FOSDEM welcome and opening talk.

Welcome to FOSDEM 2023!

February 2023 marks the 25th Anniversary of Open Source. This is a huge milestone for the whole community to celebrate! In this session, we'll travel back in time to understand our rich journey so far, and look forward towards the future to reimagine a new world where openness and collaboration prevail. Come along and celebrate with us this very special moment!

The open source software label was coined at a strategy session held on February 3rd, 1998 in Palo Alto, California. That same month, the Open Source Initiative (OSI) was founded as a general educational and advocacy organization to raise awareness and adoption for the superiority of an open development process. One of the first tasks undertaken by OSI was to draft the Open Source Definition (OSD). To this day, the OSD is considered a gold standard of open-source licensing.

In this session, we'll cover the rich and interconnected history of the Free Software and Open Source movements, and demonstrate how, against all odds, open source has come to "win" the world. But have we really won? Open source has always faced an extraordinary uphill battle: from misinformation and FUD (Fear Uncertainty and Doubt) constantly being spread by the most powerful corporations, to issues around sustainability and inclusion.

We'll navigate this rich history of open source and dive right into its future, exploring the several challenges and opportunities ahead, including its key role on fostering collaboration and innovation in emerging areas such as ML/AI and cybersecurity. We'll share an interactive timeline during the presentation and throughout the year, inviting the audience and the community at-large to share their open source stories and dreams with each other.

Modern systems have come a long way from waking up every 16 milliseconds to peek and poke into a framebuffer which was directly displayed to the user. A single image frame may begin in a camera, be pushed through an image signal processor, be sent through several layers of web browser for processing and using the GPU to add funny hats, then be sent simultaneously to a media codec to send to your friends, as well as onwards through the window system to your display controller, possibly with colour correction, alpha blending, and more, along the way. These systems are every bit as complex as they are poorly understood. In this talk, Daniel will attempt to answer all the questions you never knew you had, such as: is GBM really the Generic Buffer Manager? What's wrong with fbdev? How do I even allocate buffers? Why won't Wayland give me 1000fps on glxgears? If GPUs are so very fast, why does everyone tell me I can't use them because they're slow? And what do these window system people even do all day, anyway? The talk is aimed at anyone who wishes they understood the complexity of modern display pipelines, plans for future development, and how to develop applications & products that use the full capability of modern hardware at maximum effectiveness.

Setting the stage for the Railways and Open Transport developer room

Confused about all these new acronyms? Look no further: we will introduce and decode common terminology and concepts that are needed to follow the development of image-based Linux, especially covering other topics that will be presented and discussed as part of the devroom.

The UAPI Group introduced a set of acronyms, terms and concepts within the scope of image-based Linux. We will introduce topics such as UKI (Unified Kernel Image), DDI (Discoverable Disk Image), sysext (system extension), syscfg (system configuration), portables (portable services), and more. We will discuss where these concepts apply, what they can be used for, how they integrate and form the basis of our vision for image-based Linux, and where they are implemented and how today. Other talks in this devroom will make heavy use of these acronyms.

As of October 2022, we run a 15 minutes fuzzing session for all Pull Requests submitted to the Virtio Device implementation in rust-vmm. But implementing the fuzz targets was not smooth sailing. In this talk, we go over the challenges of implementing fuzzing for Virtio Devices and how to overcome them.

Being one of the most critical components in a virtualization stack, the Virtio Device Model is a great target for fuzzing. Fuzzing is a security focused testing technique through which you can discover vulnerabilities in code that deals with untrusted input.

When fuzzing Virtio Devices one of the biggest challenges is mocking the device-driver communication. This talk will show how we approached this in rust-vmm, and why fuzzing should be taken into consideration from the early development stages.

FIM (Fbi IMproved) is a powerful image viewer with a minimalistic interface. FIM follows the spirit of the VIM (Vi IMproved) text editor: it is specialized in its task and powered by an own domain-specific language (DSL) which allows powerful custom features. FIM happens to be mostly appreciated by users of: [neo]mutt, emacs/mu4e, vim, command-line-interface and non-standard Linux Framebuffer-enabled hardware. The talk will introduce FIM's unique features from the perspective of its DSL, with word on the future. Feedback is welcome.

https://www.nongnu.org/fbi-improved/

GStreamer is a popular multimedia framework making it possible to create a large variety of applications dealing with audio and video. Since the last FOSDEM, it has received a lot of new features: its RTP & WebRTC stack has greatly improved, Rust has become a first-class language, a high-level transcoding API was added, and much more. I will go over those major improvements and explain who they can be most useful for. Finally, I'll will look forward at the next releases.

GStreamer is a highly versatile plugin-based multimedia framework that caters to a whole range of multimedia needs, whether desktop applications, streaming servers or multimedia middleware; embedded systems, desktops, or server farms. It is also cross-platform and works on Linux, *BSD, Solaris, macOS, Windows, iOS and Android.

This talks targets everyone who cares about Free and Open Source multimedia on embedded systems. GStreamer is the standard multimedia framework, not only on the Linux desktop, but most importantly, in embedded Linux systems.

Opening Remarks from the DevRoom Sovereign Cloud Team

Introduction and Welcome to the Legal and Policy Issues Devroom

Welcoming participants to the Kotlin DevRoom @ FOSDEM 2023 - We're back in person!

Let’s do things differently. To start with, let us view logs and traces as no different from any other data. The data an application indirectly generates when in use (the logs and traces) is no different from the data an application directly works with (input and output). So let’s keep them all together in a scalable cloud storage repository. Once it is there, it is just like any other big data. We need to analyze and apply intelligent monitoring to detect situations of interest. So we need to apply trained ML models to a stream of such data for immediate alerting when the traces indicate an unwanted behavior occurring or brewing. This talk will show how to harness existing technologies to do just that.

The commonalization of desktop, phone & tablet, with the goal of providing the most user-friendly shell to the hands of users. With years of development behind it and a strong community of enthusiasts around it, Lomiri is well positioned to provide a delightful experience to both power users as well as ordinary users, powered by future-proof technologies.

In this presentation he will demonstrate how over the last 5 years Ubuntu Touch convergence has evolved from vision to reality. Switching from the custom windowing protocol it used to a commonly shared one, adapting to the defacto-standard systems layer for GNU/Linux systems, software pieces that work in tandem to provide UI features such as workspaces with window snapping and resolution specific window scaling, and managing app lifecycles in a scenario-based way.

A word of welcome by the Energy Devroom managers.

Isn’t it a cool idea to understand societies of interstellar civilization? While this may look like a fictional scenario, I believe academically serious studies can be done through simulations. Because special relativity plays a role in this scenario, it is not a strict forward task to implement interstellar social model using existing social simulation framework. As a result, I have created an open source simulation framework, Relativitization, to ease the model development.

In this presentation, I will introduce the architecture of the framework and how the framework can be used. Besides that, I will introduce a complex social model, a.k.a., a turn-based strategy game, developed based on the framework. I believe the game is useful for educating relativistic physics to the public. As a Ph.D. student in social science with a background in physics, developing an open source software is a challenging process. I will also share my experience in overcoming the challenges.

We manage a 200TB glusterfs cluster in production. While we were managing this, we learnt some key points. In this session, we will share with you:

• What are the minimal health checks that are needed for a glusterfs volume, to ensure high availability and consistency
• What are the problems with the current cluster expansion steps(rebalance) in glusterfs we experienced? How did we manage to avoid the need for a rebalancing of data, for our use-case. Proof of concept for new rebalance algo for future.
• How are we scheduling our maintenance activities such that we never have downtime even if the things go wrong.
• How did we reduce the time to replace a node from weeks to a day.

As the number of clients increased we had to scale the system to handle the increasing load, here are our learnings scaling glusterfs

• How to profile glusterfs to find performance bottlenecks.
• Why client-io-threads feature didn't work for us? How we improved applications to achieve 4x throughput by scaling mounts instead.
• How to Improve the incremental heal speed and patches contributed to upstream
• Road map for glusterfs based on these findings

TEDective is a free software (open-source) solution that makes European public procurement data explorable for non-experts. Let’s say you are a curious citizen who wants to find out how much taxpayer money your municipality spends each year on unfree software. To date, there is no free software-backed, community-developed application out there that helps you answer this question.

TEDective changes that by bringing light into the public procurement data published by the EU’s Tenders European Daily (TED) project. It transforms the XML files provided by TED into the interoperable Open Contracting Data Standard (OCDS) and then visualizes the data as a graph of relationships between companies and the public bodies they supply. Currently, neo4j is used to store the TEDective graph. Finally, the data will be enriched by other complementary data sources such as OpenCorporates and OpenSanctions.

Every year, public institutions in the EU spend more than €2 trillion on various goods and services. While the EU publishes a lot of data about public procurement in the form of TED (https://ted.europa.eu), somebody interested in European public procurement still faces a lot of difficulties: TED data is overly complex, doesn’t follow the international and interoperable Open Contracting Data Standard and is hard to explore as the UI provided by TED is limited to basic filtering and search.

This situation was the starting point for TEDective – an initiative by the Free Software Foundation Europe to make European public procurement data both accessible and explorable - for everybody. We believe that the transparency needed by such a solution to function in the interest of its users can only be provided by a community-led free software project. TEDective is such a project. The project already won the first prize at this year’s EU Datathon. With this initial funding, we are now keen to spread the word and build a community of data science, procurement and usability experts who can help us in our quest to open up and democratise European public procurement data.

In the talk, we will show you what we have done so far and how you can help us make TEDective more useful every day.

Go 1.20 is planned to be released in February 2023 and this talk covers what's coming up with it. We'll talk about new features and fixes in Go, new proposals for Go. All of the new things you might have missed!

An explanation of the structure of any complex system becomes more easily digestible and less confusing if it is accompanied by simple and understandable diagrams. Different subject areas have their own ways of depicting objects. In the case of Kubernetes clusters, this task becomes very non-trivial. Traditional network diagrams are a poor fit for a container orchestrator; official emblems have features that require their careful and moderate use. Finally, the complexity of Kubernetes makes it very easy to overload a drawing with details. We will look at how Kubernetes clusters are usually drawn by various authors. It will show how auxiliary tools such as color coding, grouping, and eye anchoring can make the cluster diagram more understandable... and how not to get the opposite effect when drawing your cluster.

OTA updates should happen frequently and install quickly even with growing OS and application sizes at limited data throughput and limited on-target storage. Untrusted cloud storage or communication channels also increase the need for encryption.

This talk will give an overview of how the RAUC update framework had to overcome some limitations of the early design to address these challenges without compromising its original goals.

In 2015, the RAUC update framework was started as an Open Source project to end the era of home-grown shell-script Embedded Linux and IoT system update 'solutions'. More than seven years later, RAUC has been used in many diverse projects, of which Valve's Steam Deck is probably the most widely known.

The focus of this talk will be the introduction of the 'verity' update bundle format in RAUC that has not only improved the verification process but has also allowed extending RAUC by built-in HTTP(S) network streaming support, adaptive delta-like updates, and full bundle encryption.

Driven by the frequent demand to allow decoupling more frequent app or container updates from full A/B OS updates, the talk will give an outlook on recent developments about reconciling this with RAUC's principles.

Quickwit is an opensource distributed search engine. The most challenging component of a search engine is its indexing pipeline.

It takes a stream of JSON documents, processes them in batches, and emits index artefacts we call splits.

We needed our implementation to be robust, testable, observable, and efficient... But even more importantly, our code had to be easy to work with.

I will explain why we chose to develop our own actor framework and discuss the unique features of our implementation.

Passwordless and multi-factor authentication (MFA) are becoming a trend and their usage will increase in the near future. However, most of the solutions target the web/online pattern, or the local users, thus leaving centralized identity management for console and POSIX system applications lacking those capabilities.

For the last year FreeIPA and SSSD have been working on enabling FIDO2/WebAuthn support for remotely managed users. One part of it is enabling a user stored in a LDAP server to locally authenticate in a system using a FIDO2 key. Another part is to use FIDO2 authentication to obtain a Kerberos ticket. This opens a new world to organizations to tighten their security, while maintaining strict control as to who access their systems.

This talk will focus on the progress in FIDO2/WebAuthn authentication in SSSD by providing the implementation state, the solution details and a demo. Additional information on the possible expansion of the solution will also be provided.

Talk to set the stage. Mark van Stiphout will go over the challenge we are currently facing in Europe, the policy that is in place and opportunities for Free and Open Source Software to make a difference.

Mark van Stiphout is currently Deputy Head of Unit in DG Energy in the unit that is responsible for Research, Innovation, Competitiveness and Digitalisation.

SaaSS means using a service implemented by someone else as a substitute for running your copy of a program for a computing activity that is entirely your own. It is explained in detail at https://www.gnu.org/philosophy/who-does-that-server-really-serve.en.html.

Services where the code is published as free software provides a huge mitigation to SaaSS, but to keep your software freedom, you need to identify it and avoid using it.

This talk will first explain some finer points of SaaSS going beyond what is written on gnu.org. I will introduce the concept of the primary purpose of using a service and incidental computing. We will evaluate what parts of some popular services are SaaSS. I will introduce an edge case as an example that the line is not always black and white. The audience will gain confidence in evaluating services they encounter for whether any parts are SaaSS.

There has been relatively little attention paid to SaaSS, but it is on the rise especially with AI services. I will suggest some practical cases and approaches for raising the issue of SaaSS. Is there a simpler way to put it? Maybe "That kind of service should only run on your own computer as free software."

Publishing free sources for non-SaaSS services is also important and warrants some discussion. If most services aren't SaaSS, why does the FSF recommend the AGPL for all service software? Users of services and society at large deserve the sharing of service software for reasons other than SaaSS which I will discuss.

This panel discussion will examine best practices for how the energy industry can implement and benefit from open source technology by exploring how traditional or legacy industries including automotive, embedded systems, finance, and networking/telecommunications have been transformed in recent years. Panelists will relay their experience working within these industries to explain how to speed adoption of open source to drive innovation and digital transformation to support the energy transition.

The major BSD Operating Systems, FreeBSD, NetBSD and OpenBSD, tend to evolve independently from each other. However, they still share large parts of their respective vision and idioms - in other words, they have way more similarities than differences to each other. An important common requirement is to support a wide range of computer devices and equipment. Unfortunately, device drivers from a BSD system are usually not directly suitable for the others. The differences vary in different amounts depending on each subsystem, bus, kernel API, etc. This presentation will illustrate the situation with a few examples, and work as a call for volunteers from every BSD project. The goal is to explore areas where more code can be shared among the different BSDs, with a focus on device drivers. Generally, good ideas deserve a chance to be visible across the different systems!

The aim of this presentation is to attempt to create a common effort, in any shape or form, in order to foster cooperation between the major BSD systems in terms of driver development in particular. The ideal outcome of this presentation could be the creation of a committee and/or of a mailing-list - formal or informal - which could convene regularly and share the state of the development for each BSD, and identify areas where designs could converge towards easier code sharing of device drivers for instance. I am myself involved with the NetBSD project (khorben@), member of the Board of the NetBSD Foundation, and would happily coordinate on that side.

You're a railway infrastructure manager. A train operator calls up, and would like to fit a new train in the existing schedule. It should leave at 10am, and it's 8am. How do you make sure this new train won't cause any traffic jams?

We discuss what is short-term train planning, what are the challenges involved, and how it's done in OSRD.

A journey from single documentation files to a meaningful information architecture.

The Sovereign Cloud Stack combines the best of Cloud Computing in one unified standard. SCS is built, backed, and operated by an active open-source community worldwide. As only the sum of different repositories complete the SCS Stack, it is important to have an easy and accessible documentation of the SCS Project in one place. In this talk you will be taken on our journey on how we have developed a low invasive workflow to bring together all individual docs to a unified collection that is being generated to single page application using docusaurus. A journey that takes us from a mere collection of markdown documents to a meaningful information architecture. With this talk we not only want to convey our story but invite you to feedback your experiences with such endeavours.

Kotlin ecosystem is rapidly evolving over the years and 2022 was not an exception. Let's gather to recap everything that happened with Kotlin in the past year and to have a closer look at the language roadmap: from the new K2 compiler, to stable Kotlin Multiplatform and beyond.

Linux container escapes continue to affect Kubernetes and derived products. User namespaces are one technology that can mitigate the risk. In this presentation I will explain the past, present and future of user namespace support in Kubernetes, and discuss how to run systemd-based containers in user namespaces. And why you would even want to try. There will be demos! Attendees will learn about what containers are, the technologies that underpin Linux containers, and how Kubernetes actually runs containers.

"systemd in a container? What! Why!?" We had our Reasons, and I'll even explain them. But more interesting than the "why" is the "how", and that's what this talk is about. Come and learn about the upcoming and in-development Kernel and Kubernetes security features that will enable better container isolation and secure deployment of systemd-based workloads.

This is a talk about what happened when a handful of complete container newbies tried to port their massive, complex, legacy application to Kubernetes. As a monolithic container. Based on systemd.

The runtime shunned our container and refused to execute it. Cloud engineers recoiled in horror at our architecture. With astounding hubris we ignored their admonitions and doubled down. If the container runtime won't run our application, well, we'll just modify the container runtime!

And so we did. Our journey took us into the darkest corners of container runtimes, Kubernetes and systemd. And we have emerged to tell you the tale. There will be demos.

Attendees will learn about the security technologies that underpin Linux containers, including namespaces and cgroups, as well as the behaviour of systemd in containers. I will also discuss the recent and planned changes in Kubernetes to provide official support for running containers in user namespaces.

Free and open source silicon, the art and craft of making computer chips with (only) free tools, has come a long way -- and has now reached the magic threshold where it can't be ignored any more. In this talk, we'll do a fast-paced journey through what's needed to go from an idea for a silicon chip to actually producing a real physical one using free and open source tools and building blocks. And since talk is cheap, we'll actually build a chip design during the talk in a live demo. Join to learn more about what's possible today, how free and open source is permeating the established industry, and how you can get involved as well.

