Salta al contenuto principale



Anthropic (contesa da Amazon) si affida ai microchip di Google

L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Anthropic annuncia un nuovo accordo multimiliardario per utilizzare i microchip proprietari di Google. Anche un'altra "big tech", Amazon, ha grandi progetti per la startup di intelligenza startmag.it/innovazione/anthro…

reshared this



The Canadian Centre for Child Protection found more than 120 images of identified or known victims of CSAM in the dataset.

The Canadian Centre for Child Protection found more than 120 images of identified or known victims of CSAM in the dataset.#News


AI Dataset for Detecting Nudity Contained Child Sexual Abuse Images


A large image dataset used to develop AI tools for detecting nudity contains a number of images of child sexual abuse material (CSAM), according to the Canadian Centre for Child Protection (C3P).

The NudeNet dataset, which contains more than 700,000 images scraped from the internet, was used to train an AI image classifier which could automatically detect nudity in an image. C3P found that more than 250 academic works either cited or used the NudeNet dataset since it was available download from Academic Torrents, a platform for sharing research data, in June 2019.

“A non-exhaustive review of 50 of these academic projects found 13 made use of the NudeNet data set, and 29 relied on the NudeNet classifier or model,” C3P said in its announcement.

C3P found more than 120 images of identified or known victims of CSAM in the dataset, including nearly 70 images focused on the genital or anal area of children who are confirmed or appear to be pre-pubescent. “In some cases, images depicting sexual or abusive acts involving children and teenagers such as fellatio or penile-vaginal penetration,” C3P said.

People and organizations that downloaded the dataset would have no way of knowing it contained CSAM unless they went looking for it, and most likely they did not, but having those images on their machines would be technically criminal.

“CSAM is illegal and hosting and distributing creates huge liabilities for the creators and researchers. There is also a larger ethical issue here in that the victims in these images have almost certainly not consented to have these images distributed and used in training,” Hany Farid, a professor at UC Berkeley and one of the world’s leading experts on digitally manipulated images, told me in an email. Farid also developed PhotoDNA, a widely used image-identification and content filtering tool. “Even if the ends are noble, they don’t justify the means in this case.”

“Many of the AI models used to support features in applications and research initiatives have been trained on data that has been collected indiscriminately or in ethically questionable ways. This lack of due diligence has led to the appearance of known child sexual abuse and exploitation material in these types of datasets, something that is largely preventable,” Lloyd Richardson, C3P's director of technology, said.

Academic Torrents removed the dataset after C3P issued a removal notice to its administrators.

"In operating Canada's national tipline for reporting the sexual exploitation of children we receive information or tips from members of the public on a daily basis," Richardson told me in an email. "In the case of the NudeNet image dataset, an individual flagged concerns about the possibility of the dataset containing CSAM, which prompted us to look into it more closely."

C3P’s findings are similar to 2023 research from Stanford University’s Cyber Policy Center, which found that LAION-5B, one of the largest datasets powering AI-generated images, also contained CSAM. The organization that manages LAION-5B removed it from the internet following that report and only shared it again once it had removed the offending images.

"These image datasets, which have typically not been vetted, are promoted and distributed online for hundreds of researchers, companies, and hobbyists to use, sometimes for commercial pursuits," Richardson told me. "By this point, few are considering the possible harm or exploitation that may underpin their products. We also can’t forget that many of these images are themselves evidence of child sexual abuse crimes. In the rush for innovation, we’re seeing a great deal of collateral damage, but many are simply not acknowledging it — ultimately, I think we have an obligation to develop AI technology in responsible and ethical ways."

Update: This story has been updated with comment from Lloyd Richardson.


#News

Breaking News Channel reshared this.



L’Ai di Perplexity lascia perplesso Reddit (che le tende una trappola)

L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁)
Le aziende che sul Web detengono grandi quantità di dati hanno iniziato a sottoscrivere accordi di licenza con le software house delle Ai per non vedere i propri contenuti usati illecitamente, ma

reshared this



Tiny UPS Keeps WiFi Online


For any mission-critical computer system, it’s a good idea to think about how the system will handle power outages. At the very least it’s a good idea to give the computer enough time to gracefully shut down if the power outage will last for an indefinite time. But for extremely critical infrastructure, like our home Wi-Fi, we might consider a more long-term battery backup that can let us get through the longest of power outages.

