- nexa - server-nexa.polito.it

UK Bus Open Data Service goes live
by Antonio Vetro' Jan. 31, 2020

Jan. 31, 2020

Mi sembra un servizio utile alla collettività: https://www.intelligenttransport.com/transport-news/95269/uk-bus-open-data-… av

1 0

How Sustainable is a Solar Powered Website? - LOW-TECH MAGAZINE
by Alberto Cammozzo Jan. 30, 2020

Jan. 30, 2020

Conti non banali... <https://www.lowtechmagazine.com/2020/01/how-sustainable-is-a-solar-powered-…> Our self-hosted, solar-powered, off-grid website has been running for 15 months now. In this article, we present its energy and uptime data, and calculate the embodied energy of our configuration. Based on these results, we consider the optimal balance between sustainability and server uptime, and outline possible improvements. Introduction In September 2018, Low-tech Magazine launched a new website that aimed to radically reduce the energy use and carbon emissions associated with accessing its content. Internet energy use is growing quickly on account of both increasing bit rates (online content gets “heavier”) and increased time spent online (especially since the arrival of mobile computing and wireless internet). The solar powered website bucks against these trends. To drop energy use far below that of the average website, we opted for a back-to-basics web design, using a static website instead of a database driven content management system. To reduce the energy use associated with the production of the solar panel and the battery, we chose a minimal set-up and accepted that the website goes off-line when the weather is bad. We have been monitoring the solar powered server for 15 months now, and we have collected data on uptime, energy use, power use, system efficiency, and visitor traffic. We also calculated how much energy was required to make the solar panel, the battery, the charge controller and the server. Uptime, Electricity Use & System Efficiency The solar powered website goes off-line when the weather is bad – but how often does that happen? For a period of about one year (351 days, from 12 December 2018 to 28 November 2019), we achieved an uptime of 95.26%. This means that we were off-line due to bad weather for 399 hours. If we ignore the last two months, our uptime was 98.2%, with a downtime of only 152 hours. Uptime plummeted to 80% during the last two months, when a software upgrade increased the energy use of the server. This knocked the website off-line for at least a few hours every night. One kilowatt-hour of solar generated electricity can serve almost 50,000 unique visitors Let’s have a look at the electricity used by our web server (the “operational” energy use). We have measurements from the server and from the solar charge controller. Comparing both values reveals the inefficiencies in the system. Over a period of roughly one year (from 3 December 2018 to 24 November 2019), the electricity use of our server was 9.53 kilowatt-hours (kWh). We measured significant losses in the solar PV system due to voltage conversions and charge/discharge losses in the battery. The solar charge controller showed a yearly electricity use of 18.10 kWh, meaning that system efficiency was roughly 50%. During the period under study, the solar powered website received 865,000 unique visitors. Including all energy losses in the solar set-up, electricity use per unique visitor is then 0.021 watt-hour. One kilowatt-hour of solar generated electricity can thus serve almost 50,000 unique visitors, and one watt-hour of electricity can serve roughly 50 unique visitors. This is all renewable energy and as such there are no direct associated carbon emissions. Embodied Energy Use & Uptime The story often ends here when renewable energy is presented as a solution for the growing energy use of the internet. When researchers examine the energy use of data centers, which host the content that is accessible on the internet, they never take into account the energy that is required to build and maintain the infrastructure that powers those data centers. There is no such omission with a self-hosted website powered by an off-the-grid solar PV installation. The solar panel, the battery, and the solar charge controller are equally essential parts of the installation as the server itself. Consequently, energy use for the mining of the resources and the manufacture of these components – the “embodied energy” – must also be taken into account. [...]

1 0

[CDT] SIM scam e sicurezza del conto bancario: 2FA dei miei stivali.
by Giovanni Biscuolo Jan. 30, 2020

