- nexa - server-nexa.polito.it

https://attivissimo.blogspot.com/2021/10/perche-questi-codici-qr-sembrano-green.html?m=1
by Alberto Cammozzo Oct. 31, 2021

Oct. 31, 2021

<https://attivissimo.blogspot.com/2021/10/perche-questi-codici-qr-sembrano-g…> Sto ricevendo numerose segnalazioni di codici QR come quello qui accanto, che le applicazioni di verifica dei “green pass” considerano validi ma che sono intestati ad Adolf Hitler. Provate a scansionarli con VerificaC19 o con l’app svizzera equivalente, CovidCheck: restituiscono HITLER come cognome, ADOLF come nome e 01.01.1900 come data di nascita. Cosa più importante, queste app di verifica li accettano come validi. A prima vista sembrerebbe essere una gravissima violazione dell’affidabilità del sistema dei green pass o certificati Covid digitali, che minerebbe alla base la fiducia nel sistema di verifica. In teoria, infatti, soltanto gli enti sanitari autorizzati hanno le chiavi crittografiche private che consentono di generare green pass validi e rendono impossibile alterare un green pass esistente immettendovi per esempio un nome differente. Ma affermazioni straordinarie richiedono prove straordinarie, che per ora scarseggiano. Questo è un altro codice QR (segnalato da @reversebrain) che fornisce lo stesso risultato, anche qui con il nome e cognome interamente in maiuscolo: Questo, invece, risulta valido e intestato a Adolf Hitler (in minuscolo tranne le iniziali), con data di nascita 01.01.1930: Secondo le prime analisi (grazie @fuomag9 e alla sua app Green Pass Decoder), l’ente emittente indicato nei primi due codici QR sarebbe la CNAM francese (Caisse Nationale d’Assurance Maladie), ma questo dato non farebbe parte di quelli protetti dalla crittografia, per cui potrebbe essere stato alterato. Il primo codice viene interpretato da Green Pass Decoder così (secondo queste info, dob è la data di nascita, fn è il nome, gn è il cognome, co è il paese di vaccinazione, dn è il numero di dosi ricevute, dt è la data di vaccinazione, is è l’ente che ha emesso il green pass, ma è il produttore del vaccino, mp è l’identificativo di prodotto del vaccino, sd è il numero totale di dosi, tg è la malattia coperta dal vaccino, vp indica vaccino o profilassi, ver è la versione dello schema, 4 indica la scadenza del codice e 6 indica la data di generazione del codice): { 1:"CNAM", 4:1697234400, 6:1635199742, -260:{ 1:{ "v":[ { "ci":"URN:UVCI:01:FR:T5DWTJYS4ZR8#4", "co":"FR", "dn":2, "dt":"2021-10-01", "is":"CNAM", "ma":"ORG-100030215", "mp":"EU/1/20/1528", "sd":2, "tg":"840539006", "vp":"J07BX03" } ], "dob":"1900-01-01", "nam":{ "fn":"HITLER", "gn":"ADOLF", "fnt":"HITLER", "gnt":"ADOLF" }, "ver":"1.3.0" } } } Il secondo codice viene letto come segue: { 1:"CNAM", 4:1697234400, 6:1635199742, -260:{ 1:{ "v":[ { "ci":"URN:UVCI:01:FR:T5DWTJYS4ZR8#4", "co":"FR", "dn":2, "dt":"2021-10-01", "is":"CNAM", "ma":"ORG-100030215", "mp":"EU/1/20/1528", "sd":2, "tg":"840539006", "vp":"J07BX03" } ], "dob":"1900-01-01", "nam":{ "fn":"HITLER", "gn":"ADOLF", "fnt":"HITLER", "gnt":"ADOLF" }, "ver":"1.3.0" } } } Su Raidforums c’è una discussione molto lunga e tecnica che sembrerebbe aver trovato le chiavi private. Se così fosse, chiunque potrebbe generarsi un green pass e l’intero sistema sarebbe da buttare e rifare da capo (o almeno sarebbe necessario revocare tutte le chiavi private attuali e cambiarle) e in ogni caso il green pass avrebbe perso ogni credibilità presso l’opinione pubblica. Stefano Zanero, docente di computer security e informatica forense al Politecnico di Milano, ha commentato pubblicamente in questo modo: “che si sia trattato di un leak o quantomeno di un abuso di chiavi di firma non è che sia discutibile, è abbastanza evidente.” 2021/10/27 1:25. VerificaC19 non riconosce più come validi i codici QR mostrati qui sopra, o perlomeno questo è quello che dice l’app sul mio telefono Android, mentre altre persone mi dicono che la loro app continua a ritenerli validi: L’app svizzera CovidCheck, invece, li riconosce ancora validi. --- Se scoprite qualcosa di più, segnalatemelo nei commenti; aggiornerò questo articolo man mano che avrò informazioni più dettagliate e sicure.

