OSDNConf 2019

UK [#uk] RU EN Home About Speakers Registration Sponsors Location Registration Home About Speakers Sponsors Location Registration Submit A Report UK RU EN Free/Libre Software And GNU/Linux Conference Kyiv, Ukraine 14 / SEP / 2019 Registration Submit A Report About ABOUT THE CONFERENCE OSDNConf Video 2018 The Conference is a non-commercial, volunteer-organized event centered on free and open-source software. It is geared towards users, developers and anyone interested in the free and open-source software movement. The Conference is held annually since 2002, in September in Kyiv, Ukraine. WHAT IS OUR GOAL? The Conference aims to enable developers and users to meet and promote the awareness and use of free and open-source software. Speakers Speakers Andy Shevchenko Kernel Developer at Intel Finland Mykola Marzhan Tech Lead at Percona BECOME A SPEAKER Agenda Agenda 9:00 10:00 Registration 10:00 10:40 Security is dead - long live security! Modern operating systems made securely Tobias Mueller Lead member at GNOME Bugsquad, Germany Details 10:40 11:20 Distributing OS Images with casync Lennart Poettering Sr. Software Engineer at RedHat, Germany Details 11:20 11:40 Coffee break 11:40 12:20 Filesystem mounts in user namespace Christian Brauner Software Engineer at Canonical, Germany Details 12:20 13:00 Forwarding syscalls to userspace Tycho Andersen Tech Lead at Cisco, USA Details Использование статистики в PostgreSQL для оптимизации производительности Maksym Boguk Chief DBA at Data Egret Details 13:00 14:20 Lunch Blue Hall White Hall 14:20 15:00 Linux and USB Audio Class 3 Ruslan Bilovol Linux Kernel Team Leader at GlobalLogic Details Marrying usability and security in large-scale infrastructures Eugene Pilyankevich CTO at Cossack Labs Details 15:00 15:40 Typical Mistakes when Submitting a New Code to Linux Kernel Andy Shevchenko Kernel Developer at Intel, Finland Details Amazon RDS Monitoring Mykola Marzhan Tech Lead at Percona Details 15:40 16:00 Coffee break 16:00 16:40 Go as a scripting language in Linux Ignat Korchagin Systems Engineer at Cloudflare, UK Details Building Distributed PKI based on blockchain Roman Kravchenko CEO at 482.solutions, CTO at REMME Details 16:40 17:20 Assessing the Security and Privacy of your Web site Tobias Mueller Lead member at GNOME Bugsquad, Germany Details Elliptic curves made easy або еліптичні курви, легкі й доступні Oleksiy Lukin Sr. Developer at FirstBridge Details 17:20 18:00 Locking down your systemd services Lennart Poettering Sr. Software Engineer at RedHat, Germany Details OpenSCADA 0.9 LTS Roman Savochenko OpenSCADA author, main developer and the project leader Details 18:00 Closing Speech Registration Registration SPEAK AT THE CONFERENCE Now accepting speaker applications! Apply now to present to one of the smartest audiences around. Please submit your talk proposals by the deadline of September 6, 2019 to make sure you are considered. Submit Sponsors Sponsors Silver Contributed to BECOME A SPONSOR Partners Event Partners Location Location Nivki-hall, Peremohy Ave, 84, Kyiv, Ukraine Phone: +380631773232 Email: info@osdn.org.ua Registration Copyright © OSDNConf 2019 Lennart Poettering Sr. Software Engineer at RedHat Germany Distributing OS Images with casync A talk about my new "casync" project, for efficiently distributing OS, IoT, container or VM images over the Internet. About speaker: Lennart Poettering works at Red Hat in the Server Experience Group. He's one of the creators of PulseAudio, Avahi and systemd. Lennart Poettering Sr. Software Engineer at RedHat Germany Locking Down Your Systemd Services systemd is the system and service manager of most of today's popular Linux distributions. This talk will focus on security features of systemd, that help developers and administrators to lock down system services in powerful ways, in order to build a more secure Operating System. Topics covered are: file system namespace features for services, networking lock-in, seccomp sandboxing, Linux security capabilities, integration with MAC security and many more. The talk will explain how many default services shipped in the various Linux distributions already make use of these security features to minimize impact of services, and how developers, devops engineers and administrators can enable this features easily for their own services, with just a few settings. About speaker: Lennart Poettering works at Red Hat in the Server Experience Group. He's one of the creators of PulseAudio, Avahi and systemd. Tycho Andersen Tech Lead at Cisco USA Forwarding syscalls to userspace Containers are ever popular, and are