- nexa - server-nexa.polito.it

Re: [nexa] explosive supply chain attack on Hezbollah pagers.
by 380° Sept. 18, 2024

Sept. 18, 2024

380° <g380(a)biscuolo.net> writes: > siccome ne ho lette di tutti i colori in merito a "hanno stati gli > hacker col MALWARE" (anche da presunti espertoni), vale la pena > analizzare i fatti cum granu salis e smetterla con la SUPERSTIZIONE. mi stavo giusto chiedendo se ci fosse qualche precedente e a rispondermi è Christine Gadsbym, Cybersecurity CISO in BlackBerry. ...poi l'articolo si trasforma in uno SPROLOQUIO sulla "software supply chain" (con soluzioni ridicole tipo gli SBOM - Software Bill Of Material), quindi mi limito a citare le parti pertinenti al supply chain attack in oggetto. https://blogs.blackberry.com/en/2024/09/pagers-explode-supply-chain-securit… «Supply Chain Lessons from Thousands of Exploding Pagers» 09.17.24, Christine Gadsby --8<---------------cut here---------------start------------->8--- But the conversation soon shifted to another possible scenario: the pagers must have been intercepted along the supply chain so someone could place explosives inside each pager with a method of remotely triggering the blasts. Attackers have utilized [[https://simple.wikipedia.org/wiki/Yahya_Ayyash][similar attacks]] before, although not to this scale. --8<---------------cut here---------------end--------------->8--- COMUNQUE: il precedente indicato è del 1996 e riguarda il sabotaggio di UN telefono cellulare nel quale furono introdotti 15 grammi di esplosivo con un sistema di detonazione remoto. --8<---------------cut here---------------start------------->8--- Kamal Hamad asked his nephew for the phone, which he later returned. It was almost certainly at this moment that the 2oz radio-controlled bomb was inserted. --8<---------------cut here---------------end--------------->8--- (https://www.independent.co.uk/news/world/how-the-phone-bomb-was-set-up-1323…) Quindi non certo un supply chain attack, ma la tecnica pare la stessa identica di circa 30 anni fa, non proprio una novità per le agenzie di "intelligence", insomma. Saluti, 380° -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

2 4

Can LLMs Generate Novel Research Ideas? A Large-Scale Human Study with 100+ NLP Researchers
by Fabio Alemagna Sept. 18, 2024

Sept. 18, 2024

«By recruiting over 100 NLP researchers to write novel ideas and blind reviews of both LLM and human ideas, we obtain the first statistically significant conclusion on current LLM capabilities for research ideation: we find LLM-generated ideas are judged as more novel (p < 0.05) than human expert ideas while being judged slightly weaker on feasibility.» https://arxiv.org/abs/2409.04109v1

1 0

Re: [nexa] explosive supply chain attack on Hezbollah pagers.
by 380° Sept. 18, 2024

