- nexa - server-nexa.polito.it

After 10 Years in Tech Isolation, I'm Now Outsider to Things I Once Had Mastered | forklog.media
by Alberto Cammozzo June 10, 2020

June 10, 2020

<https://forklog.media/after-10-years-in-tech-isolation-im-now-outsider-to-t…> [...] In the aftermath of serving a lengthy prison sentence, I witnessed first-hand just how much technology has evolved, and it felt like stepping out of a time-machine. I had been an exile in time, excommunicado from the evolution of new technologies and how our global society has evolved with it. As a hacker, I was the founder and leader of the hacker group known as the Electronik Tribulation Army. I used to stay parallel to the latest gadgets, exploits, and socio-technological trends. I used to reverse engineer malware, perform incident responses, and hack pretty much anything left unattended. I read about these technological advancements in newspapers and magazines while I served my sentence, but when it comes down to it, I am now a foreigner, an outsider to the very things I once had mastered. To say that the teacher has now become the student is quite the understatement. Recently, I was given a new Dell Inspiron laptop. Fresh out of its packaging it feels and looks like a familiar friend to me. But as soon as I booted it up, I was greeted with Windows 10, my new enemy. It only seems like yesterday that the Windows 7 beta was just released. Windows 10 is confusing and weird to me. It has a new file system and I’m not even the slightest curious about how it works. I just want my Windows XP back with my dual boot option of Ubuntu Linux and Backtrack 3. The only solution to making me happy again would seem to download Ubuntu, mount it to a USB thumb drive, and get it installed. Had I known that Windows 10 doesn’t utilize BIOS, but has replaced it with UEFI (Unified Extensible Firmware Interface), which is a secure boot option that validates programs before giving them permission to run, I wouldn’t have wasted two more days of my life trying to install my favorite operating system. Windows has seized control. Point being: I am no longer in control, and I hate it. I can spend hours on Google troubleshooting through this frustrating dilemma, and still get nowhere. I have to walk away every time, defeated. [...]

1 0

In università va promossa sempre la centralità dell’apprendimento dello studente, non l’insegnamento del docente.
by don Luca Peyron June 10, 2020

June 10, 2020

Considerazioni - a mio avviso - intelligenti a margine della DAD. Buona lettura dl https://www.cattolicanews.it/il-circolo-virtuoso-della-formazione?fbclid=Iw… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