Part of why this project from [ ] works so well is that most off-the-shelf routers don’t actually use that much energy. Keeping that and a modem online when the power is out only requires a few lithium batteries. To that end, three lithium ion cells are arranged in series to provide the router with between 9 and 12 volts, complete with a battery management system (BMS) to ensure they aren’t over- or under-charged and that they are balanced. The router plugs directly into a barrel jack, eliminating any switching losses from having to use an inverter during battery operation.

While [ ] is a student who lives in an area with frequent interruptions to the electricity supply, this does a good job of keeping him online. If you’re planning for worse or longer outages, a design like this is easily adapted for more batteries provided the correct BMS is used to keep the cells safely charged and regulated. You can also adapt much larger UPS systems to power more of your home’s electrical system, provided you can find enough batteries.


hackaday.com/2025/10/24/tiny-u…

reshared this




The Isetta TTL Computer Makes Some Noise


Our Hackaday colleague [Bil Herd] is known for being the mind behind the Commodore 128, a machine which famously had both a 6502 and a Z80 processor on board. The idea of a machine which could do the job of both those processors in hardware while containing neither would have blown the mind of any 1980s computer enthusiast, yet that’s exactly what [Roelh]’s Isetta TTL computer does. It’s an extremely clever design whose targeted microcode allows the processor-swap trick, and since he’s brought it from prototype to production and has it running SymbOS since we last saw it, it’s time we gave it another look.
A diagram showing chip placement on the Isetta PCB.All the functions on what is a surprisingly compact board.
The video below the break shows the machine in action, with the Windows 95-like SymbOS GUI running a series of sound tests in the emulated AY-3-8910 sound generator, as well as a Lemmings-like game. It also runs Sinclair ZX Spectrum software, giving it access to a huge library.

We were lucky enough to see some of this in person when we encountered it for a second time on our travels during the summer — and it’s just as impressive in the real as it looks in the video. The feeling really hits you of how this would have blown away anything on the 8-bit market in 1985, made more impressive by the silicon in use being not too far from what was available at the time.

We’re told you can now buy one for yourself as a kit, and we’re looking forward to seeing it generate an ecosystem. We’re particularly curious as to whether that retargetable microcode could allow it to support other archetctures of the day.

Our original coverage can be read here, and we’ve also touched upon SymbOS.

youtube.com/embed/EDrEPg-4vi4?…


hackaday.com/2025/10/24/the-is…



Andreessen Horowitz is funding a company that clearly violates the inauthentic behavior policies of every major social media platform.#News #AI #a16z


a16z-Backed Startup Sells Thousands of ‘Synthetic Influencers’ to Manipulate Social Media as a Service


A new startup backed by one of the biggest venture capital firms in silicon valley, Andreessen Horowitz (a16z), is building a service that allows clients to “orchestrate actions on thousands of social accounts through both bulk content creation and deployment.” Essentially, the startup, called Doublespeed, is pitching an astroturfing AI-powered bot service, which is in clear violation of policies for all major social media platforms.

“Our deployment layer mimics natural user interaction on physical devices to get our content to appear human to the algorithims [sic],” the company’s site says. Doublespeed did not respond to a request for comment, so we don’t know exactly how its service works, but the company appears to be pitching a service designed to circumvent many of the methods social media platforms use to detect inauthentic behavior. It uses AI to generate social media accounts and posts, with a human doing 5 percent of “touch up” work at the end of the process.

On a podcast earlier this month, Doublespeed cofounder Zuhair Lakhani said that the company uses a “phone farm” to run AI-generated accounts on TikTok. So-called “click farms” often use hundreds of mobile phones to fake online engagement of reviews for the same reason. Lakhani said one Doublespeed client generated 4.7 million views in less than four weeks with just 15 of its AI-generated accounts.

“Our system analyzes what works to make the content smarter over time. The best performing content becomes the training data for what comes next,” Doublespeed’s site says. Doublespeed also says its service can create slightly different variations of the same video, saying “1 video, 100 ways.”

