Un network di account sospetti ha spinto la campagna sui social contro Mattarella

Un network di “account sospetti” su twitter, strutturato e con movenze organizzate, ha prodotto una forte spinta artificiale a tre hashtag di propaganda (a volte con contenuti anche di propaganda pesante e di minacce) contro il presidente della Repubblica Sergio Mattarella, nei due giorni più caldi della crisi per la formazione del nuovo governo, di domenica e lunedì scorso. Sono i giorni in cui il Movimento cinque stelle gridava all’impeachment contro Mattarella, anche se gli account di questo network non presentano evidenze riconducibili a un partito ufficiale. Gli account non mostrano neanche segni di interferenza straniera, appaiono piuttosto frutto di farm italiane. La sostanza, comunque inquietante, è che dei network si muovono per attaccare online la presidenza della Repubblica, contribuendo a invelenire e esasperare una situazione politica già molto difficile. 

 

È quanto emerge da un report di due informatici, Andrea Stroppa e Danny di Stefano, che hanno utilizzato un algoritmo per individuare la propaganda digitale (da loro già impiegato - quasi identico - durante il World Economic Forum di Davos 2018) per analizzare tre hashtag: #mattarelladimettiti, #impeachment e #impeachmentmattarella. L’analisi ha individuato 360 account. È stata condotta dal 27 maggio (alle ore 21.50) al giorno successivo (alle 14.30). «Non parliamo di bot o troll - scrivono gli autori - ma di “account sospetti”: questo perché in uno scenario così altamente complesso, indicare un account come bot o troll è difficilmente dimostrabile, in particolar modo in un ecosistema di propaganda digitale molto discusso». La ragione principale è semplice: «Se indichiamo l’account @marioRossi232323 come bot, perché le sue caratteristiche del profilo e i suoi contenuti o azioni dimostrano automazioni, chi gestisce il presunto bot, un essere umano, potrebbe prenderne il controllo all’istante e iniziare a usarlo in prima persona, provando quindi a dimostrare l’infondatezza di una ricerca». Account generati da un software possono poi tranquillamente “animarsi”, ossia essere operati da umani. 

 

Sono stati quindi usati quattro criteri in questa analisi, confermata alla Stampa anche da una terza parte: composizione del nickname e caratteristiche del profilo, proporzione (ratio) tra following e followers, argomenti trattati, analisi di network. Per esempio, un account normale di solito tende ad avere più follower rispetto ai following, o almeno non in modo sproporzionato. Il report dunque considera solo gli account che, per ogni follower, hanno invece seguìto almeno 5 persone. Le conclusioni a cui arrivano i due informatici sono queste: è stata in corso contro la presidenza della Repubblica «una azione coordinata di digital propaganda, ben studiata in modo da potersi agevolmente nascondersi in mezzo agli account legittimi. Non ci sono evidenze che questi account appartengano ufficialmente a partiti politici come Lega Nord e M5S». Né che la campagna provenga dall’estero. «È però allo stesso modo evidente che in Italia esiste una rete in grado di manipolare eventi politici e sociali, con capacità di poter amplificare fenomeni e farli diventare virali». 

 

L’analisi non si sofferma volutamente su «account importanti» (il numeor di follower di per sé non dice granché, sono molto più interessanti il network, e eventualmente i livelli e il tipo di engagement), ma su quella che è - diciamo così - la loro «base sottostante» di piccoli account sospetti. Da questo punto di vista, le disinfo ops o le ops di black propaganda stanno lievemente mutando forma, nell’ultima stagione, almeno in Italia, cercando di polverizzarsi e mimetizzarsi il più possibile con account naturali dei social. Eviteremo quindi di citare gli account del report Stroppa-Di Stefano, ma solo alcuni dei loro contenuti, che vanno dalla satira pesante («Mattarella ha un würstel al posto del cuore #impeachment») all’insulto («traditore della patria» è il più tenue) o alla violenza verbale («Così #Mattarella butta nel cesso il voto di 15 milioni di italiani. Perché secondo lui la sovranità in Italia appartiene alla #UE e alla #Merkel e non al popolo italiano»), alla minaccia («Don’t Fear The Reaper» - «non temere la Grande Mietitrice», cioè la morte, e sotto, una foto di Mattarella in camice ospedaliero e la scritta «do not intubate do not reanimate»). Inutile procedere oltre, era solo per dare una vaga idea. Augurano o minacciano di morte Mattarella. 