9 47

Il fascino del Falso
by Antonio Iacono Oct. 31, 2021

Oct. 31, 2021

Nel 1994 quando la polizia francese entrò nella tenuta di campagna di Geert Jan Jansen vi trovò oltre 1600 opere di artisti del calibro di Picasso, Dalì, Appel, Matisse, Miro, Hockney. Piccolo particolare, la maggior parte li aveva dipinti lui stesso. Diceva: "un falso inizia sempre con la firma dell’artista che si sta falsificando. Perché se realizzi un capolavoro e poi dopo sbagli la firma è un dramma" Trasferiamoci nel digitale. Qui, riprodurre un "capolavoro" è semplice e immediato, si copia bit per bit e la copia diventa indentica all'originale. Qualche decennio fa, matematici e programmatori informatici hanno trovato un modo per aggiungere una "signature" e da quel momento in poi riprodurre un "qualcosa" di informatico, firmato, è stato, parafrasando Jan Jansen, "un dramma". Ma il falso ha sempre affascianato le persone, e l'immaginazione che, come scriveva Leopardi, "è il primo fonte della felicità umana", non si fa certo fermare dal "calcolo delle probabilità" e così capita che un oscuro hacker finlandese trova il modo per riprodurre l'irriproducibile, una "firma digitale". E' riuscito/a ad accedere ad un server? Si è procurato/a la chiave privata? Si è procurato/a delle credenziali legittime? E' lui/lei stesso un operatore / una operatrice? Il nonno, in sogno, gli ha rivelato i 32 numeri della chiave? (versione aggiornata dei tre numeri al lotto) Non lo sappiamo, quello che sappiamo è che 45 minuti dopo che il primo green pass "farlocco" sia stato emesso [1] in un forum finlandese c'era già la notizia [2]. Buona domenica, Antonio [1] domenica 17 ottobre 2021 22:19:44 GMT+02:00 DST [2] https://ylilauta.org/koronavirus/129754510

1 0

Re: [nexa] nexa Digest, Vol 150, Issue 64
by maurizio lana Oct. 29, 2021

Oct. 29, 2021

Il 29/10/21 12:00, J.C. DE MARTIN ha scritto: > *Inside Gaia-X: How chaos and infighting are killing Europe’s grand cloud project* > /The initiative, meant to boost Europe’s cloud services, is failing to fix the problems is was intended to solve./ > By Clothilde Goujard and Laurens Cerulus il 9 febbraio scorso io scrivevo a questa mailing list: > a proposito di cloud e sovranità/indipendenza, uno di primi partner di > GAIA-X, il consorzio per il nascente cloud europeo, è Palantir > https://ilmanifesto.it/gli-spioni-di-palantir-entrano-nei-dati-europei-di-g… > > Palantir è un'azienda statunitense: perché prendere un partner > statunitense nel consorzio se esso deve esprimere la > sovranità/indipendenza del cloud europeo? Maurizio

2 1

Se in Rete quel che conta è solo «appagare» gli occhi
by don Luca Peyron Oct. 29, 2021

