FOSDEM welcome and opening talk.

Welcome to FOSDEM 2020!

Today's Linux kernel and the ones from the early FOSDEM days still have some things in common, but in the end are totally different beasts. This talk will take a closer look at how the Linux kernel and its development during those twenty years evolved and adapted to new expectations.

The talk will thus mention some of the changes to the Linux kernel that had the most impact in those two decades; many might have seemed small or insignificant in the beginning, but turned out to pave the path for ground breaking techniques like Android, Cloud or Containers we all deal with today. The speaker will also take a closer look at how Linux kernel development itself changed during those twenty years, but also cover aspects that didn't change much – like the email driver development model, which in the days of Github and Gitlab might look anarchic and from the Middle Ages to some. The speaker also will step on thin ice and speculate a few minutes what the future might hold, as there are a few strong indicators that Linux is entering a new era and slowly but steady get more aspects of a microkernel.

Free and Open Source software has revolutionized the Software Industry and nearly all other areas of human endeavor, but until now its reach into actual governance at the municipal citizen level has not been very deep. Initiatives like Code for America have encountered challenges driving acceptance for FOSS alternatives to proprietary software for citizen governance. At the same time the gap between citizen need and cities’ capabilities as widened. But several new projects are aiming to change this state of affairs to help empower citizens and improve municipal services worldwide through adoption of FOSS. Learn about these efforts and how you can get involved.

Farwest is an Erlang framework for building RESTful Web applications and APIs.

Well written Farwest applications apply the HATEOAS principles and as a result can be interacted with using a single client. This removes entirely the need to write a separate client per API and lets servers decide how the data is best consumed by everyone.

This demo will show how to use Farwest to write a simple API to a document oriented database.

A review of the past year in the life of the OpenJDK Community, and a look at what's ahead.

Welcome to the Legal & Policy Issues DevRoom including and overview of how the new Collaboration and Debate sessions will work.

Welcome to the DNS DevRoom

Many people and companies are betting that cloud-native networking will be the preferred way of implementing network functions in an easy and scalable way. It is based around the tenants of modularity, high availability, scalability, low-overhead networking, and ease of deployment. And a number of companies such as Google has shown that it is really possible to achieve these properties with it. But the architectural basis of cloud-native is quite different from the ones of virtualization-based NFV, but nevertheless, in many cases we continue to use the software packages that were designed for that drastically different architecture. The question is, how well does the current set of open source projects used in NFV work in a cloud-native environment and what needs to change in them in order to realize the cloud-native vision?

In this presentation, I will define what I mean with cloud-native networking and from that derive the system requirements needed to realize that vision. Based on these requirements, we can deduce a number of basic architectural properties, features and services that are needed in the system to be able to satisfy these requirements. Then I will go through the most popular open source projects such as Linux, DPDK and OVS and see how they satisfy these architectural properties and features. The main contribution of this presentation will be to show what we need to work on within these SW packages in order to realize cloud-native networking. Or maybe we need completely new SW projects to be able to achieve this.

Brief introduction to DRLM project, it's features and news in the 2.3.x release and the presentation of the new DRLM version 3 architecture and its development state.

This talk is going to explain our vision on the future of the DRLM project, that will continue evolving in DRLM 2.x while the new DRLMv3 is being developed.

For DRLMv3 we've prepared a complete development environment on Docker to provide an easy and fast way to contribute to the project.

In this session we'll show all interesting new features on DRLMv2, a DRLMv3 preview of what is developed at time of this presentation, and how easy is to have a complete DRLMv3 development environment with a couple of commands.

We don't want to spoil anything, but this talk may be of interest for developers looking for a FLOSS project to contribute to ;).

The reproducibility crisis has shocked the scientific community. Different papers describe this issue and the scientific community has taken steps to improve on it. For example, several initiatives have been founded to foster openness and standardisation in different scientific communities (e.g. the INCF[1] for the neurosciences). Journals encourage sharing of the data underlying the presented results, some even make it a requirement.

What is the role of open source solutions in this respect? Where are the problems with open source projects in (neuro-)sciences?

In this presentation I will address these questions at the example of the entirely open-source based workflow in our laboratory[2] and our efforts in developing generic solutions for storing metadata[3] as well as unifying data and metadata storage[4] that we take together with the German Neuroinformatics Node (G-Node[5]).

[1] https://incf.org [2] https://github.com/bendalab [3] https://github.com/g-node/python-odml [4] https://github.com/g-node/nix [5] https://g-node.org

This talk will be about the OpenOffice Build system. We will talk about how it works today's, issues with it. And the talk will highlight current development in this field plus where it might moves in the future. (plans of development)

Sheduled length will be 20 min +question

Currently the build system is a mixture of dmake, gmake, ant and other tools. After a short going through I like to describe the vision we have for the future build system we are working towards.

In this talk we will explore some of the FOSS specific mentalities and practices that may discourage adoption of comprehensive automated testing, and present advice for promoting and sustaining automated testing in FOSS projects.

Automated testing is on the rise in the FOSS world, but there is still ample room for improvement when it comes to sufficiently comprehensive automated tests. The test suites of many FOSS projects leave a lot to be desired, a result that's often affected by useful FOSS practices that are taken too far. Identifying such practices, like placing excessive trust in code reviews because "given enough eyeballs, all bugs are shallow", or leaving tests for later in the spirit of "release often, release early", is a first step in having a discussion that will hopefully convince more projects to embrace automated testing, and improve the quality of FOSS overall.

Ibex implements RISC-V 32-bit I/E MC M-Mode, U-Mode and PMP. It uses an in order 2 stage pipe and is best suited for area and power sensitive rather than high performance applications. However there is scope for meaningful performance gains without major impact to power or area. This talk describes work done at lowRISC to analyse and improve the performance of Ibex. The RTL of an Ibex system is simulated using Verilator to run CoreMark and Embench and the traces analysed to identify the major sources of stalls within them. This informs where improvements should be targeted. The open source implementation tools Yosys and openSTA are used to assess potential timing and area impacts of these improvements. In this talk you’ll learn about the pipeline of Ibex, methods to analyse the performance of CPU microarchitecture and how to use Yosys and openSTA to analyse what limits clock frequency in a design.

Introducing Tanka, a scalable Jsonnet based tool for deploying and managing Kubernetes Infrastructure

There are various tools available for managing Kubernetes resources. Whether they be Helm, Kustomize or others. Ksonnet offered a powerful approach with tremendous promise, but was discontinued by developers. In this presentation we will introduce Tanka, a drop in replacement for Ksonnet developed at Grafana labs and available on GitHub. For those not familiar with Ksonnet, we will introduce the Jsonnet language, and demonstrate its power as a way of interacting with Kubernetes. We will then demonstrate some of the enhancements we have already made to Tanka, and then explain our roadmap for the tooling, and how we believe it is already the best of breed configuration management solution for Kubernetes.

After a quick overview of the semantic web landscape, we'll look into a practical application of Linked Data in the public sector: the Joinup platform of the European Commission. Joinup makes use of Linked Data to harvest information from various sources into a knowledge base. We'll have a look at the various components that we needed to build (all Open Source) to make the CMS system (Drupal) 'Linked Data enabled'. We'll look at the technical problems that needed to be solved and the solutions we came up with, as well as a the opportunities that this technology can bring to the CMS world.

The aim of this presentation is to showcase the technologies available in LLVM that aid debugging. We will focus on LLDB, the debugger, and sanitisers (e.g. AddressSanitizer and LeakSanitizer). No prior knowledge is required, but if you're familiar with GDB or Valgrind then this talk will introduce you to alternatives available within LLVM.

LLDB is a very powerful and extensible command line debugger available on Linux, Mac OS, FreeBSD, Windows and Android. It is used internally in XCode and Android Studio and available on various hardware platforms (e.g. X86, ARM, AArch64, PowerPC, Mips). LLDB is built as a set of reusable components which highly leverage existing libraries in LLVM. It has a very powerful expression evaluation engine, intuitive CL interface (with tab-completion), easy to navigate help pages and a "graphical" user interface. In this presentation we will explore basic usage as well as some lesser known features. LLDB has come a long way and we want to present how intuitive, helpful and powerful it can be when used pragmatically.

While LLDB will let you easily examine and debug a program at the point of failure, it can be harder to diagnose the underlying problem if it occurred before the program crashed or printed an incorrect result. LLVM provides some extra features in the form of 'sanitizers' to help find the root cause of some extra problems, like accessing a wrong-but-still-valid memory address or unintentionally wrapping a signed integer value. This presentation will explore how to use the sanitizers to debug programs and some examples of bugs they can catch.

From my talk you will learn about some lesser-known features of sudo, and how you can make your security more flexible by extending sudo using Python.

Everybody knows sudo, right? Sudo allows a system administrator to give certain users the ability to run some commands as root, while logging the executed commands and their arguments. It is installed by default on almost all Linux systems, and is available for most commercial UNIX systems. Sudo allows you to fine-tune access policies, record sessions, and do extensive logging. Still, even system administrators often only know it is the “prefix” to use before entering a command requiring root privileges, and don’t realize its true powers.

Did you know that with version 1.8 sudo changed to a plugin-based architecture? You can extend or even replace basic functionality through plugins. While plugins provide the ultimate flexibility – and there are both open source and commercial plugins for sudo available – it is not easy to extend sudo. This is why the Python plugin is under way to sudo (and will be released before FOSDEM).

Sudo has a number of well defined APIs for plugins (https://www.sudo.ws/man/sudo_plugin.man.html). The Python plugin builds on these APIs. For example, you can set your own policies using the policy API, or access what is happening on the screen using the I/O API (used by session recording).

Using Python for extending sudo makes development not just easier (no development environment necessary), but opens up many new possibilities. For example, you can develop a plugin which analyzes on-screen activity in real-time, and breaks the session if the infamous “rm -fr /” command appears on screen. As multiple I/O plugins can work in parallel, you do not have to give up session recording to analyze sessions in real-time from Python.

From my talk you will learn about some lesser-known features of sudo, and how you can make your security more flexible by extending sudo using Python.

Podman is the container management tool of your choice when it comes to boosting day-to-day development tasks around containers. The journey of Podman started as a drop-in replacement for docker, but nowadays it’s even more than just that. For example, Podman is capable of managing pods, running containers without being root and supports fine granular configuration possibilities.

In this presentation, we will deep dive into the exciting world of Podman. We discover how Podman fits into the containers ecosystem, learn about the architecture behind the project and utilize practical examples for daily development tasks.

For example, we will learn how rootless containers work technically, how to safely share resources within multiple containers and which benefits a daemon-less container management tool like Podman provides. All these exciting features will be explained by utilizing live demos which leaves room for an open discussion at the end of the talk.

This presentation deals with the integration of Julius Speech Recognition Engine.

The aim of this Proof of Concept is to have a connectionless speech engine, working on an embedded device, integrated as a binding of the AGL Application Framework. The recognition uses Deep Neural Network realtime decoding, and for safer results and performances purpose, uses a grammar.

Julius does not support wakewords out of the box, some hacking has been done to enable it in an efficient way. Tests have been done on Renesas' H3, and UPSquare boards.

Welcome to the FOSDEM MySQL, MariaDB & Friends Devroom 2020

We have possibility to setup small electronic assembly/production "factory" at our house for less than EUR 1000. I will try to explain every step from the design to final product:

We live in exciting times. It was never so easy to design and produce electronic devices like today. This really unleash people's creativity. The Open Source Hardware movement helps people to study, modify, improve and share designs and knowledge. Today we have FOSS CAD tools like KiCad to design our electronic boards. There are multiply choices to manufacture PCBs even in small quantity. There are lot of places to source components at low cost. We have possibility to setup small electronic assembly/production "factory" at our house for less than EUR 1000. I will try to explain every step from the design to final product:

1. How to design your product with KiCad
2. How to generate files for production
3. Where to order your PCBs
4. Where to source the components for the assembly
5. How to setup small "factory" at home at budget
6. How to certify your OSHW project at OSHWA.org

and will demonstrate Do-It-Yourself oven, solder paste printer, manual pick and place tools which could be used for production.

Welcome to the Ada Developer Room at FOSDEM 2020, which is organized by Ada-Belgium in cooperation with Ada-Europe.

Ada-Belgium and Ada-Europe are non-profit organizations set up to promote the use of the Ada programming language and related technology, and to disseminate knowledge and experience into academia, research and industry in Belgium and Europe, resp. Ada-Europe has member-organizations, such as Ada-Belgium, in various countries, and direct members in many other countries.

Welcome to FOSDEM game development devroom! We'll present what this is all about and invite you to participate.

What threats do we need to take into account when building a system? A key method for answering this question is an approach called threat modelling, whereby security problems can be anticipated during the design phase. This talk discusses major threat-modelling approaches, and includes concrete examples of how to apply them to software-intensive systems.

Open Source Hardware room with two day soldering workshops. Day 1 soldering workshop will be dedicated to Through Hole Technology and is good for beginners which has no experience with component soldering.

Beside the soldering workshop we will show our latest OSHW boards we work on, you are welcome to join and show your own OSHW projects too.

With this soldering workshop we will show that assembling printed circuit boards is not hard to learn.

We designed special board with through holes components for FOSDEM - the FOSDEM MUSIC BOX which is Arduino programmable and can play music.

During the soldering workshop we will introduce the electronic components used in the PCB and how to identify them and how components with polarity is to be recognized.

We will teach you the basics of soldering, how good and bad solder joints look like and what is cold solder joint. At the end of the workshop you will build your own Music Box and could program it with Arduino IDE to play music.

abstract

description

An overview of the main features of the Ada language, with special emphasis on those features that make it especially attractive for free software development.

Ada is a feature-rich language, but what really makes Ada stand-out is that the features are nicely integrated towards serving the goals of software engineering. If you prefer to spend your time on designing elegant solutions rather than on low-level debugging, if you think that software should not fail, if you like to build programs from readily available components that you can trust, you should really consider Ada

As decentralized social media gathers more users, the privacy by design and default principles from the GDPR are in accordance to the design model it proposes. This talk is going to tackle the main advantages and challenges this approach brings, from the perspective of the data protection legislation and privacy architectural strategies.

Social media platforms have been a central feature in our generation and as we grow more toward understanding their power and taking part in their evolution, we realize the challenges they impose. One of those is how to protect personal data of users, and ensure that the processing is done in accordance with legislation such as GDPR. Decentralized social media has developed as a space where personal data ownership is a priority, coming as an alternative to centralized platforms. Not coincidentally, they are mostly open source software, as transparency and offering control of the data to the users go hand in hand with this ambition. Blockchain based social media networks, and projects built on top of the ActivityPub protocol are some of the most popular examples of alternatives which have gathered significant numbers of users or data subjects, under the GDPR. One of the main architectural strategies in building software which is privacy by default and design is data separation. It states that the processing of personal data should be performed whenever possible in a distributed manner. As the GDPR lists privacy by design and default as core principles, decentralized social networking poses a significant advantage compared to centralized solutions. One heuristic to take from this is if the future is privacy-oriented, then social media will be decentralized. This talk is going to offer an analysis of the main benefits and challenges that decentralized social medial pose, from the points of view of personal data protection legislation and privacy design patterns for software architecture.

All major clouds have integrated DNS management these days, and OpenStack is one of them. We will run through the OpenStack DNS (Designate) project - how it works, why we laid it out the way we did, how you can use it, and how other OpenStack components can leverage it.

We will run through the general architecture of the project, and show how we can remain a simple control layer over multiple DNS servers and service providers.

We will show how you can run Designate stand alone, as a multi tenant API for managing DNS inside your company, and how you can use the ability to have multiple pools of servers available for multiple purposes.

Finally we will show the myriad of both OpenStack and other Open Source software integrations for DNS management, and DNS-01 ACME validation.

MySQL 8 and MariaDB 10.4 are the latest Major versions for MySQL and MariaDB. While MariaDB started by being slightly different MySQL variant, now it has grown into very much different database platforms which grows more different from every release.

In this presentation, we will look into the differences between MySQL and MariaDB in the core areas such as SQL features, query optimizations, replication, storage engines, and security as well as discuss unique features and capabilities MySQL 8 and MariaDB 10.4 offers compared to each other.

Intel Software Guard Extensions (SGX) makes software secure from the outside. Rust makes it secure from the inside. This workshop will introduce you to Rust and the Fortanix® Enclave Development Platform (EDP) for Rust: how it works, what you can do with it, and why Rust is such a good fit for SGX.

Please note that this was previously scheduled for 11:15 and replaces the talk on "Introduction to the CoSMIX Compiler" by Yan Michalevsky.

Godot is an incredible open source game engine. Among it key features, it comes packed with a script language called GDscript and loosely based on Python. But could it be even better ? Could we use the real Python to code our game on Godot ?

And maybe even more important, is it really a good idea ?

Godot is an advanced, feature-packed, multi-platform 2D and 3D open source game engine. The project has joined the Software Freedom Conservancy project and it growing community makes it hopes to become a real alternative to Unity&GameMaker.

This talk present the Godot-Python project aiming at bringing Python as a fully integrated language into Godot.

We will have a look at Godot’s internal architecture as is it itself a real interpreter with it garbage collector, dynamic typing, introspection and even builtin custom scripting language. All of this having to work next to our Python interpreter and communicate back and forth with it.

We will then dig into Godot-Python design choices, both past and current, this project came through a looot of errors and trials ;-)

Finally we will discuss the pros and cons about using Python as a script language for Godot vs the traditional GDscript.

The audience should have some basic knowledge of C level computing (static vs dynamic language, compilation & linking).

BlackParrot is a Linux-capable, cache-coherent RISC-V multicore, designed for efficiency and ease of use. In this talk, we will provide an architectural overview of BlackParrot, focusing on the design principles and development process as well as the software and hardware ecosystems surrounding the core. We will also discuss the project roadmap and our plans to engage the open-source community. Last, we will demonstrate a multithreaded RISC-V program running on top of Linux on a multicore BlackParrot FPGA implementation.

BlackParrot aims to be the default open-source, Linux-capable, cache-coherent, RV64GC multicore used by the world. Although originally developed by the University of Washington and Boston University, BlackParrot strives to be community-driven and infrastructure agnostic, a core which is Pareto optimal in terms of power, performance, area and complexity. In order to ensure BlackParrot is easy to use, integrate, modify and most importantly trust, development is guided by three core principles: Be Tiny, Be Modular, and Be Friendly. Development efforts have prioritized ease of use and silicon validation as first order design metrics, so that users can quickly get started and trust that their results will be representative of state-of-the-art ASIC designs. BlackParrot is ideal as the basis for a research platform, a lightweight accelerator host or as a standalone Linux core.

The biggest problem of the OCI Image Spec is that a container cannot be started until all the tarball layers are downloaded, even though more than 90% of the tarball contents are often unneeded for the actual workload.

This session will show state-of-the-art alternative image formats, which allow runtime implementations to start a container without waiting for all its image contents to be locally available.

Especially, this session will put focus on CRFS/stargz and its implementation status in containerd (https://github.com/containerd/containerd/issues/3731). The plan for BuildKit integration will be shown as well.

An overview about what's new in LibrePCB since the last presentation at FOSDEM 2018, and a short live demonstration to see LibrePCB in action.

This talk will explain some basics about KMS, introduce libliftoff, describe the library's current status and outline the next steps.

Many DRM drivers have been exposing overlay planes for quite some time. Overlay planes can improve battery consumption by scanning out directly client buffers, skipping composition. While Wayland compositors and the X server usually take advantage of the cursor plane (and sometimes are able to use the primary plane to directly scan out a client's buffer), overlay planes are under-used. The exception is Weston, which tries to use overlay planes. Other compositors ignore them.

The main challenge is to figure out how to assign buffers coming from clients to hardware planes. The only API exposed by KMS is atomic test commits, so user-space needs to try different combinations. It would be nice to have a common library shared between compositors to de-duplicate the work.

During the XDC 2019 conference we discussed about libliftoff, an attempt at designing such a library. Feedback was positive from both compositor writers and driver developers. We discussed about the API, the potential pitfalls and future goals. The scope of the library has been expanded: libliftoff could also provide some feedback to clients so that they allocate buffers suitable for hardware planes. Additionally, because the KMS API makes it tricky to find the best way to make use of hardware planes, libliftoff could grow some vendor-specific plugins.

Pulp (https://pulpproject.org) enables users to organize and distribute software. Now that Pulp 3.0 is generally available, it’s time to integrate it into your software delivery workflows. While the REST API is the primary integration point, it is the OpenAPI schema definition of that API that enables users to build client libraries in various languages. These clients simplify the integration with Pulp 3.

This talk will provide a brief introduction to OpenAPI. This will be followed by a demonstration of how to use the Pulp’s OpenAPI schema to generate a Python client for Pulp’s REST API. The Python client will then be used to perform various workflows in Pulp 3.

Apache Camel is a free software integration framework from the Apache Software Foundation. This meetup is for anyone wishing to meet and discuss Apache Camel development, share experiences and meet in meat space other folk in the Apache Camel community.

Apache Camel has been around and its used quite widely for in all sorts of software integration projects. Camel version 3 was recently released and the community has kicked of several sub-projects: Camel K - a serverless, cloud native integration on top of Kubernetes, Camel Quarkus - low memory, fast startup support utilizing Quarkus, and Camel Kafka Connector - for running Camel inside of Kafka. Let's meet and discuss these initiatives or just talk and exchange ideas around Camel. Anyone wishing to share can present on any topic relating to Apache Camel is welcome to do so, though please be mindful of the time - we have one hour in this session and would like that everyone would have the chance to participate.

Sharing knowledge in a team of people working together (company, association, study group or any other kind of project) is key for its long-term success. Even if this is not properly identified from the beginning as a main concern, setting up tools and processes that allow knowledge to be accumulated and organized correctly ends up being on the TODO list at some point, and may come with the wish to have done it earlier. Thus, the best solution is one that is quick enough to setup from the very beginning and versatile enough to be able to incrementally develop into a proper solid fortress of knowledge.

In this presentation I will use the XWiki platform to incrementally build a collaborative intranet from scratch and will try to address some frequent needs of knowledge sharing in a team, using already-made add-ons or new tools (list not exhaustive): * Blog, for unidirectional communication, * Meeting notes, for spoken knowledge not to be lost, * File Manager for just dropping files to share, * Task manager for lightweight ticketing, * Holiday requests and Recruitment applications for team management, * Unstructured free content sharing, using standard wiki pages and page templates, * Structured content tailored to fit your exact specific needs, * Multi-wiki separation for teams isolation, * Powerful search in all this, * Authentication add-ons to plug your own users management, * Easy look & feel setup, to brand it as your own.

It has become very popular in the last several years to think of free and open source as a community forward activity, indeed the modern approach is to try and form a community or foundation first and do code second. There is also much talk about maintainer burn out and community exploitation. However, the same people who talk about this still paraphrase the most famous quote from the Cathedral and the Bazaar "Scratching your own itch". They forget this is your own itch not everyone else's because Open Source begins as a selfish activity. The fact that communities do form around a load of selfish competing individuals is actually a testament to the unacknowledged power of open source to co-opt the selfish instinct and make it synergistic to some communal good.

This talk will explore the selfish origins of free and open source and dissect the co-option power it has to form broad and deep communities from what are apparently simple transactional engagements. We'll also explain how some of the more recent community failures have been engendered by the concentration on long term community to the detriment of enabling purely transactional mechanics by which initially selfish contributors come to the project.

The origins of selfish contributions, while called out in the founding canons of the open source and free software movements, were initially not very well recognized until the first open source projects (and here the author will use the example he's familiar with: the Linux Kernel) tried to engage successfully with companies trying to utilize the projects for their own ends. We became adept at explaining why forking is bad and how your cost structure will rise exponentially if you do it and how the cheapest method of achieving your business goals is in fact to work with the existing community on whatever feature the company was trying to add as part of its business plan. In fact, those of use who did company engagement because transactional sales people offering a corporation the achievements of business goals in exchange for some unexpected community engagement.

Nowadays, all companies have drunk the open source coolaid and all pledge their loyalty to further the interests of the community and this previous learning is all but forgotten in the third and fourth waves of open source. However, at their hearts, corporations are still the same business goal focussed transactional entities we had to deal with in the early days of open source and an understanding of how to co-opt their transactional nature would go a long way to assisting new open source developers in their quest to form communities.

This talk will begin with some history of the Linux kernel's corporate engagement, explore and explain some of the processes within open source development that lead to the conversion of transactionalism into long term community synergy (the truly astounding ability of open source to co-opt selfishness) and then give a few examples of how serving the community rather than enabling transactionalism can give rise to burn out and apparent exploitation. In conclusion we'll give some simple rules to enable this co-opting and suggest how some of the competing interests of the ethical source and social justice movements might likewise be co-opted.

Learn how distributed tracing can revolutionize the way you troubleshoot errors and performance issues, in both monolithic and distributed micro-service architectures.

OpenTelemetry is an industry standard for distributed tracing, merging the tech and communities of OpenCensus and OpenTracing.

• Introduce the concepts of application tracing and the state of the ecosystem (Spans, Traces, Context Propagation, OpenTracing, OpenCensus, OpenTelemetry)
• Explain how this is different and complementary to Erlang’s built-in tracing tools
• Show what insights can be more easily gained from trace data as opposed to logs and metrics
• Give an overview of the tools and vendors available to start using this technology today

A good grasp of C++ is rather useful when it comes to improving LibreOffice. However, in the project there are vital roles and tasks that do not involve writing C++. This talk explores these other ways of contributing.

From ten years of LibreOffice, how can you apply what we learned to your project ? What is going on in LibreOffice today, and where is it going ? and How can you re-use or contribute to the story.

Come hear about the story of LibreOffice, the reasons we started - and some of the highlights: successes, failures and other lessons learned from our first ten years. Hear how our initial decisions and vision of open-ness and vendor neutrality panned out. See what has been learned about building an effective commercial ecosystem, with certification.

Hear about the trajectory of technical updates and how we

re-juvenated an open-source code-base through massive re-factoring, as well as re-targetting for web and mobile.

Catch up with the latest in Online innovation, optimization

and scalability work as well as our growing integration with lots of other Open Source projects.

Finally catch up with the latest and greatest feature/function

improvements as we move towards LibreOffice 7, and find out how you can best get involved with the next decade of the LibreOffice story.

In a perfect world, lawyers (and the entire legal system) should not be necessary. And in a perfect FOSS world, everyone respects each and every provision of every license. The reality is, however, very different, and enforcement may be a necessary evil. This need does not mean we have to open the gates to be flooded by "copyleft trolls", but to establish a sound enforcement policy, in order to unleash the lawyers only for the most blatant and repeated violations

Affirmative position: FOSS licenses should not be enforced.

1. First Affirmative Constructive (1AC) = 7 minutes a. Cross-examination of First Affirmative by Second Negative = 3 minutes
2. First Negative Constructive (1NC) = 7 minutes a. Cross-examination of First Negative by First Affirmative = 3 minutes
3. Second Affirmative Constructive (2AC) = 7 minutes a. Cross-examination of Second Affirmative by First Negative = 3 minutes
4. Second Negative Constructive (2NC) = 7 minutes a. Cross-examination of Second Negative by Second Affirmative = 3 minutes
5. First Negative Rebuttal (1NR) = 3 minutes
6. First Affirmative Rebuttal (1AR) = 3 minutes
7. Second Negative Rebuttal (2NR) = 3 minutes
8. Second Affirmative Rebuttal (2AR) = 3 minutes

The approaches used in software development in an industry setting and a scientific environment are exhibit a number of fundamental differences. In the former industry setting modern team development tools and methods are used (version control, continuous integration, Scrum, ...) to develop software in teams with a focus on the final software product. In contrast, in the latter scientific environment a large fraction of scientific code is produced by individual scientists lacking thorough training in software development with a specific research goal in mind. Indeed, it is only in the last decades that scientific software development started to become a fully recognized part of scientific work. Still, formal training in software development is largely missing in the scientific curricula of many universities. Additionally, due to the exploratory nature of the scientific method at the frontier of knowledge, most projects require the implementation of custom code. The combination of these circumstances promotes the development of scientific code not suited for sharing and long term maintenance, limiting the reusability and reproducibility of scientific data and findings. The systematic development and adoption of open source packages by the scientific community can emend this situation. Here we present examplary open source packages from the field of neuroscience and discuss the special requirements for open source software development and services in this research area.

Acknowledgements: This project has received funding from the European Union’s Horizon 2020 Framework Programme for Research and Innovation under Specific Grant Agreement No. 785907 (Human Brain Project SGA2). Supported by the NFDI Neuroscience Initiative.

Management of allowed cryptographical algorithms to disallow algorithms not allowed due to weaknesses or restrictions by certification standards is complicated task. The talk will introduce system-wide crypto-policies concept and implementation as an attempt to help system administrators with this task.

This talk replaces "OSINT" talk which was schedulled initially, but David Busby could not attend on the short notice.

The system-wide crypto-policies were introduced in Fedora 21 in 2014. Since that time the tool evolved a lot especially with the recent introduction of run-time generation of configuration from a policy definition file and introduction of sub-policy concept. The feature is called Custom crypto policies. The crypto-policies nowadays help management of crypto algorithms not only in Fedora but also in Red Hat Enterprise Linux 8. It will be shown how the policy definition file looks like and how it is converted to the actual crypto library configuration.

Homebridge is a lightweight NodeJS server that emulates Apple HomeKit API. Combined with versatile plugins it allows you to make any device Homekit-compatible. In the presentation you will understand how Homebridge works and how to integrated it in a custom embedded Linux distribution built with the Yocto Project and OpenEmbedded. We will go through the exact steps for leveraging the latest release of Poky, the reference system of the Yocto Project, with systemd, X11, openbox, surf web browser, nodejs, npm, Homebridge and some of its most popular plugins. Only open source software will be used, without any commercial licenses. Practical examples for home automation with Homebridge on Raspberry Pi and the new STM32MP1 development boards will be demonstrated. The end result is an embedded device mounted in rack with a DIN rail that provides simple and user-friendly way to manage and configure Homebridge out of the box. The talk is appropriate for beginners.

Homebridge is a lightweight NodeJS server that you can run on your home network and emulate Apple HomeKit API. Started more than 5 years ago and available at GitHub under Apache License 2.0, Homebridge has a large and vibrant open source community. Multiple plugins allow Homebridge to handle user's requests either via Siri or the Home app and this way to make any device Homekit-compatible. Raspberry Pi is the perfect platforms for hobbyists to install a local Homebridge instance. However, the installation of Homebridge on Raspbian requires numerous steps and despite the excellent tutorials, users without previous Linux experience face difficulties. Another disadvantage is that Raspbian is available only as 32-bit images which doesn’t use the full capabilities of the ARMv8 64-bit processors on Raspberry Pi 3 and 4. The Yocto Project and OpenEmbedded provide all required tools to create a custom Linux distribution that out of the box offers user-friendly experience for configuring Homebridge in just a few easy steps. In the this presentation we do a code review of meta-homebridge Yocto/OE layer and we will walk through the exact steps for creating a lightweight Linux distribution with graphical user interface and a web browser that acts like a kiosk. We will integrated and configure popular open source software tools such as the Linux kernel, systemd, X11, openbox, surf web browser, nodejs, npm and of course Homebridge. Thanks to the meta-raspberrypi BSP Yocto/OE layer we will be able to unleash the full power of Raspberry Pi 3 and 4 by building 64-bit images. At the end of the presentation demonstrations and tips for making an embedded device mounted in rack with a DIN rail will be shared. We will also mention the new STM32MP1 industrial grade development boards as alternatives of Raspberry Pi for this and similar projects in the maker community. This talk brings benefits to the ecosystems of several open source communities. It will spread the word about Homebridge and significantly improve the getting started experience for user. Practical examples for using the Yocto Project and OpenEmbedded for makers will be revealed. As part of the development efforts for meta-homebridge Yocto/OE, a couple of new recipes, surf (simple web browser) and stalonetray (X11 system tray), have been contributed to the upstream of meta-openembedded. The talk is appropriate for beginners. No previous experience is required. Hopefully, this presentation will encourage the audience to try out Homebridge and leverage their knowledge about the Yocto Project and OpenEmbedded with the example of this real-world entirely open source project.

While working on the Mercurial version control system, we hit our heads against the limits of Python's performance. In this talk we will see how Python and Rust can cohabit to play off of each other's strenghts to improve a big open-source project, and what advances have been made in bridging the two languages.

Introducing Relax-and-Recover (ReaR) for the novice users. What is it and what can it mean for you? Is Disaster Recovery useful to consider it or not? How can ReaR assist you with DR? ReaR can store the details about your systems on disks (NAS, USB, SAN,...) or network (PXE, NFS, CIFS,...) including the complete backup. It also creates a bootable image which you need to recreate your system from scratch. Furthermore, thanks to the modular concept, ReaR integrates perfectly with external backup solutions (be commercial and/or open source ones) to do the backup and restore part which makes ReaR very scalable in big enterprises. ReaR scales even with Cloud solutions and is the heart of another great project (DRLM or Disaster Recovery Linux Manager).

Relax-and-Recover (ReaR) is the de facto standard generic (bare metal) disaster recovery framework for all kind of Linux systems. ReaR is in common use by admins for disaster recovery on thousands and thousands of Linux server systems. The first part of the "ReaR Basics" talk will be presented by Gratien D'haese (one of the co-founders of ReaR).

In the second part of the talk Johannes Meixner (one of the main developers of ReaR) will use his own laptop to demonstrate the ReaR disaster recovery framework. Therefore, Johannes will show a real live demo without safety net how ReaR is used to recover his own laptop from soft errors like deleted essential files (rm -r /lib...) and/or destroyed partitioning/bootloader (dd if=/dev/zero of=/dev/sdX). Come and see for yourself how ReaR can save your day!

KernelCI is a project dedicated to testing the upstream Linux kernel. Originally created by Linaro in 2014, it started a new chapter by becoming a Linux Foundation project in October 2019. Its future looks bright, with plenty of opportunities for new contributors to join.

The chosen one

The upstream kernel testing landscape is pretty wide, rich and diverse, in the same ways that the Linux kernel is. But as there is only one upstream kernel, it became clear that there should also be one main test system associated with it. KernelCI was chosen to fulfil this role, being rather neutral, versatile and based on a distributed architecture.