In the last decades, producing a "real" silicon chip was an effort that required a large-ish team, a fair amount of money, and inside knowledge that only a small, selected group of individuals and companies had. That has changed: free and open source silicon is here, and it democratizes access to chip design for anyone. Free tools in all areas of chip design, from simulation to synthesis and physical design, have attracted renewed attention and are at a point where they are powerful enough to be used for actual chip tapeouts. The last barrier of entry for prospective chip designers fell with the announcement of the SkyWater PDK two years ago: real-world design rules, required to manufacture chips, are now freely available as well.

In this talk, we'll look at the open source silicon ecosystem: which tools do we have available, how are they working together in a toolflow, and can all of that be combined to produce a working chip?

Open source software has irrevocably changed the way software is developed. Open source silicon is set to do the same: inject new life into the traditionally closed chip development ecosystem, combining ideas from the open source software world with the accumulated wisdom of seasoned hardware engineers.

LIPS Scheme project is a powerful lisp based on Scheme R7RS specification. It integrates very well with the host language which is JavaScript. The presentation will show a bit of history (lisp, scheme, and LIPS) and later explain different features of the language and a bit about its internals.

It will also show how you can interact with the hosting language (JavaScript) and how you can extend the language in Scheme.

On 2018 Luca purchases a Lenovo Tablet/PC and, since it comes with Microsoft Windows pre-installed, he requested the refund to Lenovo, but Lenovo denied to refund Luca. A court case was initiated, and Lenovo was condemned to pay a punitive damages of 20000 euros for its abusive behaviour.

After this "historic" case, some other refund were request to other companies, such as HP, Dell, Microsoft, Acer, and again to Lenovo. Each OEM tried to deny the refund, with various reasons such as contractual clauses contained in the sale contract or in the same license agreement, or the need to delete the Product Key stored in the MSDM BIOS ACPI table and therefore they require to send the PC to their laboratories. These reasons have no valid legal basis, because – at least in Italy – the license agreement is a contract totally unrelated to the sale contract, so a third party may not impose any action on your material good, and the license agreement has remained without causal and economic justification, because not accepted and missed to be concluded.

Phones running Linux became reality in last few years, and they do have cameras, but taking sharp and correctly exposed photos is still not easy, and neither is recording even short movies. I'm trying to change that, and have some successes I'd like to talk about, but there is more work are more challenges in front of us.

There are three major platforms available today: PinePhone, Librem 5 and PinePhone Pro. PinePhone includes "smart" camera sensor, which is able to do auto-exposure, auto-focus and JPEG compression on its own. Capturing good photos is relatively simple using Megapixels. Capturing 2MP, 30fps video is possible with some "interesting" solutions I'll describe. Librem 5 is much more interesting. It includes dumb 13MP sensor, with support for phase-detection auto focus. Auto-exposure and auto-focus needs to be done in software, with auto-focus being quite complex and requiring different solutions based on use case. I do have unoptimized solutions for auto-exposure and auto-focus in Millipixels project, but they really belong to libcamera. It is possible to capture 0.8MP, 20fps movie. There's really more work to be done on all sides, including kernel -- bayer10 support, caching, libcamera and applications.

Please note that this talk was originially scheduled to be given at 13:10. The talk originally in this slot, "Writing a convergent application in 2023 with Kirigami" by Carl Schwan will now take place at 13:10.

Matter is the new kid in town when it comes to IoT protocols. As an application layer protocol based on IPv6 it aims to be the language for IoT devices. With Thread it supports a low-power wireless protocol which allows sleepy devices to operate on a coin cell battery for years and still allow end-to-end connectivity. This talk will look at the technology in Thread and Matter and its open source implementations. Topics include mesh capabilities of Thread, the border router and service discovery.

Based on my OpenThread FOSDEM talk from last year this shows an extended blueprint we created for the Oniro project to provide a connectivity solution for embedded devices running Linux or Zephyr. The Matter specification, together with an open source SDK, got just released in October 2022. As Matter is based on IPv6 it can run over a different number of connectivity solutions. From the start it supports Ethernet, Wi-Fi and Thread. The later being a low-power wireless protocol for a few years already, but without to much traction. With Matter support this might change in 2023 and forward. With border router support in popular devices like Apple Homepod and TV, Google Nest and Wi-Fi or Eero access points the needed technology infrastructure will become available in normal households.

The abstract

NLnet Labs and Red Hat are closely following two legislative proposals from the European Commission applicable to almost all hardware and software on the European market;

• The Cyber Resilience Act (CRA), intends to cover products including digital elements, like software, with cybersecurity conformity requirements and obligations.
• The new Product Liability Directive (PLD) is looking to extend liability for defective products to the world of software.

The audience will learn about the CRA and PLD from different angles: from their respective authors at the European Commission, from a small, public benefit organisation producing and supporting upstream open source software, and from organisations promoting, using and distributing open source software.

The session will be divided in two parts:

• A series of lightning talks from representatives of the European Commission and NLnet Labs to introduce the subject.
• A panel, moderated by Red Hat, with participation from Digital Europe, the EC Open Source Program Office, Red Hat and NLnet Labs to share views and opinions about the future of open source software within the current and future legal framework.

The session will be split into two parts as follow:

Lightning Talks (~45min)

Topics:

• Introduction to the Cyber Resilience Act by Benjamin Boegel from DG-CNECT at the European Commission
• The Cyber Resilience Act from a NGO involved in open source by Maarten Aertsen, NLnet Labs
• Introduction to the new Product Liability Directive by Omar Ennaji from DG-GROW at the European Commision

Panel (~45min)

The panel theme is: How to proceed as a community?

Participants:

• Maarten Aertsen, Sr Internet Technologist, NLnet Labs
• Gijs Hillenius, IT Project Officer, EC DIGIT Open Source Program Office
• Zoey Stambolliu, Sr Policy Manager, Digital Europe
• Romuald Vandepoel, Chief Digital Advisor for Public Sector, Red Hat Inc.

supporting the panel:

• Benjamin Bögel, Policy Officer, EC DG-CNECT
• Omar Ennija, Legal and Policy Officer, EC DG-GROW

moderated by James Lovegrove, Public Policy Director, Red Hat Inc.

Matlab + Simulink is a very powerful tool. This tool allows engineers to simulate real devices. In open sources, some tools exist, such as Scilab + Xcos. With the growing community of Python, some tools appeared: NumPy, SciPy... Those tools intend to propose a Matlab alternative environment equivalent for Python. MuPhyN is an interface that is intended to reproduce the Simulink capabilities. The goal is to produce a community-based simulation software.

It is based on a Qt interface and uses a simulator core. It is fully written in Python and uses YAML as the descriptive language. The library feature proposed allows users to add as many boxes and schedulers as they want. The already created boxes take advantage on the SciPy and NumPy libraries to produce their behaviors.

Game of Trees (Got) is a version control system which prioritizes ease of use and simplicity over flexibility. Got uses Git repositories to store versioned data. Got is being developed on OpenBSD and its main target audience are OpenBSD developers. The -portable version of Got provides support for FreeBSD, NetBSD, DragonflyBSD, Linux, and MacOS.

A recent addition to Got's tool suite is a daemon called gotd(8), which serves Git repositories over SSH connections. This talks provides a short general introduction to Got and then presents the design of gotd(8), its usage, and details about its implementation.

This talk will walk through a node embedding algorithm called HashGNN. Node embedding algorithms provide an important bridge between graphs and traditional machine learning. Such algorithms construct for each node in a graph an associated vector which can capture local graph structure and properties. We will discuss why HashGNN is a useful embedding algorithm, its implementation in GDS which is an extension to heterogenous graphs, some intuition behind it, how it compares to Graph Neural Networks which inspired HashGNN, and more.

FIDO security keys can be used effectively to secure access to websites and applications, rendering phishing attacks harmless with hardware-protected cryptographic keys while keeping a low-friction user experience. Security keys can however also be used for different use cases, that don't necessarily involve a browser.

In this presentation we will briefly explain what FIDO Security Keys are and how they work. We will then show how security keys can be used as an alternative to more traditional hardware security solutions like smartcards. In particular we will explain how tools like OpenSSH can be used to not only authenticate users when accessing servers, but also to sign files or other data, such as git commits. We will explain how attestation works and how you can prove that a signature was made using a security key, and how to reliably determine the type of security key used. We will show what FIDO extensions can be used, for instance to store small data files such as certificates on a security key, or to derive symmetric keys that can be used to encrypt data.

Finally, we'd like to collect feedback from participants in identifying other use cases that could benefit from security keys as a low cost and versatile way to secure applications.

Over the past 12 years, OpenStack has become the de-facto standard for providing cloud infrastructure using open source solutions. But in the past 6 years, the ecosystem focus has shifted higher in the stack onto cloud-native solutions, which run on top of an existing cloud infrastructure. Does that mean that open source cloud infrastructure solutions, like OpenStack, are no longer relevant?

In this talk, Thierry Carrez, the General Manager for the Open Infrastructure Foundation, the non-profit hosting the OpenStack project, will explore this question. After examining the motivation and history of OpenStack over the past decade, we will explore what makes OpenStack relevant in the next decade, with a special attention to the European context. While it is not for everyone, new use cases like Digital Sovereignty or Edge computing are driving renewed adoption of OpenStack, especially in combination with Kubernetes (what is called the Linux OpenStack Kubernetes Infrastructure, or LOKI).

Being the maintainer of a fairly active oss project (MetalLB) over the past year, I reviewed a substantial amount of contributions. During this process, I identified a set of recurring idioms and patterns that less experienced contributors keep missing, making the codebase harder to read and to maintain.

In this talk I will describe what cognitive load is and why it matters, and provide a way to reduce it via a set of quick and easy recipes. Using this set of actionable recipes the audience will be able to drastically improve the quality of their Go code with relatively low effort.

Device-Mapper’s “verity” target provides transparent integrity checking of block devices using a cryptographic digest provided by the kernel crypto API. This target is read-only.

This presentation will illustrate how to integrate dm-verity with A/B booting as u-boot as used in project opencritis.org.

This talk will detail the current state of PipeWire and the plans for the future.

PipeWire started out as a low-level multimedia transport layer. Services such as screen sharing and later audio routing were added on top of this infrastructure. Major distributions are now adopting PipeWire as a replacement for both JACK and PulseAudio. The next step for PipeWire will be to enhance the video sharing support. This talk will briefly outline the architecture of PipeWire, the current status and the future plans.

In the last years, SBB has developed a binary data format, based on the open standard HDF5. We call this format Rail Condition Monitoring Data Exchange, or short RCM-DX. We already decided to set this format Open Source. In parallel, SBB has developed a Viewing software for this data format, called RCM-DX Viewer. We are in the process to also set Open Source this viewing software as well as a Java and C# Library that can read and write RCM-DX directly. The SBB is hoping to attract a community for those tools in order to have a free and open standard format for measuring data in the rail infrastructure domain. In an ideal world, in future a railway company can mention this format in an open tender and thus ensure, that data produced is open and readable. Also a new company, creating a new measurement system can rely on this viewing software and data format and thus lower its initial amount of work to enter the market. We would like to show our current state and let the world see where those components can be obtained

Cloud and Open Source have a very intricate relationship! In this talk we will look at the history of how the impact of Cloud on Open Source changed through the years, examine the current state as well as make a case for a particular way to use Cloud and Open Source Together. If you cherish the values of Open Source - you will do well by using Cloud as Commodity Infrastructure Provider and run Open Source Software on top of it. Consider Kubernetes in particular as your API of choice with its ubiquitous availability among all major public cloud providers and private cloud software vendors. We will show what while this ecosystem may not be as mature as proprietary solution from cloud vendors it is moving rapidly and becoming a great fit for more and more situations.

An instant world requires instant decisions at scale. This includes the ability to digest and react to changes in real-time. Thus, event logs such as Apache Kafka can be found in almost every architecture, while databases and similar systems still provide the foundation. Change Data Capture (CDC) has become popular for propagating changes. Nevertheless, integrating all these systems, which often have slightly different semantics, can be a challenge.

In this talk, we highlight what it means for Apache Flink to be a general data processor that acts as a data integration hub. Looking under the hood, we demonstrate Flink's SQL engine as a changelog processor that ships with an ecosystem tailored to processing CDC data and maintaining materialized views. We will discuss the semantics of different data sources and how to perform joins or stream enrichment between them. This talk illustrates how Flink can be used with systems such as Kafka (for upsert logging), Debezium, JDBC, and others.

Follow me as I walk through my journey of building lnx, a distributed search engine written in Rust akin to Elasticsearch or Algolia that aims to be faster and more efficient using tantivy. I cover the challenges and solutions I encountered while developing lnx over the last year, the tradeoffs made and how you can build your own search engine using the tools the Rust ecosystem provides.

In the first part of the talk we'll look at what a search engine like Algolia or Elasticsearch does, how tantivy works, what things we need to do in order to make it suitable for user-facing search and how we implement it into our code to build our own application.

In the second part of the talk I talk about the biggest issue you run into when building a search engine or any other system designed to store data... Fault tolerance and replication, together we'll go through the challenges of implementing this for a search engine using tantivy, keeping the performance competitive, reliable and the tradeoffs that are made to make it work. We'll look at some existing implementations like Raft and take a dive into the world of eventual consistency!

With any luck, you'll have a better understanding of how we can build services like search engine using libraries like tantivy along with solving technical challenges like consensus and replication for distributed systems in Rust.

vhost-user-blk is a userspace block I/O interface that has traditionally been used to connect software-defined storage to hypervisors. This talk covers how any application that needs fast userspace block I/O can use vhost-user-blk and its advantages over network protocols. A client library called libblkio is available for C and Rust applications will be introduced. The protocol is also summarized for those wishing to understand how it works or implement it from scratch.

This talk is intended for developers interested in connecting applications to SPDK or qemu-storage-daemon and those who want to know more about software-defined storage interfaces.

• Local block storage interfaces
  • Kernel vs userspace
  • Notifications vs polling
  • Message-passing vs zero-copy
• What is vhost-user-blk?
  • Implemented by qemu-storage-daemon and SPDK
  • virtio-blk and VIRTIO
• How to connect using libblkio (C/Rust)
• How to implement a server using libvhost-user (C) or vhost-user-backend (Rust)
• How to integrate with the Linux kernel block layer using VDUSE

OpenStack and Ceph have a long integration story that changed over the time to make the two technologies coexist in the same context as basic building blocks of Cloud infrastructures. ceph-ansible has been one of the most popular orchestrators for Ceph, but cephadm and the Ceph orchestrator have been a game changing in the way how operators interact with Ceph. To streamline the deployment process, OpenStack services need to be configured to interact with Ceph but there is also a need to bootstrap, configure and tune the Ceph cluster to meet the OpenStack workload. An example is Manila, where the new ceph mgr interface enabled new drivers and simplified the existing use cases. This talk will give an overview of the current state of the integration, and how projects in the OpenStack ecosystem changed and updated the reference architecture as a result of the introduction of cephadm and the Ceph orchestrator but also look towards at the Kubernetes integration, when a single Ceph cluster can be shared by OpenStack (rbd interface) and the Kubernetes workloads via pvc.

We all need to help decarbonize our world. It's hard to get hold of a PV system or heat pump for your household these days, but the real challenge to home owners is to implement a comprehensive energy management that makes best possible use of their own solar (excess) power. There's organizational, regulatory and electro-technical challenges and those specific to control, be it with 'autonomously' acting appliances such as EV chargers and heat pumps or 'simple' things like to detect a washing machine's operational state. And what sort and extent of behavioral change will "household operators" accept ?

I will have a rapid talk about real world issues we have encountered when developing and deploying a Home Energy Management System based on openHAB. It's covering the most power intensive use cases of a household: EV charging, heat pump and white goods operations.

Let's look at what Trusted Platform Modules (TPM) chips can do for you, and how they can help protecting your systems from online and offline attacks. We'll specifically focus on Linux image-based OSes, and how to secure them properly with a TPM and related technologies. We'll look at possible avenues for generic Linux distributions to make use of the now ubiquitous TPMs and how to catch up with ChromeOS, Windows and other OSes on this front.

We'll discuss concepts such as TPMs, UKIs, SecureBoot, DDIs, dm-verity, LUKS and more.

Pre-Scheme is a statically typed dialect of Scheme which offers the efficiency and low-level machine access of C while retaining many of the desirable features of Scheme. Developed by Richard Kelsey in the late '80s based on the powerful "Transformational Compiler" from his dissertation, it didn't see much use beyond the Scheme 48 virtual machine. With a renewed community interest in systems-level Scheme programming thanks to the growth of the Guix project, it's high time we revisit this corner of history.

In this talk we will: - review the history of Pre-Scheme - review its compiler implementation and related work - discuss the features & limitations of Pre-Scheme - discuss porting efforts & future work

Chromium has used V4L2 for cameras for many years and it works reasonably  well. Modern complex cameras are no longer a simple V4L2 device. libcamera  must be used instead. For Chromium in a Flatpak or Snap container it would  be nice to manage camera access at runtime. Or let's have some fun and use  an arbitrary video stream as a camera.

So the goal was to implement some kind of high-level camera interface. The  choice of technology was easy: xdg-desktop-portal is already used for  screen sharing and it has support for cameras as well. And PipeWire, the  media daemon that handles the camera already supports libcamera. 

I started the implementation more than a year ago and it is still ongoing.  This presentation gives an overview of the technologies involved, how it  fits all together and the story of the long and winding road to implement  this in Chromium.

In the last two years, we have examined over 180 research projects that develop, refine and use software related to energy in buildings and neighborhoods. These projects originate from Germany and are funded by the Federal Ministry for Economic Affairs and Climate Action. The aim of this presentation is to give an overview of relevant research fields and related software, missing software building blocks and to talk about the relationship of software developed and used by the projects to open source.

In this presentation we give an overview of the different relevant topics (especially simulations and monitoring) and the related software. We further state why there is a need to develop open sourcealterantives for them. Based on this, we state reasons for the existing challenges for (research) software in the field of building energy technology. We discuss approaches to solutions and provide impulses for relevant software that is currently lacking.