Sept. 18, 2024

380° <g380(a)biscuolo.net> writes: > siccome ne ho lette di tutti i colori in merito a "hanno stati gli > hacker col MALWARE" (anche da presunti espertoni), vale la pena > analizzare i fatti cum granu salis e smetterla con la SUPERSTIZIONE. altra fonte, France24: https://www.france24.com/en/live-news/20240917-israeli-supply-chain-infiltr… «Israeli supply chain infiltration likely behind Hezbollah pager blasts: analysts» Issued on: 17/09/2024 - 20:51 Modified: 17/09/2024 - 20:49 --8<---------------cut here---------------start------------->8--- Paris (AFP) – Israel has scored a major intelligence success by apparently infiltrating a supply chain to cause the simultaneous explosion of hundreds of Hezbollah pagers in a blow for the Lebanese militant group and its Iranian backers, analysts say. [...] With Hezbollah appearing to prefer the use of pagers for internal communications over smartphones for security reasons, analysts said it appeared Israel had corrupted the devices before delivery, allowing them to explode at a specific time. A source close to Hezbollah, asking not to be identified, told AFP that "the pagers that exploded concern a shipment recently imported by Hezbollah of 1,000 devices", which appear to have been "sabotaged at source". "For Israel to embed an explosive trigger within the new batch of pagers, they would have likely needed access to the supply chain of these devices," said Brussels-based military and security analyst Elijah Magnier. "Israeli intelligence has infiltrated the production process, adding an explosive component and remote triggering mechanism into the pagers without raising suspicion," he said, raising the prospect the third party which sold the devices could have been an "intelligence front" set up by Israel for the purpose. Charles Lister of the Middle East Institute said: "This was more than lithium batteries being forced into override. A small plastic explosive was almost certainly concealed alongside the battery, for remote detonation via a call or page." "Mossad infiltrated the supply chain," he concluded, referring to Israel's intelligence agency. 'Their big comeback' ───────────────────── The Wall Street Journal cited people familiar with the matter as saying the affected pagers were from a new shipment that the group received in recent days. [...] the images captured on camera of pagers exploding are a major security blow for Hezbollah and an illustration of Israel's reach even into its members' pockets. [...] French defence expert Pierre Servent said the latest action against Hezbollah would help Israeli intelligence services restore their reputation, which was badly dented by the October 7 attack. "The series of operations conducted over the past few months marks their big comeback, with a desire for deterrence and a message: 'we messed up but we're not dead,'" he told AFP. [...] 'Classic sabotage' ─────────────────── Former CIA analyst Mike Dimino of the US-based Defense Priorities think tank said that judging by images of the injuries a "very small explosive" implanted inside the devices was the most likely cause, rather than an overheating battery. "This was a classic sabotage operation," he said on X, adding such an operation takes "months if not years" to orchestrate. Dubai-based analyst Riad Kahwaji said that Israel had taken advantage of Hezbollah's move away from smartphones to pagers. Israel intelligence had conducted a "most professional operation", he said. "Without a doubt, one of the factories it (Israel) owns manufactured and shipped these explosive devices that exploded today," he said. --8<---------------cut here---------------end--------------->8--- -- 380° (Giovanni Biscuolo public alter ego) «Noi, incompetenti come siamo, non abbiamo alcun titolo per suggerire alcunché» Disinformation flourishes because many people care deeply about injustice but very few check the facts. Ask me about <https://stallmansupport.org>.

1 0

Larry Ellison's AI-Powered Surveillance Dystopia Is Already Here
by Daniela Tafani Sept. 17, 2024

