April 2021 - nexa - server-nexa.polito.it

Re: [nexa] How I Fought To Graduate Without Using Nonfree Software

by Antonio Iacono

> non posso che concordare con lui, da noi in dipartimento la sensibilità verso questi temi è > abbastanza bassa tanto che io ormai ho quasi smesso di lottare internamente per l'adozione del sw libero Fosse solo il software libero il problema dell'università italiana :( Oggi su Repubblica "Agnese nel Paese dei baroni" [1] che riporta, nell'incipit, l'articolo di John Foot, storico e saggista britannico specializzato in storia italiana [2]. Di quest'ultimo vorrei sottolineare un passaggio: "In 1961, Franco Basaglia accepted a job as director of the psychiatric hospital at Gorizia, on the border with Yugoslavia. Taking such a post was a sign of failure for ambitious psychiatrists at the time. Basaglia had spent many years as an assistant professor at Padua but was considered too radical for promotion. As he sat at his desk in Gorizia for the first time, some documents were brought for him to sign. They included forms giving permission for various patients to be tied to their beds. The permission was retrospective. To everyone’s surprise, Basaglia refused to sign. Seventeen years later Italy became the first country to pass a law ordering the closure of all large-scale psychiatric hospitals. But those were different times. Nobody like Basaglia would ever become a vice chancellor or a rettore of a university today." Antonio [1] https://rep.repubblica.it/pwa/longform/2021/04/22/news/scandalo_universita_… (solo per abbonati) [2] https://www.lrb.co.uk/the-paper/v43/n05/john-foot/on-the-barone

April 22, 2021

Re: [nexa] How I Fought To Graduate Without Using Nonfree Software

by Andrea Trentini

On 22/04/2021 18:12, Giovanni Biscuolo wrote: > ... > Professori di informatica cosa rispondete a questa constatazione: «As I > mentioned earlier, despite being highly knowledgeable computer > scientists and experienced in informatics, many academics demonstrated a > generally poor understanding of the politics and ethics around > software.» ? non posso che concordare con lui, da noi in dipartimento la sensibilità verso questi temi è abbastanza bassa (se ci sono colleghi in lista mi smentiscano, sarò ben contento!), tanto che io ormai ho quasi smesso di lottare internamente per l'adozione del sw libero (evitando cmq per quanto possibile ogni sw proprietario e sensibilizzando in ogni caso gli studenti sul tema) dedicandomi al mondo esterno (cfr. libro CDT) dove magari qualche soddisfazione in più si ottiene... -- |_|o|_| Andrea Trentini - http://atrent.it |_|_|o| Dipartimento di Informatica |o|o|o| Università degli Studi di Milano

