Il Tribunale dell’Unione Europea “salva” il trasferimento dei dati personali verso gli Stati Uniti. Per ora
Quello dello scorso 1 aprile non era un pesce d’aprile: la prima udienza del caso Latombe c. Commissione, infatti, rinviava alla data del 3 settembre per un giudizio sul ricorso presentato per l’annullamento della decisione di adeguatezza relativa al Data Privacy Framework.
Una decisione di adeguatezza è lo strumento giuridico previsto dall’art. 45 GDPR attraverso il quale la Commissione riconosce che un paese terzo o un’organizzazione garantisce un livello di protezione adeguato, anche in relazione a un ambito territoriale o settoriale, consentendo così il trasferimento internazionale dei dati personali senza che debbano ricorrere ulteriori autorizzazioni o condizioni.
Con un comunicato stampa la il Tribunale dell’Unione europea ha reso noto l’esito del giudizio, respingendo il ricorso e riconoscendo che il quadro normativo vigente negli Stati Uniti garantisce un livello di protezione “essenzialmente equivalente” a quello garantito dalla normativa europea sulla protezione dei dati personali.
Insomma: al momento è stato evitato un effetto “Schrems III”. Ma c’è ancora la possibilità di un altro grado di giudizio.
Il precedente delle “sentenze Schrems” e la reazione di noyb.
La storia degli accordi fra Stati Uniti e Unione Europea per il trasferimento dei dati personali è particolarmente travagliata: prima il Safe Harbor, poi il Privacy Shield vennero annullati in seguito alle sentenze Schrems I e Schrems II. Motivo per cui nel 2023 è intervenuto il nuovo accordo del Data Privacy Framework.
Le questioni cruciali affrontate anche nel ricorso di Latombe riguardano l’effettività delle tutela giurisdizionale e la legittimità della raccolta e impiego dei dati da parte delle agenzie di intelligence statunitensi.
Nella sentenza si affronta il percorso di rafforzamento delle garanzie fondamentali implementate dagli Stati Uniti in materia di trattamento dei dati personali attraverso l’istituzione e il funzionamento della Data Protection Review Court (DPRC), la corte incaricata del controllo della protezione dei dati. L’indipendenza della DPRC, contestata nel ricorso, è stata confermata constatando che è stata assicurata in forza degli ordini esecutivi presidenziali. Circa il tema della raccolta massiva dei dati personali da parte delle agenzie di intelligence, il Tribunale ha valutato che la tutela giurisdizionale offerta dalla DPRC è equivalente rispetto a quella garantita dal diritto dell’Unione.
La reazione di noyb, l’ONG di Max Schrems di attivisti dei diritti digitali, contesta la decisione del Tribunale e fa intendere che nel caso di differenti argomenti di ricorso, o anche di un’impugnazione della sentenza di fronte alla CGUE, l’esito sarà ben differente. Uno dei punti critici riguarda l’indipendenza, garantita da un ordine presidenziale e non dalla legge, che in relazione all’attuale contesto dell’amministrazione Trump non può certamente dirsi un presidio sufficiente.
Il futuro incerto del Data Privacy Framework.
Le sorti del Data Privacy Framework restano incerte. Elemento che può essere deducibile anche da uno dei passaggi della sentenza, in cui si ricorda che la Commissione deve valutare eventuali mutamenti del contesto normativo nel tempo.
Insomma: non c’è nessun “sempre e per sempre”, ma è possibile che l’adeguatezza venga riesaminata ed essere sospesa, modificata o revocata in tutto o in parte da parte della stessa Commissione. O altrimenti essere annullata per effetto di un intervento della CGUE.
Qualora dovesse venir meno il Data Privacy Framework, è comunque possibile comunque fare ricorso a garanzie adeguate o altrimenti ricevere un’autorizzazione specifica da parte di un’autorità di controllo, come previsto dall’art. 46 GDPR e come avvenuto in precedenza.
Tutto questo è un déjà-vu. Ma più che un glitch della Matrix, esprime l’inevitabile interferenza della politica internazionale sulla stabilità della normativa. Rendendo evidenti e ricorrenti le contrapposte pretese di sovratensione normativa tanto da parte degli Stati Uniti che dell’Unione Europea.
L'articolo Il Tribunale dell’Unione Europea “salva” il trasferimento dei dati personali verso gli Stati Uniti. Per ora proviene da il blog della sicurezza informatica.
Maronno Winchester reshared this.
Android Colabrodo Edition: risolte 120 vulnerabilità e due zero-day
Gli sviluppatori di Google hanno rilasciato aggiornamenti di sicurezza per Android che risolvono 120 vulnerabilità del sistema operativo. Due di queste vulnerabilità, secondo l’azienda, sono già state sfruttate dagli hacker in attacchi mirati.
Gli errori 0-day risolti questo mese sono stati identificati come CVE-2025-38352 (punteggio CVSS 7,4) – una Privilege Escalation nel componente del kernel Linux e il CVE-2025-48543 – Privilege Escalation nel componente Android Runtime.
Google sottolinea che queste vulnerabilità sono già state sfruttate in attacchi mirati e limitati, ma l’azienda non ha divulgato dettagli su questi incidenti. Si dice che le vulnerabilità non richiedano alcuna interazione da parte dell’utente per essere sfruttate.
Il CVE-2025-38352 è una vulnerabilità del kernel Linux scoperta il 22 luglio 2025 e corretta nelle versioni 6.12.35-1 e successive. Il problema è correlato a una race condition nei timer della CPU POSIX e causa errori nella routine di pulizia delle attività, che destabilizzando il kernel e causando crash, denial of service ed escalation dei privilegi.
Invece il CVE-2025-48543, a sua volta, colpisce Android Runtime, dove vengono eseguite le applicazioni Java/Kotlin e i servizi di sistema. Potenzialmente, consente a un’applicazione dannosa di aggirare la protezione sandbox e ottenere l’accesso a funzionalità di sistema di livello superiore.
Oltre ai due bug 0-day sfruttati attivamente, l’aggiornamento di settembre ha corretto quattro bug critici.
Il CVE-2025-48539, un bug di Remote Code Execution (RCE) nel componente di sistema Android, che consente a un aggressore che si trova in prossimità fisica o di rete (ad esempio, nel raggio di azione di Bluetooth o Wi-Fi) di eseguire codice arbitrario sul dispositivo senza alcuna interazione o privilegio da parte dell’utente.
Le vulnerabilità CVE-2025-21450, CVE-2025-21483 e CVE-2025-27034 riguardano componenti proprietari Qualcomm. Secondo i dettagli forniti da Qualcomm nel proprio bollettino sulla sicurezza , la vulnerabilità CVE-2025-21450 riguarda il sistema di controllo GPS, la vulnerabilità CVE-2025-21483 riguarda problemi con gli stack di dati di rete e la vulnerabilità CVE-2025-27034 riguarda un problema nel processore di chiamata multimodale.
Google ha tradizionalmente preparato due livelli di patch: 2025-09-01 e 2025-09-05, per dare ai partner la possibilità di correggere più rapidamente alcune delle vulnerabilità comuni a tutti i dispositivi Android.
L'articolo Android Colabrodo Edition: risolte 120 vulnerabilità e due zero-day proviene da il blog della sicurezza informatica.