Oct. 29, 2021

Una riflessione che mi ha fatto riflettere! Buona lettura dl https://www.avvenire.it/agora/pagine/conta-solo-appagare-gli-occhi _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1

Re: [nexa] "Inside Gaia-X: How chaos and infighting are killing Europe’s grand cloud project"
by Giuseppe Attardi Oct. 29, 2021

Oct. 29, 2021

“Very quickly it became clear that these guys were dominant in the technical groups,” said Lechelle, CEO of Scaleway. Not quickly enough: I thought this would happen since the beginning. They have many more technical people, and they can afford to spend their time in extra work like this. An Italian proverb says: “La volpe a custodia del pollaio”, but in this case you even admit the fox within the chicken coop. — Beppe > On 29 Oct 2021, at 12:00, nexa-request(a)server-nexa.polito.it wrote: > > From: "J.C. DE MARTIN" <juancarlos.demartin(a)polito.it> > To: Nexa <nexa(a)server-nexa.polito.it> > Subject: [nexa] "Inside Gaia-X: How chaos and infighting are killing > Europe’s grand cloud project" > Message-ID: <fd07f750-23b6-8e46-c64e-fd33905cfe1a(a)polito.it> > Content-Type: text/plain; charset="utf-8"; Format="flowed" > > *Inside Gaia-X: How chaos and infighting are killing Europe’s grand > cloud project* > > /The initiative, meant to boost Europe’s cloud services, is failing to > fix the problems is was intended to solve./ > > By Clothilde Goujard and Laurens Cerulus > > October 26, 2021 6:00 am > > https://www.politico.eu/article/chaos-and-infighting-are-killing-europes-gr…

1 0

No end in sight for chip shortage as supply chain problems pile up | Ars Technica
by J.C. DE MARTIN Oct. 29, 2021

Oct. 29, 2021

No end in sight for chip shortage as supply chain problems pile up "We're not talking about quarters. We're talking about years.” by Tim De Chant - Oct 28, 2021 9:32pm CET https://arstechnica.com/gadgets/2021/10/no-end-in-sight-for-chip-shortage-a… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

"Inside Gaia-X: How chaos and infighting are killing Europe’s grand cloud project"
by J.C. DE MARTIN Oct. 29, 2021

Oct. 29, 2021

*Inside Gaia-X: How chaos and infighting are killing Europe’s grand cloud project* /The initiative, meant to boost Europe’s cloud services, is failing to fix the problems is was intended to solve./ By Clothilde Goujard and Laurens Cerulus October 26, 2021 6:00 am https://www.politico.eu/article/chaos-and-infighting-are-killing-europes-gr…

1 0

Privacy Pride, 13 novembre 2021
by Federico Leva (Nemo) Oct. 28, 2021

Oct. 28, 2021

Mi segnalano e inoltro: iniziativa contro le recenti norme anti-privacy, da TERREG al famigerato DL capienze. (Aggiungerei il famoso DL ascensori del 2016,* palesemente illegittimo ma tuttora apparentemente vigente, e non parliamo poi del Digital Services Act in arrivo.) https://privacybenecomune.it/ ---- Comitato: Privacy Bene Comune La tendenza globale dei governi di tutto il mondo è quella di aumentare la sorveglianza e ciò che più spesso viene colpito è il diritto alla tutela dei propri dati personali o, più brevemente, la privacy. Ma quello contro la privacy è solo uno dei segnali dell’insofferenza generalizzata dei governi nei confronti delle authority, organi indipendenti di garanzia, che costituiscono un agile strumento per arginare il potere esecutivo ma anche per arginare lo strapotere economico di quei soggetti che, sempre più spesso, sembrano essere i veri ispiratori e beneficiari delle politiche governative. Privacy Pride! Il pomeriggio del 13 novembre 2021 avrà perciò inizio il primo Privacy Pride! Resta in ascolto. ---- Si nota un certo livello di disperazione e devo dire che lo comprendo... Federico (*) https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9704851