increasingly presented as an alternative to virtual machines. However, there are some obvious gaps in the API available to containers vs. what's available to root on the host. For example, containers cannot safely load kernel modules, or mount arbitrary filesystems. In this talk, Tycho will present a kernel patchset in development for passing syscalls off to a userspace handler, which can perform actions on behalf of the task that performed the syscall. For example, if a container tries to load a kernel module, the userspace daemon might check that the module is in a whitelist, and load the host's version of the module instead. The container is safely allowed to load kernel modules, whereas before it was not. About speaker: Tycho is an engineer at Cisco working Linux platforms. He holds degrees from the University of Wisconsin--Madison and Iowa State University, and has co-authored several peer-reviewed papers. In his spare time he rides bikes and does improv comedy. Tycho has been fortunate to speak at a number of industry conferences including linux.conf.au, Linux Plumber's Conference, Linux Piter, OpenStack Summit, ContainerCon, Docker Con (EU), Linux Con (EU), etc. as well as give industry keynotes at academic conferences like IEEE's I2CE. Christian Brauner Software Engineer at Canonical Germany Filesystem mounts in user namespaces User namespaces have become one of the most important security features for container workloads. But since they can be created by any user on the system they restrict access to a wide range of features including mounting of filesystems. In recent years a lot of work went into making mounts of filesystems from non-initial user namespaces safe. Starting with kernel 4.18 it is possible to mount FUSE filesystems in user namespaces. It is expected that overlayfs will follow in future kernel releases. In this talk we will take a closer look at the infrastructure that was added to the kernel, the underlying security mechanisms, and upcoming filesystems that might be available to unprivileged containers in the future. About speaker: Christian Brauner is a core developer and maintainer of the LXD and LXC projects. He works mostly upstream as part of the Ubuntu Server team on lower-level problems. He’s been active in the open source community for a long time and is a frequent speaker at various large Linux events; he is also strongly committed to working in the open, and a strong proponent of Free Software. Tobias Mueller Lead member at GNOME Bugsquad Germany Security is dead - long live security! Modern operating systems made securely This talks shows you how GNOME tries to be ahead of the curve regarding potential security and privacy breaches. Sandboxing and containerisation have been big topics over the last development cycles and we are happy to present the result which we hope improves various aspects of using your GNU/Linux machine. For one, we have created a technology for sandboxing applications which makes computing more secure as it confines the application and mitigates harm done by buggy or even malicious apps. But it also brings application developers closer to the users by shortcutting the traditional software distributions. While this has its shortcomings it's generally seen as an improvement and I'm happy to discuss, why. Another area of sandboxing is thumbnailing as a service for desktop applications. Traditionally, desktop systems try to display files more nicely by presenting a thumbnail of the file content. The code which produces the actual thumbnail traditionally ran with full privileges of the user session. With sandboxing, this is a thing of the past. We are now running thumbnailers (also third party ones) in a confined environment which mitigates many of the bad side effects an attacker can cause when exploiting a badly written file parser. About speaker: Tobias Mueller is a lead member of the GNOME Bugsquad for the last years and thus responsible for managing the bug database as well as the team around it. He is involved in deciding on effective policies for the bug database, actually dealing with the bugs in the database and recruiting new members who will help triaging. He also got elected to the Board of Directors in 2012 where he serves the GNOME Foundation to achieve their goals of creating and distributing great Free Software products. Besides being a Free Software and GNOME lover, Tobias is involved in the German security research community around the Chaos Computer Club. Topics of interest include Platform- and System-Security, Cryptography and Security Protocols. Tobias Mueller Lead member at GNOME Bugsquad