April 22, 2021

How I Fought To Graduate Without Using Nonfree Software

by Giovanni Biscuolo

Buongiorno, uno studente polacco che ha lottato con le unghie e coi denti per laurearsi senza usare software proprietario. ...e a uno studente così non gliele vogliamo dare un paio di lauree ad honorem in «Diritto» e «Scienze Politiche»?!? Professori di informatica cosa rispondete a questa constatazione: «As I mentioned earlier, despite being highly knowledgeable computer scientists and experienced in informatics, many academics demonstrated a generally poor understanding of the politics and ethics around software.» ? «How I Fought To Graduate Without Using Nonfree Software» by Wojciech Kosior https://www.gnu.org/education/how-i-fought-to-graduate-without-using-non-fr… --8<---------------cut here---------------start------------->8--- Because I refuse to use unethical software, the complete reliance on proprietary platforms has created an ethical conflict. My aim has been to complete my university degree without surrendering to the imposed nonfree services, by convincing my professors[2] to allow me to use only free-software replacements to proprietary applications. I didn't expect to win a fight against such power, but now, through polite but firm action, I think I may have prevailed. Hopefully this story will help you resist too. [...] Replies urging me to “run the program in a virtual machine” or saying that I “don't need the source code to use the service,” made it clear that some of my professors didn't understand, or understood only part of the issues. Had I been studying anything other than informatics, I suspect the fraction of those who understood the problem would be far smaller. [...] Not knowing whether the university would recognize my principles was a cause of ongoing stress. [...] I believe every class should at minimum be offered ways to interoperate with libre tools so that students can at least read class assignments on free platforms, and upload their answers from them. Unless universities offer interoperability, the reliance on proprietary software costs both students and professors time and headaches. At one point I emailed two professors about the use of nonfree platforms for lectures. One didn't respond and the other replied rudely. They seemed not to understand, but I suspect they were avoiding any extra work. This had a corrosive impact on my engagement and I stopped caring about lectures. Avoiding a language-specific package manager that I felt put me at risk of security and freedom issues cost me considerable time and delayed my studies. Time is precious for us all. [...] It is not necessarily the functional aspects of the software that creates friction around lack of software freedom. During the summer I had to do an internship. I backed out of a paid offer after learning that the employer would make make my code nonfree. I eventually did another, unpaid internship. [...] Before the winter semester, a list of allowed videoconferencing platforms that comply with the data protection law was given to professors. It contained Microsoft Teams, Cisco Webex, ClickMeeting, and Google Meet. You will surely see the irony here! [...] As I mentioned earlier, despite being highly knowledgeable computer scientists and experienced in informatics, many academics demonstrated a generally poor understanding of the politics and ethics around software. [...] Later, one professor who didn't agree to let me pass a course without using Teams wanted to fail me for my “absences,” despite my uploading homework throughout the semester. After a protracted argument, I was offered an option to meet online on January 8th... on Teams! I politely refused again, and reiterated my points. The professor eventually CC'd the Associate Dean in an email. In the meantime, the deadline to upload my thesis for a January defense expired. After many reminder emails, a response finally came, and through the Dean's intercession I got a grade, passed my seventh semester and successfully defended my thesis in March. [...] We can see some people are intolerant to software freedom principles, but in the end those were few and most university staff at the AGH were actually kind to me. Thanks to them I now have a proof that it is possible to study, graduate... indeed to live without relying on proprietary software. After all this hard experience, I feel more independent than ever, and I even received appreciation from the well-known RMS. Hopefully, my story will help more students get to where I am. Struggling to run only libre programs forced, and continues to force me, to gain new skills. I now know enough about web technologies to make several sites function without JavaScript. But what is best about my experience is that I will be able to share my fixes with others and eventually make a subset of the World Wide Web usable in freedom. --8<---------------cut here---------------end--------------->8--- RMS in persona è rimasto impressionato https://lists.gnu.org/archive/html/info-gnu/2021-04/msg00005.html Saluti, Giovanni. -- Giovanni Biscuolo Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché.

April 22, 2021

Proposal for a Regulation on a European approach for Artificial Intelligence

by don Luca Peyron

The Commission is proposing the first ever legal framework on AI, which addresses the risks of AI and positions Europe to play a leading role globally. https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-europe… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

April 22, 2021

Re: [nexa] nexa Digest, Vol 144, Issue 42

by Giuseppe Attardi

> On 21 Apr 2021, at 10:16, nexa-request(a)server-nexa.polito.it wrote: > > Date: Wed, 21 Apr 2021 10:16:08 +0200 > From: Alberto Cammozzo <ac+nexa(a)zeromx.net> > To: Center Nexa <nexa(a)server-nexa.polito.it> > Subject: [nexa] superare il capitalismo della sorveglianza > Message-ID: <b6a0cf17-dca0-51d9-6b19-3986be890c58(a)zeromx.net> > Content-Type: text/plain; charset=utf-8 > > Cari Nexiani, > > a vostro avviso quali sono i progetti più promettenti o più ambiziosi > per superare l'attuale impasse attorno alle piattaforme a il loro > soffocante modello di business? > > Vorrei dare agli studenti degli input basati su un certo ottimismo > (della ragione, se non dello spirito) e vedo alcuni vettori la cui > composizione rende possibile (anche se non probabile) il superamento del SC: > > 1) *architetture* IT: progetti che favoriscano decentralizzazione, > policentizzazione, disacoppiamento dati/identità, proprietà dei dati > personali, anonimizzazione, cifratura, ... > > 2) *leggi*: regolazioni che pongano limiti a certi tipi di trattamento, > alla concentrazione di mercato, all'accentramento, vedi Digital Services > Act & Digital Markets Act ... > > 3) *norme* sociali e comportamenti: crescente sensibilità verso la > privacy, paura della manipolazione, connotazione negativa per chi usa > certe piattaforme, noluddismo, rebound offline post-pandemico ... > > 4) *mercato* : fine del modello di business legato alla pubblicità > (perché scoperto non redditivo, ...), crescente inefficienza dei > monopoli, ?... > Il capitalismo non si riforma con le leggi “del mercato”, occorrono leggi “sul mercato”. Mi sono convinto che il modello di business legato alla pubblicità sia ciò che produce le massime distorsioni. Bisogna intervenire su questo che è il cuore del problema, ed è anche il punto da colpire che duole di più: vedi le vivaci discussioni tra Tim Cook e Mark Zuckerberg. Tutto il resto sono palliativi, che spesso arrivano troppo tardi o vengono aggirati. — Beppe > Che ne pensate? > > Grazie per ogni vostro contributo! > > > Alberto >