 

Il punto centrale - bisogna ripeterlo - è che secondo i due informatici si tratta di un preciso network: il sample analizzato è relativamente piccolo, ma potrebbe essere più largo (i criteri per l’inclusione sono stati molto selettivi, spiegano gli autori). Molti account del network sono sotto «limitazione temporanea» da parte di twitter, o subiscono restrizioni: segno che sono stati oggetti di ripetute segnalazioni, o sono sotto l’attenzone della cybersecurity dell’azienda. Altri presentano, anche a prima vista, una congiunzione di interessi politici che è poi alla base di alleanze reali attuali, tra sovranismo, ultranazionalismo, tematiche sociali (nazionali e sociali), temi anti-establishment. Una politica parallela è insomma pronta a essere scatenata e rialzata, se davvero si andasse al voto bisognerà tener d’occhio le reti, dove contenuti sovranisti, fortemente nazionalista e anticasta si sono sposati ormai da tre anni, e invocano con modi brutali la rivoluzione legastellata. 

Alcuni diritti riservati.

Read the full article here by LASTAMPA.it

Intel Core i7-8086K Listed, First 5.00 GHz Processor

Intel is commemorating 40 years of its 8086 processor, the spiritual ancestor of the x86 machine architecture that rules modern computing, with a special edition socket LGA1151 processor, dubbed Core i7-8086K. The chip appears to feature a nominal clock speed of 4.00 GHz, with a maximum Turbo Boost frequency of 5.00 GHz, making it the first mainstream desktop processor to hit the 5.00 GHz mark, out of the box.

The Core i7-8086K is more likely to be based on a special bin of the 14 nm, 6-core/12-thread "Coffee Lake" silicon, rather than being something next-gen or 8-core. The retail SKU bears the part number "BX80684I78086K." The chip will be compatible with Intel 300-series chipset motherboards. Pre-launch listings put its price around $486, which is along expected lines, as it's 70-100 EUR pricier than the i7-8700K. Intel could unveil the Core i7-8086K at the 2018 Computex (specifically on the 8th of June), alongside the first motherboards based on its Z390 Express chipset.

Sources: VideoCardz, Connection, Merlion

Read the full article here by techPowerUp!

Microsoft Developing a Tool To Help Engineers Catch Bias in Algorithms

Microsoft is developing a tool that can detect bias in artificial intelligence algorithms with the goal of helping businesses use AI without running the risk of discriminating against certain people. From a report: Rich Caruana, a senior researcher on the bias-detection tool at Microsoft, described it as a "dashboard" that engineers can apply to trained AI models. "Things like transparency, intelligibility, and explanation are new enough to the field that few of us have sufficient experience to know everything we should look for and all the ways that bias might lurk in our models," he told MIT Technology Review. Bias in algorithms is an issue increasingly coming to the fore. At the Re-Work Deep Learning Summit in Boston this week, Gabriele Fariello, a Harvard instructor in machine learning and chief information officer at the University of Rhode Island, said that there are "significant ... problems" in the AI field's treatment of ethics and bias today. "There are real decisions being made in health care, in the judicial system, and elsewhere that affect your life directly," he said.

Read more of this story at Slashdot.

Read the full article here by Slashdot

Mystery donor pledges $1 million to The GNOME Foundation

Despite being the default desktop environment for the two most important Linux distributions in the world -- Fedora and Ubuntu -- GNOME is not a money-making project. Actually, it is run by a non-profit called The GNOME Foundation that relies heavily on donations from both organizations and individuals. That's what makes GNOME so extraordinary -- the high quality desktop environment and apps are largely a labor of love. Today, The GNOME Foundation makes a shocking revelation -- a mystery donor has pledged $1 million dollars! We don't know who is promising the money -- it could be a rich man… [Continue Reading]

Read the full article here by Betanews

Feral's GameMode May Soon Have Soft Real-Time Capabilities

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 10,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Read the full article here by Phoronix

