- nexa - server-nexa.polito.it

è mancato Stefano Trumpy
by J.C. DE MARTIN Oct. 10, 2025

Oct. 10, 2025

Mi dispiace molto leggere che è mancato Stefano Trumpy <https://www.garr.it/it/news-e-eventi/3026-addio-a-stefano-trumpy-tra-i-padr…>. Con Stefano avevamo fatto varie cose insieme, in particolare a riguardo di quel barlume di speranza chiamato "Internet Governance Forum Italia", a cui aveva prestato tutta la sua autorevolezza Stefano Rodotà. Naturalmente Trumpy ha fatto anche tante altre cose oltre a IGF, ma sono certo che altre persone in lista potranno raccontare meglio di me. Juan Carlos

3 2

Quando il F/OSS soccombe, stretto dalla morsa delle lobby....
by Damiano Verzulli Oct. 9, 2025

Oct. 9, 2025

=> "Nextcloud decided to withdraw complaint against Microsoft" "We have decided to withdraw the complaint against Microsoft with the European Commission’s Directorate-General for Competition. We filed the complaint together with about 30 other organizations in 2021 against the bundling of OneDrive with Windows. Since filing the complaint there has not been any noticable progress. Given the lack of interest from the European Commission, lengthy process and costs on our side, Nextcloud decided to withdraw the complaint." Continua su: https://nextcloud.com/blog/nextcloud-decided-to-withdraw-complaint-against-… Cosi'... di getto... mi pare la naturale conseguenza di quanto accennava, ormai diversi anni fa (2021), il "nostro" Prof. Tommaso Valletti, che nella splendida chiacchierata [1] organizzata da "Biennale Democrazia" al Teatro Carignano di Torino, racconto' abbastanza chiaramente quello scenario che, poi, oggi, ha portato Nextcloud a dire: "Ok. Basta cosi'. Grazie, e scusate il disturbo" Non male... per l'Europa. Bye, DV [1] per chi non l'avesse vista, la consiglio fortissimamente: https://www.youtube.com/watch?v=1pBWyFvzsxo -- Damiano Verzulli e-mail: damiano(a)verzulli.it --- possible?ok:while(!possible){open_mindedness++} --- "...I realized that free software would not generate the kind of income that was needed. Maybe in USA or Europe, you may be able to get a well paying job as a free software developer, but not here [in Africa]..." -- Guido Sohne - 1973-2008 http://ole.kenic.or.ke/pipermail/skunkworks/2008-April/005989.html

2 1

[Responsible AI Talk] Navigating the Risks of Artificial Companionship, Andrew Strait, UK AI Security Institute
by Daniele Quercia Oct. 9, 2025

Oct. 9, 2025

Navigating the Risks of Artificial Companionship Andrew Strait, UK AI Security Institute Join the meeting<https://teams.microsoft.com/l/meetup-join/19%3ameeting_ZTQ2NTdkZWQtZDI5ZC00…> As artificial intelligence becomes deeply integrated into daily life, AI companion applications are rapidly proliferating, offering millions of users simulated friendship, emotional support, and even intimate relationships. This talk examines the escalating societal risks posed by these platforms, identifies key drivers for harm, and explores the kinds of harms they can cause. It ends with a discussion of potential mitigations that can be taken by developers to reduce these risks. Andrew is the Head of Societal Resilience at the UK AI Security Institute, where he runs a team that studies the societal impacts of advanced AI in the UK. He is a former Associate Director at the Ada Lovelace Institute responsible for Ada’s work addressing emerging technology and industry practice. Andrew has spent the last decade working at the intersection of technology, law and society. Prior to joining Ada, he was an Ethics & Policy Researcher DeepMind, where he managed internal AI ethics initiatives and oversaw the company’s network of external partnerships. Previously, he worked as a Legal Operations Specialist at Google where he developed and implemented platform moderation policies on areas such as data protection, hate speech, terrorist content and child safety. Subscribe to future talk announcements: Anyone outside Bell Labs can receive talk announcements by subscribing to the mailing list. To subscribe, send an empty email with the subject line "Subscribe RAI" to daniele.quercia(a)polito.it<mailto:daniele.quercia@polito.it>

