- nexa - server-nexa.polito.it

Paper: “Bugs in our Pockets: The Risks of Client-Side Scanning”
by J.C. DE MARTIN Oct. 15, 2021

Oct. 15, 2021

https://regmedia.co.uk/2021/10/14/key_risks_paper.pdf Bugs in our Pockets: The Risks of Client-Side Scanning Embargoed until 0200 CET Oct 15 Ross Anderson Steven M. Bellovin Matt Blaze Jon Callas Peter G. Neumann Jeffrey I. Schiller Bruce Schneier Carmela Troncoso October 14, 2021 Executive Summary Whitfield Diffie Ronald L. Rivest Vanessa Teague Susan Landau Our increasing reliance on digital technology for personal, economic, and government affairs has made it essential to secure the communications and devices of private citizens, businesses, and governments. This has led to pervasive use of cryptography across society. Despite its evident advantages, law enforcement and national security agencies have argued that the spread of cryptography has hindered access to evidence and intelligence. Some in industry and government now advocate a new technology to access targeted data: client-side scanning (CSS). Instead of weakening encryption or providing law enforcement with backdoor keys to decrypt communications, CSS would enable on-device analysis of data in the clear. If targeted information were detected, its existence and, potentially, its source, would be revealed to the agencies; otherwise, little or no information would leave the client device. Its proponents claim that CSS is a solution to the encryption versus public safety debate: it offers privacy—in the sense of unimpeded end-to-end encryption—and the ability to successfully investigate serious crime. In this report, we argue that CSS neither guarantees efficacious crime prevention nor prevents surveillance. Indeed, the effect is the opposite. CSS by its nature creates serious security and privacy risks for all society while the assistance it can provide for law enforcement is at best problematic. There are multiple ways in which client-side scanning can fail, can be evaded, and can be abused. Its proponents want CSS to be installed on all devices, rather than installed covertly on the devices of suspects, or by court order on those of ex-offenders. But 1 universal deployment threatens the security of law-abiding citizens as well as law- breakers. Technically, CSS allows end-to-end encryption, but this is moot if the message has already been scanned for targeted content. In reality, CSS is bulk in- tercept, albeit automated and distributed. As CSS gives government agencies access to private content, it must be treated like wiretapping. In jurisdictions where bulk intercept is prohibited, bulk CSS must be prohibited as well. Although CSS is represented as protecting the security of communications, the technology can be repurposed as a general mass-surveillance tool. The fact that CSS is at least partly done on the client device is not, as its proponents claim, a security feature. Rather, it is a source of weakness. As most user devices have vulnerabilities, the surveillance and control capabilities provided by CSS can potentially be abused by many adversaries, from hostile state actors through criminals to users’ intimate partners. Moreover, the opacity of mobile operating systems makes it difficult to verify that CSS policies target only material whose illegality is uncontested. The introduction of CSS would be much more privacy invasive than previous proposals to weaken encryption. Rather than reading the content of encrypted com- munications, CSS gives law enforcement the ability to remotely search not just com- munications, but information stored on user devices. Introducing this powerful scanning technology on all user devices without fully understanding its vulnerabilities and thinking through the technical and policy con- sequences would be an extremely dangerous societal experiment. Given recent expe- rience in multiple countries of hostile-state interference in elections and referenda, it should be a national-security priority to resist attempts to spy on and influence law- abiding citizens. CSS makes law-abiding citizens more vulnerable with their personal devices searchable on an industrial scale. Plainly put, it is a dangerous technology. Even if deployed initially to scan for child sex-abuse material, content that is clearly illegal, there would be enormous pressure to expand its scope. We would then be hard-pressed to find any way to resist its expansion or to control abuse of the system. The ability of citizens to freely use digital devices, to create and store content, and to communicate with others depends strongly on our ability to feel safe in doing so. The introduction of scanning on our personal devices—devices that keep information from to-do notes to texts and photos from loved ones—tears at the heart of privacy of individual citizens. Such bulk surveillance can result in a significant chilling effect on freedom of speech and, indeed, on democracy itsel (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

he lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting its operation
by Alberto Cammozzo Oct. 14, 2021