Violazione dati Chess.com! Servizi gratuiti per gli utenti colpiti dal Data Breach
Secondo quanto emerso, Chess.com, il gigante degli scacchi online, ha subito una violazione dei dati che ha messo a rischio le informazioni personali di 4.541 individui, come indicato in una documentazione inviata all’ufficio del procuratore generale dello stato del Maine.
L’incidente informatico è avvenuto il 5 giugno 2025 ed è stato scoperto quasi due settimane dopo, il 19 giugno 2025. Chess.com ha confermato che la violazione è stata il risultato di un attacco informatico esterno, in cui gli aggressori hanno ottenuto l’accesso non autorizzato a dati sensibili.
L’azienda ha riferito che gli hacker sono riusciti a ottenere nomi e dati personali, senza tuttavia fornire un dettaglio completo di tutti gli elementi di dati esposti. La violazione ha interessato utenti di diverse regioni, tra cui un residente del Maine.
Chess.com ha iniziato a informare le persone interessate tramite avvisi scritti il 3 settembre 2025. Per contribuire a proteggere la propria comunità, l’azienda offre 12 mesi di servizi gratuiti di protezione contro il furto di identità.
La notifica è stata presentata formalmente da Elias Colabelli, responsabile del dipartimento legale e responsabile della protezione dei dati di Chess.com, il quale ha sottolineato che l’azienda sta rafforzando i propri sistemi per prevenire incidenti simili in futuro.
Sebbene il numero di utenti interessati possa sembrare basso rispetto ad altre violazioni di dati su larga scala , l’incidente sottolinea come anche le principali piattaforme online rimangano obiettivi per i criminali informatici. Con oltre 150 milioni di utenti in tutto il mondo, Chess.com detiene un’enorme quantità di dati personali, il che lo rende un bersaglio redditizio per gli hacker.
Gli esperti di sicurezza informatica avvertono che violazioni di questo tipo possono aprire la strada a furti di identità, tentativi di phishing e ulteriori frodi se i dati rubati circolano nei mercati clandestini. Chess.com non ha ancora rivelato se le forze dell’ordine siano coinvolte nell’indagine. L’azienda afferma di continuare a lavorare per rafforzare i protocolli di sicurezza e monitorare attentamente i propri sistemi.
L'articolo Violazione dati Chess.com! Servizi gratuiti per gli utenti colpiti dal Data Breach proviene da il blog della sicurezza informatica.
Misteri berlinesi
Animate da un profondo amore per la Germania e per le «cose tedesche», connotate da una prosa limpida e volte alla ricerca del cuore di Berlino, queste pagine propongono al lettore di procedere a un’appassionata e meticolosa ricognizione della topografia della città: dei luoghi, cioè, che caratterizzano maggiormente la metropoli, una capitale dalla storia unica, considerato che nel corso del Novecento è stata prima distrutta, poi divisa, quindi riunita.
Sebbene intenzionato a seguire le orme dei grandi flâneurs, quali Franz Hessel, Siegfried Krakauer, Walter Benjamin e Hanns Zischler, lo studioso di estetica Flavio Cuniberto trasforma ben presto il proprio vagabondaggio in un itinerario di conoscenza: avvalendosi di un cospicuo numero di citazioni, individua dapprima i simboli più ovvi della nuova Berlino, ne coglie poi la dimensione fiabesca e non manca di riflettere su quella mostruosa, sempre incombente sulle vicende tedesche, che si rivela una negazione violenta della forma.
Il suo sguardo si rivolge in seguito alla città ebraica, che costituisce il primo baricentro, mentre il secondo è formato dalle opere dell’architetto e urbanista Karl Friedrich Schinkel, le quali hanno il proprio fulcro nell’Isola dei Musei. A questo proposito, va osservato come sia proprio la forma-museo a simboleggiare la vocazione profonda di Berlino, che si rivela sempre più un crogiuolo di tradizioni e, in particolare, di quelle più arcaiche, esotiche, cariche di energie primordiali. Fa notare acutamente Cunimberto: «L’apertura al mondo africano non avviene, insomma, nella prospettiva del collezionismo o del semplice apprezzamento estetico (come può accadere in un museo etnologico), ma quasi incoraggiando una vera e propria assimilazione delle culture africane, una immissione di elementi africani nella cultura del Vecchio Mondo» (p. 117).
Accade così che l’indagine dell’A., all’apparenza una sorta di «introduzione alla capitale tedesca», densa di richiami a luoghi noti, debba in realtà essere considerata la ricerca di un centro simbolico in qualche modo assoluto: quell’umbilicus urbis che la città non ha mai avuto, e del quale sembra avvertire la necessità proprio nella fase della sua rifondazione, i cui numi tutelari, in certo qual modo «esoterici», sembrano essere sia il berlinese Schinkel, esponente di un germanesimo che si apre alla totalità delle culture, sia l’ebreoamburghese Aby Warburg, sostenitore delle grandi iniziative museografiche berlinesi. Secondo Cuniberto, l’Isola dei Musei ha trovato il proprio definitivo ampliamento e coronamento nello Schloss («Castello»), che, progettato dal vicentino Franco Stella e inaugurato con il nome di Humboldt-Forum nel dicembre del 2020, ospita le magnifiche raccolte di arte orientale e la non meno bella documentazione relativa alle culture extraeuropee.
Ma va anche rilevato come Misteri berlinesi non si limiti a fornire un’analisi relativa alla metropoli bagnata dalla Sprea e dall’Havel: attorno a questa indagine, che prende in esame l’estetica, l’architettura, la filosofia, la letteratura, l’ermeneutica, si dispongono varie riflessioni che riguardano il carattere di una nazione. Si tratta di pensieri che hanno per oggetto quel quid che costituisce l’innegabile diversità tedesca e che queste «passeggiate» si propongono di osservare, comprendere, cogliere.
The post Misteri berlinesi first appeared on La Civiltà Cattolica.
TFINER is an Atompunk Solar Sail Lookalike
It’s not every day we hear of a new space propulsion method. Even rarer to hear of one that actually seems halfway practical. Yet that’s what we have in the case of TFINER, a proposal by [James A. Bickford] we found summarized on Centauri Dreams by [Paul Gilster] .
TFINER stands for Thin-Film Nuclear Engine Rocket Engine, and it’s a hoot. The word “rocket” is in the name, so you know there’s got to be some reaction mass, but this thing looks more like a solar sail. The secret is that the “sail” is the rocket: as the name implies, it hosts a thin film of nuclear materialwhose decay products provide the reaction mass. (In the Phase I study for NASA’s Innovative Advanced Concepts office (NIAC), it’s alpha particles from Thorium-228 or Radium-228.) Alpha particles go pretty quick (about 5% c for these isotopes), so the ISP on this thing is amazing. (1.81 million seconds!)
Now you might be thinking, “nuclear decay is isotropic! The sail will thrust equally in both directions and go nowhere!”– which would be true, if the sail was made of Thorium or Radium. It’s not; the radioisotope is a 9.5 um thin film on a 35 um beryllium back-plane that’s going to absorb any alpha emissions going the wrong way around. 9.5um is thin enough that most of the alphas from the initial isotope and its decay products (lets not forget that most of this decay chain are alpha emitters — 5 in total for both Th and Ra) aimed roughly normal to the surface will make it out.
Since the payload is behind the sail, it’s going to need a touch of shielding or rather long shrouds; the reference design calls for 400 m cables. Playing out or reeling in the cables would allow for some degree of thrust-vectoring, but this thing isn’t going to turn on a dime.