A welcoming place

While the project now has a governing board via the Linux Foundation membership, its involvement with the kernel community is only getting stronger. It is of utmost importance to keep the roadmap aligned with expectations from maintainers and developers to preserve the integrity and overall purpose of project. In fact, it now needs to become an easy tool to use by anyone who wants to add tests for their subsystem or their hardware and for anyone to reproduce those tests locally.

An exciting year ahead

This is a new beginning for KernelCI, with many of its prior limitations now being removed thanks to the framework provided by the Linux Foundation. Contributors to the code, tests, hardware labs and new project members will all have a great influence by joining the project at this very special point in time. Now is the time to come and help shape it as a successful project for the years to come.

Slides: gtucker-kernelci-fosdem-2020.pdf

Skydive is an open source real-time network topology and protocols analyzer providing a comprehensive way of understanding what is happening in your network infrastructure.

Skydive is a toolbox to monitor, visualize and troubleshoot an infrastructure.

It first collects all the information about the physical and logical infrastructure : network interfaces, Linux and Openvswitch bridges, network namespaces, Docker/runc containers, Kubernetes objects, virtual machines and more. All these objects are stored into a graph to allow the operator to visualize and query the whole topology. On top of this, Skydive is able to inject, capture and analyze traffic at any point of this infrastructure - using various technics such as AFpacket, eBPF, DPDK or SFlow samples. This make possible use cases like :

• troobleshoot dropped packets

• get metrics and bandwidth about some specific traffic

• trigger alert on some abnormal traffic detection

• get latency on the whole path of a flow

• and a lot more...

Skydive is agnostic to any SDN, container orchestration engine or virtualization platform. That being said, Skydive has plugins for specific technologies such as Kubernetes/Istio, OpenStack, Openvswitch, Network Service Mesh, OpenContrail, VPP and more.

This presentation will present the architecture of Skydive and demonstrate some use cases through a demo.

In this talk, we'll walk through RocksDB technology and look into areas where MyRocks is a good fit by comparison to other engines such as InnoDB. We will go over internals, benchmarks, and tuning of MyRocks engine. We also aim to explore the benefits of using MyRocks within the MySQL ecosystem. Attendees will be able to conclude with the latest development of tools and integration within MySQL.

Would you like a DNS server for IPv6 where adding a new node is as simple as typing in its name? If the answer is yes, try HashDNS.

IPv6 autoconfiguration methods can give addresses to interfaces but do not provide any means of configuring the DNS. So autoconfiguration is suitable for clients. If a host has to act as a server, it must have a fully qualified domain name and the DNS service has to map its name to its IP address.

In the Internet of Thread scenario, the number of network nodes can be orders of magnitude higher than before, as each process or thread can be a node. This idea of hash based IPv6 addresses is a viable solution to the problem to manage the DNS resolution in IoTh environments.

The host part of an IPv6 address can be computed as the result of a hash function computer on the fully qualified domain name.

In this way it is possible to write a DNS server able to resolve the addresses of any hostname in a sub-domain provided the network prefix of that sub-domain.

The installation of a new node of the network (computer, namespace, IoTh process) is as simple as providing it with its IPv6 address (the one obtained by concatenating the network prefix and the host address computed by the hash function).

There is no need to change the configuration of the DNS.

Actually the installation of a new node (or its renaming) is even simpler than that. The host can use a DHCP service designed to get the right address from the DNS server given its fully qualified domain name.

So a system administrator has nothing to do more than assigning the new node its name. (They have just to baptize the new node)

HammerBlade is an open source RISC-V manycore that has been under development since 2015 and has already been silicon validated with a 511-core chip in 16nm TSMC. It features extensions to the RISC-V ISA that target GPU-competitive performance for parallel programs (i.e. GPGPU) including graphs and ML workloads. In this talk we will overview the components of the HW and software ecosystem in the latest version, and show you how to get up and running as an open source user or contributor in either SW or HW on Amazon F1 cloud FPGAs.

HammerBlade is an open source RISC-V manycore that has been under development since 2015 and has already been silicon validated with a 511-core chip in 16nm TSMC. It features extensions to the RISC-V ISA that target GPU-competitive performance for parallel programs (i.e. GPGPU) including graphs and ML workloads. In this talk we will overview the components of the HW and software ecosystem in the latest version, and show you how to get up and running as an open source user or contributor in either SW or HW on Amazon F1 cloud FPGAs. We will overview the HW-architecture, the CUDA-like programming environment, the runtime software, the HW architecture, and our Amazon F1 cloud emulation and cosimulation environments, and our suite of performance analysis tools.

A story about graphics pipeline of 0 A. D. (an open-source game of Wildfire Games) and its issues.

Talking structure:

• A little history of 0AD (https://play0ad.com/about/the-story-of-0-a-d/)

• How our graphics pipeline works

• Used technologies (SDL, OpenGL 1/2, ARB/GLSL shaders)

• Known problems (old OpenGL, legacy support of OpenGL drivers on macOS 10.14)

• Future plans

Dhrystone and Coremark have been the defacto standard microcontroller benchmark suites for the last thirty years, but these benchmarks no longer reflect the needs of modern embedded systems. Embench™ was explicitly designed to meet the requirements of modern connected embedded systems. The benchmarks are free, relevant, portable, and well implemented.

In this talk we will present the results of benchmarking Clang/LLVM for various IoT class architectures using Embench. We shall look at - how code size and speed varies across architectures when compiling with Clang/LLVM. - how Clang/LLVM performance has evolved over time - how Clang/LLVM compares against other compilers, notably GCC - the effectiveness of various compilation techniques (LTO, Combined Elimination, Profile Guided Optimization)

The aim is not to show which architecture or compiler is best, but to gain insight into the detail of the compilation process, so that all compilers and architectures can learn from each other.

A walk through the different ways in which people from different areas and backgrounds use a same application (FreeCAD), and the impact this has on their workflows, and even on FreeCAD development

The FreeCAD project gathers a community of developers and users coming from a very large array of specialties: Makers, mechanical engineers, civil engineers, electronics engineers, architects, opticians, graphic designers, etc. All these people using the same software is a unique opportunity to explore and build cross-discipline workflows, and have people coming from one field learn unusual ways from other fields. This constant interchange of paradigms also influences FreeCAD development itself, and connects it to other fields and applications too, to create larger ecosystems. In this talk, we will show some examples of how this happens in different areas.

The Confidential Consortium Framework is an open-source framework for building permissioned confidential multi-party services. It leverages hardware trusted execution environments to provide strong confidentiality, integrity, and high performance. CCF implements consortium-based programmable and auditable governance.

Please note that this talk was originally scheduled to begin at the later time of 11:50.

BPF as a foundational technology in the Linux kernel provides a powerful tool for systems developers and users to dynamically reprogram and customize the kernel to meet their needs in order to solve real-world problems and without having to be a kernel expert. Thanks to BPF we have come to the point to overcome having to carry legacy accumulated over decades of development grounded in a more traditional networking environment that is typically far more static than your average Kubernetes cluster. In the age of containers, they are no longer the best tool for the job, especially in terms of performance, reliability, scalability, and operations. This talk provides a few examples on how BPF allows to rethink container networking based on recent work we did in Cilium. Among others, the audience will learn about running a fully functioning Kubernetes cluster without iptables, Netfilter and thus without kube-proxy in a scalable and secure way with the help of BPF and Cilium.

Project Loom, an OpenJDK project, is "intended to explore, incubate and deliver Java VM features and APIs built on top of them for the purpose of supporting easy-to-use, high-throughput lightweight concurrency and new programming models on the Java platform." These feature include Lightweight Threads, delimited continuations, and tail-call elimination.

The speaker, a Project Loom team member, will describe the project in depth, in particular the gnarly details of how coroutine and continuation scheduling mechanism works, and a new feature, Scoped Locals.

This is a hands-on short tutorial on how to write your own estimator or transformer which can be used in a scikit-learn pipeline, and works seamlessly with the other meta-estimators of the library.

It also includes how they can be conveniently tested with a simple set of tests.

In many data science related tasks, the use-case specific requirements require us to slightly manipulate the behavior of some of the estimators or transformers present in scikit-learn. Some of the tips and requirements are not necessarily well documented by the library, and it can be cumbersome to find those details.

In this short tutorial, we go through an example of writing our own estimator, test it against the scikit-learn's common tests, and see how it behaves inside a pipeline and a grid search.

There has also been recent developments related to the general API of the estimators which require slight modifications by the third party developers. I will cover these changes and point you to the activities to watch as well as some of the private utilities which you can use to improve your experience of developing an estimator.

The materials of the talk will be available on github as a jupyter notebook.

IP video intercom systems combined with smartphones can leverage regular RTP/SIP VoIP technology to offer a new set of services to end-users: getting a notification when visitors press the door bell, seeing them on video before answering the call, interacting with them via voice and video and deciding to open the door, at home or anywhere else via wifi or 3G coverage.

Linphone (a SIP user-agent) and Flexisip (a SIP proxy server) can be integrated into IP video door phones, in-house panels and video surveillance devices to build a complete VoIP network.

Linphone and Flexisip use open standards to reliably send the audio and video streams captured from IP video intercoms to in-house devices, including smartphones and tablets, connected either to a local network or to the public internet. These open source SIP-based software solutions can run perfectly on small hardware devices with reduced footprint, and can easily be integrated into GNU/Linux embedded systems, thanks to their Yocto packages.

This lecture will describe how Linphone and Flexisip can be used together to build an embedded SIP network dedicated to home automation or video surveillance. The network architecture used in these contexts can also be deployed in other areas, such as the emergency services or the Internet of Things.

Linphone and Flexisip can be integrated into IP video intercom systems to make the audio and video capabilities of a door entry panel accessible by in-house control screens and smartphones, connected either to a local network or to the public internet.

Indeed, the linphone software fits well in embedded systems, which makes it a good candidate for being used in home automation devices, such as outdoor panels or indoor monitors, where video is to be capture or displayed. However a SIP user-agent itself is not sufficient for setting up a fully functional SIP network: we propose the use of Flexisip, which is also able to run with reduced footprint on embedded devices as well as on a large scale cloud deployment, to fork incoming calls to in-house monitoring panels, smartphones or tablets.

When used together, Linphone and Flexisip offer advanced features for IP door phones and video monitoring systems, such as : - HD video and HD voice (with support for H.264 and H.265 hardware accelerated codecs, and Opus codec) - Call forking with early media video - ICE, STUN and TURN support for optimised NAT traversal allowing peer-to-peer audio and video connections whenever possible - secure user authentication with TLS client certificates - Interconnection with push notifications systems, for reliably notifying of people ringing the door

In this talk, we will see how to debug/trace on a running RabbitMQ node. Erlang remote access and remote debugging are builtin features in Erlang/Elixir.
With these features, it is possible to see what's happening inside a BEAM node (as RabbitMQ). I will show also how to use "dynamic loading" to add a not native code in a running beam.

Erlang remote access and remote debugging are builtin features in Erlang/Elixir.
With these features, it is possible to see what's happening inside a BEAM node (as RabbitMQ). There are a set of tools inside the beam like etop, eprof, dbg, fprof ... that work in the same Linux way. In this talk, we will see how to use some of these features on a running RabbitMQ node. I will show also how to use "dynamic loading" to add a not native code in a running beam.

In the Ada world, we are surrounded by impressive and professional tools that can handle large and complex projects. Did you ever dream of a tiny, incomplete but compatible system to play with? Are you too impatient, when developing small pieces of code, for long compile-bind-link-run cycles? Are you a beginner intimidated by project files and sophisticated tools? Then HAC (the HAC Ada Compiler, or the Hello-world Ada Compiler) is for you.

HAC is a revival of the SmallAda project, which supported the "Pascal subset" plus tasking.

It may be hard to image, but some sysadmins do not operate in ideal, tightly controlled circumstances. Apparently, not every developer, application or organization is ready for Kubernetes…

In this presentation we will share a real world use case: deploying and configuring a brand new natural history museum. We’ll show how we built the museum with open source software and config management tools, dealing with a broad set of technologies, a tight schedule, a sector dominated by traditional organizations fixated on proprietary solutions and a whole bunch of actual fossils. We’ll show how far we’ve come, and what choices we made along the way.

Check out this talk if you want to see how Ansible, MAAS, PlatformIO, Nextcloud and other tools were used to not just automatically deploy and configure Linux based media players, games and digital signage screens, but also to manage Cumulus Linux-based switches, OPNsense firewalls, show controllers, Arduino microcontrollers, KNX gateways, projectors and even the odd OSX machine.

It may be hard to image, but some sysadmins do not operate in ideal, tightly controlled circumstances. Apparently, not every developer, application or organization is ready for Kubernetes…

In this presentation we will share a real world use case: deploying and configuring a brand new natural history museum. We’ll show how we built the museum with open source software and config management tools, dealing with a broad set of technologies, a tight schedule, a sector dominated by traditional organizations fixated on proprietary solutions and a whole bunch of actual fossils. We’ll show how far we’ve come, and what choices we made along the way.

Check out this talk if you want to see how Ansible, MAAS, PlatformIO, Nextcloud and other tools were used to not just automatically deploy and configure Linux based media players, games and digital signage screens, but also to manage Cumulus Linux-based switches, OPNsense firewalls, show controllers, Arduino microcontrollers, KNX gateways, projectors and even the odd OSX machine.

NeuroFedora is an initiative to provide a ready to use Fedora-based Free/Open source software platform for neuroscience. We believe that similar to Free software; science should be free for all to use, share, modify, and study. The use of Free software also aids reproducibility, data sharing, and collaboration in the research community. By making the tools used in the scientific process more comfortable to use, NeuroFedora aims to take a step to enable this ideal.

The computer has become an indispensable resource in modern neuroscience. From the gathering of data, simulation of computational models, analysis of large amounts of information, collaboration, and communication tools for community development, software is now a necessary part of the research pipeline.

The Neuroscience community is gradually moving to the use of Free/Open Source software (FOSS) 1; however, the software tools used in Neuroscience and research are generally complicated and sophisticated to use. Researchers that hail from a different field other than computing must spend considerable resources on setting up and managing the computing environment and the software tools. This limits the portability of the software, making the installation of software very time-consuming and sometimes tricky.

We present NeuroFedora - A Fedora-based operating system for Neuroscientists. We have leveraged the infrastructure resources of the FOSS Fedora community 2 to develop an operating system that includes a plethora of ready-to-use Neuroscience software. We follow the standard software development and quality assurance practices set out by the Fedora community to provide an integrated platform for researchers to use. Furthermore, NeuroFedora is well integrated with other software such as desktop environments, text editors, and other daily use and development tools.

A NeuroFedora lab image is now available, with over 130 neuroscience packages ready to use. With an up to date documentation at (neuro.fedoraproject.org) and about 120+ packages in the queue, we encourage more FOSS enthusiasts to join the team to help NeuroFedora better aid the open (neuro)-science and research community.

Security vulnerabilities are still very common in todays software. Formal methods could improve the situation, but program verification remains a complex and time-consuming task. Often, the verification of existing software is infeasible and a complete rewrite can be prohibitively expensive. Both, however, is not necessarily required to improve on the current state. By replacing critical parts of an existing software by verified code, security can be strengthened significantly with moderate effort.

We show the feasibility of this approach by the example of a FLOSS TLS implementation. The basis of our PoC is the TLS 1.3 library Fizz which is written in C++. The existing message parser was replaced by a verified version implemented in the SPARK language. Our RecordFlux toolset was used to automatically generate the parser based on a formal message specification. With the SPARK tools we can prove automatically that an attacker cannot cause any overflows, runtime errors or undefined state by sending malformed messages to the modified library. Because of mismatches in the data structures used in C++ and SPARK, some glue code had to be written manually to integrate the verified parser into Fizz. Still, the modified TLS implementation shows only a slight performance loss while providing higher security.

A short update on the state of Zink, and OpenGL implementation on top of vulkan, now that it's upstream in Mesa.

ESP is an open-source research platform for RISC-V systems-on-chip that integrate many hardware accelerators.
ESP provides a vertically integrated design flow from software development and hardware integration to full-system prototyping on FPGA. For application developers, ESP offers domain-specific automated solutions to synthesize new accelerators for their software and map it onto the heterogeneous SoC architecture. For hardware engineers, ESP offers automated solutions to integrate their accelerator designs into the complete SoC.
The participants in this FOSDEM20 event will learn how to use ESP from the viewpoints of both application developers and hardware engineers by following a series of short hands-on tutorials embedded in the lecture. Conceived as a heterogeneous integration platform and tested through years of teaching at Columbia University, ESP is intrinsically suited to foster collaborative engineering of RISC-V based SoCs across the open-source community.

• What is ESP?

ESP is an open-source research platform to design and program heterogeneous systems-on-chip (SoCs). A heterogeneous SoC combines multiple general-purpose processor cores and many specialized hardware accelerators.

• What does ESP offer?

ESP provides automated solutions to (a) synthesize new accelerators, (b) integrate them with RISC-V processors and other third party accelerators into a complete SoC, (c) rapidly prototype the SoC on an FPGA board, and (d) run software applications that take advantage of these accelerators. ESP contributes to the open-source movement by supporting the realization of more scalable architectures for SoCs that integrate more heterogeneous components, thanks to a more flexible design methodology that accommodates different specification languages and design flows.

• What is an example of an SoC prototype realized with ESP?

With ESP's automation capabilities, it is easy to realize FPGA-based prototypes of complete SoCs. For example, an SoC may feature the Ariane RISC-V processor core booting Linux, a multi-plane network-on-chip supporting a partitioned memory hierarchy with multiple DRAM controllers, and tens of loosely-coupled accelerators that execute coarse-grained tasks exchanging large amount of data with DRAM through direct-memory access (DMA). These accelerators can be third-party open-source hardware components that “speak” the AXI protocol (e.g. the NVIDIA NVDLA accelerator for deep learning) or new accelerators that can be synthesized with different design flows from specifications written in different languages, including: C with Xilinx Vivado HLS, SystemC with Cadence Stratus HLS, Keras TensorFlow and PyTorch with hls4ml, Chisel, SystemVerilog, Verilog, and VHDL.

• Why is ESP relevant now?

Information technology has entered the age of heterogeneous computing. Across a variety of application domains, computing systems rely on highly heterogeneous architectures that combine multiple general-purpose processors with specialized hardware accelerators. The complexity of these systems, however, threatens to widen the gap between the capabilities provided by semiconductor technologies and the productivity of computer engineers. ESP tackles this challenge by raising the level of abstraction in the design process, simplifying the domain-specific programming of heterogeneous architectures, and leveraging the potential of the emerging open-source hardware movement.

• What are some key ingredients of the ESP approach?

Building on years of research on communication-based system-level design at Columbia University, ESP combines an architecture and a methodology. The flexible tile-based architecture simplifies the integration of heterogeneous components by balancing regularity and specialization. The companion methodology raises the level of abstraction to system-level design, thus promoting closer collaboration among software programmers and hardware engineers. Through the automatic generation of device drivers from pre-designed templates, ESP simplifies the invocation of accelerators from user-level applications executing on top of Linux. Through the automatic generation of a multi-plane network-on-chip from a parameterized model, the ESP architecture can scale to accommodate many processors, tens of accelerators, and a distributed memory hierarchy. A set of ESP Platform Services provides pre-validated solutions for accelerators configuration, memory management, sharing of system resources, and dynamic frequency scaling, among others.

• How does ESP differ from other RISC-V based platforms?

To date, the majority of the open-source hardware (OSH) efforts related to RISC-V have focused on the development of processor cores that implement the RISC-V ISA and small-scale SoCs that connect these cores with tightly-coupled functional units and coprocessors, typically through bus-based interconnects. Meanwhile, there have been less efforts in developing solutions for large-scale SoCs that combine RISC-V cores with many loosely-coupled components, such as coarse-grain accelerators, interconnected with a network-on-chip (NoC). Compared to other RISC-V related projects, ESP is focused on scalability (with the NoC-based architecture), heterogeneity (with emphasis on loosely-coupled accelerators), and flexibility (with support of different design flows). Just like the ESP architecture simplifies the integration of heterogeneous components developed by different teams, the ESP methodology embraces the use of heterogeneous design flows for component development.

• Who are the authors of ESP?

ESP has been developed by the System-Level Design (SLD) group in the Department of Computer Science at Columbia University during the past seven years. The SLD group has published over a dozen scientific papers in peer-reviewed conferences and journals to describe the most innovative aspects of ESP. ESP has been released as an open-source project via GitHub in the summer 2019.

As CoSP’s accelerate their adoption of SDN and NFV technologies, the increased need for metrics, performance measurement and benchmarking becomes a focus, to ensure the continued delivery of “best in class” services. As NFV environments have grown in size and complexity, the tools required to gain this greater visibility into the NFVi need to continue to evolve to meet the requirements for manageability, serviceability and resiliency.

Using Collectd as a metrics collection tool, OPNFV Barometer monitors the performance of the NFVi resources and has the capability to expose these insights via open industry standard interfaces to analytics or MANO components for potential enforcement or corrective actions. Barometer works with related open source technologies and communities (collectd, DPDK, OpenStack, Prometheus, SAF, etc.) to provide numerous metrics and events that address various different use cases such as service healing, power optimization and ensuring application QoS.

ONLYOFFICE is an open-source HTML5-based office suite for editing and collaborating on text documents, spreadsheets, and presentations online. Here, maximizing format compatibility, establishing browser-agnostic content display and optimizing real-time data transfer in co-authoring are the core principles in building applicable editing software.

End user-side demand indicates that deeper integration in productivity solutions and content management applications is one of the main directions for ONLYOFFICE. We would like to share our experience in building connectors that allow users to edit and co-author their documents securely right within a platform they use.

Presentation milestones:

• Review of the technical basis of ONLYOFFICE editors (HTML5 Canvas, JavaScript, etc.);
• Open API that allows creating third-party connectors;
• Integration with content management platforms such as XWiki, Nextcloud, ownCloud (including connectors/integration apps development);
• Security measures (JSON Web Token, limited cache lifetime, etc.)
• Connecting desktop and mobile environments to content management platforms;
• ONLYOFFICE integration roadmap.

Installing and configuring ReaR on thousands of Linux systems might become a nightmare to keep track what/where was done with success. Luckily using configuration management software we can do this quite easily. In this talk we will guide you through a recipe on how we have done this for a multi-national company.

See how Red Hat’s CKI project uses GitLab CI to test kernel patches as soon as they're posted to maillists.

Red Hat's CKI project uses GitLab CI to organize and track its pipelines, lint, patch, and build Linux kernels, and oversee testing. It also uses a number of supporting systems to discover kernel patches and commits, maintain hardware inventory, provision hardware and VMs, run tests, and finally record and report results.

See which tricks the project is pulling to tie all these parts together, and test patches posted to several maillists, commits to 15+ git repos, builds done by other build systems, as well as weird things like stable kernel patch queue, and parts of its own software stack.

Making such extensive use of a CI system inevitably uncovers its limitations, and a list of these will also be presented along with some possible solutions.

It is common knowledge that built-in asynchronous master-master (active-active) replication is not safe. I remember times when the official MySQL User Reference Manual stated that such an installation is not recommended for production use. Some experts repeat this claim even now.

While this statement is generally true, I worked with thousands of shops that successfully avoided asynchronous replication limitations in active-active setups.

In this talk, I will show how they did it, demonstrate situations when asynchronous master-master replication is the best possible high availability option and beats such solutions as Galera or InnoDB Clusters. I will also cover common mistakes, leading to disasters.

The fehQlibs and djbdnscurve6 provide both a DNS library which support IPv6 LLU addresses. The inclusion and use of IPv6 LLU addresses is discussed. While the typical Unix /etc/resolv.conf is applied system-wide and the Microsoft Window's pendent works interface-dependent, here application specific DNS settings can be used.

Overview: 1. Background and heritage on fehQlibs and djbdnscurve6 2. Application specific DNS resolver settings 3. Integration of IPv6 LLU addresses - benefits 4. Integration of IPv6 LLU addresses - recipe 5. Outlook and future challenges

The burgeoning RISC-V hardware ecosystem includes a number of microprocessor implementations [1, 3] and SoC generation frameworks [1, 2, 7]. However, while accelerator “sockets” have been defined and used (e.g., Rocket Chip’s custom coprocessor/RoCC), accelerators require additional collateral to be generated like structured metadata descriptions, hardware wrappers, and device drivers. Requiring manual effort to generate this collateral proves both time consuming and error prone and is at odds with an agile approach to hardware design. However, the existence and use of hardware construction languages and hardware compilers provides a means to automate this process. Through the use of the Chisel hardware description language [4] and the FIRRTL hardware compiler [5], we provide a definition of an abstract accelerator template which users then implement to integrate an accelerator with the Embedded Scalable Platform (ESP) System-on-Chip platform [2, 8]. Through the use of this template, we are able to automatically generate XML metadata necessary to integrate accelerators with the ESP platform and work on generating all collateral is in progress. Our accelerator template is open source software provided under an Apache 2.0 license [6].

[1] CHIPS alliance Rocket-chip. GitHub Repository. Online: https://github.com/chipsalliance/rocket-chpi.

[2] Columbia University Embedded scalable platform. git repository. Online: https://github.com/sld-columbia/esp.

[3] ETH Zurich Ariane. GitHub Repository. Online: https://github.com/pulp-platform/ariane.

[4] Freechips Project Chisel3. GitHub Repository. Online: https://github.com/freechipsproject/chisel3.

[5] Freechips Project FIRRTL. GitHub Repository. Online: https://github.com/freechipsproject/firrtl.

[6] IBM ESP chisel acclerators. GitHub Repository. Online: https://github.com/ibm/esp-chisel-accelerators.

[7] Princeton University OpenPiton. GitHub Repository. Online: https://github.com/PrincetonUniversity/openpiton.

[8] ESP: The open-source heterogeneous system-on-chip platform. Online: https://www.esp.cs.columbia.edu/.

The proliferation of heterogeneous hardware in recent years has driven us to consider that every system we program, most likely includes a mix of computing elements; each of which with different hardware characteristics enabling programmers to improve performance while reducing energy consumption. These new heterogeneous devices include multi-core CPUs, GPUs and FPGAs. This trend has been accompanied by changes in software development norms that do not necessarily favor programmers. A prime example is the two most popular heterogeneous programming languages, CUDA and OpenCL, which expose several low-level features to the API making them difficult to use by non-expert users.

Instead of using low-level programming languages, developers in industry and academia tend to use higher-level, object-oriented programming languages, typically executed on managed runtime environments, such as Java, R, and Javascript. Although many programmers might expect that such programming languages would have already been adapted for transparent execution on heterogeneous hardware, the reality is that their support is either very limited or absent.

In this talk, we present TornadoVM (https://github.com/beehive-lab/TornadoVM), a heterogeneous programming framework for Java programs. TornadoVM co-exists with standard JVMs (e.g., OpenJDK) that implement the JVMCI. TornadoVM consists of three components: 1) a simple API for composing pipelines of existing Java methods, 2) an optimizing JIT compiler that extends the Graal compiler with hardware-aware optimizations that generate OpenCL C code, and 3) a runtime system that executes TornadoVM specific bytecodes, performs memory management, and schedules the code for execution on GPUs, multicore CPUs, and FPGAs. Essentially, TornadoVM is a “VM-in-a-VM” that can adapt execution completely dynamically and transparently to the user, always finding the highest-performing combination of hardware accelerators through dynamic reconfiguration.

Kata Containers provide a secure container runtime offering an experience close to that of native containers, while providing stronger workload isolation and host infrastructure security by using hardware virtualization technology. This is particularly useful when containers are used to host and run third-party applications. In this presentation, after a short intro to Kata, we will demonstrate how easy it is to install and use on openSUSE. We will show it in action both as part of a podman setup as well as within a full-featured Kubernetes environment.

With containers becoming not only the preferred way of deploying applications, but also the building blocks of microservice architectures, infrastructure security and workload isolation concerns are being raised. The Kata Containers Open Source project addresses these concerns by using virtualization technology, in compliance with the "defense in depth" design principles. It is also a very flexible, dynamic and fast-moving project, with many components that need to be integrated among each others.

This presentation will illustrate how easy it can already be to use Kata as a container runtime on top of the openSUSE distribution. In fact, after giving a short introduction of Kata Containers and its architecture, we will provide a DEMO of how we have integrated Kata into openSUSE and how it can be used with podman to run containers in a secure and isolated fashion. As Kata is compatible with the OCI (Open Container Initiative) runtime specification, it can be used to seamlessly replace or coexist with other runtimes (e.g. runc) in existing Container Engines (podman, CRI-O, docker, ...), even inside a Kubernetes cluster. We will therefore be able to show how native containers and strongly isolated Kata containers can run together on the same platform. Finally, we will also demonstrate how to set Kata Containers up as an alternative runtime inside of a Kubernetes Cluster.

An update of the development activities will be presented leading to ngspice-32. Its interface to KiCad has been extended, PSPICE device model compatibility and OpAmp convergence are improved, several bugs have been fixed.

The VBIC bipolar model and the VDMOS power MOS model now incorporate the self heating effect.

This will lead to the second part of the talk: ngspice may be very well used to simulate thermal device behavior. Heat generation, transport and temperatures are translated into electrical signals. Thus we simulate two circuits: The electrical circuit with its power losses, and the thermal circuit withany resulting device heating, its feedback on the electrical behavior, and the external cooling measures that need to be provided. Some ciruit examples will be given.

Over the past twenty years, the automation landscape has changed dramatically. As our hunger for complex technical infrastructure increased, and our inability to keep up with these demands faltered, we've outsourced a lot of the work to third-parties and cloud providers. We'll step backwards and show where we came from, and where we're going. If we don't understand this future, and step up to the challenge, then we eventually won't control our own computers anymore. We'll discuss this timeline from a tools perspective and showcase many live demos of the past, present, and what will be possible in the future. This presentation will contain many demos and interactive examples. I will showcase some modern ideas I have with my Free Software project called mgmtconfig.

In FOSDEM 2013, Open Robotics introduced an overview of the Robot Operating System (ROS), an open software integration framework for robots created in 2007. After more than a decade of great success, powering from Robocup teams to NASA robots in space, ROS2 was born to break any limitation detected previously by roboticians all around the globe. It's an exciting time.

This talk will explain the design changes and technical motivations that lead to the creation of ROS2 giving a quick overview of new features present on it: multi-platform, embedded devices, real time, etc.

Managing compliance of large IT environment is complex and challenging task. Today's hybrid cloud environments are having different life cycles, when considering many short lived system like cloud instances its difficult to manage compliance on the go. This talk focuses on how OpenSCAP policies, tools and Ansible can be used to have greater control of compliance of large environments.

Compliance management with OpenSCAP

Enterprise computing environments may consist of thousands of computer systems, having multiple applications and services. These systems are accessed by large and diverse set of users and applications. To have a greater control over security of these vast environments a standard and unified way to scan systems for compliance with security policies is needed.

This talk focuses on using SCAP tools to retain control over large environments, scan compliance with desired policy, and use Ansible to remediate detected problems,

Install and use the SCAP Security Guide.
Evaluate a server's compliance with the requirements specified by a policy from the SCAP Security Guide using OpenSCAP tools.
Create a tailoring file to adjust the policy's security checks so that they’re relevant and correct for a specific system and its use case. 
Run Ansible Playbooks, included in the SCAP Security Guide, to remediate compliance checks that failed an OpenSCAP scan.
Demonstration

LibreOffice has builtin support for working with encrypted documents since a long time (with some recent improvements adding OpenPGP support). Further support for more fine-grained control of what a user can do with access-restricted documents was though missing. Come and see what recent improvements we implemented for LibreOffice 6.4 and 6.5, to permit fine-grained access controls to individual LibreOffice documents, matching the feature set of MS Rights Management Solution.

Spectre-type attacks are a real threat to secure systems because a successful attack can undermine even an application that would be traditionally considered safe. SpecFuzz is the first tool that enables fuzzing for such vulnerabilities.

The key is a novel concept of speculation exposure: The program is instrumented to simulate speculative execution in software by forcefully executing the code paths that could be triggered due to mispredictions, thereby making the speculative memory accesses visible to integrity checkers (e.g., AddressSanitizer). Combined with the conventional fuzzing techniques, speculation exposure enables more precise identification of potential vulnerabilities compared to state-of-the-art static analyzers.

Technical report: https://arxiv.org/abs/1905.10311

For almost 20 years, we relied on a CGI based protocol called WSGI to use Python to handle HTTP requests and responses software. Because Python is singled threaded we relied on a couple of hacks such as Gunicorn or uWSGI to share a socket through multiple processes. However the cost of all these multiple processes was a bit heavy and error prone.

Through Django Channels Andrew Godwin paved the way for a better way of creating web services with Python. This work landed in Django 3.0. Let's explore how it works and why it worth it!

Projects today often have thousands of FOSS dependencies. Since risk flows downstream in the supply chain; projects inherit and pass on the risks of all their dependencies. In response, licensing bill of materials tools often seek to push well-formed licensing inventory data upstream in an effort to ease downstream compliance challenges. At the same time, there has been a stark increase in license violations, especially, though not exclusively, on copyleft licenses. Is this approach to improving compliance working?

Affirmative position: Compliance at scale through tool-driven assembly of bills of materials is essential for FOSS

1. First Affirmative Constructive (1AC) = 7 minutes a. Cross-examination of First Affirmative by Second Negative = 3 minutes
2. First Negative Constructive (1NC) = 7 minutes a. Cross-examination of First Negative by First Affirmative = 3 minutes
3. Second Affirmative Constructive (2AC) = 7 minutes a. Cross-examination of Second Affirmative by First Negative = 3 minutes
4. Second Negative Constructive (2NC) = 7 minutes a. Cross-examination of Second Negative by Second Affirmative = 3 minutes
5. First Negative Rebuttal (1NR) = 3 minutes
6. First Affirmative Rebuttal (1AR) = 3 minutes
7. Second Negative Rebuttal (2NR) = 3 minutes
8. Second Affirmative Rebuttal (2AR) = 3 minutes

In this talk I will present EActors, an actor framework that is tailored to SGX and offers a more seamless, flexible and efficient use of trusted execution – especially for applications demanding multiple enclaves. EActors disentangles the interaction with enclaves and, among them, from costly execution mode transitions. It features lightweight fine-grained parallelism based on the concept of actors, thereby avoiding costly SGX SDK provided synchronisation constructs. Finally, EActors offers a high degree of freedom to execute actors, either untrusted or trusted, depending on security requirements and performance demands.