“Winners get cloned, not repeated. Take proven content and spawn variation. Different hooks, formats, lengths. Each unique enough to avoid suppression,” the site says.
One of Doublespeed's AI influencers
Doublespeed allows clients to use its dashboard for between $1,500 and $7,500 a month, with more expensive plans allowing them to generate more posts. At the $7,500 price, users can generate 3,000 posts a month.

The dashboard I was able to access for free shows users can generate videos and “carousels,” which is a slideshow of images that are commonly posted to Instagram and TikTok. The “Carousel” tab appears to show sample posts for different themes. One, called “Girs Selfcare” shows images of women traveling and eating at restaurants. Another, called “Christian Truths/Advice” shows images of women who don’t show their face and text that says things like “before you vent to your friend, have you spoken to the Holy Spirit? AHHHHHHHHH”

On the company’s official Discord, one Doublespeed staff member explained that the accounts the company deploys are “warmed up” on both iOS and Android, meaning the accounts have been at least slightly used, in order to make it seem like they are not bots or brand new accounts. Doublespeed cofounder Zuhair Lakhani also said on the Discord that users can target their posts to specific cities and that the service currently only targets TikTok but that it has internal demos for Instagram and Reddit. Lakhani said Doublespeed doesn’t support “political efforts.”

A Reddit spokesperson told me that Doublespeed’s service would violate its terms of service. TikTok, Meta, and X did not respond to a request for comment.

Lakhani said Doublespeed has raised $1 million from a16z as part of its “Speedrun” accelerator program “a fast‐paced, 12-week startup program that guides founders through every critical stage of their growth.”

Marc Andreessen, after whom half of Andreessen Horowitz is named, also sits on Meta’s board of directors. Meta did not immediately respond to our question about one of its board members backing a company that blatantly aims to violate its policy on “authentic identity representation.”

What Doublespeed is offering is not that different than some of the AI generation tools Jason has covered that produce a lot of the AI-slop flooding social media already. It’s also similar, but a more blatant version of an app I covered last year which aimed to use social media manipulation to “shape reality.” The difference here is that it has backing from one of the biggest VC firms in the world.


#ai #News #a16z

Breaking News Channel reshared this.



“Ho vissuto in una famiglia cattolica, dove mia madre e mio padre erano molto attivi in parrocchia. A mia madre, negli anni Settanta, quando si parlava molto di uguaglianza tra uomo e donna, è stato chiesto: ‘Volete essere uguali agli uomini?’.


Quel guanto finito nella melma…


@Giornalismo e disordine informativo
articolo21.org/2025/10/quel-gu…
Per anni si è detto che nella storia della Sicilia vi fosse un prima ed un dopo, racchiuso in una data: 6 gennaio 1980. La data dell’uccisione di uno dei politici migliori e perbene della mia Terra, Piersanti Mattarella. È uno sbaglio. Quella data ha dentro una storia – che ho





Per superare “resistenze, paure e incomprensioni” nel processo di una Chiesa sinodale, occorre “dare priorità alla formazione, a tutti i livelli”.


“Dobbiamo tutti prendere sul serio la chiamata di Papa Francesco ad ascoltare il grido della terra e a dare una risposta di fede a ciò che succede nel mondo”.


This week, we discuss Pavlovian Chartbeat response, when to say "cum," and the wave of making things for humans, by humans.#BehindTheBlog


Behind the Blog: Making Things for Humans


This is Behind the Blog, where we share our behind-the-scenes thoughts about how a few of our top stories of the week came together. This week, we discuss Pavlovian Chartbeat response, when to say "cum," and the wave of making things for humans, by humans.

JOSEPH: Right now I’m in the midst of upgrading a bunch of my podcasting and related gear. I’m using the same kinda cheap to midrange web cam I got when we first launched 404 Media. My mic is fine but now that a fair number of people listen to the pod, and we want to grow it, it’s time to invest in some new tech. Jason has already done this, I’m more following his lead. I used to be very into cameras, tech, gadgets, mics, but it’s been a few years.

