It’s the podcast so nice we recorded it twice! Despite some technical difficulties (note to self: press the record button significantly before recording the outro), Elliot and Dan were able to soldier through our rundown of the week’s top hacks. We kicked things off with a roundup of virtual keyboards for the alternate reality crowd, which begged the question of why you’d even need such a thing. We also looked at a couple of cool demoscene-adjacent projects, such as the ultimate in oscilloscope music and a hybrid knob/jack for eurorack synth modules. We also dialed the Wayback Machine into antiquity to take a look at Clickspring’s take on the origins of precision machining; spoiler alert — you can make gas-tight concentric brass tubing using a bow-driven lathe. There’s a squishy pneumatic robot gripper, an MQTT-enabled random number generator, a feline-friendly digital stethoscope, and a typewriter that’ll make you Dymo label maker jealous. We’ll also mourn the demise of electronics magazines and ponder how your favorite website fills that gap, and learn why it’s really hard to keep open-source software lean and clean. Short answer: because it’s made by people.
While the COVID-19 pandemic wasn’t an experience anyone wants to repeat, infections disease experts like [Dr. Pardis Sabeti] are looking at what we can do to prepare for the next one.
While the next pandemic could potentially be anything, there are a few high profile candidates, and bird flu (H5N1) is at the top of the list. With birds all over the world carrying the infection and the prevalence in poultry and now dairy agriculture operations, the possibility for cross-species infection is higher than for most other diseases out there, particularly anything with an up to 60% fatality rate. Only one of the 70 people in the US who have contracted H5N1 recently have died, and exposures have been mostly in dairy and poultry workers. Scientists have yet to determine why cases in the US have been less severe.
To prevent an H5N1 pandemic before it reaches the level of COVID and ensure its reach is limited like earlier bird and swine flu variants, contact tracing of humans and cattle as well as offering existing H5N1 vaccines to vulnerable populations like those poultry and dairy workers would be a good first line of defense. So far, it doesn’t seem transmissible human-to-human, but more and more cases increase the likelihood it could gain this mutation. Keeping current cases from increasing, improving our science outreach, and continuing to fund scientists working on this disease are our best bets to keep it from taking off like a meme stock.
Whatever the next pandemic turns out to be, smartwatches could help flatten the curve and surely hackers will rise to the occasion to fill in the gaps where traditional infrastructure fails again.
Renata Morresi: Dunque, con calma, vagliando ogni sintagma: ieri notte, in acque internazionali, dei #droni da guerra, forse mandati dal governo di #israele , hanno attaccato una nave con #aiutiumanitari diretta verso un luogo dove non c'è più cibo, acqua, elettricità, medicine, ecc., #Gaza . Ripeto: AIUTI UMANITARI - PER GAZA - BOMBARDATI - DA DRONI - IN ACQUE INTERNAZIONALI. Quando apriremo gli occhi su quello che stanno facendo il criminale #Netanyahu & i suoi complici? Per quanto tempo ancora potremo assecondare questo scempio? Potremo dire che non sapevamo? Che non arrivavano immagini o notizie? Che non conoscevamo i #genocidi ? Né i #criminidiguerra ? Come faremo a parlare di umanesimo? Di studiare la storia per non ripeterla? Come faremo a credere ai 'valori cristiani' o 'occidentali'? All'uguaglianza e all'equità? Al progresso e alla civiltà europea? Come faremo a guardarci allo specchio?
@Informatica (Italy e non Italy 😁) L'OIV (Organismo indipendente di valutazione della performance) svolge un ruolo centrale tra le funzioni di governance e controllo. Ecco le sue competenze in ambito privacy, secondo il disegno di legge recentemente approvato L'articolo OIV: profili evolutivi
Tokyo allarga il perimetro del Gcap. Con il progetto ancora nelle sue fasi iniziali e una roadmap che guarda al 2035, il Giappone avrebbe aperto un canale con Nuova Delhi per esplorare un possibile ingresso dell’India nella cordata del caccia di sesta generazione. Il ragionamento
L'articolo proviene da #StartMag e viene ricondiviso sulla comunità Lemmy @Informatica (Italy e non Italy 😁) La Commissione per la protezione dei dati irlandese (Dpc), authority di supervisione per il regolamento europeo sulla protezione dei dati (Gdpr), ha multato TikTok per 530 milioni di euro poiché la società ha trasferito illecitamente dati di
This week, Oligo has announced the AirBorne series of vulnerabilities in the Apple Airdrop protocol and SDK. This is a particularly serious set of issues, and notably affects MacOS desktops and laptops, the iOS and iPadOS mobile devices, and many IoT devices that use the Apple SDK to provide AirPlay support. It’s a group of 16 CVEs based on 23 total reported issues, with the ramifications ranging from an authentication bypass, to local file reads, all the way to Remote Code Execution (RCE).
AirPlay is a WiFi based peer-to-peer protocol, used to share or stream media between devices. It uses port 7000, and a custom protocol that has elements of both HTTP and RTSP. This scheme makes heavy use of property lists (“plists”) for transferring serialized information. And as we well know, serialization and data parsing interfaces are great places to look for vulnerabilities. Oligo provides an example, where a plist is expected to contain a dictionary object, but was actually constructed with a simple string. De-serializing that plist results in a malformed dictionary, and attempting to access it will crash the process.