2 1

Doctorow: Europe's Digital Services Act: on a Collision Course With Human Rights | Electronic Frontier Foundation
by J.C. DE MARTIN Oct. 28, 2021

Oct. 28, 2021

Europe's Digital Services Act: on a Collision Course With Human Rights https://www.eff.org/deeplinks/2021/10/europes-digital-services-act-collisio… By Cory Doctorow (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Big tech’s push for automation hides the grim reality of ‘microwork’ | Phil Jones | The Guardian
by Alberto Cammozzo Oct. 27, 2021

Oct. 27, 2021

<https://www.theguardian.com/commentisfree/2021/oct/27/big-techs-push-for-au…> When customers in the London borough of Hackney shop in the new Amazon Fresh store, they no longer pay a checkout operator but simply walk out with their goods. Amazon describes “just walk out shopping” as an effortless consumer experience. The rise of automated stores during the pandemic is just the tip of the iceberg. Floor-cleaning robots have been introduced in hospitals, supermarkets and schools. Fast-food restaurants are employing burger-grilling robots <https://techcrunch.com/2020/10/27/white-castle-rolls-out-more-robots-from-m…> and chatbots. And delivery bots <https://www.reuters.com/technology/pandemic-pushes-chinese-tech-giants-roll…> are being rolled out at an accelerated pace. As Anuja Sonalker, chief executive of Steer Tech, a tech company specialising in self-parking, ominously said last year <https://theintercept.com/2020/05/08/andrew-cuomo-eric-schmidt-coronavirus-t…>: “Humans are biohazards, machines are not.” With the realisation that machines are immune to viruses and social distancing, we have seen the return of an apocalyptic consensus: according to one recent prediction <https://www.bbc.co.uk/news/business-54622189>, as many as half of all work tasks are at risk of automation by 2025. Such gloomy forecasts conjure a world where robots do all the work and humans are consigned to history’s dustbin. We’ve been here before. Throughout capitalist history, times of crisis have bred anxieties about robots stealing our jobs. After the 2008 financial crash, a series of studies pointed to <https://www.oxfordmartin.ox.ac.uk/publications/the-future-of-employment/> an automation tsunami that would swallow as much as half of the world’s work in the coming decades. Although that much-prophesied dystopia has not yet arrived, a scenario less spectacular but equally grim is growing in its shadow:**the rise of microwork. In short, microwork refers to the human “jobs” that involve nudging artificial intelligence in the right direction. Workers, mainly in the global south, sit at computers clicking on images that, for instance, show autonomous vehicles how to navigate city centres, facial recognition cameras how to spot emotions, and marketing software how to spot breeds of horse. “For a penny, you might pay for a person to tell you if there is a human in a photo,” Jeff Bezos explained, at the public opening of Amazon Mechanical Turk (MTurk), the first and most infamous of such sites. Like other similar platforms, such as Clickworker, which match underemployed and jobless people with online piecework, Mechanical Turk operates on a simple premise. The platform hosts contractors, often large tech companies such as Twitter <https://blog.mturk.com/twitter-improves-search-with-real-time-human-computa…>, who outsource short data tasks such as labelling images – lasting a few seconds to a few minutes – to workers with few labour rights or secure hours. Such sites <https://www.wired.com/story/newly-unemployed-labeling-photos-pennies/> have seen a boom in users during the pandemic. At a time when many have lost their jobs and are stuck inside, work that only requires an internet connection and a laptop can offer a much-needed source of income. The platforms often present the work as the preserve of glamorous young freelancers. But hazy promises of the remote -work dream disguise a brutal reality. Many workers on these sites have few other options, or are otherwise excluded from the formal economy. They may reside in poor rural areas, prisons <https://www.theverge.com/2019/3/28/18285572/prison-labor-finland-artificial…> or refugee camps <https://www.bbc.co.uk/news/world-africa-13784487>, and find microwork through non-governmental programmes that aim to “Give Work, not Aid <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.hbs.