Please note that this talk was originally scheduled to begin at the later time of 12:25

Intended as a introduction to Nerves, the IoT platform for the BEAM, this talk is a journey through the land of library ecosystems, device drivers and pixel manipulators, in search for the holy grail: a stable and maintainable IoT device.

The Nerves project (https://nerves-project.org/) is a framework for building IoT devices with Elixir. In this talk I will explain how a Nerves project is structured and then move on to show and demonstrate one of the projects that I did with it, focussing on the development experience and the state of the Nerves ecosystem.

Health Data is traditionally held and processed in large and complex mazes of hospital information systems. The market is dominated by vendors offering monolithic and proprietary software due to the critical nature of the supported processes and - in some cases - due to legal requirements. The “digital transformation”, “big data” and “artificial intelligence” are some of the hypes that demand for improved exchange of health care data in routine health care and medical research alike. Exchanging data at these scales requires open data formats and protocols, multi-stakeholder collaboration, and agile development. As an example, the de-facto messaging standard organization in medicine HL7 noticed a much more positive response from the medical research community regarding their openly available FHIR specification in comparison to the for-members-only and XML-based HL7v3 messaging standard specification. While some past (or rather: ongoing) projects on a national scale in the German health care system have tried centralized, top-down specification and development approaches, more recent infrastructure projects embrace the competitive collaboration of a decentralized, bottom-up strategy. As a result, importance and recognition of free software increase in the Medical Informatics research community.

In a series of rapid spotlights, we present tools and frameworks that serve as cornerstones for the envisioned health data exchange infrastructure, including: Organization and collaboration tools; data extraction from clinical source systems, data transformation and de-identification; data management systems and long-term archival using persistent globally-unique object identifiers; federated queries across multiple independently managed clinical data integration centers.

We aim to encourage participants to actively add tools and frameworks within the discussion and highlight their experiences and challenges with using open systems in Medical Informatics.

Speaker bio:

Marcel Parciak and Markus Suhr are research associates at the University Medical Center Göttingen (UMG), Department of Medical Informatics.

Marcel graduated the Göttingen Medical Informatics Master program in 2018 and is currently a PhD student, investigating the challenges of data provenance in medical research. He is a system architect for the HiGHmed project that facilitates innovative federated infrastructure for cross-organisational secondary use of health care data.

Markus started his professional career in 2014 as a system administrator and software developer at the UMG hospital data center. He joined the Department of Medical Informatics in 2017, becoming lead developer for a free software project and working on multiple biomedical research projects. Since 2019 he is technical lead for the newly created Medical Data Integration Center. Markus is a supporter of the Free Software Foundation Europe.

mesa3d.org is stuck on web 1.0 technology, but let's see what we can do about it.

This is a Birds-Of-a-Feather session, which starts off with a short presentation as an introduction about the current state of affairs.

This talk describes how performance aspects of a big Air Traffic Flow Management mission critical application are tracked from development to operations.

Tracking performance is needed when new functionality is added, to balance the additional services versus the resource increase needed. Measuring and tracking performance is also critical to ensure a new release can cope with the current or expected load.

We will discuss various aspects such as which tools and techniques are used for performance tracking and measurements, what are the traps and pitfalls encountered for these activities. The application in question is using Ada, but most of the items discussed are not particularly Ada related.

Internet of Things (IoT) devices are part of the future we were promised. Armed with our mobile devices, we can control everything from our cars to our toasters to the doors of our homes. Along with convenience, IoT devices bring us ethical quandaries, as designers and users. We need to consider the ethical implicates of the technologies we are building and ask ourselves not just about the ways they are being used, for both good and evil, but the potential use cases we might encounter in the future.

IoT devices are becoming increasingly prevalent in our lives -- even my water filter is wifi enabled. In this session, we'll be looking at two case studies of how one might interact with IoT devices, and then consider the ethical implications of these devices, focused on the social impacts they can have on an individual or a society. While we will focus on smart doorbells and smart locks and situations in which installing these could significantly impact quality of life, we will touch on other common IoT devices.

With Nextcloud you can sync, share and collaborate on data, but you don't need to put your photos, calendars or chat logs on an American server. Nope, Nextcloud is self-hosted and 100% open source! Thanks to hundreds of apps, Nextcloud can do a lot and in this talk, I will highlight some cool things.

Consider this a follow-up from my talk about 200 things Nextcloud can do last year! An update on what's new and some cool new stuff. What, what is Nextcloud? Let's see. A private cloud is one way to put it, though that's a contradiction of course. It is a way to share your data, sync your files, communicate and collaborate with others - without giving your data to GAFAM! Keep it on your own server, or something close (like a local hosting provider or data center). Nextcloud is a PHP app that does all that, and more! Easy to use, secure (really) and fully open source of course.

More and more traditionally processes in our society now incorporate, and are influenced by software.

Processes that decide for example: Who will be able to go to which university? Who will be invited for a job interview? How long does someone have to go to jail?

Therefore many organisation which work for people's rights are now confronted with the problems proprietary software creates for society. The pupils associations, the unions, human right organisations, or environmental organisations -- all of them need to understand how software works to do their work in our society.

To continue to fulfil their role, civil society needs to understand how processes are implemented in software, they need to be able to challenge the assumptions, the values, and the way programmers designed them, and have a better understanding how you could change them.

In short: in a world in which more and more of our live is controlled by software, civil society organisations need us as Free Software hackers to support them doing their job.

Members of the closely linked Sourcehut and aerc communities meet up to put faces to names and discuss the present and future of both projects, and to collect stickers.

Sourcehut is a free/libre project hosting platform with sophisticated git hosting, mailing lists, continuous integration, and more. We'll be discussing the remaining tasks for the alpha, planning and seeking feedback for the beta, and showing off cool stuff added in the past year.

aerc is a FOSS email client for your terminal designed especially for software developers which integrates nicely into the mailing list workflow endorsed by Sourcehut. Early in its development, you'll have a chance to discuss what you'd like to see in your dream email client and speculate wildly on the lofty goals it aims to achieve.

The Linux kernel networking capabilities have been undergoing major changes over the last years. At the heart of the performance gain, eBPF (extended Berkeley Packet Filter) and XDP (eXpress Data Path) have brought new possibilities in terms of tracing and network packet processing. eBPF is a trendy topic in the Linux world, and today it needs little introduction among the SDN and NFV community. But the technology is still under heavy development, bringing new features, more flexibility, and better performance to the users. This presentation is an update on the latest evolutions in the eBPF world!

Many of those changes occur directly inside the eBPF subsystem architecture. New program types are being added. Early constraints such as the maximal number of instructions for programs, or the unavailability of loops, are changing. The internals are improved with support for debug information (BTF) or 32-bit instructions. And many new mechanisms are implemented, such as global data support, the “BPF trampoline”, batched map operations, dynamic linking. Let's review all the latest trends in eBPF kernel development!

But beyond kernel code, eBPF has grown as a full ecosystem, with a variety of tools used to work with it, or to build upon it. Bpftool, a reference utility to manage eBPF programs, keeps evolving. The networking projects using eBPF keep growing in number (e.g. Katran, Suricata, Sysdig, Hubble, Libkefir) or in features (e.g. Cilium). Let's review (briefly) some of those projects that assert eBPF as one of the essential fast dataplane solutions in the Linux world.

Have you ever needed to get some additional write throughput from MySQL ? If yes, you probably found that setting sync_binlog to 0 (and trx_commit to 2) gives you an extra performance boost. As all such easy optimisation, it comes at a cost. This talk explains how this tuning works, presents its consequences and makes recommendations to avoid them. This will bring us to the details of how MySQL commits transactions and how those are replicated to slaves. Come to this talk to learn how to get the benefit of this tuning the right way and to learn some replication internals.

GCC is the default toolchain to build C/C++ packages in Fedora. Meanwhile OpenMandrivia already builds most of its package with the LLVM toolchain, the Debian archive is regularly rebuilt with with a recent verion of clang... So could we try that for Fedora?

This talk describes an on-going effort to achieve that goal while keeping the same compiler feature set as GCC.

Subtopics of the talk include:

• Creating a clang-based buildroot and use it to rebuild the fedora user-land (and more?)
• Support for missing security features such as -fstack-clash-protection or -DFORTIFYSOURCE=2
• Add missing features for the annobin tool within lld
• Python3 compatibity
• Package size

Of course, encrypting DNS is necessary for privacy and security, like for every other Internet protocol. That's why DoT and DoH deployment is very important, so that users could safely go to a resolver they trust. Now, it is time to assert the technical compliance and performance of these trusted resolvers. We will talk about the things that could and should be tested against DoT and DoH servers and how to implement it. We will then discuss performance measurements, specially with the opportunities brought by parallelism (both in DoT and DoH) and the challenges they create for measurements. This talk will be inspired by the development of a tool which is, at this stage, in a very alpha state.

This talk will give quick overview of Bareos and the new features in Bareos 19.2.

This talk will give quick overview of Bareos and the new features in Bareos 19.2.

RISC-V processors have gained acceptance across a wide range of computing domains, from IoT to embedded/mobile class and even in server-class processing systems. In processing systems ranging from connected cars and autonomous vehicles, to those on-board satellites and spacecrafts, these processors are targeted to function in safety-critical systems, where Reliability, Availability and Serviceability (RAS)-based considerations are of paramount importance. Along with potential system vulnerabilities caused primarily due to random errors, these processors may also be sensitive to targeted errors, possibly from malicious entities, which raises serious concerns regarding the security and safety of the processing system. Consequently, such systems necessitate the incorporation of RAS-based considerations right from an early stage of processor design.

While the hardware and software ecosystem around RISC-V has been steadily maturing, there have, however, been limited developments in early stage reliability-aware design and verification. The Early-stage Reliability And Security Estimation for RISC-V (ERASER) tool attempts to address this shortcoming. It consists of an open source framework aimed at providing directions to incorporate such reliability and security features at an early, pre-silicon stage of design. These features may include what kind of protection to be applied and which components within the processor should they be applied to. The proposed infrastructure comprises of an open source toolchain for early stage modeling of latch vulnerability in a RISC-V core (SERMiner [1]), a tool for automated generation of stress marks that maximize the likelihood of a transient-failure induced error (Microprobe (RISC-V) [2]), and verification by means of statistical and/or targeted fault injection (Chiffre [3]). While the infrastructure is targeted towards any core that uses the RISC-V ISA, the repository provides an end-to-end flow for the Rocket core [4].

ERASER thus evaluates “RAS-readiness”, or the effectiveness of protection techniques in processor design such that processor vulnerability in terms of Failures-In-time (FIT) rate is minimized, for a specified power/performance overhead. FIT rate is defined as the number of failures in one billion hours of operation and is a standard vulnerability metric used in industry.

ERASER is an open source tool available for download at https://github.com/IBM/eraser. The tool currently supports analysis of all latches in the design across a single Rocket core and the generation of stressmarks that can be used to evaluate the vulnerability of these latches. In addition to radiation-induced soft errors, we plan to extend ERASER to also model errors due to voltage noise, thermal and aging-induced failures, both in memory and logic, and generate representative stressmarks.

ERASER is an initial effort to devise a comprehensive methodology for RAS analysis, particularly for open-source hardware, with the hope that it spurs further research and development into reliability-aware design both in industry and academia.

References:

1. K. Swaminathan, R. Bertran, H. Jacobson, P. Kudva, P. Bose, ‘Generation of Stressmarks for Early-stage Soft-error Modeling’, International Conference on Dependable Systems and Networks (DSN) 2019

2. S. Eldridge R. Bertran, A. Buyuktosunoglu, P. Bose, ‘MicroProbe: An Open Source Microbenchmark Generator, ported to the RISC-V ISA, the 7th RISC-V workshop, 2017

3. S. Eldridge, A. Buyuktosunoglu and P. Bose, ‘Chiffre A Configurable Hardware Fault Injection Framework for RISC-V Systems’ 2nd Workshop on Computer Architecture Research with RISC-V (CARRV), 2018

4. Krste Asanović, Rimas Avižienis, Jonathan Bachrach, Scott Beamer, David Biancolin, Christopher Celio, Henry Cook, Palmer Dabbelt, John Hauser, Adam Izraelevitz, Sagar Karandikar, Benjamin Keller, Donggyu Kim, John Koenig, Yunsup Lee, Eric Love, Martin Maas, Albert Magyar, Howard Mao, Miquel Moreto, Albert Ou, David Patterson, Brian Richards, Colin Schmidt, Stephen Twigg, Huy Vo, and Andrew Waterman, The Rocket Chip Generator, Technical Report UCB/EECS-2016-17, EECS Department, University of California, Berkeley, April 2016

The attached figure shows a representative flow for the RAS estimation methodology. An initial characterization of all instructions in the RISC-V ISA is carried out via RTL simulation using an existing core model (eg. the Rocket core). The simulation is configured to generate VCD (Value- Change Dump) files for every single instruction testcase. The SERMiner tool parses these VCD files to determine latch activities across the core, aggregated at a macro (or RTL module) level. Based on these per-instruction latch activities, SERMiner outputs an instruction sequence, which forms the basis of the SER stressmark to be generated by Microprobe (RISC-V). Microprobe (RISC-V) is a microbenchmark generation tool that is capable of generating microbenchmarks geared towards specific architecture and micro-architecture level characterization. One of its key applications is in the generation of stressmarks, or viruses, that target various worst-case corners of processor operation. These stressmarks may be targeted at maximizing power, voltage noise, temperature, or soft-error vulnerability as in case of this tool. The generated stressmark is then used to generate a list of latches that show a high residency and hence a high SER vulnerability. These latches are the focus of fault injection-based validation experiments using the Chiffre tool. Chiffre provides a framework for automatically instrumenting a hardware design with run-time configurable fault injectors. The vulnerable latches obtained from running the generated stressmarks through the Rocket core model, and then through SERMiner, are earmarked for targeted fault injection experiments using Chiffre. The objective of these experiments is to further prune the list of vulnerable latches by eliminating those that are derated, that is, they do not affect the overall output even when a fault is injected in them. Focusing any and all protection strategies on this final list of latches would maximize RAS coverage across the entire core.

Ongoing and future work:

ERASER currently only supports analysis of all latches in the design across a single Rocket core and the generated stressmarks can be used to evaluate the vulnerability of these latches. Most on-chip memory structures such as register files and caches, are equipped with parity/ECC protection and are as such protected against most radiation-induced soft errors. However, they are still vulnerable to supply voltage noise, thermal and aging-induced failures, and other hard or permanent errors. We plan to extend ERASER to model such errors, both in memory and logic, and generate stressmarks representative of worst-case thermal emergencies and voltage noise, in addition to soft errors.

Abstract: Direct buffers are, to date, the only way to access foreign, off-heap memory. Despite their success, direct buffers suffer from some limitations --- stateful-ness, lack of addressing space, non-deterministic deallocation to name a few --- which makes them a less-than-ideal choice under certain workloads. In this talk we paint the path to the future: a safe, supported and efficient foreign memory access API for Java. By providing a more targeted solution to the problem of accessing foreign memory, not only developers will be freed by the above limitations - but they will also enjoy improved performances, as the new API is designed from the ground-up with JIT optimizations in mind - and all without sacrificing memory access safety.

OpenOlitor is a SaaS open-source tool facilitating the organization and management of CSAs (Community Supported Agriculture) communities. This tool covers a large spectrum of functionalities needed for CSAs such as member management, emailing, invoicing, share planning and delivery, absence scheduling, etc. This software is organized and monitored by an international community that promotes the tool, helps operate it and support the interested communities. In order to promote the sustainability of the tool and this international community an organization based on CSS (Community Supported Software) has been proposed.

1 - Introduction

The Community Supported Agriculture movement has grown considerably the last few years proposing a new model of food production and distribution. CSA initiatives connect producers and consumers directly. The consumer receives a basket of locally produced, fresh products on a subscription basis. Risk is shared among all participants of the community, independently of being a consumer or producer. The growing popularity of the CSA model has lead to larger sized communities. Consequently, the management effort for this organizations is becoming unaffordable on a volunteer basis. In such conditions a software helping with the redundant tasks, and connecting all participants of these communities, can be particularly supportive. The main motivations for the creation of OpenOlitor (OO) are to attend to the growing popularity of the CSA model with the aim of keeping the model economically viable and sustainable by reducing management task time investment through building software which facilitates easy organization.

2 - OpenOlitor

OpenOlitor is a web-based, open source tool facilitating the organization and management of CSAs (Community Supported Agriculture) communities. This tool is composed of two different access points:

• The participant console: any member holding one or more subscriptions, has an access to this console. This displays basic information about next subscription, products that will be delivered, absences, etc.
• The admin console: only defined administrators can access this console. All the community management tools are available from this portal. Please, refer to the next subsection for a detailed list of functionalities.

2.1 - Functionalities OpenOlitor (OO) covers the main functionalities CSAs need:

• Members and people management: OO allows the management of all the current members, historical members or interested individuals. A member can be composed of multiple people. Basic information is required for every member, such us contact information, details of payment, etc.
• Subscription types: A member receives one or several baskets (also called shares) of products periodically. Different types of baskets are allowed. Types are defined by the community and may include delivery type, pickup or frequency, for example;
• Subscription management: A member can be subscribed to one or several subscriptions;
• Delivery management: Deliveries are prepared by the administrators. As a result shares will be created where subscriptions, delivery types, prices are calculated automatically;
• Billing: Automatic invoices are created for every member;
• Participatory task management: Some CSAs require a certain community work hours in order to be part of the community. OO can track this information and publish available tasks to the members;
• Absence management: Members can feed the system their pickup absences that would be taken into account automatically;
• Product/producer management: A CSA can have one or multiple producers and each producer can have one or more products. This information can be used for billing purposes or basket shaping purposes;
• Emailing: an integrated emailing functionality is provided for some of the modules already explained. This allows administrators to easily mail information to the participants, such as invoices, general announcements, etc.
• Payment management: SEPA and ESR payment work-flows are integrated;

2.2 - Basic architecture

The OO platform is divided in back-end and front-end:

• Front-end: The front-end is a Web-Application (AngularJS) accessible from any browser. A front-end application is dedicated to every CSA. The code is accessible publicly in Github:
• Administration portal (https://github.com/OpenOlitor/openolitor-client-admin)

• Members portal (https://github.com/OpenOlitor/openolitor-client-kundenportal)

• Back-end: Programmed in Scala using the Akka library for concurrency and distributed systems. A single server can be shared among multiple initiatives. The code is published on Github. Even if the server can be shared among multiple organizations, a MariaDB database is created per initiative. This model guaranties data ownership and privacy. The code is accessible publicly in Github: https://github.com/OpenOlitor/openolitor-server

3 - Current numbers

Currently, seven CSAs are using OpenOlitor to support their organizations in a production environment. Three more CSAs are in the process of transitioning to this digital tool. A few numbers extracted from the last two years and a half to put into perspective the work volume facilitated by OO:

• +/- 100'000 baskets already delivered
• +/- 3'000 managed deliveries, average 33 baskets per delivery
• +/- 3'400 subscriptions
• +/- 2'100 subscribers

4 - Hosting and Operations

As shown by the architecture, the database and the front-end are CSA specific but the server can be used by multiple organizations. We promote the idea of hosting communities where a group of CSAs share the costs for the hosting and the effort for the operational work. This model is currently in use for all CSAs using the software.

5 - Sustainability model

As a financial model we promote the idea of Community Supported Software (CSS). This model is directly inspired by the CSA model where all participants share the risk and responsibility of the food production. Transferring this idea to software, an organization working with OO is invited to participate on the maintenance, operation, support and further development of the software. A fixed financial contribution is defined per basket delivered. All contributions are shared with all projects using the tool. Using this model, the effort and risk is equally shared, independently of the size of the CSA.

6 - Legal organizations supporting OO

This software is organized and monitored by an international community that promotes this tool:

OpenOlitor International: Non legally formed organization composed by around 10 members from different European countries. This organization is in charge of the vision and principles of all interactions with the software. This group meets periodically to decide OO main features and how to evolve the platform. Everyone interested in OO is invited to join; OpenOlitor association: non-profit organization based in Switzerland. Legal body managing the founds received by initiatives and public sources; OpenOlitor operations association: Organization in charge for the operation and support of the Swiss based CSAs; Sunu: a German based organization that promotes digitalization for CSAs. They are promoting the ue of OO as well as the operational and support for German CSAs.

Kube-proxy enables access to Kubernetes services (virtual IPs backed by pods) by configuring client-side load-balancing on nodes. The first implementation relied on a userspace proxy which was not very performant. The second implementation used iptables and is still the one used in most Kubernetes clusters. Recently, the community introduced an alternative based on IPVS. This talk will start with a description of the different modes and how they work. It will then focus on the IPVS implementation, the improvements it brings, the issues we encountered and how we fixed them as well as the remaining challenges and how they could be addressed. Finally, the talk will present alternative solutions based on eBPF such as Cilium.

CadQuery (CQ) [1] is a Python library for building of parametric 3D models. The overarching design goal is to be extremely fluent and as close as possible to the design intent. CQ is based on the open source CAD kernel from OpenCascade and therefor offers industry standard B-Rep modeling capabilities and allows exporting to lossless formats such as STEP as well as lossy ones such as STL. Originally it used Python bindings based on FreeCAD [2] but recently we switched to PythonOCC [3] to be more flexible and have full access to the underlying CAD kernel capabilities. In the talk I will summarize the current status of the CQ project, show some interesting usage examples and discuss newly implemented features. Furthermore I will elaborate on the future plans of the core development team and touch on some of the challenges of maintaining a project such as CQ. I will also present a fairly new addition to the CQ ecosystem – CQ-editor [3]. It is a Python/PyQt5 based lightweight cross-platform GUI editor that allows to quickly develop and preview CQ 3D models. It also offers graphical debugging and CQ stack introspection capabilities which dramatically lowers the entry barrier for trying out and using CQ.

References

[1] https://github.com/CadQuery/cadquery [2] https://www.freecadweb.org [3] https://github.com/tpaviot/pythonocc-core [4] https://github.com/CadQuery/CQ-editor

Overview of SUSE's Linux kernel testing in OpenQA, how we keep track of known issues, explore test results and other features of JDP. The JDP framework is written in Julia, uses Redis as a distributed data cache and Jupyter for interactive reporting. OpenQA is a large application used for testing operating systems and displaying the results.

How does one manage and document change in Python projects, be that new features or deprecation or removal of a feature? Let's explore some of the tools a Python developer can keep in their toolbox for just this purpose.

Software rarely stands still (unless it's TeX). Things are added, things are removed, things break and are then hopefully fixed. Managing this, from both the developer and user perspective, can be tough. In this talk we examine and compare some of the tools that one can use to make this process easier, such as 'debtcollector', 'reno' and 'towncrier', and contrast these with alternatives used in other projects. This talk would mainly be of interest to developers of open source libraries, though the same tooling can be used for any Python library or application that wishes to maintain stable interfaces and/or document changes in their product.

The Collabora Online code-base can bring the power of LibreOffice into an iframe inside your web app. Come and hear how this works, how to integrate secure, collaborative document editing with your software, and about all the latest greatest work going on there.

Collabora Online uses a WOPI-like protocol, and it is rather simple to integrate. Come hear about the total of three REST methods you need for a simple integration, as well as the wealth of options to control how collaboration works.

Hear about some of our integrations into Nextcloud, Kolab, Mattermost, Moodle, ownCloud, and many more.

See the internals of Collabora Online, and how you can get involved with building, debugging, and developing it, and checkout some of the new features for Mobile and PC browser that we've been working on to make life better for our users.

RISC-V application, OS, and firmware development has been slowed by the lack of "real hardware" available for developers to work with. With the rise of FPGAs in the cloud and the recent release of the OpenPiton+Ariane manycore platform on Amazon's F1 cloud FPGA platform, we propose using 1-12 core OpenPiton+Ariane processors emulated on F1 to develop RISC-V software and firmware. In this talk, we will give an accelerated tutorial on how to get started with OpenPiton+Ariane, the spec-compliant RISC-V platform it offers, and how the firmware and OS can be modified and run on top. We will show a number of applications built and running for our present Debian distribution and the software development environment that this offers. We will then highlight how hardware and software can be co-designed on OpenPiton+Ariane with the ability to recompile the hardware underlying the cloud FPGA image and deploy it for use by others. This platform is serving as a basis for software and hardware development for the DECADES project, a project investigating heterogenous manycore and hardware accelerator based designs with support for orchestrated data movement.

RISC-V Software and Firmware Development in the Cloud Using OpenPiton+Ariane on Amazon F1

RISC-V application, OS, and firmware development has been slowed by the lack of "real hardware" available for developers to work with. With the rise of FPGAs in the cloud and the recent release of the OpenPiton+Ariane manycore platform on Amazon's F1 cloud FPGA platform, we propose using 1-12 core OpenPiton+Ariane processors emulated on F1 to develop RISC-V software and firmware. In this talk, we will give an accelerated tutorial on how to get started with OpenPiton+Ariane, the spec-compliant RISC-V platform it offers, and how the firmware and OS can be modified and run on top. We will show a number of applications built and running for our present Debian distribution and the software development environment that this offers. We will then highlight how hardware and software can be co-designed on OpenPiton+Ariane with the ability to recompile the hardware underlying the cloud FPGA image and deploy it for use by others. This platform is serving as a basis for software and hardware development for the DECADES project, a project investigating heterogenous manycore and hardware accelerator based designs with support for orchestrated data movement.

http://openpiton.org https://openpiton-blog.princeton.edu/2019/10/bringing-openpiton-to-amazon-ec2-f1-fpgas/

OpenPiton+Ariane contributors include: Jonathan Balkind, Grigory Chirkov, Yaosheng Fu, Adi Fuchs, Fei Gao, Alexey Lavrov, Ang Li, Xiaohua Liang, Katie Lim, Matthew Matl, Michael McKeown, Tri Nguyen, Samuel Payne, Michael Schaffner, Mohammad Shahrad, Jinzheng Tu, Florian Zaruba, Yanqi Zhou, Georgios Tziantzioulis, Luca Benini, David Wentzlaff

DECADES is a large collaboration from three academic groups: Margaret Martonosi (PI Princeton), David Wentzlaff (PI Princeton), Luca Carloni (PI Columbia) with students/researchers: Jonathan Balkind, Ting-Jung Chang, Fei Gao, Davide Giri, Paul Jackson, Paolo Mantovani, Luwa Matthews, Aninda Manocha, Tyler Sorensen, Jinzheng Tu, Esin Türeci, Georgios Tziantzioulis, and Marcelo Orenes Vera. In addition to the submission author, portions of the talk may be offered by others in the collaboration.

Bosch has open sourced a true zero-copy middleware for inter-process communication on modern robotics and vehicle computers. The shared memory based solution is compatible with Linux/QNX and achieves data independent communication in constant time without serializing data. We would like to present our recent development towards an open-source release and demonstrate our performance and timing benchmarks on a privately developed embedded robot.

On FOSDEM 2018 Bosch presented OpenADx, an initiative to collaborate and accelerate the development of automated driving with the open source community. On FOSDEM 2020 we would like to present the first project under the OpenADx umbrella called Eclipse iceoryx TM. Over the course of its company history, Bosch could establish a solid understanding of the needs and requirements of the automotive domain in terms of liability, reliability, safety and determinism. In a time where highly automated driving hits the road, these aspects become more and more important. An automated driving kit is a networked system that processes a sensor data stream in the range of GBytes/s. This naturally arises the need of an efficient and lightweight data transfer mechanism. Our group at Bosch has its main focus on tackling exactly this challenge. In order to approach the problem of distributing the high frequency, high throughput data streams on fusion and planning computers, we’ve developed a solution which can guarantee a time constant communication channel independently of the size of data to be transported. Our approach is based on shared memory which allows for transparently connecting the same range of memory between multiple processes and thus enables a true zero-copy communication. Given the nature of shared memory, an efficient data transport can thus be realized solely by passing pointers to memory addresses from publishers to subscribers. iceoryx is fully compatible with the ROS2 and Adaptive AUTOSAR APIs and can be used as an implementation for both.

The talk with give an introduction of Ansible collections and will talk about collection structure and how to deliver Ansible content with collections

The agenda for this talk will be: 1) What are Ansible collections? 2) Why Ansible collections are required? 3) Deep dive with collections (init, create, build, publish) 4) Demo

Contemporary sciences are heavily data-driven, but today's data management technologies and sharing practices fall at least a decade behind software ecosystem counterparts. Merely providing file access is insufficient for a simple reason: data are not static. Data often (and should!) continue to evolve; file formats can change, bugs will be fixed, new data are added, and derived data needs to be integrated. While (distributed) version control systems are a de-facto standard for open source software development, a similar level of tooling and culture is not present in the open data community.

The lecture introduces DataLad, a software that aims to address this problem by providing a feature-rich API (command line and Python) for joint management of all digital objects of science: source code, data artifacts (as much as their derivatives), and essential utilities, such as container images of employed computational environments. A DataLad dataset represents a comprehensive and actionable unit that can be used privately, or be published on today's cyberinfrastructure (GitLab, GitHub, Figshare, S3, Google Drive, etc.) to facilitate large and small-scale collaborations.

In addition to essential version control tasks, DataLad aids data discovery by supporting a plurality of evolving metadata description standards. Moreover, Datalad is able to capture data provenance information in a way that enables programmatic re-execution of computations, and as such provides a key feature for the implementation of reproducible science. DataLad is extensible and customizable to fine tune its functionality to specific domains (e.g., field of science or organizational requirements).

DataLad is built on a few key principles:

1. DataLad only knows about two things: Datasets and files. A DataLad dataset is a collection of files in folders. And a file is the smallest unit any dataset can contain. At its core, DataLad is a completely domain-agnostic, general-purpose tool to manage data.

2. A dataset is a Git repository. A dataset is a Git repository. All features of the version control system Git also apply to everything managed by DataLad.

3. A DataLad dataset can take care of managing and version controlling arbitrarily large data. To do this, it has an optional annex for (large) file content: Thanks to this annex, DataLad can track files that are TBs in size (something that Git could not do, and that allows you to restore previous versions of data, transform and work with it while capturing all provenance, or share it with whomever you want). At the same time, DataLad does all of the magic necessary to get this important feature to work quietly in the background. The annex is set-up automatically, and the tool git-annex manages it all underneath the hood.

4. DataLad follows the social principle to minimize custom procedures and data structures. DataLad will not transform your files into something that only DataLad or a specialized tool can read. A PDF file (or any other type of file) stays a PDF file (or whatever other type of file it was) whether it is managed by DataLad or not. This guarantees that users will not loose data or data access if DataLad would vanish from their system, or even when DataLad would vanish from the face of Earth. Using DataLad thus does not require or generate data structures that can only be used or read with DataLad -- DataLad does not tie you down, it liberates you.

5. Furthermore, DataLad is developed for complete decentralization. There is no required central server or service necessary to use DataLad. In this way, no central infrastructure needs to be maintained (or paid for) -- your own laptop is the perfect place to live for your DataLad project, as is your institutions webserver, or any other common computational infrastructure you might be using.

6. Simultaneously, though, DataLad aims to maximize the (re-)use of existing 3rd-party data resources and infrastructure. Users can use existing central infrastructure should they want to. DataLad works with any infrastructure from GitHub to Dropbox, Figshare, or institutional repositories, enabling users to harvest all of the advantages of their preferred infrastructure without tying anyone down to central services.

Lumen is an alternative compiler, interpreter and runtime to the BEAM designed for WebAssembly. Lumen allows Erlang and Elixir to run in the browser.

The Lumen project is a reimplementation of the BEAM in Rust. Using Rust, Lumen is able to leverage the cutting edge tools of the Rust WASM ecosystem. Compiling Elixir and Erlang from source to LLVM IR, the Lumen compiler is able to do whole program optimizations allowing for dead-code elimination of parts of the user application, OTP, and the runtime itself. Eliminating the dead code makes shipping OTP size-competitive with JavaScript frameworks, while retaining the benefits of thousands of concurrent processes and supervision trees.

Linux Syscalls can be used as an entrypoint to do security analysis on Linux. However reading and processing every system call in userspace creates a very unique set of challenges. In this talk we are going to see exactly what those challenges are and how we solved them in the Falco project.

One of the ways to have broad visibility into our systems, when doing security analysis is to go and ask our questions directly to the Linux kernel. For this purpose, at a very foundational level, in every Linux system we find the syscalls interface. It’s certain that every user space process goes through this part of the kernel.

Starting with this assumption, the immediate conclusion is that we can just go and ask the syscalls “Yo syscalls! What’s happening in my system?”. While this reasoning might seem very simple, reading and processing every single syscall in userspace can result in a set of very unique challenges to this domain.

In this talk we are going to see exactly what those challenges are and how we solved them in the Falco project.

Part of the solution for Falco is to have two alternative drivers, a Kernel module and an eBPF driver talking to userspace using a Ring buffer but you have to come to this talk to hear the rest!

Michal Rostecki is a Software Engineer working at SUSE. He's working on Cilium, both upstream and on integrating it with openSUSE Kubic Project and SUSE CaaS Platform.

Swaminathan Vasudevan is a Software Engineer working at SUSE. Worked on Neutron Networking Upstream and currently migrating to Cilium and openSUSE Kubic Project and SUSE CaaS Platform.

Cilium is an open source project which provides networking, security and load balancing for application services that are deployed using Linux container technologies by using the native eBPF technology in the Linux kernel. In this presentation we would talk about: - The evolution of the BPF filters and will explain the advantages of eBPF Filters and its use cases today in Linux especially on how Cilium networking utilizes the eBPF Filters to secure the Kubernetes workload with increased performance when compared to legacy iptables. - How Cilium uses SOCKMAP for layer 7 policy enforcement - How Cilium integrates with Istio and handles L7 Network Policies with Envoy Proxies. - The new features since the last release such as running Kubernetes cluster without kube-proxy, providing clusterwide NetworkPolicies, providing fully distributed networking and security observability platform for cloud native workloads etc.

Last year Khronos released OpenXR, an open API for using XR hardware. In this talk we will look at the practical side of creating VR applications and games with OpenXR.

Since the Oculus VR development kit started a resurgence of consumer VR, game development has largely been relegated to proprietary VR APIs and runtimes. Khronos reacted by creating an open API for using XR hardware and released it OpenXR 1.0 in July 2019. Collabora implemented the OpenXR API in a runtime nicknamed Monado, built on open source VR hardware drivers. With these building blocks VR applications can now use standardized APIs and run on a FOSS stack.