Jan. 30, 2020

Buongiorno nexiani, dovreste avvisare tutti coloro a cui volete bene che il giorno in cui il loro telefono dovesse perdere completamente la linea (anche dopo un paio di riavvii) allora è il caso che si precipitino in banca a bloccare l'accesso al conto. Leggendo questo articolo «Truffa sim swap, “così attraverso il numero di telefono ci hanno svuotato il conto”. I rischi nascosti nelle nuove procedure di sicurezza» [1] ho scoperto questa tecnica [2]: https://en.wikipedia.org/wiki/SIM_swap_scam --8<---------------cut here---------------start------------->8--- The fraud exploits a mobile phone service provider’s ability to seamlessly port a telephone number to a device containing a different subscriber identity module (SIM). [...] Once this happens the victim's phone will lose connection to the network and the fraudster will receive all the SMS and voice calls intended for the victim. This allows the fraudster to intercept any one-time passwords sent via text or telephone calls sent to the victim, and thus to circumvent any security features of accounts (be they bank accounts, social media accounts, etc.) that rely on text messages or telephone calls. --8<---------------cut here---------------end--------------->8--- L'articolo citato all'inizio dice sostanzialmente che alcuni cittadini italiani si sono trovati il conto svuotato da chi ha usato la tecnica sopra: --8<---------------cut here---------------start------------->8--- Una volta individuata la vittima si procede all’acquisizione delle credenziali di home banking tramite tecniche di hacking. [...] La pericolosità di questa truffa sta nel superamento del secondo fattore di autenticazione, di recente legato al numero di telefono: “Il cellulare viene identificato con la sim e chi ne entra fisicamente in possesso ha un grande vantaggio” [...] Negli Stati Uniti, dove questa truffa è molto diffusa già da qualche anno, i clienti che si sentono a rischio possono chiedere al proprio operatore di non rilasciare duplicati della sim in centri servizi standard. Questo passaggio è scomodo quando capita di perdere per davvero la sim, ma forse è il momento di rivalutarlo vista la crescita di questo tipo di truffe. [...] Il punto di partenza rimane in ogni caso il furto delle credenziali di home banking, che nella grande maggioranza dei casi avviene tramite il cosiddetto phishing [...] E poi è fondamentale aggiornare il sistema operativo dei dispositivi cui cui operiamo: molti attacchi avvengono tramite l’installazione di malware sul pc, e questo spesso accade perché non abbiamo aggiornato il sistema operativo e i browser con cui navighiamo --8<---------------cut here---------------end--------------->8--- Secondo me cambia proprio poco se il 2FA è gestito via SMS o via app: chi ha le credenziali di accesso primarie ci mette 15 secondi ad associare la propria app al conto, che si tratti di app proprietarie o libere (FreeOTP) non fa la differenza... ...ma, ma, ma: nel caso l'utente utilizzi app proprietarie 2FA sul proprio smartphone e queste app lo hanno costretto a inserire le credenziali primarie per poter attivare l'app (AFAIU il 98% delle app proprietarie distribuite dalle banche) allora la superficie di attacco a disposizione dei truffatori aumenta **esponenzialmente** Aver introdotto il 2FA e aver consentito che fosse gestito in questo modo ha reso più complicata la vita agli utenti e dato un solo po' di fastidio ai truffatori che ora sono costretti a usare un pochino di risorse in più per ottenere lo scopo. Io continuo a credere che l'unico modo serio per proteggersi da questo tipo di truffe sia essere in grado di proteggere veramente le proprie credenziali primarie *ma* questo implica che i dispositivi sui quali le memorizziamo siano davvero sicuri (io comincierei dal sistema operativo, poi per l'hardware vedremo... tipo https://betrusted.io/) Il 2FA andrebbe anche bene se chi lo offre fosse _costretto_ ad accettare che i clienti possano utilizzare qualsiasi app loro desiderino senza essere costretti a usare la app specifica (in genere proprietaria). Giusto per capirci, anche io uso 2FA via FreeOTP [3] - per esempio per l'accesso web a servizi quali per esempio https://gitlab.com un servizio per pubblicare repository git - mentre la mia banca vorrebbe costringermi ad installare la propria app, la quale per l'attivazione mi chiede di inserire i codici di autenticazione primaria... ho risposto loro che sono fuori di testa, preferisco pagare extra per avere i codici via SMS :-O Perché il PSD2 non obbliga chi eroga i servizi 2FA a dare accesso attraverso uno degli standard disponibili?!? Come se non bastasse, quando sono costretto a chiamare un operatore telefonicamente il sistema automatico mi chiede di inserire codice utente e **password** attraverso DTMF [4] (il tastierino che invia i numeri coi toni), prima di procedere... al che lo faccio solo quando sono disperato perché così mi tocca modificare la password dopo *ogni* chiamata... mi piacerebbe scambiare due paroline con coloro che hanno redatto il PSD2 :-@ L'ufficio complicazioni inutili degli affari complessi è sempre molto indaffarato. Se qualcuno trovasse una falla nel mio ragionamento sarei molto lieto di ascoltare :-) Saluti, Giovanni [1] https://www.ilfattoquotidiano.it/2020/01/30/truffa-sim-swap-cosi-attraverso… [2] l'avevo sempre immaginata possibile ma non sapevo fosse effettivamente documentata... beata ignoranza! [3] https://f-droid.org/it/packages/org.fedorahosted.freeotp/ [4] intercettare le chiamate GSM è un gioco da ragazzi oggi -- Giovanni Biscuolo Xelera IT Infrastructures