Oct. 14, 2021

<https://curia.europa.eu/juris/document/document.jsf?docid=247056&text=&dir=…> The request has been made in proceedings between Top System SA and the Belgian State concerning the decompilation by SELOR, the Selection Office of the Federal Authorities (Belgium), of a computer program developed by Top System and forming part of an application in respect of which that selection office holds a user licence. [...] By its first question, the referring court asks, in essence, whether Article 5(1) of Directive 91/250 must be interpreted as meaning that the lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting the operation of that program, including where the correction consists in disabling a function that is affecting the proper operation of the application of which the program forms a part. [...] In the light of the foregoing considerations, the answer to the first question referred is that Article 5(1) of Directive 91/250 must be interpreted as meaning that the lawful purchaser of a computer program is entitled to decompile all or part of that program in order to correct errors affecting its operation, including where the correction consists in disabling a function that is affecting the proper operation of the application of which that program forms a part. [...]

1 0

Google creates tools to track carbon footprint, emissions data
by Giuseppe Attardi Oct. 13, 2021

Oct. 13, 2021

Non so quanto questo risponda alla richiesta di Giovanna Sissa di rendere visibili i consumi di carbonio dei servizi cloud: https://www.zdnet.com/article/google-creates-tools-to-track-carbon-footprin…

4 4

Hundreds of professional footballers threaten legal action over use of data
by don Luca Peyron Oct. 12, 2021

Oct. 12, 2021

The players argue leading companies are profiting from their personal data. Under Article 4 of the GDPR, “personal data” refers to a range of identifiable information, such as physical attributes or physiological information. Buona lettura dl https://www.theguardian.com/football/2021/oct/12/hundreds-of-professional-f… _________________________ don Luca Peyron Direttore Ufficio per la Pastorale Universitaria Arcidiocesi di Torino www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

"We are Google and Amazon workers. We condemn Project Nimbus | Anonymous Google and Amazon workers" (The Guardian)
by Damiano Verzulli Oct. 12, 2021

Oct. 12, 2021

Credo sia di interesse: "We are Google and Amazon workers. We condemn Project Nimbus | Anonymous Google and Amazon workers" https://www.theguardian.com/commentisfree/2021/oct/12/google-amazon-workers… Bye, DV -- Damiano Verzulli e-mail: damiano(a)verzulli.it --- possible?ok:while(!possible){open_mindedness++} --- "...I realized that free software would not generate the kind of income that was needed. Maybe in USA or Europe, you may be able to get a well paying job as a free software developer, but not here [in Africa]..." -- Guido Sohne - 1973-2008 http://ole.kenic.or.ke/pipermail/skunkworks/2008-April/005989.html

1 0

Re: [nexa] Digital Utopias (era Valletti: “Big Tech: l’ora della responsabilità”)
by Giuseppe Attardi Oct. 12, 2021