Another demo is using AirPlay to achieve an arbitrary memory write against a MacOS device. Because it’s such a powerful primative, this can be used for zero-click exploitation, though the actual demo uses the music app, and launches with a user click. Prior to the patch, this affected any MacOS device with AirPlay enabled, and set to either “Anyone on the same network” or “Everyone”. Because of the zero-click nature, this could be made into a wormable exploit.
Apple has released updates for their products for all of the CVEs, but what’s going to really take a long time to clean up is the IoT devices that were build with the vulnerable SDK. It’s likely that many of those devices will never receive updates.
EvilNotify
It’s apparently the week for Apple exploits, because here’s another one, this time from [Guilherme Rambo]. Apple has built multiple systems for doing Inter Process Communications (IPC), but the simplest is the Darwin Notification API. It’s part of the shared code that runs on all of Apple’s OSs, and this IPC has some quirks. Namely, there’s no verification system, and no restrictions on which processes can send or receive messages.
That led our researcher to ask what you may be asking: does this lack of authentication allow for any security violations? Among many novel notifications this technique can spoof, there’s one that’s particularly problematic: The device “restore in progress”. This locks the device, leaving only a reboot option. Annoying, but not a permanent problem.
The really nasty version of this trick is to put the code triggering a “restore in progress” message inside an app’s widget extension. iOS loads those automatically at boot, making for an infuriating bootloop. [Guilherme] reported the problem to Apple, made a very nice $17,500 in the progress. The fix from Apple is a welcome surprise, in that they added an authorization mechanism for sensitive notification endpoints. It’s very likely that there are other ways that this technique could have been abused, so the more comprehensive fix was the way to go.
Jenkins
Continuous Integration is one of the most powerful tools a software project can use to stay on top of code quality. Unfortunately as those CI toolchains get more complicated, they are more likely to be vulnerable, as [John Stawinski] from Praetorian has discovered. This attack chain would target the Node.js repository at Github via an outside pull request, and ends with code execution on the Jenkins host machines.
The trick to pulling this off is to spoof the timestamp on a Pull Request. The Node.js CI uses PR labels to control what CI will do with the incoming request. Tooling automatically adds the “needs-ci” label depending on what files are modified. A maintainer reviews the PR, and approves the CI run. A Jenkins runner will pick up the job, compare that the Git timestamp predated the maintainer’s approval, and then runs the CI job. Git timestamps are trivial to spoof, so it’s possible to load an additional commit to the target PR with a commit timestamp in the past. The runner doesn’t catch the deception, and runs the now-malicious code.
[John] reported the findings, and Node.js maintainers jumped into action right away. The primary fix was to do SHA sum comparisons to validate Jenkins runs, rather than just relying on timestamp. Out of an abundance of caution, the Jenkins runners were re-imaged, and then [John] was invited to try to recreate the exploit. The Node.js blog post has some additional thoughts on this exploit, like pointing out that it’s a Time-of-Check-Time-of-Use (TOCTOU) exploit. We don’t normally think of TOCTOU bugs where a human is the “check” part of the equation.
2024 in 0-days
Google has published an overview of the 75 zero-day vulnerabilities that were exploited in 2024. That’s down from the 98 vulnerabilities exploited in 2023, but the Threat Intelligence Group behind this report are of the opinion that we’re still on an upward trend for zero-day exploitation. Some platforms like mobile and web browsers have seen drastic improvements in zero-day prevention, while enterprise targets are on the rise. The real stand-out is the targeting of security appliances and other network devices, at more than 60% of the vulnerabilities tracked.
When it comes to the attackers behind exploitation, it’s a mix between state-sponsored attacks, legal commercial surveillance, and financially motivated attacks. It will be interesting to see how 2025 stacks up in comparison. But one thing is for certain: Zero-days aren’t going away any time soon.
Perplexing Passwords for RDP
The world of computer security just got an interesting surprise, as Microsoft declared it not-a-bug that Windows machines will continue to accept revoked credentials for Remote Desktop Protocol (RDP) logins. [Daniel Wade] discovered the issue and reported it to Microsoft, and then after being told it wasn’t a security vulnerability, shared his report with Ars Technica.
So what exactly is happening here? It’s the case of a Windows machine login via Azure or a Microsoft account. That account is used to enable RDP, and the machine caches the username and password so logins work even when the computer is “offline”. The problem really comes in how those cached passwords get evicted from the cache. When it comes to RDP logins, it seems they are simply never removed.
There is a stark disconnect between what [Wade] has observed, and what Microsoft has to say about it. It’s long been known that Windows machines will cache passwords, but that cache will get updated the next time the machine logs in to the domain controller. This is what Microsoft’s responses seem to be referencing. The actual report is that in the case of RDP, the cached passwords will never expire, regardless of changing that password in the cloud and logging on to the machine repeatedly.
Bits and Bytes
Samsung makes a digital signage line, powered by the MagicINFO server application. That server has an unauthenticated endpoint, accepting file uploads with insufficient filename sanitization. That combination leads to arbitrary pre-auth code execution. While that’s not great, what makes this a real problem is that the report was first sent to Samsung in January, no response was ever received, and it seems that no fixes have officially been published.
A series of Viasat modems have a buffer overflow in their SNORE web interface. This leads to unauthenticated, arbitrary code execution on the system, from either the LAN or OTA interface, but thankfully not from the public Internet itself. This one is interesting in that it was found via static code analysis.
