- nexa - server-nexa.polito.it

"The DNC Breach and the Hijacking of Common Sense"
by J.C. DE MARTIN Aug. 10, 2016

Aug. 10, 2016

*The DNC Breach and the Hijacking of Common Sense* /Jeffrey Carr// //author, 'inside Cyber Warfare' (O'Reilly Media 2009, 2011); CEO, Taia Global, Inc.; Founder, Suits and Spooks conference/ June 19, 2016 This article is about the DNC breach and its attribution to the Russian government. But first, imagine that the DNC breach wasn’t a network breach but a shooting (no one was injured). No one knows who the shooter was but he left behind his weapon, a Kalishnikov AKM. The unknown shooter used a Russian-made weapon. Does that mean that the shooter is Russian? Or that the shooter works for the company, Kalishnikov Concern? Or even more likely in the crazy world of cyber investigations, that the designer of the AKM is also the shooter? Police would certainly explore the possibility that the shooter may have been Russian but they wouldn’t exclude other suspects. And no investigator in his right mind would arrest the CEO of Remington Arms, Sig Sauer, Kalishnikov Concern or any other arms manufacturer because a gun they made was used in a crime. In the physical world of crime investigation, common sense dictates that the perpetrator of a crime may use any weapon and not just one made in the country of his birth, and that the developer or manufacturer of the weapon most likely isn’t the criminal. And yet, those seemingly crazy assumptions are made every day by cybersecurity companies involved in incident response and threat intelligence. The malware was written in Russian? It was a Russian who attacked you. Chinese characters in the code? You’ve been hacked by the Peoples Liberation Army. […] Continua qui: https://medium.com/@jeffreycarr/the-dnc-breach-and-the-hijacking-of-common-…

1 0

LAT: "Want cheaper Internet access? Hand over your privacy "
by J.C. DE MARTIN Aug. 10, 2016

Aug. 10, 2016

Los Angeles Times *Want cheaper Internet access? Hand over your privacy** * /David Lazarus// / It seems a simple enough proposition: Would you agree to receive marketing pitches in return for a discount on your high-speed Internet service? Telecom heavyweight Comcast made just such a case last week in a filing with the Federal Communications Commission. The company defended what it called “a bargained-for exchange of information for service,” which it said “is a perfectly acceptable and widely used model throughout the U.S. economy.” […] Continua qui: http://www.latimes.com/business/lazarus/la-fi-lazarus-privacy-discount-2016…

1 0

Slashdot: "White House Releases Federal Source Code Policy To Help Government Agencies Go Open Source"
by Marco Ciurcina Aug. 9, 2016

Aug. 9, 2016

https://yro.slashdot.org/story/16/08/08/2326222/white-house-releases-federa… White House Releases Federal Source Code Policy To Help Government Agencies Go Open Source The U.S. federal government just released a new Federal Source Code policy (PDF). For each of the next 3 years, at least 20 percent of custom-developed Federal source code is to be released as open-source software. Earlier this year, Tony Scott, Federal CIO of the U.S. government, wrote on the White House blog that the U.S. government "can save taxpayer dollars by avoiding duplicative custom software purchases and promote innovation and collaboration across Federal agencies." Today, they released the Federal Source Code policy. TechCrunch reports: "The main requirement is that any new custom source code developed 'by or for the Federal Government' has to be made available for sharing and re-use by all Federal agencies. For example, this means that the TSA can have access to custom made software that was commissioned by the FBI. Considering there is probably a great deal of overlap in applications needed by certain branches of the Federal Government, this rule alone should save the government (and taxpayers) a great deal of money. In fact, the policy states that 'ensuring Government-wide reuse rights for custom code that is developed using Federal funds has numerous benefits for American taxpayers.'"

