- nexa - server-nexa.polito.it

Cyber-Mercenary Groups Shouldn't be Trusted in Your Browser or Anywhere Else
by Giacomo Tesio Feb. 27, 2019

Feb. 27, 2019

DarkMatter, the notorious cyber-mercenary firm based in the United Arab Emirates, is seeking to become approved as a top-level certificate authority in Mozilla’s root certificate program. Giving such a trusted position to this company would be a very bad idea. DarkMatter has a business interest in subverting encryption, and would be able to potentially decrypt any HTTPS traffic they intercepted. One of the things HTTPS is good at is protecting your private communications from snooping governments—and when governments want to snoop, they regularly hire DarkMatter to do their dirty work. [...] Browsers rely on this list of authorities, which are trusted to verify and issue the certificates that allow for secure browsing, using technologies like TLS and HTTPS. Certificate Authorities are the basis of HTTPS, but they are also its greatest weakness. Any of the dozens of certificate authorities trusted by your browser could secretly issue a fraudulent certificate for any website (such as google.com or eff.org.) A certificate authority (or other organization, such as a government spy agency,) could then use the fraudulent certificate to spy on your communications with that site, even if it is encrypted with HTTPS. [...] The companies on your browser’s trusted CA list rarely commit such fraud, since not issuing malicious certificates is the foremost responsibility for a certificate authority. But it can and does still happen. The concern in this case is that DarkMatter has made its business spying on internet communications, hacking dissidents’ iPhones, and other cyber-mercenary work. DarkMatter’s business objectives directly depend on intercepting end-user traffic on behalf of snooping governments. Giving DarkMatter a trusted root certificate would be like letting the proverbial fox guard the henhouse. [...] Other organizations have used this fact to game the system in the past and worm their way into our browsers. In 2009, Mozilla allowed CNNIC, the Chinese state certification authority, into the root CA program, after CNNIC assured Mozilla and the larger community that it would not abuse this power to create fake certificates and break encryption. In 2015 CNNIC was caught in a scandal when an intermediate CA authorized by CNNIC issued illegitimate certificates for several google-owned domains. Google, Mozilla, and others quickly revoked CNNIC’s authority in their browsers and operating systems after learning about the breach of trust. CNNIC is not the only example of this. In 2013 Mozilla considered dropping the Swedish company Teliasonera after accusations that it had helped enable government spying. Teliasonera ultimately did not get dropped, but it continues to have security problems to this day. https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-tr… ____ Insomma, agli USA non piace la concorrenza! :-D Ma... usate HTTPS! HTTPS everywhere! HTTPS è sicuro! Let's Encrypt! :-D Giacomo PS: chi non sa quando NON usare uno strumento, non ha le competenze per usarlo.

1 0

Platform societies + Communities at a Crossroads (iniziative legate a STSItalia)
by alvise Feb. 27, 2019

Feb. 27, 2019

Ciao, ormai da circa due mesi seguo la mailing list di Nexa e devo dire che sono molto contento di farne parte visto l'interesse dei post e il respiro delle questioni affrontate. Al di là di "annunciarmi" alla lista espleto il mio ruolo quasi istituzionale di membro della Società Italiana per lo Studio Sociale della Scienza e della Tecnologia per segnalare due eventi legati agli STS italiani (di cui uno ufficiale dell'associazione) Ma ne approfitto per annunciare che per una fortuita coincidenza, oggi sono a Torino a fare esami in Via Boggio e quindi farò un salto al seminario, che peraltro mi sembra molto in linea con i miei interessi. Qui gli annunci Seminario Nazionale STS ITALIA. PLATFORM SOCIETIES AND NEW VULNERABILITIES Sapienza – Università di Roma Dipartimento di Scienze Sociali ed Economiche (DiSSE) Venerdì 8 Marzo 2018 (via Salaria 113, Aula C4, secondo piano) http://www.stsitalia.org/?p=1998&lang=en New Book out: Communities at a Crossroads: Material semiotics for online sociability in the fade of cyberculture by Annalisa Pelizza. Downloadable for free https://networkcultures.org/blog/publication/tod-28-communities-at-a-crossr… a più tardi fisicamente con alcuni e alcune di voi alvise

1 0

Make Google Do It. Interpellating digital subject/objects of desire in the gendering of artificially intelligent virtual personal assistants - Guest research seminar
by Guido Noto La Diega Feb. 26, 2019