1 0

Bria, "Reclaiming Europe’s Digital Sovereignty"
by J.C. DE MARTIN Oct. 9, 2025

Oct. 9, 2025

Segnalo questo ottimo articolo di Francesca Bria (che, oltre a tanti ruoli, è anche garante del Centro Nexa). juan carlos *Reclaiming Europe’s Digital Sovereignty* /Europe can accept permanent technological dependency, or it can build democratic digital systems rooted in climate commitments, labor protections and social diversity. / Francesca Bria /Editor’s Note: Noema is committed to hosting meaningful intellectual debate. This piece is in conversation with another, written by Benjamin Bratton, the Berggruen Institute’s Antikythera program director. Read it here: “Is European AI A Lost Cause? Not Necessarily. <https://www.noemamag.com/is-european-ai-a-lost-cause-not-necessarily/>“ /*The Cartography Of Digital Power * Geopolitical power once flowed through armies and treaties, but today it courses through silicon wafers, server farms and algorithmic systems. These invisible digital infrastructures and architectures shape every aspect of modern life. “The Stack” — interlocking layers of hardware, software, networks and data — has become the operating system of modern political and economic power. The global race to control the Stack defines the emerging world order. The United States consolidates its dominance through initiatives like Stargate, which fuses AI development directly to proprietary chips and hyperscale data centers, creating insurmountable barriers to competition. China advances through systematic industrial policy and its Digital Silk Road, achieving unprecedented integration from chip design to AI deployment across Asia and beyond. These are deliberate strategies of technological imperialism. [...] continua qui: https://www.noemamag.com/reclaiming-europes-digital-sovereignty/

3 3

Re: [nexa] Quando il F/OSS soccombe, stretto dalla morsa delle lobby....
by alessandro marzocchi Oct. 8, 2025

Oct. 8, 2025

Given the lack of interest from the European Commission ... rari nantes in gurgite vasto ... Il giorno mer 8 ott 2025 alle ore 20:07 <nexa-request(a)server-nexa.polito.it> ha scritto: Date: Wed, 8 Oct 2025 20:07:54 +0200 > From: Damiano Verzulli <damiano(a)verzulli.it> > => "Nextcloud decided to withdraw complaint against Microsoft" > ... Since filing the complaint there has not been any noticable > progress. Given the lack of interest from the European Commission, lengthy process and costs on our side, Nextcloud > decided to withdraw the complaint." > > Non male... per l'Europa.

1 0

La Germania dice NO a Chatcontrol
by Roberto Resoli Oct. 8, 2025

Oct. 8, 2025

https://www.patrick-breyer.de/en/citizen-protest-halts-chat-control-breyer-… > In una svolta importante per il movimento per i diritti digitali, ieri il governo tedesco ha rifiutato di appoggiare la controversa normativa UE sul controllo delle chat dopo aver subito una forte pressione da parte dell'opinione pubblica. Il governo non ha preso posizione sulla proposta. Ciò impedisce il raggiungimento della maggioranza richiesta nel Consiglio dell'UE, facendo deragliare il piano di approvare la legge sulla sorveglianza la prossima settimana. Jens Spahn, presidente del gruppo parlamentare conservatore CDU/CSU nel Bundestag, ha dichiarato in una dichiarazione pubblica: “Noi, il gruppo parlamentare CDU/CSU nel Bundestag, siamo contrari al monitoraggio ingiustificato delle chat. Sarebbe come aprire tutte le lettere come misura precauzionale per vedere se contengono qualcosa di illegale. Questo è inaccettabile e non lo permetteremo”.