IPv6 is the answer to all of our IPv4 induced woes, right? It has Stateless Address Autoconfiguration (SLAAC) to handle IP addressing without DHCP, and Router Advertisement (RA) to discover how to route packets. And now, taking advantage of that great functionality is Spellbinder, a malicious tool to pull off SLACC attacks and do DNS poisoning. It’s not entirely new, as we’ve seen Man in the Middle attacks on IPv4 networks for years. IPv6 just makes it so much easier.
Il Ministro dell'Istruzione e del Merito Giuseppe Valditara, il Ministro dell'Interno, Matteo Piantedosi, il Ministro dell'Università e della Ricerca, Anna Maria Bernini e la Presidente della Conferenza dei rettori delle università italiane, Giovanna…
Una nuova campagna di phishing sta circolando in queste ore con un obiettivo ben preciso: spaventare le vittime con la minaccia di una multa stradale imminente e gonfiata, apparentemente proveniente da PagoPA. L’obiettivo è convincere l’utente a cliccare su un link fraudolento e inserire i propri dati di pagamento, con la scusa di saldare una sanzione.
In questo articolo analizziamo cosa è importante non fare quando si riceve un’email di questo tipo, per capire come molte truffe online sfruttino l’urgenza e la credibilità di marchi noti al fine di ottenere un vantaggio economico. Email fake di PagoPA arrivata alla redazione di Red Hot Cyber
“Evita la maggiorazione: paga adesso”. Scopriamo perché è una truffa
L’email in questione arriva da un mittente apparentemente legittimo, ma con un dominio sospetto: [strong]jeyhun.ashurov@tu-dortmund.de[/strong]. Intanto un dominio di origine tedesca dovrebbe far subito pensare che si tratti di una truffa. Le email ufficiali solitamente pervengono dal dominio gov.it Il contenuto della comunicazione cerca di replicare lo stile formale delle notifiche ufficiali, con messaggi intimidatori come:
“La preghiamo di prendere nota che, in caso di mancato pagamento entro la fine della giornata odierna, l’importo totale sarà automaticamente aggiornato a 500 €.”
Un’altra tecnica psicologica è l’urgenza: la scadenza è fissata per il giorno stesso della ricezione, inducendo panico e reazioni impulsive. Pertanto:
Email sospetta: le comunicazioni sono avvenute dall’email [strong]jeyhun.ashurov@tu-dortmund.de[/strong]. PagoPA avvengono da domini istituzionali come @pagopa.gov.it.
Assenza di destinatario specifico: si usa “Gentile proprietario/a del veicolo”, un modo generico per colpire più vittime.
Minacce e urgenze: è una tecnica comune nel phishing per spingere l’utente all’azione.
Link truffaldini: il link “Accedi al Pagamento Online” porta quasi certamente a una pagina clone creata per rubare i dati della carta.
Cosa fare se ricevi questa email?
Per prima cosa aumenta l’attenzione
Non cliccare sul link.
Segnala l’email come phishing nel tuo client di posta.
Verifica eventuali multe reali solo tramite i portali ufficiali (come il sito del Comune o il portale ufficiale di PagoPA).
Avvisa amici e parenti, in particolare quelli meno esperti di tecnologia.
L’analisi tecnica di Red Hot Cyber: cosa si cela dietro il link
Il team di Red Hot Cyber ha analizzato l’email sospetta all’interno di un ambiente sicuro, utilizzando una sandbox, ovvero una macchina virtuale isolata dal sistema reale, che consente di analizzare contenuti potenzialmente pericolosi senza rischi per il computer o la rete.
Al primo tentativo, cliccando sul link presente nell’email, abbiamo osservato una serie di redirect automatici: sorprendentemente, il collegamento sembrava concludersi sul sito ufficiale di PagoPA, un’astuzia probabilmente pensata per aumentare la fiducia della vittima e ridurre i sospetti.
Abbiamo quindi analizzato l’URL tramite VirusTotal, una piattaforma che verifica la reputazione dei link attraverso decine di motori antivirus. Il risultato? Tre antivirus lo identificavano chiaramente come malevolo. schermata che etichetta il link presente nell’email come malevolo www.virustotal.com Effettuando ulteriori test — e questa volta utilizzando Tor per anonimizzare la navigazione e accedere eventualmente a contenuti geolocalizzati o camuffati — siamo riusciti ad accedere al vero sito fraudolento.
Come funziona la truffa
Una volta atterrati sul sito clone, ci è stato chiesto di compilare un modulo con i nostri dati anagrafici, dopodiché il sito richiede di inserire:
Numero della carta di credito
Data di scadenza
Codice CVV
Non è finita. Dopo l’inserimento dei dati della carta, il sito richiede anche:
Codice SMS (OTP) ricevuto via banca
PIN della carta
In questo modo, il criminale informatico ottiene tutti i codici necessari per svuotare la carta di credito: dati personali, dati bancari, codice di sicurezza e persino il secondo fattore di autenticazione.
Una volta in possesso di queste informazioni, il truffatore può effettuare prelievi e transazioni fino al totale prosciugamento del plafond disponibile sulla carta.