Emissions from buildings are one of the biggest drivers of global climate change. Refurbishment, changes in use and operation, or adapted planning are ways to reduce these emissions. In order to achieve this goal, researchers worldwide are developing numerous ideas and corresponding software. Our analysis of the German landscape shows that even if criteria for open source and open science are met, much of this software is not reused, resulting in parallel developments. In addition to heterogeneity in the infrastructure, there is also a lack of individual building blocks in open-source software chains (e.g. solvers) that are needed to implement use cases. We describe ideas and approaches to close these gaps.

This talk will present our usage of SPDK, Storage Performance Development Kit, with the Xen hypervisor and discuss memory sharing mechanisms in hypervisors from a security and performance perspective.

This talk will present our usage of SPDK, Storage Performance Development Kit, with the Xen hypervisor and discuss memory sharing mechanisms in hypervisors from a security and performance perspective.

SPDK is a userspace NVMe driver allowing access to these types of storage devices with minimal overhead from the operating system. It allows you to maximize the performance usage of new storage technologies, as well as having faster development times of applications serving IO because of the easier development cycle of running in userspace. In our case, we use it as a storage backend for virtual machines where an SPDK application establishes a connection with virtual machines through shared memory.

This sharing of memory, in a virtualized environment, gives access to the outside world to a virtual machine. In the case of Xen, the sharing mechanism, called Grant Table, uses the hypervisor as a trusted intermediary to allow sharing memory with another virtual machine. The backend doing device multiplexing only get access to areas explicitely permitted by the frontend. This permits the guest to not completely trust the storage provider software with complete access to private memory, but the extra security of this model doesn't come for free. We would like to discuss improvements that could be added that would still keep the security aims of the Grant Table mechanism while providing a high performance interface.

Are you a sysadmin and feeling paranoid? Let's promote security hardening to another level. Perhaps, with the concept of Application Whitelisting you will be able to sleep again.

In this session we are going to harden a Linux system with a file access policy daemon - fapolicyd. This daemon enables administrators to block or allow specific applications and executables using a fine-grained policy. We plan to explore the daemon’s possibilities and we want to get through its configuration. We will analyze multiple variations of set ups and evaluate their security aspects. We are going to demonstrate with an altered binary how integrity checking enablement prevents malicious attack. After the session, attendees will understand how to follow a problem and design their own policy with security in mind.

This presentation is based on Red Hat/Fedora Linux environment.

Please note that this talk replaces one entitled "Sudo logs for Blue Teamers" that was due to have been given by Peter Czanik, who has sent his apologies but is now unable to attend as he has fallen ill. We wish him a speedy recovery.

Bluetooth mesh networks enable creation of large scale device networks and can be very useful for a variety of IoT use cases. As the state of open source tools around it needed some love, it was an ideal candidate for developing Rust stack to help developers use it in their solutions. In this session you'll learn about Rust tools available to develop embedded firmware, linux gateways and cloud applications for Bluetooth mesh solutions. We'll cover asynchronous embedded Rust with "Embassy" and "Drogue device" projects for writing firmwares and how to use them for mesh applications. Next, we'll explore the state of the mesh on Linux with "Bluez" and "Bluer" projects. We'll see how to use Rust and containers to develop mesh gateways. Finally, we'll describe the final piece needed to build end-to-end solutions, "Drogue IoT cloud". With this we laid down the architecture and tools needed to build usable mesh applications. The session participants will get a good overview of the whole stack needed to build mesh IoT applications. They learn the benefits of Rust for building this kind of software and find good starting points to get going with their projects.

Jupyter notebooks are a great tool for exploratory data analysis as it is very easy to process and visualize data using traditional charts. However, they lack utilities to properly explore networks interactively. The ipysigma library therefore proposes a Jupyter widget enabling its users to perform visual network analysis from the comfort of a notebook. ipysigma makes it simple to tweak a network's visual variables to display it exactly as you intend. This way, you can perform a work at the crossroad between Python processing of graph data and visual exploration like you would do for example with Gephi. It supports networkx and igraph seamlessly and can be easily used by numpy and pandas users all the same. Different usecases of ipysigma will be showcased during the talk through a dataset about FOSDEM history. We will also demonstrate how ipysigma is able to render synchronized & interactive "small multiples" of a same network so that one can easily compare different features. ipysigma is developed at the médialab of SciencesPo and uses graphology and sigma.js (JavaScript libraries able to render interactive graphs in web browsers).

Fedora CoreOS is a basic, monolithic, automatically updating operating system that is optimised for running containers. It focuses on offering the best container host for executing containerized workloads securely and at scale. This fits perfectly the requirement for setting up a container-oriented self-hosted homelab and in this talk, we would detail that and go one (or more steps) further by providing a case study of setting up Fedora CoreOS as a self-hosted homelab distribution for globally accessible (using secure network tunnelling) multiplayer servers for video games (namely, Minecraft, Valheim etc.).

Who is the target audience?

1. Professional sysadmins who use Fedora CoreOS but want to know more applications
2. Budding community members wanting to contribute to the upstream projects
3. GNU/Linux distribution users who are on the fence, about trying a different workflow
4. Video game enthusiasts who run (or plan to run) their dedicated multiplayer servers
5. Self-hosted homelab followers who maintain a home infrastructure as a hobby
6. Software engineers or students who wish to learn sysadminship with Fedora CoreOS

How is the target audience benefited?

1. Professional sysadmins (who already use Fedora CoreOS or similar distros) would learn about other creative applications like running a multiplayer server.
2. Budding community members would know how they can contribute to the upstream projects that provide a well-suited container-oriented distro.
3. GNU/Linux distribution users would be helped with their decision by knowing the difference between the workflows used in regular distros and that in Fedora CoreOS.
4. Video game enthusiasts would get bragging rights among their friends once understand (and apply) how to set up a multiplayer server seamlessly.
5. Self-hosted homelab followers would obtain more insights on possible alternative operating systems like Fedora CoreOS for their current infrastructure setup.
6. Software engineers or students would gain more information on where they can start from within the community (i.e. Fedora Infrastructure) with their learnings.

Dagger is a programmable CI/CD engine that runs pipelines in containers allowing developers to build and debug pipelines locally and then run them anywhere avoiding vendor lock-in to a particular CI/CD solution (well...except Dagger).

While the portable pipeline concept may not be new, by combining that with the ability to write pipelines as code (Go, Python, TypeScript, JavaScript, CUE supported at the moment) instead of YAML, Dagger revolutionizes how CI/CD pipelines are built and ran.

This presentation illustrates how the Guix project provides software deployment for reproducible research. GNU Guix takes care about the computational environment from the package management to producing container (Docker, Singularity) and also being an alternative for virtual environment.

Open science means transparent and collective; transparent because a scientific result needs to be scrutinized and studied bug-to-bug, and collective because an independent observer must observe the same result–at least when speaking about computational processing–and this observation needs to be sustainable. Guix is an attempt to implement, for the computational environment, these two items.

By applying functional programming concepts to package management, pioneered by Nix, Guix is deeply transparent by design. The whole computational environment is captured and its inspection, from source code to binary, becomes tractable. As a nice consequence, this computational environment is reproducible from one machine to another. What about missing source code? Guix is able to transparently fallback to the Software Heritage archive. The reproduction of this computational environment becomes sustainable–to some extent.

In short, this presentation try to convince how Guix and 3 command lines can helps open science.

Porting mainline Linux to new Qualcomm SoCs seems like a daunting task but it actually isn't too bad! Let's take a look into the support of the Fairphone 4, which is based on the Qualcomm Snapdragon 750G, what is working after about 1.5 years of working on it and what is still missing.

As the legal industry more readily leverages software for tools, automation, and predictive analytics, it has increased the affordable access to justice and legal services for underserved populations, helping make information and knowledge available for all. FOSS has and will continue to play a critical role in this evolution, but the line between where such software's functionality ends and the practice of law begins remains fuzzy. This presentation will discuss some of the legal precedent around Unauthorized Practice of Law (UPL) enforcement related to software, and will explore how current and future UPL enforcement may align or conflict with FOSS principles.

By now you’ve surely heard of Kotlin Multiplatform, and maybe tried it out in a demo. Maybe you’ve even integrated some shared code into a production app. If you have, you know that there are many subtle complications that come up when you want to ship shared Kotlin code. This includes things like modularization, translating between Kotlin and Swift, managing multiple repositories that depend on each other, and optimizing build times and binary sizes. It’s not as easy as it looks when you write your first “Hello World”!

At Touchlab, we’ve been involved with Kotlin Multiplatform since the very beginning, and we’ve learned a thing or two along the way about what does and doesn’t work well. Come hear about how we’ve solved some of these difficulties to ship Multiplatform code across all sorts of organizations and environments, so you’re ready to use KMP in the real world.

This is being used to test our systems in advance of the event. It is not a real talk.

MOTIS is a modular mobility platform that was released as Open Source in May 2020. It's main functionality is its high performance door to door routing. However, MOTIS comes with "batteries included" and provides additional modules for input (e.g. auto-complete for station names and addresses) and output (embedded map tile server, departure and arrival tables, vehicle locations, etc.) as well as an Android app and web user interface (all open source). MOTIS offers a JSON-API via HTTP(S). It reads timetables in GTFS and can update its data model with GTFS-RT. Our current focus is the profile-based computation of fully accessible routes for people with disabilities as well as the implementation of a data model and algorithms that can efficiently work with timetables of arbitrary length.

Project website: https://motis-project.de/
GitHub page: https://github.com/motis-project/motis

Reggae is built upon CBSD and uses it as a layer to create and configure jails and virtual machines, configure network and to some degree interact with firewall. Reggae also makes creating of development environment fast and easy. It enables developers to use jails or virtual machines for development so that the host system is not polluted with project dependencies. It supports different provisioners: shell, ansible, puppet, chef and salt stack. When not in development mode, Reggae makes maintaining of production easy with helper commands like provisioning already deployed jail. This talk will cover all features of Reggae and some features of CBSD and FreeBSD that make Reggae possible.

Ceph was originally designed to fill a need for a distributed file system within scientific computing environments but has since grown to become a dominant unified software-defined distribute storage system. Today, it is also notably used as an enterprise-quality block device and object store provider. This talk will cover the new development of an SQLite Virtual File System (VFS) on top of Ceph's distributed object store (RADOS). I will show how SQL can now be run on Ceph for both its internal use and for new application storage requirements.

The talk will cover:

• Existing storage abstractions on Ceph.
• Very brief introduction to RADOS.
• Very brief introduction to SQLite and its VFS abstraction.
• The libcephsqlite library and how it works.
• How to use libcephsqlite in an application.
• How Ceph uses libcephsqlite.
• What's in the future?

This is being used to test our systems in advance of the event. It is not a real talk.

Over the past 3 years, Mobian has grown from a one-person hobby project to one of the main actors in the mobile Linux community.

As we're preparing for the upcoming release of Debian 12 (bookworm), and the first Mobian stable release (shortly) following it, we want to share our plans for this transition and the future of Mobian and Debian on mobile devices.

Back when Debian 11 (bullseye) was released, both the Mobian project and the mobile ecosystem were still young and lacked maturity. We therefore chose to stay an in-development, rolling-release-like distribution based on Debian testing.

Fast-forward 2 years, Linux-based mobile phones have become more and more usable, the ecosystem has gained a lot of maturity and the Mobian team has been working towards reducing our delta with upstream Debian, both through upstream contributions and by maintaining Mobian packages directly in Debian.

We feel it is now time to switch to a more usual (at least in the Debian world) stable+testing release and development scheme, and will detail during this talk how we plan to do so. We will more specifically emphasize our past and present contributions to Debian, as well as our goals and plans for the next development cycle (trixie).

The mkosi-initrd project builds initrds directly from system packages. This means that there is no separate dependency and packaging system. Normal system packages and services are used in the initrd. This means that we don't need to build a duplicate set of scripts. Systemd is used to the maximum extent — it sets up the environment and manages jobs in the initrd. Requirements and dependencies for startup tasks must be expressed as unit properties. Systemd's functionality is used to manage secrets, measure state, and load system extensions to extend the initrd. In this talk I'll cover the current state of the project (what works) and the plans for the future.

Apache Beam is an open source SDK for data pipelines, with an unified model for batch and streaming pipelines. The SDK is multi-runner and portable: you may run your pipeline on Apache Spark, Apache Flink, Cloud Dataflow and other runners. In this talk, we will cover the main features of Beam for streaming analytics pipelines, with some examples of the capabilities to apply complex time-based logics to streams of data.

There has been a significant shift from on-premise data centers to the cloud in the last fifteen years. This process was due to the perceived cost difference between the legacy on-premise data centers and the newer and shinier cloud. Due to a renewed interest in privacy and data sovereignty, many organizations are returning to the on-premise. For the success of such initiatives, it is fundamental to learn from the past and understand how a modern on-premise data center would be structured. I started working in 2004 when almost everything was on-premise, and I had a front-row seat to the migrations that occurred in this period thanks to my roles as a Systems and Solutions Architect. In this talk, we will recap the last twenty years of migrations to learn some key lessons, and then we will analyze what a modern on-premise data center would look like, which technologies might help and which could be risky bets.

Graph database servers have grown immensely powerful, but they still can't query DAGs (Directed Acyclic Graphs) better than a command-line tool can: git. One CI system needs just that to correlate results and bugs with the revision history of the Linux kernel.

The KCIDB system at Linux Foundation's KernelCI project has been collecting build and test results for the Linux kernel for a while. We receive about 10K build and 200K test results per day from seven CI systems.

However, due to the specifics of the Linux development process, and the nature of testing an OS kernel, this raw data alone is not very useful to developers. In order to filter out already-known issues, spot new ones, and track performance trends, we need to correlate our results to the Linux revision history, which forms a DAG (Directed Acyclic Graph).

Our attempts to find a solution were unsuccessful: Neo4j couldn't do it, and we couldn't find another system which would be sufficiently different to offer hope. So, we're here to either find one, or inspire you to create one, specifically targeting large DAGs.

Building embedded systems is complex, especially if they will last. This talk will be a collection of (funny!) cases and stories of errors made in different projects. Examples cover a wide range of situations, for example, not using git at all (or poorly) or optimizing too early. Marta will also show best practices to follow instead and how to convince customers and coworkers actually to follow those practices.

The talk applies to an intermediate audience, but experts could also find a suggestion or two.

This talk will introduce one of the latest Fedora Remixes, the Asahi Fedora Remix! Asahi Fedora Remix exists to assist the Asahi community with Apple Silicon upstreaming and to provide a nifty ARM-based Fedora Workstation for those that own Apple Silicon hardware. We will discuss packages we have forked: kernel, kernel-edge, mesa. Some of the new characteristics of this distro include, 16k page size, a kernel built with rust drivers and hence a kernel built with clang/LLVM. We will show some performance results against some other x86 and aarch64 machines.

On the community side, we will discuss some core values we try our best to abide by, such as our "upstream everything" attitude.

Reflection is a very powerful JVM feature that allows to create implementations of interfaces on the go, as well as exploring the type hierarchy, methods and properties of a given class. These capabilities do not exist in Kotlin/Multiplatform, so we will explore an alternative method to runtime reflection: a compile-time symbol processor to create compile time mirrors. Using Mocking as an excuse (as mocking typically needs reflection), we will explore how we can use KSP (Kotlin Symbol Processor) to circumvent the absence of reflection and generate efficient test mocks at compile time. We will also see the limitations that multiplatform brings to both the KSP generator and its associated runtime, and we will explain the tradeoff that needs to be made when using KSP, and why they are needed.

Transition is a web based transit network edition and analysis platform. Leveraging OpenStreetMap data as it's base data source, it lets you create a network from scratch easily or import and modify an existing one via GTFS files. You can create multiple scenarios and compare them via various visualisation Using travel survey data, we have a genetic algorithm that can optimise your network, reducing overall transit time for users, while keeping your constraints fixed.

The talk will present the various features of the platform, with examples from actual cities, describe our routing infrastructure, show where we are hoping to go and touch the topic of OSM data quality and the data require for best analysis.

This is a great example of a project who started in the depth of a research lab and graduated to be used outside of it. The development was done in collaboration with planners from various transit agencies, which insure that the features are useful to users. We could tell many stories about the challenges of bringing code from the research labs out to the real world, we'll touch on some, time permitting.

We developped our routing engine for transit purpose, trRouting. We also build on top of OSRM (Open Source Routing Machine).

The talk is a review of my work on Guix's bootstrapping process for RISC-V. The presentation describes why we needed to make this, the challenges I encountered, what I focused doing, what is missing and how people can take part.

The bootstrapping process starts with Stage0-POSIX, then comes Gnu Mes and from there a bootstrappable fork of TinyCC is built. From that point, GCC is somehow built and then the rest of the distribution is built using it. In this talk, we'll discuss the last part of this process, from the bootstrappable TinyCC to the final GCC that compiles the world.

With NlNet's support, I spent some time this last year preparing this process to be ready for RISC-V. During the talk I'll share the work that has been done, I'll introduce some of the particularities that RISC-V has, why this process has been different to the other architectures and I'll describe the current state of the bootstrapping process and how it can be improved.

This is being used to test our systems in advance of the event. It is not a real talk.

We will give a brief introduction to electric vehicle charging technology, including an overview of the standards and protocols involved. This will be followed by a deep dive into how you can build your own AC charging station with open hardware, utilizing the EVerest open source software stack. Concluding the talk, we will present an outlook on how you could assemble a DC charging station with readily available components.

The primary goal of EVerest is to develop and maintain an open source software stack for EV charging infrastructure. You can think of it as an operating system for EV chargers with implementations of communication protocols, software modules for representations of hardware devices and tools for simulating the charging process. In this talk you will learn how you can adapt and use EVerest with existing charging station hardware, as well as building your own AC and DC charging stations. We will show you how you can get started by using open hardware designs and schematics in combination with open source software to build a charging station that will reliably charge your electric vehicle.