April 22, 2021

Re: [nexa] In epic hack, Signal developer turns the tables on forensics firm Cellebrite | Ars Technica

by Giovanni Biscuolo

Buongiorno, Una borsa cade da un furgone proprio nelle mani di quello che ce l'ha a morte con Cellebrite per quello che fanno, anche con i dati (locali ovviamente) di Signal... guarda a volte le coincidenze eh! :-D Dopo una cosa del genere in un mondo normale l'azienda dovrebbe fallire nel giro di tre giorni... io invece scommetto un caffè che continuerà a fare un sacco di affari. Alberto Cammozzo via nexa <nexa(a)server-nexa.polito.it> writes: > <https://arstechnica.com/information-technology/2021/04/in-epic-hack-signal-…> > > > For years, Israeli digital forensics firm Cellebrite has helped > governments and police around the world break into confiscated mobile > phones, mostly by exploiting vulnerabilities that went overlooked by > device manufacturers. Now, Moxie Marlinspike—creator of the Signal > messaging app—has turned the tables on Cellebrite. > > On Wednesday, Marlinspike published a post that reported vulnerabilities > in Cellebrite software Credetemi, vale la pena di leggere anche il post su Signal: https://signal.org/blog/cellebrite-vulnerabilities/ --8<---------------cut here---------------start------------->8--- Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those seeking to abuse and oppress in Turkey, UAE, and elsewhere. A few months ago, they announced that they added Signal support to their software. Their products have often been linked to the persecution of imprisoned journalists and activists around the world, but less has been written about what their software actually does or how it works. Let’s take a closer look. In particular, their software is often associated with bypassing security, so let’s take some time to examine the security of their own software. --8<---------------cut here---------------end--------------->8--- [...] > “We are of course willing to responsibly disclose the specific > vulnerabilities we know about to Cellebrite if they do the same for all > the vulnerabilities they use in their physical extraction and other > services to their respective vendors, now and in the future,” Standing ovation di 3 ore! Saluti, Giovanni -- Giovanni Biscuolo Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché.

April 22, 2021

In epic hack, Signal developer turns the tables on forensics firm Cellebrite | Ars Technica

by Alberto Cammozzo

<https://arstechnica.com/information-technology/2021/04/in-epic-hack-signal-…> For years, Israeli digital forensics firm Cellebrite has helped governments and police around the world break into confiscated mobile phones, mostly by exploiting vulnerabilities that went overlooked by device manufacturers. Now, Moxie Marlinspike—creator of the Signal messaging app—has turned the tables on Cellebrite. On Wednesday, Marlinspike published a post that reported vulnerabilities in Cellebrite software that allowed him to execute malicious code on the Windows computer used to analyze devices. The researcher and software engineer exploited the vulnerabilities by loading specially formatted files that can be embedded into any app installed on the device. Virtually no limits “There are virtually no limits on the code that can be executed,” Marlinspike wrote. He continued: For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question. Cellebrite provides two software packages: The UFED breaks through locks and encryption protections to collect deleted or hidden data, and a separate Physical Analyzer uncovers digital evidence (“trace events”). To do their job, both pieces of Cellebrite software must parse all kinds of untrusted data stored on the device being analyzed. Typically, software that is this promiscuous undergoes all kinds of security hardening to detect and fix any memory-corruption or parsing vulnerabilities that might allow hackers to execute malicious code. “Looking at both UFED and Physical Analyzer, though, we were surprised to find that very little care seems to have been given to Cellebrite’s own software security,” Marlinspike wrote. “Industry-standard exploit mitigation defenses are missing, and many opportunities for exploitation are present.” Compromising integrity One example of this lack of hardening was the inclusion of Windows DLL files for audio/video conversion software known as FFmpeg. The software was built in 2012 and hasn’t been updated since. Marlinspike said that in the intervening nine years, FFmpeg has received more than 100 security updates. None of those fixes are included in the FFmpeg software bundled into the Cellebrite products. Marlinspike included a video that shows UFED as it parses a file he formatted to execute arbitrary code on the Windows device. The payload uses the MessageBox Windows API to display a benign message, but Marlinspike said that “it’s possible to execute any code, and a real exploit payload would likely seek to undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” Our latest blog post explores vulnerabilities and possible Apple copyright violations in Cellebrite's software: "Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective"https://t.co/DKgGejPu62 pic.twitter.com/X3ghXrgdfo — Signal (@signalapp) April 21, 2021 Marlinspike said he also found two MSI installer packages that are digitally signed by Apple and appear to have been extracted from the Windows installer for iTunes. Marlinspike questioned if the inclusion constitutes a violation of Apple copyrights. Apple didn't immediately provide a comment when asked about this. In an email, a Cellebrite representative wrote: "Cellebrite is committed to protecting the integrity of our customers’ data, and we continually audit and update our software in order to equip our customers with the best digital intelligence solutions available." The representative didn't say if company engineers were aware of the vulnerabilities Marlinspike detailed or if the company had permission to bundle Apple software. Marlinspike said he obtained the Cellebrite gear in a “truly unbelievable coincidence” as he was walking and “saw a small package fall off a truck ahead of me.” The incident does seem truly unbelievable. Marlinspike declined to provide additional details about precisely how he came into possession of the Cellebrite tools. The fell-of-a-truck line wasn't the only tongue-in-cheek statement in the post. Marlinspike also wrote: In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice, and aesthetics are important in software. Files will only be returned for accounts that have been active installs for some time already, and only probabilistically in low percentages based on phone number sharding. We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time. There is no other significance to these files. The vulnerabilities could provide fodder for defense attorneys to challenge the integrity of forensic reports generated using the Cellebrite software. Cellebrite representatives didn’t respond to an email asking if they were aware of the vulnerabilities or had plans to fix them. “We are of course willing to responsibly disclose the specific vulnerabilities we know about to Cellebrite if they do the same for all the vulnerabilities they use in their physical extraction and other services to their respective vendors, now and in the future,” Marlinspike wrote.

