Open Source And GNU/Linux

Distributing OS Images with casync

A talk about my new "casync" project, for efficiently distributing OS, IoT, container or VM images over the Internet.

About speaker:

Lennart Poettering works at Red Hat in the Server Experience Group. He's one of the creators of PulseAudio, Avahi and systemd.

Locking Down Your Systemd Services

systemd is the system and service manager of most of today's popular Linux distributions. This talk will focus on security features of systemd, that help developers and administrators to lock down system services in powerful ways, in order to build a more secure Operating System. Topics covered are: file system namespace features for services, networking lock-in, seccomp sandboxing, Linux security capabilities, integration with MAC security and many more. The talk will explain how many default services shipped in the various Linux distributions already make use of these security features to minimize impact of services, and how developers, devops engineers and administrators can enable this features easily for their own services, with just a few settings.

About speaker:

Lennart Poettering works at Red Hat in the Server Experience Group. He's one of the creators of PulseAudio, Avahi and systemd.

Forwarding syscalls to userspace

Containers are ever popular, and are increasingly presented as an alternative to virtual machines. However, there are some obvious gaps in the API available to containers vs. what's available to root on the host. For example, containers cannot safely load kernel modules, or mount arbitrary filesystems.
In this talk, Tycho will present a kernel patchset in development for passing syscalls off to a userspace handler, which can perform actions on behalf of the task that performed the syscall. For example, if a container tries to load a kernel module, the userspace daemon might check that the module is in a whitelist, and load the host's version of the module instead. The container is safely allowed to load kernel modules, whereas before it was not.

About speaker:

Tycho is an engineer at Cisco working Linux platforms. He holds degrees from the University of Wisconsin--Madison and Iowa State University, and has co-authored several peer-reviewed papers. In his spare time he rides bikes and does improv comedy. Tycho has been fortunate to speak at a number of industry conferences including linux.conf.au, Linux Plumber's Conference, Linux Piter, OpenStack Summit, ContainerCon, Docker Con (EU), Linux Con (EU), etc. as well as give industry keynotes at academic conferences like IEEE's I2CE.

Filesystem mounts in user namespaces

User namespaces have become one of the most important security features for container workloads. But since they can be created by any user on the system they restrict access to a wide range of features including mounting of filesystems. In recent years a lot of work went into making mounts of filesystems from non-initial user namespaces safe. Starting with kernel 4.18 it is possible to mount FUSE filesystems in user namespaces. It is expected that overlayfs will follow in future kernel releases. In this talk we will take a closer look at the infrastructure that was added to the kernel, the underlying security mechanisms, and upcoming filesystems that might be available to unprivileged containers in the future.

About speaker:

Christian Brauner is a core developer and maintainer of the LXD and LXC projects. He works mostly upstream as part of the Ubuntu Server team on lower-level problems. He’s been active in the open source community for a long time and is a frequent speaker at various large Linux events; he is also strongly committed to working in the open, and a strong proponent of Free Software.

Security is dead - long live security! Modern operating systems made securely

This talks shows you how GNOME tries to be ahead of the curve regarding potential security and privacy breaches.
Sandboxing and containerisation have been big topics over the last development cycles and we are happy to present the result which we hope improves various aspects of using your GNU/Linux machine. For one, we have created a technology for sandboxing applications which makes computing more secure as it confines the application and mitigates harm done by buggy or even malicious apps. But it also brings application developers closer to the users by shortcutting the traditional software distributions. While this has its shortcomings it's generally seen as an improvement and I'm happy to discuss, why. Another area of sandboxing is thumbnailing as a service for desktop applications. Traditionally, desktop systems try to display files more nicely by presenting a thumbnail of the file content. The code which produces the actual thumbnail traditionally ran with full privileges of the user session. With sandboxing, this is a thing of the past. We are now running thumbnailers (also third party ones) in a confined environment which mitigates many of the bad side effects an attacker can cause when exploiting a badly written file parser.

