia sollecitazione, Hauser ha scritto questa lettera al Financial Times. ARM, a British company, headquartered in the UK, has provided the design for over 160 billion processors via its 500+ licensees, making it the world’s most valuable IP Company. The proposed sale of ARM to Nvidia the dominant American graphics processor company would have disastrous consequences for Cambridge, the UK and Europe for three main reasons. - Firstly, it will lead to inevitable job losses in Cambridge, where 2500 people are employed, as the HQ will move to Silicon Valley. Nvidia bought the Bristol based company Icera in 2011 and subsequently in 2015 sacked all 300+ UK based staff. - Secondly, it will destroy ARM’s neutrality and even handedness to over 500 hundred licensees all over the world, many of which, including European companies are competitors of Nvidia. - Thirdly, and most seriously it will make ARM a division of an American company to which the US CFIUS regulations apply. This means that the American president can decide which companies ARM is allowed to sell to worldwide. This raises the vital issue of technology sovereignty which the UK and Europe have suffered from for many years. The dominance of Silicon Valley companies in search (Google), social media (Facebook), films (Netflix), e-commerce (Amazon) has become a pressing issue, fostering the belatedly debate on how we could have allowed this dominance to happen. Now we are about to witness one of our last great European technology companies with a dominant position in mobile phones becoming part of the US trade armoury. Whether we are allowed to use our own British designed microprocessors in the UK and Europe will be decided in the White House rather than in Downing Street. This is a major step towards the UK becoming an American vassal state. It must be stopped. A viable alternative to provide the cash to Softbank, ARM’s current owner, is to list ARM on the LSE and make it a UK based company again. If the LSE does not have enough firepower for an estimated $40bn IPO they will be happy to work with the NYSE, Shanghai Star or Euronext. This will be a crucial test of whether the UK government is serious about an industrial strategy. > On 20 Aug 2020, at 12:00, nexa-request(a)server-nexa.polito.it wrote: > > Date: Thu, 20 Aug 2020 11:37:30 +0200 > From: Giuseppe Attardi <attardi(a)di.unipi.it <mailto:attardi@di.unipi.it>> > To: nexa(a)server-nexa.polito.it <mailto:nexa@server-nexa.polito.it> > Subject: [nexa] ARM > Message-ID: <472D9C85-EA5B-498A-884A-BE8CECFCE308(a)di.unipi.it <mailto:472D9C85-EA5B-498A-884A-BE8CECFCE308@di.unipi.it>> > Content-Type: text/plain; charset=utf-8 > > ARM è la società di Cambridge creata da Herman Hauser come spinoff di Acorn. > Quando Acorn venne acquisita da Olivetti, Hauser divenne direttore di ricerca Olivetti e interagii con lui sullo sviluppo di software per ARM, tra cui il port del linguaggio Lisp che comprendeva un innovativo sistema di parallelismo a thread. > Oggi ARM progetta i chip a basso consumo usati nei cellulari ed è stata acquistata dall?investitore giapponese SoftBank, che ora la vuole vendere. > SMT e Samsung producono i chip ARM. > ARM ha anche una divisione che progetta coprocessori GPU da usare per AI. > BTW: 30 anni fa aiutai SMT a realizzare una GPU per cellulari Nokia, evitando che questa si rivolgesse a Texas Instrument, che ne aveva una già pronta. > > ARM è oggi un asset strategico per l?Europa, visto che è l?unica azienda di processori e GPU in grado di competere con Intel, almeno nel settore dei chip a basso consumo. > > All?acquisto di ARM è interessata NVIDIA, la principale ditta che produce GPU per applicazioni sia grafiche tradizionali, che industriali (visione e AI), avendo introdotto la libreria CUDA, che consente di programmare le GPU per svolgere calcoli tensoriali ad alto parallelismo. > Oggi tutta l?AI di punto viene sviluppata su GPU NVIDIA. > > Herman Hauser stesso è contrario all?acquisto di ARM da parte di NVIDIA, che mette a rischio non solo l?esistenza della divisione GPU ma di lasciare agli USA il dominio totale dei processori. > > STM potrebbe essere l?acquirente ideale. > Ho provato a sondare gli attuali dirigenti di STM che conosco, ma mi hanno risposto che l?acquisto non sarebbe possibile per motivi antitrust. > Non mi sembra sia questo il caso: ci sono altri ben agguerriti produttori di chip, ben più monopolisti di una eventuale STM+ARM ed NVIDIA+ARM sarebbe avrebbe un più invadente dominio nel settore dei chip per AI. > > Bisognerebbe promuovere una cordata di grandi imprenditori europei del settore dei chip, comprendente ad esempio Herman Hauser, Federico Faggin, Pasquale Pistorio, che col sostegno dei politici europei, si proponga a per l?acquisto di ARM al fine di farla restare in mani europee. > > ? Beppe >

2 1