In this talk, Christoph will give an overview of the feature set of the OpenXR API and the practical side of creating VR applications and games with OpenXR. We will look at low level code using the OpenXR API directly as well as an OpenXR plugin for the godot engine.

BIND 9 consists of a huge and old codebase. In this talk, I would like you to show all the available tools that we use on regular basis to improve, refactor and make the BIND 9 code safer. I'll show the examples of various Google/LLVM Sanitizers, cppcheck, LLVM scan-build and semantic patching using coccinelle.

This talk analyzes the vulnerability space arising in Trusted Execution Environments (TEEs) when interfacing a trusted enclave application with untrusted, potentially malicious code. Considerable research and industry effort has gone into developing TEE runtime libraries with the purpose of transparently shielding enclave application code from an adversarial environment. However, our analysis reveals that shielding requirements are generally not well-understood in real-world TEE runtime implementations. We expose several sanitization vulnerabilities at the level of the Application Binary Interface (ABI) and the Application Programming Interface (API) that can lead to exploitable memory safety and side-channel vulnerabilities in the compiled enclave. Mitigation of these vulnerabilities is not as simple as ensuring that pointers are outside enclave memory. In fact, we demonstrate that state-of-the-art mitigation techniques such as Intel’s edger8r, Microsoft’s “deep copy marshalling”, or even memory-safe languages like Rust fail to fully eliminate this attack surface. Our analysis reveals 35 enclave interface sanitization vulnerabilities in 8 major open-source shielding frameworks for Intel SGX, RISC-V, and Sancus TEEs. We practically exploit these vulnerabilities in several attack scenarios to leak secret keys from the enclave or enable remote code reuse. We have responsibly disclosed our findings, leading to 5 designated CVE records and numerous security patches in the vulnerable open-source projects, including the Intel SGX-SDK, Microsoft Open Enclave, Google Asylo, and the Rust compiler.

Please note that this talk was originally scheduled to begin at the later time of 13:00

MariaDB/MySQL/Percona Server provide some features in this space, but currently there isn't one product that covers all the needs (at least not available as FOSS). This talk will provide an overview of Data-at-Rest-Encryption features in MySQL, MariaDB and Percona Server for MySQL, their availability across versions, and status (experimental/GA).

Open Food Facts is a collaborative and crowdsourced database of food products from the whole planet, licensed under the Open Database License (ODBL). It was launched in 2012, and today it is powered by 27000 contributors who have collected data and images for over 1 million products in 178 countries (and growing strong…) This is the opportunity to learn more about Open Food Facts, and the latest developments of the project.

Scan a product using your phone, take a picture, and you're already part of the Open Food Facts revolution !

In this talk we'll show how Open Food Facts leverages open source technologies such as Perl, Python, TensorFlow, MongoDB, Java, Swift, React and Flutter as well as the great power of communities to open data of public interest for health & science, as well as unforeseen applications in your daily life.

We will also introduce you to Open Beauty Facts, for freeing your cosmetic cupboard: shampoos, toothpastes, lipsticks, etc.

How does it work? Using our Android or iPhone app, you can easily scan the barcode of products from your home or local store. You can either check them out (thanks to the decoding and comparison tools) or contribute pictures of their labels, assisted by our label-reading AI. The same can also be done from the website, where additional tools are available to fill in the product details from the labels, navigate or vizualise the database based in various ways, or access the APIs and raw data to make your own tools and analysis.

Open Food Facts is developed and managed by a community of open source, open data and food enthusiasts and is organised as a non-profit association. All its creations are open: - the collected data is published as Open Data, - the software running the server(s) is open source and reusable (it was also used to create the Open Beauty Facts database), - the mobile applications are open source as well.

Backing up virtual machines in larger environments is usually not a simple task. With the new oVirt-Plugin for Bareos you can now easily backup and restore your oVirt virtual machines. This talk will give a short introduction how Bareos backs up oVirt virtual machines.

I will talk about KiCad's role in the Open Hardware design movement and how it is remarkably similar to the early days of the Free, Libre, Open Source Software (FLOSS) movement and what it means for the future of Open Hardware.

One of the challenges of doing software network applications is observing the inputs, outputs, and what the application is doing with them. Linux provides a rich tool set with eBPF but integrating this into a DPDK application is challenging. The DPDK libraries for capturing is incomplete which leads to lots of time debugging the tools. This talk addresses these issues, recommends solutions and proposes enhancements to make developers live easier.

The DPDK provides a limited form of packet capture, but it only works on a single interface with no filtering and inaccurate timestamps. I go over what packet capture does now, how it can be improved, and how it can be integrated with other tracing.

This talk is an extension of the talk (based on community feedback) given in 2019 at the DPDK userspace summit.

We would like to present and overlay technique for RISCV, develop by WD and open sourced. This FW feature acts as a software “paging” manager. It is to be threaded with the Real-Time code and to the toolchain. Cacheable Overlay Manager RISC-V (ComRV), a technique which fits limited memory embedded devices (as IoT’s), and does not need any HW support.

The difficult task to checkpoint and restore a process is used in many container runtimes to implement container live migration. This talk will give details how CRIU is able to checkpoint and restore processes, how it is integrated in different container runtimes and which optimizations CRIU offers to decrease the downtime during container migration.

In this talk I want to provide details how CRIU checkpoints and restores a process. Starting from ptrace() to pause the process, how parasite code is injected into the process to checkpoint the process from its own address space. How CRIU transforms itself to the restored process during restore. How SELinux and seccomp is restored.

I want to end this talk with an overview about how CRIU is integrated in different container runtimes to implement container live migration.

At the GNU Tools Cauldron we held a panel discussion on how GCC and LLVM can work together. The video of that discussion can be seen at https://www.youtube.com/watch?v=PnbJOSZXynA. We proposed a similar discussion to be held at the LLVM Developers Meeting, but the reviewers suggested that such a discussion would be better held as part of the FOSDEM LLVM Devroom, since that was more likely to attract GNU developers as well.

We wish to explore how Clang/LLVM and the GCC can work together effectively.

The participants will explore opportunities for co-operation between the projects. Areas to be covered include:

• collaboration on issues related to language standards, changes to existing standards or implementing new ones;
• maintaining ABI compatibility between the compilers;
• interoperability between tools and libraries e.g. building with clang and libstdc++ or building with gcc and linking with lld; and
• communication channels for developers via bugzilla or mailing lists.

The compilers are part of wider projects providing all the components of the tool chain, and we anticipate the discussion will roam to low level utilities, source code debuggers and libraries as well. We hope the output of the discussion will inform future work between the two communities.

The panelists are

• Arnaud de Grandmaison is a Director of the Linux Foundation, currently working at Arm. He has been developing with LLVM for his last 10+ years, to support custom architecture or enable architecture exploration.
• Pedro Alves is a global mainainer and major contributor to the GNU Debugger (GDB)
• Tom Tromey is a long-time GNU maintainer. He wrote Automake, worked on gcj and Classpath, and now is a GDB maintainer.

Styles are the essence of a text processor. And while experts love to unleash the power of LibreOffice Writer, it’s at the same time a major source of nuisance. In particular when you receive documents from other people, it can be quite difficult to understand the applied formatting and to fix issues around. This talk presents two ideas for an improved feedback.

Generating insight and conclusions from research data is often not a straightforward process. Data can be hard to find, archived in difficult to use formats, poorly structured and/or incomplete. These issues create “friction” and make it difficult to use, publish and share data. The Frictionless Data initiative (https://frictionlessdata.io/) at Open Knowledge Foundation (http://okfn.org) aims to reduce friction in working with data, with a goal to make it effortless to transport data among different tools and platforms for further analysis, and with an emphasis on reproducible research and open data. The Frictionless Data project is comprised of a set of specifications (https://frictionlessdata.io/specs/) for data and metadata interoperability, accompanied by a collection of open source software libraries (https://frictionlessdata.io/software/) that implement these specifications, and a range of best practices for data management. Over the past year and a half, we have been working specifically with the researcher community to prototype using Frictionless Data’s open source tools to improve researchers’ data workflows and champion reproducibility. This talk will discuss the technical ideas behind Frictionless Data for research and will also showcase recent collaborative use cases, such as how oceanographers implemented Frictionless Data tooling into their data ingest pipelines to integrate disparate data while maintaining quality metadata in an easy to use interface.

Expected prior knowledge / intended audience

The audience should be familiar with the themes of researching, using data in various forms from various sources, scientific computing, and the talk is intended for those that are interested in data management, data cleaning, metadata, and using open research data.

Speaker bio

Lilly Winfree is the Product Owner of the Frictionless Data for Reproducible Research Project at Open Knowledge Foundation, where she solves researchers’ technical data management issues. She has her PhD in neuroscience, and has been active in the open data, open source, and open science communities for four years. Lilly has given numerous conference presentations and workshops over the past decade, and enjoys presenting on technical topics to technical and non-technical audiences.

Links to code / slides / material for the talk (optional)

https://github.com/frictionlessdata/ http://frictionlessdata.io/software/

Links to previous talks by the speaker

Workshop presentation: http://bit.ly/FDepfl Talk from a previous position: https://youtu.be/4Jqu8mBXcmA

In this presentation we take under consideration the increased use of Docker in corporate environments. It is a fact that Docker has found wide spread of use during the past years, mostly because of it being very easy to use , economic w.r.t resources used, fast and easy to deploy when compared with a full blown virtual machine. More and more servers are being operated as Docker hosts on which micro-services run in containers. From a security point of view, two aspects of it arise in the context of this talk and the inherent time-limitations it has. Firstly, the aspect of the already quite talked-through question, “is it secure ?”.Secondly the less analyzed aspect of incident analysis and the changes introduced with respect to known methods and evidence.In this presentation we will briefly outline some security considerations about Docker and the average user and then we will try to examine how Docker introduces changes to the workflow related to incident analysis and forensics in its environment.

Last year I presented Cappulada, a C++ binding generator for Ada that intended to overcome the shortcomings of existing solutions and to provide usable bindings even for complex C++ code.

This year I want to show our conclusions on why automatic bindings between C++ and Ada are hard (if not impossible) and where existing solutions (including our own) fail.

When printed circuit boards come out of the assembly line, a test fixture is required to perform functional testing and program the firmware. These fixtures, called bed of nails, are sturdy setups usually built for high volume production, and can be quite costly. The goal of this talk is to describe how you can build your own low cost fixture with basic PCB design skills and off the shelves components.

Functional testing of printed circuit boards (PCB) is typically done with a bed of nails fixture. The fixture holds the PCB in place over spring-loaded probes that make contact with the board’s test points. The probes can be connected to an acquisition system that runs functional tests and to a programmer that flashes production firmware. The Internet has tutorials and DIY kits suitable for PCBs with large test points (on a 2.54 mm grid). However as PCBs get smaller and more crowded, test points have to be smaller and closer to each other. The goal of this talk is to describe how to build a test fixture with tighter requirements (test points with 0.6 mm diameter and 1.27 mm spacing) on a tight budget.

Main talking points:
- Making a PCB (with Kicad) to hold the probes in place and align the device under test (DUT)
- Using a Raspberry Pi Zero to instrument the setup and communicate with the DUT
- Running OpenOCD on the Raspberry Pi Zero to flash the production firmware.

I will talk about: * features * ongoing work and necessary reworks * big and important technical issues * overall state of the Nouveau project

This is a replacement for Manasi Navare's "Enabling 8K displays" talk, which got cancelled as Intel rejected her travel request again.

How can we give users standing in free/open software/hardware? How can we motivate end users to care about FOSS if they can't express their preference? What tools do we have beyond the "court of public opinion"? Can we invent a NEW legal hack?

The speaker started to experiment with running BEAM modules on Android during summer of 2019. A prototype called CoffeeBeam has been created that is capable of loading and running BEAM files on Android. The solution also contains a virtual machine that provides a lightweight Erlang runtime system. Most of the implemented functionality is independent of the source language of the BEAM files, so the platform is easily extensible to support further languages on the BEAM. During the talk, the speaker is going to present a real-life example of running a BEAM file on Android, while presenting the concepts of the implementation and sharing the story of this journey.

CoffeeBeam: a BEAM VM for Android

Goal

CoffeeBeam is a lightweight Erlang virtual machine that provides easy integration of BEAM files with Android applications. The current alternative solutions provide almost fully functional Erlang runtime systems in the form of Erlang shell on Android devices. However, CoffeeBeam follows a different approach, targeting easy integration of pre-compiled BEAM files into standalone Android applications. The characteristics of Android devices are in focus: they provide large amount of memory while CPU usage needs to be optimized to provide longer device lifetime. It is preferred to make the communication between Erlang and the Android application transparent to provide better user experience.

Use Case

Let's assume that you chose a language over the BEAM to implement an application logic efficiently. CoffeeBeam provides a framework to build on this logic and enable communication between the BEAM and the Android application with only minor changes to your original code. The demonstrated example is a TicTacToe game where the game logic is implemented in Erlang that is extended with a graphical user interface implemented as an Android activity in Java.

Application Architecture

Android Activity

The TicTacToe game is implemented as an Android activity which is a common way of creating interactive applications. The activity contains the view for displaying textual information (game name and user instructions depending on the state of the game) and widgets (game board and new game button) for initiating user actions towards the game logic.

CoffeeBeam VM

The CoffeBeam VM provides the runtime system for the game logic. It is written in Java and included as a .jar library inside the Android application source code. Starting and stopping the VM is connected to the onCreate() and onDestroy() callbacks of the activity.

Game logic

The flow of the game and the computer player's intelligence is implemented as an Erlang module (approximately 250 lines of code) and the compiled .beam file is packaged into the Android application as resource.

Communication

The BeamClient class provides interface for starting and stopping the VM, and manages communication between the VM and the Android application through function calls and callback functions. The default behavior can be redefined by extending the BeamClient class. The forms of communication are described in detail below.

Function call in the VM

User actions in the Android application are translated into function calls in the VM using the apply(String module, String function, ErlList args) method of the BeamClient class. The function call implies creating a new process in the Erlang VM and applying module:function with the list of args. The TicTacToe game logic provides the following functions:

• Start the game process: start(). The game process is spawned that initializes the board for a new game.
• Start a new game: new_game(GamePid). The game board is cleared and a new game starts in the game process identified by GamePid.
• The player selects a field: put(GamePid, X, Y). The player marks the (X,Y) field of the game board with an X sign.

Handle function result in Android

When the Erlang function is executed in the VM, the result of the function initiates a callback in the BeamClient as handleResult(ErlTerm result). In the TicTacToe example, the process identifier of the game process is returned as the result of the tictactoe:start() function. The returned value can be used to send Erlang messages to the game process during the game.

Handle function callback in Android

Each call in the form of beamclient:function(arg) in the Erlang modules results in a BeamClient callback handleCall(String function, ErlTerm arg). Each game event invokes a beamclient:update({Event, Board}) function call that is translated into handleCall callback in the Android application.

Summary and contribution

CoffeeBeam executes BEAM files in a lightweight VM that can be packaged into the Android application. The above TicTacToe example showed how to include the Erlang game logic in the Android application that provides the graphical user interface. The game flow runs in a separate process in the CoffeBeam VM, and the communication with Android is done through BeamClient function calls and callbacks.

The CoffeeBeam VM is open source and available for further development to extend the VM functionality or implement customizations for other languages running on the BEAM. The source code with documented interface is available at: https://github.com/vikger/coffeebeam.

For as long as human society has existed, humans have been unable to trust each other. For millennia, we relied on middlemen to establish business or legal relationships. With the advent of Web2.0, we also relayed the establishment of personal connections, and the system has turned against us. The middlemen abuse our needs and their power and we find ourselves chained to convenience at the expense of our own thoughts, our own privacy. Web3 is a radical new frontier ready to turn the status quo on its head, and these are the technologies we're using to make it happen.

We, as developer, aim to provide code that, almost matches our team code style, looks better and behaves right. Static code analysis (SCA) tools are one of the way to achieves that. But, with multi-programming languages projects and all kinds of code related needs, It's difficult to address all thoses usecases without dealing with a vast majority of SCA tools.

Coala is a — language agnostic — static code analysis framework that provides a common command-line interface for linting and fixing all your code.

It is written in Python and supports way over 50 languages in addition to language independent routines. So, instead of building new analysis tools from scratch you can now build your own custom logic and let let coala deal with the rest.

This talk introduces the audience to the Coala Framework and guides them through how the can use it to build routines to do almost anything you want with your code.

AUDIENCE

Python Developers

LEVEL

Beginner / Intermediate / Advanced

Notes

This talk is for python developers with any level of experience.

At the en of the talk, the attendees will learn :

• Some Basics concepts of static code analysis
• The purpose and usage of Coala Framework
• How to create custom routines either lint, or fix their code

Abstract

We, as developer, aim to provide code that, almost matches our team code style, looks better and behaves right. Static code analysis (SCA) tools are one of the way to achieves that. But, with multi-programming languages projects and all kinds of code related needs, It's difficult to address all thoses usecases without dealing with a vast majority of SCA tools.

Coala is a — language agnostic — static code analysis framework that provides a common command-line interface for linting and fixing all your code.

It is written in Python and supports way over 50 languages in addition to language independent routines. So, instead of building new analysis tools from scratch you can now build your own custom logic and let let coala deal with the rest.

This talk introduces the audience to the Coala Framework and guides them through how the can use it to build routines to do almost anything you want with your code.

Agenda

• Static Code Analysis : Quick overview
• Introduction to Coala and Coala-bears
• Coala-bears : How to build your own coala routines
• Going Further : What's next ?
• Q & A

The presentation is going to be audiovisual and entertaining; based on a number of short videos I want to tell the story of Blender. Starting in late 90s, how Blender became open source, going over the big milestones for Blender, end ending with the fast growth of our project and the interest of the film and game industry. Blender now is a more mature project now, which involves a different dynamics than it used to be. How are we going to tackle the challenges of the industry, while not losing the community that brought us this far?

The Tiki Wiki CMS Groupware software community obviously uses Tiki itself for collaboration and knowledge management. Yet, many other software tools or infrastructures are used. I will review and explain how and why.

Tiki Wiki CMS Groupware was initially released in 2002 and is still very much alive with a vibrant community. We obviously want to use Tiki itself for collaboration and knowledge management as much as possible, but the real situation is, we use a lot more tools. We leverage the fact that Tiki is part of wikisuite by using the other wikisuite software, but these still don't cover everything we use. The reasons vary from old habits to convenience or improved efficiency and they are different for each collaboration tool. I will review them and explain why we use them and how useful they are to us. Also, I will mention our plans for the future.

Despite the number of working groups, advisory committees, and coordination roundtables, there is little progress towards creating more ethical and safe AI systems. AI systems are deployed in increasingly fragile contexts. From law enforcement to humanitarian aid, several organizations use AI powered systems to make or inform critical decisions with increasingly outsized side effects.

What is a rights-based approach for designing minimally safe and transparent guidelines for AI systems? In this talk, we explore what a Free AI system might look like. Then, taking research and guidelines from organizations such as Google and the UN Office for the Coordination of Humanitarian Affairs, we propose practical policies and tools to ensure those building an AI system respect user freedom. Lastly, we propose the outlines of a new kind of framework where all derivative works also respect those freedoms.

Rights based approaches are commonly used within humanitarian contexts to approach problems that the sector faces. In this talk, we use the same approach to solving the issue of “unethical” AI systems. We do so by first defining a set of rights that we feel must be respected, proposing a number of methods that we feel helps ensure a system respects those rights, and lastly propose an organizational and regulatory framework that we feel could help encourage and enforce those methods be used by developers of AI systems.

Stateful applications like databases needs to preserve their state as they need to save client data of one session for use in next session in persistent storage. Managing state in Kubernetes is difficult because the system’s dynamism is too chaotic for most databases to handle. So backup of data is very important especially in case of node failures, disk failures etc. Velero is an open source tool to safely backup and restore, perform disaster recovery, and migrate Kubernetes cluster resources and persistent volumes. In this talk, I will elaborate on why, how and when to use velero for your Kubernetes cluster and volumes.

Please join us for our Birds of a Feather session on open source storage. We'll be talking about Ceph, Gluster, and all other things open source and storage. Mike Perez, community human for Ceph at Red Hat, will be leading the discussion and is happy to give some cool demos during the BoF.

Please join us for our Birds of a Feather session on open source storage. We'll be talking about Ceph, Gluster, and all other things open source and storage. Mike Perez, community human for Ceph at Red Hat, will be leading the discussion and is happy to give some cool demos during the BoF.

Designing for Failure

While we all work very hard to build high-available, fault-tolerant and resillient applications and infrastructures the end-goal is currently often something along the lines of loosly-coupled/microservices with zero-downtime in mind. Upgrades are tied to CI/CD pipelines and we should be sipping pina coladas on the beach. Time to unleash the Chaos Monkey, because that is what Netflix does, so we should try it as well.

Now, the backend DB failed. The middleware application is returning errors, and your frontend is showing a fancy 5xx.

While each layer is able to scale independently or fail-over to another region, even a simple timeout @ the DB can cause a cascading failure.

The application is designed to work, not designed to recover from failure.

Designing for failure applies to both software development and infrastructure architecture, and I'd like to talk about a couple of points to highlight this paradigm.

Please note that this talk replaces one entitled "Introduction to Metal³" that was due to have been given by Stephen Benjamin, who has sent his apologies but is now unable to attend.

This hour is dedicated to people who want to come up and shortly present their project, without having to schedule a full talk.

Bring your open source game-related project (be it an engine, game, demo, tool, or something else) and showcase to our fellow gamedev friends. Talks should have at most five minutes with no time allotted for questions. If you want to bring a laptop to show something, keep it ready and install/uninstall it as fast as possible (will be part of your five minutes). Please be understanding so everyone can have a chance. Contact the room managers on the event day if you want to present something.

In September 2017 Oracle announced that it would be migrating governance of the Java EE platform to the Eclipse Foundation, the home of MicroProfile. Two years later Jakarta EE 8 shipped, signaling the successful completion of that move. As a result, Free Java has a new home for a significant piece of the Java ecosystem. A home which is purely open source, vendor neutral, and community led.

This talk will be about how the long and painful journey from Java EE to Jakarta EE unfolded. But more importantly it will focus on how the new Jakarta EE community works, and how there is a new, open, specification process for Java APIs (other than SE) that is available for the community. We are looking forward to welcoming many of those interested in Free Java to participate in driving new innovation in Java APIs for cloud and other exciting use cases.

XDP support is an increasing trend on the network devices. XDP main goal is processing packets at the lowest point in the software stack avoiding overheads. Memory recycling of received buffers achieved through the in kernel pagepool API plays a fundamental role in the increased performance. Adding XDP support on a driver can be non-trivial. In this talk we'll demonstrate how porting a standard ethernet driver (mvneta/netsec) to XDP and the pagepool API can boost performance. Part of the page_pool evolution involves adding the recycling support in the kernel's SKB stack and leverage the increased performance attributes of the API.

RISC-V boot flow has come a long way since in recent times by leveraging the various opensource boot loaders/firmware projects. This also helped in achieving a well-supported and standard boot flow for RISC-V. As a result, developers can use the same boot loaders to boot Linux on RISC-V as they do in other architectures. Currently, U-Boot is used as the last stage boot loader and OpenSBI as the machine mode run time service provider, but there's more work to be done. A few of such future works includes U-boot SPL support, UEFI boot in RISC-V Linux and booting protocol improvements. This talk will focus on some of these ongoing works which are necessary to declare that RISC-V is truly ready for world domination.

ProxySQL, the high performance, high availability, protocol-aware proxy for MySQL is now GA in version 2.0. This version introduces several new features, like causal reads using GTID, better support for AWS Aurora, native support for Galera Cluster, LDAP authentication and SSL for client connections.

This session provides an overview of the most important new features.

Slide agenda:

• Supported OSes & Packaging
• Query Cache Tunables
• GTID Causal Reads
• Native Galera Support
• Amazon Aurora Features
• LDAP Integration
• SSL, Audit Log & Security
• JSON Support
• Performance Enhancements
• MySQL 8

DNS is easy. You type fosdem.org in your browser's address bar, hit enter and you will be greeted by your favorite open-source event's start page. Actually...

We will introduce unwind(8) - an always-running, validating DNS recursive nameserver, answering queries on localhost (127.0.0.1). We will explain its privilege-separated design and show that it is secure to run this daemon by default. We will then show how its novel approach of observing changes in network location and actively probing the quality of the local network improve the user experience in DNS resolution. The focus will be on laptops that move through many networks, some good, some bad, some outright hostile.

We will compare unwind(8) to prior solutions and show how its design enables it to run without user intervention.

In this talk we will cover the development path of the Pocket Science Lab (PSLab) board from version one in 2014 to today and outline how we use tools like KiCad to bring the device to large scale production. We will also share some major issues that we solved to get the device manufacturing ready and challenges that lie ahead of us like ensuring thorough device testing at production.

In this talk we will cover the development path of the Pocket Science Lab (PSLab) board from version one in 2014 to today and outline how we use tools like KiCad to bring the device to large scale production. We will also share some major issues that we solved to get the device manufacturing ready and challenges that lie ahead of us like ensuring thorough device testing at production. The goal of Pocket Science Lab is to create an Open Source hardware device (open on all layers) and software applications that can be used for experiments. The tiny pocket lab provides an array of instruments for doing science and engineering experiments. It provides functions of numerous measurement tools including an oscilloscope, a waveform generator, a frequency counter, a programmable voltage, current source and even a component to control robots with up to four servos.

OP-TEE is an open source implementation of the GPD TEE specifications. However deploying OP-TEE inside a real world product requires more than just the integration into the system, since the integrator needs to ensure that all security requirements are met. This talk will outline a common set of these requirements and show the necessary changes based on NXP i.MX6 platforms.

Please note that this talk was originally scheduled to begin at the later time of 13:35

While actual browsers expose their internals through an API and limit access to the host system, Next doesn't, allowing for infinite extensibility and inviting the users to program their web browser. On top of that, it doesn't tie itself to a particular platform (we currently provide bindings to WebKit and WebEngine) and allows for live code reloads, thanks to the Common Lisp language, about which we'll share our experience too.

Next is a keyboard-oriented, extensible web browser designed for power users. While most (all?) current browsers expose their internals through an API, Next exposes its entire code to the user. Modern browsers limit access to the host system, and Next doesn't, allowing for a broad range of new features. Similar projects have failed due to being tied to a particular platform (Vimperator, Conkeror…), but Next's choice is to have its core written as an independent library, and to provide bindings to web engines (currently WebKit and WebEngine are supported). Next's magic touch is its live coding capability: we can develop a command from a REPL, compile the function and try the changes immediately, without restarting anything. Or just edit our init file and reload it into the current session. This flexbility comes for free thanks to the Common Lisp language, the experience with which we'd like to share too.

Next is usable as of today. It features ad-blocking (only basic for now, contributions are welcome), multi-selection, bookmarks, session persistence, Emacs and Vim-like shortcuts, history seen as a tree, fuzzy completion everywhere, basic git-forking and file management interfaces…

We are entering a new phase of development, with hopefully announcements that we can make public at the time of the conference :)

A brief overview of the current state of the backup tool, architecture, MySQL 8.0 support, new cloud native features, and the roadmap.

During this brief lecture, I will present the roadmap for Percona XtraBackup, talk about the importance of our Cloud direction, why PXB 8.0 is a separate binary, and how PXB fits into our Percona Distribution model for 2020.

Recently the kernel landed seccomp support for SECCOMPRETUSER_NOTIF which enables a process (supervisee) to retrieve a fd for its seccomp filter. This fd can then be handed to another (usually more privileged) process (supervisor). The supervisor will then be able to receive seccomp messages about the syscalls having been performed by the supervisee.

We have integrated this feature into userspace and currently make heavy use of this to intercept mknod(), mount(), and other syscalls in user namespaces aka in containers. For example, if the mknod() syscall matches a device in a pre-determined whitelist the privileged supervisor will perform the mknod syscall in lieu of the unprivileged supervisee and report back to the supervisee on the success or failure of its attempt. If the syscall does not match a device in a whitelist we simply report an error.

This talk is going to show how this works and what limitations we run into and what future improvements we plan on doing in the kernel.

What benchmark? How many VMs? How big each VM is? Are they all equal or are they different? What's the host OS? What are the guest OSes? I.e., when wanting to do virtualization performance testing, the matrix of test cases tends to explode pretty quickly. This talk will show how we enhanced an existing benchmarking suite, MMTests, in order to be able to deal a little bit better with such complexity. And what our further activities and plans are, for even more and better automation.

Functional testing is already hard enough, in virtualization. For instance, because we need to make sure that things work with different combinations of versions of the OSes in hosts and guests. Doing performance testing, even more so. In fact, there are much more things to consider, such as how many VMs we use, how big they are, whether or not they are equally big or different, what to run in them, how to partition the host resources for them... And this is true either in case you have a specific (virtualized) workload and some KPI to meet, in which case you need testing and benchmarking to figure out whether or not the tuning you have done has brought you there, or in case you wonder how good (or how bad) a certain configuration of both your host and your guests works, for a number of workloads,

This talk will introduce the problem, showing how the size and the complexity of a typical 'virtualization performance testing matrix' really tend to explode. We will, as an example, show how some specific characteristics of a virtualized system were, despite tuning, causing us to not be able to achieve the desired performance levels. Then we illustrate how, at SUSE, we do automated performance benchmarking, how we enhanced the tool that was in use the most for baremetal benchmarks (the MMTests suite) in order for it to be much more useful in virtualized systems and how we are integrating it with other tools to bring the level of automation even further and achieve something that really resembles a Virtualization Performance CI system.

Protocols in symmetric cryptography are often built from block ciphers, with a fixed input and output size, while variable sizes are handled through their modes of use. Incrementality, namely, the ability to efficiently compute the output for increasing inputs, or to request longer outputs, is often a property of the implementation rather than an explicit feature of a mode.

A doubly-extendable cryptographic keyed (or deck) function is a new kind of object that makes incrementality an integral part of its definition. Writing modes for various applications, such as authenticated encryption of a network channel or disk encryption with a wide block cipher, on top of a deck function turns out to be a simple exercise and leads to less error-prone implementations than on top of a block cipher. We illustrate this with the session-supporting authenticated encryption modes SANE and SANSE. (Sessions naturally protect a continuous flow of messages or a client-server dialog.)

While a deck function can be constructed from existing primitives, like a block cipher, we show two more natural ways of making a deck function in practice.

• The first one is based on the well-known permutation-based duplex construction, of which a nice instantiation is the Strobe protocol framework. Strobe was showcased in Noise+Strobe=Disco as an advantageous replacement to all kinds of primitives in the Noise protocol framework, resulting in much simpler specifications and a lighter implementation. Xoodyak, our candidate to the NIST Lightweight Cryptography competition, is another example.

• The second one is based on the recent Farfalle construction, which relies on the parallel application of a permutation. Farfalle's inherent parallelism yields deck functions that are at the same time simple and efficient on a wide range of platforms. In particular, we point out the nice performance of Kravatte and Xoofff, two deck functions based on the Keccak-p and the Xoodoo permutation, respectively. It is worth noting that Kravatte and Xoofff are much faster than AES-128 in software, and at least competitive with and often faster than AES-128 using dedicated AES instructions on the more recent Intel and AMD processors!

ELIXIR is an intergovernmental organization that brings together life science resources across Europe. These resources include databases, software tools, training materials, cloud storage, and supercomputers.

One of the goals of ELIXIR [1] is to coordinate these resources so that they form a single infrastructure. This infrastructure makes it easier for scientists to find and share data, exchange expertise, and agree on best practices. ELIXIR's activities are divided into the following five areas Data, Tools, Interoperability, Compute and Training known as “platforms”. The ELIXIR Tools Platform works to improve the discovery, quality and sustainability of software resources. Software Best Practices task of the Tools Platform aims to raise the quality and sustainability of research software by producing, adopting, promoting and measuring information standards and best practices applied to the software development life cycle. We have published four (4OSS) simple recommendations to encourage best practices in research software [2] and the Top 10 metrics for life science software good practices [3].

The 4OSS simple recommendations are as follows: - Develop a publicly accessible open-source code from day one. - Make software easy to discover by providing software metadata via a popular community registry. - Adopt a license and comply with the licence of third-party dependencies. - Have a clear and transparent contribution, governance and communication processes.

In order to encourage researchers and developers to adopt the 4OSS recommendations and build FAIR (Findable, Accessible, Interoperable and Reusable) software, best practices group in partnership with the ELIXIR Training platform, The Carpentries [4][5], and other communities are creating a collection of training materials [6]. The next step is to adopt, promote, and recognise these information standards and best practices, by developing comprehensive guidelines for software curation, and through workshops for training researchers and developers towards the adoption of software best practices and improvement of the usability of research software tools.

Additionally, the ELIXIR Software Best Practices WG is currently developing a Software Management Plan under the context of the necessary metrics for assessing adoption of good software development practices [7] and will subsequently develop practical guidelines to support its implementation in ELIXIR projects. We will work with the newly formed ReSA (Research Software Alliance) to facilitate the adoption of this plan to the broader community. In the past year, the Working Group has also been working on improving the tooling and practices around software citation. This work has been done in collaboration with the eLife journal, the Software Sustainability Institute, Datacite, and Software Heritage, over multiple sprint events: (i) BOSC CoFest, (ii) eLife Innovation Sprint, (iii) FORCE19 Research Software Hackathon, and (iv) BioHackathon.

[1] “ELIXIR | A distributed infrastructure for life-science information” Internet: https://www.elixir-europe.org/, [Sep. 16, 2018] [2] Jiménez RC, Kuzak M, Alhamdoosh M et al. (2017) “Four simple recommendations to encourage best practices in research software” F1000Research [Online]. 6:876. https://doi.org/10.12688/f1000research.11407.1 [3] Top 10 metrics for life science software good practices https://doi.org/10.12688/f1000research.9206.1 [4] “carpentries.org” Internet: carpentries.org, Sep. 15, 2018 [Sep. 16, 2018] [5] “ELIXIR teams up with The Carpentries to boost its training programme | ELIXIR”, Internet: https://www.elixir-europe.org/news/elixir-carpentries-agreement, Aug. 17, 2018 [Sep. 16, 2018] [6] SoftDev4Research/4OSS-lesson https://doi.org/10.5281/zenodo.2565040 [7] Top 10 metrics for life science software good practices https://doi.org/10.12688/f1000research.9206.1

Photography policies have begun to appear at free-software events in recent years. These policies typically seek to address personal privacy concerns for event attendees, but they sometimes conflict with the event's desire to record talks, Q&A periods, and social gatherings in public spaces. If not drafted with care, photo policies also run the risk of creating ambiguities for journalists, other attendees making personal photo or video recordings, and members of event-hosting organizations or the public. This session will be an open discussion about photo and video-recording policies, online tagging policies, and related personal-privacy policies, with the goal of clarifying the requirements, needs, and intents of all stakeholders in the FOSS community, so that future event organizers have a solid framework from which to draft clear policies that fit their situations.