April 22, 2021

Oggi, 22 Aprile - 20:30, LinuxTrent riprende oggi gli incontri online. Rispettando la riservatezza le persone

by Roberto Resoli

Salve a tutti, Come forse qualcuno sa, faccio parte di LinuxTrent, un'associazione che cerca di mantenere un'attenzione costante ad un uso delle tecnologie informatiche rispettoso delle persone. La nostra attività consiste soprattutto in incontri pubblici, nell'intento di aumentare la consapevolezza e abbattere le barriere verso l'adozione degli strumenti migliori (che non sono quelli di uso comune, come ben sappiamo). Nell'ultimo anno questa attività si è quasi azzerata, ovviamente. Ho cercato di capire se fosse possibile riprendere la nostra attività prendendo il meglio di quanto realizzato da altri (https://iorestoacasa.work per la videoconferenza) offrendo per quanto possibile il resto (diretta streaming e chat contestuale) in proprio. All'inizio di quest'anno tutti gli strumenti necessari sono diventati disponibili: il progetto Peertube[1], con la versione 3, ha aggiunto la possibilità di ricevere stream rtmp, e un paio di mesi dopo è iniziato lo sviluppo di livechat[2], un plugin per peertube che abilita l'utilizzo di una chat xmpp contestuale ai video. Qui i dettagli: https://www.linuxtrent.it/incontri-online-di-linuxtrent-il-potere-di-scegli… Per chi vuole, siamo in diretta oggi, alle 20:30. Marco Agostini parlerà delle sue esperienze con FreePBX, una interfaccia web per il server VOIP Asterisk: https://www.linuxtrent.it/finalmente-uninterfaccia-per-asterisk-con-i-fiocc… a seguire, altri incontri (anche di argomento molto più generale e disparato). ciao, rob [1] https://joinpeertube.org/ [2] https://github.com/JohnXLivingston/peertube-plugin-livechat

April 22, 2021

Le mirabolanti avventure di Lovelace e Babbage

by Antonio Iacono

Una segnalazione che, sono sicuro, farà piacere agli amanti della storia del computer e del ... fumetto :) https://www.oscarmondadori.it/libri/le-mirabolanti-avventure-di-lovelace-e-… o, in inglese The Thrilling Adventures of Lovelace and Babbage: The (Mostly) True Story of the First Computer https://www.penguin.co.uk/books/286/286982/the-thrilling-adventures-of-love… Antonio

April 21, 2021

Neuralink Could Sell Your Private Thoughts to the Highest Bidder

by Antonio Iacono

Last week, Elon Musk’s neural implant company Neuralink released a video of a primate, who’d been implanted with its technology, playing the game “Pong” with its thoughts. The technologically flashy but otherwise disappointing demo — neuroscientists first developed and demonstrated mind-control tech in primates decades ago — represented Neuralink’s growing prominence in the public sphere, and raised important questions about privacy, data ownership, and biomedical ethics. [1] Antonio [1] https://futurism.com/neoscope/expert-neuralink-sell-private-thoughts-highes…

April 21, 2021