1 0

Paper: "Personalized Learning: The Conversations We’re Not Having"
by J.C. DE MARTIN Aug. 8, 2016

Aug. 8, 2016

*Personalized Learning: The Conversations We’re Not Having** * Data & Society Working Paper 07.22.2016 MONICA BULGER *Abstract* The pursuit of personalized education at a mass scale drives a number of current education technology initiatives that fall under the broad umbrella of personalized learning. The personalized learning space has seen a huge infusion of capital in recent years, with notable support from the Bill & Melinda Gates Foundation and a range of other investors, philanthropists, and technologists. Federal support for personalized learning has come through Obama’s Race to the Top program and, looking ahead, will come through the recently passed Every Student Succeeds Act’s provision for competency-based assessments. The story of personalized learning is a complex one in which education technology developers are applying startup logics like risk taking and testing in the field and marketing tactics like personalized content delivery and recommender systems. Their products are designed to meet the needs of states and administrators, who seek to improve efficiency and performance through formative testing and tailored learning modules, but they are often narrated differently to the public. The promise of technologically enabled personalized learning – that through technology we can democratize access to information and instruction, scale excellence across the socioeconomic spectrum, and do so with efficiency and rigor – is a familiar one to educators. And yet there are tensions between the promises of personalized learning, the state-of-its-art, and the practical realities of its implementation. As a buzzword symbolizing the potential of data use in education, personalized learning enjoys a broad definitional reach and is aligned by proponents with educational best practices like “student-centered instruction.” At its best, personalized learning represents a pedagogy of adaptation to students’ unique combination of goals, interests, and competencies. But many so-called personalized learning platforms are more responsive than adaptive, as they provide materials appropriate to students’ proficiency levels without moving beyond a pre-determined decision tree. They do this by analyzing student data such as age, gender, grade level, and test performance against idealized models based on data sets of students with similar demographics, then offering content recommendations directly to the student or to the teacher for further intervention. The widespread adoption of personalized learning platforms may lead to unintended consequences. For example, the focus on performance may negatively affect students’ psychological wellbeing by promoting individualist notions of achievement and undermining the social dimensions of learning. With the wealth of data that such systems generate, it becomes possible to track and report students’ progression, reinforcing a laser focus on numbers and performance metrics which may undermine other key facets of learning, while forcing teachers to support algorithmic logics rather than leverage their knowledge about education. In addition, data-driven personalized learning algorithms depend upon data points but there is a lack of transparency over what data points are collected, how they are used, and who is permitted access, leading to the recent sharp uptick in proposed national and state student data privacy legislation. Full PDF here: http://www.datasociety.net/pubs/ecl/PersonalizedLearning_primer_2016.pdf

2 1

Guardian: "Universities are tracking their students. Is it clever or creepy?"
by J.C. DE MARTIN Aug. 8, 2016

Aug. 8, 2016

*Universities are tracking their students. Is it clever or creepy?* /Learning analytics are becoming increasingly popular for improving learning and cutting drop-out rates – but critics question the impact on privacy/ Chris Jutting Wednesday 3 August 2016 14.19 BST What could be more normal that heading to the university library, swiping your card and logging in to a computer? Most students wouldn’t think twice about it. But what they may not realise is that this mundane series of events leaves a unique data pattern that can be recorded, logged and reviewed, in a practice known as “learning analytics”. And now data analysts are using this information to predict whether students will struggle with their courses, or drop out. “We’re trying to use data to improve our understanding of how students learn,” says Dr Bart Rienties, director of the learning analytics programme at the Open University. “We want to understand the story behind that data.” Such techniques look set to become an integral part of university life in the future, much to the delight of advocates. “Learning analytics can provide a more personal learning experience, rather than a one-size-fits-all solution,” Rienties says. He was part of a new study – which analysed data from more than 113,000 students at the Open University – looking at drop-out rates and how usage patterns of online learning resources can be an early indicator of academic performance. […] Continua qui: https://www.theguardian.com/higher-education-network/2016/aug/03/learning-a…

4 5

Paper: "The Myth of Accountability: How Data (Mis)Use is Reinforcing the Problems of Public Education"
by J.C. DE MARTIN Aug. 8, 2016