1 0

Re: [nexa] Chat control: sicurezza o sorveglianza? Anatomia critica di un regolamento europeo
by alessandro marzocchi Oct. 8, 2025

Oct. 8, 2025

380° ha scritto Date: Fri, 26 Sep 2025 14:16:56 +0200 > From: 380° <g380(a)biscuolo.net> > Subject: [nexa] Chat control: sicurezza o sorveglianza? Anatomia > critica di un regolamento europeo > Buongiorno, > segnalo questo ottimo articolo apparso ieri su Diritto.it firmato > dall'Avv. Luisa Di Giacomo ... ... ... > Le discussioni su Chat Control non riguardano soltanto algoritmi, > crittografia, interoperabilità o compliance normativa ... ... ... quanto > siamo disposti a > sacrificare, in termini di libertà e diritti, nel nome della > sicurezza? Il regolamento CSAR – è una proposta non ancora approvata – vuole prevenire abusi sessuali, evitare che accadano, questa è l’ottica di valutazione. Gli statunitensi si appellano alla libertà assicurata dalla loro costituzione Usa e comprano armi senza controlli preventivi, per noi europei sarebbe impensabile. ********* > Il vero pericolo è la *normalizzazione del controllo*: > l'abitudine a essere osservati, scansionati, valutati. È il lento > scivolamento verso un paradigma in cui la privacy non è più il > default, ma un privilegio da conquistarsi; in cui la trasparenza è > richiesta solo al cittadino, mentre le decisioni automatizzate restano > opache e inaccessibili. In questa ottica più ampia, osservo che il digitale cambia molto dell’esperienza precedente, alla sorveglianza di massa opporrei la trasparenza di massa, GAFAM deve rendermi disponibili e trasparenti tutti i suoi dati fino al codice sorgente senza alcuna protezione nè riserva. La trasparenza totale dovrebbe essere la richiesta di noi umani al digitale, inclusa l'alfabetizzazione digitale. Nell'attesa ... GAFAM continua a padroneggiare e schiavizzarci. Buona domenica. Duccio (Alessandro Marzocchi)

7 8

MEMENTO | 187° Mercoledì di Nexa | 8 ottobre 2025, ore 17.00
by Nexa - Media Oct. 6, 2025

Oct. 6, 2025

Gentilissime, gentilissimi, Vi ricordiamo che mercoledì 8 ottobre, alle ore 17.00, si terrà il 187° Mercoledì di Nexa con un incontro dal titolo "L’Era dei Tecno-stati: USA e Cina nella battaglia per la supremazia tecnologica". Ospite dell'incontro: Paolo Gerbaudo (Università Complutense di Madrid). L'incontro si terrà IN PRESENZA e ONLINE. SEDE FISICA dell'incontro: Centro Nexa su Internet e Società, Politecnico di Torino, Via Boggio 65/a, Torino (1° piano). Per accedere alla sala si raccomanda di suonare al citofono Portineria e di seguire le indicazioni segnalate lungo il percorso. QUI<https://nexa.polito.it/contatti> maggiori informazioni su come raggiungerci. STANZA VIRTUALE dell'incontro: https://didattica.polito.it/VClass/NexaEvent Maggiori informazioni alla pagina: https://nexa.polito.it/mercoledi-187 Un saluto cordiale, -- Valeria Bergantino Communication Manager Nexa Center for Internet & Society Politecnico di Torino - DAUIN Via Pier Carlo Boggio, 65/A - 10138 Torino web: https://nexa.polito.it/ mail: valeria.bergantino(a)polito.it<mailto:valeria.bergantino@polito.it> tel: 3473443585

