The RISKS Digest
Volume 31 Issue 80

Wednesday, 6th May 2020

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

Circumventing Censorship
Fenello
Brit cyber-spies drop 'whitelist' and 'blacklist'—political correctness gone mad?
The Register
Tracking your browsing using HTML canvas fingerprinting
Web Informant
UK finds itself almost alone with centralized virus contact-tracing app that probably won't work well, asks for your location, may be illegal
The Register
Visualization shows droplets from one cough on an airplane infecting large number of passengers, researchers say
FoxNews
Social Distancing Informants Have Their Eyes on You
NYTimes
BSides
World Netwide Online via Rob Slade
Re: Online voting is too vulnerable
Mark E. Smith
Re: statistics and protection - Remdesevir
David Alexander
Re: Big Rigs Begin to Trade Diesel for Electric Motors
Richard Stein
Info on RISKS (comp.risks)

Circumventing Censorship (Fenello)

geoff goodfellow <geoff@iconia.com>
Mon, 4 May 2020 17:38:15 -1000

EXCERPT:

Today, we live in a world that is interconnected at an historic rate. We can directly interact with billions of people via phone, text, and email, as well as assorted online platforms. News is also abundantly available through traditional TV, radio and print, as well as newer venues like youtube and other online websites.

But what appears to be robust and permanent, is actually fragile and under attack. Messages that differ from the accepted narratives are being deleted at an alarming rate, while those responsible for those message are being demonetized and de-platformed. People are also being shadow-banned, resulting in their messages getting reduced visibility and circulation, all without anyone's knowledge.

And it's not just the private networks either. We know from governments like China and revelations from Edward Snowden, that even more draconian measures are possible. Websites can be de-indexed from the search engines, taken offline, or even replaced with fake versions. Phone numbers and text can be blocked, as well as entire cellular and Internet networks.

To circumvent these measures, here are a few options:

[…] https://www.fenello.com/blog/circumventing-censorship/


Brit cyber-spies drop 'whitelist' and 'blacklist'—political correctness gone mad?

Li Gong <ligongsf@gmail.com>
Sun, 3 May 2020 23:15:16 -0700

https://www.theregister.co.uk/2020/05/02/uks_ncsc_whitelist_blacklist/


Tracking your browsing using HTML canvas fingerprinting (Web Informant)

Gabe Goldberg <gabe@gabegold.com>
Tue, 5 May 2020 18:06:18 -0400

Author writes:

Every time you fire up your web browser your movements and browser history are being leaked to various websites. No, I am not talking about cookies, but about a technology that you may not have heard much about. It is called canvas fingerprinting.

In this post, I will tell you what it does and how you can try to stop it from happening. Beware that the journey to do this isn't easy.

The concept refers to coordinating a series of tracking techniques to identify a visitor using what browser, IP address, computer processor and operating system and other details. Canvas is based on the HTML 5 programming interface that is used to draw graphics and other animations using JavaScript. It is a very rich and detailed interface and to give you an idea of the data that the browser collects without your knowledge, take a look at the screenshot below. It shows my computer running Chrome on a Mac OS v.10.13 using Intel hardware. This is just the tip of a large iceberg of other data that can be found quite easily by any web server.

https://blog.strom.com/wp/?p=7749


UK finds itself almost alone with centralized virus contact-tracing app that probably won't work well, asks for your location, may be illegal

Dave Farber <farber@gmail.com>
Wed, 6 May 2020 02:19:05 +0900

https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/


Visualization shows droplets from one cough on an airplane infecting large number of passengers, researchers say (FoxNews)

geoff goodfellow <geoff@iconia.com>
Mon, 4 May 2020 17:36:21 -1000

The coronavirus pandemic has brought air travel to an unprecedented standstill—wreaking all sorts of havoc and putting countless jobs at risk — but a new visualization is unlikely to make people eager to fly the friendly skies again soon. <https://www.foxnews.com/category/health/infectious-disease/coronavirus>

The motion graphic produced by Purdue University researchers shows the aftermath of a single cough on an airplane, with tiny invisible droplets dispersing throughout the cabin, possibly infecting a large number of fellow passengers. […]

https://www.foxnews.com/science/visualization-droplets-one-cough-airplane-infecting-passengers


Social Distancing Informants Have Their Eyes on You (NYTimes)

Monty Solomon <monty@roscom.com>
Tue, 5 May 2020 09:59:54 -0400

Largely confined to their homes and worried about the spread of the coronavirus, members of the public are becoming unofficial watchdogs.

https://www.nytimes.com/2020/05/04/us/social-distancing-rules-coronavirus.html


BSides (World Netwide Online)

Rob Slade <rmslade@shaw.ca>
Tue, 5 May 2020 12:34:05 -0700

So, a number of us are at home, prevented from going to any of the normal round of security conferences.

But we are creative and inventive people, and we know the tech. So, why not create our own?

I'm thinking the BSides model, trying to keep it as cheap (free?) as possible, for the widest possible access. (I'm thinking this because of the notices I am receiving from various vendors who are trying to actually sell their sales presentations, or combinations thereof, as conferences.) (I may be jumping the gun on that name/brand: I don't know who owns the BSides model or brand, and while I highly respect it, I don't want to step on any toes by simply assuming it.)