Aug. 8, 2016

*The Myth of Accountability:** **How Data (Mis)Use is Reinforcing the** **Problems of Public Education* Data & Society Working Paper 08.08.2016 CLAIRE FONTAINE *Introduction *There is an ongoing tension in the American public education system between the values of excellence, equity, and efficiency. Accountability has emerged as a framework in education reform that promises to promote and balance all three values. Yet this frame is often contested due to disagreements over the role of incentives and penalties in achieving desirable change, and concerns that the proposed mechanisms will have significant unintended consequences that outweigh potential benefits. More fundamentally, there is widespread disagreement over how to quantify excellence and equity, if it is even possible to do so. Accountability rhetoric echoes a broader turn toward data-driven decision- making and resource allocation across sectors. As a tool of power, accountability processes shift authority and control to policymakers, bureaucrats, and test makers over professional educators. Today, measurements of school performance have become so commonplace that they are an assumed part of education debates. As new forms of data are easier to collect and analyze, drawing on and interacting with information to measure the impact of programs and to inform decision-making and policy has emerged as a key strategy to foster improvement in public schools (Coburn and Turner 2012). But when did our national obsession with educational data start? What are the historic precursors to accountability as we now know it? What set of political, economic, cultural, and social conditions led to test scores becoming the main measure of a school’s success? How do current data-driven practices compare to historical data-driven practices and how have the terms shifted over time? Who does accountability serve? What are the incentive structures, and how is accountability gamed and resisted? In short, accountability of what, to whom, for what ends, at what cost? Full PDF here: http://www.datasociety.net/pubs/ecl/Accountability_primer_2016.pdf

1 0

Fwd: [A2k] NEW! What Every Copyright Law should have to Support Libraries
by J.C. DE MARTIN Aug. 8, 2016

Aug. 8, 2016

-------- Forwarded Message -------- Subject: [A2k] NEW! What Every Copyright Law should have to Support Libraries Resent-Date: Mon, 08 Aug 2016 14:27:42 +0200 Resent-From: d004620(a)polito.it Date: Mon, 8 Aug 2016 13:20:15 +0100 From: Teresa Hackett <teresa.hackett(a)eifl.net> To: a2k(a)lists.keionline.org The EIFL Core Library Exceptions Checklist sets out provisions that every copyright law should have to support library activities and services in the 21st century, such as lending, making an electronic copy of a journal article or book chapter for a user, providing library material for use in virtual learning environments, and undertaking digital preservation. The checklist is a practical way to evaluate national copyright law, identify gaps or see where the law is doing well. It is a starting point for policy advocacy, or to propose amendments if the copyright law is being updated. The checklist is accompanied by ‘Rate my copyright law’, a handy tool to rate your national law for core library provisions. Find out more: http://www.eifl.net/news/rate-my-copyright-law-how-well-does -your-law-support-libraries ----- Teresa Hackett Copyright and Libraries Programme Manager EIFL - Electronic Information for Libraries - www.eifl.net ----- _______________________________________________ A2k mailing list A2k(a)lists.keionline.org http://lists.keionline.org/mailman/listinfo/a2k_lists.keionline.org

1 0

Re: [nexa] R: R: SPID e wi-fi federata con un sistema di accesso unico
by SASSANO ANNA PIA (ADPA) Aug. 8, 2016