Rune - Haiku images on ARM

Up until recently, Haiku builds for ARM have targetted individual ARM boards. The compile process for ARM images required two things: an architecture, and a target board (such as the Raspberry Pi 2). This board setting adjusted a large number of defines throughout Haiku at compile time to set the operating system up for the target ARM device. The board selection also handled placing all the propriety bits (a lot of which have sketchy licensing) into the Haiku image during compile. Haiku would then have to distribute these files. (sketchy licensing and all)

Over the past few years, François Revol, Ithamar R. Adema, and others have worked to add Flat Device Tree (FDT) support to Haiku. FDT’s enable operating systems to obtain core knowledge of the devices they run on by simply swapping one or more compiled binary files. These files describe critical things the operating system needs to know about the hardware they run on. Really important things such as what devices exist at what memory locations. (Think video frame buffers, serial ports, etc)

In a series of cryptic commits in July 2017, I removed these board-centric build steps with grand plans of making testing (and running) Haiku on ARM devices easier.

No, this does not mean Haiku now runs on ARM, as it has been able to do that for a while now. The goal of these changes and improvements is to speed up development of Haiku's ARM build, and to simplify the distribution of ARM builds into a single, generic ARMv7 image.

Read the full article here by OSNews

SafeKeeper: protecting web passwords using trusted execution environments

SafeKeeper: protecting web passwords using trusted execution environments Krawiecka et al., WWW’18

(If you don’t have ACM Digital Library access, the paper can be accessed either by following the link above directly from The Morning Paper blog site, or from the WWW 2018 proceedings page).

Today’s paper is all about password management for password protected web sites / applications. Even if we assume that passwords are salted and hashed in accordance with best practice (NIST’s June 2017 digital identity guidelines now mandate the use of keyed one-way functions such as CMAC), an adversary that can obtain a copy of the back-end database containing the per-user salts and the hash values can still mount brute force guessing attacks against individual passwords.

SafeKeeper goes a lot further in its protection of passwords. What really stands out is the threat model. SafeKeeper keeps end user passwords safe even when we assume that an adversary has unrestricted access to the password database. Not only that, the adversary is able to modify the content sent to the user from the web site (including active content such as client-side scripts). And not only that! The adversary is also able to read all content sent to the backend servers, including any content encrypted by a TLS session key. The adversary can also execute any software they like on the backend server(s), and can launch state-of-the-art phishing attacks. Such as adversary for example, could be one that has taken over a backend server, or an operator of the service, or an operator of a service that a client has been hoodwinked into connecting to in lieu of the real thing.

Given an adversary like that, how is it possible to design a system that protects users’ passwords !? The adversary should not be able to obtain a user password though any means other than guessing. Offline guessing should be computationally infeasible irrespective of password strength, and online guessing must be throttled (rate limited) regardless of the adversary’s computational capabilities. The end user must also be able to tell whether they are communicating safely with a trustworthy backend service.

The answer is a clever use of trusted execution environments (Intel SGX in this case).

High-level design of SafeKeeper

On the server side, SafeKeeper’s password protection service computes cipher-based message authentication codes (CMAC) on salted passwords before storing them in the database. To perform a guessing attack against such passwords, an adversary also requires the CMAC key. SafeKeeper randomly generates this and protects it within an SGX enclave.

To prevent repeated guessing attacks using the online service, SafeKeeper enforces rate limiting within the trusted execution environment.

To prevent eavesdropping on passwords before they arrive at the password protection service, SafeKeeper establishing a secure end-to-end channel directly between the client and the enclave.

To ensure the client can trust the backend service it is interacting with, remote attestation is used to validate that the client is communicating with a genuine SafeKeeper Trusted Application.

To ensure that the user knows it is safe to their credentials, the SafeKeeper browser add-on displays trust information for the backend service, and highlights to the user the input fields that will be protected.

Server-side protection

The server-side is implementation as an SGX enclave.

• The init function is called whenever the enclave is started. If this is the first time the enclave has been started, Intel’s hardware random number generator is used to generate a new strong CMAC key.
• The shutdown function seals the enclave state (CMAC key, the map of salts, and password attempt counters) so that it can be securely stored outside of the enclave. This sealed data can be restored in the enclave on subsequent calls to init.
• The process function takes as input a password (encrypted on the client-side) and corresponding salt value, it calculates the CMAC and returns the result. This result can be stored by the database when the password is first set, and then tested against in future login attempts.