Because the four of us are spread all over, we can’t do the popular aesthetic of everyone sitting on a chair or sofa chatting in a podcast studio. That stuff obviously performs better on video/YouTube, which is where podcast discovery often happens now. But we can try to make our remotely recorded podcast look as good as we can. Give people something to actually look at.

This post is for subscribers only


Become a member to get access to all content
Subscribe now





Deep, la scommessa subacquea di Fincantieri tra AI, droni e sicurezza

@Notizie dall'Italia e dal mondo

Nella profondità dei fondali si gioca una parte crescente della sicurezza globale, tra reti energetiche, infrastrutture, comunicazioni e servizi essenziali per la vita di tutti. È in questo scenario che Fincantieri ha presentato Deep, un sistema di droni subacquei integrati con intelligenza artificiale e controllo digitale.



Mi hanno spedito un pacco con UPS, al mio indirizzo di casa. Vorrei cambiare l'indirizzo e farlo depositare ad un UPS Point, tanto me lo consegneranno sicuramente quando non sono a casa quindi meglio farlo andare lì e poi me lo vado a prendere con calma.

Vado sul sito UPS, l'opzione è disponibile, scelgo quindi di ricevere il pacco presso un UPS Point. Il sito mi propone quello più vicino a casa ma c'è anche una mappa con tutti gli altri in zona, scelgo quello che per me è più comodo.

Nella pagine del riepilogo finale, prima di confermare il cambiamento di destinazione, trovo scritto l'UPS Point più vicino a casa.

Rifaccio e rifaccio e rifaccio la procedura, niente, nonostante io scelga sempre quell'UPS Point alla fine della procedura mi ricompare sempre l'UPS più vicino a casa.

Chiedo assistenza, mi risponde il cretino digitale in chat che ovviamente non capisce nulla.

Dai e dai riesco a farmi dare un numero di telefono, mi risponde un cretino digitale sotto forma di voce registrata che mi fa le domande del caso poi ad un certo punto mi fa una domanda a cui rispondo "sì". Non capisce e mi chiede di ripetere, ripeto "sì" (da notare che fino a quel punto ci ero arrivato, quindi la parte prima l'aveva capita bene).

A questo punto comincia a parlare in inglese, ma non in inglese-inglese... sono frasi inglesi ma pronunciate come se le leggesse in italiano, e quindi diventano incomprensibili.

Niente, rinuncio.

Però che bello il servizio assistenza di UPS... proprio roba di qualità.

#UPS

#UPS
in reply to Max - Poliverso 🇪🇺🇮🇹

è il bello dell'era dell'IA, si pensa che gli esseri umani non servano più.

Prova con Bartolini e fammi sapere 😐



Hackaday Podcast Episode 343: Double Component Abuse, a Tinkercad Twofer, and a Pair of Rants


This week, Hackaday’s Elliot Williams and Kristina Panos met up across the universe to bring you the latest news, mystery sound, and of course, a big bunch of hacks from the previous seven days or so.

In Hackaday news, OMG Supercon is almost here! And we just revealed the badge! In other news, we’ve still got a contest running. Read all about the 2025 Component Abuse Challenge, sponsored by DigiKey, and check out the contest page for all the details.

On What’s That Sound, Kristina failed spectacularly. Will you fare better and perhaps win a Hackaday Podcast t-shirt? Mayhap you will.

After that, it’s on to the hacks and such, beginning with a really cool entry into the Component Abuse Challenge wherein a simple transmission line is used to multiply a voltage. We watch as a POV globe takes to the skies, once it has enough motors.

Then we discuss several awesome hacks such as an incredible desk that simulates beehive activity, a really great handheld PC build, and a Tinkercad twofer. Finally, we discuss the future of removable batteries, and the history of movable type.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

html5-player.libsyn.com/embed/…

Download in DRM-free MP3 and savor at your leisure.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:



Episode 343 Show Notes:

News:



What’s that Sound?



