July 2023 - nexa - server-nexa.polito.it

Mercoledì di Nexa del 12 luglio 2023, ore 17.00 | Aperitivo insieme al MixTo, Corso Castelfidardo, 34/A

by Nexa Media

Gentilissime, gentilissimi, Vi segnaliamo che l'incontro di *mercoledì 12 luglio*, dedicato alla riflessione condivisa sull'anno accademico trascorso e al brindisi per salutarci in vista della pausa estiva, si terrà al *MixTo, in Corso Castelfidardo, 34/A*, a Torino, dalle *17.00* in avanti. Ricordiamo che per questo incontro non sarà prevista la modalità di partecipazione online. Vi chiederemmo anche la cortesia di farci sapere, tra oggi e domani, chi vorrà partecipare, così da segnalare al locale scelto il numero indicativo di persone presenti. Per maggiori informazioni:https://nexa.polito.it/mercoledi-brindisi-chiusura-anno-accademico Cordiali saluti, -- Anita Botta Communication Manager Nexa Center for Internet & Society Politecnico di Torino – DAUIN Corso Duca degli Abruzzi, 24 - 10129 Torino web: https://nexa.polito.it/ mail: anita.botta(a)polito.it tel: 011 090 7219

July 10, 2023

Facebook is the "true employer" of its content moderators in Kenya – not Sama, its outsourcing company

by Antonio

Titolo delle (buona) notizia: Huge ruling in Kenyan court threatens global model of outsourced content moderation – and says that Facebook is the "true employer" of its key safety workers Link: https://www.foxglove.org.uk/2023/06/06/kenyan-court-ruling-outsourced-conte… I "moderatori di contenuti" sono persone come Kauna Malgwi: "Kauna Malgwi, 29, is among the former Sama workers whose lives are in limbo right now. A trained clinical psychologist, Malgwi worked at Sama for four years, starting in 2019. Her job involved reviewing and flagging content that violated Facebook’s guidelines. She would typically start her day at 7 a.m., sifting through thousands of posts daily, many of which contained disturbing content such as videos depicting murders, road accidents, rape, beheadings, and suicides. She earned around $600 per month. Five months after losing her job, Malgwi told Rest of World, she continues to struggle with mental health issues from the moderation work." [1] Sama è una delle tante outsourcing company che al primo problema con l'opinione pubblica chiude (o cambia committente) e licenzia tutti. Altri riferimenti alla "Content Moderators Union" qui [2][3]. Antonio [1] https://restofworld.org/2023/meta-content-moderators-kenya-fired-unionize/ [2] https://africasolutionsmediahub.org/2023/05/01/workers-at-facebook-tiktok-a… [3] https://superrr.net/2023/05/10/Report-Content-Moderators-Summit-Kenya.html

