- nexa - server-nexa.polito.it

Opinion | How Capitalism Betrayed Privacy - The New York Times
by J.C. DE MARTIN April 13, 2019

April 13, 2019

https://www.nytimes.com/2019/04/10/opinion/sunday/privacy-capitalism.html (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

How Germany's anti-trust watchdog could change the way Facebook works - The Listener
by J.C. DE MARTIN April 13, 2019

April 13, 2019

https://www.noted.co.nz/tech/germany-anti-trust-watchdog-could-change-way-f… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Safari link tracking can no longer be disabled
by Giacomo Tesio April 12, 2019

April 12, 2019

https://lapcatsoftware.com/articles/Safari-link-tracking.html HTML5 added a "feature" to the web called hyperlink auditing. You can read the specification from the Web Hypertext Application Technology Working Group (WHATWG). Hyperlink auditing is added to a web page via the ping attribute on an HTML anchor element (<a>), i.e., a link. [...] Notice that when you hover over the "Ping Me" link, you only see the href URL, you don't see the ping URL, so you don't even know that the attribute exists unless you look at the HTML page source. When you click the link, it loads the page http://lapcatsoftware.com/ as expected. But it also sends an HTTP POST request to http://underpassapp.com/ without any visible indication to the user. You can only see it if you do a packet trace. It should come as no surprise that the primary usage of hyperlink auditing is for tracking of link clicks. [...] Firefox disables hyperlink auditing by default, as explained in a knowledge base article. You can see this if you open about:config and look at browser:send_pings. [...] Prior to Safari 12.1, you could disable hyperlink auditing with a hidden preference: ``` defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2HyperlinkAuditingEnabled -bool false ``` Unfortunately, this no longer works in Safari 12.1. [...] I've been informed that chrome://flags#disable-hyperlink-auditing is now missing from the Google Chrome betas, even though it still exists in the current non-beta version. The flag was removed from the source code a little over a month ago. ___ E' interessante come anche prima della rimozione, per disabilitare questo tracciamento dovevi A) sapere che c'era B) usare tool "avanzati". E tanto via JS il server può fare lo stesso. Si chiama "Insecurity through Obscurity". Ed è uno standard! Potremmo chiedere un parere alla commissione etica del WHATWG! Se solo uno dei membri sapesse di cosa si parla! :-D Giacomo

2 1

Matrix.org: We have discovered and addressed a security breach.
by Giacomo Tesio April 12, 2019

April 12, 2019

Matrix è (era?) un bel progetto open source. Al di là dei problemi di sicurezza del loro sistema che hanno permesso la compromissione, il fatto che abbiano rimosso le issue create su GitHub dall'hacker che li ha bucati (che spiegava come ha fatto e suggeriva correzioni al sistema) rappresenta uno splendido esempio di come NON gestire un breach di sicurezza. Ora matrixnotorg è stato rimosso da GitHub ma potete dare un occhiata sulla WaybackMachine https://web.archive.org/web/20190412145208/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145145/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145122/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145058/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145035/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… https://web.archive.org/web/20190412145008/https://github.com/matrix-org/ma… Segue un estratto dalla disclosure su https://matrix.org/blog/2019/04/11/security-incident/ TL;DR: An attacker gained access to the servers hosting Matrix.org. The intruder had access to the production databases, potentially giving them access to unencrypted message data, password hashes and access tokens. As a precaution, if you're a matrix.org user you should change your password now. [...] # The security breach is not a Matrix issue. The hacker exploited a vulnerability in our production infrastructure (specifically a slightly outdated version of Jenkins). Homeservers other than matrix.org are unaffected. [...] # What user data has been accessed? Forensics are ongoing; so far we've found no evidence of large quantities of data being downloaded. The attacker did have access to the production database, so unencrypted content (including private messages, password hashes and access tokens) may be compromised. [...] # Update 2019-04-12 The rebuilt infrastructure itself is secure, however, and the DNS issue has been solved without further abuse. If you have already changed your password, you do not need to do so again. [...] The attacker has also posted github issues detailing some of their actions and suggested remediations at https://github.com/matrix-org/matrix.org/issues/created_by/matrixnotorg. This confirms that GPG keys used for signing packages were compromised.

1 1

[nexa] https://www.newyorker.com/tech/annals-of-technology/mark-zuckerberg-elizabeth-warren-and-the-case-for-regulating-big-tech
by J.C. DE MARTIN April 12, 2019

April 12, 2019

https://www.newyorker.com/tech/annals-of-technology/mark-zuckerberg-elizabe… (Sent from my wireless device; please excuse brevity and typos (if any))

3 2

BBC:"US lawmakers to probe algorithm bias"
by J.C. DE MARTIN April 12, 2019

April 12, 2019

*US lawmakers to probe algorithm bias* 11 April 2019 Computer algorithms must show they are free of race, gender and other biases before they are deployed, US politicians have proposed. Lawmakers have drafted a bill that would require tech firms to test prototype algorithms for bias. Many organisations rely on coded instructions or algorithms for tasks such as showing users relevant ads, analysing behaviour or sorting data. Critics said the bill could limit the benefits of machine intelligence. [...] continua qui: https://www.bbc.com/news/technology-47894492

1 0

A German court forced us to remove part of a Wikipedia article’s ‘history.’ Here’s what that means.
by Giacomo Tesio April 12, 2019