2 1

in browser port scanning... altro?
by Giovanni Biscuolo June 10, 2020

June 10, 2020

Cari nexiani, un amico molto tecnico mi segnala questo articolo molto tecnico, che in buona sostanza rivela come Ebay e molti altri clienti di LexisNexis utilizzino *anche* la tecnica del port scanning del PC sul quale funziona il browser (via Javascript) per profilare i visitatori. Il port scanning è una tecnica che serve per sapere quali porte sono "aperte" su un host e di conseguenza stabilire quali servizi sono in funzione sul quell'host. Siamo sicuri che una tecnica analoga non possa essere usata anche per **esporre** un'intera rete locale attraverso un reverse tunnell "in browser" sfruttando questa tecnica: https://github.com/MDSLab/wstun?!? (chiedo scusa se ai non addetti ai lavori sembra arabo) Qualche esperto websocket/Javascript in lista può dirmi se sono eccessivamente paranoico? «Ebay is port scanning visitors to their website - and they aren't the only ones», by Dan Nemec, 24 May 2020 https://blog.nem.ec/2020/05/24/ebay-port-scanning/ --8<---------------cut here---------------start------------->8--- [...] actually discussing a different type of port scanning, one initiated directly by a website the target loads in their browser. It’s an ingenius, if not insidious, technique that allows would-be port scanners to paradrop straight into an internal network and scan it using Javascript from within the browser context. As an aside, this is something that a browser extension could block, however the company behind the port scanning uses techniques to prevent widespread blocking of their trackers, as we’ll see later. How Browser Port Scanning Works While modern browsers allow Javascript to make requests to other domain names than the one you’re currently visiting (e.g. www.ebay.com) they layer on security controls to ensure the target data allows the calling website to access it. This prevents, for example, a malicious website from requesting the account details from you bank’s website. However, even without knowing the contents of the remote site, details about the connection itself (such as the time it takes to connect or time out) can be used to infer whether or not a website exists at the given host and port. A bit of Javascript code can wrap that into a package and allow any site to scan a user’s internal network, determining which IP addresses and ports have services running. Further, because many well-known services are commonly available on the same port (there is a registration page, but it’s more of a guideline than a hard and fast rule), it’s possible to also infer some programs that a user may be running on their network depending on whether the port is open or not. [...] In trying to load Ebay locally I found that I couldn’t replicate the behavior in Linux even after spoofing a Windows User Agent and disabling all of my extensions. There must be some check hidden in the Javascript, but as of yet I haven’t found one. After that, I loaded a Windows VM, installed the latest Edge, fired up https://www.ebay.com, and I finally replicated the port scanning behavior. However, I had some trouble replicating the behavior reliably, and after some trial and error I found that https://signin.ebay.com/ was far more reliable for triggering the port scanning. [...] To summarize what we’ve found so far: * Ebay collects data on whether certain ports are open on your local PC * This data is shipped to an Ebay domain, but does not seem to be used * otherwise Additional data like User Agent and IP are also sent [...] the domain where data is exfiltrated is not a subdomain of ebay.com - it’s ebay-us.com. Still, a quick check shows that it’s owned by somebody at Ebay, so at the very least it isn’t phishing malware. Twitter user Armchair IR pointed out that similar behavior has been seen by Facebook and it traced to a company called ThreatMetrix, an identity tracking/anti-fraud company. Checking the DNS records for src.ebay-us.com, sure enough it’s a CNAME to h-ebay.online-metrix.net, a domain owned by ThreatMetrix Inc. [...] It’s not just Ebay scanning your ports, there is allegedly a network of 30,000 websites out there all working for the common aim of harvesting open ports, collecting IP addresses, and User Agents in an attempt to track users all across the web. And this isn’t some rogue team within Ebay setting out to skirt the law, you can bet that LexisNexis lawyers have thoroughly covered their bases when extending this service to their customers (at least in the U.S.). --8<---------------cut here---------------end--------------->8--- Saluti, Giovanni. -- Giovanni Biscuolo

3 9

Spanish and French governments turn to open source video-conferencing platform
by Giacomo Tesio June 10, 2020

June 10, 2020

The Spanish and French governments have turned to an open-source solution, Jitsi Meet, to host online meetings and press conferences. Jitsi Meet is a video conferencing tool that doesn’t require the download of any software or the creation of an account. The French Inter-ministerial Directorate for Digital Affairs (Direction interministérielle du numérique, DINUM) has adopted Jitsi as an inter-ministerial web conferencing service promoting team cooperation across governmental bodies. DINUM built a custom video conferencing service, based on the open-source code of Jitsi Meet, deployed on governmental servers using advanced encryption. During the COVID-19 crisis, the Spanish government chose Jitsi to host their press conferences using the live chat feature of the tool to allow interactions between journalists and government officials. Continua su https://joinup.ec.europa.eu/collection/open-source-observatory-osor/news/op… Ora.. quali sono le nostre scuse? "Epperò abbiamo anche le nostre eccezioni^W eccellenze!" Giacomo

1 0

Developers renew push to get rid of objectionable code terms to make 'the world a tiny bit more welcoming' • The Register
by Alberto Cammozzo June 9, 2020