July 10, 2023

The AI Dividend: a _modest_ proposal by Bruce Schneier and Barath Raghavan

by 380°

Buongiorno, «Aò: "Big Data is the new oil"; perché nun famo come 'aamo fatto pe' l'Alaska?!?» https://www.schneier.com/blog/archives/2023/07/the-ai-dividend.html «The AI Dividend» aka «Artificial Intelligence Can’t Work Without Our Data - We should all be paid for it» Date: 2023.06.29 --8<---------------cut here---------------start------------->8--- For four decades, Alaskans have opened their mailboxes to find checks waiting for them, their cut of the black gold beneath their feet. This is Alaska’s Permanent Fund, funded by the state’s oil revenues and paid to every Alaskan each year. We’re now in a different sort of resource rush, with companies peddling bits instead of oil: generative AI. Everyone is talking about these new AI technologies—like ChatGPT—and AI companies are touting their awesome power. But they aren’t talking about how that power comes from all of us. Without all of our writings and photos that AI companies are using to train their models, they would have nothing to sell. Big Tech companies are currently taking the work of the American people, without our knowledge and consent, without licensing it, and are pocketing the proceeds. You are owed profits for your data that powers today’s AI, and we have a way to make that happen. We call it the AI Dividend. Our proposal is simple, and harkens back to the Alaskan plan. When Big Tech companies produce output from generative AI that was trained on public data, they would pay a tiny licensing fee, by the word or pixel or relevant unit of data. Those fees would go into the AI Dividend fund. Every few months, the Commerce Department would send out the entirety of the fund, split equally, to every resident nationwide. That’s it. [...] The bottom line for Big Tech is that if their AI model was created using public data, they have to pay into the fund. If you’re an American, you get paid from the fund. Under this plan, hobbyists and American small businesses would be exempt from fees. Only Big Tech companies—those with substantial revenue—would be required to pay into the fund. [...] Using today’s numbers, here’s what it would look like. The licensing fee could be small, starting at $0.001 per word generated by AI. A similar type of fee would be applied to other categories of generative AI outputs, such as images. That’s not a lot, but it adds up. Since most of Big Tech has started integrating generative AI into products, these fees would mean an annual dividend payment of a couple hundred dollars per person. The idea of paying you for your data [isn’t new], and some companies have tried to do it themselves for users who opted in. And the idea of the public being repaid for use of their resources goes back to well before Alaska’s oil fund. But generative AI is different: It uses data from all of us whether we like it or not, it’s ubiquitous, and it’s potentially immensely valuable. It would cost Big Tech companies a fortune to create a synthetic equivalent to our data from scratch, and synthetic data would almost certainly result in worse output. They can’t create good AI without us. Our plan would apply to generative AI used in the US. It also only issues a dividend to Americans. Other countries can create their own versions, applying a similar fee to AI used within their borders. Just like an American company collects VAT for services sold in Europe, but not here, each country can independently manage their AI policy. Don’t get us wrong; this isn’t an attempt to strangle this nascent technology. Generative AI has interesting, valuable, and possibly transformative uses, and this policy is aligned with that future. Even with the fees of the AI Dividend, generative AI will be cheap and will only get cheaper as technology improves. There are also risks—[both every day and esoteric]—posed by AI, and the government may need to develop policies to remedy any harms that arise. Our plan can’t make sure there are no downsides to the development of AI, but it would ensure that all Americans will share in the upsides—particularly since this new technology isn’t possible without our contribution. This essay was written with Barath Raghavan, and [previously appeared] on Politico.com. [isn’t new] <https://www.nytimes.com/interactive/2019/09/23/opinion/data-privacy-jaron-l…> [both every day and esoteric] <https://www.wired.com/story/large-language-model-phishing-scams/> [previously appeared] <https://www.politico.com/news/magazine/2023/06/29/ai-pay-americans-data-001…> --8<---------------cut here---------------end--------------->8--- Tralasciando _ogni_ considerazione di storia più o meno contemporanea in merito all'Alaska e gli interi USA *e* _ogni_ considerazione in merito alla fiscalità applicata alle multinazionali... ...in rigoroso ordine di importanza: Neanche un accenno al fatto che una grossa quantità dei dati ingollati da quei sistemi di machine learning non sono stati prodotti da cittadini statunitensi, molti dati addirittura sono precedenti ai primi insediamenti dei coloni nelle americhe... ma ogni bit, ogni pixel, deve contribuire al WAWOIF (We are Americans and We Owe It Fund) Neanche un accenno al fatto che la _stragrande_ quantità di /quei/ dati sono **personali** - molti di cittadini EU, raccolti in violazione del GDPR, ma che gliè frega a loro - e sono impiegati precisamente per profilare e schedare le persone. Neanche un accenno ai lavoratori para-schiavizzati che sono indispensabili per "taggare" le tonnellate di dati ingollate dai sistemi di machine learning delle multinazionali che questa proposta vorrebbe tassare, lavoratori che quelle stesse multinazionali remunerano con cifre scandalose e fregandosene dei loro diritti ("non siamo noi, sono i governi dei rispettivi paesi a doverci pensare"); quel lavoro semplicemente non è contemplato, quel lavoratori **non esistono**. Per non parlare della qualità di quel lavoro di "tagging". Saluti, 380° -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