It’s also not going to have oodles of thrust, but the small thrust it does produce is continuous, and will add up to large deltaV over time. After a few years, the thrust is going to fall off (the half-life of Th-228 is 1.91 years, or 5.74 for Ra-228; either way the decay products are too short-lived to matter) but [Bickford]’s paper gives terminal/cruising velocity in either case of ~100 km/s.
Sure, that’s not fast enough to be convenient to measure as a fraction of the speed of light, and maybe it’s not great for a quick trip to Alpha Centauri but that’s plenty fast enough for to reach the furthest reaches of our solar system. For a flyby, anyway: like a solid-fueled rocket, once your burn is done, it’s done. Stopping isn’t really on offer here. The proposal references extra-solar comets like Oumuamua as potential flyby targets. That, and the focus of the Sun’s gravitational lens effect. Said focus is fortunately not a point, but a line, so no worries about a “blink and you miss it” fast-flyby. You can imagine we love both of those ideas.
NASA must have too, since NIAC was interested enough to advance this concept to a Phase II study. As reported at Centauri Dreams, the Phase II study will involve some actual hardware, albeit a ~1 square centimeter demonstrator rather than anything that will fly. We look forward to it. Future work also apparently includes the idea of combining the TFINER concept with an actual solar sail to get maximum possible delta-V from an Oberth-effect sundive. We really look forward to that one.
Repairing a Tektronix 577 Curve Tracer
Over on his YouTube channel our hacker [Jerry Walker] repairs a Tektronix 577 curve tracer.
A curve tracer is a piece of equipment which plots I-V (current vs voltage) curves, among other things. This old bit of Tektronix kit is rocking a CRT, which dates it. According to TekWiki the Tektronix 577 was introduced in 1972.
In this repair video [Jerry] goes to use his Tektronix 577 only to discover that it is nonfunctional. He begins his investigation by popping off the back cover and checking out the voltages across the voltage rails. His investigations suggest a short circuit. He pushes on that which means he has to remove the side panel to follow a lead into the guts of the machine.
Then, in order to find the shorted component he suspect exists, [Jerry] breaks out the old thermal cam. And the thermal cam leads to the fault: a shorted tantalum capacitor, just as he suspected to begin with! After replacing the shorted tantalum capacitor this old workhorse is like new.
There are probably quite a number of repair lessons in this video, but we think that an important takeaway is just how useful a thermal camera can be when it comes time for fault finding. If you’re interested in electronics repair a thermal cam is a good trick to have up your sleeve, it excels at finding short circuits.
If you’re interested in repairing old Tektronix gear be sure to check out Repairing An Old Tektronix TDS8000 Scope.
youtube.com/embed/SI-DL0fU0Pc?…
Chess.com: come un tool di file transfer ha esposto i dati di migliaia di utenti
@Informatica (Italy e non Italy 😁)
Nel panorama dei servizi online, poche piattaforme possono vantare la stessa pervasività e fedeltà degli utenti di Chess.com. Con oltre 100 milioni di iscritti e 10 milioni di partite organizzate ogni giorno, il sito è il cuore pulsante del gioco degli
In sentencing memos and exhibits, Pratt's attorney paints of picture that points at Pratt's abusive father, his ADHD, his co-conspirators, the entire pornography industry, and the victims themselves.
In sentencing memos and exhibits, Prattx27;s attorney paints of picture that points at Prattx27;s abusive father, his ADHD, his co-conspirators, the entire pornography industry, and the victims themselves.#girlsdoporn
Ahead of Sentencing, GirlsDoPorn Ringleader Michael Pratt Attempts to Seem Reformed
Days away from finding out his sentence for sex trafficking as the ringleader of Girls Do Porn, Michael James Pratt and his attorney are attempting to paint a picture of a man reformed behind bars, through personal letters and certificates from classes he has passed inside prison.GirlsDoPorn was a sex trafficking operation posing as a porn studio that Pratt ran from 2009 to 2020. By lying to the women they recruited, telling them that they were being hired for “modeling” gigs and adult video shoots that would never be distributed outside offline private collections, GirlsDoPorn’s operators coerced young, inexperienced women into shooting rough, hours-long sex scenes in San Diego hotel rooms. The videos were distributed on massive porn sites including Pornhub, where GirlsDoPorn was a content partner for years. Women who have come forward for the civil and federal trials against GirlsDoPorn have said their lives were upended by Pratt’s criminal enterprise.
💡
Were you a victim of GirlsDoPorn, or do you have knowledge of how it operated? I would love to hear from you. Using a non-work device, you can message me securely on Signal at sam.404. Otherwise, send me an email at sam@404media.co.Pratt has been in custody since he was arrested in Spain on December 21, 2022 and extradited to the US. Prior to that, he’d been in hiding since fleeing the US in the middle of a massive civil trial in 2019, where 22 victims sued him and his co-conspirators for $22 million (a case they won). Right after his disappearance, Pratt was charged with federal counts of sex trafficking by force, fraud and coercion, and was on the FBI’s Most Wanted List for years. He initially pleaded not guilty to these charges in 2024, but changed his plea to guilty in June.
Exhibits filed by Pratt’s lawyer Brian White on Sept. 1 include letters, mostly anonymous, from people who knew him when he was younger asking the judge for leniency, including his sister and mother. “Mike's father, Steve Pratt, was not a good role model. He was a drinker and had a controlling personality. I caught Steve smacking Michael uncontrollably on a couple of occasions. I stopped it immediately,” his mother wrote.
“Three years of prison has given me enough time to think about this entire situation,” Pratt wrote in a letter to the court submitted on Monday. “Trying to understand things from other points of view has given me insight into how some victims were really affected by these videos. I put myself in the shoes of the women who participated, trying to see what they have gone through. I myself have been a victim of bullying and know how rough that is on the psyche. I cannot imagine the trauma experienced by a video being published where friends and family could come across it.”
We know, in fact, from years of testimonies and interviews—many while it was still unsafe for them to come forward, when the consequences of speaking up about this abuse risked compounding trauma and continued, violent harassment—how Pratt’s victims were impacted by his actions.
Several of the women who’ve testified in the civil and federal trials, and came forward to speak on the record to journalists, reported violent assault to the point of bleeding or injury, being trapped inside the hotel rooms with no clothing, and being lied to by Pratt and his co-conspirators about who would be able to see the videos. As one of the women targeted by GirlsDoPorn told me in 2021: “There were a few points where I was just like please, I need to stop, I need to stop, because it was just so much pain. I said, I can’t go on anymore… At that point I could have said nothing. I could have been mute. My voice was just not heard at all.” Another woman said while testifying during the civil trial: “They put furniture in front of the door, so what was I going to do—jump over the balcony?” GirlsDoPorn’s attorney at the time, Aaron Sadock, asked that woman on the stand if she had fun. “No, I did not have fun!” she said, crying.
Kristy Althaus, who sued Pornhub in 2023 for disseminating the videos, claimed that Pratt’s conspirators held her captive in a hotel room and filmed her being raped for nine to 10 hours, barricading the doors, ignoring her bleeding and cries, forcing her to consume alcohol, marijuana, and Xanax, and spiking her drink with oxycodone. According to that complaint, when she refused to return for another “shoot,” Pratt threatened her and her family, texting, “You have it coming for u,” “I will cut and kill you bitch,” and “You better be here by noon shoot 2tomorrow or your graveyard,” according to screenshots of texts from Althaus’s complaint.