This talk is an interim report on a journey to enhance scientific programming in Python within the French social sciences. Scientific programming is a stepstone to develop open and reproductible data projects. In numerous field, tools and libraries were developed thanks to Python to become standards. Backed by detailed documentations, those tools diffuse beyond specialties and frontiers and opens new prospects. Nevertheless, social sciences in France seem to stand appart. One reason may be the precedence of R as a programming langage, with highly specialized libraries lacking sometime of documentation or update. Another one may be the diversity of traditions, data and approaches that can hinder shared practices and ease of use of existing libraries. Based on the experience of a small Python library - PySHS - and the organization of training sessions, I will argue that there is a need (and space) for an high-level and easy to use scientific programming framework in Python dedicate to social sciences that can bridge current practices with the state of the art libraries. Such library could in return help to clarify methodologies. This opens two main question that should be addressed : first, how to maintain the flexibility of scientific programming against overtly specialized tools ; second : how to build a meta-framework with other programming langages as R to avoid fragmentation.

In this talk I share the motivation, goals, and architecture of my new project Aurae. Informed by my experience of operating large production platforms I discuss my thesis of how bringing deliberate runtime controls to a node will unlock a new generation of higher order distributed systems.

The audience walks away with an in-depth understanding of the current state of affairs Rust and the Aurae runtime project. We learn about my journey to Rust from working with Go in Kubernetes.

I am an accomplished Go engineer who has made the jump into Rust and I believe my story is worth compiling and sharing with FOSDEM. I believe there will be many like me in the future.

Aurae is on a mission to be the most loved and effective way of managing workloads on a single piece of hardware. My hope is that by bringing a better set of controls to a node, I can unlock brilliant higher order distributed systems in the future.

Aurae takes ownership of all runtime processes on a single piece of hardware like systemd, and provides mTLS encrypted gRPC APIs (Aurae Standard Library) to manage the processes. Aurae has a new style of isolation called "Aurae Cells" that manage cgroups and namespaces directly from pid1. With Aurae Cells the project offers a way to slice up a system using various isolation strategies for enterprise workloads including MicroVMs.

Learn about 3 specific parts of the project and how they influenced the decision to move to Rust.

1. Managing cgroups (v1/v2) directly with Rust, and how kata containers and systemd influenced the container runtime module.
2. mTLS encrypted gRPC with tonic and rustls. Learn why I have given up on OpenSSL and where rustls is working well and not so well for us.
3. Serving ephemeral short lived microVMs with Aurae, and how we "spawn" a new host and kernel into a microVM that shares properties with the parent instance of Aurae.

I talk about my journey to Rust from Go and why I believe it is necessary to reimagine parts of Kubernetes in Rust.

Helios is a simple microkernel written in part to demonstrate the applicability of the Hare programming language to kernels. This talk briefly explains why Helios is interesting and is a teaser for a more in-depth talk in the microkernel room tomorrow.

Hare is a systems programming language designed to be simple, stable, and robust. Hare uses a static type system, manual memory management, and a minimal runtime. It is well-suited to writing operating systems, system tools, compilers, networking software, and other low-level, high performance tasks. Helios uses Hare to implement a microkernel, largely inspired by seL4.

OKD Virtualization is the community project bringing traditional virtualization technology into OKD. OKD is an Open Source Community Distribution of Kubernetes optimized for continuous application development and multi-tenant deployments. OKD is a sibling community distribution to Red Hat OpenShift Container Platform. Meet the OKD Virtualization community, learn new features, discover deployment patterns and get involved!

OKD Virtualization is the community project bringing traditional virtualization technology into OKD. OKD is an Open Source Community Distribution of Kubernetes optimized for continuous application development and multi-tenant deployments. OKD is a sibling community distribution to Red Hat OpenShift Container Platform. OKD Virtualization is built on top of the KubeVirt project and its sibling operators. The Hyperconverged Cluster Operator project ensures an opinionated and robust deployment automating common Day-1 (installation, configuration, etc.) and Day-2 (re-configuration, failover, etc.) operations. The Hyperconverged Cluster Operator is available in the Openshift Community Operators catalog and so also on your OKD cluster. In this session you will learn about fresh OKD Virtualization features like: - Deploying a single node development/testing environment on CodeReady Containers (with nested virtualization) on your laptop - Using KubeVirt Tekton tasks to automate VM common tasks (creating/copying VMs, generating ssh keys, executing commands into a VM or manipulating disks with libguestfs tools) in a CI/CD fashion - Automatic importing and updating of pre-defined or custom boot sources

After this session newcomers will know what OKD Virtualization is while experienced users will get a sneak peek of new and upcoming features.

Digital autonomy has been at the heart of the public policy debate in the EU for a while now, with Commissioner Thierry Breton himself stating in 2021 that “in the digital decade, Open Source will be a key element to achieve Europe’s resilience and digital sovereignty”. In this session, which will also include an open debate with the audience, we will analyze the opportunities for open source when it comes to contributing to building Europe’s technological sovereignty, but also the challenges that this new policy landscape poses for the open source ecosystem in Europe (and beyond).

Gaël Blondelle joined the Eclipse Foundation in 2013 and now serves as Chief Membership Officer. He has been involved in the open source arena for more than 18 years in a number of key roles. Gaël co-founded an open source start-up and worked as its Chief Technology Officer. Gaël then worked in business development for an open source systems integration company and managed highly strategic research IT projects aiming to create open source ecosystems for major industrial players. Gaël joined the Eclipse Foundation to pursue his goal of helping more companies work in open source, and to implement open, innovative and collaborative ecosystems for mission-critical applications.

Alberto P. Martí has developed most of his career in Spain and in the UK, both in the IT sector and in Academia. As VP of Open Source Innovation at OpenNebula Systems, he deals with strategic collaborations with public cloud/edge providers, open source initiatives, and development teams from other tech vendors. Alberto coordinates the SovereignEdge.EU initiative and is involved in both the IPCEI-CIS and the European Alliance for Industrial Data, Edge and Cloud, where he supports the role of OpenNebula Systems as chairing company of the Cloud/Edge Working Group while co-leading one of its Task Forces. Alberto is particularly interested in the conjunction between open source, ethical innovation, and digital sovereignty.

Recently the interest in concurrent programming has grown dramatically. Unfortunately, parallel programs do not always have reproducible behavior. Even when they are run with the same inputs, their results can be radically different. In this talk I’ll show how to debug concurrency programs in Go.

I’ll start from showing how you can debug your gorotines using delve and gdb debuggers. Then I’ll try to visualize goroutines using different scenarios, sometimes it helps to better understand how things work. Next part of the topic will be about dumping a goroutine stack trace of your application while it’s running and inspect what each goroutine is doing. And I’ll demonstrate how to debug leaking goroutines by tracing the process of how the scheduler runs goroutines on logical processors which are bound to a physical processor via the operating system thread that is attached.

As a bonus i’ll cover debugging tips on how to find deadlocks and how to avoid race conditions in your application.

Since the first implementation of elliptic curves over finite fields for the GnuPG and the implementation on OpenSSL of the curves over finite and binary fields, back in the 2000s, many things have happened over this mathematical construction. We've witnessed instances like the birth and death of certain isogenies or searching for algorithms that resist quantum computing, which are only a few to mention.

We moved from the NIST curves on the P1363 to use Edwards variety, and there is a recent proposal with Double-odd curves. So the assortment is increasing, but we need to squeeze them more. For each new curve, all users always share the same group. This talk will review the path walked and evaluate the progress in implementing the Double-odd Jacobi Quartic in Libgcrypt and GnuPG.

In the three years that have passed since the last Liquidsoap presentation, much change has happened! During this walk we will: * Give an update on the community growth during the pandemic and recap what we learned during our two liquidshop events that mixed technical presentations with actual user projects presentations! * Present some the recent advanced in the Liquidsoap language and how they can be be used to leverage awesome programming language ideas to create powerful, rich and safe media project scripts * Showcase the new integration with FFmpeg and how Liquidsoap provides flexible and advanced usage of the excellent FFmpeg features and APIs.

This talk should be of interest for anyone with interest in community radio, media broadcasting and anything related to audio and video handling in general, including integration with online APIs and websites and more!

We would also love to present and discuss our implementation of media APIs and the new abstractions that could be emerging in future implementations.

This presentation will showcase an open source solution for deploying Kubernetes clusters on hybrid and multi-cloud environments using the recently released OpenNebula Kubernetes Engine (OneKE). In this talk we will present to the world the new OneKE appliance, a CNCF-certified K8s distribution based on Rancher’s RKE2, and will explain how it has been expanded with a number of additional pre-installed open source components to handle persistence, ingress traffic, and on-premise load balancing. In this talk, we will also introduce OpenNebula’s native model for hybrid and multi-cloud computing, which allows a unified management of diverse workloads and applications leveraging resources from different public cloud and edge infrastructure providers. Participants will be able to see a demo, showing how to bring all those features and technologies together in order to launch and manage a multi-cluster Kubernetes deployment across Hybrid and Multi-Cloud environments.

With Phosh (a Wayland shell for GNOME on mobile devices) and it's associated ecosystem being adopted more widely we want to highlight some of the progress made during 2022.

This talk will give a short overview of the state of Phosh and related software components, what you can do today and what you can expect in the future.

This presentation describes the new read (aka primary) balancer that is added to Ceph next version (Reef) and explains how the framework developed as part of this balancer for more sophisticated use cases. Specifically, it shows how you can use this framework and creates a policy that changes the SDS load dynamically so it can mitigate effects such as noisy neighbors and faulty network devices (NICs or ToR switch) without moving data around. This can be very useful when the effects described are temporary (for example noisy neighbor in hyper-converged environment)

The new balancer is based on a policy that defines the desired primary configuration and the engine that changes the configuration to meet the desired configuration (or at least be as close to it as possible). The engine is fast and involves no data movement (only metadata changes). As a result, it can be executed periodically over relatively short periods. Given this feature, anyone can write policies that react to changes in the cluster behavior in near real time. We will show some use cases and the logic to build policies that maximize the cluster performance for these use cases.

This is being used to test our systems in advance of the event. It is not a real talk.

Ultrablue (User-friendly Lightweight TPM Remote Attestation over Bluetooth) is a solution to allow individual users to perform boot state attestation with their phone. It consists in a server, running on a computer, acting as the attester, and a graphical client application, running on a trusted phone, acting as the verifier.

A typical use-case is to verify the integrity of your bootchain before unlocking your computer, to prevent offline attacks on an unattended laptop. It can also serve as a debugging tool for secure boot issues after firmware upgrades or as a second factor for disk encryption.

During the boot of a PC, it is now common to have each stage store measurements of the next one into a TPM, in order to keep a tamper-proof log of the boot chain. Those measurements are then leveraged to seal secrets, eg. a disk encryption key, or to report the state of the device to a remote server in cryptographically secure way, using a procedure known as remote attestation.

Remote attestation has slowly gained traction over the last few years, most notably among cloud providers such as Azure, to guard access to online resources. It is also a key element in validating dynamic root-of-trust measurements (DRTM), which reduce the trusted computing base compared to traditional UEFI-based boot chains, but require a trusted third-party to validate the final state of the system. Unfortunately, little progress has been made recently to enable individual users without access to server resources to reap the benefits of remote attestation. This is particularly frustrating considering that almost everybody carries a small trusted server with them all the time: smartphones.

Building upon an idea by Matthew Garrett (Linux Conference Australia, 2020), we introduce Ultrablue (User-friendly Lightweight TPM Remote Attestation over Bluetooth), a solution to securely inspect and validate a TPM event log from a phone. Ultrablue consists of a command-line attester, running on a computer, and an Android graphical application, running on a trusted phone, communicating over encrypted Bluetooth low-energy (BLE). Pairing the phone and computer is made easier and more secure through the use of a QR Code. After a trust-on-first-use provisioning phase to enroll the computer on the phone, the phone can check that the boot chain has not been compromised in later boots. Sample scripts and a self-contained virtual machine are also provided as a reference of how to integrate Ultrablue in the boot process to guard disk encryption by a secret delivered by the phone.

Future work includes improving the user interface to inspect and validate unexpected event logs, adding support for more versatile verification policies, and integrating Ultrablue into existing hardened systems such as Safeboot (safeboot.net).

The Ultrablue project has been developped at ANSSI (https://ssi.gouv.fr) by Loïc Falkau--Buckwell, under the supervision of Nicolas Bouchinet and Gabriel Kerneis.

Sometimes, you need to step away from your current focus to invest in the future. One of the most effective ways to approach community building is through the lens of pathways to leadership. A path that invests in new maintainers is the backbone of creating a welcoming, diverse, and sustainable open source community. In this talk, we’ll use the Mountain of Engagement framework to break down how open source projects can level up their community and invest in new maintainers.

Cloud brought many innovations - one of them is inexpensive, scalable and sometimes secure Distributed Storage options. In this presentation we will talk about distributed storage Options modern clouds offers ranging from elastic block devices and object storage to sophisticated transactional data stores. We will discuss the benefits and new architecture options such distributed storage systems enable as well as the challenges pitfalls you need to be aware about.

This is being used to test our systems in advance of the event. It is not a real talk.

Since 1950, force layouts have dominated the graph visualization scenario, as of easy implementation. However, placing aesthetic constraints may not be obvious to obtain an effective visualization. In this talk the goal is discussing an AI-based methodology alternative to Force Layouts, allowing the flexible application of various aesthetic constraints for an effective visualization for the end user. Furthermore, a parallel version on CPU will be proposed to allow visualization in large contexts

Introducing the new version of the on-device installer for Linux Mobile.

The GNU Guix package manager/distribution provides its own containers as part of a more general tool, 'guix shell' for quick one-off or repeatable environments. The container option is isolated from the host system, with options to expose directories, network interfaces, and so on. This is an excellent tool for isolating software in a completely controlled and reproducible environment in a minimal way. Recently, we added an option to emulate the Filesystem Hierarchy Standard (FHS) within the container, so that this environment looks like a more "typical" distribution with a global '/lib', '/bin', etc., unlike a Guix system. This is helpful for developing or running software which expects or assumes an FHS file layout. For example, many language environments want to manage their own tools and download binaries, or some software isn't yet packagable for Guix, like a fully source and bootstrapable JavaScript application. These would otherwise be very difficult to use in Guix and now we can do so in an (isolated) environment. This talk will introduce 'guix shell' and the container and emulate-FHS options with examples of real-world use.

Crowdsourced datasets starts to become common, we can cite the Wikipedia and Wikimedia projects or the OpenStreetMap database as well known examples. The UMRAE research lab collect data from thousands users around the world with its NoiseCapture application. Assess the quality of the sound spectrum recorded by hundreds of differents smartphones models is a challenge by itself and people are working on it. But in the mean time, we ask ourself if we can extract information from the tags provided by the users. This talk will present the 2017 - 2020 collection dataset, the analysis of the recordings' tags and the complete FOSS toolset we used. We will present the challenges we faced, the solutions we found and the issues we will have to mitigate in the future.

The past few years have seen the emergence of yet another Virtio device, extending the aforementioned virtualization protocol to hardware video accelerators in V4L2. The upcoming Virtio Video driver conforms to the memory-to-memory stateful interface and draws upon a mature ecosystem to speed up media workflows in a guest OS by tapping into the host's hardware. In doing so, it is a step further in the general direction of establishing a de-facto standard for media handling in different hypervisors.

This talk goes over the upcoming VA-API virtio video decoder backend currently in the works for the CrosVM hypervisor. It explains how the flexibility of Virtio technology can be paired with a very established API in order to produce a robust solution in video decoding virtualization, effectively blending the worlds of stateful and stateless interfaces. It details how the community at large stands to benefit from it and how it both validates and helps propel the development of the work-in-progress virtio video protocol itself.

The talk will also cover the latest developments in the work in progress VirtIO Video protocol and delve in the architecture of cros-codecs, which is a project that aims to offer video decoding capabilities to the Rust ecosystem as a whole.

This is a double talk about "What's in the new release of FFmpeg 6.0", and a "demonstration of VLC running inside Webbrowsers using Wasm".

As FFmpeg 6.0 is approaching, what's new in it, what are the major and minor changes, and why you should care about the future work on FFmpeg.

After that, a demonstration of VLC and its dependencies compiled to the web-browser using wasm, and using Webcodecs to decode the video.

It's been almost 10 years since the demonstration of the earliest Docker client at PyCon in 2013. While container capabilities and tooling existed prior to Docker, we can all agree that the last 10 years has seen an explosion of tools, integrations, and production services all built on container runtime technologies similar to that early Docker engine project.

Given that context, it's a good time to look around and survey the landscape of container developer tooling in use today. While Docker engine, and the companion Docker Desktop product are widely used, the creation of the OCI standards and the launching of the CNCF has allowed for a wide array of tools and projects that also provide developers tools and capabilities to create, build, and run containers and interoperate with container registries. In this talk we'll tour the current world of open source developer tools, including podman, the early simple containerd clients, nerdctl, and the advent of non-Linux platform support built alongside these tools, such as Rancher Desktop, Lima/colima, Finch, and Podman Desktop.

Attendees will learn a bit about each of the container developer tool platforms, what open source components they are built from, and how to see them in context with the other alternatives in this space. We'll demonstrate the similarities and differences, and show how thanks to the OCI specs, interoperability between these tools is guaranteed and that developers have significant choice when deciding what tools to use for local container development.

This talk will cover all the new features and changes in Delve since the last in-person FOSDEM and then go right into a deep-dive into how Delve enables extremely low-overhead tracing of Go programs using eBPF. Attendees will learn not only how to use this new feature of Delve, but also how they can leverage eBPF in their own Go programs. I will start by introducing this new feature, showcasing how it can be used, and then I will take the audience into an in-depth look at how it is implemented under the hood. The talk will feature a code walkthrough and detailed explanation of the technical details that went into making this feature a reality. I will also talk in depth about the libraries and approaches used to enable Go programs to leverage eBPF, which will empower attendees to implement such a feature in their own applications as well.

This talk is accessible to any level of Go programmer, from novice to advanced. Novice users will get a lot of benefit from learning how to use the tracing feature in Delve to track down problems in their code, while intermediate to advanced users will get a lot of information from the technical deep dive and will also walk away with the knowledge of how to integrate eBPF programs into their own codebases. The information in this talk will be practical and immediately applicable to attendees in their day-to-day Go development.