July 8, 2023

[CDT:L5] [CDT:L6] AI as Sensemaking for Public Comments

by 380°

Buongiorno, https://www.schneier.com/blog/archives/2023/06/ai-as-sensemaking-for-public… «AI as Sensemaking for Public Comments» June 20, 2023 - by Bruce Schneier and Nathan Sanders pubblicato anche qui: https://theconversation.com/ai-could-shore-up-democracy-heres-one-way-207278 con il più "modesto" titolo «AI could shore up democracy – here’s one way» --8<---------------cut here---------------start------------->8--- [...] Many groups have started demonstrating the potential [beneficial] uses of AI for governance. A key constructive-use case for AI in democratic processes is to serve as [discussion moderator] and [consensus builder]. To help democracy [scale better] in the face of growing, increasingly interconnected populations—as well as the wide availability of AI language tools that can generate reams of text at the click of a button—the US will need to leverage AI’s capability to rapidly digest, interpret and summarize [this content]. There are two different ways to approach the use of generative AI to improve civic participation and governance. Each is likely to lead to drastically different experience for public policy advocates and other people trying to have their voice heard in a future system where AI chatbots are both the dominant readers and writers of public comment. For example, consider individual letters to a representative, or comments as part of a regulatory rulemaking process. In both cases, we the people are telling the government what we think and want. For more than [half a century], agencies have been using human power to read through all the comments received, and to generate summaries and responses of their major themes. To be sure, digital technology has helped. In 2021, the Council of Federal Chief Data Officers [recommended modernizing] the comment review process by implementing natural language processing tools for removing duplicates and clustering similar comments in processes governmentwide. These tools are simplistic by the standards of 2023 AI. They work by assessing the semantic similarity of comments based on metrics like word frequency (How often did you say “personhood”?) and clustering similar comments and giving reviewers a sense of what topic they relate to. Think of this approach as collapsing public opinion. They take a big, hairy mass of comments from thousands of people and condense them into a tidy set of essential reading that generally suffices to represent the broad themes of community feedback. This is far easier for a small agency staff or legislative office to handle than it would be for staffers to actually read through that many individual perspectives. But what’s lost in this collapsing is individuality, personality, and relationships. The reviewer of the condensed comments may miss the personal circumstances that led so many commenters to write in with a common point of view, and may overlook the arguments and anecdotes that might be the most persuasive content of the testimony. Most importantly, the reviewers may miss out on the opportunity to recognize committed and knowledgeable advocates, whether interest groups or individuals, who could have long-term, productive relationships with the agency. These drawbacks have real ramifications for the potential efficacy of those thousands of individual messages, undermining what all those people were doing it for. Still, practicality tips the balance toward of some kind of summarization approach. A passionate letter of advocacy doesn’t hold any value if regulators or legislators simply don’t have time to read it. There is another approach. In addition to collapsing testimony through summarization, government staff can use modern AI techniques to