Feb. 26, 2019

Car* NINSO (Northumbria Internet & Society Research Group) ha il piacere di invitarvi a partecipare all'incontro con Dr Rachel Adams sul tema ‘*Make Google Do It.** Interpellating digital subject/objects of desire in the gendering of artificially intelligent virtual personal assistants*.’ *Abstract. *The seminar will explore how the particular gendering of artificially intelligence virtual personal assistants as female through their names, characterisations and marketing, meets with an imperative grammar with which users are to engage with them, most notably with the call “Hey Siri!” or “Hey Alexa!” Drawing on Louis Althusser and Judith Butler’s accounts of interpellation, I discuss how the gendering of these devices coupled with the new techno-crafted grammar given to engage with them, plays into a broader history of female automata produced as both subjects to and objects of a male desire to (literally) constitute, control and command the female. Thus, expanding on the current account of female gendered virtual personal assistants as a strategy for softening the transition from a traditional past to a disruptive digital future, I argue that, more critically, this gendering re-inscribes and legitimises a historically embedded male desire which works, primarily, to ensure the female is always in a subject to/object of relationship to their male “user”/maker, without agency to attain her own status as subject. *Dove*: Faculty of Business and Law (CCE1), room 405 (ma *se non potete venire,* l'incontro sara' registrato e pubblicato sul nostro canale YouTube!) *Quando*: Wednesday 6th March 2019 alle 12 Il link per la registrazione e' https://www.eventbrite.co.uk/e/make-google-do-it-tickets-56349087638. A presto, Guido Guido Noto La Diega, PhD FHEA Senior Lecturer / European Research Partnerships Coordinator @ Northumbria Law School Director @italiot | Fellow @nexacenter | Co-convenor @NINSOrig | Co-founder @DPA2018 Northumbria Law School City Campus East, Newcastle upon Tyne NE1 8ST noto.la.diega(a)gmail.com +44(0)191 349 5562 You can access my papers on Academia.edu <http://northumbria.academia.edu/GuidoNotoLaDiega> and on the Social Science Research Network (SSRN <https://papers.ssrn.com/sol3/cf_dev/AbsByAuth.cfm?per_id=1794950>) This e-mail and any attachment hereto are strictly confidential and are exclusively intended for the person above identified. Without intended recipient’s entitlement, use, copy and dissemination of this e-mail is prohibited. If you have received it in error, please advice us immediately by telephone and return the documents received to the above address, deleting the files. Thank you. Unless necessary, please do not print this e-mail.

3 4

Segnalazione
by Cristina Iuli Feb. 26, 2019

Feb. 26, 2019

Buongiorno a tutti, mi permetto di segnalare una pubblicazione che ritengo possa essere d'interesse agli iscritti alla newsletter di Nexa. Si tratta del n. 54 della rivista McSweeney's intitolata "The End of Trust. An investigation of surveillance in the digital age". Contiene, tra le altre cose, una lunga intervista a Snowden intitolata "Edward Snowden Explains Blockchain to His Lawyer - and the Rest of Us". Saluti cordiali, Cristina Iuli Maria Cristina Iuli Lingua e Letteratura Nordamericana Dipartimento Studi Umanistici Università del Piemonte Orientale Piazza S. Eusebio, 3 13100 Vercelli ITALY Tel 0039 0161 222 8304 Fax 0039 0161 269959