Oct. 12, 2021

> On 12 Oct 2021, at 15:52, Giacomo Tesio <giacomo(a)tesio.it> wrote: > > Ciao Giuseppe, > > >> On October 12, 2021 9:06:05 AM UTC, Giuseppe Attardi wrote: >> Il filosofo Mosterín riflette sul superamento degli stati-nazione >> attraverso Internet. In una digital utopia si eviterebbe la netta >> contrapposizione tra maggioranza e minoranza che impongono scelte non >> accettate da tutti, in quanto ciascuno aderisce a quella comunità di >> cui accetta gli ideali. > > Dunque sarebbero mutualmente esclusive? No, si può appartenere a più comunità, è il bello del virtuale. > > Su Internet, sin dall'invenzione della mailing list, l'appartenenza ad > una comunità non esclude "ex lege" l'appartenenza a nessun'altra. > > Non solo, ma non esisteva alcuna autorità preposta o anche solo in > grado di identificare con certezza l'elenco completo di comunità cui un > individuo apparteneva. > > Questa qualità di Internet viene spesso confusa con l'anonimato e lo > pseudonimato online (che certamente facilitano questa separazione degli > aspetti sensibili della propria vita cibernetica) ma in realtà era un > effetto indipendente da essi e semplicemente dovuta alla natura > decentralizzata (e quindi partizionata amministrativamente) della rete. > > > Con la centralizzazione a livello infrastrutturale (cloud, oauth, > openid connect etc...) e culturale (facebook, twitter e silos vari) > questa caratteristica è diventata sempre meno scontata. > > Oggi è tecnicamente possibile tracciare capillarmente e continuamente > la vita cibernetica della maggioranza delle persone e dunque > individuare le varie comunità cui appartengono ANCHE se usano > pseudonimi. > > Tant'è che Google lo fa da anni e ci fa pure soldi. > > Però la centralizzazione è precondizione per il tracciamento e la > sorveglianza: ssenza sarebbe impossibile impedire ad una persona di > partecipare a più "utopie digitali", fossero anche in diretta > contraddizione valoriale. > > O magari mi sto perdendo qualcosa di ovvio? > > >> Modern liberal democracy is a compromise between the twin ideals of >> freedom and democracy. Mosterín emphasizes their differences: freedom >> comes down to doing what I want to do; democracy, to doing what (the >> majority of) the others want me to do. > > Pessimo argomento fantoccio. > > Almeno in teoria [1], in una democrazia la maggioranza non decide cosa > un individuo debba fare, ma cosa NON debba fare (ed al limite COME debba > fare alcune cose). Ci sono tanti atti a cui i cittadini sono obbligati: pagare tasse, iscrivere figli a scuola, assicurare le automobili e indossare cinture di sicurezza, contribuire al SSN, ecc. Pone obblighi non solo ai cittadini, ma alle istituzioni stesse, pubbliche e private. > La differenza talvolta può essere molto sottile, ma pure esiste. > > Prendiamo un esempio particolarmente problematico: > > - l'obbligo di vaccinarti con vaccini che richiedono una TUA assunzione > di responsabilità in caso di eventi avversi > - il divieto di uscire di casa senza una certificazione che attesti > sostanzialmente la tua ridotta probabilità di essere contagioso > > SONO comunque diversi. > > La fiera del tartufo ad Alba, dopo l'esperienza dell'anno scorso che > portò alla chiusura di tutte le scuole del Piemonte, mostra tutta > l'ipocrisia di questi divieti, che non hanno finalità di salute > pubblica ma di massimizzazione dei profitti privati. > > Tuttavia sono rarissime le situazioni in cui un governo democratico > impone ai propri cittadini qualcosa. > > La differenza fra cittadino e suddito