Free-software events, like free-software projects, have to maintain a delicate balance between openness as a broad principle and privacy as an individual concern. In the past few years, more and more free-software events and community projects have developed "photo policies" that are intended to define when and how individuals and groups should be captured in media from the event and when and how those same people should be identified in the media. But a haphazard approach to policy writing can create unintentional ambiguities, such as how to define when an individual is the "subject' of a photograph or merely in the background. And free-software communities must also take care to write policies that do not come into conflict with local law, especially when events take place in public spaces. Finally, event organizers need to ensure that their photo policies, real-name policies, press policies, and session-recording consent policies work in concern with one another, not in conflict.

This session will be a broad discussion of photography policies and how they interact with other policy concerns. The intent will be to enumerate the concerns of all stakeholders, identify potential areas of confusion, note best practices, and — most importantly — establish resources and spaces for further discussion for project and community members creating photo policies in the future.

A tour of the internals of Weave Net, one of the most popular container networks: design challenges and lessons learned from five years in the wild. Including Kubernetes integration and how CNI was born.

Weave Net is written in Go, using many Linux kernel features such as veths, bridges and iptables. Aimed at developers rather than network engineers, Weave Net tries to be self-configuring and find the best available transport between nodes. The control plane operates via gossip, with no central point of control.

Wikidata, Wikimedia's knowledge base, has been very successful since its inception 7 years ago. Wikidata's general purpose data about the world is powering everything from Wikipedia to your digital personal assistant. Its linked, machine readable data is collected and maintained by a community of over 20000 people. But not all data should and can be in Wikidata. Instead we are taking the software powering Wikidata, Wikibase, to new places. We empower communities and institutions all around the world who want to collect structured, machine-readable data about a topic area of their choice to run their own Wikibase. These Wikibase instances are then connected to form a thriving ecosystem. In this talk we'll go over what Wikibase is, where it's coming from and what it is enabling right now.

Compilation and execution are as different as night and day. Or are they? By blurring the lines, Elixir (and the BEAM VM) enable some very powerful and useful meta-programming techniques.

In this presentation, Marten will talk about running and generating code at compile-time, Elixir's hygienic macros, and how to compile and hot-reload altered or extra code, while your program is running! Besides explaining these concepts, their usefulness will be motivated using various practical real-world examples.

The Robot Operating System (ROS) is one of the chief frameworks for service robotics research and development. The next iteration of this framework, ROS2, aims to improve critical shortcomings of its predecessor like deterministic memory allocation and real-time characteristics.

RCLAda is a binding to the ROS2 framework that enables the programming of ROS2 nodes in pure Ada with seamless integration into the ROS2 workflow.

Oreboot = Coreboot - C. Oreboot is a fully open-source power-on-reset and romstage firmware written in Rust. Oreboot can boot a HiFive RISC-V processor to Linux with a Go user-mode.

Oreboot rethinks the firmware driver models. Each driver is distilled to four basic functions: init, pread, pwrite and shutdown. This interface allows us to make convenient higher-level drivers such as a "union driver" which duplicates a single write operation to multiple drivers. This makes consoles which have multiple underlying UART drivers elegant.

By using the Rust programming language, Oreboot has a leg-up in terms of security and reliability compared to contemporary firmware written in C or assembly. Rust's borrow-checker ensures pointers are not used after freed and proves that coroutines are thread-safe at compile time.

In this talk, we will also present a short overview of the basics of Rust, how our driver model incorporates coroutines and the bootflow of Oreboot.

SortingHat is an open source Python tool that helps to manage the different contributor identities within an open source project. Under the hood SortingHat relies on a relational database, which can be queried via SQL, command line or directly via its Python interface. However, these ways of interacting with SortingHat hinder its integration with external tools, web interfaces and new web technologies (e.g., Django, REST services). To overcome these obstacles, we have evolved SortingHat's architecture using a GraphQL model based on the Graphene-Django implementation.

This talk describes our experience in migrating to GraphQL, from adapting the SortingHat functionalities to refactoring the unit tests. Furthermore, we comment also on lesson learned, advantages and drawbacks of using this new approach

SortingHat is one of the core tools of GrimoireLab, an open-source software analytics platform part of CHAOSS project (Community Health Analytics Open Source Software) under the umbrella of the Linux Foundation.

LibreOffice is free and open source office suite software that is very popular today. LibreOffice is almost used in various user segments, ranging from personal, community, education, and even companies. It would be very interesting to be able to have LibreOffice specific themes for each segment. For this reason, we (LibreOffice Indonesia Community) took the initiative to create a special extension to manage themes in LibreOffice, we call it LO-TC (read: Lotis) LibreOffice Theme Changer.

LibreOffice is free and open source office suite software that is very popular today. LibreOffice is almost used in various user segments, ranging from personal, community, education, and even companies. It would be very interesting to be able to have LibreOffice specific themes for each segment. This of course will also further strengthen the fact LibreOffice is truly free software. Unfortunately, the features to set themes in LibreOffice are currently limited. As of now, LibreOffice only provides 6 theme choices for users. In the previous version, although there were many bug and problems, there was a persona theme menu that was quite interesting to me. For this reason, I and my friends in the LibreOffice Indonesia Community took the initiative to create a special extension to manage themes in LibreOffice, we call it LO-TC (read: Lotis) LibreOffice Theme Changer. LO-TC was originally just a simple bash script that allows users to change some visual components in LibreOffice, some of which are:

• Images in headers and footers
• Intro or splash screen
• Colors in the application, and
• Icons (optional)

Because it is only based on bash scripts, LO-TC can only be used for Linux and Mac (with a few adjustments). Because of this limitation, we finally decided to rewrite LO-TC in the form of extensions so that it could later be used on many operating systems. The various LibreOffice installation models (via repositories of distributions, snap, flatpak, etc.) pose quite daunting challenges for developers. In addition, this is our first extension project, so we need a lot of new things that we must understand in the process of working on this latest LO-TC. Current status of LO-TC development can be found here: https://github.com/libreofficeid/LO-TC-GUI

A key aspect of a microservice architecture is to make sure individual services work in isolation. But as a developer its also important to make sure the service works in the full system. Providing developers a way to run pre-production code in a multi-service environment is challenging.

Making use of existing Helm charts and defaulting to production configuration does part of the work. Also important is being able to extend upon tools like Telepresence/Ksync for debugging in k8s. But while these great tools are available, what has been lacking is the "easy to use", single command that gives a developer a place to work with their own full, self-contained system. There are now a few open source solutions to do just that (like Garden, Acyl, & Armador). In this talk, Jeff will break down how these tools work, and what makes them different.

In this half hour we study aspects of physically and cryptographically secure hardware (often termed secure element or SE) and the integration into existing circuits. We illustrate utility of such integration by inspecting a cryptocurrency wallet design, and explain the difficulty presented by nondisclosure agreements (NDA) common to industry closed adversaries. We examine several hardware devices, study their parts under a close range circuit camera, and suggest instructions on their use.

Building secure applications involves research of new technology while leveraging well known practices, for example when using ECDSA to secure systems with low power devices.

In this half hour lecture, we study an in depth example of using cryptoaccelerated hardware to research such secure applications.

We review common cryptography practices.

• Applied security paradigms
• Asymetric public key exchange
• Encryption and signing algorithms
• Challenges of low power computing
• Noncomputational security features ...for example mechanical UI constructs

We proposes new hardware supported techniques.

• Open FPGA platforms
• NDA unencumbered SE
• Circumventing black boxes
• Benchmark measurements
• Hardened serial interfaces

We end by viewing a number of real device hardware circuits under a close range microscope, and possibly offer a device petting zoo to encourage exploration of hardware.

Shenandoah GC landed in JDK12 about a year ago, giving OpenJDK another low-pause garbage collector. It has undergone substantial changes since then. Specifically we have a new barrier scheme, and have eliminated the extra forwarding pointer word per object, thus substantially reducing memory footprint. After giving a general introduction to OpenJDK GC landscape and Shenandoah GC, this talk focuses on those recent changes in Shenandoah and what's in it for you.

A brief overview of the current state of backup tool, architecture, existing features, and the roadmap.

Please note that this talk will now be given by Michal Čihař instead of Václav Zbránek.

You will learn how to localize your project easily with little effort, open-source way. No repetitive work, no manual work with translation files anymore. Weblate is unique for its tight integration to VCS. Set it up once and start engaging the community of translators. More languages translated means more happy users of your software. Be like openSUSE, Fedora, and many more, and speak your users' language now thanks to Weblate!

I will show you the main perks of Weblate and the setup of the project. If you have a project with open repo and you want to start translating it, take your git:// link, and we will set it up right on the spot. FOSDEM is a great time and place to found your translating community.

SELinux (Security Enhanced Linux) provides enhanced security mechanism for more advanced access control and auditing. It allows your application software and your system users to only access the resources it's been preconfigured to allow. Of course when you want to move your data- or log files to a non-standard location these policies will stop MySQL from starting.

The easy way out is obviously to set SELinux to disabled or permissive. But someone once said: "Every time you disable SELinux a kitten dies". We'll show you a few ways how you can find out if it actually is SELinux that is blocking you and how to update the policies to properly keep you system secured.

another approach in automating maintenance

Catalog zones are DNS zones containing dynamic configuration, or better said “configuration data”:
 the domain zones to be loaded/unloaded) in your DNS daemon.

This already works find in Bind, be it slow when running million of domains. So I wish to add a section that would allow to iterate over the relevant data.

Today, the task of running containers involves a lot of technologies and levels of abstraction, and it can be difficult to understand, or just to keep up. How do CRI-O and containerd overlap ? Does Kata containers compete with Firecracker ? Is there any relationship between OCI and CRI ? How many different meanings can "container runtime" have ?

In this talk, we will navigate this treacherous sea of overlapping technologies and acronyms that take care of running container workloads, below Kubernetes all the way down to the Linux kernel. We will present at a high-level how these technologies, interfaces and levels of abstraction combine and overlap, and hopefully clarify which are spec vs. implementation, which are complementary, and which are alternative solutions.

This talk will cover the following points:

• The world used to be simple: the case of Docker
• Interfaces: OCI and CRI
• More puzzle pieces: Podman, Containerd and CRI-O
• Workload isolation: Kata Containers, GVisor and Firecracker
• Q&A

As an editor for WYSIWYM text, Stylo is designed to change the entire digital editorial chain of scholarly journals the field of human sciences.

Stylo (https://stylo.ecrituresnumeriques.ca) is designed to simplify the writing and editing of scientific articles in the humanities and social sciences. It is intended for authors and publishers engaged in high quality scientific publishing. Although the structuring of documents is fundamental for digital distribution, this aspect is currently delayed until the end of the editorial process. This task should, however, be undertaken early on in the process; it must be considered by the author himself. The philosophy behind Stylo consists in returning the task of managing the publication markup to researchers. This repositioning of tasks relating to the editorial process relies on the author’s semantic rather than graphic skills.

This lightning talk will be the opportunity to present this tool and several publishing projects realized with Stylo.

Reflecting on OpenSCAD's 10 years of history and what we've learned and discovered along the way. Discussion on opportunities and potential avenues forward, and some stories from the trenches.

The security of computer systems fundamentally depends on the quality of its underlying software. Despite a long series of research in academia and industry, security vulnerabilities regularly manifest in program code. Consequently, they remain one of the primary causes of security breaches today. The discovery of software vulnerabilities is a classic yet challenging problem of the security domain. In the last decade, there appeared several production-graded solutions with a favorable outcome.

Code Property Graph[1] (or CPG) is one such solution. CPG is a representation of a program that combines properties of abstract syntax trees, control flow graphs, and program dependence graphs in a joint data structure. There exist two counterparts[2][3] that allow traversals over code property graphs in order to find vulnerabilities and to extract any other interesting properties.

In this talk, we want to cover the following topics:

• an intro to the code property graphs
• how we built llvm2cpg, a tool that converts LLVM Bitcode to the CPG representation
• how we teach the tool to reason about properties of high-level languages (C/C++/ObjC) based on the low-level representation only
• interesting findings and some results

[1] https://ieeexplore.ieee.org/document/6956589 [2] https://github.com/ShiftLeftSecurity/codepropertygraph [3] https://ocular.shiftleft.io

The RISC-V H-extension (aka hypervisor extension) is suitable for both Type1 and Type2 hypervisor. We have ported two hypervisors for RISC-V: Xvisor (Type1) and KVM (Type2). We show the current state and furture work for both hypervisors.

OCS stands for Openshift Container storage. It provides container-based storage for OCP(Openshift container platform). It’s easily scalable to bare metal, VMs and cloud platforms. Auto healing is a property of OCS cluster that auto heals a cluster component automatically when passes through an unexpected condition. A component can be a node, a network interface, a service, etc. To make sure auto heals just fine, we introduced negative testing. Negative Testing is defined as, a testing type that checks a system for unexpected conditions. In this presentation, We’re going to talk, what role negative testing plays, how to negative test components like node by shutting it down, deploying a heavy workload, etc. Similarly, for the network component, we are going to see what happens when the public network is disconnected along with many more scenarios.

SGX-LKL is a library OS designed to run unmodified Linux binaries inside SGX enclaves. It uses the Linux Kernel Library (LKL) and a modified version of musl to provide system support for complex applications within the enclave. SGX-LKL has support for in-enclave user-level threading, signal handling, and paging. This demo presents an overview of SGX-LKL and demonstrates how popular applications can be ported and executed within SGX-LKL.

Please note that this talk was originally scheduled to begin at the later time of 14:10

Tor Meetup

All Python developer who want to run asynchronous tasks should know Celery. If you have already used it, you know how great it is ! But you also discovered how it can be complicated to follow the state of a complex workflow. Celery Director is a tool we created at OVH to fix this problem : using some concepts of Event Sourcing, Celery Director helps us to follow the whole lifecycle of our workflows. It allows us to check when a problem occurred and relaunch the whole DAG (or just a subpart if tasks are not completely idempotent). During this talk we will introduce you the different concepts of Celery Director then we'll make a demonstration of it.

All Python developer who want to run asynchronous tasks should know Celery. If you have already used it, you know how great it is ! But you also discovered how it can be complicated to follow the state of a complex workflow. Celery Director is a tool we created at OVH to fix this problem : using some concepts of Event Sourcing, Celery Director helps us to follow the whole lifecycle of our workflows. It allows us to check when a problem occurred and relaunch the whole DAG (or just a subpart if tasks are not completely idempotent). During this talk we will introduce you the different concepts of Celery Director then we'll make a demonstration of it.

A popular way to manage long-running state in Erlang and Elixir programs is by using processes; this model is well-understood and well-supported, but remains firmly rooted within known orthodoxy. Within this session, I shall demonstrate application of the Orleans model to existing Erlang and Elixir applications, review existing work done by the community, and compare this way of programming against other models. For maximum enjoyment, the audience is advised to possess working knowledge of Erlang and Elixir. Some background knowledge in Web applications will be helpful as well. The session will be presented with live demo in Elixir.

This talk is about "Kapow!" an open source webframework for the shell developed by BBVA Innovation Labs. We will talk about the current development of the project including an overview of Kapow!'s technology stack and the recent release of the first stable version.

The motivation behind the project was to create an adapter between the shell and the web. Allowing users to expose command line programs as HTTP services with a high degree of freedom and flexibility, not imposing any predefined behavior. The project is based on an open specification.

Kapow! supports an increasing list of HTTP features; including forms, websockets and streaming. The architecture is based on exposing a private REST API through which the shell can interact with the incoming user HTTP requests.

Leveraging this architecture an ecosystem of specialized tools is planned, to help with common high level tasks in Kapow! services. For example: - Shell commands that can interact with incoming web browser requests and render specialized web pages. - Automatic mapping of shell command parameters to REST API through bash completion scripts.

Roberto will do some demos about creating Kapow! services from scratch (expose nmap as a service, tcpdump and pandoc).

Advene is a video annotation platform (free software) that aims at accompanying scholars in their audiovisual analyses workflow. It promotes flexible and evolving annotation structures and interfaces in order to deal with the inherent dynamic nature of analysis. In this presentation, I will present the platform itself, and illustrate its usage through existing Digital Humanities projects that use it, from structuring videos for interview analyses to implementing a workflow for semantic annotation of movies.

The Advene project (Annotate Digital Video, Exchange on the NEt) aims at providing a model and a format to share annotations about digital video documents (movies, courses, conferences...), as well as tools to edit and visualize the hypervideos generated from both the annotations and the audiovisual documents.

With the Advene software, teachers, moviegoers, etc. can exchange multimedia comments and analyses about video documents. The project also aims at studying the way that communities of users (teachers, moviegoers, students...) will use these self-publishing tools to share their audiovisual "readings", and to envision new editing and viewing interfaces for interactive comment and analysis of audiovisual content.

Advene is a GPL desktop application, based on Python3/Gtk/Gstreamer.

Join us to learn why Operators are the leading and default approach for managing workloads on Kubernetes. We will pull back the curtain to show you exactly what an Operator is, how to make one, and what it means to be “Kubernetes Native”.

SREs automate every aspect of workload management. Applying this mentality to the Kubernetes space, a pattern has emerged for coding such automation directly into the control plane. By adding native extensions to the Kubernetes API that are tailored to individual workloads, the Operator pattern enables infrastructure and workloads to be managed side-by-side with one set of tooling and access control.

Join us to learn why Operators are the leading and default approach for managing workloads on Kubernetes. We will pull back the curtain to show you exactly what an Operator is, how to make one, and what it means to be “Kubernetes Native”. To close we will discuss use cases from the field; how real organizations have created and/or re-used Operators to automate their operations.

As soon as you are on Linux you are generally confident with the embedded system, whatever it is. But often the boot process may hide some misteries, and understanding the details may help to recover a bricked board or to upgrade or replace a bootloader. The explained path would start from comparing some different SoC's, passing from the ROM boot loader, static RAM, sdram init, secondary bootloader, and so on, until the last "jump" to Linux. Most common non volatile boot devices would be introduced. A basic knowledge would be ok for the audience.

Ada incorporates in its standard a model for distributed execution. It is an abstract model that does not depend on a particular kind of network or any other communication mean, and that preserves full typing control across partitions. This presentation briefly exposes the principles of Ada's distribution model, then shows the possibilities with life demos across different machines and operating systems.

The early history of Unix is much richer than is usually presented. There are many hidden gems that are little known and quite interesting to learn about. The dates of many of the "firsts" for Unix accomplishments is much earlier than people think. This well-researched talk explores those gems, firsts and shares many artifacts from the early days of Unix. Many of these artifacts have just come to light in recent years, and change how we view the early history of Unix. Even the oldest of grey beards will learn things they didn't know about Unix from this talk.

Most histories of Unix follow the same old boring plan: talk about Multics, Ken scrounging the pdp-7, moving to the pdp-11, rewriting in C and then the explosion that happened with V6 and V7 before jumping into the Unix wars between AT&T and BSD followed by something about Linux (either pro or con depending on the speaker's politics). We've all seen it, and many can predict which "classic" pictures will be used, the points that will be made, and the arcs drawn.

This talk is nothing like that. It brings all the early years of Unix to life in a unique way. The early years of Unix were surprising rich. The author will use original sources to take you on a tour of many of the firsts in Unix and explore the community ties key to Unix's early success. Many of today's fads, like microkernels, hypervisors, multiprocessing and user mode execution actually happened early on in Unix's history, long they were today's fads. "What's old is new again" has never been so apt. You'll be surprised to learn how early each of these things happened. Come see the secret history of Unix as it played out both in obscure business units of AT&T and in the world wide users groups who banded together to support each other when AT&T wouldn't. You'll see footage of early machines as well as the first real Unix application: space travel (newly rediscovered and restored by the TUHS group). See first hand the machines, programs, newsletters and documentation that together weave a rich tale of innovation, community and working within constraints. Learn how today's open source movement owes a debt to these early communities and how they paved the way for Unix to become the open and ubiquitous system it is today and helped sow the seeds for the communities of today.

Quarkslab is a French company specializing in information security R&D, consulting and software development.

Due to strong data security constraints imposing self-hosted solutions coupled with limited resources in a fast-growth environment, data safety has been a pain point in our infrastructure.

After our backup server failed, we decided to recreate a new backup system from scratch, adapted to our needs and using technologies we were familiar with, to backup 30+ Linux servers.

In this talk, we will present how our old backup system failed, the key requirements we learned from this failure, and how we designed and implemented a new backup system based on Borg Backup, borgmatic, SSH, Python and FreeNAS to solve those requirements.

We will conclude by listing the shortcomings and improvement points of our approach, as well as comparing our solution to seven important properties every backup system should have.

Some interesting features of our new backup solution are strong data safety and security, fully self-hosted, using only open-source tools, simple to set up and easy to understand.

One specific requirement we solved was for the sysadmin team to be blind to the data they backup, managing only the process itself.

This lets people working on confidential project on dedicated and access-restricted servers to still use a centralized and resilient backup system without compromising data and server security.

We will open-source our Ansible roles and Python scripts on Github before FOSDEM.

In this talk will cover Monado and Khronos' OpenXR standard, and give an overview about the current state of open source VR and what lies ahead. Also go into some details of how tracking is done inside of Monado and show of the current state.

VR took off for the consumer with the release of Oculus consumer hardware. But the hardware lacked open source drivers and Linux support in general. The consumer VR space has now grown from a kickstarter campaign into a large industry. But this growth has its down sides, multiple companies have their own APIs competing. Luckily these companies have agreed to work on a single API under the Khronos umbrella. Now that OpenXR has been released and and the Monado project has been getting more stable it is now possible to do good VR on a completely open stack.

Free Software (as in Freedom) had won. The vertically integrated Cloud now is the predominant operational paradigm and is threatening to undermine software freedom. To many all seems lost, but the world keeps changing and decentralized compute is making a comeback. Containers and Kubernetes are already having a deep impact on the Linux operating system (OS) that goes well beyond DevOps and cloud-native applications. The concepts of application-centric packaging, process isolation through Linux containers, and immutable infrastructure are shaking up the core traditions of today's GNU/Linux operating systems. These concepts are also challenging the assumptions and approaches derived from the past 40+ years of work that originated with UNIX. The Linux distribution as we know it is coming to an end, and is being replaced by a new concept of containerized, multi-instance, multi-user applications, which can be deployed in scale-out environments as well as for widely distributed compute scenarios. In this session, we'll assess this new OS environment in the times of '5G' de-centralized cloud and take a deep look at the consequences this new OS model has for both developers and admins.

This talk will draw on the history of compute in general and Free and Open Source in specific to explain an evolution of paradigms from the GNU/Linux Distribution to modern Free Software application plattforms build on Kubernetes and how they can shape the future of compute in the face of major technological changes.

How Transparent Data Encryption is built in MySQL and Percona Server ? - keyrings – what are they used for ? What is the difference between using a server back-end (keyringvault) versus file back-end (keyringfile). How it affects server startup and why? Why per server separation is needed in Vault Server? - How Master Key encryption works ? How it is build on page level ? How do we know which key we should fetch to decrypt a table ? How do we know that used key is the correct one ? How do we make sure that we can decrypt a table when we need it ? - What crypto algorithms are used ? - How Master Key rotation works ? Why is it needed ? - What is KEYRING encryption and what are encryption threads? - How binlog encryption works in 5.7 and how it works in 8.0 ? - How undo log/redo log encryption works ?

How Transparent Data Encryption is Built in MySQL and Percona Server ?

In this presentation, we'll take a deep dive into the world of transparent data encryption for open source databases. We'll be looking at how transparent data encryption is implemented in MySQL and Percona Server for MySQL: - keyrings – what are they used for ? What is the difference between using a server back-end (keyringvault) versus file back-end (keyringfile). How it affects server startup and why? Why per server separation is needed in Vault Server? - How Master Key encryption works ? How it is build on page level ? How do we know which key we should fetch to decrypt a table ? How do we know that used key is the correct one ? How do we make sure that we can decrypt a table when we need it ? - How Master Key rotation works ? Why is it needed ? By the end of the talk, you'll have a better understanding of the transparent data encryption and will be aware of things to take into account when interacting with encrypted databases in your applications.

Are the FSF's 4 Freedoms and the OSI's Open Source Definition out of date in 2020 and should be replaced.

Affirmative position: OSD/FSD is now irrelevant

1. First Affirmative Constructive (1AC) = 7 minutes a. Cross-examination of First Affirmative by Second Negative = 3 minutes
2. First Negative Constructive (1NC) = 7 minutes a. Cross-examination of First Negative by First Affirmative = 3 minutes
3. Second Affirmative Constructive (2AC) = 7 minutes a. Cross-examination of Second Affirmative by First Negative = 3 minutes
4. Second Negative Constructive (2NC) = 7 minutes a. Cross-examination of Second Negative by Second Affirmative = 3 minutes
5. First Negative Rebuttal (1NR) = 3 minutes
6. First Affirmative Rebuttal (1AR) = 3 minutes
7. Second Negative Rebuttal (2NR) = 3 minutes
8. Second Affirmative Rebuttal (2AR) = 3 minutes

A data-centric, offline-first approach to decentralized collaborative application development focusing on data ownership and privacy.

Exploring replicated mergeable data structure stores as building blocks of decentralized applications that enable asynchronous collaboration and offline search in combination with peer-to-peer gossip-based protocols that provide pub/sub, dissemination, and recommendation services both over the internet as well as on local and mobile proximity networks, thereby forming interest-based networks that facilitate discovery of personally relevant content and people.

OpenOffice Writer offers all features needed for basic frequency analysis and visualization. We'll see how to do automated text analysis and simple word clouds without using specialized external tools.

JDK Flight Recorder provides production time profiling and diagnostics via a compact events-based infrastructure inside the Hotspot JVM itself. JDK Mission Control is a stand-alone application that provides real-time monitoring information for Hotspot JVMs, as well as tools to read, automatically analyze and visualize flight recording data produced by JDK Flight Recorder.

When this talk is presented, JMC 7.1.0 has (hopefully) been out for a little while. This presentation talks about what is new and the roadmap for the upcoming JMC 8. We will also discuss recent changes in the project, such as the move to Skara. Towards the end we will demo how JDK Flight Recorder and JMC core libraries can be used to diagnose applications deployed in container orchestration platforms.

The DNS Protocol has features that have grown to become liabilities. The query type "ANY" is one. Earlier this year a published RFC document describes how a DNS server may respond to such queries while reducing the liability. But the document does not define a definitive means for a server to signal that it is differing from the original protocol. This presentation measures of the impact of having no definitive means specified and examines the "fear, uncertainty, and doubt" of lacking explicit signals.

The "minimal ANY responses" RFC (Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY, a.k.a. RFC 8482) results in about 1% of the TLD nameservers indicating they are minimizing ANY responses. That's (only) about 250 cases. What is troubling is that there are about 9 different responses observed to indicate the response is "minimized" 9 different ways in just 250 samples, "fuzzing" the protocol The morale of this tale is that "fuzzying" the protocol is worrisome.  (Not that minimizing ANY is a bad thing.)

According to the interwebs, Java is one of the most popular programming languages in the multiverse.
And yet, when it comes to games, its popularity seems to dwindle.

Why though...
Is it really not suited for game development?
Is the language as bad as the critics claim??
Is GC...EVIL!?

I have this side-project of porting Doom 3 from C/C++ to Java. And even though Doom 3 is a ~15 year old game, it is still a massive AAA code-base. So I believe my experiences there can adequately answer a lot of the questions that come to mind when you think of Java & Games.

During this talk, I will try to convince you that Java is a very viable game prototyping/development tool.
Either that, or will add more fuel to the flame...

Memory management is an extraordinarily complex and widely misunderstood topic. It is also one of the most fundamental concepts to understand in order to produce coherent, stable, and efficient systems and containers, especially at scale. In this talk, we will go over how to compose reliable memory heavy, multi container systems that can withstand production incidents, and go over examples of how Facebook is achieving this in production at the cutting edge. We'll also go over the open-source technologies we're building to make this work at scale in a density that has never been achieved before.

We will go over widely-misunderstood Linux memory management concepts which are important to site reliability and container management with an engineer who works on the Linux kernel's memory subsystem, busting commonly held misconceptions about things like swap and memory constraints, and giving advice on key and bleeding-edge kernel concepts like PSI, cgroup v2, memory protection, and other important container-related topics along the way.

Running databases in Kubernetes has come a long way.

Focusing on MySQL, we will explore the challenges and issues of running production databases in Kubernetes. We'll look at the opportunities and benefits of running in Kubernetes too. While rolling out a database is easy enough, things can get interesting when production tasks are undertaken. How do you achieve scaling – whether that's scaling up or down? How do you know that your latest backup will restore safely? We will also take a look at an open source solution for monitoring your database deployments, adding support for Kubernetes as a robust production environment.

Focusing on MySQL, we will explore the challenges and issues of running production databases in Kubernetes. We'll look at the opportunities and benefits of running in Kubernetes too. While rolling out a database is easy enough, things can get interesting when production tasks are undertaken. How do you achieve scaling – whether that's scaling up or down? How do you know that your latest backup will restore safely? We will also take a look at an open source solution for monitoring your database deployments, adding support for Kubernetes as a robust production environment.

Outline: - Introduction - Installing MySQL in Kubernetes - Scaling up, scaling down - Backup, restore, verification - An open source monitoring solution - What could possibly go wrong?

Takeaways: This presentation should encourage the audience to embrace the possibilities of running production databases on Kubernetes, and will help attendees understand the "do's and dont's" of such a deployment.

Incorporating new components into PCBs is a difficult task that often requires reading multiple datasheets and creating prototypes to get it right. The funny thing is: every engineer needs to re-read reference designs! Even though there are tens of thousands of designs with new components documented and available on Github. The reason: it is almost impossible to find a relevant project. The solution? Instead of using Github search, which only retrieves files by filename, our approach creates a local database that takes the search results from Github, and then parses the used components inside the PCB designs to index them. That way, you can easily search a component and get the most relevant designs as a reference.

This talk will give an overview of the software that was created, discusses the difficulties that were overcome and the potential for improvement in future work.

We have currently indexed 8,000 KiCad-projects on GitHub containing 37,000 electronic components as a proof-of-concept. The project was kindly supported by AISLER with a server instance for a prototype of the search engine, which can be accessed at https://search-dev.aisler.net

There is a need for a lightweight tools for experiments with RISC-V custom extensions. Adding support for custom instructions in binutils/gcc/llvm is out of range for many hardware architects. LuaJIT includes a small and powerful assembler: dynasm, accessible from within Lua interpreter. Currently dynasm supports following 32 and 64-bit instruction sets: x86, x64, ARM, PowerPC, and MIPS, and it is just reasonable to extend this support to RISC-V.

Lua itself is a very compact and simple yet powerful dynamic language, its JIT compiler (luajit) makes it one of the fastest, if not the fastest, interpreted language, and it is used in many projects, so having it running on RISC-V would have use besides the mere internal need for experimental platform.

Outline

Project scope

• Lua 5.1, luajit 2.1 overview
• rv32/rv64
• dynasm
• interpreter/virtual machine
• jit
• gc
• bit manipulation ('B' extention and bitop in Lua 5.3)

Develpment platforms

• spike (ISA simulator, 32 and 64-bit)
• rv64: SiFive Unleashed
• rv32: softcore CPU on FPGA

Benchmarks and baseline

Deviation (side project)

Yet another Forth and yet another assembler

Kubernetes (k8s) is currently the de-facto standard for containers orchestration. However, K8s does not provide any solution for handling containers networking. Instead, it offloads the networking to third-party certified plugins called CNI plugins. Contiv-VPP is a k8s CNI plugin that offers fast I/O by leveraging the carrier-grade capabilities of VPP and DPDK in the dataplane.

The adoption of containers and microservices calls for IPv6 to provide addressing and reachability for such massive number of endpoints. SRv6 leverages the IPv6 dataplane to provide overlay networking, traffic engineering, load balancing, network policy and service chaining.

In this talk, we present an SRv6-based solution for k8s networking. We will show how SRv6 is used for pod-to-pod communication, k8s services and service function chaining (SFC), and how SRv6 solves several k8s networking challenges. We will also show the integration of our solution in Contiv-VPP. This solution is the result of combined effort between Bell Canada, Cisco and Pantheon.tech.

Representing geographical time-space is a fundamental issue in geography, addressing core questions of the discipline, i.e. where are places and what distance separate them. Yet, considering the properties of geographical time space shaped by transport means, no satisfying cartographic representation – including classical maps and plastic space approaches – has been proposed so far. The "shriveling_world" project aims at producing images of the global geographical time-space, using the third dimension, as in time-space relief maps. The word "shriveling" was introduced by Waldo Tobler in his comments of Mathis-L'Hostis time-space relief image, in order to describe the complex contraction process suggested by the model. The FOSDEM presentation aims at opening the code to the scientific community, now that the application is close to a first functional version.

Shared editing is the ability to collaboratively edit the same text in real-time. The market for shared editing solutions is fragmented. Once you choose a solution you will be locked into using a specific editor and a specific backend. Yjs is a data synchronization framework that aims to enable shared editing in all open-source editors using any networking stack.

Yjs is a data synchronization framework that is specifically designed for creating shared editing applications like Google Docs. The number of editors, that Yjs supports, is steadily growing. At this time we implemented shared-editing support for six of the most prominent open-source rich-text editors - including Quill, ProseMirror, and CodeMirror. We are currently working on integrating Yjs in Gutenberg, the new WordPress editor.

Since Yjs is network agnostic and does not require a central authority to resolve sync conflicts, it is possible to use any networking stack to share document updates of the collaborative document. We created an ecosystem of modules that handle data synchronization over, for example, WebRTC, Dat Protocol, IPFS, and traditional client-server connections via WebSockets.

In this lightning talk, we want to show the huge potential of Yjs that hopefully will make it the go-to solution for creating shared editing applications on the web.