Rate-limiting is done on a per-salt basis (no user ids are passed to the enclave). Assuming a salt-per-user, this is equivalent to rate-limiting by user. SafeKeeper uses a quantized maximum rate limit for each salt, which allows a fixed number of attempts within a pre-defined time interval but doesn’t mandate a delay between the attempts. Once the number of attempts has been exceeded, the user must wait until the next time interval before they can try again.

Remote attestation

Via a process known as remote attestation, a client can verify it is communicating with an endpoint that is running a genuine copy of the SafeKeeper Trusted Application inside a genuine SGX enclave.

Remote attestation is the process through which one party, the verifier, can ascertain the precise hardware and software configuration of a remote party, the prover. The objective is to provide the verifier with sufficient information to make a trust decision about the prover. SGX supports remote attestation by providing verifiers with a signed quote from the enclave, which includes the enclave’s precise identity (MRENCLAVE value) and the enclave’s public key. The verifier can then validate this quote using the Intel Attestation Service (IAS), and can then establish an end-to-end encrypted channel directly to the enclave.

The configuration information in the quote is checked by the client against a whitelist of known SafeKeeper Trusted Applications (TAs). The same TA can be used as-is by many websites, so this list should be short. Since the key agreement step to establish a session key is cryptographically bound to the TA’s remote attestation, the adversary cannot perform a man-in-the-middle attack. The client encrypts the user-supplied password using the session key, and on the server it is this encrypted password that is passed as input to the process function of the enclave, which can decrypt using the shared key.

Client-side assurances

The client-side mechanism is implemented as a browser addon (e.g., a Chrome extension). The server specifies which input fields should be encrypted and sent to the SafeKeeper TA. The addon parses this information and encrypts any text entered into these fields.

A rogue server might specify the wrong field names though, leaving the actual password field unprotected. To prevent this, SafeKeeper visually highlights the fields to be encrypted, greying out the rest of the page.

To avoid an adversary spoofing the highlighting performed by SafeKeeper, the user is required to click on the extension icon to activate the highlighting.

This click cannot be detected or prevented by the adversary (as it is outside of the browser DOM). After the user has clicked, the SafeKeeper icon is again changed to indicate that it is in the highlighting mode… The user is thus assured that a password entered into such an input field will always be protected by SafeKeeper, regardless of the identity of the website or the behaviour of the server.

The addon is stateless and user-agnostic, which means it could also be directly integrated into web browsers.

What about…?

A malicious server operator can include javascript in the page that attempts to read the password as it is typed by the user. SafeKeeper provides a mode which will disable scripts for an individual website and then reload the page with all scripts but SafeKeeper’s blocked. It’s not perfect (there are race conditions), and on many modern sites disabling javascript interferes with the usability of the web page, so SafeKeeper allows client-side scripts by default. An alternative discussed in the extended technical report is to change the UI so that the password is directly entered into a SafeKeeper popup controlled by the extension. For this to work, users must be trained to only enter password data into SafeKeeper popups.

I also wondered about the enclave becoming a single point of failure, and how SafeKeeper would provide high availability. The answers can be found in sections 7.1 and 7.2 of the extended technical report. SafeKeeper supports backup and recovery across a set of key-holding enclaves, with unanimous approval of all current key holding enclaves required to add a new one. If a machine fails, an operator must provide a proof that the failed machine has been revoked in order to change the set of key holding enclaves. If desired, the backup and recovery protocol can be extended to support multiple concurrent primaries. In this case, the overall permissible password checking rate is divided amongst the primaries.

The SafeKeeper site including links to all technical papers and the source code can be found at https://ssg.aalto.fi/research/projects/passwords/.

Read the full article here by the morning paper

Spectre and Meltdown variant 4: Microsoft, Google and Intel reveal new Speculative Store Bypass chip vulnerability

Just when you thought you could forget about the Spectre and Meltdown chip vulnerabilities, yet another variant has been discovered. Known as Speculative Store Bypass, the vulnerability affects chips from AMD and Intel, as well as Power 8, Power 9 and System z processors. The vulnerability has been assigned CVE-2018-3639, and successful exploitation would mean that an attacker could gain access to data. The attack can be carried out through a "language-based runtime environment" such as JavaScript. Some patches exist while others are in development, and they include the same performance hit associated with patches for the previous vulnerabilities. See… [Continue Reading]

Read the full article here by Betanews

No-Battery HD Video Streaming Does It with Backscatter

What if Google Glass didn’t have a battery? That’s not too far fetched. This battery-free HD video streaming camera could be built into a pair of eyeglass frames to stream HD video to a nearby phone or other receiver using no bulky batteries or external power source. Researchers at the University of Washington are using backscatter to pull this off.