I'm thinking this is more than just a big Zoom meeting, or even a series of Zoom meetings.

Anybody in?


Re: Online voting is too vulnerable (RISKS-31.79)

“Mark E. Smith” <mymark@gmail.com>
Tue, 5 May 2020 19:31:23 -0500

Dick Mills appears to understate the risks to the public from US elections, whether the votes are cast online or not. Since the US Constitution does not require that the popular vote be counted, it is the Constitution itself, not the way in which elections are held, that constitutes a risk to the public, who can be fooled into thinking that their vote is a form of participation or a voice in government, when it is, in reality, merely an expression of wishful thinking. An election in which a candidate who loses both the popular and Electoral votes can still become President, is not a democratic process that ensures meaningful public input or influence.


Re: statistics and protection - Remdesivir

David Alexander <davidalexander440@btinternet.com>
Wed, 6 May 2020 08:08:14 +0000 (UTC)

Rob Slade looks for details in the reports on the trial of Remdesivir (Remdesivir works against CoVID-19! https://lite.cnn.com/en/article/h_1a62255cc20919cda25d487543ad9118) and I agree that the message the data gives does need to be managed to ensure it does not give a false sense of security. Unfortunately Rob appears to have missed one obvious point. The drug may not lower the mortality rate by much (but as far as I am concerned any life saved is a significant bonus for that individual, their family & friends) but reducing the recovery time by 4 days is absolutely crucial for a medical and care system that is heavily over-loaded. If it can get people out of hospital 4 days earlier, freeing up the bed and care professionals to treat somebody else who might otherwise die for a lack of treatment, that is a game changer, a 'force multiplier' for good. disclaimer: I am not a healthcare professional (but my fiancee is) nor do I have any connection with the pharmaceutical industry, except as a satisfied customer.


Re: Big Rigs Begin to Trade Diesel for Electric Motors (RISKS-31.64)

Richard Stein <rmstein@ieee.org>
Wed, 6 May 2020 20:08:40 +0800

https://catless.ncl.ac.uk/Risks/31/64#subj10.1

Privately-owned vehicles converted from carbon-fuel to battery-driven propulsion are apparently compliance-exempt from FMVSS 141, save for certain conversions as noted. The NY Times piece identifies at least one company that sells and conversion kits for classic VW models.

A battery-powered stretch-Humvee does not need to hum unless it wants to.

Here's the NHTSA's Office of Vehicle Safety Compliance (OVSC) response to my inquiry on after-market vehicle conversions.

From: OVSCPublic@dot.gov Date: 06MAY2020

Please note that the response provided below does not constitute authoritative legal advice. If you would like an authoritative answer, please request an interpretation from NHTSA's Office of Chief Counsel.

Please also note that you may wish to consider the relevance of state/local laws and insurance policies.

If this is a privately owned vehicle, and you are the owner, it is likely that modifications that you make do not fall under NHTSA's authority and would not need to comply with FMVSS 141 unless your modifications are extensive enough to make this a new vehicle (e.g. if an old body is placed on a new chassis). That being said, we would encourage vehicle owners to carefully consider whether vehicle modifications alter the vehicle in a way that might affect safety, and to take appropriate steps to ensure motor vehicle safety.

NHTSA's enforcement authority applies primarily to entities such as manufacturers, distributors, dealers, and motor vehicle repair businesses rather than individual owners. If you are not the owner of the vehicle, you are likely to be considered such an entity. (In certain cases, you may also be such an entity even if you are the individual owner.) In such a case, we suggest seeking an interpretation from the Office of Chief Counsel or contacting the Compliance Assistance Program.

The entities mentioned above are responsible for ensuring that vehicles comply with FMVSS that were applicable at the time of first sale - i.e. new vehicles. After first sale, such entities may not modify vehicles in a manner that knowingly makes inoperative part of a device or element of design that is required to maintain compliance with FMVSSs (see 49 USC 30122). Consequently, a business modifying/repairing a vehicle would need to consider whether they are modifying the vehicle in a manner that maintains compliance with the FMVSSs that applied to the vehicle at the time it was originally manufactured. Additionally, the answer to your question may hinge on whether the vehicles you intend to produce are consider new or used. If they are considered used, then FMVSS 141 would likely not apply. If the vehicle is considered new (e.g. if an old body is placed on a new chassis), then FMVSS 141 would apply subject to the phase-in schedule detailed in 49 CFR 571.141 S9. The phase-in schedule applies to small volume manufacturers beginning on September 1, 2020.

The Office of Chief Counsel has previously addressed correspondence similar to your question. Please note that these interpretations are being provided as a reference and may not be applicable to your specific circumstances:

* https://isearch.nhtsa.gov/files/8439.html
* https://isearch.nhtsa.gov/gm/92/nht92-8.48.html

For more information about interpretations from NHTSA's Chief Counsel, see https://isearch.nhtsa.gov/ For more information on the Compliance Assistance Program, see https://www.nhtsa.gov/laws-regulations/compliance-assistance-program-cap

Thank you, OVSC Public

Please report problems with the web pages to the maintainer

x
Top