No one seems to like the "German Eichrecht", esp. not manufacturers and operators of charging infrastructure, yet it provides security and transparency of your charging sessions. This talk will give an introduction to the fundamentals and requirements of the calibration law and explain you why Open Source of the "Chargy Transparency Software" is not only eyecandy, but a fundamental part of the security goals and guarantees for EV drivers.

From a software developer's point of view the German calibration law is not so much about measuring energy correctly or invoicing the correct prices, but a first step towards a more modern zero trust architecture for the e-mobility charging infrastructure. This security update is sorely needed, as todays architecture is full of well-known, yet unaddressed bugs and design flaws mainly caused by the very the bad communication of people in distributed systems and across gated communities.

Besides solving technical goals, the German Eichrecht also tries to make sure, that the security gurantees also reach the end users and give them all required tools, data and information to verify the correctness of their charging sessions. Therefore for us Open Source is not only a non-functional, nice-to-have marketing feature off the calibration law or just more cost effective way of shared software development, but a fundamental (functional) requirement. Unfortunately the applicability of the calibration law for those end users is still very low. With the upcoming version 2.x of our Chary Transparency Software we not only introduce multi-language support to support the adoption of the German Eichrecht all over Europe, but also present new services like a real public key infrastructure for energy meter public keys and incremental charge transparency records for a "Real-Time Eichrecht".

Of course we are interested in your feedback and future contributions to this Open Source Project.

Dependency Injection has become boring in Kotlin Multiplatform projects. Now compiler plugins can make the use of this pattern exciting again! Kotlin Symbol Processor (KSP) brings the fun back and helps us manage our dependencies with a nice fully typed API. Let's deep dive into it and see how it works.

In this presentation we will talk about what makes Compiler plugins useful. How they help us build more reliable applications by reducing boilerplate and generating robust APIs.

How we generate code and why can be confusing or misunderstanding. So, we will take Dependency Injection as an excuse for our Kotlin Symbol Processor tour. First of all, we will configure a new processor module. Then we will see how we can create our own Kotlin symbol processor to enhance our architecture by providing a fully typed Dependency Injection API.

Digitransit is an open-source public transportation project which consists of microservices created within the Digitransit project and use of existing open-source projects. Digitransit was originally created in Finland to replace existing nation-wide and regional journey planning solutions in 2014. Digitransit has since been used around the world in smaller and larger projects, for example in Germany.

In this presentation, I will discuss and demonstrate what Digitransit is and what are the future plans for the project.

When doing real-time analytics, you not only want your database to ingest as quickly as possible, but also to have your data available for (fast) querying as soon as possible.

In this session I will show you the technical decisions we made when building QuestDB, an open source time-series database, and how we can achieve over a million row writes per second without blocking or slowing down the reads.

OpenSSL 3.0 key feature was FIPS-140-2 certification. As FIPS-140-2 is sunseting, we had to significantly patch OpenSSL to make it FIPS-140-3 capable.

The presentation briefly describes major changes in OpenSSL 3.0 architecture, what happened to Old Good API and why deal with new, the provider concepts, and changes necessary to match the new standard.

OpenSSL 3.0 key feature was FIPS-140-2 certification. To deal with it properly, the architecture was significantly changed, and applications have to deal with it.

A lot of API calls were deprecated, the engines shouldn't be used now, and applications can't rely on all the algorithms are still with us. The brand new provider concept opens new way to extend OpenSSL functionality.

As FIPS-140-2 is sunseting, the upstream version can't be taken as is for the future version of the standard. We had to significantly patch OpenSSL to make it FIPS-140-3 capable. We also provided some extra hardening to be sure that only up-to-date algorithms are in use, limited SHA-1 usage, and introduced many other changes.

WAM is the web runtime used in LG webOS (both for its products and the Open Source Edition), and has been adopted by Automotive Grade Linux. It is built on top of Chromium web engine and its Ozone Wayland backend.

In this presentation I will showcase its main features, and talk about its history, from HP/Palm devices, through LG TV and its Raspberry PI Open Source Edition, to end with its adoption in AGL.

WAM, also known as WebAppManager, or Web Application Manager, is a system service providing web runtime capabilities in LG webOS and AGL platforms.

Its goals are: * Performance through reuse of resources among web applications. * Provide a native-like experience to applications based on the Web Platform standards.

It has been a central part of LG webOS in all its flavours, including LG webOS Open Source Edition. As such, it provides a great example of how to integrate the web experience in a Linux system, providing graphics integration through Wayland protocol.

It will be a history of web engines. From QtWebKit, to QtWebEngine, to a custom embedding API directly on top of Chromium.

This is also going to be a history of the flexibility of the platform, as it was possible to integrate it not only on webOS, but also in the different releases of Automotive Grade Linux, even after different architecture rewrites. This presentation will highlight the strong points that make WAM specially flexible for integrating in different Linux platforms.

A retrospective of the main milestones of WAM in last decade. But also a look into its future.

This is being used to test our systems in advance of the event. It is not a real talk.

This is being used to test our systems in advance of the event. It is not a real talk.

This is being used to test our systems in advance of the event. It is not a real talk.

There are multiple ways how FOSS projects coordinate and inform about their localization effort. Wiki pages, forums, READMEs, etc. And there are different platforms and servers. Should there be something unified to ease the orientation for translators? Something like TRANSLATE.md?

In 2018 here at Fosdem, I publicly introduce a new port called pkg-provide, a pkg plugin to perform reverse searches and found the package you must install to have a certain file. Started as a proof of concept about how to build pkg plugin, pkg-plugin is now five years old and gain hundred of users around the world. It's probably the perfect time to tell you how it all started, reveal the real numbers of the audience, and talk a little bit about the future

This is being used to test our systems in advance of the event. It is not a real talk.

Imaged based systems are considered safer to update as a new image will only be activated via reboot as a whole. Images are rather static though as the OS image is typically delivered by the OS vendor. Package based systems on the other hand are very flexible wrt installed software. However, since packages are typically updated individually at run time, there are non-atomic, intermediate states states that may lead to undefined behavior. This talk presents a hybrid model that behaves similar to an image based system while retaining flexibility of package based systems, building on ideas from SUSE's MicroOS.

We present BastionLab, a Rust open-source privacy framework for confidential data science collaboration. We aim to help data owners open access to their datasets to outside data scientists. The current approaches, such as opening Jupyter notebooks, provide no elaborate control over what is shared. Datasets can easily be extracted from them, which means they offer little privacy guarantees and make data collaboration difficult.

BastionLab provides an interactive interface for data scientists to explore remote datasets, yet answers the privacy concerns of data owners, as only results compliant with the privacy policy defined by the data owners can be communicated.

Data exposure is limited as data scientists never have direct access to the data, they can only use a limited set of operators which preclude arbitrary code execution to exfiltrate data, and a strict access control policy is put in place. Differential Privacy and Trusted Execution Environments are supported as well to ensure maximum privacy. We will provide an example to show how a COVID dataset could be shared to a remote data scientist to perform data exploration, cleaning and visualization, while making sure only anonymized results are communicated. The server side of BastionLab is developed in Rust for its memory safety, performance and community. It allows the use of cutting-edge libraries like polars, an open source DataFrame library in Rust several times faster than pandas, the go-to solution in Python.

OpenTripPlanner is an open source journey planning framework with over 10 years of history. It is constantly evolving, with the version 2.0, including an entirely revamped transit routing algorithm, Multi-Criteria Range-RAPTOR with Destination Pruning, released in the end of 2020. The new algorithm makes it possible to support large national and international deployments. Currently, it powers the national journey planners in multiple countries, including Norway and Finland. At Entur it is used as a basis for systems ranging from ticket sales to physical departure boards at railway stations.

In this presentation, we will take a quick look into the history of OpenTripPlanner, where does it come from, and how has it evolved over the years. We will take a closer look at the recently released OpenTripPlanner version 2.3 and its new features, as well as a look on the roadmap of which functionality will be coming in the next releases.

Sailfish OS is an embedded Linux distribution developed by Jolla that’s designed to run primarily on phones. In this presentation I’ll talk about my journey porting Sailfish OS to various Xperia phones, via the Sony Open Devices Program, and how that’s made it possible to contribute changes upstream. If you’ve ever wondered what’s involved in porting a Linux operating system like Sailfish OS to a new hardware platform, or might even be interested to try, then this talk will describe one of the easiest routes to getting started.

Sailfish OS is an embedded Linux distribution developed by Jolla that’s designed to run primarily on phone and tablet hardware. The Sailfish community has a proud hardware adaptation track record, having ported Sailfish OS to devices as wide ranging as watches, feature phones, smartphones, tablets and PC hardware. Despite the breadth of successful ports, the process of adapting Linux to a new phone platform can be daunting for new porters. On the other hand, the Sony Open Devices Program makes the process of opening up a selection of Sony’s Xperia mobile phones for use by porters as easy as possible.

In this presentation I’ll look at the process of porting Sailfish OS to Sony Open Device Program devices, see how the Open Devices Program helps in practice, and also look at some of the tools, documentation and infrastructure made available by Jolla to help with this process.

I’ll talk about my own journey as a porter, how I came to start porting and the work I’m doing now porting Sailfish OS to different Sony Xperia devices. I’ll also talk about how Sailfish porters are able to work with the Sony Open Devices Program for mutual benefit, pushing changes upstream that then flow back down to make porting Sailfish OS or other Linux variants to other Xperia phones in the Open Devices Program more streamlined and reliable.

I will aim to provide enough technical detail so that developers who haven’t yet tried porting can go away and get started, but will also aim to include material that is of general interest to more casual mobile phone and Linux users.

If you’ve ever wondered what the process of porting Linux to a new hardware platform involves, might even be interested in trying it yourself, then this talk will offer some essential groundwork and highlight one of the easiest routes to getting started.

It wasn't easy to reproduce the same container image from its Dockerfile, due to changes in timestamps and "aptgettable" package versions. This lack of reproducibility has been a threat to the trustworthiness of container images and binary artifacts built inside containers.

In this talk, Akihiro Suda will introduce the current work being done to enable reproducible builds in the Dockerfile ecosystem.

This talk will consist of two parts:

The first part will explain the current status of implementing the SOURCE_DATE_EPOCH specification [1] in BuildKit [2] for deterministic timestamps of rootfs files and OCI metadata.

The second part will introduce a new tool called repro-get [3] which can be used to deterministically install a specific snapshot of apt, dnf, apk, and pacman packages. The packages are fetched by their SHA256 hash from various file providers including HTTP(S) sites, local filesystems, OCI registries, and even IPFS. The repro-get tool is expected to be used for containers in conjunction with the SOURCE_DATE_EPOCH work, but it can also be useful in non-container environments.

• [1] https://reproducible-builds.org/specs/source-date-epoch/
• [2] https://github.com/moby/buildkit
• [3] https://github.com/reproducible-containers/repro-get

In programming we use editors and IDEs all the time. Previously if one use Vi/Vim like text editor it typically means you just edit soruce code as simple text, but nowadays things have been changed. Especially after releasing support of the Language Server Protocol(LSP), which works as a client to LSP servers for example rust-analyzer. This talk gives deep dive of Language server Protocol implementation for Rust and how to build friendly relationships between rust-analyzer and Neovim.

In this talk i’ll start from brief of what’s LSP and rust-analayzer, some missing features you probably didn’t know about? E.g. go-to-definition, find-references, hover, completion, rename, format, refactor, etc., using semantic whole-project analysis. Also i’ll show you how to write you first plugin using Rust and interact with some LSP primitives. to turn you editor in God mode surf trough it like a pro.

In this talk we will present SUSE's storage team's latest passion project, s3gw (https://s3gw.io), an easy-to-use S3-compatible service for kubernetes environments. Although focused to work on top of Longhorn (https://longhorn.io), s3gw can leverage any local filesystem or Persistent Volume provided to it. The project is divided in two main components: the s3gw service, a Ceph RADOS Gateway with a custom, filesystem based backend, leveraging RGW's SAL implementation; and the s3gw UI, not only for management tasks but also providing a bucket and object explorer. During our time together we will discuss s3gw's backend implementation, and present the UI, with a small demonstration of how to deploy the project on a small kubernetes cluster. With this talk we would love to also gather feedback from the attendees, so we can feed back into project development.

Financing Open Source projects has been one of the main difficulties for years. Currently, well-funded projects usually depend on a small number of big companies. Donations from physical persons (and users) are also a common revenue source. Hundreds (thousands?) of small companies are using Open Source in Europe. Regularly donating only a small amount can make a difference for many projects they depend on. Marta will share the experience of giving by a small company in France with the list of "DOs and DON'Ts."

Package managers are essential tools in any Linux system, designed to install, upgrade, remove, and manage software. For several years, Fedora had YUM, which became DNF eleven years ago. Now, DNF5 will replace DNF and be the new Fedora standard. In this talk, we will give an introduction to DNF5. We aim to address our new design principles and how our choices fix some of DNF's design flaws. We will present a live demo of the new product to showcase some features of DNF5 and make comparisons with DNF. Lastly, we will cover our plan to improve communication, inclusion, and openness with the open-source community.

It is public knowledge that the DNF codebase became cluttered and, at times, substandard, cutting off a large slice of the open-source community from participating in the development process and decision-making process. Likewise, historical design decisions held DNF back from evolving into a modern and sustainable package manager. We want to answer how certain design issues were addressed, and why the structure of DNF5 impacts environments such as the desktop, containers, and CI. Moreover, we will go over the user experience of our command-line interface in the live demonstration, with some examples of common use cases and a speed comparison of processing commands between DNF and DNF5. Lastly, we will discuss how DNF5 enables us to work closer with the community. A thoroughly documented codebase, transparent upstream issue tracking, and open feature planning and delivery are all requirements that we intend to fulfill. Our target audience is people with some degree of expertise in package management or who are proficient using DNF.

Using checksums for verifying disk image download is very common, but how do you verify uploading a disk image to a virtual disk or verify that a backup is correct? The standard tools such as sha256sum cannot help since the disk image and the virtual disk may use different image formats. Even if the image formats match, standard tools are too slow to handle huge virtual disks which typically contain a small amount of data and a large amount of unallocated space.

In this talk we will learn about the blkhash algorithm for computing a fast checksum of sparse disk images, up to 3 orders of magnitude faster compared with standard algorithms, the libblkhash C library that you can use in your program, and the blksum command line tool for computing checksum of common disk image formats.

The blkhash project grew from the ovirt-imageio project, providing fast disk checksums since oVirt 4.4. The blkhash project adds support for multiple threads, uses the high performance libnbd library, and is implemented in C. The project is released under LGPL license so you can use it in your project or package it for your distribution.

Disinformation on has become a crucial issue for our democracies, nowadays. This presentation, based on a real use case will show how to efficiently identify the real owner of a disinformation website by using OSINT techniques based on open-source software. We will also present the methodology and tools we used to better understand the ecosystem of disinformation this website evolves in, its influence out of the far-right social platforms, and the financial motivation of its creator behind the scene.

No prerequisite skills are needed. Tools used : Firefox, Gephi, Retina, R, Snscrape.

GNU Guix functions well as a package manager and has been extended to also serve as a full operating system, under the name Guix System. In this talk I will show how it is possible to declaratively create operating system images for specific uses. Different than a 'spin' of a distribution, these can be used as a one-off live image or as a starting image to install to a computer before making further tweaks. Create your own minimal rescue image without needing to remaster media or use loopback mounts.

Seapath is a Power grid substation automation solution.

The Power grid substation automation is moving toward virtualization. In order to facilitate this transition, it is necessary to have a reference design and industrial grade open source real-time platform that can run virtualized automation and protection applications (for the power grid industry and potentially beyond). That is why RTE, Alliander and Savoir-faire Linux created SEAPATH project under the governance of Linux Foundation Energy.

Several solutions already exist, but they cover only part of the needs. That's why the project aims to assemble the right packages with as few specific developments as possible. The effort is put on testing to ensure that all the parts, hardware and software fulfill the needs for critical system.

The presentation will be about the platform itself with virtualization, high availability and cybersecurity features, and also about the test process based on the IEC61850 standard that will validate that the platform can indeed host automation and protection applications.

In this talk, we will introduce td-shim (https://github.com/confidential-containers/td-shim). Td-shim is a lightweight Intel Trust Domain Extensions (TDX) virtual firmware (TDVF) for the simplified kernel for TD based confidential container (e.g. Kubernetes). In order to match the short start-up time and resource consumption overhead of bare-metal containers, runtime architectures for TD-based containers put a strong focus on minimizing boot time. They must also launch the container payload as quickly as possible. Hardware virtualization-based containers typically run on top of simplified and customized Linux kernels to minimize the overall guest boot time. As such, we introduced the td-shim to replace the traditional Open Virtual Machine Firmware (OVMF) based TDVF for container use case. Currently the rust-based td-shim supports multiple hypervisors such as KVM and cloud hypervisor with smaller size and better boot performance. It provides a secure and efficient way of building the cloud native infrastructure.

"Go Even Further Without Wires" is the thrilling part 3 of the "Go Wireless Saga".

In "Go Without Wires", we wrote TinyGo code that runs directly on Bluetooth devices.

In "Go Further Without Wires", we used TinyGo to connect to WiFi networks, and consequently to the Internet itself.

Now, we will extend our reach further out into the real world, with TinyGo programs that can connect to Wide Local Networks (WAN) using the long distance radio protocol LoRA/LoRAWAN.

This talk will include several live demonstrations, including a flying object.

"Go Even Further Without Wires" is the thrilling part 3 of the "Go Wireless Saga".

In "Go Without Wires", we wrote TinyGo code that runs directly on Bluetooth devices.

In "Go Further Without Wires", we used TinyGo to connect to WiFi networks, and consequently to the Internet itself.

Now, we will extend our reach further out into the real world, with TinyGo programs that can connect to Wide Local Networks (WAN) using the long distance radio protocol LoRA/LoRAWAN.