April 12, 2019

Brutto precedente. Estremamente pericoloso. Non solo si rimuove il contenuto diffamatorio, ma si riscrive la sua storia. Si cerca di cancellare la memoria invece di arricchirla di una nuova informazione (la constatazione di un tribunale che il contenuto offensivo era falso e dunque diffamatorio). https://wikimediafoundation.org/2019/04/11/a-german-court-forced-us-to-remo… Three months ago, a German court ruled that part of a Wikipedia article—found to be defamatory in a previous court decision—had to be removed from both the article and its associated revision tracker, known as a “history” page. (History pages allow anyone to see how a Wikipedia article has developed since they were created, in some cases going back all the way to 2001. We have a desktop-based tutorial on using these history pages in both English and German.) A German court ruled in September of last year that the content was in fact defamatory, largely because the source in question had been taken offline—what we call “link rot.” German volunteers quickly removed the text in question from the article but the article’s corresponding history page retained the statements. This is a common practice on Wikimedia projects. [...] Article histories are a useful tool for contributors, readers, and staff—even courts, on occasion— to see how an article has evolved over time. [...] In a case like this, deleting the article history may in fact inspire more curiosity, leading visitors to search for more information about the controversy. [...] Note that the issue in this case is distinct from the right to be forgotten. Here, the claim was that something in the article was false in the first place, that a source had made a mistake, and that the information harmed the individual’s reputation.

1 0

Google AMP lowered our page speed, and there's no choice but to use it
by Giacomo Tesio April 11, 2019

April 11, 2019

https://unlikekinds.com/article/google-amp-page-speed For those that don’t know, a very quick primer. AMP is a set of rules that publishers (typically news and analysis content providers) must abide by in order to appear in the “Top Stories” section of Google’s search results, a lucrative position at the top of the page. It’s also required for your content to appear as a “rich” result, meaning emphasized links with images, which can receive a lot more attention from users. AMP must be implemented by the publisher on their site, and it’s not trivial. Google puts the onus on publishers to, effectively, rejig large tracts of their websites layout, content, and functionality, in return for preferential treatment. [...] We didn’t really want to; our site is already fast because we made it fast, largely with a combination of clever caching and minimal code. But hey, maybe AMP would speed things up. Maybe Google’s new future is bright. It isn’t. [...] But Google already ranks websites by speed. [...] So you’d imagine that Google’s existing page speed ranking could easily be used to limit which sites appear in the carousel. Anything with a performance score below an 80 could appear as a performance issue in Google Search Console, and the site demoted. But no, Google insists you build your website with their technology. [...] # AMP isn’t about speed. It’s about control. AMP is an open source project. That evokes images of open, honest, collaboration amongst equals. But that’s not what’s happening. For a start, anyone contributing to AMP is required to sign a contributor license agreement (CLA) for their code to be accepted into the project. The CLA requires that you “grant to Google and to recipients of software distributed by Google a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license”. There’s also a clause for much the same regarding any patents. Note, you don’t grant these rights to the AMP Project, you grant them to Google. Google owns the code and patents. The issues on AMP’s GitHub page is littered with revolts. Most notorious was Google’s attempt to co-opt email itself. The issue is full of non-Google developers in open revolt against Google’s power-grab, with users describing it as misguided and user-hostile, complete with frequent use of the thumbs-down emoji. Google’s response? They’ve labeled the issue Priority 2: “Soon” and “INTENT TO IMPLEMENT”, and are powering ahead regardless. [...] This is the core of the problem. If you’re trying to build a brand with something unique or distinctive, Google forbids you. And let’s not forget, it’ll be served from a Google domain, further diminishing your brand. [...] Google’s in an incredible position of power. According to the Wall Street Journal: Publishers who are critical of AMP were reluctant to speak publicly about their frustrations, or to remove their AMP content. One executive said he would not comment on the record for fear that Google might “turn some knob that hurts the company.” Sure, there’s a technical steering committee. 3/7 of them are Google employees, and the others are platforms: Microsoft, Twitter, Pinterest, and Pantheon (a web host, for some reason) - not the people actually making the content. Not the publishers like the New York Times, just the gatekeepers. # Why can Google do this? Because they own the web. [...]

1 0

Decentralizing the Web with FreedomBox
by Giacomo Tesio April 11, 2019

April 11, 2019

https://www.linkedin.com/pulse/decentralizing-web-freedombox-james-pemantel… In the Computer Underground of the 80's and 90's, there was an axiom "Knowledge is power; Information is freedom." Information is critical to our democracy and it has become apparent that popular technology can be used in ways -- both deliberately and passively -- that weaken democracy: - The way that news is presented on social media is designed to be addictive and provoke intense responses. - Geo-tracking features of social media platforms have been used to intimidate protesters and discourage dissent. - Voter manipulation via social media influenced recent US and UK national elections. - In some countries, the platforms are censored by governments and in other cases the propensity for information to "go viral" is exploited by the state to control users. The trend for popular technology is for it to be centralized on servers and controlled by someone else. At the advent of personal computing, it was the client that went into the home, not the server. FreedomBox is a non-profit project that is designed to decentralize the web by putting the control of one's information back into the hands of the user. It is a distribution of Debian GNU/Linux entirely comprised of Free Software with a web frontend that makes management and installation of software user-friendly.

1 0

Walmart Responds To Bezos: "How About Paying Your Taxes?" | Zero Hedge
by J.C. DE MARTIN April 11, 2019

April 11, 2019

https://www.zerohedge.com/news/2019-04-11/walmart-responds-bezos-how-about-… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0