OpenTAP is a project aimed at automation in the test and measurement space. It is designed for test and measurement of hardware in R&D and manufacturing, but is moving more towards software testing e.g. with usage in cloud infrastructure testing. The project started as an internal product by Keysight Technologies and is used as the core of many products and solutions deployed around the world. As of 2019, we have released OpenTAP under the Mozilla Public License v2 and are working on building a community around it. The release was influenced by the team attending FOSDEM over the last few years, we will also welcome you for more detailed discussion at our booth on Saturday.

What we want is to grow an environment for people to share, leverage and co-develop test system plugins and solutions.

In this short talk, we will explain the basic concepts of OpenTAP, what it can be used for, and how to get started.

Making electronics accessible to the broad public was mainly made possible by Arduino, Raspberry PI and last but not least Fritzing. Back in 2009, it was a pain to get from a loose wiring on a breadboard to a PCB. Fritzing came up first with a unique breadboard view and a simple to use PCB layout. Fast forward 10 years to Fosdem 2019, Fritzing was in a major crisis. Despite well over 200.000 users, thousands of downloads per day and an enthusiastic community, development had stalled. It has now been rebooted, and the project is back to gaining momentum. So what has happened between last year and this year? This talk will give a rough introduction to Fritzing and its ecosystem, including how we overcame the problems, learned from our mistakes and how we plan to keep improving Fritzing in the future.

The design, implementation, and configuration of the secure logging service. Its aim is to provide tamper evident logging, i.e., to adequately protect log records of an information system against tampering and to provide a sensor indicating attack attempts. The secure logging service achieves this by authentically encrypting each log record with an individual cryptographic key used only once and protects integrity of the whole log archive by a cipher{based message authentication code. Each attempt to tamper with either an individual log record or the log archive itself will be immediately detected during log archive verification. Therefore, an attacker can no longer tamper with log records without being detected which greatly enhances the use of log archives in forensic investigations.

Log records are normally produced by any information system in order to perform monitoring during normal operations and for troubleshooting in case of technical problems. Log information is equally important for retaining the security of an information system, as security relevant events are recorded and can later be monitored for unusual patterns which may indicate an attack attempt. Examples include log on and log off, startup and shutdown, network service access, network filter rule application, storage access, etc. Log records may also contain valuable information about a system that a potential attacker intends to compromise. If an attacker is able to successfully compromise a system, they are also able to tamper with log records, potentially hiding their traces. This makes forensic analysis extremely difficult, as no reliable data source about system behavior immediately before the attack is available to a security analyst performing incident investigation. Therefore, log information should be appropriately protected. The aim of the secure logging service is to provide tamper evident logging, i.e., to adequately protect log records of an information system and to provide a sensor indicating attack attempts. The secure logging service achieves this by authentically encrypting each log record with an individual cryptographic key used only once and protects integrity of the whole log archive by a cryptographic authentication code. Each attempt to tamper with either an individual log record or the log archive itself will be immediately detected during log archive verification. Therefore, an attacker can no longer tamper with log records without being detected. ost information systems rely on standards in order to provide logging services. One of the most widely adopted standards is the syslog protocol which is specified in RFC 5424. Many implementations of this protocol are available. A popular extensible implementation with additional features is syslog-ng, which is an enhanced logging daemon with advanced features for input and output. Furthermore, it features capabilities for log message filtering, rewriting, and routing. It can be used as a drop-in replacement for existing log daemons on UNIX systems. The implementation of the secure logging service providing tamper evidence and confidentiality of system logs based on the template mechanism of syslog-ng is presented together with an application example.

Web mining, as represented mostly by the scraping & crawling practices, is not a straightforward task and requires a variety of skills related to web technologies. However, web mining can be incredibly useful to social sciences since it enables researchers to tap into a formidable source of information about society.

But researchers may not have the possibility to invest copious amount of times into learning web technologies in and out. They usually rely on engineers to collect data from the web. The object of this talk is to explain how Sciences Po's médialab designed & developed tools to empower researchers and enable them to perform web mining tasks to answer their research questions. Here is an example of issues we will tackle during this talk:

• How a social sciences laboratory life can be a very fruitful context for tool R&D regarding webmining
• How to create performant & effective webmining tools that anyone can use (multithreading, parallelism, JS execution, complex spiders etc.)
• How to re-localize data collection: researchers should be able to conduct their own collections without being dependent on external servers or resources
• How to teach researchers the necessary skills: HTML, the DOM, CSS selection etc.

Examples will be taken mainly from the minet CLI tool and the artoo.js bookmarklet.

Speaker

Guillaume Plique is a research engineer working for SciencesPo's médialab. He assists social sciences researchers daily with their methods and maintain a variety of FOSS tools geared toward the social sciences community and also developers.

Often when asyncio is discussed, people think of it as a high performance concurrency programming paradigm for Python. In this talk however, we approach asyncio from a different angle, one that will possibly help some of you to finally get what asyncio is about. it's not only about performance, but at least as much about correctness and readability of concurrent applications.

Concurrency is hard to get right.

Often when asyncio is discussed, people think of it as a high performance concurrency programming paradigm for Python. In this talk however, we approach asyncio from a different angle, one that will possibly help some of you to finally get what asyncio is about. it's not only about performance, but at least as much about correctness and readability of concurrent applications.

It is known that for multithreaded applications, synchronization is hard to get right. Doing it wrong can either lead to deadlocks or broken data structures.

We will have a look at how using asyncio is different from using threads, when it's better and what pitfalls we have.

This talk should be a good introduction for anyone just starting with asyncio, but can also clarify things for people that are using asyncio already. I expect people to have at least used some form of concurrency, either threads or an event loop like we have in JavaScript.

Productivity software like LibreOffice has long been sustained by the commercial activities of community members as well as the contributions of countless volunteers. That's also driven standards engagement, like the work around Open Document Format (ODF). But the cloud is slowly strangling the desktop support business, and spare-time volunteers may not be enough for complex, mature software. The Document Foundation has been innovating to sustain LibreOffice and ODF; this talk will describe the COSM and TDC projects, and ask whether similar approaches might sustain other open source desktop software.

Immutable infrastructure paradigm is often associated with relative new concept like containers and orchestrators like kubernetes. In this talk will be illustrate how to obtain the same result but using most of the classic concepts, tools and simple cloud platforms.

In particular will be shown the usage of:

• Terraform for the orchestration
• Packer for the creation of the instance image
• Simple shell scripts for the provisioning
• DigitalOcean as cloud platform

The illustrated approach is based on lessons learned in almost two years of using this methodology on a production service.

Python with LLVM has at least one decade of history. This session will be going to cover-up how python implementations tried to use LLVM such as CPython's Unladen Swallow branch (PEP 3146) or attempts from PyPy and why they failed. After that it will show what are the current python projects that use LLVM for speed, such as numba and python libraries for working with LLVM IR. In the end, it will mention about new ideas that would unite the powers of both LLVM and Python.

This talk is about LLVM's influence over Python's ecosystem. It is targeted an audience of language developers who want to integrate LLVM and developers who are curious about why dont dynamic languages can unite their power with LLVM to speed-up. It will start with python's implementations and the approaches they take. The Unladen Swallow branch which basically tries to integrate LLVM to CPython (under google sponsored) is a good example of these approaches. There are attempts from the PyPy side but they are also failed because of the dynamic nature of Python. After this fails, we'll swap back to our current time and show projects that are benefiting from LLVM to speed up python especially on the scientific side such as numba (which offers JITting via LLVM). Besides these projects, there are also a few projects that offer an interface to LLVM. Such as llvmpy and llvmlite. I've been using llvmlite about 1 year in my side projects and toy languages so these projects has the potential to inspire developers to work with LLVM and build languages a-top on it. In the end, it will show what is the future of these two big projects (LLVM & Python) and how we can participate.

ALTER TABLE in MySQL used to copy the table contents row by row. We can do much better; in the best case, allow instantaneous schema changes, even for nontrivial changes, such as ADD COLUMN…AFTER and DROP COLUMN. This talk describes how ALTER TABLE has been improved over the years for the InnoDB storage engine in MySQL 5.1, 5.5, 5.6, 5.7, and MariaDB Server 10.2, 10.3, 10.4, 10.5, mostly by the presenter.

The talk enumerates different classes of ALTER TABLE operations:

1. operations not involving other than metadata
2. operations that can be performed instantly by introducing a backward-compatible data file format change and 'faking' the operation (ADD or DROP COLUMN)
3. operations that can avoid rebuilding a table
4. operations that must rebuild the table
5. variations of the previous 2 classes that allow concurrent modifications to the table

We also show how ALTER TABLE can be executed concurrently on multiple nodes in statement-based replication. Finally, we cover some theoretical limits of what kind of ALTER TABLE operations can be supported without rebuilding the table, by introducing an optional validation step and on-demand conversion of records in previous schema versions of the table.

We'll show a real demonstration of how you can encrypt your data and collaborate with others in real-time using the CryptPad Open Source project. This demonstration will include real-time Wysiwyg, Text, Kanban, Spreadsheet, File storage and Teams features allowing to share your documents securely with your friends and co-workers.

The Internet business model is about "surveillance capitalism" and every day our data is being used to target us with more and more invading advertisements, and every day data is being leaked by Internet business and cloud providers.

CryptPad is using end-to-end encryption to protect your data, while including innovative algorithms to allow collaboration between users. With CryptPad, the cloud hoster cannot read your data and if data leaks, hackers only get encrypted data which they cannot read without the keys.

Start ditching proprietary privacy invading cloud services for an free software privacy protecting alternative.

Come join the 20000 weekly users of the cryptpad.fr main instance and the 300 other instances available, including the German Pirate Party and C3 Wien instances.

Come join us restoring our privacy.

LXD is a system container manager, its goal is to safely run full Linux systems at very high density and low overhead. Containers may be created from pre-made images, covering most Linux distributions, or by importing an existing virtual machine or physical system.

Advanced resource control and device passthrough is available to expose as much or as little system resources to those containers. Snapshot and backup tooling is available to safeguard those containers and data. Storage pools and networks can be used to offer a variety of storage and network options to the containers.

Management happens through a REST API with a default CLI client. LXD has built-in support for clustering which makes it trivial to scale a deployment to dozens of servers, all acting as one virtual LXD server.

In this presentation, we'll go over LXD's main features through a demonstration including usage of LXD's clustering abilities, running a variety of Linux distributions and converting existing systems to containers.

This presentation describes sparselizard: a fast, general, robust and user-friendly finite element c++ library with high potential for low-maintenance integration to open-source simulation tools. It is demonstrated with a large range of validated examples that the library has the ability to simulate heavily nonlinear multiphysics problems involving at least mechanic, fluid, electric, magnetic and electromagnetic physics. Its robustness, speed and user-friendliness are also demonstrated.

The GraalVM project provides, among other options, a means to deliver Java programs as compact, self-contained, fast-startup native images. GraalVM has been moving from research to development for quite a few years now. However, it is only just beginning to be properly integrated with the latest OpenJDK releases and there is still much to be done to get it fully productized and to improve usability and performance.

This talk will recount our joint experiences of trying to add new and/or improved capabilities to the the GraalVM code base. Our story will stumble gracelessly from one pitfall to the next cock-up in the hope that by exposing and explaining our own history of lamentable error and occasional failure you will be able to avoid being doomed to repeat it.

We will provide a guide to getting started and building GraalVM, an overview of the how the compiler, native image generator and other elements of the GraalVM toolkit operate plus a map of what code sits where in the source tree and how it fits together and offer tips for debugging the Graal compiler and native image generator -- all the tasks you will need to perform in order to attain a vantage point from which to change or add to the current functionality.

A quick introduction to the 3rd edition of the retro-computing devroom.

Historically, the UEFI forum has been a bit rubbish at interacting with open source development, but this is improving.

This talk gives a background on why (both the rubbish and the improvement) and what is being done.

Also, a brief update on news for the TianoCore/EDK2 project.

After much lawyerly fun, the UEFI Self-Certification Testsuite (SCT) was released under an OSI license (BSD2) at the end of 2018. We will explain why this is useful, and how this has helped with the addition of UEFI support in U-Boot, as well as helped improving EDK2 code quality.

We have a new process, referred to as "code first" for drafting changes to the UEFI spefication in public. This will give an overview of the process, as well as one of the first exercises of it - the definition of audio APIs (for accessibility or, you know, DOOM).

Also, an update on changes in the EDK2 reference implementation, including dropping the CLA and upcoming RISC-V support.

And finally Ard Biesheuvel will give a quick overview of a plan to unify the Linux kernel boot protocol on EFI platforms across architectures.

Boomerang is an open-source Real User Monitoring (RUM) JavaScript library used by thousands of websites to measure their visitor's experiences. The developers behind Boomerang take pride in building a reliable and performant third-party library that everyone can use without being concerned about its measurements affecting their site. We recently performed and shared an audit of Boomerang's performance, to help communicate its "cost of doing business", and in doing so we found several areas of code that we wanted to improve. We'll discuss how we performed the audit, some of the improvements we've made, how we're testing and validating our changes, and the real-time telemetry we capture for our library to ensure we're having as little of an impact as possible on the sites we're included on.

Boomerang is an open-source Real User Monitoring (RUM) JavaScript library used by thousands of websites to measure their visitor's experiences.

Boomerang runs on billions of page loads a day, either via the open-source library or as part of Akamai's mPulse RUM service. The developers behind Boomerang take pride in building a reliable and performant third-party library that everyone can use without being concerned about its measurements affecting their site.

Recently, we performed and shared an audit of Boomerang's performance, to help communicate the "cost of doing business" of including Boomerang on a page while it takes its measurements. In doing the audit, we found several areas of code that we wanted to improve and have been making continuous improvements ever since. We've taken ideas and contributions from the OSS community, and have built a Performance Lab that helps "lock in" our improvements by continuously measuring the metrics that are important to us.

We'll discuss how we performed the audit, some of the improvements we've made, how we're testing and validating our changes, and the real-time telemetry we capture on our library to ensure we're having as little of an impact as possible on the sites we're included on.

Agenda

1) Current situation: complicated & incomplete threat models 2) Concepts worth looking into 3) data sovereignty 4) named data networks 5) zero trust 6) Our hands-on experience with the above

The current state of play to protect data is a tedious task that involves many stakeholders and blocks resources. The shift from on-premise to private/public cloud systems requires a careful inspection of an assumed threat model. The application of a zero-trust model is one radical shift to authenticate and authorize at any given point in your IT landscape, but most importantly it breaks with the assumption that we can design systems that are "safe and secure". The talk will highlight the above mentioned concepts and will give a brief outline of a new approach called Named Data Network (NDN) and how this could improve the situation in terms of data sovereignty.

This talk focuses on how Ansible and Foreman integrate with each other and what added value can the users get when using Ansible from Foreman. It describes two primary approaches of using Ansible from Foreman. The first is a traditional configuration management approach, where hosts are kept in a predefined state, while the other works in a more remote execution fashion. The talk goes over several scenarios and demonstrates how Foreman can leverage Ansible to effortlessly solve the issues present in the given scenarios.

This talk focuses on how Ansible and Foreman integrate with each other and what added value can the users get when using Ansible from Foreman. It describes two primary approaches of using Ansible from Foreman. The first is a traditional configuration management approach, where hosts are kept in a predefined state, while the other works in a more remote execution fashion. The talk goes over several scenarios and demonstrates how Foreman can leverage Ansible to effortlessly solve the issues present in the given scenarios.

Kubernetes is complex, and extremely vulnerable. In 2019 we explored the complexity of the Kubernetes codebase, and the antipatterns therein. This year we want to look at understanding how we observe our cluster at runtime. Let's live code some C and C++ and explore the libraries that bring Wireshark, Falco, and Sysdig to life. We concretely demonstrate how we are able to audit a Kubernetes system, by taking advantage of auditing the kernel's syscall information while enriching this data with meta information from Kubernetes.

We start off by presenting the problem of Kubernetes security at runtime. We discuss concerns with namespace and privilege escalation in a Kubernetes environment. We discover how auditing the kernel gives us visibility into both the container layer, as well as the underlying system layer.

We look at building an eBPF probe, or kernel module to begin auditing syscall metrics. We discover how we are able to pull those out of the kernel into userspace, and start exploring powerful patterns for using these metrics to secure a Kubernetes cluster.

The audience walks away understanding how the kernel treats containers, and how we are able to easily make sense of them. The audience also walks away equipped with an OSS toolkit for understanding, observing, and securing a Kubernetes environment.

We present: 1) a full pipeline for unsupervised machine translation training (making use of monolingual corpora) for languages with low available resources; 2) a translation server making use of that unsupervised MT with an HTTP API compatible with Moses toolkit, a once prominent MT system; 3) a Docker packaged version of the EU funded free Computer Aided Translation (CAT) tool MateCAT for ease of deployment. This full translation pipeline enables a non technical user, speaking a non-FIGS language for which there is scarcity of parallel corpora, to start translating documents and software following translation industry standards.

Localization within community suffers from the fragmentation of technologies (too wide wedge between commercial Computer Aided Translation tools and free ones), available language resources (making difficult to train a Machine Translation) and lack of clear and robust pipelines to get started. Low resource language communities suffer the most, since MT systems require training corpora of millions of words and industry has settled to expecting the massive corpora available to FIGS (French, Italian, German, Spanish) languages. Moreover, the community suffers from a lack of adoption of established technologies and workflows, leading to reinventing the wheel and suboptimal efforts’ outcomes. Today we would like to present a connector for the implementation of an unsupervised MT (made by Artetxe et al.), that claims a BLEU of 26 on limited language resources (which is enough as a support system) integrated with MateCAT, an industry level, free, web based tool funded by EU, in order to provide a more viable alternative to resorting to Google Translate and commercial LSPs.

For as long as computers have been around, roughly every 10-15 years, the whole industry underwent a reset and reinvented itself anew… until the early 1990s, when somehow, the industry skipped a generation. Instead, it looked backwards, and adopted an older model of computing. The cost has been very high and is holding back the development of the entire field.

This talk looks at how we turned to the past instead of the future, what we missed out on as a result, and how to move forward. It follows on from the above proposal, but takes a different tack and should stand alone. It looks at where personal computers might have – but didn’t – go in the 1980s and 1990s. At a sampling of advanced OS technologies that never caught on – Plan 9, Inferno, Taos, Oberon – and the cool stuff we lost out on as a result.

It will end with trying to identify the next such generation gap, and why we should consider starting afresh rather than adapting current tech for the next gen.

As recent events, such as the leftpad incident and the Equifax data breach, have demonstrated, dependencies on networks of external libraries can introduce projects to significant operational and compliance risks as well as difficult to assess security implications. FASTEN introduces fine-grained, method-level, tracking of dependencies on top of existing dependency management networks. In our talk, we will present how FASTEN works on top of the Rust/Cargo and Java/Maven ecosystems.

Tasks in Ada are effective to speed up computations on multicore processors. In writing parallel programs we determine the granularity of the parallelism with respect to the memory management. We have to decide on the size of each job, the mapping of the jobs to the tasks, and on the location of the input and output data for each job.

A multitasked Newton's method will show the effectiveness of Ada to speed up the computation of power series. This application belongs to the free and open source package PHCpack, a package to solve polynomial systems by polynomial homotopy continuation.

Python has proven to be a popular choice for data scientists in the domain of graph analytics. The multitude of freely available frameworks and python packages allow to develop applications quickly through ease of expressibility and reuse of code. With petabytes of data generated everyday and an ever evolving landscape of hardware solutions, we observe a graph processing framework should expose the following characteristics: ease of use, scalability, interoperability across data formats, and portability across hardware vendors. While existing python packages have been helping to drive application development, our assessment is that none of the packages address all the aforementioned challenges. We propose a community led, open source effort, to design and build a graph processing python library to specifically address these challenges.

Open Document editing is, as many things in life, more and more an online action. Collabora introduced the important first steps in 2015. Since then much work has been done and LibreOffice and Collabora Online grew enormously in possibilities. This presentation will guide you trough the various areas. And in the Q&A, lets talk about expectations for the future.

OpenRefine is a data transformation tool popular in many communities: data journalism, semantic web, GLAMs, scientific research… In this talk I give an overview of our recent efforts to revamp this project as it approaches its 10th anniversary. We are working on exciting improvements which should help alleviate some of the most salient issues faced by our users. My intention is not to lecture the attendance about how to deal with technical debt or to grow a contributor community - I instead seek feedback and spark discussions about our choices. Let us know what you think and help us take good care of this fantastic tool!

Learn how to scrutinize your Python application in order to optimize them and make them run faster.

Getting inside knowledge of how your Python application runs is critical in order to achieve the best performance. Profiling is a mean to achieve this: by gathering all the runtime information available about the execution of your program, you might be able to understand how to optimize it. However, profiling running code in production might be a real challenge as it requires the profiler to be noninvasive and having low overhead.

Therefore, to profile production services, statistical profiling is the favorite analysis method. By regularly checking your program activity, you’ll be able to find production code bottlenecks down to the line of code. Profiling services that are running with real workload makes sure that you are collecting valuable data and that you are not guessing what the performance barrier might be.

This talk explains how it’s possible to build a statistical profiler that collects information about CPU time usage, memory allocation, and other information — all that while respecting the need for low overhead, data export format, and granularity. We’ll dig into some of the operating systems and CPython internals to understand how to build the best profiler possible.

tl;dr - contribute to a community management guide written for practitioners, by practitioners; bring your internet-enabled device.

Whether you are a community manager or any other contributor to a free/libre open source software (FLOSS) project, you'll find yourself learning and thinking of good methods and practices for having a happy, successful, and productive project. Community managers and members share these practices with each other all the time -- in talks, in person, as blog posts, and sometimes as a stand-alone book. But has anyone ever really collaborated on a guide that is for practitioners and collaboratively written BY practitioners?

Actually, yes: 10 years ago The Open Source Way 1.0 was written and released. In the passage of that decade, the best practices around caring for FLOSS projects have evolved, as has the work of the people in those community shepherding roles.

We have embarked on a revamp to this guide, and we invite you to comelearn about, participate in, and contribute to this living document real-time during this BOF.

We will begin the BOF with a brief introduction to the guide itself, what is covered within it currently, and an overview of the narrative being told from/to community management practitioners. We'll then get hands-on with the contribution process, starting with a walk through for what is needed for the 2.0 release. After we do some real-time submissions to the guide, the BOF participants can begin working together in small groups or individually on portions of the guide, including both content and publication toolchain.

Applications and services rely on configuration data in order to be customized and we will talk about how to keep them in a safer place other than plaintext configuration files.

The configparser module is Python's standard configuration file parser and many projects rely on it to achieve easy configuration with plaintext files. OpenStack Common Libraries (Oslo) has an alternative called oslo.config with additional sources of input like command line arguments or environment variables. With the addition of a feature called source drivers last year, we are now able to increase the security of configuration values storing them in a safer place.

This talk focuses on the new source driver that integrates Oslo.Config and Castellan, another Olso module specialized in talking to secret managers, and how we can store our sensitive configuration data using HashiCorp Vault.

Alpha Waves is the first 3D platform game ever, according to the Guiness Book of Records.

Initially developed on Atari ST, it was then ported on Amiga and on the IBM PC. The technology later gave rise to Alone in the Dark, a major game that launched Infogrames in the big league. This is the history of that game.

The game was initially developed on Atari ST, representing 17000 lines of 68K assembly code. It was later ported on Amiga and on the IBM PC, and was the first and only assembly program game that Infogrames ever ported to another CPU. The technology developed for that game later inspired Frederick Raynal to develop Alone in the Dark, a major game that launched Infogrames in the big league.

This talk is the history of that game by its developer. It will cover:

• General principles of paleo-3D

• How to draw polygons in software. Fast.

• Computing 3D transforms using mostly additions

• Music, graphics and other stuff

• Funny stories and trivia around the game, including the stints of Infogrames in Artificial Intelligence and the arch-genesis of Alone in the Dark

Since several years, software quality tools have evolved, CI systems are more and more scalable, there are more testing libraries than ever and they are more mature than ever and we have seen the rise of new tools to improve the quality of code we craft.

Unfortunately, most of our CI system still launch a script and check the return code, most of the testing libraries don't allow to select finely which tests to launch and most of CI advanced innovations, parallel running, and remote execution, are not available to developers on their workstation.

Each language community has its own set of tools, libraries, and command-line and visual interfaces increasing the effort for developers to learn or learn again how to write, run and debug tests in each language.

How to improve the situation? In this talk, I will present one of my project LITF (https://github.com/Lothiraldan/litf) a new protocol for test running and test output as well as BALTO (https://github.com/lothiraldan/balto), a test orchestrator using this new format. Thanks to this new format, BALTO can execute several test suites in different languages, remotely on a Kubernetes cluster and all in parallel. In any case, this is the goal of the stable version.

To boot Linux on a new ARM/ARM64 platform we have to port Linux to that platform and a bootloader. Aside from the platform setup code, we need to add and maintain some device drivers to both Linux and the bootloader. We decided to avoid the extra effort and get rid of the dedicated bootloader. With a few dozen lines of assembly code, Linux Kernel and a pinch of userland tools the "boot" kernel was running with all the cool features we wanted! Then we used kexec(2) to start a "full" Linux kernel.

How to boot Linux and nothing else

To boot Linux on a new ARM/ARM64 platform we have to port Linux to that platform and a bootloader. Aside from the platform setup code, we need to add at least some platform specific device drivers both Linux and the bootloader and maintain the drivers in both trees. We decided to avoid the extra effort and get rid of the dedicated bootloader.

We took a widely available Odroid XU4 board and replaced bootloader (U-Boot) with a few dozen lines of assembly code, Linux Kernel and a pinch of userland tools. The "boot" kernel was running with all the cool features we wanted! Then we used kexec(2) to start a "full" Linux kernel.

Dedicated bootloaders perform two types of tasks: platform specific setup and management (starting an OS, managing OS updates). We show that Linux is a better environment to implement management proccedures.

We want to share our experience and encourage others to join our effort to use Linux Kernel as a bootloader on ARM/ARM64 platforms.

Target audience

The presentation is meant for everyone interested in how the Linux Kernel handles the boot process and especially developers who commit to arch/* directories, and bootloader developers. We present our experience with ARM Odroid XU4 board, but we expect people working on other platforms will benefit too.

How we want to improve the ecosystem

Development of new bootloading code for ARM and other embedded platforms. We believe using Linux kernel for this task is beneficial in three different ways. Less platform specific code needs to be created and maintained in different repositories. General purpose code like filesystem drivers or network stack are maintained better in Linux than in U-Boot. This, as well as wide verity of libraries makes Linux better environment to develop advanced management functions (e.g OS updates, security checks etc.) in contemporary bootloader.

Blueprints in the Kubernetes-Native Infrastructure Blueprint Family leverage the best-practices and tools from the Kubernetes community to declaratively manage edge computing stacks at scale and with a consistent, uniform user experience from the infrastructure up to the services and from developer environments to production environments on bare metal or on public cloud.

All blueprints in this family share the following characteristics:

• K8s Machine API: declarative API to manage a configure the infrastructure of a cluster.
• Operator Framework: automated and secure lifecycle of applications running on the edge stack.
• Kubernetes-native workloads: allowing the mix of CNFs and VM-based workloads via Kubevirt.

Come and see the leading edge!

Launched in 2018, Akraino Edge Stack aims to create an open source software stack that supports high-availability cloud services optimized for edge computing systems and applications.

As part of the Akraino project, Kubernetes-Native-Infrastructure blueprint family represents the reference edge stack managed as a declarative platform, where controllers monitor a system for deviations between the user-declared target state and reality and take corrective actions to reconcile reality with the declared target state.

KNI blueprints cover up two different use cases:

• Provider Access Edge: as part of the network transformation, telco operators are moving to run its radio access network in a cloud-native manner. Technologies like vRAN will be only possible with a declarative approach, and leveraging open networking best practices.

• Industrial Edge: workloads such IoT, AI/ML, AR/VR, and ultra-low latency control will be run in the edge. These workloads will require specific hardware such GPUs and FPGAs. KNI can show how this needs can be a reality today.

With Kubernetes Native Infrastructure learn about the k8s way of managing infrastructure. By defining a declarative state, the edge administrator will be able to manage thousands of sites by following an innovative GitOps approach.

If you are interested in these exciting topics, don't miss the talk!

Although KMS/DRM can replace the Linux Framebuffer, there are a number of programs and libraries that can be built on top of the Linux Framebuffer (without X11 or Wayland dependencies) and that might still be worth considering. The Linux Framebuffer allows direct access to pixels: we will illustrate it with various rendering tools (Fbpad, Fbi, NetSurf, MPlayer, ...), but also with drawing libraries such as Cairo or Evas, and multimedia frameworks like FFmpeg or GStreamer. The Mesa 3D project makes OpenGL rendering possible using only the Linux Framebuffer with GLFBDev or EGL: mesa-demos and yagears programs will be shown. We will then cover graphics libraries (GLUT, SDL, EFL, GTK, Qt) that allow to integrate high level applications running directly on top of the Linux Framebuffer with no compositor. An example will be described using either WebKitGTK or QtWebKit for the rendering of a HTML5 media player and a WebGL sample, using the Linux Framebuffer port of those libraries and toolkits. This talk is inspired by the HiGFXback project which aims at preserving historical backends used for graphics on GNU/Linux systems.

We have seen several licenses proposed as "open source" that carry some obligation or restriction related to ethics or other social goals. Is this a good direction for FOSS license drafting?

Affirmative position: FOSS licenses should advance social goals

1. First Affirmative Constructive (1AC) = 7 minutes a. Cross-examination of First Affirmative by Second Negative = 3 minutes
2. First Negative Constructive (1NC) = 7 minutes a. Cross-examination of First Negative by First Affirmative = 3 minutes
3. Second Affirmative Constructive (2AC) = 7 minutes a. Cross-examination of Second Affirmative by First Negative = 3 minutes
4. Second Negative Constructive (2NC) = 7 minutes a. Cross-examination of Second Negative by Second Affirmative = 3 minutes
5. First Negative Rebuttal (1NR) = 3 minutes
6. First Affirmative Rebuttal (1AR) = 3 minutes
7. Second Negative Rebuttal (2NR) = 3 minutes
8. Second Affirmative Rebuttal (2AR) = 3 minutes

For some arcane reason contributors spend their precious time on open source game projects. Why do they do this? And more importantly: What can you do to make them do it on your project?

FOSS game projects live on the motivation of their contributors. This motivation usually consists of two parts: The desire to contribute to FOSS game development in general and the desire to contribute to a specific project. While the former is very interesting to discuss, our ability to affect it is negligible. Thankfully, the control of the latter is definitely possible, and it is crucial to the survival of our projects. In this talk we will analyse different characteristics of FOSS game projects with regards to contributor recruitment and retention. We will try to present practical steps to lower the risk of your current or future projects dying to inactivity and obscurity.

Imagine, you're given a time machine. A fairly limited one, it cannot transport you anywhere. Still, it can show you the past, what your tables looked like at any given point in time. This is exactly what the SQL:2011 standard and MariaDB 10.3+ are giving you. System versioned tables allow you to rewind time and see their content as it was in the past — all using normal SELECT statements. This talk will show how to create system versioned tables, how to use them and how not to kill the performance when doing that. It will present various new applications and use cases that became possible now. Having a time machine, what will you use it for?

Imagine, you're given a time machine. A fairly limited one, it cannot transport you anywhere. Still, it can show you the past, what your tables looked like at any given point in time. This is exactly what the SQL:2011 standard and MariaDB 10.3+ are giving you. System versioned tables allow you to rewind time and see their content as it was in the past — all using normal SELECT statements. This talk will show how to create system versioned tables, how to use them and how not to kill the performance when doing that. It will present numerous different applications and use cases that became possible now. Having a time machine, what will you use it for?

This talk details low level exploitable issues with container and Kubernetes deployments. We focus on lessons learned, and show attendees how to ensure that they do not fall victim to avoidable attacks.

Andy has made mistakes. He's seen even more. And in this talk he details the best and the worst of the container and Kubernetes security problems he's experienced, exploited, and remediated.

See how to bypass security controls, exploit insecure defaults, evade detection, and root clusters externally (and more!) in this interactive and highly technical appraisal of the container and cluster security landscape.

Open Cascade Technology is a framework for B-Rep modeling. The presentation highlights key features available in the toolkits. The following topics are covered: - What is OCCT? - Development facts - OCCT architecture - Modeling algorithms - Visualization - Data exchange - Versions history

This talk introduces Flang (F18), the new Fortran frontend of LLVM being written in modern C++. The talk will provide a brief introduction to Flang, motivation for writing this new compiler, design principles, architecture, status, and an invitation to contribute.

F18 project started at PGI/Nvidia as a new Fortran frontend designed to work with LLVM. The aim of the project is to create a modern Fortran frontend (Fortran 2018 standard) in modern C++. In April of this year, it was accepted as an LLVM project (https://lists.llvm.org/pipermail/llvm-dev/2019-April/131703.html).

The parser and semantic analysis are implemented in a way that provides a strong correspondence to the standards document. It is hoped that this correspondence will help in the development of new features and will become the testbed for deciding future Fortran standard features. The frontend also embraces the newly open-source MLIR framework for language-specific optimisations. This will be through a new dialect call FIR (https://www.youtube.com/watch?v=ff3ngdvUang). MLIR will also be used for creating an OpenMP dialect. The project also hopes to share code with the Clang frontend. While the parser/AST will not be shared, code will be shared in the Driver, OpenMP codegen etc.

In this presentation, we hope to cover the technical details mentioned in the paragraph above, the status of implementation and also give an invitation to contribute.

The Bazel build system sandboxes each action (e.g. each compiler invocation) to ensure the action only has access to declared inputs and that the action only generates the promised outputs. This ensures that the execution of each build tool is deterministic and not subject to system-wide state. Unfortunately, creating these sandboxes is costly, and every millisecond added to the runtime of each action has a large impact on total build time. Just consider that Bazel focuses on large-ish builds with thousands of actions in them: each little inefficiency quickly multiplies and can result in significant slowdowns, and developers always want faster build times. In this talk, I'll explain how Bazel implements sandboxing and I will cover a FUSE file system I've been developing, sandboxfs, to optimize this process. I'll go into the details of the file system, explain how it started as a Go project and was then rewritten in Rust, and then show some performance metrics.