This talk will include several live demonstrations, including a flying object.

We will show-case how Eclipse KUKSA project can help to leverage the advantages of a standardized description of vehicle signals. A large challenge for automotive software is the lack of standardization inside a vehicle. The basic data fabric of a vehicle consists of "signals", such as for example the speed of the vehicle or the state of a door. For this kind of data traditionally there was no standardized way how it is represented or transmitted. This makes even seemingly simple end-to-end applications such as "upload mileage to the cloud" very hard and costly in the industry. With the COVESA Vehicle Signal Specification (https://covesa.github.io/vehiclesignalspecification/) there exist an approach that is currently quickly adopted throughout the industry addressing this by introducing a domain taxonomy for vehicle signals.

KUKSA.val is an Open Source solution that helps transforming and serving such standardised signals inside a vehicle computer enabling faster development of reusable cross-fleet in-vehicle software.

The talk will show the architectural answer given by the Eclipse KUKSA project to leverage the COVESA Vehicle Signal Specification inside a vehicle: We will show how to use KUKSA components to gather and transform the data from lower embedded layers in the vehicle, and providing them in a secure way to apps and services. We will take a look the APIs provided in KUKSA and touch upon questions of data security and privacy. This demonstrates why within the context of the current Software Defined Vehicle Trend, Vehicle Computers are a worthwhile target for OSS solutions. A lot of benefit can be created by adopting standardised solutions for common challenges, laying a solid and cost-effective foundation for all kind of applications and services on top.

Do you really know what your users think about you? If you’re not doing user interviews, you probably don’t. In this talk, Emily Omier will help attendees understand why user interviews are so important, how to run an interview that provides good information and what to do with the information you get. Spoiler: often the best interviews are also the most awkward.

In this talk, Christopher Rost will present "graph stream zoomed", a graph stream grouping algorithm resulting from two master thesis. It enables real-time zooming of a property graph stream, from a schema graph stream to more fine-grained summarizations.

Graphs today are not only very large and heterogeneous, but also change over time. In addition to the typical storage of a graph in a database and subsequent analysis, some use cases require reactivity, and thus recent work has focused on processing the graph in a stream model. Real-time query and analysis of high-frequency incoming graph data, such as social network interactions, click streams, bike rentals, or supply chain product updates, provides continuous insights into to the most recent portion of the graph.

Graph summarization (or grouping) as a typical analysis has been well explored for static graphs, but there are just a few new approaches using of a graph stream, especially when the stream is modelled after the property graph model and thus has labels and properties on the streamed vertices and edges. In this talk, we present a graph stream grouping algorithm and a distributed reference implementation based on Apache Flink. It enables window-based summarization of the property graph stream by grouping vertices and edges on equal characteristics using so-called key functions. This enables various zoom granularities, from a schema graph stream to more fine-grained summarizations. In addition, elements leading to a group can be aggregated in flexible ways to provide deeper insights in the respective summarized vertices and edges. A bicycle rental graph stream is used to demonstrate the power of the algorithm and the multitude of analytical questions that can be answered with it.

Rust is a fast rising star in the pantheon of programming languages and comes with some interesting properties in regard to Multiplatform. On the other side, Kotlin promises with KMP as well Multiplatform capabilities. Are both set up to be rivals, or could both complement each other? What could Kotlin learn from Rust, and where might Rust borrow from Kotlin? The talk will give you an opinionated introduction into KMP with Rust in terms of tooling, developer experience and all the things I discovered so far. It will not sell you a ready to go product, but rather an idea.

This talk will bring you the good word of Multiplatform in terms of Kotlin and Rust. It will on board you to the idea of Multiplatform and what it means in terms of Kotlin and Rust each. This also means it will explain some keyconcepts which are characterizing for the work with it in regard to your Multiplatform project. It will show you, how you can use Rust and KMP on iOS, Web and of course Android. Also, it shares some pitfalls, workarounds and other lessons learned from failures with you. Let’s figure out if this is the beginning of a love story!

The ELISA project aims to make it easier to build and certify Linux-based safety-critical applications. This lecture will give an overview of the goals and technical strategy of the ELISA project. It provides information about the different work groups, their interaction, and contributions. Attendees will leave the talk with an understanding where the ELISA project stands today and what comes next. They get insights which methodologies and tools are used, which challenges exist, and why the different puzzle pieces are all needed for enabling Linux in safety-critical applications.

Safety-critical systems as addressed by the ELISA project are those, where failure could result in loss of human life, significant property damage or environmental damage. ELISA members are working together to define and maintain a common set of tools and processes that can help companies demonstrate that a specific Linux-based system meets the necessary safety requirements for certification. These existing working groups focus on Linux Features for Safety-Critical Systems, Software Architecture, Open Source Engineering Process, Tool Investigation and Code Improvement. They are complemented by vertical use case working groups dealing with Automotive, Medical, and Aerospace.

The Kerberos PKINIT extension replaces password authentication with X.509 PKI. This bring some advantages but also new risks. This presentation explains and demonstrates how PKINIT works, and presents a novel attack against FreeIPA's PKINIT implementation.

Kerberos is an authentication and single sign-on protocol based on symmetric cryptography. To avoid the drawbacks and risks of passwords, the PKINIT protocol extension enables clients to authenticate using public key cryptography and X.509 certificates. To further improve security, private keys can reside and signing/decrytion operations can be performed on hardware cryptographic tokens (smart card, PIV, TPM, etc).

I will start the talk with a brief overview of the core Kerberos protocol. Next I will explain how the PKINIT extension works, and demonstrate how to set up and use PKINIT in a FreeIPA environment. (FreeIPA is a free software identity management system that includes MIT Kerberos and Dogtag PKI.)

Finally I will discuss some of the risks that arise when using PKINIT, and security considerations for implementers and deployers. I will present and demonstrate a recently discovered PKINIT security flaw in some older (but still supported) versions of FreeIPA.

Since the adoption of VP9 by Netflix in 2016, royalty-free coding standards continued to gain prominence through the activities of the AOMedia consortium with AV1. In the early years after standardisation, High-dynamic-range (HDR) videos tends to be under served in open source encoders for a variety of reasons including the relatively small amount of true HDR content being broadcast and the challenges in optimisation with that material. Fast-forward to 2022, there has been a rise of HDR content which is publicly available. In this presentation, we review the AV1 Playback, present challenges and various strategies to adopt for a scientific testing environment for HDR signal conformance and evaluation.

CHERI defines hardware extensions to encode access constraints on pointers, enabling hardware enforcement of such restructions based on metadata stored alongside pointers. There is an ongoing drive to support compiling Rust code in a way that can make use of these extensions.

Doing this provides another layer of protection. We can encode knowledge about provenance validity, bounds and other access restrictions that the compiler (and OS/etc.) knows about in a way the hardware can enforce at runtime. The Rust memory model is famous for being able to enforce these types of restrictions at compile time, but not for unsafe Rust code. Unsafe Rust code needs to be written sometimes, which presents situations which can only be verified at run time. Some other nice benefits could come from this work. For example, runtime bounds checking can now be done by hardware rather than software, and since provenance information is necessary for operations on capabilities, closing gaps where it is not currently preserved forms a part of this work.

This talk is a discussion on what is required for this support, and gives an overview of the state of the various attempts to implement this support.

Solid is a protocol powered by W3C standards and the Semantic Web that intends to change the way the Web works by letting users bring their own storage to applications. It was introduced here at FOSDEM back in 2019, and many new developments have happened ever since.

I have been making Solid Apps for 4 years now, and in this talk I will go through my journey starting from having no idea about the Semantic Web. I'll share the lessons I learned along the way, and some of the challenges that are still ahead.

Solid is a protocol, so even though I've got my stack of choice this talk will be framework agnostic. I will focus on the challenges and learnings that can be useful to any developer. If you've heard about the Solid Protocol before and are wondering what developing apps is like, this is the talk for you!

Ubuntu Core is a different kind of linux. It offers image-based updates and secure boot with disk encryption. This presentation is a technical explanation on how this is achieved. We will focus on what makes Ubuntu Core different from other distributions.

Ubuntu Core is based on “snaps” which are readonly squashfs images with signed metadata. Everything on the system is a snap. This includes applications and the kernel. Snaps run in a lightweight container like environment with apparmor confinement and are isolated from each other and can only communicate via well defined security boundaries (“interfaces”).

Then the main system is composed of a kernel snap, a bootloader snap, a base (rootfs) snap, and a snapd daemon snap. This granularity is useful to handle IoT hardware since much of the hardware needs custom kernels or bootloaders. Here a new initrd was developed and is presented in the talk. Some hurdles (like how to deal with /etc in a readonly image world) are also presented.

Kirigami is a QML based framework to build convergent user interface for both desktop and mobile devices. It was created by Marco Martin in 2015 and has been contently evolving across the years becoming more mature and powerful.

While not being the maintainer of Kirigami, I developed several small and large applications with it, like Kalendar, NeoChat, Kalendar and Tokodon and I am also regularly contributing to Kirigami.

I hope to be able to give a good overview of the major changes Kirigami received. How this had an impact on how to write applications with Kirigami and how applications developed with Kirigami helped Kirigami to evolve.

Please note that this talk was originially scheduled to be given at 11:00. The talk originally in this slot, "Sharp photos and short movies on a mobile phone" by Pavel Machek will now take place at 11:00.

Real-Time Data Analytics is becoming very popular these days because of the important values and insights that it is bringing to the business. It also relies on super-fast data ingestion and that is all possible by leveraging on a powerful event-driven streaming platform. Two very important Open Source Apache projects have risen to serve such a grand purpose: Apache Pulsar for event streaming and Apache Pinot for real-time analytics. We take a look at how both of these projects can integrate very well together and achieve the blazingly fast results that we desire and show you a use case that we've built.

When you hear "decision maker", it's natural to think, "C-suite", or "executive". But these days, we're all decision-makers. Restaurant owners, bloggers, big box shoppers, diners - we all have important decisions to make and need instant actionable insights. In order to provide these insights to end-users like us, businesses need access to fast, fresh analytics.

In this session we will learn how to build our own real-time analytics application on top of a streaming data source using Apache Pulsar, Apache Pinot, and Streamlit. Pulsar is a distributed, open source pub-sub messaging and streaming platform for real-time workloads, Pinot is an OLAP database designed for ultra low latency analytics, and Streamlit is a Python based tool that makes it super easy to build data based apps.

After introducing each of these tools, we’ll stream data into Pulsar using its Python client, ingest that data into a Pinot real-time table, and write some basic queries using Pinot’s Python SDK. Once we've done that, we’ll bring everything together with an auto refreshing Streamlit dashboard so that we can see changes to the data as they happen. There will be lots of graphs and other visualisations!

This session is aimed at application developers and data engineers who want to quickly make sense of streaming data.

Slint is an Open Source GUI toolkit for Desktop and Embedded. It is written in Rust, and comes with a declarative UI description language that compiles into native Rust code. We will present Slint and show how you can build an reactive GUI in Rust

One of the question that often comes out is "Are We GUI Yet?". i.e. can you use Rust to create user interfaces? Our answer to that question is "Yes, with Slint"

Slint is an Open Source GUI toolkit. It scales from desktop platforms all the way down to micro controllers with only a couple of hundred of KB of RAM.

Thanks to the great tooling around Rust, it is also really easy to build a UI that can run on multiple different platform: Desktop native UI, wasm in the browser, or MCUs.

This presentation will be a presentation of Slint, demonstrating what you can do with it and how to use it.

Chimera Linux is a new Linux distribution started in mid-2021. It's a general-purpose operating system based on binary packages that aims to be practical and clean, while addressing various shortcomings of an average Linux distro. One of the things making it unique is that it's a non-GNU distribution, utilizing a combination of userland utilities originating from FreeBSD, the LLVM/Clang toolchain and musl libc, besides other things. On top of that, it is not based on any existing distribution and comes with its own packaging infrastructure and various custom software that was needed to fill in the gaps. It's also highly portable, already supporting x86_64, POWER, AArch64 and RISC-V, with more possibly coming. In the presentation I will cover the progress made in the last year, as well as give a general overview of the system and what it takes to create a distro from scratch.

The distribution follows a rolling release model and by default uses the GNOME desktop with Wayland. The custom package building infrastructure was created after having learned from the shortcomings of equivalent systems in other distros, aiming to be flexible and fast, while emphasizing correctness and allowing for fully sandboxed, unprivileged builds. The result is binary packages/repositories for apk-tools, which Chimera uses as a frontend package manager. The build tooling can also bring the system up from source using a foreign musl-based distribution as a base, making it easily bootstrappable. The resulting repositories utilize LLVM's ThinLTO for nearly all packages, and special emphasis is also placed on security hardening (including CFI and others). Service management is based on the Dinit suite with a custom set of core services and is fully supervising, dependency-based and aims to provide practical parity with systemd, while remaining lean and grokkable (and most importantly, portable). A major aspect of the project is to also improve software portability across the stack, improving the state of matters for both Linux and the BSDs. We also aim to contribute code improvements back to FreeBSD.

Most importantly, this is not any kind of dogmatic, niche effort. It's a system that tries to be pragmatic, providing a complete package that is polished and has well-defined defaults, while establishing its own identity and not being like something else. We also want to establish a community that is open and welcoming, without pointless elitism, and most importantly have fun doing all of this.

This is a follow-up presentation to last year's FOSDEM, but I will try my best to make it standalone and as easy to understand as possible for the general audience. Some basic Linux administration knowledge may be necessary for some of the information.

While the Wikimedia Foundation is best known for its flagship project, Wikipedia, and the MediaWiki software that powers it, the Foundation's open-source ecosystem extends far beyond these well-known projects.

In this talk, we will explore the fascinating world of Wikimedia's open-source tools ecosystem and the cloud infrastructure that makes it possible. We will showcase some of the coolest tools and projects, and we will highlight the unique opportunity that the Foundation offers for contributing to its cloud infrastructure – a rare chance to work on infrastructure for a cause that does good in the world, supporting the Foundation's mission of providing free and open knowledge to the global community.

Whether you are a seasoned open-source developer or a newcomer to the field, this talk will provide valuable insights and inspiration for getting involved in Wikimedia's vibrant community of contributors.

With Kubernetes 1.25 it is finally possible to checkpoint and restore containers. This offers new possibilities how to use containers in Kubernetes with the help of CRIU (Checkpoint Restore in Userspace). In this session I want to present possible use cases for checkpointing and restoring containers (including demos), how it is currently integrated in Kubernetes and how we plan to extend checkpoint and restore in Kubernetes over the next few releases.

For ten years i'm involved in Public transport digital services (especially traveler information, trip planner, Mobility as a Service at Hove and now i'm the SNCF open data platform coordinator). I'm an Open transport advocate working for SNCF Group and organising Open Transport meetups, mainly in France, being also part of initatives who works on commons like Fabrique des mobilités or OpenStreetMap. As i was part of the team when we opened Navitia trip planner source code and decided to have an open based strategy step by step (transport open data / open source / open API and SDK), i had the chance to be at the center of this great adventure at Hove, connecting with Navitia reusers an contributors, developing links with Open transport community. As open transport also means open innovation, it's important to work on developer's experience to facilitate either the integration of Navitia (open source) or the development of innovative services with Navitia Playgroung (Navitia API console). I propose to have a look in the rear view mirror, either the successes, showing concrete use cases from different sectors (mobility, tourism, real estate, employment), Navitia's reusers and contributers,... or some difficulties (long is the road), what are the next steps in the transport industry, with the European Union.

The Open Source Initiative is working on making improvements to its license review process and has a set of recommendations for changes it is considering making, available [link to be provided]. This session will review the proposed changes and also take feedback from the participants on what it got right, what it got wrong, and what it might have missed.

The License Review Working Group of the Open Source Initiative was created to improve the license review process. In the past, the process has been criticized as unpredictable, difficult to navigate, and applying undisclosed requirements. The Working Group developed a set of recommendations for revising the process for reviewing and approving or rejecting licenses submitted to the OSI. The recommendations include separate review standards for new and legacy licenses, a revised group of license categories, and some specific requirements for license submissions. The recommendations are available [link to be provided] and the OSI is in the feedback stage of its process, seeking input on the recommendations. The session will review the proposed changes and also take feedback from the participants on what it got right, what it got wrong, and what it might have missed.

Note that the following is out of scope for the Working Group:

A review of the Open Source Definition itself Replacement tooling for the license-review email list

Jon Doyle's 1978 PhD thesis proposal, 'Reflexive Interpreters,' describes the idea of a reflective problem-solving meta-interpreter with a sophisticated model of its own behavior, semantics, capabilities, and limitations, that would display "self-conscious" behavior. We investigate this idea of a reflexive interpreter, and connect it to ideas from McCarthy, Minsky, and Lenat.

In this talk, we describe the LDBC Social Network Benchmark's two workloads: the Interactive workload for transactional graph database systems and the Business Intelligence workload for analytical graph data systems.

The Linked Data Benchmark Council (LDBC) was founded in 2012 by vendors and academic researchers with the aim of making graph processing performance measurable and comparable. To this end, LDBC provides open-source benchmark suites with openly available data sets starting at 1 GB and scaling up to 30 TB. Additionally, it allows vendors to submit their benchmark implementations to LDBC-certified auditors who ensure that the benchmark executions are reproducible and comply with the specification.

We describe the key features of both workloads, including their data sets, queries, and update operations. We explain how they ensure meaningful and interpretable results via careful parameter tuning. Finally, we showcase the workloads' reference implementations (maintained by vendors and community members).

Information on the talk:

• Expected prior knowledge: specialized prior knowledge is not needed
• Intended audience: developers and users of graph database management systems

Speakers:

• Gábor Szárnyas is a post-doctoral researcher at CWI Amsterdam. He is the lead developer of the LDBC Social Network Benchmark's BI workload and the maintainer of the Graphalytics benchmark. He is a member of the LDBC steering committee.
• David Püroja is a research software engineer at CWI Amsterdam and the maintainer of the LDBC Social Network Benchmark's Interactive workload. He is a certified LDBC auditor.