#NoiSiamoLeScuole, il video racconto di questa settimana è dedicato, al Liceo “Rita Levi Montalcini” di Casarano (LE) e all’IC “Rosario Livatino” di Roccalumera (ME) che, grazie al #PNRR, hanno potenziato le attività laboratoriali dedicate alle mater…
#NoiSiamoLeScuole, il video racconto di questa settimana è dedicato, al Liceo “Rita Levi Montalcini” di Casarano (LE) e all’IC “Rosario Livatino” di Roccalumera (ME) che, grazie al #PNRR, hanno potenziato le attività laboratoriali dedicate alle mater…
@Notizie dall'Italia e dal mondo Dietro ogni errore c’è un’impresa reale. Aziende cinesi, spesso medio-piccole, che nulla hanno a che vedere con la difesa o la sicurezza nazionale ma che si ritrovano improvvisamente considerate una minaccia globale L'articolo Stati Uniti. Errori e
Gli Stati Uniti sono il secondo produttore al mondo di terre rare. Ciononostante, il Paese ne importa il 95% del proprio fabbisogno, il cui 70% giunge dalla Cina. Il quadro, a dispetto dell’accordo appena siglato con l’Ucraina e delle dichiarazioni del Presidente Trump, è destinato a
L’Italia sprofonda al 49° posto nella classifica mondiale della #libertà di #stampa. Il peggior risultato tra tutti i Paesi dell’Europa occidentale.
Peggio della Slovacchia di Fico. Peggio del regno di Tonga. Peggio della Macedonia del Nord.
E no, non è un caso. Né un’eredità del passato. A dirlo è #ReporterSansFrontières : «Sì, è colpa del #governo Meloni. Ha contribuito in modo cospicuo al peggioramento della #libertà dei #media ».
Lo ha fatto con le pressioni politiche sulla #Rai. Con le #querele temerarie contro le testate più #critiche . Con la #leggebavaglio . Con le #intimidazioni ai #cronisti . Con i tentativi di minare la #segretezza delle fonti. E perfino con episodi di #sorveglianza come il caso #Paragon che ricordano – parole loro – gli #abusi dell’Ungheria e della Grecia.
Nel 2023 eravamo già finiti nella lista nera dei “Paesi problematici”. Nel 2024 siamo scesi di altri cinque posti. E ora, nel 2025, l’Italia scivola ancora.
Il crimine informatico continua a rappresentare una minaccia significativa per la sicurezza globale e le economie. La Rete europea per la criminalità informatica giudiziaria (EJCN) ha tenuto la sua 18a riunione plenaria dal 28 al 29 aprile presso la sede di Eurojust a L'Aia. L'evento di due giorni ha riunito 60 partecipanti provenienti da 32 paesi. Istituito nel 2016, l'EJCN svolge un ruolo vitale nel promuovere la cooperazione e la condivisione delle conoscenze tra i professionisti specializzati nella lotta al crimine informatico, con l'obiettivo di aumentare l'efficienza delle indagini e dei procedimenti giudiziari. Con il sostegno del partner chiave #Eurojust, l' #EJCN lavora per rafforzare la cooperazione tra le autorità nazionali, affrontando la natura senza confini del crimine informatico e le sfide che pone. I progressi tecnologici creano nuove opportunità per i criminali di sfruttare la velocità, la convenienza e l'anonimato di Internet. Le conseguenti minacce informatiche non conoscono confini, causando danni e ponendo minacce reali alle vittime di tutto il mondo. Le autorità nazionali stanno adottando misure per combattere questa minaccia in crescita, ma spesso affrontano sfide al passo con l'ambiente tecnico in rapido cambiamento.
I pubblici ministeri e i giudici in tutta l' #UE sono alle prese con nuovi problemi legali e aree grigie, come cooperare con i fornitori di servizi che detengono prove elettroniche cruciali, sequestrare criptovalute sotto il controllo dei fornitori di servizi di cripto-attività o affrontare i complessi fenomeni del terrorismo abilitato al cyber. La 18a riunione plenaria dell'EJCN ha affrontato queste sfide frontalmente, presentando discussioni su argomenti chiave come l'intelligenza artificiale, criptovalute, il pacchetto E-evidence e le reti terroristiche che operano online. L'incontro ha incluso presentazioni su casi studio, incluso l'uso criminale di modelli linguistici di grandi dimensioni, evidenziando la natura in evoluzione delle minacce informatiche. Una sessione ristretta del secondo giorno ha permesso ai partecipanti di condividere aggiornamenti su legislazioni, sentenze e casi nazionali. Le sessioni di approfondimento hanno riguardato argomenti come l'intelligenza artificiale, criptovalute, le prove elettroniche e la formazione per la magistratura su argomenti relativi al #cybercrime, fornendo una piattaforma per i partecipanti per condividere esperienze e anticipare le sfide future. L'incontro è stato un importante raduno di esperti e parti interessate, offrendo preziose informazioni e discussioni sulle principali sfide che l'industria della criminalità informatica deve affrontare e dimostrando l'impegno dell'EJCN a sostenere i suoi membri nei loro sforzi per combattere la criminalità informatica.
W l'Italia fondata sul lavoro, dove tutto va bene...(Per i politicanti).
A marzo -16mila occupati: calo tra le donne e gli under 35. Il tasso di disoccupazione giovanile risale al 19% - Il Fatto Quotidiano ilfattoquotidiano.it/2025/05/0…
Scommettiamo che, tempo sei mesi, anche del prossimo papa si dirà (o meglio, i suoi seguaci diranno) che è un papa che piace ai credenti e ai non-credenti?