For many of these women, the trauma and harassment didn’t stop once they left the hotel rooms. In some cases, they were disowned by their families and friends, harassed endlessly, struggled to find jobs in previously-prestigious careers and found it difficult to date or trust anyone intimately again.In the defendant’s sentencing memorandum, White blames Pratt’s alcoholic, abusive father and his own ADHD; throws his co-conspirators under the bus; accuses the entire pornography industry of being “exploitative and dehumanizing;” and asserts again that the women lied in their testimonies.
The memo paints a picture of Pratt as a precocious child with a difficult upbringing in Christchurch, New Zealand, where he taught himself how to use computers and eventually learned about websites and affiliate marketing. “Mr. Pratt began looking for better ways to generate income, and through the associations he made in the affiliate marketing business, he learned that making videos to direct internet traffic to pornography sites could be financially successful,” the memo says. But when he tried to make a pornography business himself, he wasn’t very good at it, blaming the banning of Craigslist’s erotic ads in 2009 for his difficulties in finding models. He claims he posted ads seeking “models” as a way around the ban.
Pratt's lawyer asserts in the memorandum that his employee, Andre Reuben “Dre” Garcia, the main “actor” in most of the GirlsDoPorn videos, stopped when the women told him to stop. “She said, ‘stop, it’s not going to work.’ Garcia stopped,” the memo says. “The model offered to try a second time and again told Garcia to stop because it wasn’t going to work. Again, Garcia stopped. That was the end of it. Forcing a model to do something against her will was not Mr. Pratt’s intention.” He also claims that when Pratt heard complaints about Garcia from models, Pratt “instituted certain safety measures” like locking the hotel room refrigerators and putting more cameras in the room. Those “safety measures” didn’t include firing Garcia, however.
When he’s arguing that he should have a lower sentence than Garcia’s 20 years, Pratt acknowledges that Garcia sexually assaulted many of these women. “Garcia physically raped a number of the models before and after the video shoots, and multiple women were forced to continue having sex with him on video despite their pleas to stop due to pain or because the sex went beyond the scope of what they had agreed to do,” the memorandum states.
The exhibits filed as part of the memo also attempt to show how productive and busy Pratt has been in prison. His attorney submitted nearly 100 “certificates of completion” issued by the learning platform Edovo, which offers classes for incarcerated people. The classes Pratt passed include “Embracing Unexpected Change,” “Doing Time With Jesus,” several anger management courses, “Media Relations Foundations,” marketing classes for LinkedIn and Facebook, “Augmented Reality Marketing,” “Human Trafficking in the United States: The Truth and What You Can Do About It,” “Introduction to Artificial Intelligence,” and multiple cooking classes, including “Soups” and “Sauces.”
Federal prosecutors seek a 22-year prison sentence, while Pratt’s defense countered with around 17 years; Judge Janis L. Sammartino will hand Pratt his sentence on Monday in San Diego.
playlist.megaphone.fm?p=TBIEA2…Prosecutors want to send GirlsDoPorn ringleader to prison for 22 years
Michael James Pratt pleaded guilty in June to charges of sex trafficking and conspiracy to commit sex trafficking in the GirlsDoPorn case.City News Service (Times of San Diego)
Giorgio Armani: la grandezza e l’umiltà
@Giornalismo e disordine informativo
articolo21.org/2025/09/giorgio…
Con la scomparsa di Giorgio Armani ci dice addio una certa idea di moda, una certa idea di Milano e anche una certa idea d’Italia. Armani, infatti, era un uomo colto, partito dal basso e rimasto umile per tutta la vita. Piacentino, classe 1934, si è affermato
Mauro likes this.
Tips for Homebrewing Inductors
How hard can it be to create your own inductors? Get a wire. Coil it up. Right? Well, the devil is definitely in the details, and [Nick] wants to share his ten tips for building “the perfect” inductor. We don’t know about perfect, but we do think he brings up some very good points. Check out his video below.
If you are winding wire around your finger (or, as it appears in the video, a fork) or you are using a beefy ferrite core, you’ll find something interesting in the video.
Of course, the issue with inductors is that wires aren’t perfect, nor are core materials. Factors like this lead to inefficiency and loss, sometimes in a frequency-dependent way.
It looks like [Nick] is building a large switching power supply, so the subject inductor is a handful. He demonstrates some useful computational tools for analyzing data about cores, for example.
We learned a lot watching the tricks, but we were more interested in the inductor’s construction. We have to admit that the computed inductance of the coil matched quite closely to the measured value.
Need a variable inductor? No problem. Before ferrite cores, good coils were a lot harder to wind.
youtube.com/embed/PEme07iCH-s?…
Dal governo via libera a “scudo penale” per i medici: perseguibili solo per colpa grave
Lo prevede un disegno di legge delega. Il Consiglio dei Ministri ha anche approvato il nuovo decreto sull'esame di maturitàRedazione di Rainews (RaiNews)
Mauro reshared this.
Francesca Albanese e le sanzioni Usa: "Chi ha rapporti con me rischia 20 anni di carcere"
La relatrice speciale dell'Onu spiega le ripercussioni delle misureRedazione Adnkronos (Adnkronos)
like this
reshared this
A hacker has compromised Nexar, which turns peoples' cars into "virtual CCTV cameras" that organizations can then buy images from. The images include sensitive U.S. military and intelligence facilities.
A hacker has compromised Nexar, which turns peoplesx27; cars into "virtual CCTV cameras" that organizations can then buy images from. The images include sensitive U.S. military and intelligence facilities.#News
This Company Turns Dashcams into ‘Virtual CCTV Cameras.’ Then Hackers Got In
A hacker has broken into Nexar, a popular dashcam company that pitches its users’ dashcams as “virtual CCTV cameras” around the world that other people can buy images from, and accessed a database of terabytes of video recordings taken from cameras in drivers’ cars. The videos obtained by the hacker and shared with 404 Media capture people clearly unaware that a third party may be watching or listening in. A parent in a car soothing a baby. A man whistling along to the radio. Another person on a Facetime call. One appears to show a driver heading towards the entrance of the CIA’s headquarters. Other images, which are publicly available in a map that Nexar publishes online, show drivers around sensitive Department of Defense locations.The hacker also found a list of companies and agencies that may have interacted with Nexar’s data business, which sells access to blurred images captured by the cameras and other related data. This can include monitoring the same location captured by Nexar’s cameras over time, and lets clients “explore the physical world and gain insights like never before,” and use its virtual CCTV cameras “to monitor specific points of interest,” according to Nexar’s website.
This post is for subscribers only
Become a member to get access to all content
Subscribe nowThis Company Turns Dashcams into ‘Virtual CCTV Cameras.’ Then Hackers Got In
A hacker has compromised Nexar, which turns peoples' cars into "virtual CCTV cameras" that organizations can then buy images from. The images include sensitive U.S. military and intelligence facilities.Joseph Cox (404 Media)
Breaking News Channel reshared this.
rilanciamo la mobilitazione con una nuova due giorni di raccolta firme
Sabato 6 e domenica 7 torniamo nelle piazze per cancellare i poteri speciali grazie ai quali Gualtieri gioca la partita con un mazzo di carte truccato. Contro l'abuso di potere legalizzato puoi metterci la firma. Nella locandina trovi dove e quando firmare. Massima diffusione 💪🏼
404 Media first revealed ICE’s new app, called Mobile Fortify, in June. Now members of a congressional committee are pressing DHS for more information, including ICE's legal basis for using the app inside the U.S.