About speaker:

Tobias Mueller is a lead member of the GNOME Bugsquad for the last years and thus responsible for managing the bug database as well as the team around it. He is involved in deciding on effective policies for the bug database, actually dealing with the bugs in the database and recruiting new members who will help triaging. He also got elected to the Board of Directors in 2012 where he serves the GNOME Foundation to achieve their goals of creating and distributing great Free Software products. Besides being a Free Software and GNOME lover, Tobias is involved in the German security research community around the Chaos Computer Club. Topics of interest include Platform- and System-Security, Cryptography and Security Protocols.

Assessing the Security and Privacy of your Web site

PrivacyScore.org is a Free Software platform to perform various security and privacy related scanning tasks. It helps automating the analysis of Web sites that you are interested in, being it your own or your competitor's. A regular and thorough analysis helps to comply with corporate or legislative policies. Especially in light of the new EU privacy laws demanding privacy by design a tool for assessing how often and how well certain privacy enhancing technologies are implemented.

About speaker:

Tobias Mueller is a lead member of the GNOME Bugsquad for the last years and thus responsible for managing the bug database as well as the team around it. He is involved in deciding on effective policies for the bug database, actually dealing with the bugs in the database and recruiting new members who will help triaging. He also got elected to the Board of Directors in 2012 where he serves the GNOME Foundation to achieve their goals of creating and distributing great Free Software products. Besides being a Free Software and GNOME lover, Tobias is involved in the German security research community around the Chaos Computer Club. Topics of interest include Platform- and System-Security, Cryptography and Security Protocols.

Typical Mistakes when Submitting a New Code to Linux Kernel

Code review is a crucial part of developing a stable and robust open source project, such as Linux kernel. Newcomers and surprisingly many active and known contributors have been making the same mistakes, like using non-scalable APIs, over and over. How can we eliminate or avoid them? Considering the patterns the best practices would be suggested. In addition, relatively new Linux kernel APIs, such as Unified Device Properties, will be discussed.

About speaker:

Andriy has over ten years of software development experience in Linux environment, especially in a serial bus drivers area in the kernel programming. During this time he has contributed hundreds of patches to the Linux kernel. In his current position, he has been designing and developing a glue layer between ACPI and pin control framework.

Go as a scripting language in Linux

Are you a fan of Go? Do you like Go so much and use it in every software project? Do you think Go is a truly universal language? How about taking it to the next level and trying Go as a scripting language for your favourite Linux distribution?

About speaker:

Ignat is a systems engineer at Cloudflare working mostly on platform and hardware security. Ignat’s interests are cryptography, hacking, and low-level programming. Before Cloudflare, Ignat worked as senior security engineer for Samsung Electronics’ Mobile Communications Division. His solutions may be found in many older Samsung smart phones and tablets.

Amazon RDS Monitoring

AWS має managed рішення для запуску MySQL баз даних - Amazon RDS for MySQL та Amazon Aurora.
Такі рішення маюсь свої переваги - можна запустити базу даних в декілька кліків, не потрібно переживати за high availability, встановлення апдейтів, налаштування бекапів та відновлення з них. Але такі рішення як чорний ящик, адміністратори не мають доступу до операційної системи. Отже performance моніторинг таких систем нетривіальний, але можливий.

About speaker:

AWS Certified Solutions Architect Professional
Mykola is monitoring lover and has been developing monitoring systems since 2004. He has been working as Release Engineer/DevOps for 10 years and most of his career has focused on automation of release procedures and infrastructure, development of monitoring, update and deployment systems.

Elliptic curves made easy або еліптичні курви, легкі й доступні

Gentle introduction to elliptic curves (EC) cryptography: math overview, comparsion to RSA, base operations; EC key pairs; ECDSA, ECDH, signing and encryption with EC.
Presentation of C++ and Java opensource libraries of EC with very simple intrafce but military-grade cryptogrphy inside.