…>”. A World Bank researcher in 2012 wrote of a situation where millions of tiny digital tasks generated “thousands of jobs <https://blogs.worldbank.org/psd/from-millions-of-tasks-to-thousands-of-jobs…>”. But microwork is often so sporadic and poorly paid it can hardly be called a “job”. In 2018, formerly middle-class Venezuelans facing an increasingly desperate economic situation sat at laptops and annotated images of urban areas to train autonomous vehicles. Workers were paid by the task and, in some cases, made less than$30 a week <https://restofworld.org/2021/self-driving-cars-outsourcing/>. In many respects, the work differs little from the survivalism of<https://www.cambridge.org/core/journals/journal-of-asian-studies/article/ab…>“wage hunters and gatherers <https://www.cambridge.org/core/journals/journal-of-asian-studies/article/ab…>”, who spend their days doing a dizzying range of odd jobs such as shoe-shining, selling tissues and picking litter. With jobs on microwork sites lasting as little as a few seconds, workers must continually hunt for work <https://www.dissentmagazine.org/article/digital-piecework>, and might be contracted by upwards of 50 “requesters” over the course of a day. Carved into tiny segments, the jobs are opaque, often surreal and sometimes humiliating. One task on Mechanical Turk allegedly asked <https://gizmodo.com/horror-stories-from-inside-amazons-mechanical-turk-1840…> workers – or “Turkers” – to post pictures of their feet for reasons unexplained. Opacity, however, is no software glitch. By design, the platforms obscure operations and preclude worker organisation, promising contractors a dream scenario: all the work without the troubles associated with an actual workforce. Impenetrable rating systems, which permit contractors to reject “bad” tasks <https://www.mturk.com/worker/help> out of hand, only allow workers to contact and “challenge” the contractors, who are under no obligation to reply. Wage theft is thus all too common – a report <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ilo.…> by the International Labour Organization found that on one major platform, about 15% of all tasks go unpaid. In a statement, which has been edited for length, Amazon Web Services said, “MTurk is a marketplace where requesters determine how much they are willing to pay a worker to complete a specific task. The amount of compensation workers receive depends on the price requesters set, the number of tasks workers complete, and the quality of their work. Most workers see MTurk as part-time work or a paid hobby, and they enjoy the flexibility to choose the tasks they want to work on and work as much or as little as they like. While the overall rate at which workers’ tasks are rejected is very low (less than 1%), they also have access to a number of metrics that can help them determine if they want to work on a task, including the requester’s historical record of accepting tasks.” The freedoms many of us have enjoyed working from home during the pandemic are the flipside of new kinds of control and surveillance. Meetings on Teams and Zoom send data straight to Microsoft and Amazon. Militant bosses have made employees keep their webcams on <https://www.theguardian.com/world/2020/sep/27/shirking-from-home-staff-feel…> to display their faces and keystrokes. Like the workers on microwork sites, our labour is increasingly captured as data to power artificial intelligence. How the data is then used remains a mystery. Maybe to directly show AI how to do our jobs; or perhaps to expose AI to data about the emotions we experience at work. One thing seems clear: increasingly the primary or secondary role of work is no longer just work, but to show robots how to do our jobs, even if this aspiration in many cases remains a far-flung fantasy. But the picture is not wholly bleak. Just as these sites act as experimental labs for new forms of exploitation and control, they also generate new strategies of resistance. In lieu of union representation, workers resort to letter-writing campaigns <https://www.theguardian.com/technology/2014/dec/03/amazon-mechanical-turk-w…> to draw attention to their work, forums <https://www.bloomberg.com/opinion/articles/2021-10-13/how-good-is-ai-much-a…> that challenge the platform, and browser plug-ins <https://emea01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.thev…> to spotlight unscrupulous contractors. Online forums become loose networks of support that offer advice and guidance to platform users. These tactics remain in their infancy. But as all our jobs are increasingly driven by the demands of “big data”, we will need similar tactics to wrestle back some control of our working lives – as well as taking notice of those who make our digital lives so seemingly “effortless”. * Phil Jones is the author of Work Without the Worker: Labour in the Age of Platform Capitalism

1 0