A me i papi non piacciono mai (*) ma probabilmente rappresento una parte minoritaria dei non-credenti.
(*) il che non vuol dire li consideri tutti dei pendagli da forca ma se facessi la lista dei cento terrestri che mi piacciono di più dubito ci finirebbe dentro un papa.
Diete vegane e aminoacidi essenziali: il punto critico che pochi considerano @scienza focustech.it/news/diete-vegane… Le diete vegane stanno guadagnando sempre più terreno, spinte da motivazioni etiche, ambientali e salutistiche. Eliminando tutti i prodotti di origine animale, molti trovano in questo
Diete vegane e aminoacidi essenziali: il punto critico che pochi considerano | Le diete vegane offrono numerosi benefici, ma nascondono una sfida poco discussa: l’equilibrio degli aminoacidi essenziali. Scopri perché è importante conoscerla.
@Notizie dall'Italia e dal mondo L’attacco, attribuito da più parti a Israele, è avvenuto alle 00:23. La Freedom Flotilla ha inviato un segnale di SOS. Malta sostiene di aver risposto e che tutti gli attivisti a bordo sono salvi L'articolo FREEDOM FLOTILLA PER
Gli hacktivisti filorussi prendono costantemente di mira importanti organizzazioni pubbliche e private nei Paesi Bassi con attacchi DDoS (Distributed Denial of Service), causando problemi di accesso e interruzioni del servizio
Come armonizzare le complessità della regolamentazione globale dell'IA
Shadow AI: il rischio nascosto del caos operativo
Ho letto la legge sull'intelligenza artificiale dell'UE così non devi farlo tu: ecco 5 cose che devi sapere
Dai piccoli casi di evasione fiscale e violazioni delle normative ai reati più gravi, i nostri sistemi legali e di controllo delle leggi hanno sempre funzionato partendo dal presupposto che non tutte le infrazioni verranno scoperte e tanto meno punite.
Per il quinto giorno consecutivo, Extinction Rebellion torna in azione a Roma. Questa mattina, poco dopo le 10, un centinaio di persone ha occupato l’ingresso del Ministero di Giustizia di via Arenula. Dopo aver lanciato in aria polvere colorata, creando una nuvola dalle mille sfumature, hanno aperto un grande striscione con scritto “Nel buio fascista, i colori della giustizia. “Questi colori rappresentano le mille sfumature della giustizia e l’amore per la diversità e per i valori democratici di solidarietà e riconnessione con la Terra” afferma Ludovica. “Di fronte al buio che avanza, restituiamo rabbia, gioia e colori.”
Per sottolineare queste contraddizioni, i manifestanti si sono poi seduti a terra, mostrando cartelli che recitano “Dio è morto … nelle carceri, nei CPR, nel Mediterraneo, a Gaza, nei decreti sicurezza”, un chiaro riferimento alla nota canzone di Francesco Guccini, una delle canzoni di protesta più amate, uscita nel 1965 che, paradossalmente, venne censurata dalla RAI, ma trasmessa invece da Radio Vaticana. Un testo che, evocando i luoghi simbolo del male, i campi di sterminio, parla di un Dio ucciso dall’ipocrisia, dal falso mito della razza, dalla politica fatta di odio e di paura. Una rilettura in chiave attuale, quindi, quella di Extinction Rebellion, che elenca i luoghi dove oggi le persone soffrono e muoiono a causa delle scelte politiche in tema di crisi ecoclimatica, migrazioni, sicurezza. “Quegli stessi ministri che hanno promosso politiche distruttive per clima, ambiente e diritti, in questi giorni successivi alla morte di Papa Francesco, hanno dichiarato il loro impegno verso gli ultimi” afferma ancora Ludovica. Tra gli altri si è espresso, appunto, il ministro della Giustizia, Carlo Nordio, che ha dichiarato: “Nella sua grande misericordia era molto sensibile alle sofferenze dei carcerati. Nel suo nome lavoreremo per rendere il sistema penitenziario sempre più umano”.
Affermazioni che sembrano tuttavia non trovare riscontro nelle numerose critiche e osservazioni, come quella delle Camere Penali, che in questi mesi sono arrivate alla gestione della giustizia e delle carceri e all’approvazione del #DecretoSicurezza . L’introduzione di numerosi nuovi reati e l’inasprimento delle pene sono stati definiti incostituzionali da moltissimi autorevoli commentatori, anche internazionali, e in ultimo è arrivato un durissimo appello sottoscritto da 237 costituzionalisti, di cui è primo firmatario Gustavo Zagrebelsky. Il testo sottolinea l’impostazione autoritaria della gestione dell’ OrdinePubblico e della giustizia da parte dell’attuale Governo “il filo che lega il metodo e il merito di questo nuovo intervento normativo rende esplicito un disegno complessivo, che tradisce un’impostazione autoritaria, illiberale e antidemocratica, non episodica od occasionale ma mirante a farsi sistema, a governare con la paura invece di governare la paura”.
“Di fronte all’ipocrisia di chi, in ogni scelta politica, ha ucciso solidarietà, fratellanza e libertà gridiamo Dio è morto”, conclude #ExtinctionRebellion
A photograph of Trump administration official Mike Waltz's phone shows him using an unofficial version of Signal designed to archive messages during a cabinet meeting.