Interesting Hacks of the Week:



Quick Hacks:



Can’t-Miss Articles:



hackaday.com/2025/10/24/hackad…



Microreattori e sicurezza nazionale. La scommessa del Pentagono

@Notizie dall'Italia e dal mondo

Basi militari americane alimentati in territorio (continentale) statunitense da small modular reactors entro l’autunno del 2028. È l’obiettivo del Janus Program, iniziativa congiunta del Dipartimento della Guerra e del Dipartimento dell’Energia annunciata dal segretario dell’Esercito Daniel P.



La trappola del falso supporto tecnico: attenti, è phishing


@Informatica (Italy e non Italy 😁)
È stata rivelata una campagna di truffe online che sfrutta il logo Microsoft in uno schema di falso supporto tecnico. L’attacco non punta tanto sulla sofisticazione tecnica, quanto sulla capacità di sfruttare la fiducia e la paura per ottenere il controllo completo del dispositivo della



There is no evidence the Instagram and Facebook account, called Montcowatch, sells anything. Lawyers from the ACLU say the move is "wild outside the scope" of DHS' authority.

There is no evidence the Instagram and Facebook account, called Montcowatch, sells anything. Lawyers from the ACLU say the move is "wild outside the scope" of DHSx27; authority.#ICE #DHS


DHS Tries To Unmask Ice Spotting Instagram Account by Claiming It Imports Merchandise


The Department of Homeland Security (DHS) is trying to force Meta to unmask the identity of the people behind Facebook and Instagram accounts that post about Immigration and Customs Enforcement (ICE) activity, arrests, and sightings by claiming the owners of the account are in violation of a law about the “importation of merchandise.” Lawyers fighting the case say the move is “wildly outside the scope of statutory authority,” and say that DHS has not even indicated what merchandise the accounts, called Montcowatch, are supposedly importing.

“There is no conceivable connection between the ‘MontCo Community Watch’ Facebook or Instagram accounts and the importation of any merchandise, nor is there any indicated on the face of the Summonses. DHS has no authority to issue these summonses,” lawyers with the American Civil Liberties Union (ACLU) wrote in a court filing this month. There is no indication on either the Instagram or Facebook account that the accounts are selling any type of merchandise, according to 404 Media’s review of the accounts. “The Summonses include no substantiating allegations nor any mention of a specific crime or potential customs violation that might trigger an inquiry under the cited statute,” the lawyers add.

💡
Do you know anything else about this case or others like it? We would love to hear from you. Using a non-work device, you can message Joseph securely on Signal at joseph.404 or Jason at jason.404

A judge temporarily blocked DHS from unmasking the owners last week.

“The court now orders Meta [...] not to produce any documents or information in response to the summonses at issue here without further order of the Court,” the judge wrote in a filing. The move to demand data from Meta about the identities of the accounts while citing a customs statute shows the lengths to which DHS is willing to go to attempt to shut down and identify people who are posting about ICE’s activities.

Montcowatch is, as the name implies, focused on ICE activity in Montgomery County, Pennsylvania. Its Instagram posts are usually titled “Montco ICE alert” and include details such as where suspected ICE agents and vehicles were spotted, where suspected agents made arrests, or information about people who were detained. “10/20/25 Eagleville,” one post starts. “Suspected dentention [sic] near Ollies on Ridge Pike sometime before 7:50 am. 3 Agents and 3 Vehicles were observed.”

The Instagram account has been posting since June, and also posts information about peoples’ legal rights to film law enforcement. It also tells people to not intervene or block ICE. None of the posts currently available on the Instagram account could reasonably be described as doxing or harassing ICE officials.

On September 11, DHS demanded Meta provide identifying details on the owners of the Montcowatch accounts, according to court records. That includes IP addresses used to access the account, phone numbers on file, and email addresses, the court records add. DHS cited a law “focused on customs investigations relating to merchandise,” according to a filing from the ACLU that pushed to have the demands thrown out.
playlist.megaphone.fm?p=TBIEA2…
“The statute at issue here, 19 U.S.C. § 1509, confers limited authority to DHS in customs investigations to seek records related to the importation of merchandise, including the assessment of customs duties,” the ACLU wrote. “Identifying anonymous social media users critical of DHS is not a legitimate purpose, and it is not relevant to customs enforcement.” As the ACLU notes, a cursory look at the accounts shows they are “not engaged in commerce.” The court record points to an 2017 Office of the Inspector General report which says Customs and Border Protection (CBP) “regularly” tried much the same thing with its own legal demands, and specifically around the identity of an anonymous Twitter user.