2 1

Facial Recognition Is Only the Beginning
by don Luca Peyron Jan. 30, 2020

Jan. 30, 2020

Those actors have the power to make society *believe* in the value of the technology and the understandings of the world it generates, while at the same time building and selling the systems and apparatuses for that tracking, measurement, and computational analysis. Solo allarmismo o lucida analisi? Buona lettura dl https://www.publicbooks.org/facial-recognition-is-only-the-beginning/ _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

A Global System of Work, A Global System of Regulation?: Crowdwork and Conflicts of Law by Miriam A. Cherry :: SSRN
by J.C. DE MARTIN Jan. 29, 2020

Jan. 29, 2020

A Global System of Work, A Global System of Regulation?: Crowdwork and Conflicts of Law Tulane Law Review, Vol. 94, 2019 Saint Louis University School of Law Legal Studies Research Paper No. 2019-11 63 Pages Posted: 23 Jan 2020 Last revised: 26 Jan 2020 Miriam A. Cherry Saint Louis University - School of Law Abstract On-demand platforms are changing and reshaping our conceptions of both the firm and the work relationship in far-reaching and critical ways, allowing companies to hire workers and to seek customers across national boundaries. Confronted with low pay, wage theft, and other problematic working conditions, gig workers around the world have turned to the courts, attempting to invoke the protections of traditional labor and employment law. While some commentators believe existing forms of labor and employment regulations can stretch to cover on-demand work, others have called for new legal initiatives specifically crafted for online platforms. The goal of this paper is to provide a global framework for thinking about the on-demand business model and these assorted conflicts of law and jurisdictional issues. The Maritime Labor Convention is discussed as an analogous regulatory scheme. Throughout, the paper emphasizes the need for further coordinated multilateral study, discussion, and regulatory action to assist both crowdworkers and businesses as they navigate the on-demand model of production. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3523303 (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Hunting UEFI Implants
by Giacomo Tesio Jan. 29, 2020

Jan. 29, 2020

Lettura interessante dal punto di vista tecnico e politico. https://blogs.gnome.org/hughsie/2020/01/27/hunting-uefi-implants/ Di seguito ometto i passaggi più tecnici, per riportare le considerazioni che credo possano essere interessanti per Nexa. Ovviamente, la soluzione proposta non può funzionare. E incrementerebbe il potere delle poche aziende "affidabili" (tutte rigorosamente USA). E' dunque probabile che verrà accolta con entusiasmo dal mercato. Giacomo ____ My fellow students were a mixture of security professionals and employees from various government departments from all over the world. We talked, a lot. My personal conclusion quite simply is that we’re failing as an industry. In the pursuit to reduce S3 resume time from 2s to 0.5s we introduce issues like the S3 bootscript vulnerability. With the goal to boot as quickly as possible, we only check the bare minimum certificate chain allowing additional malicious DXEs to be added to an image. OEMs are choosing inexpensive EC hardware from sketchy vendors that are acting as root of trust and also emulating hardware designed 30 years ago, whilst sharing the system SPI chip. By trying to re-use existing power management primitives like SMM as a security boundary the leaky abstractions fail us. Each layer in the security stack is assuming that the lower below it is implemented correctly, and so all it takes is one driver with SMM or CSME access to not check a memory address in a struct correctly and everything on top (e.g. BootGuard, ALSR, SELinux, etc) is broken. Coreboot isn’t the panacea here either as to get that to run you need to turn off various protections [...] Worst still, if you allow your “assumed secure” laptop out of sight then all bets are off with security. About a quarter of people at the UEFI training had their “travel laptop” tampered with at some point – with screws missing after “customs inspections” or with tamper seals broken after leaving a laptop in a hotel room. You really don’t need to remove the screws to image a hard drive these days. But, lets back away from the state-sponsored attacker back to reality for a minute. The brutal truth is that security costs money. [...] My proposal would be as follows: - SEC1: SecureBoot, BIOS_WE, BLE, SMM_BWP, and updates on the LVFS, with no existing detectable SMM issues (like ThinkPwn for example) - SEC2: PRx set correctly, if not using BootGuard or BIOSGuard, with PCR0 attestation data - SEC3: BootGuard enabled, with the EC controller requiring signed images - SEC4: Intel BIOSGuard or HP SureStart - SEC5: Hardware attestation like Apple T2 or Google Titan [...] Perhaps we could let the consumer vote with their wallet and make the ecosystem more secure.