Outline:

• Brief introduction to Bazel: what are actions.
• Why is sandboxing of actions important and what it intends to achieve.
• How does sandboxing work in the default case and what problems it carries performance- and correctness-wise.
• The solution: how we can use FUSE to eliminate the major source of slowdowns.
• Brief explanation of what sandboxfs is and how Bazel takes advantage of it.
• Present performance metrics.
• Delve a little bit into why the project started in Go and was then rewritten in Rust.
• Ideas for other possible uses for sandboxfs (NixOS and reproducible package builds).

In this talk we'll explore ways that the JVM can reduce the object allocation rate of Java programs automatically by performing stack allocation of objects that are known to be local to a method, or in compiler terms non-escaping. The discussion is focused on employing the escape analysis optimization in the OpenJDK Hotspot C2 compiler to determine which Java objects can be stack allocated, and how this optimization can reduce pressure on the Java JVM garbage collectors.

We'll show some results on how various real world applications can benefit from such optimizations and describe the methodology of how we prototyped this in OpenJDK. Our work is only in prototype state at this moment and we are looking for more data to understand how broadly applicable this optimizations is. This work wouldn't be possible without free open source access to Java.

Graffiti is the graph engine of Skydive - an open source networking analysis tool. Graffiti was created from scratch to provide the features required by Skydive : distributed, replicated, store the whole history of the graph, allow subcribing to events on the graph using WebSocket and visualization.

Skydive (https://skydive.network) is an open source analysis tool. It collects information about an infrastructure topology - such as network interfaces, Linux bridges, network namespaces, containers, virtual machines, ... and store them into a graph database called Graffiti (https://github.com/skydive-project/skydive/tree/master/graffiti)

The graph is :

- distributed : some agents only have a portion of the graph
- replicated : for high availability and load distribution
- historical : every change on the graph is archived, allowing retrieval of the graph at any point in time or getting all the revisions of a set of nodes and edges during a period of time

A custom implementation of the Gremlin language is used to query the graph, with some additional steps to specify the time context of the query for instance.

In addition to the core engine, a WebSocket based user interface - based on D3JS - is available to visualize and interact with the graph.

This presentation will showcase a demo of Graffiti and try to advocate its use in your own project.

Reactive Programming is an event based programming method. ReactiveX is a cross-platform implementation of Reactive Programming. It is heavily inspired from functional programming and contains many operators that allow to create, modify, and combine streams of events. Moreover it is composable and extensible. This short introduction presents Reactive Programming through RxPY, the Python implementation of ReactiveX.

The aim of this talk is to present RxPY to people that never used it, or used RxPY v1:

• Reactive Programming, ReactiveX, and RxPY
• The Reactive Hello World
• How to deal with errors
• how to deal with concurrency
• A real life example

The Genode OS framework is an open-source tool kit for building highly secure component-based operating systems scaling from embedded devices to dynamic desktop systems. It runs on a variety of microkernels like SeL4, NOVA, and Fiasco OC as well as on Linux and the Muen SK. But the project also features its own microkernel named "base-hw" written in C++ like most of the Genode framework.

Spunky is a pet project of mine. Simply put it's an approach to re-implement the design of the "base-hw" kernel first in Ada and later in SPARK with the ultimate goal to prove its correctness. It is also an opportunity to learn how Genode can benefit from Ada and SPARK in general and promote the use of safety-oriented languages in the project.

The community seems to be rife with conversations about our sustainability problems. Do we actually have one? We’ll lead a discussion and debate around how we as a community can think about these issues, while drawing out the nuanced aspects of each as well as their potential solutions.

When something like left-pad or event-stream happens, how much responsibility should be taken on by companies who deployed a dependency that was critical enough to their operations that removing it created immediate crisis, but not well supported or understood enough that there was any kind of mitigation strategy or backup plan?

And yet, when you look at OpenSSL, curl, and other pieces of open source infrastructure that live in our dependency chains, there are many examples of projects that are important enough to be critical, but are under-resourced to the point that maintainers are having to make quality-of-life tradeoffs to stay on top of the project. We are responsible for ensuring that our shared dependencies are sustainably developed. But who is holding us accountable?

If a maintainer is driving themselves to burnout because they are supporting too many of their open source projects, don’t they bear some responsibility for that choice?

But how are we supposed to untangle which of the thousands of dependencies that we use are in most need of support - and what kind of support they prefer?

Is there a sustainability problem in FOSS after all?

This presentation will be co-presented with Duane O'Brien, Head of Open Source at Indeed.com, the world’s #1 jobs site.

This talk is a late addition that replaces "The Role of Open Source Frameworks in Quantum Computing and Technologies" by Jack Hidary.

Are you a sysadmin and feeling paranoid? Let's promote security hardening to another level. Perhaps, with the concept of Application Whitelisting you will be able to sleep again.

In this session we are going to explain the Application Whitelisting idea and its implementation, what benefits are there from a security point of view and how it differs from competitors. We are going to show how to create a new set of rules based on distribution default for given examples. As a result, an attendee should be able to setup the Application Whitelisting framework on his server or workstation.

This presentation is based on Red Hat/Fedora Linux environment.

We will showcase Grafoscopio, a flexible, extensible, self contained "pocket infrastructure", which simplifies infrastructure to amplify participation, so reproducible research and publishing, agile data storytelling and custom data visualization can be used in fields like investigative journalism, data feminism and civic hacktivism. We will show prototypes developed with Grafoscopio in the previously mentioned domains, the motivations behind Grafoscopio and the local community practices around it that deconstruct binary relations of power (software developer/user, data producer / consumer, software binary / source code, male/female) and approach reproducible research practices and tools from a perspective located and embodied in a particular place of the Global South in Latin America and in contrast/dialogue with Global North perspectives.

Reproducible research (and publishing) has been confined mostly to academic places. But it has a lot of potential in several other places like investigative journalism, data feminism and civic hacktivism, as we have showcased by building several prototypes, including: making the so called "Panama Papers" data leak story reproducible; creating domain specific visualizations for medicine information released by 16 governments; porting the Spanish Data Journalism Handbook and the Data Feminism book to our "pocket infrastructures" and the creation of agile and resilient tools and practices to write and publish together (see proposal links for a detailed view of such prototypes).

To bridge reproducible research and publishing, agile data storytelling and custom data visualization, with the previously mentioned domains, we have co-designed, developed, used and extended a set of inclusive approaches and tools for/from the Global South, that we have called "pocket infrastructures". Our "pocket infrastructures" simplify infrastructure to amplify participation, and they are mostly self contained, flexible, extensible, and work well with good, low or non connectivity and run from a variety of hardware, from a USB drive, to low end computers, to servers and the "cloud" and anything in between and beyond. This is in sharp contrast with exclusionary approaches like "Big Data" or others that start with big and/or overcomplex infrastructures and are getting traction in the Global North (or are being imported from there to the Global South as the "only way" forward regarding reproducibility).

Grafoscopio is one of such pocket infrastructures for reproducible research and publishing, agile visualization and data storytelling and this lecture will showcase Grafoscopio, the motivations behind it, and some prototypes developed with it, and the community practices that allow the development of such projects and prototypes deconstructing also binary relations of power (software developer/user, data producer / consumer, software binary / source code, male/female).

Update: this talk has been proposed by Offray Luna who unfortunately couldn't make it to FOSDEM. Santiago Bragagnolo will present this talk on his behalf.

Collabora Online - The driving force behind putting LibreOffice in the cloud -is quite flexible in the means that you can alter to your personal taste without the need to change other core components.

Collabora Online - The driving force behind putting LibreOffice in the cloud - is quite flexible in the means that you can alter to your personal taste without the need to change other core components. Tag along and see how can you customize Online's look and feel without a sweat and using mainly CSS, SVG! Don't know much about web technologies? No problem! There is no requirement to be eligible to attend, as I'll be talking in a casual fashion and with examples and hopefully illustrate each step of the way.

Using Terraform is often simple, extending it to do what YOU want, can be challenging (or “impossible”). Want to manage unsupported resources? Maintain lots of resources? Integrate non-integrable? The talk is an advanced guide about HOW to extend, integrate and execute Terraform to get things DONE.

If you’ve been using Terraform just by following the official documentation, you are not getting all from it.

As soon as one cloud provider announces a new service or a feature, you dream that Terraform has zero-day support for it. Well, it is not always like this, and I will show what we can do about it.

Are you using Terraform and keep asking yourself why I should copy-paste so much? What if you need to manage more than a dozen resources with Terraform (e.g., hundreds of GitHub repositories with permissions, or hundreds of IAM users and their permissions)? How can I use Terraform to manage absolutely ANY type of resource? What is beyond Terraform modules? What is a really dynamic module and what Terraform 0.12 will help us with?

Let's see the advanced and very unusual solutions of how Terraform can be extended, integrated, executed, or merely hacked to get the job done with the help of external open-source services and integrations.

PipeWire has recently been adopted by Automotive Grade Linux for its implementation of the low-level platform audio service, replacing entirely previous solutions. Getting there had, of course, many challenges. In this talk, George is going to talk about how PipeWire has managed to overcome these challenges and has evolved to support automotive use cases and hardware through the design and implementation of a new, reusable, session & policy management component, WirePlumber.

The Unified Extensible Firmware Interface (UEFI) is the default for booting most Linux and BSD distributions. But the complexity of the UEFI standard does not offer an easy entry point for new developers. The U-Boot firmware provides a lightweight UEFI implementation. Using booting from iSCSI with U-Boot and iPXE as an example let's delve into the UEFI API.

The UEFI sub-system in U-Boot has developed from barely starting GRUB to supporting complex UEFI applications like iPXE and the EFI shell and passing most of the UEFI compliance tests for the implemented protocols and services.

The session gives an overview of the boottime and runtime services of UEFI with a focus on driver binding. The challenges of integrating the UEFI subsystem with U-Boot's infrastructure are described and an outlook is provided.

Questions this talk should answer: - How does the UEFI driver model work? - How does this integrate with U-Boot? - What to expect next in U-Boot's UEFI implementation?

At the height of the cold war, BASIC programs exchanged by radio and cassette tape provided young people of socialist Eastern and capitalist Western Europe a rare insight into each other's worlds. BASICODE was a transmission format and an API developed by the Dutch public broadcasting service to overcome the challenge of exchanging open source hobby programs in the highly fragmented 8-bit computing landscape of the early 1980s, which was dominated by mutually incompatible versions of BASIC. Somewhat improbably, the format was picked up across the iron curtain in the German Democratic Republic, where it experienced its age of greatest popularity. The need for programs to work on platforms with widely different capabilities and incompatible syntaxes forced it to be simply structured, highly regulated and relatively well documented. This makes it ideally suited for implementation in a web browser.

• An early age of open source
• Modulating source code for radio transmission
• An API based on GOSUBs in BASIC
• East and West in the 1980s
• Implementing BASICODE in a web browser

Overview of the process the OpenStack community uses to manage all software releases through automation around Git commits.

The OpenStack community has enabled a lot of automation around releasing their software. This presentation will give an overview of how code reviews are used to manage release activity. It will step through the use of Zuul CI jobs to perform validation of requests before they are accepted, and how commits are used to trigger jobs to tag and release the software, update documentation, trigger requirements updates, and other follow on work that needs to happen whenever new code is released.

QUIC was introduced by Google to move the transport protocol implementation out of the kernel, and is now being standardized in the IETF. It provides both encryption and multiplexing, and will be the default transport for HTTP/3. In this talk we'll present the work we've done investigating whether QUIC would benefit from vectorized packet processing, the impact it has on performance and how it can be consumed by external applications.

VPP (vector packet processing) is a fast network data plane, part of the Linux Foundation FD.io project providing fast network functions on top of DPDK. It provides an optimized support of TCP & UDP allowing significant performance improvements. In this presentation, we'll discuss:

• How we took advantage of the open source protocol implementation quicly and vpp's hoststack, to implement fast QUIC sockets.
• How this can be consumed by external applications and to what ends.
• What this enables regarding hardware and software offloads.

The World Wide Web is still among the most prominent Internet applications. While the Web landscape has been in perpetual movement since the very beginning, these last few years have witnessed some noteworthy proposals such as SPDY, HTTP/2 and QUIC, which profoundly reshape the application-layer protocols family. To measure the impact of such changes, going beyond the classic W3C notion of page load time, a number of Web performance metrics has been proposed (such as SpeedIndex, Above-The-Fold and variants). At the same time, there is still a limited amount of understanding on how these metrics correlate with the user perception (e.g., such as user ratings, user-perceived page load time, etc.). In this talk, we discuss the state of the art in metrics and models for Web performance evaluation, and their correlation with user experience through several real-world studies. Additional information, software and datasets are available at https://webqoe.telecom-paristech.fr

Bloom filters are a probabilistic data structure that tell us where things are not. They also utilize one way hash functions to build a probabilistic representation of an object. This talk will address how this structure can be used to provide an index into encrypted data that can be made publicly available with minimal risk.

Talk will cover how bloom filters are constructed, the Flat Bloofi indexing implementation and how to take the properties to be indexed and create Bloom filters, and then how to associate the bloom filter with the encrypted object in the index.

The result is an extremely fast index that can retrieve data items containing partial keys.

After this talk participants will be able to provide search capabilities across a collection of encrypted objects.

Code examples will be provided.

The talk will start with a recap of how MariaDB(or MySQL) handles the ORDER BY LIMIT optimization and examples demonstrating why the current optimizer is not good enough.

Further, the talk will describe how the optimizer in MariaDB 10.5 mostly solves the issue, the remaining unresolved issues and how DBAs can tackle them.

FULL DESCRIPTION:

For the first part of the talk, I will discuss the possible strategies by which ORDER BY LIMIT optimization is handled in MariaDB (or MySQL)

The strategies are: 1) Using an ordered index (ref, range or index scan) 2) Using filesort on the first non-const table 3) Using filesort on the temporary table, that stores the output of the join

Then I will discuss how the current MariaDB/MySQL optimizer makes the choice between the strategies and show the situations where it will never get a good query plan

For the second part of the talk, I will describe how a new cost-based optimization in MariaDB 10.5 solves the above issue. The talk will contain details about how the costs were taken into account during the optimization phase. Further, with the help of examples I would demonstrate how the execution differs for this new optimization and how this leads to improved performance for ORDER BY LIMIT queries.

Godot 4.0 is in the process of being ported from OpenGL to a Vulkan rendering API. This new technology provides new challenges and benefits for improving quality and performance, which will be explained and compared during this presentation.

Godot 4.0 is in the process of being ported from OpenGL to a Vulkan rendering API. This new technology provides new challenges and benefits for improving quality and performance, which will be explained and compared during this presentation.

Running application containers within Kubernetes presents a challenge to the operator for quickly handling security updates - every container must be patched, rebuilt and re-tested, and then updated separately. The slowest dev turnaround of all your containers is the fastest you can fully update your cluster.

However, for many fixes, the application likely will not care which compatible version of a system library it is using. Using AtomFS, operators can update individual libraries inside app containers without a rebuild. Containers using an AtomFS storage backend can simply be restarted after a fix is applied, and they will see it reflected in their filesystems.

The AtomFS storage backend requires minor changes to your container runtime, and we demonstrate it with the LXC runtime and crio-lxc, an adapter to enable using LXC-based containers in Kubernetes using CRI-O.

In this talk Tycho will cover how AtomFS works, what changes are needed to make application container builds work with AtomFS, and fix an exploit live without a rebuild.

Graph algorithms play an increasingly important role in real-world applications. The Neo4j Graph Algorithms library contains a set of ~50 graph algorithms covering a lot of different problem domains. In our talk, we’ll present the architecture of the library and demonstrate the different execution phases using a real world example.

Graph algorithms play an increasingly important role in real-world applications. Use-cases that we see in the wild are related to fraud detection, fraud detection, retail recommendation and identifying influencers for marketing campaigns. The Neo4j Graph Algorithms library contains a set of ~50 graph algorithms covering the above-mentioned problem domains.

Running a graph algorithm in Neo4j involves three essential steps: loading the graph from the database in an optimized in-memory format, executing the algorithm, and streaming or writing of results. For the user, these steps are hidden behind single procedure calls, integrated in the Cypher query language.

In our talk, we will explain and demonstrate what happens in the system when a user calls an algorithm procedure. This involves scanning Neo4j store files, constructing our in-memory graph representation and executing an algorithm via our Java Graph API.

Attendees will learn how to setup and use the Neo4j Graph Algorithms Library. Furthermore, they will get a good understanding of how the library works internally and how to tune it for specific use-cases.

STEP files generated by many FOSS modelling programs are much larger than those generated by the equivalent commercial software packages. This does not meaningfully matter for most files. However, for libraries of STEP files containing thousands of models, the extra bytes in downloads and storage can be problematic.

This talk introduces a single-purpose library and command line utility called STEPReduce that removes the superfluous elements, replacing them with their equivalent, existing in-file references. I will show a reduction of 50% file size in both compressed and uncompressed STEP files over the full KiCad STEP library. I will also show the resulting improvement in complex model load times using the industry standard OpenCascade import routines. Finally, I will show the utility's verification routines of solid model equivalence between compressed and uncompressed files.

Please note that this talk replaces one entitled "News from gEDA/gaf" that was due to have been given by Roland Lutz, who has sent his apologies but is now unable to attend as he has fallen ill. We wish him a speedy recovery.

Abstract: G1 has been around for quite some time now and since JDK 9 it is the default garbage collector in OpenJDK. The community working on G1 is quite big and the contributions over the last few years have made a significant impact on the overall performance. This talk will focus on some of these features and how they have improved G1 in various ways. We will also take a brief look at what features we have lined up for the future.

Wikidata, Wikimedia's knowledge base, has been collecting general purpose data about the world for 7 years now. This data powers Wikipedia but also many applications outside Wikimedia, like your digital personal assistant. In recent years Wikidata's community has also started collecting lexicographical data in order to provide a large data set of machine-readable data about words in hundreds of languages. In this talk we will explore how Wikidata enables thousands of volunteers to describe their languages and make it available as a source of data for systems that do automated translation, text generation and more.

Why should you allow all possible system calls from your application when you know that you only need some? If you have ever wondered the same then this is the right talk for you. We are covering:

• What is seccomp in a nutshell and where could you use it.
• Practical example with Elasticsearch and Beats.
• How to collect seccomp violations with Auditd.

Because your security approach can always use an additional layer of protection.

Simulation is a powerful tool to understand quantum phenomena. The simulation of quantum circuits is usually achieved by gate matrix product, such as in Qiskit and ProjectQ. Thanks to the Lindblad master equation solver, QuTiP is developing a simulator that simulates quantum circuits at the level of the real quantum evolution happening in your quantum device. This framework offers pulse-level control and a flexible way of noise simulation. Upon it, we are going to define different back-ends for different physics systems such as Cavity QED, Ion trap or Superconducting system. The simulator could help to improve your quantum device, study the effect of noise and create noise mitigation scheme.

Verifpal is new software for verifying the security of cryptographic protocols. Building upon contemporary research in symbolic formal verification, Verifpal’s main aim is to appeal more to real-world practitioners, students and engineers without sacrificing comprehensive formal verification features. Verifpal represents a serious attempt at making the formal analysis of advanced cryptographic systems such as Signal and TLS 1.3 easier to achieve.

Contemporary research in symbolic formal verification has led to confirming security guarantees (as well as finding attacks) in secure channel protocols such as TLS and Signal. However, formal verification in general has not managed to significantly exit the academic bubble. Verifpal is new software for verifying the security of cryptographic protocols that aims is to work better for real-world practitioners, students and engineers without sacrificing comprehensive formal verification features.

In order to achieve this, Verifpal introduces a new, intuitive language for modeling protocols that is easier to write and understand than the languages employed by existing tools. Its formal verification paradigm is also designed explicitly to provide protocol modeling that avoids user error. By modeling principals explicitly and with discrete states, Verifpal models are able to be written in a way that reflects how protocols are described in the real world. At the same time, Verifpal is able to model protocols under an active attacker with unbounded sessions and fresh values, and supports queries for advanced security properties such as forward secrecy or key compromise impersonation.

Verifpal has already been used to verify security properties for Signal, Scuttlebutt, TLS 1.3 and other protocols. It is a community-focused project, and available under a GPLv3 license.

An Intuitive Protocol Modeling Language: The Verifpal language is meant to illustrate protocols close to how one may describe them in an informal conversation, while still being precise and expressive enough for formal modeling. Verifpal reasons about the protocol model with explicit principals: Alice and Bob exist and have independent states.

Modeling that Avoids User Error: Verifpal does not allow users to define their own cryptographic primitives. Instead, it comes with built-in cryptographic functions — this is meant to remove the potential for users to define fundamental cryptographic operations incorrectly.

Easy to Understand Analysis Output: When a contradiction is found for a query, the result is related in a readable format that ties the attack to a real-world scenario. This is done by using terminology to indicate how the attack could have been possible, such as through a man-in-the-middle on ephemeral keys.

Friendly and Integrated Software: Verifpal comes with a Visual Studio Code extension that offers syntax highlighting and, soon, live query verification within Visual Studio Code, allowing developers to obtain insights on their model as they are writing it.

Insurgo had engaged itself in the adventure of facilitating security accessibility and received NlNet funding to do exactly that. Now it wants to get developers involved and expand funding.

The goal of this is to bridge the gap between reasonably secure OS (QubesOS) and slightly more secure hardware (Heads) to help privacy-focused users and those that are vulnerable. But we need to prepare for the future now!

Insurgo has challenged the status quo that has been prevalent since 2015 and has made it possible for OEMs to preinstall QubesOS, thanks to the Heads Open Source Firmware (OSF) and his own PrivacyBeast QubesOS certified branch, not yet merged upstream, due to the lack of time and resources of a single man effort needing additional collaboration.

The integrity of the firmware and boot files is already remotely sealed and can be attested over smartphone (TPMTOTP) and from the bundled Librem Keys/Nitrokey Pro 2 (HOTP), prior to shipping. Thanks to HOTP-enabled USB security dongles bounded to shipped products, the user can visually validate that the hardware they've received is in OEM attested state, prior to complete reownership which is regenerating all required secrets from a trustable recovery environment (Heads OSF) thanks to a re-ownership wizard that guides the user until completion.

This is just the beginning of the adventure and the road ahead requires your help. Insurgo wants to propel this movement forward.

Today's secure hardware (REAL open source initialized hardware, eg. the RYF KGPE-D16, replicant supported phones, Sandy bridge/Ivy bridge based boards, eg. x230) struggle to stay current with upstream code and compliance requirements. LineageOS dropped support of the i9300. Coreboot dropped support of the KGPE-D16 platform. And the list will expand if no measures are taken to support maintainership of privacy focused projects that are taken for granted until support is finally dropped. This is a real problem requiring real solutions.

New efforts to support future, REAL Open Source Hardware (newly Respect Your Freedom [RYF] certified hardware, eg. Talos II from RaptorEngineering, future Power10 based hardware) are neither currently under active development nor currently supported by QubesOS. This needs to change. Now.

There is an opportunity for transition. This requires leadership, developers and funding. This is why we've created the Insurgo Initiative on the OpenCollective platform.

This is where transparent funding will be available to the public for open source R&D. Please consider participating through code contributions!

Insurgo is making today's most trustworthy hardware available (TRUELY Neutered+Deactivated Intel ME, no FSP, no binary blobs whatsoever but EC firmware in the Root of Trust) to the masses through remote attestation over Heads OSF.

NlNet is helping Heads to be compatible on the T530, T430, T420 and X220, which are widely available, binary blob-free hardware platforms, thanks to a partnership with 9elements under NlNet grant. NlNet funds is also permitting development of remote administration of QubesOS over tor hidden services when needed, thanks to an ongoing partnership with both the Qubes OS Project & Whonix.

But what about other work needed to ease accessibility of tomorrow's secure hardware and technologies?

Insurgo decided to give back to Open Source Firmware (OSF) related communities and will publicly announce novel approach to support required open source projects. In premiere, we plan to give back 25% of Insurgo's net profit on sales to the Insurgo Initiative, hosted on OpenCollective.

Those funds will be available to Open Source projects in the form of bounties, to be paid out upon proof of work of agreed contributions.

The idea here is that open source tickets (issues) can be used as bounties and if knowledgeable people knew funds were available for needed work, they'd be more incentivized to address them. Developers could then be rewarded for their efforts and paid for completing tasks similiar to how Open Source Funds (OpenTech, NlNet, etc) provides funds for larger projects.

The Insurgo Initiative will be self funded and potentially expanded through international partnerships, while the goal stays the same: supporting a future where security is more accessible to the public.

Here are some projects needing additional funding and more developer awareness, right now. Big funds and grant application are great. But the funding process has issues. Not every developer wants to go through the application process, which requires management skills and requires a process that is not just about coding. There are awesome developers out there whose help would be greatly needed.

How do we appropriately match developers with pertinent issues? We can fix this with the right mission and funding. Insurgo's mission is for accessible security.

Bounty tags are being added to projects that lack the funding and to help address the current problems they face for completion:

• PPC64le QubesOS support for upcoming Power10 laptop and Talos II RYF hardware

• Heads needs more community developers and maintainers

• QubesOS bounty tagged issues

• Whonix needs more collaborators or it might die

The main problem we seem to face with many projects can be seen over and over again: a lack of maintainership.

No one can carry on a project for too long without becoming overwhelmed/drained by it. We need to fairly distribute this work and make sure contributions are incentivized and fairly paid.

In this talk, I will go quickly over past work. The current situation. And where Insurgo wants to go.

Welcome aboard!

We are not journalists. But we are developers working for journalists. When we receive leaks, we are flooded by the huge amount of documents and the huge amount of questions that journalists have, trying to dig into this leak. Among others :

* Where to begin ?
* How many documents mention "tax avoidance" ?
* How many languages are in this leaks ?
* How many documents are in CSV ?

Journalists have more or less the same questions as researchers ! So to help them answer all these questions, we developed Datashare. In a nutshell, Datashare is a tool to answer all your questions about a corpus of documents : just like Google but without Google and without sending information to Google. That means that it extracts content and metadata from all types of documents and index it. Then, it detects any people, locations, organizations and email addresses. The web interface expose all of that to let you have a complete overview of your corpus and search through it. Plus Datashare lets you star and tag documents.

We didn't want to reinvent the wheel, and use assets that has been proved to work well. How did we end up with Datashare from an heterogeneous environment ? Initially we had :

- a command line tool to extract text from huge document corpus
- a proof of concept of NLP pipelines in java
- a shared index based on blacklight / RoR and SolR
- opensource tools and frameworks

Issues we had to fix :

- UX
- scalability of SolR with millions of documents
- integration of all the tools in one
- maintainability and robustness while increasing code base

HTTP/3 is designed to improve in areas where HTTP/2 still has some shortcomings, primarily by changing the transport layer. HTTP/3 is the first major protocol to step away from TCP and instead it uses QUIC.

HTTP/3 is the designated name for the coming next version of the protocol that is currently under development within the QUIC working group in the IETF.

HTTP/3 is designed to improve in areas where HTTP/2 still has some shortcomings, primarily by changing the transport layer. HTTP/3 is the first major protocol to step away from TCP and instead it uses QUIC.

Daniel Stenberg does a presentation about HTTP/3 and QUIC. Why the new protocols are deemed necessary, how they work, how they change how things are sent over the network and what some of the coming deployment challenges will be.

In the last couple of years, the Software Engineering Lab of the University of Mons has extensively studied different aspects of dependency management within and across different package management ecosystems, including Cargo, npm, Packagist, Rubygems, CPAN, CRAN and NuGet. These ecosystems contain a large number of package releases with many interdependencies. They face challenges related to their scale, complexity, and rate of evolution. Typical problems are backward incompatible package updates, and the increasing proportion of fragile packages due to an excessive number of transitive dependencies.

This talk reports on our findings based on multiple empirical studies that we have conducted to understand different aspects of dependency management and their practical implications. This includes: * the outdatedness of package dependencies, the transitive impact of such "technical lag", and its relation to the presence of bugs and security vulnerabilities. * the impact of using either more permissive or more restrictive version contraints on dependencies. * the virtues and limitations of being compliant to semantic versioning, a common policy to inform dependents whether new releases of software packages introduce possibly backward incompatible changes. * the impact of specific characteristics, policies and tools used by the packaging ecosystem and its supporting community on all of the above.

The contents of the talk will be adapted to the target audience of open source software practitioners, but will be primarily based on the following peer-reviewed scientific articles: * What do package dependencies tell us about semantic versioning? Alexandre Decan, Tom Mens. IEEE Transactions on Software Engineering, 2019. https://doi.org/10.1109/TSE.2019.2918315 * An empirical comparison of dependency network evolution in seven software packaging ecosystems. Alexandre Decan, Tom Mens, Philippe Grosjean. Empirical Software Engineering 24(1):381-416, 2019. https://doi.org/10.1007/s10664-017-9589-y * A formal framework for measuring technical lag in component repositories and its application to npm. Ahmed Zerouali, Tom Mens, Jesus Gonzalez‐Barahona, Alexandre Decan, Eleni Constantinou, Gregorio Robles. Journal of Software: Evolution and Process 31(8), 2019. https://doi.org/10.1002/smr.2157 * On the Impact of Security Vulnerabilities in the npm Package Dependency Network. Alexandre Decan, Tom Mens, Eleni Constantinou. International Conference on Mining Software Repositories, 2018. https://doi.org/10.1145/3196398.3196401 * On the Evolution of Technical Lag in the npm Package Dependency Network. Alexandre Decan, Tom Mens, Eleni Constantinou. International Conference on Software Maintenance and Evolution, 2018. https://doi.org/10.1109/ICSME.2018.00050

As the number of servers that we are responsible for increases, the ability to manage issues on those systems becomes more and more difficult. Situations arise like log files filling up disks, failed login attempts that could be brute force attacks, and unwanted processes and services running. Using the Beacon and Reactor systems of SaltStack, we can monitor a system for these have SaltStack restore those systems to the desired state. In this talk, we’ll look at some real-life examples of these scenarios and how Saltstack can help to automatically heal the systems.

As the number of servers that we are responsible for increases, the ability to manage issues on those systems becomes more and more difficult. Situations arise like log files filling up disks, failed login attempts that could be brute force attacks, and unwanted processes and services running.

Using the Beacon system of SaltStack, we can monitor a system for these & other scenarios. Pairing this with the Reactor system, we can have SaltStack restore those systems to the desired state.

In this talk, we’ll look at some real-life examples of these scenarios and how Saltstack can help to automatically heal the systems.

The talk will include:

• A brief introduction to Salt Stack.
• Using Salt Beacons to monitor aspects of a system.
• Using Salt Reactors to react to events from the Salt Beacons.
• Using those reactors to re-mediate issues as they occur.

HTTPX is a next generation HTTP client, that supports HTTP/2 and HTTP/1.1.

It can be used in high-performance async web frameworks, using either asyncio or trio, and is able to support making large numbers of requests concurrently.

This talk will introduce HTTPX, demonstrate some of its features, and talk through the motivation and aims for the project.

The talk will cover:

• Why HTTPX exists & what new functionality HTTPX brings to the table.
• How and where HTTPX differs from the existing Requests package.
• Examples of making parallel HTTP requests.
• Examples of making HTTP/2 requests.
• Examples of making requests directly to a web application, rather than over the network.
• Using Asyncio vs using Trio.
• A quick architecture overview.

Overcoming the synchronous web copy/paste API's limitations in real browsers is extremely non-trivial. Come & hear how we provide rich copy/paste support across browsers, inside our app and hear a bit about how this mess should be fixed.

Collabora has been working to provide a good user-experience for Collabora Online - bringing LibreOffice to the web, and a particularly challenging aspect of this has been copy/paste. One of our challenges is that by design we keep our document data on the server, which is at the end of an asynchronous web-socket. Another challenge is the impossibly baroque and arguably mis-designed set of clipboard APIs that we have to work with.

Hear a story of how we defeated the issues, as well as the somewhat sad UX compromises we were forced to make for the hard cases.

Several prominent FOSS projects have changed their FOSS licenses to alternate licenses that make software available, but with additional restrictions intended to help financially sustain FOSS development and combat "strip mining" by software-as-a-service providers. Additionally, recently several related organizations have jumped into the the role of helping sustain open source by providing (for a fee) funding conduits, fundraising services, or other mechanisms to route money to maintainers.

Affirmative position: FOSS benefits from sustainability efforts

1. First Affirmative Constructive (1AC) = 7 minutes a. Cross-examination of First Affirmative by Second Negative = 3 minutes
2. First Negative Constructive (1NC) = 7 minutes a. Cross-examination of First Negative by First Affirmative = 3 minutes
3. Second Affirmative Constructive (2AC) = 7 minutes a. Cross-examination of Second Affirmative by First Negative = 3 minutes
4. Second Negative Constructive (2NC) = 7 minutes a. Cross-examination of Second Negative by Second Affirmative = 3 minutes
5. First Negative Rebuttal (1NR) = 3 minutes
6. First Affirmative Rebuttal (1AR) = 3 minutes
7. Second Negative Rebuttal (2NR) = 3 minutes
8. Second Affirmative Rebuttal (2AR) = 3 minutes

WPEWebKit is a WebKit flavour (also known as port) specially crafted for embedded platforms and use-cases. During this talk I would present WPEWebKit's architecture with a special emphasis on its multimedia backend based on GStreamer. I would also demonstrate various use-cases for WPE, spanning from Kiosk apps and Set-top-box user-interfaces to advanced scenarios such as Web overlays for live TV broadcasting.

WPEWebKit is designed for simplicity and performance. It allows application developers to easily deploy hardware-accelerated fullscreen (or not) browsers with multimedia support, small (both in memory usage and disk space) and light as possible, and implementing the most relevant HTML specifications.

Traditionally WebKit ports are associated with a specific widget toolkit library (GTK, Qt, Cocoa,...) but WPEWebKit breaks with this monolithic design and thus enables a new range of use-cases. By delegating the final web page rendering to dedicated view-backends, WPEWebKit allows flexible and tight integration in a wide range of hardware platforms. We also provide a Qt5 QML plugin that can easily replace the deprecated QtWebKit-based module.

WPEWebKit leverages GStreamer for its multiple multimedia backends, ensuring your WPEWebKit-based browser supports zero-copy hardware video decoding on the most common embedded platforms such as the Raspberry Pi, i.MX6 and i.MX8M SoCS.

WPEWebKit can also be used in pure GStreamer applications! Thanks to the GstWPE plugin, web-pages can be "injected" in GStreamer pipelines as audio and video streams. This new plugin thus enables use-cases such has HTML overlays.