“Movant now files this urgent motion to protect their identity from being exposed to a government agency that is apparently targeting their ‘community watch’ Facebook and Instagram accounts for doing nothing more than exercising their rights to free speech and association,” those lawyers and others wrote last week.

“Movant’s social media pages lawfully criticize and publicize DHS and the government agents who Movant views as wreaking havoc in the Montgomery County community by shining a light on that conduct to raise community members’ awareness,” they added.

The judge has not yet ruled on the ACLU’s motion to quash the demands altogether. This is a temporary blockage while that case continues.

The Montocowatch case follows other instances in which DHS has tried to compel Meta to identify the owners of similar accounts. Last month a judge temporarily blocked a subpoena that was aiming to unmask Instagram accounts that named a Border Patrol agent, The Intercept reported.

Earlier this month Meta took down a Facebook page that published ICE sightings in Chicago. The move came in direct response to pressure from the Department of Justice.

Both Apple and Google have removed apps that people use to warn others about ICE sightings. Those removals also included an app called Eyes Up that was focused more on preserving videos of ICE abuses. Apple’s moves also came after direct pressure from the Department of Justice.

Montcowatch directed a request for comment to the ACLU of Pennsylvania, which did not immediately respond.


#ice #x27 #DHS


“Accompagnare i giovani verso un futuro di speranza è urgente”. Ne è convinto il Papa, che nel discorso rivolto ai Superiori maggiori dei Gesuiti, ricevuti in udienza, ha fatto notare come “i giovani d’oggi sono diversi: studenti, migranti, attivisti…


Decibel - Vivo da re - 1980

youtube.com/watch?v=Wrm_0zVRW1…



Making WiFi Sound Like Dial-Up Internet


Dial-up modems had a distinctive sound when connecting, with the glittering, screeching song becoming a familiar melody to those jumping online in the early days of the Internet. Modern digital connections don’t really have an analog to this, by virtue of being entirely digital. And yet, [Nick Bild] decided to make WiFi audible in a pleasing tribute to the modems of yore.

The reason you could hear your dial-up modem is because it was actually communicating in audio over old-fashioned telephone lines. The initialization process happened at a low enough speed that you could hear individual sections of the handshake that sounded quite unique. Ultimately, though, once a connection was established at higher speed, particularly 33.6 k or 56 k, the sound of transmission became hard to discern from static.

Modern communication methods like Ethernet, DSL, and WiFi all occur purely digitally — and in frequencies far above the audible range. Thus, you can’t really “listen” to a Wi-Fi signal any more than you can listen to the rays of light beaming out from the sun. However, [Nick] found an anachronistic way to make a sound out of WiFi signals that sounds vaguely reminiscent of old-school modems. He used a Raspberry Pi 3 equipped with a WiFi adapter, which sniffs network traffic, honing in on data going to one computer. The packet data is then sent to an Adafruit QT Py microcontroller, which uses the data to vary the amplitude of a sound wave that’s then fed to a speaker through a digital-to-analog converter. [Nick] notes this mostly just sounds like static, so he adds some adjustments to the amplitude and frequency to make it more reminiscent of old modem sounds, but it’s all still driven by the WiFi data itself.

It’s basically WiFi driven synthesis, rather than listening to WiFi itself, but it’s a fun reference to the past. We’ve talked a lot about dial-up of late; from the advanced technology that made 56 k possible, to the downfall of AOL’s long-lived service. Video after the break.

youtube.com/embed/OxAJHiVkBEM?…


hackaday.com/2025/10/24/making…



“Camminare con i poveri, gli esclusi del mondo e quanti sono stati feriti nella dignità”. Lo ha chiesto il Papa ai Superiori maggiori dei Gesuiti, ricevuti in udienza.


Il volume "Testa, cuore e mani. Grandi educatori a Roma" (Libreria Editrice Vaticana) verrà presentato a Roma venerdì 31 ottobre, alle ore 17.00, nella Sala San Pio X (via dell’Ospedale 1) nell’ambito del Giubileo del Mondo Educativo.