Sept. 17, 2024

Larry Ellison's AI-Powered Surveillance Dystopia Is Already Here Jason Koebler Sep 17, 2024 There’s a comment that’s become very popular on social media whenever a new, horrifying surveillance practice is revealed: “1984 was supposed to be a warning, not an instruction manual!” This sentiment has become a bit tiresome, in part because saying it doesn’t really mean anything, and our real world has long since surpassed George Orwell’s dystopian nightmare in a few ways. But invoking 1984 as warning, not instruction manual feels appropriate here, with Oracle CEO Larry Ellison, the fifth-richest person in the world, pitching his exciting vision for an always-on, 1984-style, AI-powered surveillance fever dream to an audience of investors. In the remarks, which were first reported by Business Insider, Ellison said police body cameras, car cameras, drones, and other cameras will be always on and streaming to Oracle data centers, where AI will constantly be monitoring the feeds. “The police would be on their best behavior, because we’re constantly watching and recording everything that’s going on,” Ellison said. “Citizens will be on their best behavior, because we’re constantly recording and reporting everything that’s going on. It’s unimpeachable. The cars have cameras on them.” Ellison’s entire remarks are worth reading, because what he is pitching is a comprehensive surveillance apparatus that touches most parts of being in public. More importantly, every idea he is pitching currently exists in some form, and each has massive privacy, bias, legal, or societal issues that have prevented them from being the game-changing technology that somehow makes us all safer. Ellison: “Securing schools: We think we can absolutely lock down schools so that dramatically reduce the case of anyone being on campus that doesn’t belong on campus, and immediately alert someone, use AI cameras to immediately recognize that.” The idea that schools can be made safe with technology (or armed teachers, or more police) rather than, say, making guns harder to access, has become a cash cow for surveillance tech companies in the age of near-constant school shootings. Many schools have begun to implement AI-powered weapon detectors, which are notoriously inaccurate and which have, for example, detected notebooks as “weapons,” missed actual weapons, and led to what one administrator called “the least safe day” because of mass confusion associated with the scanners. Students are also being monitored in the hallways, in the bathroom, on social media, and on their school-issued devices. It’s unclear that any of this has made schools any safer. Axon, meanwhile, pitched the idea of taser-equipped drones that patrol schools, an idea that was quickly shelved after widespread public outrage and its own ethics board resigning over the idea. Ellison: “We completely redesigned body cameras. Our body cameras cost $70, normal body camera costs, I don’t know, $7,000. Our body cameras are simply lenses, two lenses attached to a vest attached to the smartphone you’re wearing. We take the video of the police officer. And the camera is always on. You don’t turn it on and off. [A police officer can say], ‘Oracle, I need two minutes to take a bathroom break,’ and we’ll turn it off. The truth is, we don’t really turn it off. What we do is, we record it, so no one can see it, so no one can get into that recording without a court order. So you get the privacy you requested, but court order, we will—a judge will order, that so-called bathroom break. Something comes up, I’m going to lunch with my friends. ‘Oracle, I need an hour of privacy for lunch with my friends.’ God bless. We won’t listen in, unless there’s a court order. But we transmit the video back to headquarters, and AI is constantly monitoring video.” Ellison is correct that police turning off their body cameras is a well-documented problem. Intuitively, you would also think that body cameras would improve police behavior. But the evidence for this is actually not that strong. Academics have shown that having a body camera on does not make a statistical or consistent difference in police behavior in part because there are many cases of police being filmed committing acts of brutality where the officer in question does not face severe consequences. Public access to body camera footage is also incredibly uneven; public records laws differ in each state about whether that footage can be obtained by journalists and police accountability organizations. Ellison is proposing a situation here where the footage would be held and analyzed not by a public police department but by Oracle and Oracle’s AI systems. “We won’t listen in, unless there’s a court order” means, of course, that it is listening in, and has all sorts of implications for who can access this sort of footage, when, and under what circumstances. Ellison: “Remember this terrible case in Memphis where the five police officers basically beat to death another citizen in Memphis? Well, that can’t happen because it’d be on TV at headquarters. Everyone would see it. Your body cameras would be transmitting that. The police would be on their best behavior, because we’re constantly watching and recording everything that’s going on. Citizens will be on their best behavior, because we’re constantly recording and reporting everything that’s going on. It’s unimpeachable. The cars have cameras on them. I think we have a squad car someplace. Those applications—we’re using AI to monitor the video. So that altercation that occurred in Memphis, the chief of police would be immediately notified. It’s not people that are looking at those cameras, it’s AI that’s looking at the camera, [saying] ‘No, no no, you can’t do this. That’s an event.’ An alarm is going to go off and we’re going to have supervision. Every police officer is going to be supervised at all times. And if there’s a problem, AI will report it to the appropriate person, whether it’s the sheriff or the chief or whoever we need to take control of the situation.” AI-powered and connected smart cameras are already in use in the United States and across the world. So are automated license plate readers, AI-powered gunshot detecting microphones, connected home security cameras, facial recognition tech, etc. Tesla footage is being subpoenaed and used in police investigations. Crime still exists, and false positives and cases of mistaken identities are common across most of these technologies. Companies like Predpol, Shotspotter, Flock, Fusus, Axon, and many others have been pitching the idea of predictive and instantly-reactive policing as a deterrent for many years. These technologies are anything but “unimpeachable.” There have been numerous incidents of Black men being misidentified by facial recognition technology, instances of police automatically responding to a supposed gunshot that was not a gunshot, and cases of over-policing for minor crimes or minor disturbances. In South Africa, for example, AI-connected smart surveillance cameras have been accused of creating a “new Apartheid” because of bias within its systems. Ellison: “We have drones. A drone gets out there way faster than a police car. You shouldn’t have high-speed chases with cars. You just have the drone follow a car, it’s very simple. A new generation of autonomous drones. A forest fire—the drone spots a forest fire and then the drone drops down and looks around to see if there’s a human being near that heat bloom, and someone else either had an unattended campfire that caught fire, or it’s arson. We can do all of that. It’s all done autonomously with AI.” This system is called “drones as first responders,” it also already exists, and there are problems with this, too. Drones are being used to automatically surveil homeless encampments, house parties, teens being loud, and a person “bouncing a ball against a garage.” AI and drone tech to prevent forest fires is also something that has had millions of dollars poured into it, with underwhelming results so far. This is all to say that Larry Ellison’s surveillance fever dream isn’t actually a fever dream: All of these are technologies that already exist in some form, many of which have not measurably driven down crime or solved the complicated societal, political, and economic problems that lead to crime in the first place or the societal power structures that protect police at every turn. These technologies have collectively cost billions of dollars, made surveillance companies very rich, and have created new privacy problems. Big Brother is here, and, surprise, having AI “supervision” has not created a crimeless utopia. <https://www.404media.co/larry-ellisons-ai-powered-surveillance-dystopia-is-…>