1 0

F-Droid and Google's Developer Registration Decree
by Giacomo Tesio Oct. 4, 2025

Oct. 4, 2025

For the past 15 years, F-Droid has provided a safe and secure haven for Android users around the world to find and install free and open source apps. When contrasted with the commercial app stores — of which the Google Play store is the most prominent — the differences are stark: they are hotbeds of spyware and scams, blatantly promoting apps that prey on their users through attempts to monetize their attention and mine their intimate information through any means necessary, including trickery and dark patterns. F-Droid is different. It distributes apps that have been validated to work for the user’s interests, rather than for the interests of the app’s distributors. The way F-Droid works is simple: when a developer creates an app and hosts the source code publicly somewhere, the F-Droid team reviews it, inspecting it to ensure that it is completely open source and contains no undocumented anti-features such as advertisements or trackers. Once it passes inspection, the F-Droid build service compiles and packages the app to make it ready for distribution. The package is then signed either with F-Droid’s cryptographic key, or, if the build is reproducible, enables distribution using the original developer’s private key. In this way, users can trust that any app distributed through F-Droid is the one that was built from the specified source code and has not been tampered with. Do you want a weather app that doesn’t transmit your every movement to a shadowy data broker? Or a scheduling assistant that doesn’t siphon your intimate details into an advertisement network? F-Droid has your back. Just as sunlight is the best disinfectant against corruption, open source is the best defense against software acting against the interests of the user. # Google’s move to break free app distribution The future of this elegant and proven system was put in jeopardy last month, when Google unilaterally decreed that Android developers everywhere in the world are going to be required to register centrally with Google. In addition to demanding payment of a registration fee and agreement to their (non-negotiable and ever-changing) terms and conditions, Google will also require the uploading of personally identifying documents, including government ID, by the authors of the software, as well as enumerating all the unique “application identifiers” for every app that is to be distributed by the registered developer. The F-Droid project cannot require that developers register their apps through Google, but at the same time, we cannot “take over” the application identifiers for the open-source apps we distribute, as that would effectively seize exclusive distribution rights to those applications. If it were to be put into effect, the developer registration decree will end the F-Droid project and other free/open-source app distribution sources as we know them today, and the world will be deprived of the safety and security of the catalog of thousands of apps that can be trusted and verified by any and all. F-Droid’s myriad users will be left adrift, with no means to install — or even update their existing installed — applications. (How many F-Droid users are there, exactly? We don’t know, because we don’t track users or have any registration: “No user accounts, by design”) # The Security Canard While directly installing — or “sideloading” — software can be construed as carrying some inherent risk, it is false to claim that centralized app stores are the only safe option for software distribution. Google Play itself has repeatedly hosted malware, proving that corporate gatekeeping doesn’t guarantee user protection. By contrast, F-Droid offers a trustworthy and transparent alternative approach to security: every app is free and open source, the code can be audited by anyone, the build process and logs are public, and reproducible builds ensure that what is published matches the source code exactly. This transparency and accountability provides a stronger basis for trust than closed platforms, while still giving users freedom to choose. Restricting direct app installation not only undermines that choice, it also erodes the diversity and resilience of the open-source ecosystem by consolidating control in the hands of a few corporate players. Furthermore, Google’s framing that they need to mandate developer registration in order to defend against malware is disingenuous because they already have a remediation mechanism for malware they identify on a device: the Play Protect service that is enabled on all Android Certified devices already scans and disables apps that have been identified as malware, regardless of their provenience. Any perceived risks associated with direct app installation can be mitigated through user education, open-source transparency, and existing security measures without imposing exclusionary registration requirements. We do not believe that developer registration is motivated by security. We believe it is about consolidating power and tightening control over a formerly open ecosystem. Continua su <https://f-droid.org/en/2025/09/29/google-developer-registration-decree.html> Se Google ci riesce, il DMA è carta straccia. Giacomo

1 0

One Token to rule them all (aka God Mode Vulnerability in Microsoft's cloud services).
by 380° Oct. 3, 2025