“La Chiesa ha bisogno di voi sulle frontiere, siano esse geografiche, culturali, intellettuali o spirituali”. Lo ha detto il Papa, ricevendo oggi in udienza i Superiori maggiori dei Gesuiti.



Offener Brief: Bürgerrechtsorganisationen pochen auf Unabhängigkeit der irischen Datenschutzaufsicht


netzpolitik.org/2025/offener-b…



Obesità, il presidente di Aifa Robert Nisticò a TPI: “La prevenzione è un dovere dello Stato”


@Politica interna, europea e internazionale
Presidente Nisticò, con l’approvazione della Legge Pella, l’Italia è il primo e unico Paese al mondo ad avere una norma per la prevenzione e la cura dell’obesità. Cosa comporta? «L’obesità è una vera e propria malattia, molto



Collins Aerospace: la voce di Everest su una tempesta perfetta. Ricostruiamo i fatti


@Informatica (Italy e non Italy 😁)
Si dice spesso che la verità sia la prima vittima in una guerra, e nel confuso panorama della cybersecurity questa massima risuona con sinistra frequenza. Quella che ha colpito Collins Aerospace a settembre del 2025 non è stato un semplice




Il deputato di Forza Italia Roberto Pella a TPI: “La mia legge contro l’obesità? Pensa al domani”


@Politica interna, europea e internazionale
On. Pella, l’Italia è il primo Paese al mondo a riconoscere l’obesità come malattia, grazie alla legge recentemente approvata di cui Lei è il primo firmatario. «È un motivo di grande soddisfazione. Indubbiamente a ognuno di noi fa piacere



This Week in Security: Court Orders, GlassWorm, TARmageddon, and It was DNS


This week, a US federal court has ruled that NSO Group is no longer allowed to use Pegasus spyware against users of WhatsApp. And for their trouble, NSO was also fined $4 million. It’s unclear how much this ruling will actually change NSO’s behavior, as it intentionally stopped short of applying to foreign governments.

There may be an unexpected source of leverage the US courts can exert over NSO, with the news that American investors are acquiring the company. Among the requirements of the ruling is that NSO cannot reverse engineer WhatsApp code, cannot create new WhatsApp accounts, and must delete any existing WhatsApp code in their possession. Whether this actually happens remains to be seen.

Points On the Curve


Cryptography is hard. Your implementation can do everything right, and still have a weakness. This was demonstrated yet again in the Cloudflare CIRCL cryptography library. The issue here is a Diffie-Hellman scheme using the Curve4Q elliptic curve.

Quick review: Diffie-Hellman is a technique where Bob and Alice can exchange public keys, and each combine the received public key with their own private key, and arrive at a shared secret. This can be accomplished on an elliptic curve by choosing a scalar value as a private key, and multiplying a standard generator point by that scalar to derive a new point on the curve, which serves as the public key. After the public key points are exchanged, Alice and Bob each multiply the received public point by their own secret scalar. Just like simple multiplication, this function is commutative, and results in the same answer for both.

There is a catch that can cause problems. Not every value is a valid point on the curve, and doing calculations on these invalid points can lead to unusual results. The danger here isn’t remote code execution (RCE), but leaking information about the private key when doing an invalid calculation using these invalid points.

The CIRCL library had a couple instances where invalid points could be used. There’s a quirk of deserializing FourQ points, that the x value can be interpreted two ways, essentially a positive or negative x. The CIRCL logic attempts to deserialize an incoming point in one way, and if that point is not actually on the curve, the value is inverted (technically “conjugated”), and the new point is accepted without testing. There were a few other similar cases where points weren’t being validated. These flaws were reported to Cloudflare and fixed earlier this year.

GlassWorm


We recently covered Shai Hulud, an npm worm that actively uploaded itself into other npm libraries when it found valid credentials on compromised computers. It was something of a sea change in the world of library security. Now a month later, we have GlassWorm, a vscode extension worm.