1 0

Data center emissions probably 662% higher than big tech claims. Can it keep up the ruse? | Technology | The Guardian
by J.C. DE MARTIN Sept. 16, 2024

Sept. 16, 2024

https://www.theguardian.com/technology/2024/sep/15/data-center-gas-emission… (messaggio spedito in movimento - scusate brevità ed eventuali refusi)

1 0

116° Nexa Lunch Seminar | 25 settembre 2024, ore 13.00
by Nexa - Media Sept. 16, 2024

Sept. 16, 2024

Gentilissime, gentilissimi, Vi invitiamo a partecipare al 116° Nexa Lunch Seminar che si terrà mercoledì 25 settembre, dalle ore 13.00 alle ore 14.00, con un incontro dal titolo: "Bringing Archives to Life. Costruire Knowledge Graphs con i Large Language Models". Ospite dell'incontro: Giuseppe Futia (Fellow del Centro Nexa). L'incontro si terrà IN PRESENZA e ONLINE. SEDE FISICA dell'incontro: Centro Nexa su Internet e Società, Politecnico di Torino, Via Boggio 65/a, Torino (1° piano). Per accedere alla sala si raccomanda di suonare al citofono Portineria e di seguire le indicazioni segnalate lungo il percorso. QUI<https://nexa.polito.it/contatti> maggiori informazioni su come raggiungerci. STANZA VIRTUALE dell'incontro: https://didattica.polito.it/VClass/NexaEvent Di seguito maggiori dettagli: https://nexa.polito.it/lunch-116<https://nexa.polito.it/lunch-116/> Cordiali saluti, -- Valeria Bergantino Communication Manager Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino web: https://nexa.polito.it/ mail: valeria.bergantino(a)polito.it<mailto:valeria.bergantino@polito.it> tel: 3473443585

1 0

an evil Nexa
by maurizio lana Sept. 15, 2024

Sept. 15, 2024

Bruce Schneier nel suo blog segnala il progetto surveillance-watch (https://www.schneier.com/blog/archives/2024/08/surveillance-watch.html) se si apre e si va alla sezione surveilling entities, tra le tante c'è un "Nexa Technologies" > Senior executives at this French spyware firm have been indicted for > the company’s sale of surveillance software to authoritarian regimes > in Libya and Egypt that resulted in the torture and disappearance of > dissidents. Eagle products supplied by Nexa Technologies / Amesys were > discovered in the offices of Muammar Gaddafi’s secret police. Nexa has > an Emirati-based subsidiary called Advanced Middle East Systems Nexus Technologies, no? oppure Nexon Technologies? Maurizio ------------------------------------------------------------------------ dialogare tra di noi per costruire una democrazia, l’unica istituzione di vita comune che non sia fondata sulla paura di morire michel dardenne ------------------------------------------------------------------------ Maurizio Lana Università del Piemonte Orientale Dipartimento di Studi Umanistici Piazza Roma 36 - 13100 Vercelli