sta proprio in questa > impossibilità: lo Stato (la maggioranza) delimita lo spazio della nostra > libertà con divieti (non uccidere, non rubare etc...) ma non ci dice > cosa fare giorno per giorno. > > Cosa che peraltro oggi sarebbe tecnicamente possibile. > >> Rejecting as muddled the metaphysical notion of free will, he focuses >> on political freedom, the absence of coercion or interference by >> others in my personal decisions. > > Definizione molto liberista. > > Se fosse vera, il bambino che muore di povertà è perfettamente libero. > Ma allora sceglie di morire? > > E se è adulto? > > >> He proposes a world without nation-states, territorially organized in >> small autonomous but not-sovereign cantonal polities, complemented by >> strong world organizations. > > Proposta interessante. > > Personalmente ritengo che la tendenza ad aumentare la complessità > organizzativa che l'uomo ha manifestato negli ultimi diecimila anni > renda lo scenario di un singolo stato planetario probabile nel lungo > periodo (a meno che non avvenga un collasso della civiltà umana, con > la morte della maggioranza della popolazione del pianeta). > > Tuttavia non immagino cosa impedirebbe a queste organizzazioni mondiali > di schiacciare le piccole autonomie locali e governarle direttamente. Assumi che tutte le grandi organizzazioni siano malefiche. Io spero che ce ne siano alcune benefiche. Sta solo ai cittadini fare crescere quelle in cui si riconoscono, facendole diventare in grado di contrastare le altre. E dal confronto sugli esiti che producono, i cittadini potranno scegliere oculatamente. Oggi vige ovunque un modello neoliberista e gli economisti sostengono che non ce ne sia un altro (There is no alternative. Margareth Thatcher). Se si potesse sperimentare in un mondo virtuale un altro modello, si potrebbe dimostrare che le alternative esistono. Pensa solo alla questione climatica. Oggi abbiamo mivimenti transnazionali che si battono per il clima, ma il cui obiettivo si limita a chiedere ai politici di intervenire. Ma la politica fa fatica a intervenire, in quanto soggetta a mediazioni e a molti livelli di decisione. Immagina invece un’utopia incentrata sulla sostenibilità ambientale. I suoi aderenti adotterebbero comportamenti virtuosi e chiunque volesse interagire con loro, ad esempio vendendo prodotti, dovrebbe rispettare i dettami sui sistemi produttivi. Se l’utopia consiste di milioni di persone, costituirebbe un mercato interessante e le aziende si adeguerebbero ai loro principi. > D'altronde, Mosterín propone di sostituire stati-nazione (e dunque > storie e culture geograficamente determinate), religioni e partiti con > queste piccole autonomie locali che però sono comunque determinate > geograficamente (perché comunque SIAMO sempre anche il nostro corpo: le > allucinazione transumaniste lasciamole ai lobbisti in acido). > > Tu invece proponi qualcosa che non è geograficamente (e dunque > fisicamente) determinato e quindi ancora più fragile politicamente. Non direi che un utopia costituita da mezzo milardo di persone sarebbe fragile. I Big Tech derivano da quello la loro potenza, non dalla territorialità. — Beppe > > Può esistere solidarietà senza solidità? > > > Giacomo > > [1] nella pratica i Governi degli stati "democratici" governano sempre > di più "a nome" della maggioranza, ma lo scollamento con la realtà > e la popolazione dei politici è talmente drammatica che è difficile > talvolta riconoscervi una democrazia (cosa della quale i populismi > approfittano per radicarsi e radicalizzarsi).