404 Media first revealed ICE’s new app, called Mobile Fortify, in June. Now members of a congressional committee are pressing DHS for more information, including ICEx27;s legal basis for using the app inside the U.S.#Impact
Congress Pushes DHS for Details on ICE’s New Facial Recognition App
Members of a congressional committee have demanded Department of Homeland Security (DHS) Secretary Kristi Noem for more information about Mobile Fortify, Immigration and Customs Enforcement’s (ICE) new facial recognition app, which taps into an unprecedented array of government databases and uses a system ordinarily reserved for when people enter or exit the U.S. 404 Media first revealed the app in June.The Democratic lawmakers, Bennie G. Thompson, J. Luis Correa, and Shri Thanedar, are asking Noem a host of questions about the app, including what databases Mobile Fortify searches, the tool’s accuracy, and ICE’s legal basis for using the app to identify people outside of ports of entry, including U.S. citizens.
“Congress has long had concerns with the Federal government’s use of facial recognition technology and has regularly conducted oversight of how DHS utilizes this technology. The Mobile Fortify application has been deployed to the field while still in beta testing, which raises concerns about its accuracy,” the letter from the Committee on Homeland Security and addressed to Noem reads.
💡
Do you know anything else about this app? I would love to hear from you. Using a non-work device, you can message me securely on Signal at joseph.404 or send me an email at joseph@404media.co.404 Media first revealed Mobile Fortify’s existence through leaked emails. Those emails showed that ICE officers could use the app to identify someone based on their fingerprints or face by just pointing a smartphone camera at them. The underlying Customs and Border Protection (CBP) system for the facial recognition part of the app is ordinarily used when people enter or leave the U.S. With Mobile Fortify, ICE then turned that capability inwards to identify people away from ports of entry.
In the footnotes of the letter, the lawmakers indicate they have a copy of a similar email, and the letter specifically cites 404 Media’s reporting.
In July 404 Media published a second report based on a Mobile Fortify user manual which explained the app’s capabilities and data sources in more detail. It said that Mobile Fortify uses a bank of 200 million images, and can pull up a subject’s name, nationality, date of birth, “alien” number, and whether a judge has marked them for deportation. It also showed that Mobile Fortify links databases from the State Department, CBP, the FBI, and states into a single tool. A “super query” feature lets ICE officers query multiple databases at once regarding “individuals, vehicles, airplanes, vessels, addresses, phone numbers and firearms.”
“Face recognition technology is notoriously unreliable, frequently generating false matches and resulting in a number of known wrongful arrests across the country. Immigration agents relying on this technology to try to identify people on the street is a recipe for disaster. Congress has never authorized DHS to use face recognition technology in this way, and the agency should shut this dangerous experiment down,” Nathan Freed Wessler, deputy director of the American Civil Liberties Union’s Speech, Privacy, and Technology Project, previously told 404 Media.
In their letter the lawmakers ask Noem questions about the app’s legality, including ICE’s legal basis to use the app to conduct biometric searches on people outside ports of entry; the databases Mobile Fortify has access to; any agreements between CBP and ICE about the app; information about the usage of the app, such as the frequency of ICE searches using the tool and what procedures ICE officials follow with the app; the app’s accuracy; and any policies or training to ICE agents on how to use the app.
“To ensure ICE is equipped with technology that is accurate and in compliance with constitutional and legal requirements, the Committee on Homeland Security is conducting oversight of ICE’s deployment of the Mobile Fortify application,” the letter says.
CBP acknowledged a request for comment but did not provide a response in time for publication. ICE did not respond to a request for comment.
You can find a copy of the letter here.
Inside ICE’s Supercharged Facial Recognition App of 200 Million Images
404 Media has seen user manuals for Mobile Fortify, ICE’s new facial recognition app which allows officers to instantly look up DHS, State Department, and state law enforcement databases by just pointing a phone at someone’s face.Joseph Cox (404 Media)
Evento precongressuale a La Spezia: “Psichedelici e salute: nuove frontiere della terapia”
In occasione del XXII Congresso dell’Associazione Luca Coscioni per la libertà di ricerca scientifica, l’Associazione Luca Coscioni, in collaborazione con la Cellula Coscioni La Spezia e SIMEPSI, presenta l’evento
Psichedelici e salute: nuove frontiere della terapia
L’appuntamento è per sabato 27 settembre alle ore 10.00 presso l’Auditorium Beghi, in via del Canaletto 100, a La Spezia. L’evento, ad accesso libero, sarà registrato e poi reso disponibile sul canale YouTube dell’Associazione Luca Coscioni all’interno della playlist “Eventi precongressuali 2025”.
L’evento è in fase di accreditamento ECM per professioni sanitarie.
PROGRAMMA
ore 10 – 13 Prima sessione
moderano: Diego Silvestri e Guido Frosina
Ore 10 – 10.30 Introduzione, saluti vari – Marco Perducaore 10.30-11.50Modulo 1 – Fondamenti teorici “Dalla ricerca alla pratica: protocolli, evidenze e applicazioni cliniche”Dott. Dario Zaccheroni “Stati non ordinari di coscienza e psicoterapia assistita da psichedelici”
Dott.ssa Susanna Lucini Paioni “Medicina Psichedelica e nuovi paradigmi in salute mentale”
Dott. Lorenzo Goppa
“Funghi medicinali, psilocibina e prospettive di ricerca “
Ore 12.00 – 13.00Modulo 2: Applicazioni cliniche “Il cervello psichedelico: meccanismi d’azione e potenzialità”
Proff. Marco Scarselli “Uso terapeutico degli psichedelici: dal meccanismo d’azione alla efficacia clinica” Prof. Ciro Conversano “Uso terapeutico degli psichedelici: dal meccanismo d’azione alla efficacia clinica”
13-14.00 pausa pranzo
dalle ore 14.00 alle ore18.00
seconda sessione
14 – 15.20
Modulo 3 – Cultura, Società e riduzione del danno
Sara Ballotti
Dall’underground alla condivisione dell’esperienza psichedelica: i cerchi di integrazione
di illuminismo Psichedelico
Simone Toneatti e ITARDDservizi di riduzione del danno, rete ITARDD
Dott. Gabriele Marino “Tutte le teste ti porti via: origine e caratteri della psichedelia musicale”
Prof.ssa Teresa Prudente “Sostanze psicoattive, allucinazione e testo letterario: casi studio, forme, implicazioni”
15.30 – 16.30
Modulo 4 – Psichedelici nelle cure palliative Dott. Luca Magnani “Accompagnamento al fine vita: dignità, significato e riduzione della sofferenza”
Ilaria Di LisoPotenzialità degli psichedelici nella malattia cronica e terminale e nel morire.” assistente spirituale
Diego Silvestri Numero Bianco
16.30
pausa caffè
16.45
Modulo 5 – confronto sui temi politici ed istituzionali locali16.45
Voci dal territorio: Spazio riservato alle ASL e agli ordini professionali di psicologi e psichiatri, consiglieri regionali Liguria e domitato di bioetica regionale + Consiglieri regionali Liguria+ comitato di bioetica regionale
17.15
Quadro normativo e prospettive future Claudia Moretti, M. Perduca
17.45
“Innovazione e tradizione in medicina: quali prospettive per la Liguria?”
discussione aperta con i relatori, ripresa del focus sulle esigenze sanitarie specifiche del territoriomodera Marco Perduca
L'articolo Evento precongressuale a La Spezia: “Psichedelici e salute: nuove frontiere della terapia” proviene da Associazione Luca Coscioni.