June 9, 2020

Major release nel codice semantico-informatico. Scordiamoci queste parole: master, slave, blackist, whitelist. "Server" per qualche motivo resiste ancora. <https://www.theregister.com/2020/06/08/developers_renew_push_to_get/> Amid the protests over the death of George Floyd, activists in the software community have taken the opportunity to remind people that they're trying to do away with terminology tied to racial oppression. On Monday, Scott Hanselman, a programmer and educator who happens to work at Microsoft, published a blog post about how to rename the "master" branch in code repositories created using Git version control software with a less loaded term. "The Internet Engineering Task Force (IEFT) points out that 'master-slave is an oppressive metaphor that will and should never become fully detached from history' as well as 'In addition to being inappropriate and arcane, the master-slave metaphor is both technically and historically inaccurate,'" he wrote. "There's lots of more accurate options depending on context and it costs me nothing to change my vocabulary, especially if it is one less little speed bump to getting a new person excited about tech." This comes from an IETF draft document published in 2018, the same year developers involved in Redis and Python made a push to purge "master/slave" terminology, not to mention Rails. That same year, the terms elicited a bug report in Google's Chromium project, one that has led to a series of changes since then, percolating down through various header and source files to change "blacklist" to a term without racial overtones, "blocklist," and "whitelist" to "allowlist." On Saturday, that effort led to a proposed name change for the classes in the components/blacklist directory, the effect of which can be seen in code diffs like this one. Put those empty boxes over there, by the stock photography lighting rig Redis does a Python, crushes 'offensive' master, slave code terms Google did not immediately respond to a request for comment, but these changes represent an attempt to comply with the company's code inclusivity guidelines for its Chromium project. Google is far from the only company dealing with this issue. Pivotal's LicenseFinder swapped "whitelist" for "permitted licenses" in January. Box is currently discussing a shift to "allowlist" and "denylist." Elixir nixed the terms about a week ago. OpenShift merged a pull request to adopt alternate language four days ago. Yelp modified its secret scanning code about two weeks ago. The osquery project is working on it. Among those contributing to the open source Git project, "master" terminology came up in a mailing list discussion last month about fixing the terminology in the Git source code. The proposal met with resistance, partly because of the amount of work it would entail. In response to a post arguing for revised wording, Brian Carlson, a developer at GitHub who also contributes to the Git codebase, acknowledged the concerns that have been raised about the terms and objections to making changes. He expressed willingness to review potential changes to Git source code that would purge the term but said he couldn't undertake the project himself. "It appears that if we made the obvious one-line change to builtin/init-db.c, we'd have 304 tests that fail, which is about a third of our test suite," he said. At GitHub, the GitHub CLI replaced "master" with "trunk" about two weeks ago and the GitHub Desktop software did the same in 2019. Despite significant support for these changes, there are also detractors who point out that Git's use of "master" hails from sound recording rather than slave owning (as opposed to the master/slave descriptors applied to device networking) and that "master" has other connotations, like expertise in a field. Google's guidance on inclusive coding, which focuses more on the use of gendered terms rather than racial ones, notes some of the potential problems with trying to apply inclusive language. For example, coders are advised to avoid the gendered pronoun "he," but "he" is okay if it refers to Helium, the ISO 639-1 language code for Hebrew or the first person conjugation of the Spanish verb "Haber." Hanselman acknowledges that vocabulary revision does not erase history or make people less racist. "All it does is make the world a tiny bit more welcoming," he said via Twitter.

6 8

The Brave web browser is hijacking links, and inserting affiliate codes
by Giacomo Tesio June 9, 2020