Previous talks:

• The LDBC Social Network Benchmark: Business Intelligence workload (15th LDBC Technical User Community meeting, 2022)
• The Linked Data Benchmark Council: Fostering competition in the graph processing space (World AI Conference, 2022)

In this talk I'm going over some lessons learned from building internal APIs in Rust as well as some public APIs such as the Redis rust crate, the insta snapshot testing library, the MiniJinja template engine and more.

It covers lessons learned from making mistakes, more crafty abstractions with generics and more of building libraries in Rust for 10 years.

PIMMI is a Python software that performs visual mining in a corpus of images. Its main objective is to find all copies, total or partial, in large volumes of images and to group them together. Our initial goal is to study the reuse of images on social networks (typically, our first use is the propagation of memes on Twitter). However, we believe that its use can be much wider and that it can be easily adapted for other studies.

The main features of PIMMI are therefore: - ability to process large image corpora, up to several millions files - robustness to some modifications of the images (crop, zoom, composition, addition of text, ...) - adaptability to different use cases (mainly the nature and volume of the image corpus)

A study using PIMMI will generally be broken down into several steps: 1. constitution of a corpus of images (jpg and/or png files) and their metadata 2. choice of PIMMI parameters according to the criteria of the corpus 3. indexing the images with PIMMI and obtaining clusters of reused images 4. exploitation of the clusters by combining them with the descriptive metadata of the images

The development of this software is still in progress and we warmly welcome beta-testers, feedback, proposals for new features and even pull requests!

Vis aims to be a modern, legacy-free, simple yet efficient editor. It extends vi’s modal editing with built-in support for multiple selections and combines it with sam‘s structural regular expression based command language.

This BoF is meant to help users find each others and share thoughts and configurations.

Desktop and server software at the present moment in time is very rarely developed with its energy consumption as a major consideration. However in a world with limited resources this becomes a growing concern, especially as developers cannot cater to this need since the appropriate tools are currently lacking.

The Green Metrics Tool is an open source framework that allows for measuring, comparing and optimizing the energy consumption of arbitrary software. The goal is to empower both software engineers and users to make educated decisions about libraries, code-snippets and software in order to save energy and thus carbon emissions.

Any application will be containerized and then analyzed by its logical parts. The open source tool measures classical performance metrics as well as energy related metrics like wattage, temperature and cooling efficiency to understand what part of the software is responsible for which part of the energy consumption.

Through the concept of usage scenarios we create an interface for developers to test/develop against. In the end this makes complex software products comparable to each other and thus enables developers to select libraries based on their functionality-energy-profile (for instance messages per Watt or similar).

We present the roadmap for this tool over the next year, which will result in a public and open database of energy information for arbitrary hardware setups, code blocks and libraries and a green standard library / green code completion.

VVenC and VVdeC were released on GitHub shortly after VVC finalization in 2020. This talk will present the current state of the project, shortly recap its development history, and outline how it can enable VVC encoding and playback in popular open source frameworks.

In various scenarios, it is necessary to attest the integrity of a remote machine, making sure that the system was booted securely, essential files were not modified and that only allowed software is executed. For this purpose, we present Keylime as a remote attestation solution. It leverages the trust from the Trusted Platform Module (TPM) in combination with UEFI Measured Boot and the Linux Kernel Integrity Measurement Architecture (IMA) which are probably available on your system today. We will present how Keylime works and real world applications for remote attestation.

With a VM attached to multiple networks, it may become difficult and sometimes impossible for its workload to recognize which interface is connected to which network. In this presentation, we will cover various vNIC to network mapping options, their advantages and limitations.

The traditional interface naming scheme (eth0, eth1) does not play well when multiple network devices are present in a system. The names are dependent on the device detection order, which makes them unreliable over reboots.

Modern OS have started using predictable naming schemes for some time now, making the traditional naming scheme a thing of the past.

KubeVirt [1] provides several options that allow to reliably map vNICs to networks in guests: - Based on MAC address. - Based on the PCI address. - Based on the ACPI index. - Based on the device-role-tagging [2].

While we will use KubeVirt as an example, note that these methods are applicable to other platforms too.

Prior familiarity with virtualization and basics of networking are recommended. The audience will walk out knowing how to use the various network mapping methods and understand their pros and cons.

[1] http://kubevirt.io/ [2] https://kubevirt.io/user-guide/virtualmachines/startupscripts/#device-role-tagging

Linux desktop camera applications have traditionally been limited to support USB cameras preventing their usage on mobile Linux platforms with complex camera systems. With the adoption of Pipewire and libcamera traditional camera applications are not anymore limited to desktop system but can be re-used for mobile platforms.

This talks presents the implementation of the components that allow a desktop camera application to run on a mobile system, using a Pinephone Pro running PostMarketOS as development platform.

Linux desktop camera applications have historically supported only simple use cases and are generally limited to the usage of USB cameras. This has traditionally prevented their adoption on embedded and mobile devices, such as Linux smartphones, where the camera system requires precise configuration of the several components that realize it.

The increasing adoption of Pipewire as the system media device manager in conjunction with its libcamera backend that enables support for complex cameras, allows the usage of 'traditional' camera application in new contexts.

The talk will demo a desktop camera application such as gnome-camera or cheese running on a PinephonePro with PostMarketOS and presents the architecture and the implementation of the components that allow a 'desktop' camera application to run on a mobile Linux system.

Veraison is an OSS project that aims at sensibly reducing the complexity associated with the verification of attestation evidence.

Remote attestation is the means by which a computational workload can provide trust metrics about itself as well as the processing environment on which it executes.

Evidence produced by an "attester" is typically used by a relying party to ascertain its security posture, and therefore as a building block to establish trust between the parties involved in distributed computations -- especially those that require a high level of security and privacy, such as in Confidential Computing.

However, an attestation is pointless if its trustworthiness can't be verified.

Verification is, in fact, the central function the entire remote attestation architecture relies upon.

An attestation verifier sits amid a complex network of trust relationships and processes -- including device manufacturing, software life-cycle, and product certification -- and has to make sense of a vast and messy amount of information in order to give the relying party the simple answer it needs to instruct its authorisation policy.

It provides pre-canned software packages addressing different attestation technologies that can be composed into a verification service.

To reduce complexity and fragmentation, Veraison embraces standard interfaces as much as possible while at the same time providing enough flexibility to adapt to technology- and deployment-specific needs.

Veraison has been adopted by the Confidential Computing Consortium in the Linux Foundation.

Kotlin Multiplatform Mobile is now in Beta, enabling a whole new series of possibilities to share code between platforms. But sometimes things don't go as planned, especially when using an out-of-the-box multiplatform library on a native iOS project. In this session, we'll talk about what we learned from our experience while porting some Android libraries to Multiplatform ones, with a focus on how it's possible to improve the user experience on Swift when consuming Kotlin Multiplatform artifacts.

Strings can seem like one of the most innocuous data structures in Go. Yet, they still play a significant role in most ubiquitous types of programs, such as text processors, in-memory key-value stores, DNS resolvers, or codecs. Their burden on the performance of such programs becomes especially pronounced in distributed systems and cloud-native environments, where the number of strings within an instance of the software can reach an order of millions or more. This gives rise to performance issues and bottlenecks, especially with regard to memory consumption.

To provide answers to these problems, the talk will discuss several string-optimization techniques. To be more accessible for both beginner and intermediate levels, the talk will first state the problem and briefly introduce strings as a data structure, and will explain how strings look internally in Go. The core of the presentation will be dedicated to discussing operations with strings and how these can be optimized based on various techniques, such as string interning and string concatenation. The author will also share his experience and practical examples of open-source programs, where these techniques are being applied.

Let's have a look at openSUSE's MicroOS architecture and see how it implements the UAPI group's ideas of a modern, secure operating system, especially regarding deployment, update mechanisms, configuration file management and full disk encryption using the TPM.

Table of contents: * The general design (Btrfs snapshots, RPM packages) * Update and rollback mechanisms (transactional-update, libtukit) * Configuration file management * Full disk encryption implementation

KDE's digital travel assistance app Itinerary consumes public transport data in various ways, from journey queries over realtime disruption information and coach layouts to tickets. In this talk we'll look at what has been implemented for this and what is still missing.

KDE Itinerary supports you on the road by presenting all relevant travel dates and documents in a timeline, with all its content being automatically extracted from flight, train and bus tickets, hotel reservations or event tickets. Unlike with proprietary alternatives, all of this happens on the user's device and under the user's control. Itinerary can then augment this with realtime information about disruptions and suggest public transport options to get from the station to the hotel for example. For connections in complex train stations Itinerary also provides OSM-based indoor maps including the realtime operational status of elevators where available.

In order to support the travel data extraction from tickets, decoding several standard and proprietary ticket barcode formats has been implemented. Besides UIC 918.3 and ERA SSB/TLB this as of recently also includes the rather complex new European international ticket standard "Flexible Content Barcode" (FCB). For a few proprietary barcodes we are still struggling with reverse engineering and/or finding the corresponding documentation though.

For querying public transport journeys and disruption information several open and proprietary backends are supported, such as Navitia, OpenTripPlanner, OpenJourneyPlanner/TRIAS, Hafas and EFA. The focus here is on unified access to common information rather than to support every possible detail and journey customization option. One still missing but particularly difficult to model piece of information however are prices and tariffs.

With over 80 currently supported online services, automating discovering and managing information about those also becomes relevant. We will look at the Transport API Repository project as well as Itinerary's approach of adding line and product metadata from OSM and Wikidata for this.

Realtime data of the operational status of elevators and escalators or the train coach layout at a given platform are also supported, but unfortunately not as widely available. This tends to be particularly relevant information for users with mobility restrictions though.

using a mountain metaphor instead of choropleth or cartogram visualisations has some use in showing similarities and differences between places. data mountains are a bit like bar charts on a map, but their mountainous shape makes the bars resemble topographic features!

using #nbdev to publish the package was fun because it makes it much easier for python teams to collaborate on jupyter notebooks in git as it cleans json metadata with a pre-commit hook that prevents merge conflicts, and it also makes it very convenient to document, test, and share code and packages on the web, pypi, and conda.

The PinePhone appeals to those of us who seek autonomy from dominant platform corporations. The talk introduces a new operating system for the PinePhone that is not based on Linux but on Genode. With such an unorthodox underpinning, we found ourself inspired to reimagine the dual notion of the phone as a highly dependable and secure appliance, and as a host for general-purpose applications. The talk will give an overview of Genode, present technical tidbits, and of course demonstrate the OS.

It is hard to imagine our society without smartphones. With the convenience of those handy companions, however, comes the dependence from platform providers who curate, manage, and update the devices for us. This central role has become an incredible leverage for the platform vendors, like Google and Apple. Those of us who want to escape the reach of those powerful corporations find the prospect of openness and transparency of the PinePhone hard to resist.

Even though the PinePhone is primarily meant for the use with Linux, it deserves more than one operating system kernel! Driven by the vision of a truly trustworthy smartphone, we have built a custom operating system for the PinePhone. Its uncompromising architecture is a radical departure from existing Linux-based systems. It combines microkernel technology, capability-based security, sandboxed device drivers, and custom system-control-processor firmware with a new user interface that diverges from the beaten track in interesting ways.

The talk by Genode developer Norman Feske will present the outcome of the past two years of intensive development, touching topics ranging from energy management, over voice telephony and mobile-data connectivity, up to applications like the Morph web browser. It goes without saying that the talk wouldn't be complete without showing the new OS in action.

Ceph RGW (RADOS Gateway) is an interface to Ceph, providing access to Ceph object storage using the industry standard S3 and Swift protocols.

Zipper is a project currently underway to provide a plug-in framework to utilize other storage solutions, e.g. an SQLite database, in addition to or instead of Ceph RADOS.

Other related activities include adding LUA scripting, an Apache Arrow Flight front end, and pluggable, stackable filters.

In this talk we will provide a high level overview of the overall Ceph architecture, and then drill in to the RGW architecture with the Zipper enhancements. We will do a deeper dive into the source and review the Zipper API that developers use to write a Zipper plug-in.

Open source has become the defining way of developing software. But how do we open-source the operation of software?

The Operate First Community Cloud is a peer-to-peer mentoring environment for running software in production, as well as a community for Cloud Native SREs to share knowledge about production practices. Using the same community-building process of open source projects, but extended to ops procedures and data.

Experienced SRE’s find an outlet for sharing their knowledge and new talent get’s a chance to grow into an SRE role and get their hands on cloud-native projects in a production environment.

Could this be a blueprint for a sovereign cloud?

We’ll discuss how opening operations can free up a cloud deployment and lead to the same independence that open source brought to software.

We will build a few analytical apps from scratch. This includes the full circle: data collection, processing, and visualization, and most of this is done by ClickHouse and a bunch of one-line shell scripts. The emphasis of this talk is to show how approachable and powerful are modern data processing tools.

Containers are essential for microservices applications; In this talk, we'll talk about database containers, the construction process, and best practices when creating a database container. For example, we will use open-source databases and create a Dockerfile from scratch focusing on each layer of the databases. Participants in this talk will learn the fundamentals behind containers, specifically database containers. Those who want to implement it will have enough information to build their database containers efficiently.

Driving research based on large collection of data often demands in the humanities a strong collaboration between researchers and data engineers. Data are the corner stone on which the research is based. Caring about our research data is not only a good practice to drive and open our research, it's also a good way to foster collaboration between researchers and engineers. In this talk we will present how, in a Digital Humanities research project, controlling the data quality and structure through a frictionless data package leverage the a great data productivity.

Please note that this talk replaces one entitled "Data flowing the right way" that was due to have been given by María Arias de Reyna, who has sent his apologies but is now unable to attend the conference.

In the Kubernetes resource allocation model, abstract concepts like resource request and limits, container QoS (quality of service), etc are being used. These concepts are eventually being converted under the hood to cgroup configurations, which have their own resource management model and concepts like CPU shares, CFS quotas, etc.

In the context of Kubevirt, an add-on to Kubernetes to allow running cloud-native VMs alongside containers, this information is crucial. In fact, our own “Cgroup Manager” was implemented to mutate and configure the container cgroups that are being defined to us by Kubernetes. One especially interesting challenge was to support a true CPU Pinning for VMs running on top of Kubernetes.

This presentation will take you through our journey to support true dedicated CPUs for VMs. I hope that after taking part in this presentation, the audience will better understand Kubernetes and Cgroup resource allocation models and how they can be further utilized in the future. In addition, I wish that the info presented here will improve the collaboration between different technologies in the ecosystem like Cgroups, KVM, libvirt, Kubevirt and Kubernetes by raising awareness to how they all interact together in different and interesting use-cases.

After thirty years of FOSS advocacy, issue and problems in approach have begun to emerge. Strategic mistakes in approach to new technologies has often led to large areas of software endeavor to remain proprietary. While for-profit companies have been rewarded with great efficiency benefits and other perks from their adoption of FOSS, rarely do these benefits trickle down to consumers and end-users in their daily computing lives. This talk examines our past mistakes in advocacy and activism, and considers what to do next.

Since its advent in the late 1980s, the Free and Open Source Software (FOSS) community now has more than thirty years of experience in strategies for advocacy and encouraging adoption of FOSS. Results have, unfortunately, been mixed. While corporate adoption by for-profit companies has led to a boon and integration of FOSS into most corporate practices, the true promise of software rights and freedoms — the ability of individual hobbyist and consumers to participate on equal footing with the largest software producers in the world — mostly eludes our community.

This talk examines the wins, losses and challenges that FOSS advocacy has faced in the last thirty years. We'll explore how failures to foresee both web application deployment and the advent of advertising-based app-oriented software deployment led to serious strategic errors in advocacy and focus of attention. Many of these problems remain difficult to address, and only frank discussion among activists will reveal new approaches to continue a vibrant FOSS community into the next generation.

Currently, the energy consumption metrics are only available at node levels. There is no way to obtain container-level energy consumption. Autoscalers and schedulers really need pod-level metrics data in order to obtain energy savings from resizing or migrating containers.

The presentation introduces Kubernetes-based Efficient Power Level Exporter (Kepler) and its integration with Kubernetes. By leveraging eBPF programs, Kepler probes per container energy consumption related system counters and exports them as metrics. These metrics help end users observe their containers’ energy consumption and allow cluster admins to make intelligent decisions on achieving energy conservation goals. The presentation shows that Kepler can be easily integrated into Prometheus and render time series metrics into Grafana.

At last, we will demonstrate sustainable management of clusters by leveraging Cloud-native patterns, Observability and Kubernetes features like node selector, node labels, node name, affinity and anti-affinity to achieve carbon intensity aware placement of workloads in a Kubernetes cluster.

Go is a very performant language, so, normally you don't need to optimize it at all. But what happen when you need it?

This talk is a walk through some techniques and tools that you can use to squeeze that last drops from your functions.

We are going to see tools like pprof or go benchmarks, and explore some of the results.

We are going to explore other topis like escape analysis, function inlining or the garbage collector, that all of them can affect the performance of your application.

This talk will present how support for an advanced camera use case was integrated into the mainline Linux kernel, using the Media and V4L2 APIs. It involves supporting a sensor using the raw Bayer RGB format, transmission over the MIPI CSI-2 bus as well as support for the Image Signal Processor (ISP) found on Allwinner platforms. A specific focus will be set on this ISP, with details about the features it implements as well as the internal and userspace APIs that are used to support it.

Capturing pixels with a camera involves a number of steps, from the ADC reading the photosites in the image sensor to the final pixel values that are ready for encode/display, with various processing and transmission taking place along the way.

While simple cases put most of the heavy lifting on the image sensor's side (through its embedded processor) and use a simple parallel bus for transmission, advanced cases require more work to be done outside of the sensor. In addition, modern high-speed transmission buses also bring-in more complexity.

NLnet is inviting (prospect) NGI Zero projects to meet & greet, and have a discussion about the Next Generation Internet.

Kotlin is great language to do modern functional programming, and in my opinion perhaps the best language to do modern mainstream (hardcore) functional programming. With the power of Kotlin DSLs we can make functional programming idiomatic, simple and elegant. This talk takes us through the different techniques that we can apply in Kotlin to achieve modern, and elegant functional patterns.