The problem is that a camera which streams HD video wirelessly to a receiver consumes over 1 watt due to the need for a digital processor and transmitter. The researchers have separated the processing hardware into the receiving unit. They then send the analog pixels from the camera sensor directly to backscatter hardware. Backscatter involves reflecting received waves back to where they came from. By adding the video signal to those reflected waves, they eliminated the need for the power-hungry transmitter. The full details are in their paper (PDF), but here are the highlights.

On the camera side, the pixel voltages (CAM Out) are an analog signal which is fed into a comparator along with a triangular waveform. Wherever the triangle wave’s voltage is lower than the pixel voltage, the comparator outputs a 0, otherwise, it outputs a 1. In this way, the pixel voltage is converted to different pulse widths. The triangular waveform’s minimum and maximum voltages are selected such that they cover the full possible range of the camera voltages.

The sub-carrier modulation with the XOR gate in the diagram is there to address the problem of self-interference. This is unwanted interference from the transmitter of the same frequency as the carrier. And so the PWM output is converted to a different frequency using a sub-carrier. The receiver can then filter out the interference. The XOR gate is actually part of an FPGA which also inserts frame and line synchronization patterns.

They tested two different implementations with this circuit design, a 112 x 112 grayscale one at up to 13 frames per second (fps) and an HD one. Unfortunately, no HD camera on the market gives access to the raw analog pixel outputs so they took HD video from a laptop using USB and ran that through a DAC and then into their PWM converter. The USB limited it to 10 fps.

The result is that video streaming at 720p and 10 fps uses as low as 250 μW and can be backscattered up to sixteen feet. They also simulated an ASIC which achieved 720p and 1080p at 60 fps using 321 μW and 806 μW respectively. See the video below for an animated explanation and a demonstration. The resulting video is quite impressive for passive power only.

If the University of Washington seems familiar in the context of backscatter, that’s because we’ve previously covered their battery-free (almost) cell phone. Though they’re not the only ones experimenting with it. Here’s where backscatter is being used for a soil network. All of this involves power harvesting, and now’s a great time to start brushing up on these concepts and building your own prototypes. The Hackaday Prize includes a Power Harvesting Challenge this year.

Read the full article here by Hack a Day

Hyper-realistic racing game 'Project Cars' is coming to mobile

Flutter beta 3 released, Fuchsia gets initial ART support

Tomorrow at Google I/O’s developers keynote, we will see the official launch of Flutter Beta 3. This beta is an important step towards the 1.0 build for Flutter, with a heavy focus on solidifying the improvements that Google has been working since they launched the initial Flutter Beta.

First and foremost among those improvements is the implementation of the Dart 2 programming language. The second version of Dart was designed specifically with the challenges that early Flutter builds ran into in mind, and brings some substantial changes, including strong typing, cleaner syntax, and an updated developer tool chain.

Flutter and Dart are also important parts of Fuchsia. And on that note, might I point out that Fuchsia is getting support for ART, the Android Runtime?

Read the full article here by OSNews

Fatal Crash Rate

Read the full article here by xkcd.com

Microsoft Enabling Javascript in Excel Has Security Pros Anxious

On Monday at its Build conference in Seattle, Microsoft announced a host of software products and updates related to buzzy technologies like machine learning and mixed reality. But the company also debuted a number of smaller upgrades to existing products, including a new Excel feature that allows users to execute custom JavaScript functions in spreadsheets. That might be helpful for spreadsheet junkies, but it makes security researchers cringe.

The move is well-intentioned; it should make Excel even more powerful and capable by allowing users to integrate expanded information from the web and third-party services—think bank account balances or stock prices. But JavaScript also creates more interconnection and more access points—meaning more points of potential vulnerability. It's already a bit of a web security nightmare. And on top of that, attackers have long shown their willingness to exploit customization and automation features in Excel—and other Microsoft Office programs—to create malicious files for phishing and other attacks. The ubiquity of Microsoft Office files make them the perfect vector for tricking victims and wreaking havoc.