1 0

Lo stato d'animo di chi twitta
by don Luca Peyron Jan. 29, 2020

Jan. 29, 2020

Buongiorno a tutti, segnalo un sito interessante: http://www.emojitracker.com/ il cui scopo è tracciare in tempo reale l'uso di emoticon su Twitter. Ridere fino alle lacrime pare sia il mood preferito dai nostri contemporanei. Buon tutto dl _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

5G Security
by Giacomo Tesio Jan. 29, 2020

Jan. 29, 2020

Una panoramica chiara e comprensibile che dovrebbe arrivare a chiunque abbia ruoli decisionali in merito all'adozione e alla distribuzione di sistemi basati sul protocollo 5G. La prospettiva è molto US-centrica, ma le considerazioni di Schneier sono molto più preoccupanti in Europa. https://www.schneier.com/blog/archives/2020/01/china_isnt_the_.html Giacomo _____ The 5G security problems are threefold. First, the standards are simply too complex to implement securely. This is true for all software, but the 5G protocols offer particular difficulties. Because of how it is designed, the system blurs the wireless portion of the network connecting phones with base stations and the core portion that routes data around the world. Additionally, much of the network is virtualized, meaning that it will rely on software running on dynamically configurable hardware. This design dramatically increases the points vulnerable to attack, as does the expected massive increase in both things connected to the network and the data flying about it. Second, there's so much backward compatibility built into the 5G network that older vulnerabilities remain. 5G is an evolution of the decade-old 4G network, and most networks will mix generations. Without the ability to do a clean break from 4G to 5G, it will simply be impossible to improve security in some areas. Attackers may be able to force 5G systems to use more vulnerable 4G protocols, for example, and 5G networks will inherit many existing problems. Third, the 5G standards committees missed many opportunities to improve security. Many of the new security features in 5G are optional, and network operators can choose not to implement them. The same happened with 4G; operators even ignored security features defined as mandatory in the standard because implementing them was expensive. But even worse, for 5G, development, performance, cost, and time to market were all prioritized over security, which was treated as an afterthought. Already problems are being discovered. In November 2019, researchers published vulnerabilities that allow 5G users to be tracked in real time, be sent fake emergency alerts, or be disconnected from the 5G network altogether. And this wasn't the first reporting to find issues in 5G protocols and implementations. [...] 5G security is just one of the many areas in which near-term corporate profits prevailed against broader social good. In a capitalist free market economy, the only solution is to regulate companies, and the United States has not shown any serious appetite for that. What's more, U.S. intelligence agencies like the NSA rely on inadvertent insecurities for their worldwide data collection efforts, and law enforcement agencies like the FBI have even tried to introduce new ones to make their own data collection efforts easier. Again, near-term self-interest has so far triumphed over society's long-term best interests. [...] The geopolitics of 5G are complicated, involving a lot more than security. China is subsidizing the purchase of its companies' networking equipment in countries around the world. The technology will quickly become critical national infrastructure, and security problems will become life-threatening. Both criminal attacks and government cyber-operations will become more common and more damaging. Eventually, Washington will have do so something. That something will be difficult and expensivelet's hope it won't also be too late.

1 0

Facial Recognition Is Only the Beginning | Public Books
by J.C. DE MARTIN Jan. 29, 2020

Jan. 29, 2020

https://www.publicbooks.org/facial-recognition-is-only-the-beginning/ (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Summer School - Algoritmic State, Market and Society, Florence 13-17 July
by Giovanni De Gregorio Jan. 28, 2020

Jan. 28, 2020

Carissimi, vorrei condividere con voi quest'iniziativa estiva che spero possa essere di vostro interesse: The First Edition of the Summer School on “Algorithmic State, Market and Society”(FLOS) will be held in Florence on 13-17 July 2020. The one-week programme focuses on cutting-edge issues in the field of law and technology focusing especially on automated technologies. This initiative aims to create a multi-stakeholder environment made of scholars, practitioners, students and experts in the field of law, technology and economics. The idea of FLOS has been conceived within the framework of the research group on “Algorithmic State, Market and Society” which has been launched during the inaugural conference on “Constitutional Challenges in the Algorithmic Society” held at the University of Florence and European University Institute in May 2019. FLOS aims to give rigorous and comprehensive training in a wide variety of topics on law and algorithms thanks to the collaboration of distinguished scholars and participants. It embraces law, technology and policy and it is open to policy makers, practitioners, judges, scholars and students. Each day is made of four sessions of one hour and half. Each session deals with different issues in the field of law and algorithms and aims to create the environment for questions and discussions between participants. FLOS is jointly hosted by the University of Florence (Italy), the European University Institute (Florence, Italy), and Bocconi University (Milan, Italy). FLOS is coordinated by professors Oreste Pollicino, Giovanni Sartor and Andrea Simoncini and scientifically organised by Erik Longo and Giovanni De Gregorio. For any query or information, please contact Erik Longo (erik.longo(a)unifi.it) and Giovanni De Gregorio (degregorio.giovanni(a)unibocconi.it) You can find more info at http://www.algorithmicstate.eu/summer-school/ Un saluto Giovanni De Gregorio

1 0