Aug. 8, 2016

Gentile professor Pizzetti ho letto nella precedente e.mail dei dubbi sull'uso che Poste farebbe dei dati acquisiti quando si accede con un'autenticazione SPID ad un servizio WIFI usando PosteID e forse posso dare una mano a fare chiarezza: a) come noto l'identità PosteID è già da tempo usata dai servizi di Poste Italiane per accedere al sito o autorizzare transazioni finanziarie e solo di recente è stata anche aperta al circuito SPID. In sintesi: chi prende l'identità PosteID non solo può usarla per i servizi di Poste ma può anche utilizzarla per accedere ai servizi che hanno aderito al circuito SPID e quindi espongono il bottone "Entra con Spid" o simili; b) durante la registrazione della nuova versione dell'identità digitale PosteID, che come noto è stata oggetto di verifica in ambito AGID per l'accreditamento, viene chiesto al cliente se, per i soli servizi di Poste Italiane, vuole rilasciare le autorizzazioni all'utilizzo dei dati ai fini di contatto commerciale da parte di Poste o di profilazione, sempre da parte di Poste, in quanto clienti. Se entrate nel processo di registrazione questa fase di autorizzazione è anche accessibile da tutte le pagine andando a leggere l'informativa privacy. Vi riporto di seguito solo la prima frase: "Informativa sul trattamento dei dati personali ai sensi dell'art. 13 del D. Lgs. 196/2003 (Codice in materia di protezione dei dati personali) - Persona Fisica o soggetto assimilabile - Servizio PosteID" "[...] Poste tratterà i dati personali dell'Interessato conformemente al consenso da questi prestato, per le finalità suindicate. Con riferimento alla finalità di "profilazione", l'Interessato prende atto che in caso di consenso, il trattamento dei Suoi dati personali non riguarderà né la fase di registrazione al Servizio PosteID né l'utilizzo dei servizi erogati online dai "Fornitori di servizi" tramite il Servizio PosteID, ma potrà riguardare - a meno di specifiche richieste delle Autorità competenti inerenti, per esempio, la rilevazione di dati in forma aggregata per fini statistici - la funzione delle altre tipologie di prodotti/servizi di Poste Italiane eventualmente in essere. In caso di cessazione del Servizio PosteID ma di vigenza di almeno un prodotto e/o servizio principale con Poste Italiane, i dati dell'Interessato concernenti tale prodotto/servizio continueranno ad essere trattati da Poste nel rispetto del consenso da questi prestato. In caso di cessazione dell'unico e/o ultimo prodotto e/o servizio principale, così come degli annessi prodotti e/o servizi opzionali aggiuntivi1, i dati dell'Interessato non saranno più trattati da Poste per le finalità suindicate. [...]" c) quindi non solo Poste chiede un consenso "specifico, libero, espresso ed informato" come prevede il codice privacy ma non cede i dati a terzi. L'unica cosa che esplicitamente è prevista, sempre chiedendo il consenso privacy, è la possibilità di "comunicare i dati di profilazione alle società del Gruppo Poste Italiane". d) mi sento quindi di tranquillizzarvi che nulla può accadere senza che il cliente lo consenta ed anche ove dia tutti i consensi sul fronte dei servizi di Poste bisogna ricordare cos'è l'identità digitale SPID. E' l'Identity Provider che semmai, su autorizzazione esplicita del cliente, fornisce al Service Provider SPID (colui che gestisce il servizio di WI FI in questo esempio) i dati del titolare dell'identità che servono ad espletare il servizio. Il viceversa non esiste in natura visto che all'Identity Provider, una volta forniti i dati ed autenticato l'accesso al servizio come prevede il servizio di autenticazione Spid, nulla perviene di quanto transita poi tra cliente e fornitore. Se Vi fa piacere ed avete altre perplessità su SPID e PosteID, che possono aiutare anche noi a contribuire a fare maggiore chiarezza, sono chiaramente a Vostra disposizione. Cordiali Saluti Anna Pia Sassano (in questo caso e su questo canale, Vi rispondo chiaramente a titolo personale ma pronta a procurarvi una risposta ufficiale di Poste se vi occorre). ________________________________ La presente comunicazione elettronica contiene informazioni aziendali non private. Eventuali risposte alla presente potrebbero essere conosciute, per motivi organizzativi e di sicurezza, dal personale di Poste Italiane S.p.A.

6 18

novità normative in materia di cyberbullismo-- con potenziali rischi
by Mauro Alovisio Aug. 8, 2016

Aug. 8, 2016

Gent.me/mi segnalo novità sul disegno di legge in materia di cyberbullismo in approvazione alla Camera dei Deputati il prossimo 12 settembre. La sopra citata normativa a tutela dei minori rafforza il ruolo della scuola nella prevenzione del fenomeno ma contiene potenziali possibili rischi per libertà di espressione nell'utilizzo dei blog di tutti i cittadini: come ben rappresentatato dagli approfondimenti di Arturo Corinto <http://www.repubblica.it/tecnologia/sicurezza/2016/08/06/news/cyberbullismo…> http://www.repubblica.it/tecnologia/sicurezza/2016/08/06/news/cyberbullismo… e Fulvio Sarzana http://www.ilfattoquotidiano.it/2016/08/04/internet-si-legge-cyberbullismo-… Buona estate Mauro Alovisio

1 0

Irraggiungibilità nexa.polito.it e mailing-list il 12/08/16
by Davide Allavena Aug. 6, 2016

Aug. 6, 2016

Buongiorno, A causa di un intervento di manutenzione alla linea elettrica programmato dal Politecnico comunico che il 12 Agosto 2016. Nel caso in cui l'intervento proceda come previsto l'interruzione avverrà dalle 8,00 alle 17:00. Durante quell'intervallo di tempo il sito nexa.polito.it e le mailing list associate non saranno raggiungibili. Resto a disposizione per eventuali chiarimenti. Scusate per il disagio, buona giornata Davide Allavena -- Davide Allavena IT Manager & Research Fellow Nexa Center for Internet and Society DAUIN - Politecnico di Torino https://nexa.polito.it/people/dallavena

1 1