explode it. They can automatically recover and recognize a distinctive argument from one piece of testimony that does not exist in the thousands of other testimonies received. They can discover the kinds of constituent stories and experiences that legislators love to repeat at hearings, town halls and campaign events. This approach can sustain the potential impact of individual public comment to shape legislation even as the volumes of testimony may rise exponentially. In computing, there is a rich history of that type of automation task in what is called [outlier detection]. Traditional methods generally involve finding a simple model that explains most of the data in question, like a set of topics that well describe the vast majority of submitted comments. But then they go a step further by isolating those data points that fall outside the mold—comments that don’t use arguments that fit into the neat little clusters. State-of-the-art AI language models aren’t necessary for identifying outliers in text document data sets, but using them could bring a greater degree of sophistication and flexibility to this procedure. AI language models can be tasked to identify novel perspectives within a large body of text through prompting alone. You simply need to tell the AI to [find them]. In the absence of that ability to extract distinctive comments, lawmakers and regulators have no choice but to prioritize on other factors. If there is nothing better, “[who donated the most to our campaign]” or “[which company employs the most of my former staffers]” become reasonable metrics for prioritizing public comments. AI can help elected representatives do much better. If Americans want AI to help revitalize the country’s ailing democracy, they need to think about how to align the incentives of elected leaders with those of individuals. Right now, as much as 90% of constituent communications are [mass emails] organized by advocacy groups, and they go largely ignored by staffers. People are channeling their passions into a vast digital warehouses where algorithms box up their expressions so they don’t have to be read. As a result, the incentive for citizens and advocacy groups is to fill that box up to the brim, so someone will notice it’s overflowing. A talented, knowledgeable, engaged citizen should be able to articulate their ideas and share their personal experiences and distinctive points of view in a way that they can be both included with everyone else’s comments where they contribute to summarization and recognized individually among the other comments. An effective comment summarization process would extricate those unique points of view from the pile and put them into lawmakers’ hands. --8<---------------cut here---------------end--------------->8--- [beneficial] <https://www.nytimes.com/2023/04/05/opinion/artificial-intelligence-democrac…> [discussion moderator] <https://www.npr.org/2023/03/05/1161192417/a-new-ai-tool-can-moderate-your-t…> [consensus builder] <https://arxiv.org/abs/2211.15006> [scale better] <https://cyberscoop.com/rethinking-democracy-ai/> [this content] <https://www.brookings.edu/research/robotic-rulemaking/> [half a century] <https://core.ac.uk/download/pdf/144232278.pdf> [recommended modernizing] <https://resources.data.gov/resources/cdoc_comment_analysis/> [outlier detection] <https://scikit-learn.org/stable/modules/outlier_detection.html> [find them] <https://andrewmayneblog.wordpress.com/2021/04/18/the-gpt-3-zero-shot-approa…> [who donated the most to our campaign] <https://doi.org/10.1111/lsq.12266> [which company employs the most of my former staffers] <https://doi.org/10.1086/698931> [mass emails] <https://www.congressfoundation.org/news/blog/1637> -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