Designing an Open Source Micro-Manipulator
When you think about highly-precise actuators, stepper motors probably aren’t the first device that comes to mind. However, as [Diffraction Limited]’s sub-micron capable micro-manipulator shows, they can reach extremely fine precision when paired with external feedback.
The micro-manipulator is made of a mobile platform supported by three pairs of parallel linkages, each linkage actuated by a crank mounted on a stepper motor. Rather than attaching to the structure with the more common flexures, these linkages swivel on ball joints. To minimize the effects of friction, the linkage bars are very long compared to the balls, and the wide range of allowed angles lets the manipulator’s stage move 23 mm in each direction.
A Raspberry Pi Pico 2 and three motor drivers control this creation; even here, the attention to detail is impressive. The motor drivers couldn’t have internal charge pumps or clocked logic units, since these introduce tiny timing errors and motion jitter. The carrier circuit board is double-sided and uses through-hole components for ease of replication; in a nice touch, the lower silkscreen displays pin numbers.
To test the manipulator’s capabilities, [Diffraction Limited] used it to position a chip die under a microscope. To test its accuracy and repeatability, he traced the path a slicer generated for the first layer of a Benchy, vastly scaled-down, with the manipulator. When run slowly to reduce thermal drift, it could trace a Benchy within a 20-micrometer square, and had a resolution of about 50 nanometers.
He’s already used the micro-manipulator to couple an optical fiber with a laser, but [Diffraction Limited] has some other uses in mind, including maskless lithography (perhaps putting the stepper in “wafer stepper”), electrochemical 3D printing, focus stacking, and micromachining. For another promising take on small-scale manufacturing, check out the RepRapMicron.
youtube.com/embed/MgQbPdiuUTw?…
Thanks to [Nik282000] for the tip!
Returning To An Obsolete Home Movie Format
A few years ago, I bought an 8 mm home movie camera in a second hand store. I did a teardown on it here and pulled out for your pleasure those parts of it which I considered interesting. My vague plan was to put a Raspberry Pi in it, but instead it provided a gateway into the world of 8mm film technology. Since then I’ve recreated its Single 8 cartridge as a 3D printable model, produced a digital Super 8 cartridge, and had a movie camera with me at summer hacker camps.
When I tore down that Single 8 camera though, I don’t feel I did the subject justice. I concentrated on the lens, light metering, and viewfinder parts of the system, and didn’t bring you the shutter and film advance mechanism. That camera also lacked a couple of common 8 mm camera features; its light metering wasn’t through the lens, and its zoom lens was entirely manual. It’s time to dig out another 8 mm camera for a further teardown.
A Different Camera To Tear Down
My test camera is a battered and scuffed Minolta XL-250 that I found in a second hand store for not a lot. It takes Super 8 cartridges, of which I have an expired Kodachrome example for the pictures, and it has the advantage of an extremely well-thought-out design that makes dismantling it very easy. So out it comes to be laid bare for Hackaday.
Once the sides have come off the camera, immediately you can see a set of very early-70s-analogue PCBs containing the light metering circuitry. Typically this would involve a CdS cell and a simple transistor circuit, and the aperture is controlled via a moving coil meter mechanism. This camera also has a large mostly-unpopulated PCB, giving a clue to some of the higher-end features found on its more expensive sibling.
Turning our attention inside the camera to the film gate, we can see the casting the film cartridge engages with, and the frame opening for the shutter To the left of that opening is a metal claw that engages with the sprocket holes in the film, thus providing the primary film advancement. The metal claw is attached to a slider on the back of the film gate, which in turn is operated by the rotation of the shutter, which is the next object of our attention.
The shutter is a disc that spins at the frame rate, in this case 18 frames per second. It sits in the light path between the back of the lens system and the film gate. It has a segment cut out of the disc to let light through for part of the rotation, this is how it operates as a shutter. On its reverse is the cam which operates the slider for the film advancement claw, while its front is mirrored. This forms part of the through-the-lens light metering system which we’ll come to next.
The mirror on the front of the shutter is angled, which means that when the shutter is closed, the light is instead reflected upwards at right angles into a prism, which in turn directs the light to the light meter cell. The PCB on the other side must have a charge pump which takes this 18 Hz interrupted analogue signal and turns it into a DC to drive the moving coil mechanism. There’s a 10 uF capacitor which may be part of this circuit.
Finally, we come to the powered zoom feature that was missing from the previous camera. On the top of the camera is a W/T rocker, for Wide/Telephoto. that operates the zoom. It is connected to a set of levers inside the case, which emerge as a pin at the front of the camera below the lens. This engages with a small gearbox that drives a knurled ring on the lens body, and selects forward and reverse to turn the ring. It’s driven by the same motor as the shutter, so it only works when the camera is operating.
I hope this look at my Minolta has filled in some of the gaps left by the previous article, and maybe revealed that there’s more than meets the eye when it comes to 8 mm movies. Careful though. If you dip a toe into this particular puddle it may suck you in head first!
Optimizing VLF Antennas
Using digital techniques has caused a resurgence of interest in VLF — very low frequency — radio. Thanks to software-defined radio, you no longer need huge coils. However, you still need a suitable antenna. [Electronics Unmessed] has been experimenting and asks the question: What really matters when it comes to VLF loops? The answer he found is in the video below.
This isn’t the first video about the topic he’s made, but it covers new ground about what changes make the most impact on received signals. You can see via graphs how everything changes performance. There are several parameters varied, including different types of ferrite, various numbers of loops in the antenna, and wire diameter. Don’t miss the comment section, either, where some viewers have suggested other parameters that might warrant experimentation.
Don’t miss the 9-foot square antenna loop in the video. We’d like to see it suspended in the air. Probably not a good way to ingratiate yourself with your neighbors, though.
Between software-defined radio and robust computer simulation, there’s never been a better time to experiment with antennas and radios. We first saw these antennas in an earlier post. VLF sure is easier than it used to be.
youtube.com/embed/S7nQ2fnaA3Y?…
Bootstrapping Android Development: a Survival Guide
Developing Android applications seems like it should be fairly straightforward if you believe the glossy marketing by Google and others. It’s certainly possible to just follow the well-trodden path, use existing templates and example code – or even use one of those WYSIWYG app generators – to create something passable that should work okay for a range of common applications. That’s a far cry from learning general Android development, of course.
The process has changed somewhat over the years, especially with the big move from the Eclipse-based IDE with the Android Development Tools (ADT) plugin, to today’s Jetbrains IntelliJ IDEA-based Android Studio. It’s fortunately still possible to download just the command-line tools to obtain the SDK components without needing the Google-blessed IDE. Using the CLI tools it’s not only possible to use your preferred code editor, but also integrate with IDEs that provide an alternate Android development path, such as Qt with its Qt Creator IDE.
Picking Poison
Both Qt Creator and ADT/Android Studio offer a WYSIWYG experience for GUI design, though the former’s design tools are incomparably better. Much of this appears to be due to how Qt Creator’s GUI design tools follow the standard desktop GUI paradigms, with standard elements and constraint patterns. After over a decade of having wrangled the – also XML-based – UI files and WYSIWYG design tools in ADT/Android Studio, it never ceases to amaze how simple things like placing UI elements and adding constraints love to explode on you.