1 0

"Perché l'ultimo decreto del governo mette a rischio la protezione dei dati"
by J.C. DE MARTIN Oct. 12, 2021

Oct. 12, 2021

*Perché l'ultimo decreto del governo mette a rischio la protezione dei dati** * /Il dl Capienze ha toccato anche aspetti di tutela dei dati personali, andando a modificare il Codice privacy e ridimensionando alcuni poteri del Garante// / Vincenzo Tiani https://www.wired.it/internet/regole/2021/10/08/privacy-decreto-capienze-go…

4 4

Digital Utopias (era Valletti: “Big Tech: l’ora della responsabilità”)
by Giuseppe Attardi Oct. 12, 2021

Oct. 12, 2021

> On 12 Oct 2021, at 10:13, nexa-request(a)server-nexa.polito.it wrote: > >> Mi piacerebbe moltissimo conoscere come affronteresti questi problemi. > Piacerebbe anche a me, specie se si riuscisse a coinvolgere altri pensatori. > Finora tutte le critiche allo status quo, che provoca crescenti disuguaglianze e consumo di risorse, anche di economisti come Piketty o Romer, restano nel quadro di un modello basato su nazioni westfaliane e sul capitalismo di mercato. Il filosofo Mosterín riflette sul superamento degli stati-nazione attraverso Internet. In una digital utopia si eviterebbe la netta contrapposizione tra maggioranza e minoranza che impongono scelte non accettate da tutti, in quanto ciascuno aderisce a quella comunità di cui accetta gli ideali. Modern liberal democracy is a compromise between the twin ideals of freedom and democracy. Mosterín emphasizes their differences: freedom comes down to doing what I want to do; democracy, to doing what (the majority of) the others want me to do. Rejecting as muddled the metaphysical notion of free will, he focuses on political freedom, the absence of coercion or interference by others in my personal decisions. Because of the tendencies to violence and aggression that lurk in human nature, some constraint on freedom is necessary for peaceful and fruitful social life, but the more freedom we enjoy, the better.[24] Especially, there is no rational ground for curtailing the cultural freedoms (of language, religion and customs) in the name of the nation, the church or the party. From this point of view, Internet provides a much more attractive model than the obsolete nation-state or the nationalistic movements. Mosterín thinks that the nation-state is incompatible with the full development of freedom, whose blossoming requires the reorganization of the world political system along cosmopolitan lines. He proposes a world without nation-states, territorially organized in small autonomous but not-sovereign cantonal polities, complemented by strong world organizations.[25] https://en.wikipedia.org/wiki/Jesús_Moster%C3%ADn

2 1

"Higher education responses to COVID-19 in the United States: Evidence for the impacts of university policy"
by J.C. DE MARTIN Oct. 12, 2021

Oct. 12, 2021

*Higher education responses to COVID-19 in the United States: Evidence for the impacts of university policy* Brennan Klein, Nicholas Generous, Matteo Chinazzi, Zarana Bhadricha, Rishab Gunashekar, Preeti Kori, Bodian Li, Stefan McCabe, Jon Green, David Lazer, Christopher R. Marsicano, Samuel V. Scarpino, Alessandro Vespignani doi: https://doi.org/10.1101/2021.10.07.21264419 /This article is a preprint and has not been certified by peer review [what does this mean?]. It reports new medical research that has yet to be evaluated and so should not be used to guide clinical practice.// / *Abstract* With a dataset of testing and case counts from over 1,400 institutions of higher education (IHEs) in the United States, we analyze the number of infections and deaths from SARS-CoV-2 in the counties surrounding these IHEs during the Fall 2020 semester (August to December, 2020). We used a matching procedure designed to create groups of counties that are aligned along age, race, income, population, and urban/rural categories—socio-demographic variables that have been shown to be correlated with COVID-19 outcomes. We find that counties with IHEs that remained primarily online experienced fewer cases and deaths during the Fall 2020 semester; whereas before and after the semester, these two groups had almost identical COVID-19 incidence. Additionally, we see fewer deaths in counties with IHEs that reported conducting any on-campus testing compared to those that reported none. We complement the statistical analysis with a case study of IHEs in Massachusetts—a rich data state in our dataset—which further highlights the importance of IHE-affiliated testing for the broader community. The results in this work suggest that campus testing can itself be thought of as a mitigation policy and that allocating additional resources to IHEs to support efforts to regularly test students and staff would be beneficial to mitigating the spread of COVID-19 in the general population. https://www.medrxiv.org/content/10.1101/2021.10.07.21264419v1

1 0

"How A Virtual Classroom Company Made Millions On Software That Left Many Students Feeling Abandoned"
by J.C. DE MARTIN Oct. 12, 2021

Oct. 12, 2021

*How A Virtual Classroom Company Made Millions On Software That Left Many Students Feeling Abandoned** * /Edgenuity offers to help schools pivot from “brick to click” during the pandemic, but to many parents, teachers, and students, the cost-saving program comes at the expense of a quality education./ Caroline O'Donovan BuzzFeed News Reporter Posted on October 11, 2021 [...] continua qui: https://www.buzzfeednews.com/article/carolineodonovan/edgenuity-education-t…

1 0