July 8, 2023

anatomia di uno zero-day: il caso dell'ultimo baco di WebKit (Safari et al)

by 380°

Buongiorno, grazie al DSA 5449-1 [1] ricevuto via email scopro che: --8<---------------cut here---------------start------------->8--- The following vulnerabilities have been discovered in the WebKitGTK web engine: CVE-2023-32439 An anonymous researcher discovered that processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. --8<---------------cut here---------------end--------------->8--- Per chi non lo sapesse WebKit è **software libero** ed è la "web engine" (la libreria software che interpreta e visualizza il contenuto delle pagine web) usata da moltissimi browser: Safari, quelli di iOS e iPadOS, Gnome Web ma anche su console Playstation, Nintendo e televisori con WebOS [2]. La notizia era già stata data sotto forma di _propaganda_ /un tanto al chilo/ da diversi giornali "generalisti" nazionali [3] e non, senza dare il benché minimo riferimento (nemmeno in successivi articoli di aggiornamento, AFAIU) ai report tecnici che descrivono il problema. Il baco riportato sopra fa parte di una serie di vulnerabilità descritte come zero-day in questo interessante articolo di The Hacker News: https://thehackernews.com/2023/06/zero-day-alert-apple-releases-patches.html «Zero-Day Alert: Apple Releases Patches for Actively Exploited Flaws in iOS, macOS, and Safari» --8<---------------cut here---------------start------------->8--- [...] This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation [https://thehackernews.com/2023/06/new-zero-click-hack-targets-ios-users.html] that has been active since 2019. The exact threat actor behind the activity is not known. * CVE-2023-32434 - An integer overflow vulnerability in the Kernel that could be exploited by a malicious app to execute arbitrary code with kernel privileges. * CVE-2023-32435 - A memory corruption vulnerability in WebKit that could lead to arbitrary code execution when processing specially crafted web content. The iPhone maker said it's aware that the two issues "may have been actively exploited against versions of iOS released before iOS 15.7," crediting Kaspersky researchers Georgy Kucherin, Leonid Bezvershenko, and Boris Larin for reporting them. The advisory comes as the Russian cybersecurity vendor dissected the spyware implant used in the zero-click attack campaign targeting iOS devices via iMessages [...] The sophisticated implant, called TriangleDB [https://thehackernews.com/2023/06/new-report-exposes-operation.html] operates solely in the memory, leaving no traces of the activity following a device reboot. It also comes with diverse data collection and tracking capabilities. This includes "interacting with the device's file system (including file creation, modification, exfiltration, and removal), managing processes (listing and termination), extracting keychain items to gather victim credentials, and monitoring the victim's geolocation, among others." [...] Also patched by Apple is a third zero-day CVE-2023-32439, which has been reported anonymously and could result in arbitrary code execution when processing malicious web content. The actively exploited flaw, described as a type confusion issue, has been addressed with improved checks. --8<---------------cut here---------------end--------------->8--- La pagina dedicata al CVE-2023-3249 dal NIST [4] riporta alcuni link di riferimento a "release notes" di aggiornamento emesse da Apple, alcune delle quali [5] indicano che il bug sul sistema di bug tracking di WebKit è il numero 256567: https://bugs.webkit.org/show_bug.cgi?id=256567 «EnumeratorNextUpdateIndexAndMode and HasIndexedProperty should have different heap location kinds» --8<---------------cut here---------------start------------->8--- Status: RESOLVED FIXED Alias: CVE-2023-32439 Product: WebKit Component: JavaScriptCore (show other bugs) Version: WebKit Nightly Build Hardware: Unspecified Unspecified Importance: P2 Normal Assignee: Yijia Huang URL: Keywords: InRadar Depends on: Blocks: Reported: 2023-05-09 18:26 PDT by Yijia Huang Modified: 2023-06-22 08:44 PDT (History) CC List: 2 users (show) --8<---------------cut here---------------end--------------->8--- Il tipo di bug viene definito "type confusion" in [4] :-D Il bug è quindi relativo al sottosistema che interpreta i Javascript (ma dai?!?), viene classificato come di importanza normale mentre il NIS nel CVE gli da un "base score" di 8.8 (su 10). La descrizione del bug credo sia stata redatta per eliminare ogni riferimento all'**anonimo** che ha segnalato il baco, strano perché di solito queste cose "fanno curriculum" :-O Il bug è stato risolto con il commit 52fe95e580 [6] il 10 Maggio scorso (zero-day what?). Tutti i nostri dispositivi sono letteralmente dei colabrodo, parlo di quelli di cui almeno si può verificare la corrispondeza tra sorgente e binario; il resto sono ovviamente irrimediabilmente compromessi. É stata una svista o un sapiente hack? Qualcuno™ lo sapeva e ha fatto finta di niente per anni? Saluti, 380° [1] Debian Security Advisory, non ancora pubblicato via web qui: https://www.debian.org/security/2023/ [2] https://en.wikipedia.org/wiki/WebKit [3] presi a caso: Il Fatto Quotidiano: https://archive.is/HX7aL Il Tempo: https://archive.is/2PloD Punto Informatico: https://web.archive.org/web/20230707111337/https://www.punto-informatico.it… non ho avuto tempo di consultare i FAT checkers [4] https://nvd.nist.gov/vuln/detail/CVE-2023-32439 [5] queste: https://support.apple.com/en-us/HT213813 https://support.apple.com/en-us/HT213814 https://support.apple.com/en-us/HT213816 [6] https://github.com/WebKit/WebKit/commit/52fe95e5805c735cc1fa4d6200fcaa1912e… -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

July 7, 2023

Domicilio digitale e recaptcha

by Alberto Cammozzo

Il nuovo servizio nazionale pubblico (AGID) del domicilio digitale richiede Google recaptcha attivo. Vedi allegato lo schema di permessi richiesti per umatrix. A.