WPEWebKit is an open source project with a growing community, and it is developed within the ecosystem of the WebKit project, which powers many open source and proprietary web browsers.

Replicant is a fully free Android distribution running on several devices, a free software mobile operating system putting the emphasis on freedom and privacy/security.

This meeting is for everyone interested in the Replicant project (users, developers, devices vendors, etc.). Among other things, we will present the ongoing efforts on Replicant 9 and discuss how we should move forward. Everyone's point of view is welcomed.

Here's a non-exhaustive list of the topics that will be up for debate:

• Replicant 9 status on the i9300/i9305: bootloader, modem, LCD, audio, graphics.
• Future targets: PinePhone, Librem5.
• WebView dependency on non-free Chromium.
• Android build system.
• Replicant infrastructure: servers, test benches, build machines.
• Long term project sustainability.
• Supported mainline kernel phones, what kernel versions brought what support and what is upcomming in the next kernel versions.
• How the endorsement of stores selling Replicant devices should work.
• Wiki migration from Redmine to MediaWiki.
• Upstream and maintainership of the code of Replicant 9 that enables to use an upstream kernel.
• Relationship with LineageOS on supporting the Galaxy SIII.

We will try to setup an audio conference (through Mumble) for those that cannot come to FOSDEM. For that we need several unidirectional (cardioid) microphones, being it lapel or handheld, that can be connected to a laptop. If you have one please bring it.

TTM is the memory manager in the Linux kernel used by graphics drivers with dedicated VRAM.

It was added to the mainline kernel in June 2009 and has seen numerous changes and we are now more or less running into a dead-end with it's design.

This talk outlines TTMs current functionality, what design problems we ran into and what can we do to fix this.

Alire (Ada LIbrary REpository) is a package manager project for the Ada/SPARK community. The goal of a package manager is to facilitate collaboration within the community and to lower the barrier of entry for beginners.

In this talk we will present the Alire project, what it can do for you and how you can contribute and give more visibility to your Ada/SPARK projects.

We will also provide a tutorial to show how to use Alire to create a library and then publish it for others to use.

Security is a big problem especially in the cloud of container workloads. This presentation investigates improving security in the Linux kernel itself. The first target is securing sensitive application data, for instance, private keys.

Address space isolation has been used to protect the kernel and userspace programs from each other since the invention of the virtual memory.

Assuming that kernel bugs and therefore exploits are inevitable it might be worth isolating parts of the kernel to minimize damage that these exploits can cause. Moreover, restricted mappings in the kernel mode may improve mitigation of hardware speculation vulnerabilities.

There are several ongoing efforts to use restricted address spaces in Linux kernel for various use cases: * speculation vulnerabilities mitigation in KVM * support for memory areas visible only in a single owning context * hardening of the Linux containers

We are going to present the approach for the implementation of restricted mappings in the Linux kernel and how this implementation would be used with various use-cases.

We are also going to take a closer look at possibility to assign an address space to the Linux namespaces, so that tasks running in namespace A have different view of kernel memory mappings than the tasks running in namespace B. For instance, by keeping all the objects in a network namespace private, we can achieve levels of isolation equivalent to running a separated network stack.

Ever wondered how the LLVM project and community works? Want to get some advice on how to most effectively contribute? Now is your chance at FOSDEM to ask experienced developers directly. This panel will host a number of experienced LLVM developers, answering any relevant questions from the audience.

In case questions from the audience do not fill the entire slot, a set of prepared questions focussed on how to get started working with and contributing to LLVM will be raised for the panelists to answer.

The panel will consist of the following experienced contributors to LLVM: Kristof Beyls, Peter Smith, Jeroen Dobbelaere, Nick Desaulniers

This presentation includes multiple topics mixed together * Porting a DOS multimedia program into Linux/BSD * How music was composed/stored in old type of games from the 8bit era, up into the amiga (and partly the DOS world) * How does audio/music hardware work. C64 SID, ZX-Spectrum and alike, Amiga, Adlib FM-synth OPL2/3 and General Midi

As a child, I was exposed to Cubic Player. This program was a text-based music player. All the color full texts mesmerized me and it gave a direct visual feedback of how the music was generated.

During teenage years I learned programming and got introduced to Linux. All the sourcecode for everything was available. The kernel, multimedia libraries, tools, all kind of APIs. If there are anything you wonder how works, you can inspect it. If you are unable resolve a specific detail in your own project, try to find another project that has done something similar! But for playback of these Amiga style modules, there was no programs that had the same charm as Cubic Player. Programs like mikmod, XMMS, Audacious only displayed playlist, maybe instrument-names and maybe an spectrum analyzer.

When I discovered that Cubic Player had been released as Open Cubic Player. I grabbed the source code and started to study it. All of it was based on direct hardware access, as it was written for DOS. Direct access to video-memory/hardware, raw keyboard scan codes, hardware interrupts for timers allowing background rendering of audio if needed etc. A natural candidate for a novice programmer to port?

Slowly I went through one and one single file of the original source code. * Lots of logic could be kept * Some could be thrown away like direct audio hardware drivers * Some needed heavy rewrites like video output * Assembler needed to be rewritten into C inlines * The timer interrupt porting caused a zero-day kernel bug to be discovered https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0554

When text appears on the screen, and audio (highly distorted in the beginning) appeared, was a magical feeling. Progress was faster when the goal felt to be well within the reach.

When you the make your code public, people start to use it... and you start to get feedback like: * Program is unable to compile on other platforms * Program crash on other platforms * Specific crashes that only happens for some few people - compiler bugs (these were more common back in the days)

How did old systems playback music? Using specific hardware circuits. How is music composed / stored / playback?

We will take a deep dive into these two questions on these platforms:

ZX-Spectrum 128 .AY files - Using code chopped out from "aylet"

Atari ST .YM files - Using ST Sound Library

C64 .SID files - libsidplay

OPL2/OPL3 style - libadplug

Amiga style modules

General MIDI - TiMidity++

Open Source makes it possible to combine the work and effort from multiple volunteers. Not everything is a always an easy walk in the park, but it sure makes it easier than writing everything from scratch when there are known working code that can be either be used as a template or wrapped around.

Every year we hear great content about how to develop in Go, but rarely do we focus on how to test in Go. Well written tests are critical to the success of a project, and more often than not, they can help drive developers to design features in more simple and concise ways.

In this talk, I'll explain the importance of test driven development and provide some tactics for how to implement the practice in your daily work and on your respective team. I'll dive into the testing, require, and assert packages to dissect which function calls are appropriate for different use cases, and present multiple different ways to write Go tests for each scope, including unit, integration and e2e. I'll also discuss how to refactor code to make it more testable (with examples), so you can optimize and simplify Go code for robust and reliable Go tests. Lastly, I will cover race conditions to help you debug concurrency related problems. Let's write Go(od) tests!

Come to see some real-life examples of how you can do CPU profiling with perf and eBPF/BCC, to create FlameGraphs and ColdGraphs visualizations of the on-CPU/off-CPU time spent by the database. Based on these visualizations and reading the database source code (this is why we love Open Source!) you can quickly gain insight about what's burning CPU (FlameGraphs) and what's causing CPU to wait (ColdGraphs), and with this knowledge you will be several steps closer to answering "what's consuming all that CPU time".

Gunrock is a CUDA library for graph-processing designed specifically for the GPU. It uses a high-level, bulk-synchronous, data-centric abstraction focused on operations on vertex or edge frontiers. Gunrock achieves a balance between performance and expressiveness by coupling high-performance GPU computing primitives and optimization strategies, particularly in the area of fine-grained load balancing, with a high-level programming model that allows programmers to quickly develop new graph primitives that scale from one to many GPUs on a node with small code size and minimal GPU programming knowledge.

Features of Gunrock include: - Best of class performance among GPU graph analytics frameworks - A large number of graph applications (28 at last count) - A data-centric programming model targeted at GPUs that offers advantages over other programming models - A programming model that scales to multiple GPUs with high performance while still using the same code as a single-GPU primitive

Gunrock began in 2013 as a project under DARPA's XDATA program and is currently the performance reference in DARPA's HIVE program. Gunrock is also in development as a component in NVIDIA's RAPIDS platform for data analytics. The Gunrock team actively develops and improves Gunrock under an Apache 2.0 license.

https://gunrock.github.io/

Gmsh (http://gmsh.info) is an open source finite element mesh generator with built-in pre- and post-processing facilities. Under continuous development for the last two decades, it has become the de facto standard for open source finite element mesh generation, with a large user community in both academia and industry. In this talk I will present an overview of Gmsh, and highlight recent developments including the support for constructive solid geometry, new robust and parallel meshing algorithms, flexible solver integration and a new multi-language Application Programming Interface in C++, C, Python and Julia.

Client compiler, server compiler, JVMCI, Graal ... What are we using today and how do they work together? In this talk I'll give and overview of the Just-in-time compilers included in OpenJDK and explain how to play with them. I'll also address Just-in-time compiler threads and resource related issues.

"With its recent advancements, AFXDP is gaining popularity in the high performance packet processing space. As a result, existing frameworks for packet processing, such as DPDK, are integrating AFXDP support to provide more options for moving packets to user space applications. The challenge with such integration is that both AF_XDP and frameworks like DPDK have their own assumptions and constraints about such things as, for example, how to align or manage packet buffers, making the integration less straight forward than it might appear at first glance.

This talk takes a look at the usability of AFXDP pre-kernel v5.4, before diving into the recent challenges we encountered when integrating DPDK and AFXDP, and how we made changes (on both sides) to allow the two to work together in a much more seamless manner."

We all love fonts. From Google Fonts to Typekit, Hoefler&Co and more, they give character and tone to our websites. The down side of fonts is that they can really slow down our loads. In this talk we'll learn about common pitfalls like critical requests depth and how to use resource hints to play tricks with latency to load web applications faster. We'll walk through a network profile to understand what's going on in the browser and how to make it faster.

The availability of namespaces inside user sessions is increasing, and Valve's Steam game distribution platform is taking advantage of this for better gaming on Linux.

A recent beta of Steam for Linux adds pressure-vessel, an experimental mechanism developed by Collabora to put games in containers. This gives the game partial isolation from various aspects of the host system, and in particular allows it to use a runtime library stack that is not entangled with the host's, with different games using different runtimes.

Meanwhile, the unofficial Steam Flatpak app distributed on Flathub puts the entire Steam client and all of its games in a container. This gives the Steam client more thorough isolation from the host system, but all the games have to share that single container.

In this talk, pressure-vessel developer and Flatpak contributor Simon McVittie will compare the two approaches and the challenges they encounter, and look at where Steam containers might go in the future.

Disk encryption is essential for physical computer security, but seldom used due to the trouble of remembering and typing a password at every restart. We describe Mandos, a program which solves this problem, its security model, and the underlying concepts of its design, and some of its evolution over the 10 years since its initial release.

Any security system must have a clear view of its intended threat model – i.e. what threats it is actually intended to protect against; the specific choices and tradeoffs made for Mandos will be explained. Another danger of security system design is the risk of its non-use; i.e. that the system will not be used for some real or perceived drawbacks, such as complexity. The deliberate design choices of Mandos, involving low-interaction, “invisible” and automatic features, will be covered. If possible, the many necessary changes made since the last FOSDEM talk in 2015 will also be described.

For the last several years, hypervisors have played a key role in platform security by reducing the possible attack surface. At the same time, the hype surrounding computing and Internet of Things Gateways has led to an increase in network appliance devices. Our target was to create a less-insecure virtual network appliance using TrenchBoot, Trusted Platform Module 2.0 and AMD SKINIT Dynamic Root of Trust for Measurement to establish a Xen hypervisor with a meta-virtualized pfSense firewall. We are going to present it with an update of the status of support of TrenchBoot for AMD processors. This appliance is supported by are supported by apu2, a reliable low-SWaP x86 device from Swiss OEM PC Engines. It can be used as a Single Office / Home Office firewall or an industrial edge device and has mostly open-source hardware, coreboot firmware, mPCIe extensibility and an extended support lifecycle for the embedded Central Processing Unit and motherboard. In this talk, we will show how to create a system, which enables a significant portion of computations to the edge devices while maintaining security. Using a simple, well-known platform, we will conduct a secure boot using the Static Root of Trust for Measurement with coreboot, move to the Dynamic Root of Trust for Measurement by SKINIT in TrenchBoot and use all of this to provide a complete chain of trust for the Xen hypervisor, a virtual firewall appliance isolated by an input–output memory management unit (IOMMU) from the physical network interface controller (NIC) devices. We will present benchmark data on virtualization overhead, explain how this complexity can still be practical and outline the value of this stack. In the second part of presentation we will discuss current status of Intel TXT development in the GRUB and Linux kernel.

The days of having only a few open source dependencies are over. Projects often have thousands of open source dependencies in their supply chain and companies may have millions. Even worse, risk is viral -- projects inherit and pass on the risks of all their dependencies. At the same time, software is shipping more frequently.

This creates numerous challenges for commercial and open source projects of any size -- how to discover the myriad of components being used across a range of ecosystems and scenarios, where to get high quality data to drive smart decisions, how to capture and evaluate comprehensive policies.

Enabling high-confidence, rapid delivery, requires integrating supply chain management automation deep into the engineering system. Core to this is accurate discovery and identification of dependencies and trustworthy, high-quality compliance and security data about the discovered components.

In this talk we detail the challenges in this space, look at various approaches such as ClearlyDefined, a crowd-sourced, open source project aimed at discovering and curating compliance data about open source components, and relate experiences running high performance, massive scale compliance systems for a wide range of open source and commercial projects.

Yeah, this is about my last summer. But I promise to focus on the story of how I was able to do four amazing lightning talks with Python and a harmonica.

This one is not about technical stuff, it is about finding something that python overlaps with your hobbies and sharing it back to the community.

This talk is about writing songs and playing music with python. Back in 2017 I came to know FoxDot, a python wrapper around SuperCollider, which is a super popular open source synthesizer. Since then, I have been using it to create entertaining lighting talks and would like to cover a bit more than just a lightning talk this time.

This presentation is a feedback from experience on helping a researcher transforming a series of scattered analyses into a documented, reproducible and shareable workflow.
Time allocated by researchers to program / code the analyses required to answer their scientific questions is usually low compared to other tasks. As a result, multiple small experiments are developed and outputs are gathered as best as possible to be presented in a scientific paper. However, science is not only about sharing results but also sharing methods. How can we make our results reproducible when we developed multiple, usually undocumented analyses? What do we do if the program is only applicable to our computer directory architecture? This is always possible to take time to rewrite, re-arrange and document analyses at the time we want/have to share them. Here, I will take the exemple of a "collaboration fest" where we dissected R scripts of a researcher in ecology. We started a reproducible, documented and open-source R-package along with its website, automatically built using continuous integration: https://cesco-lab.github.io/Vigie-Chiro_scripts/.
However, can we think, earlier in the process, a better way to use our small programming time slots by adopting a method that will save time in our future? In this aim, I will present a documentation-first method using little time while writing analyses, but saving a lot when the time has come to share your work.

Session type (Lecture or Lightning Talk)

Lecture

Session length (20-40 min, 10 min for a lightning talk)

30 min

Expected prior knowledge / intended audience

No prior knowledge expected. Example will be about building documentation for R software but any developper, using any programming language may be interested in the method adopted.

Speaker bio

Sébastien Rochette has a PhD in marine ecology. After a few years has a researcher in ecology, he joined ThinkR (https://rtask.thinkr.fr), a company giving courses and consultancy around the R-software. Along with commercial activities, he is highly involved in the development of open-source R packages. He also shares his experience with the R-community through free tutorials, blog posts, online help and other conferences. https://statnmap.com/

Links to code / slides / material for the talk (optional)

I wrote a blog post in French about what I am planning to present: https://thinkr.fr/transformer-plusieurs-scripts-eparpilles-en-beau-package-r/
This topic is also related to another blog post: https://rtask.thinkr.fr/when-development-starts-with-documentation/

Links to previous talks by the speaker

Talks about R are in my Github repository: https://github.com/statnmap/prez/. The "README" lists talks that have a live recorded video.
As a researcher, I also gave multiple talks about marine science, modelling and other topics related to my research.

Please note that this talk was originally scheduled to be at 17h. The talk originally in this slot was "Developing from the field." by Audrey Baneyx and Robin de Mourat which will now take place at 17h.

Software developers have been testing their code for years. Why is it still not a common thing for infrastructure and operations people? We are in an era where it is expected everyone moves fast. Moving too fast can negatively affect our customers so it's vital that we ensure the changes we make to our infrastructure are tested like other code changes would be.

In this talk, Paul is going to demonstrate some of the methods for testing infrastructure code. The talk will demonstrate how to establish fast feedback loops that provisions infrastructure, as well as being able to check that the code adheres to company policies, and has not drifted from the plan of record as specified in our infrastructure as code repository.

Software developers have been testing their code for years. Why is it still not a common thing for infrastructure and operations people? We are in an era where it is expected everyone moves fast. Moving too fast can negatively affect our customers so it's vital that we ensure the changes we make to our infrastructure are tested like other code changes would be.

In this talk, Paul is going to demonstrate some of the methods for testing infrastructure code. The talk will demonstrate how to establish fast feedback loops that provisions infrastructure, as well as being able to check that the code adheres to company policies, and has not drifted from the plan of record as specified in our infrastructure as code repository.

Yocto is the most famous "build system" for embedded Linux. During this conference we'll study how to use some Yocto features to help the development of a free industrial project. We will study the eSDK (extended cross-toolchain), Ptest and Testimage (CI), Devtool and Devshell (recipe modification). We will also learn how to be in compliance with the GPLv3 / LGPLv3 licenses thanks to the "archiver" class (and more).

This talk is a late addition that replaces "Computing with TensorNetwork & QML Tools" by Stefan Leichenauer

KRSI (Kernel Runtime Security Instrumentation) is an ongoing effort at Google to upstream an LSM (Linux Security Module) instrumentable using eBPF (extended Berkeley Packet Filter) to the Linux kernel.

KRSI allows system owners to dynamically attach eBPF programs to security hooks and write MAC and audit policies without having to reboot or patch the kernel thereby enabling a new class of system security and auditing software.

This talk presents the main concepts behind KRSI: it introduces the technologies leveraged and presents the API exposed to users.

Come and hear how to integrate Collabora Online – a powerful online office suite based on LibreOffice code – with web applications. Learn about how Collabora developers helped to develop solutions by extending the WOPI-like API and PostMessage API of Collabora Online.

Nuspell version 3 is a FOSS checker that is written in pure C++17. It extensively supports character encodings, locales, compounding, affixing and complex morphology. Existing spell checking in web browsers, office suits, IDEs and other text editors can use this as a drop-in replacement. Nuspell supports 90 languages, suggestions and personal dictionaries.

In this talk we will summarize the functionality of Nuspell version 3 and provide easy to follow examples on how to use it as a command-line tool or link to the C++ library. Newly made integrations in Firefox and Enchant will be discussed. The audience will be invited to further integrate Nuspell into their software, create new language bindings, port it to other operating systems and help grow its community. This new spell checker has outgrown from an MVP to a faster and more complete spell checker.

The presentation will give a brief overview of the projects history & lessons learned during the course of developing a high tech camera device as community project. We also want to demo and explain the produced hardware, enclosures and sample footage then look at the challenges still ahead. Last 5 minutes reserved for Q&A

Graph databases and applications have attracted much attention in the past few years due to the efficiency with which they can represent big data, connecting different layers of data structures and allowing analysis while preserving contextual relationships. This has resulted in a fast-growing community that has been developing various database and algorithmic innovations in this area, many of which will be gathering together in this conference. We joined this field as computer architecture researchers and are currently building a complete hardware-software design, called DECADES, that aims to accelerate the execution of these algorithms.

From a computer architecture point of view, applications involving dense matrix operations such as neural networks have garnered much attention for their acceleration through specialized hardware such as GPUs and TPUs, while graph applications remain difficult to improve even with modern specialized accelerator designs. The reason for this is the characteristic pointer-based data structures of graph applications and the resulting irregular memory accesses performed by many of these workloads. Such irregular memory accesses result in memory latency bottlenecks that dominate the total execution time. In this talk, as part of the DECADES infrastructure, we present an elegant hardware-software codesign solution, named FAST-LLAMAs, to overcome these memory-bottlenecks, and thus, accelerate graph and sparse applications in an energy efficient way.

Graph databases and applications have attracted much attention in the past few years due to the efficiency with which they can represent big data, connecting different layers of data structures and allowing analysis while preserving contextual relationships. This has resulted in a fast-growing community that has been developing various database and algorithmic innovations in this area, many of which will be gathering together in this conference. We joined this field as computer architecture researchers and are currently building a complete hardware-software design, called DECADES, that aims to accelerate the execution of these algorithms.

From a computer architecture point of view, applications involving dense matrix operations such as neural networks have garnered much attention for their acceleration through specialized hardware such as GPUs and TPUs, while graph applications remain difficult to improve even with modern specialized accelerator designs. The reason for this is the characteristic pointer-based data structures of graph applications and the resulting irregular memory accesses performed by many of these workloads. Such irregular memory accesses result in memory latency bottlenecks that dominate the total execution time. In this talk, as part of the DECADES infrastructure, we present an elegant hardware-software codesign solution, named FAST-LLAMAs, to overcome these memory-bottlenecks, and thus, accelerate graph and sparse applications in an energy efficient way.

We propose a 40 minute talk which includes a rigorous characterization of the problem, and an in-depth analysis of our software-hardware co-design solution, FAST LLAMAs. We will present results based on a simulated model of our system which show significant performance improvements (up to 8x), as well as energy improvements (up to 20x) on a set of fundamental graph algorithms and important real-world datasets. Our system is completely open-source, and includes a compiler and cycle-accurate simulator. Our proposed system is compatible and easily extendable to many of the open-source graph analytic and database frameworks and we are excited to engage with the open-source community of this increasingly important domain.

The work is part of a large collaboration from three academic groups: Margaret Martonosi (PI Princeton), David Wentzlaff (PI Princeton), Luca Carloni (PI Columbia) with students/researchers: Juan L. Aragón (U. of Murcia, Spain), Jonathan Balkind, Ting-Jung Chang, Fei Gao, Davide Giri, Paul J. Jackson, Aninda Manocha, Opeoluwa Matthews, Tyler Sorensen, Esin Türeci, Georgios Tziantzioulis, and Marcelo Orenes Vera. In addition to the submission author, portions of the talk may be offered by others in the collaboration.

JOIN is one of the most common operation in a database system, and for a long time, the only algorithm for executing a join in MySQL has been variations of the nested loop algorithm. But starting from MySQL 8.0.18, it is now possible to execute joins using hash join. This presentation will walk you through how we were able to implement hash join using our new iterator executor, how hash join in MySQL works, when it is used, and everything else that is worth knowing about hash join in MySQL.

Modern CPUs provide a wide variety of Single-instruction-multiple-data (SIMD) instructions, or vector instuctions, for operating on larger blocks of data than with regular instructions. Though thought of by many programmers primarily as instructions for doing calculations in parallel on arrays of data, these vector instructions can actually be used in other ways to accelerate packet processing applications. This talk goes through a number of examples in open-source projects, such as DPDK and OVS, where vector instructions have been used to boost performance significantly, and explains the general techniques used that can be applied to other applications.

The talk focuses on the work done on DPDK and OVS to leverage the SSE and AVX instruction sets for packet acceleration. It shows how the different tasks to be performed in those applications can be mapped to SIMD instructions, and presents general guidelines on how to think about packet processing work from a vectorization viewpoint. It also discusses some considerations in application design so as to allow the app to run with best performance on a variety of platforms, each of which may have different instruction sets available.

In this talk we will show you, practical, hands on, how you can secure your application, a small user community or environment using industry best of breed security, fully self-supporting and without having to rely on a central certificate authority, big-tech or other central powerhouses. As devolved & federated, or as central as you want - you set the rules. Working for you, with your standard-issue iPhone, your router or your laptop out of the box.

Project redwax produces industry best practice crypto in a small package. Available today. If you know how to install the apache webserver - you are almost there.

Project Redwax lets you download,a set of easy to deploy simple tools that capture and hard code a lot of industry best practice and specialist PKI knowledge. So that they can be put into the hands of a much wider community than currently served by a few specialist industries. It provides a non centralised, interoperable, open standard, open source, fully federated trust network where participants are not required to ask permission and can be self sufficient.

This presentation presents what is available today and our plans on how to take this further, to engage with the wider open source community that together we can support individuals, organisations and (small) companies to get best of breed, distributed, peer to peer, security, confidentiality and privacy without having to rely on central infrastructures.

Wouldn’t it be nice to be able to trust your own environment without having to trust a corporation or government? Wouldn’t it be nice to take the sting out of certificate management?

With some hands on examples we introduce the audience to the advantages of running your own certificate authority for security IOT in and around your home and establishing a trusted channel for exchanging information with your friends.

This project (and code) helps you to decentralize trust management so that the values security, confidentiality and privacy can be upheld in public infrastructure and private interactions. We strengthen the existing technologies and infrastructure by providing a modular, very simple and foremost practical set of tools to manage public key based trust infrastructures as currently used.

Project Redwax lets you download, a set of easy to deploy simple tools that capture and hard code a lot of industry best practice and specialist PKI knowledge. So that they can be put into the hands of a much wider community than currently served by a few specialist industries. It provides a non centralised, interoperable, open standard, open source, fully federated trust network where participants are not required to ask permission and can be self sufficient.

With support from NLNET project Redwax has made the code available under the Apache license from a infrastructure that is firmly rooted in Europe. And the good news - it is simple - if you know how to install the Apache Webserver - you are almost there. We are working with the unix/linux community to get the code in standard distro’s and cloud init scripts so that these capabilities are made available to wider community of application developers.

This presentation presents what is available today and our plans on how to take this further, to engage with the wider open source community that together we can support individuals, organisations and (small) companies to get best of breed, distributed, peer to peer, security, confidentiality and privacy without having to rely on central infrastructures, rare knowledge or big interests.

Speaker: Dirk-Willem van Gulik (Dirkx@apache.org) Talk: 50 minutes. Travel support: not needed Language: English

BIO Dirk-Willem van Gulik?

During the startup-years - Dirk-Willem van Gulik helped shape the world-wide-web. He was one of the founders, and the first president, of the Apache Software Foundation; and worked on standards such as HTTP at the Internet Engineering Taskforce. He has worked for the Joint Research Centre of the European Commission, the United Nations, telecommunications firms, the BBC, several satellite&space agencies and founded several startups. He participated in different international standards bodies, such as the IETF and W3C on metadata, GIS, PKI, Security, Architecture and Internet standards. Dirk build the initial engineering team at Covalent - the first open source company; and was one of the Founders of Asemantics, a leader in Enterprise Information Integration; which helped make the Semantic Web a reality. He then initiated Joost.com, a peer to peer based video and build and lead the team that created the worlds first instant play P2P viewer and a back office system with user profile driven advert targeting and payment settlements. He was the Chief Technical Architect at the BBC where has helped shape the audience facing delivery platform Forge in the time for the Olympics and where he made information security and compliance a core enabler for business processes. He currently works on several medical and privacy intensive security projects with a heavy emphasis on Architecture and Governance. When not at work, he loves to sail, hang out at the makerspaceleiden.nl or play with his lego.

Using web technologies, one can easily emulate the Minitel ecosystem, not only the iconic french terminal but also its servers. This easiness has been made possible due to ES6 and websockets.

• Brief history of the Minitel
• Minitel + VideoTex + X25 vs Browser + HTML + TCP/IP
• Technical aspects of Minitel emulation (ES6 + websockets)
• Creation of a VideoTex page (live demo)
• Surfing on Minitel (live demo)

We will present the challenges in doing distributed deep learning training at scale on shared heterogeneous infrastructure. At NVIDIA, we use containers extensively in our GPU clusters for both HPC and deep learning applications. We love containers for how they simplify software packaging and enable reproducibility without sacrificing performance. Docker is a popular tool for running application containers on Linux, and while it is possible to enable container workflows for users by granting them access to the docker daemon, the security impact needs to be carefully considered, especially in a shared environment. Relying on docker for the container runtime also requires a large amount of complicated boilerplate code to start multi-node jobs using the Message Passing Interface (MPI) for communication. In this presentation, we will introduce a new lightweight container runtime inspired from LXC and an associated plugin for the Slurm Workload Manager. Together, these two open-source projects enable a more secure architecture for our clusters, while also enabling a smoother user experience with containers on multi-node clusters.

There are many container runtimes available, but none met all of our needs for running distributed applications with no performance overhead and no privileged helper tools. For our use case, we built a simple container runtime called enroot - it's a tool to turn traditional container images into lightweight unprivileged sandboxes; a modern chroot. One key feature is that enroot remaps all UIDs inside the container to a single UID on the host. So, unlike runtimes which rely on /etc/subuid and /etc/subgid, with enroot there is no risk of overlapping UID ranges on a node, and no need to synchronize ranges across the cluster. It is also trivial to remap to UID 0 inside the container which enables users to safely run apt-get install to add their own packages. Enroot is also configured to automatically mount drivers and devices for accelerators from NVIDIA and Mellanox using enroot's flexible plugin system. Finally, enroot is highly optimized to download and unpack large docker images, which is particularly useful for images containing large applications.

We also created a new plugin for the Slurm Workload manager which adds command-line flags for job submission. When the “--container-image” flag is set, our plugin imports a container image, unpacks it on the local filesystem, creates namespaces for the container, and then attaches the current job to these new namespaces. Therefore, tasks transparently land inside of the container with minimal friction. Users can even make use of the PMI2 or PMIx APIs to coordinate workloads inside the containers without needing to invoke mpirun, further streamlining the user experience. Currently, the plugin works with two different tools - enroot and LXC. It could be extended to other container runtimes in the future.

One of the most prevalent - if not the most prevalent - exception type in Java is the NullPointerException. While Java set out to overcome the possibilities to do the mistakes one can do when programming in languages like C/C++ by not exposing pointers in the Java language, the misleading term 'pointer' sneaked into this exception. To this day, NullPointerExceptions thrown by the runtime system didn't contain messages. All you had was a callstack and a line number. But in typical expressions and statements there are several dereferences where an NPE can occur in one line.

We - some engineers in the SAP team - thought this could be helped by a little enhancement. The new NPE message gives precise information about the location and tries to explain what was going on when a null reference was encountered. However, due to its prominent nature, it eventually became a JEP.

In my talk I'll demonstrate the improvements that come with this enhancement. I will lift the hood a little and provide a glance at its implementation details. And finally I'll say some words about the current status and share some ideas for further improvements in the area of exception messages.

An in-depth look at the development process of virtual reality in Blender. This project started in 2014 and illustrates well the development channels, how Blender does onboarding, how the development team collaborates with others interested parties, and the role the community has in the projects.

Come learn about how browsers try to guess in what order web page resources should be loaded and how servers use that information to often (accidentally) make your web page slower instead. We look at what resource prioritization is, how it's often implemented terribly in modern HTTP/2 stacks and how we're trying to fix it in QUIC and HTTP/3. We use clear visualizations and images to help explain the nuances in this complex topic and also muse a bit on whether prioritization actually has that large an impact on web performance.

HTTP/2 started the move from multiple parallel TCP connections to a single underlying pipe. QUIC and HTTP/3 continue that trend. While this reduces the connection overhead and lets congestion controllers do their work, it also means we no longer send data in a truly parallel fashion. As such, we need to be careful about how exactly we send our resource data, as some files are more important than others to achieve good web performance.

To help regulate this, HTTP/2 introduced a complex prioritization mechanism. Browsers use complex heuristics to try and estimate the importance of a resource and, with various success, communicate their preferences to the servers. It has however become clear that this scheme does not work well in practice. Between server implementation bugs, questionable browser choices and bufferbloat in caches and network setups, HTTP/2 prioritization is sometimes more a liability than a useful feature.

For this reason, this feature is being completely reworked in HTTP/3 over QUIC. However, there a whole new can of worms is opened. One of QUIC's main features for improving performance over TCP is that it removes "head of line blocking": if one resource suffers packet loss, other can still make progress. That is... if there are other resources in progress! What performs well for lossy links turns out to be exactly what to prevent for high speed connections.

Along the way, we also discuss existing options for web developers to impact the browser's heuristics and server behaviour (such as resource hints (e.g., preload) and the upcoming priority hints).

Finally, we question about how we got in this terrible state of things to begin with: if people made so many mistakes implementing HTTP/2 prioritization, why didn't anyone really notice until 3 years later? Could it be its impact on web performance is actually limited? Or have we just not seen its full potential yet?

We make this complex topic approachable with plenty of visualizations and animations. The content is mainly based on our own research (and papers) and that of others in the web community, such as Patrick Meenan and Andy Davies.

Getting your itinerary presented in a unified, well structured and always up to date fashion rather than as advertisement overloaded HTML emails or via countless vendor apps has become a standard feature of digital assistants such as the Google platform. While very useful and convenient, it comes at a heavy privacy cost. Besides sensitive information such as passport or credit card numbers, the correlation of travel data from a large pool of users exposes a lot about people's work, interests and relationships. Just not using such services is one way to escape this, or we build a privacy-respecting alternative ourselves!

Standing on the shoulders of KDE, Wikidata, Navitia, OpenStreetMap and a few other FOSS communities we have been exploring what it would take to to build a free and privacy-respecting travel assistant during the past two years, resulting in a number of building blocks and the "KDE Itinerary" application. In this talk we will look at what has been built, and how, and what can be done with this now. In particular we will review the different types of data digital travel assistants rely on, where we can get those from, and at what impact for your privacy.

The most obvious data source are your personal booking information. Extracting data from reservation documents is possible from a number of different input formats, such as emails, PDF files or Apple Wallet passes, considering structured annotations and barcodes, but also by using vendor-specific extractors for unstructured data. All of this is done locally on your own devices, without any online access.

Reservation data is then augmented from open data sources such as Wikidata and OpenStreetMap to fill in often missing but crucial information such as timezones or geo coordinates of departure and arrival locations. And finally we need realtime traffic data as well, such as provided by Navitia as Open Data for ground-based transport.

We will of course also look at how features based on that data can be integrated into applications. While there is the KDE Itinerary mobile application presenting these information in a timeline view with access to the corresponding boarding passes or ticket tokens, the underlying building blocks are explicitly meant to be reusable for wider integration. This might be of particular interest for people working on e.g. email application or digital assistants.