Oct. 3, 2025

Buongiorno, di recente è stato rivelato un _enorme_ baco di sicurezza nei servizi cloud (pubblici) di Microsoft. Tranquili: tutt'apposto!!! B-) Piccola premessa: Microsoft Entra ID è il sistema di autenticazione per accedere ai servizi cloud (multi-tenant); dettagli qui: https://en.wikipedia.org/wiki/Microsoft_Entra_ID «One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens» September 17, 2025 https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-ac… --8<---------------cut here---------------start------------->8--- [...] This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments [1]). If you are an Entra ID admin reading this, yes that means complete access to your tenant. The vulnerability consisted of two components: undocumented impersonation tokens, called “Actor tokens”, that Microsoft uses in their backend for service-to-service (S2S) communication. Additionally, there was a critical flaw in the (legacy) Azure AD Graph API that failed to properly validate the originating tenant, allowing these tokens to be used for cross-tenant access. Effectively this means that with a token I requested in my lab tenant I could authenticate as /any user/, including Global Admins, in /any other tenant/. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants. Since the Azure AD Graph API is an older API for managing the core Azure AD / Entra ID service, access to this API could have been used to make any modification in the tenant that Global Admins can do, including taking over or creating new identities and granting them any permission in the tenant. With these compromised identities the access could also be extended to Microsoft 365 and Azure. I reported this vulnerability the same day to the Microsoft Security Response Center (MSRC). Microsoft fixed this vulnerability on their side within days of the report being submitted and has rolled out further mitigations that block applications from requesting these Actor tokens for the Azure AD Graph API. Microsoft also issued [CVE-2025-55241] for this vulnerability. [CVE-2025-55241] <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241> [...] Practical abuse ──────────────── With this vulnerability it would be possible to compromise any Entra ID tenant. Starting with an Actor token from an attacker controlled tenant, the following steps would lead to full control over the victim tenant: 1. Find the tenant ID for the victim tenant, this can be done using public APIs based on the domain name. 2. Find a valid `netId' of a regular user in the tenant. Methods for this will be discussed below. 3. Craft an impersonation token with the Actor token from the attacker tenant, using the tenant ID and `netId' of the user in the victim tenant. 4. List all Global Admins in the tenant and their `netId'. 5. Craft an impersonation token for the Global Admin account. 6. Perform any read or write action over the Azure AD Graph API. [...] Compromising tenants by hopping over B2B trusts ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌ I previously mentioned that a users `netId' is used to establish links between a user account in multiple tenants. This is something that I researched a few years ago when I gave a talk at [Black Hat USA 22] about external identities. [...] To abuse this, a threat actor could perform the following steps, given that they have access to at least one tenant with a guest user: 1. Query the guest users and their `alternativeSecurityIds' attribute which gives the `netId'. 2. Query the tenant ID of the guest users home tenant based on the domain name in their UPN. 3. Create an impersonation token, impersonating the victim in their home tenant. 4. Optionally list Global Admins and impersonate those to compromise the entire tenant. 5. Repeat step 1 for each tenant that was compromised. The steps above can be done in 2 API calls per tenant, which do not generate any logs. Most tenants will have guest users from multiple distinct other tenants. [...] Looking at the list of guest users in the tenants of some of my clients, this technique would be extremely powerful. I also observed that one of the first tenants you will likely compromise is Microsoft's own tenant, since Microsoft consultants often get invited to customer tenants. Many MSPs and Microsoft Partners will have a guest account in the Microsoft tenant, so from the Microsoft tenant a compromise of most major service provider tenants is one step away. [...] Conclusion ─────────── This blog discussed a critical token validation failure in the Azure AD Graph API. While the vulnerability itself was a bad oversight in the token handling, the whole concept of Actor tokens is a protocol that was designed to behave with all the properties mentioned in the paragraphs above. If it weren't for the complete lack of security measures in these tokens, I don't think such a big impact with such limited telemetry would have been possible. Thanks to the people at MSRC who immediately picked up the vulnerability report, searched for potential variants in other resources, and to the engineers who followed up with fixes for the Azure AD Graph and blocked Actor tokens for the Azure AD Graph API requested with credentials stored on Service Principals, essentially restricting the usage of these Actor tokens to only Microsoft internal services. Disclosure timeline ╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌ • July 14, 2025 - reported issue to MSRC. • July 14, 2025 - MSRC case opened. • July 15, 2025 - reported further details on the impact. • July 15, 2025 - MSRC requested to halt further testing of this vulnerability. • July 17, 2025 - Microsoft pushed a fix for the issue globally into production. • July 23, 2025 - Issue confirmed as resolved by MSRC. • August 6, 2025 - Further mitigations pushed out preventing Actor tokens being issued for the Azure AD Graph with SP credentials. • September 4, 2025 - [CVE-2025-55241] issued. • September 17, 2025 - Release of this blogpost. [CVE-2025-55241] <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55241> Footnotes ───────── [1] I do not have access to any tenants in a national cloud deployment, so I was not able to test whether the vulnerability existed there. Since national cloud deployments use their own token signing keys, it is unlikely that it would have been possible to execute this attack from a tenant in the public cloud to one of these national clouds. I do consider it likely that this attack would have worked across tenants in the same national cloud deployments, but that is speculation. --8<---------------cut here---------------end--------------->8--- Saluti, 380° -- 380° (lost in /traslation/) «Welcome to the chaos of the times If you go left and I go right Pray we make it out alive This is Karmageddon»

1 0