1 0

67° Nexa Lunch Seminar | 27 febbraio 2019
by Nexa Media Feb. 25, 2019

Feb. 25, 2019

Nexa Center for Internet and Society Newsletter Se non visualizzi correttamente questo messaggio clicca qui <http://nexa.polito.it/lunch-67> NEXA 67° Nexa Lunch Seminar Mercoledi 27 febbraio 2019, ore 13.00 - 14.00 Politecnico di Torino http://nexa.polito.it/lunch-67 Follow the thing: li-ion battery Speaker Alberto Valz Gris (FULL - Politecnico di Torino) This event will be webcast live: https://nexa.polito.it/nexa-hangout-on-air Li-ion batteries are constructed through a complex production network spanning a significant portion of the planet. From raw materials extraction across the Southern hemisphere to cell production in the Northern one, their geographies mobilise urban theory well beyond its conventional site: cities. Through a multi-sited and relational research practice, the project aims at articulating *the role of production networks and emerging technologies in unequal processes of urbanisation at the planetary scale*. The talk will focus on broadly quantitative data describing the planetary scenario of the li-ion commodity chain as well as more detailed empirical data collected through the first of a series of mobile ethnographies across the Chilean-Argentinian lithium-rich Atacama plateau. /Ingresso libero - Sarà disponibile un leggero rinfresco per coloro che si saranno registrati su http://lunch67.eventbrite.com entro il 25 febbraio./ BIOGRAFIE - e informazioni supplementari [VAlzGris] *Alberto VALZ GRIS* is a PhD candidate in urban geography at the Polytechnic University of Turin and part of the Future Urban Legacy Lab <http://urbanlegacylab.net/>. His doctoral research focuses on emerging processes urbanisation at the planetary scale through global production networks and the automation of labour. Letture consigliate e link utili: * Merchant, B. (2017) /The One Device/. London: Bantam Press. * Frankel, T. & Whoriskey, P. (2016, December 19)/Tossed Aside in the 'White Gold' Rush/ <https://www.washingtonpost.com/graphics/business/batteries/tossed-aside-in-…>. The Washington Post. * JCook, I., Evans, J., Griffiths, H., Morris, R., & Wrathmell, S. (2007). /It’s more than just what it is’: Defetishising commodities, expanding fields, mobilising change…./ Geoforum, 38(6), 1113-1126. * Marcus, G. E. (1995)./Ethnography in/of the world system: The emergence of multi-sited ethnography/. "Annual review of anthropology", 24(1), 95-117. * Roy, A. (2009). /The 21st-century metropolis: new geographies of theory/. "Regional Studies". 43(6), 819-830. * Brenner, N. (2014)./Implosions/explosions. Towards a Study of Planetary Urbanization/. Berlin: Jovis. Che cosa sono il Centro Nexa e i cicli di incontri “Mercoledì di Nexa” e “Nexa Lunch Seminar” #lunch67 <https://twitter.com/search?f=tweets&q=%23lunch67&src=typd> #urbanisation <https://twitter.com/hashtag/urbanisation?src=hash> #lionbattery <https://twitter.com/search?f=tweets&q=%23lionbattery&src=typd> Il Centro Nexa su Internet & Società del Politecnico di Torino (Dipartimento di Automatica e Informatica) è un centro di ricerca indipendente e interdisciplinare che studia Internet e il suo effetto sulla società. Maggiori informazioni all'indirizzo: http://nexa.polito.it/about. Durante i “*Mercoledì di Nexa*”, che si tengono *ogni 2° mercoledì del mese* alle *ore 18 in punto*, il Centro Nexa su Internet e Società apre le sue porte non solo agli esperti e a tutti coloro i quali lavorano con Internet, ma anche a semplici appassionati e cittadini. Il ciclo di incontri intende approfondire, con un linguaggio preciso ma divulgativo, i temi legati alla Rete: motori di ricerca, Creative Commons, social networks, open source/software libero, neutralità della rete, libertà di espressione, privacy, file sharing, big e open data, smart cities e molto altro. Al centro di quasi tutti gli incontri un ospite pronto a dialogare con i direttori del Centro Nexa, il Prof. Juan Carlos De Martin del Politecnico di Torino e il Prof. Marco Ricolfi dell'Università di Torino, nonché lo staff e i Fellows del Centro Nexa. Maggiori informazioni sui Mercoledì di Nexa, incluso un elenco di tutti i “Mercoledì” passati, sono disponibili all'indirizzo: http://nexa.polito.it/mercoledi. Si segnala inoltre che dal maggio 2012 *ogni 4° mercoledì* del mese *dalle ore 13 alle ore 14* il Centro Nexa organizza anche i "*Nexa Lunch Seminar*". Una lista di tutti i “Lunch Seminar” passati è disponibile all'indirizzo: http://nexa.polito.it/lunch-seminars. See our events calendar <http://nexa.polito.it/events> if you're curious about future luncheons, discussions, lectures, and conferences not listed in this email. Our events are free and open to the public, unless otherwise noted. Responsabile Comunicazione Centro Nexa su Internet & Società: *Francesco Ruggiero*, tel: +39 011 090 7219, Mob: +39 349 1335082, francesco.ruggiero(a)polito.it <mailto:francesco.ruggiero@polito.it>. Maggiori informazioni sui Mercoledì di Nexa e i Nexa Lunch Seminar, sono disponibili all'indirizzo: http://nexa.polito.it/events. Weekly Events Newsletter. Sign up <http://nexa.polito.it/mailing-lists> to receive this newsletter if this email was forwarded to you. To manage your subscription preferences, please click here <https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa>. Connect & get involved: Jobs, internships, and more <http://nexa.polito.it/get-involved>.