A photograph of Trump administration official Mike Waltzx27;s phone shows him using an unofficial version of Signal designed to archive messages during a cabinet meeting.#News
A photograph of Trump administration official Mike Waltz's phone shows him using an unofficial version of Signal designed to archive messages during a cabinet meeting.
Army Will Seek Right to Repair Clauses in All Its Contracts
A new memo from Secretary of Defense Pete Hegseth is calling on defense contractors to grant the Army the right-to-repair. The Wednesday memo is a document about “Army Transformation and Acquisition Reform” that is largely vague but highlights the very real problems with IP constraints that have made it harder for the military to repair damaged equipment.
Hegseth made this clear at the bottom of the memo in a subsection about reform and budget optimization. “The Secretary of the Army shall…identify and propose contract modifications for right to repair provisions where intellectual property constraints limit the Army's ability to conduct maintenance and access the appropriate maintenance tools, software, and technical data—while preserving the intellectual capital of American industry,” it says. “Seek to include right to repair provisions in all existing contracts and also ensure these provisions are included in all new contracts.” playlist.megaphone.fm?p=TBIEA2… Over the past decade, corporations have made it difficult for people to repair their own stuff and, somehow, the military is no exception. Things are often worse for the Pentagon. Many of the contracts it signs for weapons systems come with decades long support and maintenance clauses. When officials dig into the contracts they’ve often found that contractors are overcharging for basic goods or intentionally building weapons with proprietary parts and then charging the Pentagon exorbitant fees for access to replacements. 404 Media wrote more about this problem several months ago. The issue has gotten so bad that appliance manufacturers and tractor companies have lobbied against bills that would make it easier for the military to repair its equipment.
This has been a huge problem for decades. In the 1990s, the Air Force bought Northrop Grumman’s B-2 Stealth Bombers for about $2 billion each. When the Air Force signed the contract for the machines, it paid $2.6 billion up front just for spare parts. Now, for some reason, Northrop Grumman isn’t able to supply replacement parts anymore. To fix the aging bombers, the military has had to reverse engineer parts and do repairs themselves.
Similarly, Boeing screwed over the DoD on replacement parts for the C-17 military transport aircraft to the tune of at least $1 million. The most egregious example was a common soap dispenser. “One of the 12 spare parts included a lavatory soap dispenser where the Air Force paid more than 80 times the commercially available cost or a 7,943 percent markup,” a Pentagon investigation found. Imagine if they’d just used a 3D printer to churn out the part it needed.
As the cost of everything goes up, making it easier for the military to repair their own stuff makes sense. Hegseth’s memo was praised by the right-to-repair community. “This is a victory in our work to let people fix their stuff, and a milestone on the campaign to expand the Right to Repair. It will save the American taxpayer billions of dollars, and help our service members avoid the hassle and delays that come from manufacturers’ repair restrictions,” Isaac Bowers, the Federal Legislative Director of U.S. PIRG, said in a statement.
The memo would theoretically mean that the Army would refuse to sign contracts with companies that make it difficult to fix what it sells to the military. The memo doesn’t carry the force of law, but subordinates do tend to follow the orders given within. The memo also ordered the Army to stop producing Humvees and some other light vehicles, and Breaking Defense confirmed that it had.
With the Army and the Pentagon returning to an era of DIY repairs, we’ll hopefully see the return of PS: The Preventive Maintenance Monthly. Created by comics legend Will Eisner in 1951, the Pentagon funded comic book was a monthly manual for the military on repair and safety. It included sultry M-16 magazines and anthropomorphic M1-Abrams explaining how to conduct repairs.
The Pentagon stopped publishing the comic in 2019, but with the new push in the DoD for right-to-repair maybe we’ll see its return. It’s possible in the future we’ll see a comic book manual on repairing a cartoon MQ-9 Reaper that leers at the reader with a human face. A tank teaching you how to repair it. Image: DoD archive.
""All of these parochial interests and all of these lobbyists that crawl around this building and crawl around Congress, they have succeeded for far too long, and so the first thing is, we are going to start to cut the things we don't want or need," …
The CEO of Meta says "the average American has fewer than three friends, fewer than three people they would consider friends. And the average person has demand for meaningfully more.”#Meta #chatbots #AI
La manifestazione di Extinction Rebellion di questa mattina davanti al Ministero della Giustizia si è conclusa dopo poche ore con uno sgombero effettuato
La quarta giornata della Primavera Rumorosa di Extinction Rebellion a Roma, ieri 29 Aprile, comincia con un unicorno di tre metri cavalcato da una sosia
Ieri, in una Roma ancora blindata per i funerali del Papa, un fiume rosso sangue scorre per la città adagiandosi poi con teatrale eleganza sulla statua di
The Bluesky and ATmosphere reports are back after I was occupied last week with the Ahoy! conference about ATProto in Hamburg. It was amazing to meet so many cool people in real life, and share the excitement of working on this network together. There were some great talks, and just being around people who you can talk in-depth about Bluesky and ATProto with is just great. Hoping to see many more ATProto conferences pop up and meet more of you in real life.
A practical note: if you missed the ATmosphere report last week, a reminder that I’m also sending out the reports via email every Friday. This comes with an extra analysis article that’s not on the website, so don’t forget to subscribe!