Streamlining the tool for legitimate users could make it more effective for attackers.

"JavaScript opens up another attack vector for malicious documents, and is yet another thing that we as defenders will have to watch out for other than what Excel can already do," says Chase Dardaman, a malware analysis researcher based in Texas. "The main concern is that since JavaScript usage in Excel is so new we do not know what controls Microsoft will put around it. They will need to make it more open and easier to use than it currently is, and that could open up new attack vectors."

JavaScript is an extremely popular programming language, and has been around since 1995. It's often used to power common features on websites like multimedia modules and form submissions. But if JavaScript components aren't contained and limited in what they can access, attackers can potentially exploit them to access and manipulate systems and execute malicious code. In just one example, hackers are known to exploit insecure JavaScript implementations to pull of cross-site scripting (XSS), which lets attackers hijack websites to steal data or serve malware to innocent visitors. JavaScript has also been around for so long that lots of buggy prefab code exists in libraries around the web, and frequently gets incorporated into unsuspecting websites.

Right now Microsoft has only released the expanded Excel functionality to members of its "Office Insiders" program, so it still has time to refine the implementation. In particular, observers say they hope Microsoft will turn JavaScript execution off by default, so Excel only allows the custom functions to run after specifically prompting a user to approve—or deny—it each time. A company spokesperson said in a statement to WIRED that, "We take the security of our customers seriously, and by design, only trusted logic can execute within the context of a custom function—with appropriate controls to gate usage.”

As the company works on the new feature, analysts are already exploring what attackers could do with it if and when it hits the mainstream market. Within a day of the announcement this week, Dardaman published a proof of concept that showed how the new functionality could be programmed to run the CoinHive cryptomining program through an Excel document. Dardaman was even able to set things up so that the mining quietly relaunched each time a user opened the compromised Excel file.

Thankfully, the pre-release of JavaScript for Excel makes it difficult to share tainted files, but researchers say that protection largely stems from JavaScript for Excel still being in a testing phase. Eventually, Dardaman suspects that Microsoft will refine the feature and make it easier to use. Streamlining the tool for legitimate users could make it more effective for attackers.

"I understand what Microsoft is going for with this, but I believe the harm vastly outweighs the good," says Mitch Edwards, a threat intelligence analyst and researcher. "Accessibility has been put before security for a long time. We in the security community are still trying to get a grip on other attack vectors in the Office Suite, and the addition of JavaScript functionality to Excel adds another tool to the belt of the attacker."

Observers note that a cryptominer isn't the only thing an attacker could program into a JavaScript-enabled Excel file. Phishers and targeted attackers looking to gain access to a system or spread malware could lean on these innocuous-looking file downloads as the jumping off point to achieving a number of goals, from data theft to gaining remote control of a victim's device. Just look at how attackers have exploited the Office automation feature "Macros" for years, building special "Macro malware" to spread in spam emails and ZIP files.

"With all of the badness JavaScript can cause, I'd imagine that Microsoft is going to have to handle it the same way that they handle Macros, which is to have it turned off by default," says Crane Hassold, a threat intelligence manager at the security firm PhishLabs, who previously worked as a digital behavior analyst for the FBI. If the company doesn't, he says, the feature will become popular with "not just phishers, but cyber threat actors in general."

Hacking Microsoft

Read the full article here by Wired Top Stories

CineMAH presenta:INFINITY GUANTY persy a scuoly

04/05/2018

Vi dico subito che questa pseudo recensione contiene spoiler, glutine, tracce di frutta secca in guscio e lattosio. Non dite che non vi avevo avvertiti. E comunque, dai, ma che vi frega, tanto è un film Marvel, mica LA MOGLIE DEL SOLDATO! Anche se non lo avete visto, ve lo avranno raccontato i milioni di spoileratori professionisti che vivono solo per andare al cinema prima di tutti, prima anche del regista e degli attori, solo per il gusto di dirvi “Ah, ma non lo sai che Furenzio è MMOOORTOOOOO?” E Furenzio è lui.

Buio in sala. Si comincia. Con quella cosa che mi piace un sacchissimo che è il logo dei Marvel Studios. Quando lo vedo, con la sua musica trionfale, per me son già a posto così.

 

 

Read the full article here by Come Non Detto