Somewhat recently the original Android API layouts also got ditched in favor of the ‘refactored’ AndroidX API layouts, with apparently now this Jetpack Compose being the (high-level) way to use. Over the years of me having developed for Android, many APIs and tools have been introduced, deprecated and removed at an increasingly rapid pace, to the point where having Android Studio or the CLI tools not freak out when confronted with a one year old project is a pleasant surprise.
Although Qt isn’t the only alternative to the Android Studio experience, it serves to highlight the major differences encountered when approaching Android development. In fact, Qt for Android offers a few options, including building a desktop Qt application for Android, which can also use the Qt Quick elements, or including Qt Quick within your existing Android application. For Qt Quick you want to either create the UIs by hand, or using Qt Quick Designer, though I have so far mostly just stuck to using Qt Creator and liberally applied stylesheets to make the UI fit the target Android UI.
Whichever way you choose, it’s important to know your requirements and take some time to work through a few test projects before investing a lot of time in a single approach.
The Build System
No matter what approach you choose, the build system for Android is based on what is objectively one of the worst build automation tools conceivable, in the form of Gradle. Not only does it take ages to even start doing anything, it’s also agonizingly slow, insists on repeating tasks that should already have been completed previously, provides few ways to interact or get more information without getting absolutely swamped in useless verbosity, and loves to fail silently if you get just the wrong Gradle version installed in your Android project.
Did I mention yet that the entire Gradle tool is a permanent fixture of your Android project? Android Studio will want to upgrade it almost every time you open the project, and if you don’t use an IDE like it which automates Gradle upgrades, you better learn how to do it manually. Don’t forget to install the right Java Development Kit (JDK) either, or Android Studio, Gradle or both will get very upset.
If your IDE doesn’t pave over many of these inane issues, then getting familiar with the Gradle wrapper CLI commands is right on the top of your list, as you will need them. Fortunately sticking to an IDE here tends to avoid the biggest pitfalls, except for having enough time with each build session to fetch a coffee and go on a brisk walk before returning to address the next build failure.
There are no real solutions here, just a call for perseverance and documenting solutions that worked previously, because you will always encounter the same errors again some day.
Test, Debug And Deploy
Even if you have built that shiny APK or app bundle, there’s a very high likelihood that there will be issues while running it. Fortunately the one advantage of JVM-based environments is that you get blasted with details when something violently explodes. Of course, that is unless someone screwed up exception handling in the code and your backtrace explodes somewhere in thin air instead. For the same reason using a debugger is pretty easy too, especially if you are using an IDE like Android Studio or Qt Creator that provides easy debugger access.
Logging in Android tends to be rather verbose, with the LogCat functionality providing you with a veritable flood of logging messages, most of which you want to filter out. Using the filter function of your IDE of choice is basically essential here. Usually when I do Android application debugging, I am either already running Qt Creator where I can start up a debug session, or I can fire up Android Studio and do the same here as at its core it’s the same Gradle-based project.
Of course, in order to have something catch on fire you first need to run the application, which is where you get two options: run on real hardware or use an emulator. Real hardware is easier in some ways, as unlike an emulated Android Virtual Device (AVD) your application can directly access the network and internet, whereas an AVD instance requires you to wrangle with network redirects each session.
On the other hand, using an AVD can be handy as it allows you to create devices with a wide range of screen resolutions, so it can be quite nifty to test applications that do not require you to connect to externally via the network. If you want to know for example how well your UI scales across screen sizes, and how it looks on something like a tablet, then using an AVD is a pretty good option.
Some hardware devices are also quite annoyingly locked-down, such as Xiaomi phones that at least for a while have refused to allow you to toggle on remote debugging via USB unless you install a SIM card. Fortunately this could be circumvented by clicking through an alternate path that the Xiaomi developers had not locked down, but these are just some of the obnoxious hurdles that you may encounter with real hardware.
With that out of the way, deploying to an AVD or real device is basically the same, either by using the ‘Start’ or similar function in your IDE of choice with the target device selected, or by doing so via the command-line, either with ADB, or via the Gradle wrapper with ./gradlew InstallDebug or equivalent.
This will of course be a debug build, with creating a release build also being an option, but this will not be signed by default. Signing an APK requires a whole other procedure, and is honestly something that’s best done via the friendly-ish dialogs in an IDE, rather than by burning a lot of time and sanity on the command-line. Whether you want to sign the APK or app bundle depends mostly on your needs/wants and what a potential app store demands.
Ever since Google began to demand that all developers – including Open Source hobbyists – send in a scan of their government ID and full address, I have resorted to just distributing the Android builds of my NymphCast player and server via GitHub, from where they can be sideloaded.
This NymphCast server is incidentally the topic of the next installment in this mini-series, in which we will be doing a deep dive into native Android development using the NDK.
Dal Commodore 64 a GitHub! Il BASIC di Gates e Allen diventa open source dopo 48 anni
Microsoft ha ufficialmente reso pubblico il codice sorgente della sua prima versione di BASIC per il processore MOS 6502, che per decenni è esistito solo sotto forma di fughe di notizie, copie da museo e build non ufficiali. Ora, per la prima volta, è pubblicato con licenza libera e disponibile per studio e modifica.
La prima versione del BASIC di Microsoft apparve nel 1975 per il microcomputer Altair 8800 basato sul processore Intel 8080. Fu scritta dai fondatori dell’azienda, Bill Gates e Paul Allen. Un anno dopo, Gates, insieme al secondo dipendente Microsoft, Rick Weiland, portò il BASIC sul processore MOS 6502. Nel 1977, Commodore acquistò la licenza per 25.000 dollari e la integrò nei suoi sistemi PET, VIC-20 e Commodore 64.
Gli ultimi due computer vendettero milioni di copie e divennero uno dei fattori determinanti nella diffusione di massa della tecnologia informatica.
La versione 1.1 è stata resa pubblica, tenendo conto dei miglioramenti al garbage collector proposti dall’ingegnere Commodore John Feagans e dallo stesso Gates nel 1978. Nei dispositivi PET, questa versione era nota come BASIC V2. Il codice contiene 6.955 righe di assembler è pubblicato su GitHub con licenza MIT, che ne consente l’uso e la rivendita senza restrizioni.
Microsoft ha fornito al repository note storiche e commit eseguiti con timestamp di “48 anni fa”. Il codice sorgente implementa la compilazione condizionale per diverse piattaforme dell’epoca: Apple II, Commodore PET, Ohio Scientific e KIM-1.
Le funzionalità includono un set completo di operatori BASIC, supporto per array, gestione delle stringhe, aritmetica in virgola mobile, I/O, garbage collection delle stringhe e archiviazione dinamica delle variabili.
Particolare enfasi è posta sull’uso efficiente della memoria, fondamentale per i sistemi a 8 bit. Il codice contiene anche gli Easter egg di Bill Gates, nascosti nelle etichette STORDO e STORD0, confermati dallo stesso Gates nel 2010.
Il MOS 6502, per il quale fu creato l’interprete, divenne una leggenda del settore.
Fu la base dell’Apple II, delle console di gioco Atari 2600 e NES e di un’intera linea di home computer Commodore. La semplicità e l’efficienza dell’architettura lo resero popolare tra i produttori e influenzarono la formazione del mercato dei personal computer. Oggi, l’interesse per il 6502 non accenna a diminuire: gli appassionati creano repliche FPGA, sviluppano emulatori e persino preparano una nuova riedizione “ufficiale” del Commodore 64 basata su logica programmabile.