June 9, 2020

https://davidgerard.co.uk/blockchain/2020/06/06/the-brave-web-browser-is-hi… The Brave web browser sells itself on privacy, security and ad-blocking. It also has its own cryptocurrency, the Basic Attention Token. As such, it’s a favourite with crypto people — or ones who don’t know how to install uBlock Origin, anyway. # What Brave’s done this time Brave is very into affiliate marketing. Just in March this year, Brave was caught running eToro affiliate marketing without the legally-required disclaimers — and Brave staff were caught deleting all mention of this from the /r/brave_browser subforum on Reddit. [Github, archive] If you’re using Brave and try to go to the Binance crypto exchange, Brave hijacks the Binance link you typed in, and autofills with its own affiliate code. This was spotted by @cryptonator1337 on Twitter earlier today. [...] This ignores the legally required disclosures for affiliate links — the disclosures that Brave also ignored for the eToro links in March. In the US, the FTC has required full disclosure of affiliate marketing since 2009 — you have to put it right there on the page. Similar rules apply in the UK and the EU. (See my Amazon disclosure at the bottom-right of this post, for example.) However, Eich is very sorry that Brave got caught — again — and something will be changed in some manner to stop this behaviour, or at least obscure it. (Eich doesn’t say precisely what the totally fine thing Brave thought it was doing was, or what’s going to change here.) [...] # What should Brave do? I’d like to assume Eich is acting in good faith here — but this sort of nonsense keeps happening. When you see you’ve done something wrong, you should fix it — then explain what you got wrong, that you understand why your users are upset, and precisely how this happened, step by step. Then you don’t do it again. And you put systems into place so that you don’t do it again. What you don’t do is to rack up a chain of other unmarked affiliate advertising, or pull what looks remarkably like donation fraud. Then apologise each time, say you’ve fixed it … and then do it again. This is precisely what scammers do — they apologise, they swear they’ll fix it, and then they do it again. # What should I do, as a Brave user? There is no good reason to use Brave. Use Chromium — the open-source core of Chrome — with the uBlock Origin ad blocker. Or use Firefox with uBlock Origin — ‘cos it blocks more ads than the Chromium framework will let anything block Or [...] _________ Non condivido appieno le alternative suggerite. Anzitutto perché preferisco suggerire uMatrix ad uBlock Origin (anche se mi rendo conto che richiede un minimo di formazione per essere usato correttamente). E poi perché sia Chromium che Mozilla bilanciano la sicurezza degli utenti con gli interessi economici dei propri finanziatori. Giacomo

4 7

Semplificazione PA (punto 23 Piano Colao)
by Diego.Latella June 9, 2020

June 9, 2020

Buongiorno, Ho letto il punto 23 del "Piano Colao" (scaricato stamani dal sito di Repubblica), cioe' il punto relativo alla "semplificazione PA". Mi ha colpito, nella parte "Azioni Specifiche" il testo che segue: "Ridurre l'area di responsabilità dei dipendenti pubblici conseguente all'adozione di procedure governate da algoritmi (Cons. St. sentenza n. 8472/2019)" Non ho avuto la pazienza di leggere la sentenza citata, anche perche' non mi e' chiaro se sia indicata come esempio "positivo" o "negativo" (nella visione del "Piano"), ma l'azione suggerita mi sembra preoccupante perche', se non ho capito male, tende a deresponsabilzzare i pubblici dipendenti che assumono decisioni sulla base del ("conseguenti al") risultato di algoritmi, senza meglio specificare come queste decisioni siano conseguenti ai risultati degli algoritmi (il dipendete publico e' esonerato dal valutare il risultato o dal motivarlo ecc ecc?). E inoltre non vengono minimamente considerate paculiarita' degli algoritmi (corretti? spiegabili? open source? ecc ecc) Mi auguro di aver capito male. Per il resto, nulla di nuovo: ancora una volta per _semplificare_ la PA, invece di _aggredire _e _modificare _le _norme_ e le _procedure_ che regolano ("regolano", mah ...) la burocrazia, si insiste sulla semplice informatizzazione delle _procedure esistenti _(come si evince anche dal titolo del punto (a)). Ancora una volta, quindi, la farraginosita' e delle procedure burocratiche viene semplicemente _implementata_ telematicamente invece di essere _semplificata_. E cosi ad essa si aggiungeranno altri problemi dovuti ai bachi del software ... DL -- Dott. Diego Latella - Senior Researcher CNR-ISTI, Via Moruzzi 1, 56124 Pisa, Italy (http:www.isti.cnr.it [1]) FM&&T Lab. (http://fmt.isti.cnr.it) http://www.isti.cnr.it/People/D.Latella - ph: +390506212982, mob: +39 348 8283101, fax: +390506212040 =================== The quest for a war-free world has a basic purpose: survival. But if in the process we learn how to achieve it by love rather than by fear, by kindness rather than compulsion; if in the process we learn how to combine the essential with the enjoyable, the expedient with the benevolent, the practical with the beautiful, this will be an extra incentive to embark on this great task. Above all, remember your humanity. -- Sir Joseph Rotblat I don't quite know whether it is especially computer science or its subdiscipline Artificial Intelligence that has such an enormous affection for euphemism. We speak so spectacularly and so readily of computer systems that understand, that see, decide, make judgments, and so on, without ourselves recognizing our own superficiality and immeasurable naivete with respect to these concepts. And, in the process of so speaking, we anesthetise our ability to evaluate the quality of our work and, what is more important, to identify and become conscious of its end use. […] One can't escape this state without asking, again and again: "What do I actually do? What is the final application and use of the products of my work?" and ultimately, "am I content or ashamed to have contributed to this use?" -- Prof. Joseph Weizenbaum ["Not without us", ACM SIGCAS 16(2-3) 2--7 - Aug. 1986] Links: ------ [1] http://www.isti.cnr.it