Bluesky launches a blue check verification system
Bluesky has launched a new verification system for their platform, with blue checkmarks. With the checkmark system, Bluesky selects a few Trusted Verifiers, who can hand out checkmarks. Bluesky PBC will also hand out checkmarks to “authentic and notable accounts”. The main reason for this system’s existence is that the other verification system, using domain names as handles, did not perform well enough. Bluesky PBC says that 270k accounts have set their own domain name as a handle, but not enough high-profile accounts have done so. The other problem with domain names as verification is that many well-known public figures do not have a well-known website. The first organisations that are Trusted Verifiers in the Bluesky app are the New York Times and Wired Magazine.
Bluesky PBC advertises the new checkmark verification system with its Trusted Verifiers as “a healthy digital society should distribute power”. However, it is unclear with the current implementation to what extend power is actually distributed. Bluesky PBC is the one who selects the Trusted Verifiers that can be displayed in their app. In their blog post, they also write: “Bluesky will review these verifications as well to ensure authenticity.” To me, it seems far from distributing power, and can at best be seen as distributing operational work. With Bluesky PBC holding full control of who gets to be a Trusted Verifier, as well as reviewing their output, how much power has Bluesky PBC actually distributed?
The new checkmark verification system is not exclusive to the Bluesky app however, and it is build on an open system. Anyone can create verifications or become a Verifier, as all the data for verification is openly accessible to anyone. The only difference is that verifications that are not made by Bluesky PBC or one of their Trusted Verifiers will not be visible in the official Bluesky clients. Other systems have already sprung up, a new verifier tool by cred.blue allows anyone to easily hand out verifications. The Deer client, which is a fork of the Bluesky client, already allows for anyone to set their own Verifiers as well. I’ll talk more about this in an upcoming article, as what is happening with Deer and verification has some interesting implications on how the network will likely develop.
For now, Bluesky PBC has build a technologically cool system, which also solves a meaningful problem that their app has in the short term. While the way it is currently implemented falls short of the advertised distribution of power regarding verification, the team is clear that this is an early implementation and that the system will evolve later.
Streamplace funding
Some news from streaming software Streamplace:
Streamplace has raised 100k Livepeer tokens, worth around 500k USD, from the Livepeer Treasury to further expand the Streamplace platform. The money will be used to expand the team, enhance infrastructure and build a deeper integration with ATProto, as well as building content moderation infrastructure.
A short explanation of Livepeer, and how it relates to Streamplace. Livepeer is a decentralised network for video transcoding and processing. Transcoding (in this context) processes the video stream to make it accessible in various formats and qualities, so a stream can be viewed both by someone on a slow internet connection in 360p, as well as someone with fast internet in 4K definition. Livepeer is a DAO, with an attached crypto token. Streamplace uses Livepeer for the video transcoding, and because of this integration, which allows the Livepeer network to grow as well, the Livepeer DAO has awarded Streamplace 100k tokens, currently worth around 500k USD. It is unclear to me how the Livepeer token works, with its corresponding tokenomics, and where the value of the tokens is coming from.
Streamplace creator Eli Mellon gave an interview on the devtools-fm podcast where Eli goes into more detail on the background of Streamplace and how the software works.
Two other ATProto apps are working on integration Streamplace. Skylight already announced earlier to be working with Streamplace. At the ATProto conference Ahoy in Hamburg last week Joe Basser, co-founder of the ATProto video platform, announced to be working on livestreaming with Streamplace as well.
Streamplace is hiring a Decentralized Video Protocol Engineer and a Lead Front-End Engineer
An OBS overlay to display Streamplace chat on-stream.
An update on relays and independent infra
Bluesky PBC made some changes to how their relays work, with an update with the unassuming name of ‘Sync 1.1′. The update made it much cheaper to run relays, as they do not have to store data of the entire network anymore. This has made a drastic impact on running relays. Last month, independent developer @futurset up a relay on his own Raspberry Pi. Now Phil, another independent developer, has set up multiple relays and made them publicly accessible. This means that there are now multiple other full-network relays that index the entire network, that are outside of US jurisdiction. Just as importantly, running these full-network relays is cheap, with costs getting as low as 18 USD per month. Feed builder Graze is also creating their own implementation of a relay: Turbostream includes a large amount of extra information in the stream. For example, where Jetstream (a simplified version of a relay) broadcasts a reply, Turbostream broadcasts a reply together with the post that is being replied to, as well as a range of other information. This in turn makes it easier to other parties to build on, as most information needed is already included in Turbostream.
These developments leads to some interested new questions. When it comes to running a relay, technology and costs are clearly not barriers anymore. But what about moderation and uptime guarantees? Is having a relay that many other parties depend on even the right model of the network?
It also calls the model that the Free Our Feeds campaign had in mind, which aligned more with a perspective of expensive and large relays. Today, Free Our Feeds announced that they will donate a 50k USD grant to a new IndieSky Working Group. The IndieSky came out of the second day of the conference, organised by Boris Mann and Ted Han. Mann and Han are behind the ATProtocol Developer Community Group, and also organised the first ATProto conference in Seattle last month. The goal of IndieSky is to “work together on R&D, code, and infrastructure on how and why to run different parts of the ATProto stack”, with more details in the announcement. The first meeting for the working group is on May 8th.