GlassWorm combines several very sneaky techniques. When it injects code into an extension, that code is hidden with Unicode shenanigans, rendering in VSCode as blank lines. Once this malicious VSCode extension is loaded, it reaches out to some interesting Command and Control (C2) infrastructure: The Solana blockchain is used as a sort of bulletproof DNS, hosting a a C2 IP address. There’s a second, almost equally weird C2 mechanism: Hosting those IP addresses in entries on a public Google Calendar.

Once this malware is running, it harvests credentials, and if it gets a chance, injects itself in the code for other extensions and tries to publish. And it also turns the compromised machine into a “Zombi”, part of a botnet, but also working as a RAT (Remote Access Trojan). All told, it’s really nasty malware, and seems to indicate a shift towards these meta-worms that are intended to infiltrate Open Source software repositories.

Speaking of npm, GitHub has begun making security enhancements in response to the Shai Hulud worm. It looks like good changes, like the deprecation of classic access tokens, in favor of shorter lived, granular tokens. TOTP (Time based One Time Password) is going away as a second factor of authentication, in favor of passkeys and similar. And finally, npm is encouraging the use of doing away with long-lived access tokens altogether, and publishing strictly from CI/CD systems.

TARmageddon


We’ve cheered on the progress of the Rust language and its security wins, particularly in the realm of memory safety. But memory management is not the only cause of security issues. The async-tar rust package had a parsing bug that allowed a .tar file to smuggle additional contents that were not seen by the initial validation step.

That has all sorts of potential security ramifications, like smuggling malicious files, bypassing filters, and more. But what’s really interesting about this particular bug is that it’s been around since the first release of the package, and async-tar has been forked into many other published packeges, some of which are in use but no longer maintained. This has turned what should have been a simple fix into a mess, and the popular tokio-tar is still unfixed.

It Was DNS


You probably noticed that the Internet was sort of a dumpster fire on Monday — more than normal. Most of the world, it seems, runs on Amazon’s AWS, and when AWS goes down, it’s surprising what else fails. There were the normal sites and services down, like Reddit, Signal, Fortnight, and Prime Video. It was a bit of a surprise that some banks were down and flights delayed. And then there were IoT devices, like smart beds, litter boxes, and smart bulbs.

And the problem, naturally, was DNS. It’s always DNS. Specifically, Amazon has pinned the outage on “…a latent race condition in the DynamoDB DNS management system that resulted in an incorrect empty DNS record…”. This bad record brought down other services that relied on it, and it didn’t take long for the problem to spin out of control.

Bits and Bytes


There’s even more DNS, with [Dan Kaminsky]’s infamous cache poisoning making an unwelcome comeback. DNS has historically run over UDP, and the Kaminsky attack was based on the lack of authorization in DNS responses. The solution was to randomize the port a request was sent from, requiring the matching response be delivered to the same port number. What’s new here is that the Pseudo Random Number Generator (PRNG) in BIND has a weakness, that could have allowed predicting those values.

TP-Link’s Omada gateways had a pair of vulnerabilities that allowed for RCE. The more serious of the two didn’t require any authentication. Noword on whether this flaw was accessible from the WAN interface by default. Patched firmware is now available.

The better-auth library patched an issue early this month, that allowed the createApiKey endpoint to run without authRequired set true, simply by providing a valid user ID. This bug has been in the library ever since API keys were added to the project. The fix landed in 1.3.26.

And for bonus points, go check out the ZDI post on Pwn2Own Ireland, that just wrapped. There were lots of IoT hacks, including at least one instance of Doom running on a printer. Summoning Team took the Master of Pwn award, nearly doubling the points earned by second place. Congrats!


hackaday.com/2025/10/24/this-w…





Tg del 24 ottobre 2025

Conduzione: Alessio GarzinaCoordinamento: Vincenzo CimminoDigiwall: Marco BertoliniCollegamento: Elisabetta GuglielmiTicker: Alessio Corsaro e Irene Di CastelnuovoServizi di: Tommaso Di Caprio, Lorenzo Giovanardi, Iris Venuto, Giacomo Basile, Elisa Ortuso, Flavia Falduto, Antonio…
L'articolo Tg del 24 ottobre 2025 su Lumsanews.

lumsanews.it/tg-del-24-ottobre…