2 1

Informatica a scuola
by Angelo Raffaele Meo Sept. 15, 2024

Sept. 15, 2024

bellissimi messaggi degli amici Marco Fioretti, Enrico Nardelli, Giuseppe Attardi e 380° finalizzati alla promozione dell’insegnamento dell’informatica nella scuola mi suggeriscono una autentica operazione di marketing a favore di due nostri prodotti. Per farmi perdonare vi inforno che questi due prodotti sono una piccola parte del lavoro svolto gratuitamente nel tempo libero da una ventina di fanatici della parrocchia del software libero. I due pacchetti, come molti altri di cui intendo parlarvi in futuro, sono assolutamente liberi e gratuiti. Il primo prodotto è un riassunto dei principi e degli strumenti dell’informatica; il secondo è un manuale di programmazione in linguaggio Python. Stiamo completando in questi giorni l'attivazione del prototipo di un nuovo "archivio nazionale del materiale didattico libero" (definizione di UNESCO) nel quale stiamo caricando 2000 oggetti didattici (libri, manuali, videolezioni e videoconferenze, videogiochi didattici, software didattico). Ovviamente stiamo caricando in quell'archivio anche quei due manualini. Chi avesse bisogno subito dei due prodotti di cui vi ho parlato mi mandi un mail (angelo.meo(a)polito.it) ed io glieli manderò immediatamente via "we transfer". Molti colleghi della scuola mi hanno manifestato il timore che i loro allievi non siano in grado di comprendere i principi dell’informatica e della programmazione. Io invece penso che l’insegnamento dell’informatica sia più facile dell’insegnamento della mia prediletta filosofia e che anche l’apprendimento dei principi dell’informatica da parte degli allievi sia più facile dell’apprendimento dei concetti fondanti della filosofia. Inoltre, l’insegnamento dell’informatica può divenire più divertente inventando qualche gioco didattico che coinvolga gli allievi in ogni momento della lezione. Vi presento l’esempio di una lezione di un mio corso di programmazione nel linguaggio Python che tenni in una terza elementare (allego la foto). Si, cari amici. Vi parlo non di un programma applicativo ma della programmazione in Python, non dell’ultimo anno del liceo scientifico ma di una terza elementare, con allievi di 8 anni. L’oggetto della lezione erano gli operatori logici OR, AND e NOT. Le bambine rappresentavano le variabili Booleane indipendenti e il bambino la variabile Booleana dipendente.In quel momento veniva illustrato il seguente esempio: “bagnetto dell’elefantino” = “acqua fresca” OR “elefantino sporco”. Conservo fra i ricordi più simpatici le letterine che gli allievi di quella classe mi mandarono, forse su suggerimento della loro insegnante, per dirmi che si erano divertiti. Quelle letterine contenevano meravigliosi disegni, proposte di nuovi esempi e simpatici messaggi scritti in codice binario. Arrivo alle conclusioni, chiara manifestazione del mio fanatismo. Io penso che anche un maestro o un docente di materie umanistiche possano impartire lezioni di informatica. Ma ritengo che gli ordinamenti scolastici debbano prevedere anche l’insegnamento obbligatorio dell’informatica in tutte le scuole di ogni ordine e grado, compresa la scuola primaria. La finalità è quella indicata da Angelo Marcello Cardani: “ trasformare l’Italia in un Paese ad alfabeto puramente digitale”. Angelo Raffaele Meo

1 0

LLMs Will Always Hallucinate, and We Need to Live With This
by Giacomo Tesio Sept. 14, 2024

Sept. 14, 2024

As Large Language Models become more ubiquitous across domains, it becomes important to examine their inherent limitations critically. This work argues that hallucinations in language models are not just occasional errors but an inevitable feature of these systems. We demonstrate that hallucinations stem from the fundamental mathematical and logical structure of LLMs. It is, therefore, impossible to eliminate them through architectural improvements, dataset enhancements, or fact-checking mechanisms. Our analysis draws on computational theory and Godel's First Incompleteness Theorem, which references the undecidability of problems like the Halting, Emptiness, and Acceptance Problems. We demonstrate that every stage of the LLM process-from training data compilation to fact retrieval, intent classification, and text generation-will have a non-zero probability of producing hallucinations. This work introduces the concept of Structural Hallucination as an intrinsic nature of these systems. By establishing the mathematical certainty of hallucinations, we challenge the prevailing notion that they can be fully mitigated. https://arxiv.org/abs/2409.05746 Naturalmente, una volta compreso che si tratta di compressioni lossy dei testi usati per programmarli, una presenza di artefatti grosso modo inversamente proporzionale al livello di compressione è ovvia. Ma magari un articolo scritto nella lingua parlata dai believer della AI è utile a far scoppiare un po' di bolle (pustole? :-D) Giacomo