Germany Assessing the Security and Privacy of your Web site PrivacyScore.org is a Free Software platform to perform various security and privacy related scanning tasks. It helps automating the analysis of Web sites that you are interested in, being it your own or your competitor's. A regular and thorough analysis helps to comply with corporate or legislative policies. Especially in light of the new EU privacy laws demanding privacy by design a tool for assessing how often and how well certain privacy enhancing technologies are implemented. About speaker: Tobias Mueller is a lead member of the GNOME Bugsquad for the last years and thus responsible for managing the bug database as well as the team around it. He is involved in deciding on effective policies for the bug database, actually dealing with the bugs in the database and recruiting new members who will help triaging. He also got elected to the Board of Directors in 2012 where he serves the GNOME Foundation to achieve their goals of creating and distributing great Free Software products. Besides being a Free Software and GNOME lover, Tobias is involved in the German security research community around the Chaos Computer Club. Topics of interest include Platform- and System-Security, Cryptography and Security Protocols. Andy Shevchenko Kernel Developer at Intel Finland Typical Mistakes when Submitting a New Code to Linux Kernel Code review is a crucial part of developing a stable and robust open source project, such as Linux kernel. Newcomers and surprisingly many active and known contributors have been making the same mistakes, like using non-scalable APIs, over and over. How can we eliminate or avoid them? Considering the patterns the best practices would be suggested. In addition, relatively new Linux kernel APIs, such as Unified Device Properties, will be discussed. About speaker: Andriy has over ten years of software development experience in Linux environment, especially in a serial bus drivers area in the kernel programming. During this time he has contributed hundreds of patches to the Linux kernel. In his current position, he has been designing and developing a glue layer between ACPI and pin control framework. Ignat Korchagin Systems Engineer at Cloudflare Go as a scripting language in Linux Are you a fan of Go? Do you like Go so much and use it in every software project? Do you think Go is a truly universal language? How about taking it to the next level and trying Go as a scripting language for your favourite Linux distribution? About speaker: Ignat is a systems engineer at Cloudflare working mostly on platform and hardware security. Ignat’s interests are cryptography, hacking, and low-level programming. Before Cloudflare, Ignat worked as senior security engineer for Samsung Electronics’ Mobile Communications Division. His solutions may be found in many older Samsung smart phones and tablets. Mykola Marzhan Release Engineer at Percona Amazon RDS Monitoring AWS має managed рішення для запуску MySQL баз даних - Amazon RDS for MySQL та Amazon Aurora. Такі рішення маюсь свої переваги - можна запустити базу даних в декілька кліків, не потрібно переживати за high availability, встановлення апдейтів, налаштування бекапів та відновлення з них. Але такі рішення як чорний ящик, адміністратори не мають доступу до операційної системи. Отже performance моніторинг таких систем нетривіальний, але можливий. About speaker: AWS Certified Solutions Architect Professional Mykola is monitoring lover and has been developing monitoring systems since 2004. He has been working as Release Engineer/DevOps for 10 years and most of his career has focused on automation of release procedures and infrastructure, development of monitoring, update and deployment systems. Oleksiy Lukin Sr. Developer at FirstBridge Elliptic curves made easy або еліптичні курви, легкі й доступні Gentle introduction to elliptic curves (EC) cryptography: math overview, comparsion to RSA, base operations; EC key pairs; ECDSA, ECDH, signing and encryption with EC. Presentation of C++ and Java opensource libraries of EC with very simple intrafce but military-grade cryptogrphy inside. Ruslan Bilovol Linux Kernel Team Leader at GlobalLogic Linux and USB Audio Class 3 The USB Audio Class 3 spec was recently introduced by USB-IF and is designed to replace 3.5 analog jack in phones and consumer electronics. In this talk Ruslan will give an introduction to the spec, review current status in Linux, share insides on faced challenges during UAC3 drivers implementation and contribution to Linux Kernel. We will see what is still missing, discuss open challenges and