1 1

The case of the supersized shebang
by Giacomo Tesio Feb. 25, 2019

Feb. 25, 2019

The array used to hold the shebang line is defined to be 128 bytes in length. That naturally leads to the question of what happens if the line exceeds that length. In current kernels, the line will simply be truncated to fit the buffer, after which execution proceeds as normal. Or, at least, as normal as can be expected given that part of the shebang line is now missing. Recently, Oleg Nesterov decided that this behavior is wrong; it could cause misinterpreted arguments or, should the truncated line happen to be the valid name of an interpreter executable in it own right, run the wrong interpreter entirely. He put together a patch (merged for 5.0-rc1) changing that behavior; the kernel would fail the attempt to find an alternative interpreter entirely in that situation, causing a fallback to the default shell. [...] One might well wonder just how things worked before, since a truncated version of that shebang line is still wrong. It turns out that the Perl interpreter is able to detect this truncation; it rereads the first line itself and sets its arguments properly. As long as the interpreter itself is the correct one, things will work as expected. As of 5.0-rc1, though, the correct interpreter would no longer be invoked, and things went downhill from there. The kernel project's policy on this kind of change is clear, but Linus Torvalds reiterated it in this case anyway: > It doesn't matter if it "corrupted" things by truncating it. > All that matters is "it used to work, now it doesn't" > Yes, maybe it never *should* have worked. And yes, > it's sad that people apparently had cases that depended > on this odd behavior, but there we are. [...] Had that been the end of the story, it would have been just another case of a regression introduced during the merge window, then corrected during the stabilization period. But, as it happens, this change found its way into the 4.20.8, 4.19.21, 4.14.99, and 4.9.156 stable kernel updates, despite the fact that neither the author nor the maintainer who merged it (Andrew Morton) had marked it for stable backporting. [...] Nesterov's patch had been automatically selected for backporting by Sasha Levin's machine-learning system. https://lwn.net/SubscriberLink/779997/11de2bdc8dbc0d69/ Non so davvero se sia più inquietante che la sicurezza informatica dei sistemi Linux dipenda da un software che calcola quali patch distribuire come stabili o... che bug vecchi di 50 anni non vengono corretti solo perché Perl ha imparato a sopravvivere con essi. Giacomo

1 0

Discovery of cameras built into airlines’ seats sparks privacy concerns - The Verge
by J.C. DE MARTIN Feb. 24, 2019

Feb. 24, 2019

https://www.theverge.com/2019/2/22/18235979/camera-airplane-inflight-entert… (Sent from my wireless device; please excuse brevity and typos (if any))

1 0

Microsoft Employees Are Demanding The Company Cancel Its HoloLens Contract With The US Army
by Stefano Zacchiroli Feb. 23, 2019

Feb. 23, 2019

“We did not sign up to develop weapons,” says an employee letter to Microsoft executives published Friday. A group of Microsoft employees is circulating a letter among the company’s over 130,000-person staff demanding that executives cancel a $479 million contract with the US Army. [...] Continua qui: https://www.buzzfeednews.com/article/carolineodonovan/microsoft-hololens-ar… -- Stefano Zacchiroli . zack(a)upsilon.cc . upsilon.cc/zack . . o . . . o . o Computer Science Professor . CTO Software Heritage . . . . . o . . . o o Former Debian Project Leader & OSI Board Director . . . o o o . . . o . « the first rule of tautology club is the first rule of tautology club »

1 0

Vaccino o non vaccino?
by don Luca Peyron Feb. 23, 2019

Feb. 23, 2019

Una nobile - o per altri non giusta decisione - ma a leggere fino in fondo si scopre che... Buona lettura e buona domenica dl https://www.corriere.it/esteri/19_febbraio_23/vaccini-youtube-mette-bando-v… _________________________ www.universitari.to.it via XX settembre 83, Torino tel. 011 5156239

1 0

Public hacker test on Swiss Post’s e-voting system
by Giacomo Tesio Feb. 22, 2019

Feb. 22, 2019

Public Intrusion Test (PIT) Swiss Post will be carrying out resilience testing, also known as a public intrusion test (PIT), on its e-voting system between 25 February and 24 March 2019. During the test, hackers and other independent IT specialists can challenge the Swiss Post e-voting system with deliberate attacks. [...] Why is Swiss Post performing an intrusion test on its e-voting system? Swiss Post believes that only a transparent e-voting solution can be successful in the long term. By opening it up to an intrusion test, it is exposing its system to the intelligence and skill of sophisticated hackers to identify whether, when and how its e-voting system can be compromised. It will incorporate the results of the intrusion test into the development of its e-voting system. Swiss Post will identify and rectify any vulnerabilities that may be found. Last but not least, the intrusion test should also establish hard facts and thereby contribute to a fact-based discussion of e-voting. Intrusion tests are an established procedure within the IT field and are a standard part of developing many IT systems. https://www.evoting-blog.ch/en/pages/2019/public-hacker-test-on-swiss-post-…

3 3