In Other News
The Ahoy! conference for the European Social Web was last week, and as an extremely biased person who helped organise the conference I think it was a great success! Massive shout-out to Sebastian Korfmann who has done an incredible amount of work getting the conference to such a great place, super impressive. During the conference I did some longer video interviews with some of the people in the community, those videos will be released in the coming weeks. The main takeaway for me from the conference was to see the amount of positive energy and enthusiasm in the community. People are aware that they are contributing to a space that has massive potential and is undergoing rapid changes. I’m excited to see more conferences for ATProto, and meet more people from the community in real life, as it has been super great to meet the people at Ahoy!.
Turtleisland.social is a Mastodon server for the North American Native/Indigenous community. They have set up their own PDS server for community members to join Bluesky as well. Community-centered data hosting is one of the possibilities with the PDS system of Bluesky that is mentioned regularly as an option, but has not been borne out much yet. Two other communities are in the process of building out a similar structure: Blacksky is creating their own PDS software for the Black community, and Northsky is building out systems that allow people to easily migrate their ATProto account to a Northsky PDS. It’s worth pointing out here that the early adopters of new technology on social networking are all minority communities. For people building social networks this provides a pragmatic argument (besides the much more important ethical argument) for creating safe digital spaces: the people for whom safety is the most crucial are also the most likely to be early adopters of new technologies.
Not all early adoption is by minority communities: Gander.social is a newly announced social network on ATProto, focusing on the Canadian community. Gander has a lot of plans for features that make it stand out from the Bluesky app. The project is still in development, and it seems once the project gets closer to launch it will become clearer what the ATProto integration will actually entail.
Bluesky has made some changes to their PDS, allowing people to sign up directly for an ATProto account on a PDS without going through the Bluesky app. Link aggregator platform Frontpage is one of the first to take advantage of this, allowing account creation on the Frontpage platform now.
Bluesky PBC is joining Lexicon Community Technical Steering Committee. Bluesky Engineer Bryan Newbold will be the representative. It signals a growing maturity of the ecosystem, that an effort run by the ATProto developer community can come to a place where Bluesky joins the initiative on an equal footing.
Openvibe is a multi-network client that combines someones Mastodon, Bluesky, Nostr and Threads accounts into a single app. Their latest update is an customisable For You algorithmic timeline, which combines posts from multiple networks into a unified algorithmic timeline.
Newsletter publishing platform Ghost now has a simple setting to share posts on Bluesky, via the ActivityPub bridge. This was already possible with Bridgy Fed, but that required some manual steps, where it is now a simple toggle setting.
The Links
For the protocol-minded people:
A proposal for private images (not posts!) on ATProto.
Proposal: A Simple XRPC Method for Signing Payloads in ATProtocol
News from Bluesky takes the most popular links on the network and displays them in an interface more like Hacker News.
Bluesky video client Skylight is working on a dislike feature so people can further fine tune their algorithm.
An example of how inauthentic accounts use Starter Packs to quickly build a following and integrate themselves into the network.
That’s all for this week, thanks for reading! If you want more analysis, you can subscribe to my newsletter. Every week you get an update with all this week’s articles, as well as extra analysis not published anywhere else. You can subscribe below, and follow this blog @fediversereport.com and my personal account @laurenshof.online on Bluesky.
bsky.app login screen at the top right showing account creation changed to turtleis.land Our Bluesky Personal Data Server joins our Mastodon server for a more complete Native/Indigenous social media experience The Bluesky Native community is much lar…
si parla di "metalli rari" e "terre rare" come se fosse la stessa cosa. sono basita. spero che zelensky abbia scritto terre rare, così sarà vincolato a non dare un bel niente a trump. forse trump dovrebbe leggere la tabella periodica degli elementi... e tanti italiani anche.
Uovo è più di un coworking convenzionale: è lo spazio ideale per la presentazione di libri, lezioni, workshop, incontri, servizi fotografici e molto altro.
L'immagine presenta un'atmosfera misteriosa e urbana, con un focus su oggetti che suggeriscono un gioco di ruolo o un'esperienza di gioco. Al centro, in caratteri rossi e bianchi, si legge "SODOMA 2" con la sottotitolo "URBAN GAME" in rosso. Sotto il titolo, si intravede una mano guantata di nero, posata su un foglio di carta beige, con un bastone di legno e un oggetto bianco curvo accanto. In alto a destra, un bicchiere con cubetti di ghiaccio aggiunge un tocco di eleganza. Lo sfondo è scuro e grigio, con un effetto di texture che contribuisce all'atmosfera enigmatica.
Fornito da @altbot, generato localmente e privatamente utilizzando Ovis2-8B
The image features a cartoon character standing on a sidewalk in front of a red brick wall. The character has a bald head with a few strands of brown hair on the sides, wears black-rimmed glasses, and a blue and black striped shirt. He is holding a microphone in his right hand and giving a thumbs-up with his left hand. His facial expression is cheerful, with a wide smile showing his teeth. To the right of the character, there is a black spider hanging from a web. The background includes green grass on either side of the sidewalk. The overall style of the image is simple and cartoonish, with bold outlines and flat colors.
Provided by @altbot, generated privately and locally using Ovis2-8B
A tank teaching you how to repair it. Image: DoD archive.
Ильдар
in reply to Andrea Russo • • •