1 0

Re: [nexa] "pogrammazione statistica" o "intelligenza artificiale"? [era: AI Training is Copyright Infringement]
by Giuseppe Attardi Sept. 14, 2024

Sept. 14, 2024

> Date: Wed, 11 Sep 2024 21:53:58 +0000 > From: Giacomo Tesio <giacomo(a)tesio.it> > > Ciao Giuseppe, > > Il 11 Settembre 2024 16:38:55 UTC, Giuseppe Attardi <attardi(a)di.unipi.it> ha scritto: >> Mi spiace dover dissentire da Enrico. > > Dissenti anche da me o solo da Enrico? > > Ti ho proposto una semplice dimostrazione dell'equivalenza fra dato e programma: > > ``` > Ogni dato è software eseguibile da almeno una macchina programmabile. > > Puoi infatti facilmente costruire una macchina programmabile che avanza il proprio > program counter se riceve in input il byte corrente del proprio programma e si ferma altrimenti. > ``` > (qui <https://server-nexa.polito.it/pipermail/nexa/2024-September/053214.html>) > > Non ti convince? > > > Te ne propongo un'altra: ho qui una macchina programmabile che ad ogni ciclo legge > un nuovo bit dal programma caricato e chiude un circuito se il bit vale 1, mentre lo > apre se vale 0. > > > Ho provato a caricargli un binario ARM e l'ha eseguito senza problemi. > Ho provato con un COFF e un ELF e li ha eseguiti senza problemi. > Allora ho provato con una foto, e ha continuato ad accendere e spegnere una lampadina > esattamente secondo l'ordine dei bit forniti. > Infine ho provato a caricare la tua mail, e la macchina (me ne scuso) > ne ha eseguito ogni bit, dal primo all'ultimo. > > Perché la mia macchina irriverente continua ad eseguire qualsiasi dato che io gli carico > senza distinguere fra istruzioni e non? > Il tuo programma esegue istruzioni che leggono dei dati qualunque, non eseguono quei dati. Il fatto che quei dati siano una *rappresentazione* in un certo formato di istruzioni non li fa eseguire dalla tua macchina, perché non passano dal suo interprete (CPU), ma dalla sua ALU. L’architettura Von Neumann e la MTU prevedono che i programmi vengano rappresentati nella stessa forma, per comodità nel primo caso (in alternativa alla Harvard architecture) e per generalità la seconda (una singola macchina anziché infinite), ma c’è un passo ineludibile passaggio di trasformazione prr ottenere larappresentazione come dato di un programma, tipicamente un compilatore. > >> In altri termini, qualunque istruzione può essere rappresentata come dato, ma non >> ogni dato può essere interpretato come istruzione... > > Perché questo predicato diventi vero è necessario aggiungere "da una qualsiasi macchina programmabile" No, qualunque sia la macchina, esiste un dato (anzi infiniti) che non sono interpretabili da quella macchina, o, se vuoi, che danno errore se eseguiti. L’insieme delle rappresentazioni dei programmi è un sottoinsieme stretto di quello dei dati. > > La verità di tale predicato però non esclude in alcun modo che possano esistere infinite > macchine programmabili in grado di eseguire un qualsiasi dato. > > >> Ossia la semantica di un’istruzione è strettamente legata al suo interprete, quella di un dato no. > > Anche qui, perché il predicato diventi vero dobbiamo sostiire "dato" con "quasiasi dato": > molte macchine infatti possolo eseguire solo certe sequenze di bit e non altre. > > Un x86 non eseguirà correttamente un eseguibile ARM o JVM. > > D'altto canto ogni Vector Reducing Machine è in grado di eseguire solo le matrici numeriche > la cui dimensionalità è compatibile > > Sono macchine programmabili diverse, ma pur sempre macchine il cui comportamento > dipende esclusivamente dal programma fornito. > > > Mi puoi spiegare dove sbaglio? L’errore sta nel verbo “eseguire”: si eseguono istruzioni, sui dati si opera. Le Vector Reducing Machine effettuano operazioni matriciali su vettori e matrici, le matrici non eseguono alcunché. C’è una circuiteria apposta nelle GPU per operare su matrici, seguendo le *istruzioni* fornite tramite la libreria CUDA; se le matrici eseguissero, potresti fare a meno delle GPU e di CUDA. > > > Giacomo

4 6