July 7, 2023

Re: [nexa] Piattaforme digitali e censura: un questionario per la raccolta di casi di censura online

by 380°

Buongiorno Maurizio, Maurizio Borghi <maurizio.borghi(a)unito.it> writes: > Vi segnalo il progetto Piattaforme digitali e censura online: la > moderazione dei contenuti tra libertà di pensiero e contrasto alla > disinformazione e hate speech in rete > <https://nexa.polito.it/piattaforme-digitali-censura-online>, da me > coordinato e condotto dalla dott.ssa Beatrice Balzola. Ho riletto poco la pagina relativa al progetto indicata sopra ma non trovo aggiornamenti in merito a come sta andando, un paio di domande: 1. quanti questionari compilati avete ricevuto? 2. quando è prevista la pubblicazione dei risultati? Grazie mille, 380° [...] -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

July 6, 2023

Re: [nexa] Social media could be as harmful to children as smoking or gambling – why is this allowed? | Devi Sridhar | The Guardian

by Fabio Alemagna

Il giorno mer 5 lug 2023 alle ore 18:04 M. Fioretti <mfioretti(a)nexaima.net> ha scritto: > 1) Per cominciare, "dai 14 ai 18 anni" significa appunto che i > problemi sono aumentati, in maniera accelerata, ANCHE fra i 14enni. Non vedo come possa significare una cosa del genere. I dati si riferiscono a una specifica popolazione e non ci consentono di fare alcuna estrapolazione riguardo ad altro tipo di popolazioni. Ma le questioni sono altre. 1) Se il problema sono i social network, perché vietare tutta internet? 2) Se il problema è che c'è aumento di pensieri suicidi e depressione e c'è la certezza che questi, nell'età dai 14 ai 19 anni, siano direttamente causati dall'interazione sui social network, perché non vietarli proprio in quell'età? > "Kids Who Get Smartphones Earlier Become Adults With Worse Mental Health" > > https://jonathanhaidt.substack.com/p/sapien-smartphone-report Correlation is not causation, quante volte lo si deve dire? Ieri sera ero al ristorante, e in ben due tavoli al mio fianco c'erano due poco allegre famigliole con prole al seguito. I genitori quasi neanche si guardavano in faccia, a stento bonfocchiavano qualche parola tra un boccone e l'altro, mentre i figli, annoiati, stavano al cellulare, dal quale evidentemente traevano maggiori stimoli. Possiamo escludere che il cellulare sia semplicemente una valvola di sfogo di *qualche altra cosa*, per esempio una carenza di affetto e interazioni da parte dei genitori, e che sia questa la causa del peggiore stato mentale nell'età adulta? Non basta leggere un post urlato su substack che fa cherry picking di qualche studio a piacere, dandogli l'interpretazione preferita, per poi rilanciarlo con toni ancora più allarmati, per fare scienza o divulgazione scientifica. Fabio

July 6, 2023

Francia. Come si può fare integrazione in una società che si disintegra?

by don Luca Peyron

Un pezzo che mi ha fatto riflettere, che tocca i nostri temi solo in modo tangenziale, ma forse neppure troppo se ci pensiamo. Buona lettura a chi lo desidera dl https://www.avvenire.it/opinioni/pagine/come-si-pu-fare-integrazione-in-una… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

July 6, 2023

Una bocciatura intelligente

by de petra giulio

Vi segnalo questa intervista che racconta che cosa sta avvenendo al liceo Albertelli di Roma https://centroriformastato.it/piano-scuola-4-0-avrei-preferenza-di-no/

July 5, 2023