future steps. Eugene Pilyankevich CTO at Cossack Labs Marrying usability and security in large-scale infrastructures Usability is often thought to be the opposite of security. However, most security controls inside operating systems and most security tools that run on them - are designed to be operated by humans. This talk will walk through speaker’s experience in building and seeing how engineers integrate security tooling - how security controls and tools are misdesigned to fail once used, how poorly integrated controls decrease overall security of a system, and how lessons learnt in reliability/infrastructure engineering apply to security tooling to fix that. About speaker: Eugene is CTO at Cossack Labs, responsible for managing development of open-source and enterprise security instruments for implementing data security in large distributed systems. Eugene’s life-long interests blend between technical security, reliability engineering, and the way humans make decisions, assess risk and create mess in complex technical environments. Karsten Andreas Artz Community Member at Team Silverblue, Germany Fedora Silverblue - Are containers the future of Linux OS? Todays world is developing fast. In IT and the Linux OS we have now the chance to take part in this development process. Fedoras Project of Atomic workstation defines that the software/programms are seperated installed from the system. Thus the programms are no longer dependent on any librariers/structures. You can install the programms by flatpak, snap or appimage. Otherwise you feel free to download the software directly and update them on your own. One more aspect is that you can rollback the OS or programm. This is a good feature because, if a programm is not stable enough and causes problems on your system; the user can rollback to the version before. Normally, the repos and installed programms don't give this possibilty. This lecture should introduce about the main functions of Fedora Atomic workstation and the further work "Team Silverblue". Roman Savochenko OpenSCADA author, main developer and the project leader OpenSCADA 0.9 LTS Анонс нової LTS версії 0.9 проекту OpenSCADA — відкрита Система Диспетчерського Контролю та Збору Даних. Нова стабільна версія є результатом шести років розробки, впровадження до різних рішень, стабілізації та експлуатації OpenSCADA у її робочій гілці. Та весь цей час продовжували випускатися оновлення до 0.8.0 LTS та що буде відбуватися для анонсованої 0.9 LTS. Maksym Boguk Chief DBA at Data Egret Использование статистики в PostgreSQL для оптимизации производительности Статистическая информация, собираемая PostgreSQL, имеет большое влияние на производительность системы. Зная статистику распределения данных, оптимизатор может корректно оценить число строк, необходимый размер памяти и выбрать наиболее быстрый план выполнения запроса. Но в некоторых редких случаях он может ошибаться, и тогда требуется вмешательство DBA. Помимо информации о распределении данных, PostgreSQL также собирает статистику об обращении к таблицам и индексам, вызовов функций и даже вызовов отдельных запросов (при помощи расширения pg_stat_statements). Эта информация, в отличие от распределений, больше нужна администраторам, нежели для работы самой базы, и очень помогает для нахождения и исправления узких мест в системе. В докладе будет показано, каким образом статистическая информация собирается, для чего она важна, и как ее правильно читать и использовать; какие параметры можно "подкрутить" в тех или иных случаях, как подобрать оптимальный индекс и как переписать запрос, чтобы исправить ошибки планировщика. Roman Kravchenko CEO at 482.solutions, CTO at REMME Building Distributed PKI based on blockchain В первой, концептуальной части доклада, будет проведен анализ проблем безопасности идентификации и управления доступом (Identity and access management) и принципы построения инфраструктуры открытых ключей (Public Key Infrastructure). Будет рассмотрено 2 модели архитектуры PKI: централизованная и децентрализованная, на основе технологий распределенного реестра (блокчейна). Во второй, прикладной части доклада, будут проанализирован индустриальный кейс PKId решения REMME. REMME (http://remme.io/) - протокол с открытым исходным кодом и платформа для идентификации и управления доступом на основе PKId (распределенной инфраструктуры публичных ключей). В данной части доклада пойдет речь о том, почему было принято решение выбрать кастомный блокчейн на основе Hyperledger Sawtooth, а также рассмотрены критерии, которые были применены для выбора консенсуса и модели принятия решений (токенэкономики) на основе мастернод.