Microsoft sottolinea che è stato il BASIC a rendere l’azienda un attore significativo sul mercato, molto prima della comparsa di MS-DOS e Windows. La concessione in licenza di massa di questo interprete da parte di vari produttori è diventata il fondamento del modello di business di Microsoft nei suoi primi anni.
Dal 1977 a oggi, il BASIC continua a vivere: dal cursore lampeggiante sullo schermo del Commodore alle versioni FPGA del 2025. Oggi, il codice storico non solo viene preservato, ma anche trasferito nelle mani della comunità, per studio, adattamento e nuovi esperimenti gratuiti.
L'articolo Dal Commodore 64 a GitHub! Il BASIC di Gates e Allen diventa open source dopo 48 anni proviene da il blog della sicurezza informatica.
like this
reshared this
Nuova ondata di attacchi di Quishing: Le tattiche innovative dai criminali informatici
Negli ultimi anni si è diffusa una forma di phishing particolarmente insidiosa: il Quishing o QRishing, una strategia basata sull’utilizzo di codici QR contenenti link malevoli che, una volta scansionati, reindirizzano le vittime su siti web falsi, creati appositamente per rubare le loro credenziali o informazioni sensibili.
Gli esperti di Barracuda Networks, principale fornitore di soluzioni di cybersecurity che offre una protezione completa dalle minacce complesse per aziende di ogni dimensione, hanno scoperto due tecniche innovative utilizzate dai criminali informatici per consentire ai codici QR malevoli di aggirare i sistemi di sicurezza negli attacchi di phishing. Queste tattiche, descritte in dettaglio in un nuovo report, prevedono la suddivisione in due parti di un codice QR per confondere i sistemi di scansione tradizionali, oppure l’inserimento di un codice QR dannoso all’interno o accanto a un secondo codice QR legittimo.
In particolare, gli analisti di Barracuda hanno riscontrato l’impiego di queste tecniche di suddivisione e accorpamento (o, secondo la definizione tecnica, “annidamento”) in attacchi condotti tramite alcuni dei principali kit di Phishing-as-a-Service (PhaaS), quali Tycoon e Gabagool.
Codici QR divisi in due
Gli hacker che hanno utilizzato Gabagool si sono serviti di codici QR splittati in una truffa che simula una richiesta di reset della password da parte di Microsoft. La loro strategia consiste nel dividere il codice QR in due immagini separate e inserirle molto vicine tra loro in un’e-mail di phishing.
In questo modo, all’occhio umano l’immagine appare come un unico codice. Tuttavia, quando i sistemi di sicurezza tradizionali analizzano il messaggio, rilevano due immagini distinte dall’aspetto innocuo, anziché un QR code completo. Ma se il destinatario scansiona l’immagine, viene reindirizzato su un sito di phishing creato doloso appositamente per rubare le sue credenziali.
Codici QR accorpati
Il kit PhaaS Tycoon, invece, utilizza la tecnica dell’annidamento per circondare un codice QR legittimo con uno dannoso: il codice QR esterno reindirizza a un URL doloso, mentre il codice QR interno rimanda a Google. Una tecnica ideata con buona probabilità per rendere più difficile l’individuazione della minaccia da parte degli scanner, poiché i risultati appaiono ambigui.
“I codici QR malevoli sono molto usati dai criminali informatici perché hanno un aspetto legittimo e possono aggirare le misure di sicurezza tradizionali, come i filtri e-mail e gli scanner URL”, dichiara Saravanan Mohankumar, manager, threat analysis team di Barracuda.
“Poiché per scansionare il codice i destinatari devono spesso utilizzare un dispositivo mobile, si finisce per operare al di fuori del perimetro di sicurezza dei computer e, di conseguenza, dalle relative protezioni. I cybercriminali continuano a sperimentare nuove tecniche per restare sempre un passo avanti rispetto alle misure di difesa. Per questo, una protezione integrata e potenziata dall’intelligenza artificiale può davvero fare la differenza”.
Codici QR in continua evoluzione: come difendersi
Oltre all’adozione di pratiche di base fondamentali come attività di formazione e sensibilizzazione sulla sicurezza informatica, autenticazione a più fattori e solidi filtri anti-spam e per le e-mail, è importante valutare l’introduzione di una protezione e-mail multilivello che includa capacità di AI multimodale per rilevare le minacce in continua evoluzione. Infatti, l’intelligenza artificiale multimodale rafforza la protezione identificando, decodificando e ispezionando il codice QR senza la necessità di estrarne il contenuto incorporato.
L'articolo Nuova ondata di attacchi di Quishing: Le tattiche innovative dai criminali informatici proviene da il blog della sicurezza informatica.
Nuova Campagna MintsLoader: Buovi Attacchi di Phishing tramite PEC sono in corso
Dopo una lunga pausa estiva, nella giornata di ieri il CERT-AgID ha pubblicato un nuovo avviso su una nuova campagna MintsLoader, la prima dopo quella registrata lo scorso giugno.
Rispetto alle precedenti ondate, il template dell’email risulta solo leggermente modificato, mantenendo però lo schema già noto. In particolare:
- invece del consueto link ipertestuale sulla parola “Fattura“, l’email presenta ora un file ZIP allegato;
- all’interno dell’archivio compresso è presente un file JavaScript offuscato che avvia la catena di compromissione.
Abuso di caselle PEC
Come già osservato nelle precedenti ondate, anche questa campagna mantiene la stessa natura di diffusione: i messaggi vengono inviati da caselle PEC compromesse a caselle PEC dei destinatari, sfruttando quindi il canale certificato per aumentare la credibilità e l’efficacia dell’attacco.
L’obiettivo finale è la compromissione dei sistemi delle vittime, in particolare macchine Windows (dalla versione 10 in poi), dove la disponibilità del comando cURL viene sfruttata per avviare la catena d’infezione e installare malware, generalmente appartenenti alla categoria degli infostealer.
Strategia temporale
È inoltre interessante evidenziare come venga mantenuta la stessa strategia temporale già descritta nel precedente avviso del CERT-AGID, con un ritorno delle attività in coincidenza con la ripresa lavorativa post-estiva.
Raccomandazioni
Si raccomanda di prestare attenzione a messaggi email sospetti, in particolare a quelli con oggetto relativo a fatture scadute e contenenti allegati ZIP, evitando in ogni caso di estrarre gli archivi e interagire con i file al loro interno. Nel dubbio, è sempre possibile inoltrare le email ritenute sospette alla casella di postamalware@cert-agid.gov.it
Azioni di contrasto
Le attività di contrasto sono state già messe in atto con il supporto dei Gestori PEC. Gli IoC relativi alla campagna sono stati diramati attraverso il Feed IoC del CERT-AGID verso i Gestori PEC e verso le strutture accreditate.
L'articolo Nuova Campagna MintsLoader: Buovi Attacchi di Phishing tramite PEC sono in corso proviene da il blog della sicurezza informatica.
Berichte über Überwachung in Gaza: Microsoft entlässt Mitarbeitende nach Protesten
netzpolitik.org/2025/berichte-…
Li trovo davvero orrendi. Soffro forse di un deficit cognitivo?
Snow
in reply to simona • • •simona likes this.
OrionBelt©
in reply to simona • • •simona likes this.
simona
in reply to simona • •