1 0

IBM is exiting the face recognition business - Axios
by Alberto Cammozzo June 9, 2020

June 9, 2020

<https://www.axios.com/ibm-is-exiting-the-face-recognition-business-62e79f09…> In a letter to members of Congress on Monday, IBM said it is exiting the general-purpose facial recognition business and said it opposes the use of such technology for mass surveillance and racial profiling. Why it matters: Facial recognition software is controversial for a number of reasons, including the potential for human rights violations as well as evidence that the technology is less accurate in identifying people of color. What he's saying: "IBM no longer offers general purpose IBM facial recognition or analysis software," CEO Arvind Krishna said in the letter. "IBM firmly opposes and will not condone uses of any technology, including facial recognition technology offered by other vendors, for mass surveillance, racial profiling, violations of basic human rights and freedoms, or any purpose which is not consistent with our values and Principles of Trust and Transparency." The big picture: An IBM representative told Axios that the decisions were made over a period of months and have been communicated with customers, though this is the first public mention of the decision. IBM said it will "no longer market, sell or update these products" but will support existing clients as needed.

1 0

IBM will no longer offer, develop, or research facial recognition technology - The Verge
by J.C. DE MARTIN June 9, 2020

June 9, 2020

https://www.theverge.com/2020/6/8/21284683/ibm-no-longer-general-purpose-fa… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Teledidattica: proprietaria e privata o libera e pubblica?
by Giacomo Tesio June 8, 2020

June 8, 2020

Ciao, vorrei condividere con voi questa ottima lettura: https://www.roars.it/online/teledidattica-proprietaria-e-privata-o-libera-e… Per quel che conta, da informatico E cittadino, anche io condivido le preoccupazioni e lo sbigottimento di Maria Chiara. > È però chiaro, perfino a chi, come me, conosce l’informatica > solo per sentito dire, che una comunità universitaria e di ricerca > collettivamente incapace di mantenere e sviluppare > un’infrastruttura propria, di controllare i propri dati e di > promuovere e sviluppare competenze proprie pagherà un > prezzo infinitamente alto in termini di sapere, di potere e di > libertà, perché sarà sempre più dipendente – entro ambienti > di scelta disegnati da altri – da sistemi e da > conoscenze che non le appartengono. > > Non si limiterà, cioè, a mettere i propri dati sul computer > di qualcun altro, fuori d’Italia, ma sarà usata da strumenti > e ambienti di scelta disegnati da qualcun altro, e cioè da > multinazionali private che traggono profitto dal commercio > di manipolazione e sorveglianza. E formerà, per le aziende > italiane, tecnici a loro volta incapaci di farne a meno, > perché nient’altro è stato loro insegnato. Io posso dire che quanto descritto da Maria Chiara corrisponde tragicamente con la mia esperienza diretta nel mondo del lavoro. Giacomo

2 1