Linux and USB Audio Class 3

The USB Audio Class 3 spec was recently introduced by USB-IF and is designed to replace 3.5 analog jack in phones and consumer electronics.
In this talk Ruslan will give an introduction to the spec, review current status in Linux, share insides on faced challenges during UAC3 drivers implementation and contribution to Linux Kernel. We will see what is still missing, discuss open challenges and future steps.

Marrying usability and security in large-scale infrastructures

Usability is often thought to be the opposite of security. However, most security controls inside operating systems and most security tools that run on them - are designed to be operated by humans. This talk will walk through speaker’s experience in building and seeing how engineers integrate security tooling - how security controls and tools are misdesigned to fail once used, how poorly integrated controls decrease overall security of a system, and how lessons learnt in reliability/infrastructure engineering apply to security tooling to fix that.

About speaker:

Eugene is CTO at Cossack Labs, responsible for managing development of open-source and enterprise security instruments for implementing data security in large distributed systems. Eugene’s life-long interests blend between technical security, reliability engineering, and the way humans make decisions, assess risk and create mess in complex technical environments.

Fedora Silverblue - Are containers the future of Linux OS?

Todays world is developing fast. In IT and the Linux OS we have now the chance to take part in this development process. Fedoras Project of Atomic workstation defines that the software/programms are seperated installed from the system. Thus the programms are no longer dependent on any librariers/structures. You can install the programms by flatpak, snap or appimage. Otherwise you feel free to download the software directly and update them on your own. One more aspect is that you can rollback the OS or programm. This is a good feature because, if a programm is not stable enough and causes problems on your system; the user can rollback to the version before. Normally, the repos and installed programms don't give this possibilty. This lecture should introduce about the main functions of Fedora Atomic workstation and the further work "Team Silverblue".

OpenSCADA 0.9 LTS

Анонс нової LTS версії 0.9 проекту OpenSCADA — відкрита Система Диспетчерського Контролю та Збору Даних. Нова стабільна версія є результатом шести років розробки, впровадження до різних рішень, стабілізації та експлуатації OpenSCADA у її робочій гілці. Та весь цей час продовжували випускатися оновлення до 0.8.0 LTS та що буде відбуватися для анонсованої 0.9 LTS.

Использование статистики в PostgreSQL для оптимизации производительности

Статистическая информация, собираемая PostgreSQL, имеет большое влияние на производительность системы. Зная статистику распределения данных, оптимизатор может корректно оценить число строк, необходимый размер памяти и выбрать наиболее быстрый план выполнения запроса. Но в некоторых редких случаях он может ошибаться, и тогда требуется вмешательство DBA.
Помимо информации о распределении данных, PostgreSQL также собирает статистику об обращении к таблицам и индексам, вызовов функций и даже вызовов отдельных запросов (при помощи расширения pg_stat_statements). Эта информация, в отличие от распределений, больше нужна администраторам, нежели для работы самой базы, и очень помогает для нахождения и исправления узких мест в системе.
В докладе будет показано, каким образом статистическая информация собирается, для чего она важна, и как ее правильно читать и использовать; какие параметры можно "подкрутить" в тех или иных случаях, как подобрать оптимальный индекс и как переписать запрос, чтобы исправить ошибки планировщика.

Building Distributed PKI based on blockchain

В первой, концептуальной части доклада, будет проведен анализ проблем безопасности идентификации и управления доступом (Identity and access management) и принципы построения инфраструктуры открытых ключей (Public Key Infrastructure). Будет рассмотрено 2 модели архитектуры PKI: централизованная и децентрализованная, на основе технологий распределенного реестра (блокчейна).
Во второй, прикладной части доклада, будут проанализирован индустриальный кейс PKId решения REMME.
REMME (http://remme.io/) - протокол с открытым исходным кодом и платформа для идентификации и управления доступом на основе PKId (распределенной инфраструктуры публичных ключей). В данной части доклада пойдет речь о том, почему было принято решение выбрать кастомный блокчейн на основе Hyperledger Sawtooth, а также рассмотрены критерии, которые были применены для выбора консенсуса и модели принятия решений (токенэкономики) на основе мастернод.