FFV1 is a lossless, royalty free and open source video coding format. We'll present the work made around it, especially the IETF standardization work (RFC 9043), the reference encoder/decoder (FFmpeg), a FFV1 conformance checker (MediaConch), and a practical usage of it through the RAWcooked project, as well as its planned usage in MXF. We'll also talk about the standardization of its audio counterpart, FLAC, and the accompanying container, Matroska.

Since its inception in early 2020 our podcast named Linux Inlaws has gathered an average audience of just short of 8,000 listeners per episode and continues to grow in this fashion. What started out as a hobby project (and to a certain degree still is) covers - peppered with a dash of humour - a wide variety of topics ranging from political and social to technology subjects; attracting key industry figures and projects including the Electronic Frontier Foundation, the Free Software Foundation Europe, Mozilla's CTO, Nextcloud and BSD core devs to name but a few guests on the show so far.

The talk gives an overview of the history of the podcast since its creation followed by a discussion of the general approach, the philosophy behind the format and its organisation. A section on the technology stack that drives the highly automated workflow behind the scenes will be of interest not only for buddying fellow podcasters but anybody concerned with media production and distribution in general. In addition, the hosts will shed some light on the challenges we have faced over the years and how these were overcome. The talk concludes with a discussion of the road ahead for the Inlaws and their next twenty years (if not more :-) of making a difference in the community and beyond.

The tools necessary for 3D printing, CAM and CNC, and other maker-based activities are available to run instantly in the browser with no software to install. This is ideal for STEAM education, online coursework, maker spaces, or anywhere you either can't install software or can't keep it up to date.

Modern browsers expose substantial computational power with access to multiple cores, shared memory, GPUs, and near-native code execution with Web Assembly. It is possible to present complete browser-based replacements for applications that were previously only the domain of desktop-installed software. Add in the capabilities of Progressive Web Apps, we get always-on, always up-to-date applications that start instantly and have a fraction of the footprint of their desktop counterparts.

The focus of this talk, Kiri:Moto, was started in late 2013 as a 3D printing slicer when the cohort of available tools was very limited. It has since evolved to handle 4-axis CAM, laser cutters, and mSLA output targets. Kiri:Moto was one of the first slicers to support belt 3D printers. And this cutting-edge work will soon extend to 5 axis FDM.

Kiri:Moto runs both online and offline (as a progressive web app) in standard browsers as well as mobile devices and tablets. It pushes the boundaries of what's possible inside the browser sandbox using web workers for distributed computing, WASM for accelerated computation, and ThreeJS for visualization.

The active base of users skews toward college and high-school classrooms, maker-spaces, and individual creators. It is available (also free) inside of Onshape's web-based CAD, helping to make a complete in-browsers stack requiring no software installation to go from design to manufacture.

CoffeOSM is a tool that helps users improve OpenStreetMap by scanning the text on receipts from shops and checking if the place is already listed in OpenStreetMap. If the place does not exist, CoffeOSM suggests ways to insert it. This talk will discuss how CoffeOSM works and the benefits it brings to the OpenStreetMap community. We will also showcase examples of how CoffeOSM has been used to add new locations to OpenStreetMap and demonstrate its user-friendly interface. Attendees will learn how they can use CoffeOSM to contribute to the OpenStreetMap project and help make it even more comprehensive and accurate. I'll also ask for help to gather receipt example from different countries.

Hybrid Public Key Encryption is a new standard which got finalized in February 2022. It uses asymmetric encryption to transfer a symmetric key between two participants which is then used to encrypt the communication. The standard itself is not post-quantum resistant. The presentation explains how to make it post-quantum resistant.

Please note that this is a late addition to the schedule, and the programme because the presenter Naveen Srinivasan of previously selected talk "How do you trust your open source software?" was not able to attend on the last minute.

Gephi is a popular open source network visualization software. In this talk we propose to share how we build the future of Gephi on two levels: the code, and the rest.

For two years, we have been making efforts to sustain Gephi over the long term. The threats to the project are sometimes about the code, sometimes not: what if a library we use, and is no longer maintained, becomes incompatible with the latest MacOS? What if the few people who know the codebase get out of the project, and we cannot transfer that knowledge to new devs? What if we fail to recruit new developers?

There is a lot of good will around Gephi, and yet making the project healthy is not easy because the path to sustainability is not obvious. This is the discussion we want to have with developers, both to share what works, and to get some feedback to improve. We are not there yet, and we struggle to recruit Java developers.

This talk will be given by two co-founders of the project, Mathieu Bastian, the historic architect of the Gephi codebase, and Mathieu Jacomy, the designer of Gephi and a researcher in network visualization.

In short, the topics we want to touch upon are: * What is the Gephi road map and why is it how it is * The path to funding the project * Our "Gephi code sustainability retreats", where they shined, where they failed * The relation we build two communities: the users, and the devs. * Documenting the codebase and engaging developers * How the Gephi project acknowledges the web as a platform (Gephi Lite)

Machine OS, designed for appliances used in lights-out/hands-off environments, is an environment for Secure and Trusted booting of an image-based Linux OS leveraging TPM 2.0 security chips to guard unique platform secrets only made available if the chain of trust from the platform, through the kernel and into user-space is verified. The platform secret is used to attest, at runtime, device and software veracity for creating clusters of systems with a common root of trust extended from the platform.

The secured (PCR7) initial environment of Machine OS checks a signed (Machine OS CA) manifest of images present. It then verifies (dm-verity) the images before handing over execution control. Machine OS leverages opensource tools for building (project-stacker), signing (notary/cosign) and hosting (project-zot) such images. The design of Machine OS has some similarities with the UAPI proposal for Trusted/SecureBoot, making for an interesting comparison on design goals.

Our design is focused around the goal not of preventing alternative boot images, but denying all images which are not verified access to a set of TPM-protected secrets. Furthermore, to support re-use of a single signed UKI by multiple unrelated projects, image manifests are signed by product certificates which are all signed by one company-wide CA, whose certificate is shipped as part of the (protected) UKI.

Accurate description of the railway network as always been a key resource to manage train circulations. To solve common problems of operation simulation requires a great amount of data of high quality. Unfortunately, open data published by infrastructure managers in Europe is not meeting expectations: poor documentation, no information on data quality, low frequency updates, missing data, heterogeneous coverage… In this talk, we will compare current railway network data availability and quality on OpenStreetMap and on company-owned open data platforms of several European countries. Based on this analysis, we will issue usage recommendations for open-source projects needing to use railway network description data. Then, we will share perspectives on the evolution of these data sources on the years to come.

Accurate description of the railway network as always been a key resource to manage train circulations. To solve common problems of operation simulation requires a great amount of data of high quality:

Comprehensive geometry (length, incline, curve) and topology of tracks, including switches and crossings and of passing points (stations, points of interest); 

Circulation restrictions, associated to tracks (speed limit, track vacancy detection, electrification, loading gauge); 

Rolling stock (power, size, weight, contents). 

Historically, this data has been created and maintained by rail infrastructure managers, to construct the timetable, sell train paths to transporters and maintain the infrastructure. The strategic nature of the data has been reassessed these last years, as open data regulation evolved in Europe (public money = public data), compelling infrastructure managers to publish some of their data. Open data supports innovative product emergence inside and outside of the company, and is a requirement on open-source projects, to allow collaboration.

Unfortunately, published data is not meeting expectations: poor documentation, no information on data quality, low frequency updates, missing data, heterogeneous coverage…

Meanwhile, since 2007 on the OpenStreetMap (OSM) project, a collaborative geographic database of the world, volunteers have mapped the European railway network with great accuracy, using mainly aerial imagery and field knowledge provided by railway enthusiasts. Because of its overall quality, coverage, and easy access, projects started to use OSM data instead of company-provided open data (OpenRailwayMap, OpenRailRouting).

Using OSM data has many advantages: public and decentralized (anyone can access, at any time), constantly updated with detailed metadata, world coverage, easy updating of incorrect data, data model flexibility allowing new usages, powerful open-source tools to edit and ascertain data quality, protective license (OdBL).

But there are still many challenges to address: integrating company-sourced open data in OSM while respecting the community work (and as so, challenging the ownership of the data as a data producer), establishing public data quality reports, integrating real-time and non-geographic data (such as rolling stocks) that cannot be published on OSM, work with other users to ensure the data model and data quality suits every use, etc.

In this talk, we will compare current railway network data availability and quality on OpenStreetMap and on company-owned open data platforms of several European countries. Based on this analysis, we will issue usage recommendations for open-source projects needing to use railway network description data. Then, we will share perspectives on the evolution of these data sources on the years to come.

During the last few years we've seen no less than 2 phones ship with Linux installed out of the box, a large uptick in the number of Linux distributions targeting mobile devices, and big improvements to the usability of user interfaces and apps on mobile devices. But as the band Chicago once said, "where do we go from here?" This talk won't provide any definitive answers for what comes next, but hopes to introduce some ideas for what the community can do so that Linux Mobile continues to grow.

In this short talk, we'll present a way to see the discourse around digital sovereignty through a climate lens - understanding how the concepts that support having a vibrant diverse set of cloud providers can result in a healthy ecosystem climate wise , and also in terms of values alignment too.

We'll introduce a useful model, known as the Green Web Triangle, for talking about the trade-offs we currently make when choosing digital services that can help technologists have productive conversations with budget holders and policy makers.

Finally we'll explore how competing on transparency with open source is a valid strategy where existing incumbent cloud providers cannot do the same - organisations with legally binding carbon reductions are now required by investors and policy to report on efficiency and sustainability in ways that are currently impossible with most incumbent providers, but doing so will be a legal necessity, as new laws around sustainability reporting come into effect in 2024. We'll end with Q and A to explore these new developments and how to make the most of the changing policy landscape to move towards a more open, diverse ecosystem of companies building the cloud platforms we need for a sustainable, pluralistic diverse internet.

Started in 2014, the gccrs project is working toward creating an alternative compiler implementation for the Rust programming language. At the moment, the project targets the 1.49 version of the language and hopes to catch up once that milestone is reached.

In that talk, we will explore some of the components inside gccrs, as well as dive into some of the hurdles encountered during the project's lifetime.

Finally, we will explore ways to cross-pollinate with the Rust community, in order to help and benefit both projects. Specifically, we will dive into some ways we plan to share components with rustc, and how to achieve that: namely, we will look at how we plan on integrating the Polonius project to perform borrow-checking inside gccrs, what our efforts with running the rustc 1.49 testsuite are, and what we need to achieve to start being useful to the Rust- for-Linux project.

Announcing pg_statviz, a minimalist extension and utility pair for time series analysis and visualization of PostgreSQL internal statistics.

This talk will be the official announcement of pg_statviz, a new extension and utility pair created for snapshotting PostgreSQL's cumulative and dynamic statistics, and performing time series analysis on them. The accompanying utility can produce visualizations for selected time ranges on the stored stats snapshots, enabling the user to track PostgreSQL performance over time and potentially perform tuning or troubleshooting.

Closing the Railways and Open Transport developer room

CorTexT Platform is the digital platform of the Interdisciplinary Laboratory for Science, Innovation and Society (LISIS) held in Paris. This platform aims at empowering open research and studies in social sciences about the dynamic of science, technology, innovation and knowledge production. It covers a large variety of methodological research fields, such as scientometrics, Social Networks Analysis, Natural Language Processing and spatial analysis. Its web application gathers most of the original methods produced by the platform team members (https://www.cortext.net/members/). Twelve years after its creation, CorTexT Manager is facing a growth of its usages: in number of users, type of institutions, and locations of the users. Back in 2021, more than 1300 active users came to analyze data on it, producing more than 66 000 calculations, from a wide variety of organizations (laboratories, government agencies, firms, newspapers...) located in 60 countries across the world. In 2019, our users were coming from 39 different countries. In the meantime, scientific production published using one or more sets of methods accessible through CorTexT Manager has nearly doubled: a total of 67 scientific documents citing or mentioning CorText Manager has been identified for 2021 (https://www.cortext.net/publications/). Addressing these changes has required significant transformations of CorTexT Manager: both for its technical infrastructure as well as for how its codebase is produced and its academic visibility. This presentation will give a brief overview of what is CorTexT Manager and focus on: the importance of user documentation for scientific reproducibility, questions related to the ownership and copyright of the source code when engineers and developers are supported by multiple research organizations, and how to ensure its academic visibility.

AVX512 assembly instructions are now available on many CPUs and can offer substantial improvements for some workloads. Whilst the dav1d AV1 decoder project has had AVX512 assembly for some time, it is only recently that FFmpeg has some. This presentation will explain current and future AVX512 assembly optimisations in FFmpeg.

In this talk, we will take a deep dive into reconciliation, which is the fundamental principle behind the working of Kubernetes, and see how we leverage Golang constructs to achieve these patterns. We will explore how to extend these patterns to create what are known as operators in Kubernetes, to enhance its functionalities taking Cluster API as our use-case.

The reconciliation pattern is a design pattern that is commonly used in Kubernetes to ensure that the desired state of a system is consistently maintained. It involves continuously monitoring the state of the system and making adjustments as needed to ensure that it remains in compliance with the desired state. Reconciliation is one of the key patterns that emerge from control theory, which is a branch of engineering that deals with the design and analysis of systems that control the behavior of dynamic processes. Reconcilers are the heart of Kubernetes and Cluster API. The use of reconcilers in Kubernetes enables users to define the desired state of their clusters declaratively, and let Kubernetes handle the details of implementing and maintaining that state. The reconciliation pattern in Go is implemented by using the Kubernetes API to track the state of the cluster, and Go's concurrency features to ensure that the reconciler runs continuously and can make adjustments in real time. We will take a look into the implementation of these patterns in their nascent form and then their extension in Cluster API by the use of controllers.

You clone a Git repository, then pull from it. How can you tell its contents are “authentic”—i.e., coming from the “genuine” project you think you’re pulling from? With commit signatures and “verified” badges ✅ flourishing, you’d think this has long been solved—but nope! This is in essence the problem GNU Guix, as a software deployment tool and GNU/Linux distribution, had to solve as we will see in this talk.

A key element of supply chain security is updates: how can we make sure software updates are secure? That one doesn’t risk running malicious software when updating software their system? For free system distributions, The Update Framework (TUF) has become a reference on these matters. However, TUF is designed with binary distributions in mind—think Debian or even PyPI—and is not suite for “source distributions” like GNU Guix.

In this talk I will present how Guix distributes software packages and the mechanisms central to supply chain security in Guix: reproducible builds, builds from source (the “full-source bootstrap”), and provenance tracking. Software updates in Guix amount to ‘git pull’ so the security of updates translates to the ability to authenticate Git checkouts.

Believe it or not, this pretty fundamental problem was still in search of a solution. Guix developed a simple mechanism for Git authentication, which has been used in production for a couple of years. I will present it and, given that the solution is generic, show how it could benefit Git users alike. We’ll also reflect on how Guix’s approach compares to those developed by tools like slsa or in-toto.

Seccomp has supported a notify target for a little while now. This can be used to delegate system call handling to a userspace process. Using this, it's possible to intercept any syscall (even a non-existing one) and have it be handled by a potentially more privileged userspace process.

In LXD, we like running very safe containers. For that we use user namespaces by default, combined with both AppArmor and Seccomp policies. The result are very very safe containers but because of all that security, a number of actions just aren't possible or return odd values.

System call interception gives us a way out there as we can selectively intercept system calls such as mount, sysinfo, ebpf, ... then run them through policies and if found to be safe, run them again with elevated privileges. We have been progressively growing the list of system calls that can be handled in that way with our eventual goal to complete deprecate the use of privileged containers.

In this presentation, we'll be covering the general concept behind system call interception through the seccomp notify mechanism, some of the things to be extremely careful about and show the ones we have implemented to this day.

Come to see some of the actions the community has done to push Kotlin further, and get inspiration on how to join or lead that movement for higher software quality and compatibility.

Wish SDK X supported Kotlin Multiplatform? Wish it had coroutines and Flows instead of callbacks? With some bug you encounter in the IDE was fixed? Wish that idea you just had makes it to Kotlin? Wish function as a service from cloud provider Y had first-class Kotlin support? Wish scripting in app Z supported Kotlin?

Well, YOU, can join the push to have more and better Kotlin APIs, and better Kotlin tooling, beyond IntelliJ IDEA and Android Studio.

How? There's no definite answer, but you'll learn stories about how people are leading that push, all for higher software quality, and wider compatibility.

Do you know the story of how Kotlin got installed on all GitHub Actions runners? You'll learn about that, too.

Hopefully, that will inspire you enough to become an effective ally in the push for more Kotlin worldwide!

In order to ensure the confidentiality and integrity of container images, we need to download all container images from the registry within trusted domains when creating pods. Current solutions have many disadvantages. The pod/container startup time is extremely slow, the pressure on the network and container registry is high, and additional CPU, memory, and disk IO are consumed.

The Nydus Image Service project aims to reduce container startup time and resource consumption through techniques such as lazy loading and data deduplication, which may help to solve the problems of container image management for confidential containers.

Setting your first steps in the world of programming can be a daunting task. The tools used are unforgiving, and learning materials are too often based on rote learning and writing code from scratch. Many learners feel excluded and like they do not belong, this is especially true for learners that are from groups underrepresented in programming education. In recent years the Predict-Run-Investigate-Modify-Make (PRIMM) approach has been proposed to help students by focusing on learning how to read code before moving on to learning how to write it.

In this lightning talk we will discuss how open source micromaterials can be created as small side or hobby projects, taking into consideration these concepts. We will do so by discussing some open source micro-materials we made, but we will also take a look on how to ensure that your contributions provide educational value.

Co-op Cloud is a software stack that aims to make hosting libre software applications simple for small service providers such as tech co-ops who are looking to standardise around an open, transparent and scalable infrastructure. It uses the latest container technologies and configurations are shared into the commons for the benefit of all.

The project launched public beta in May 2022 and has seen a lot of interest from hosters, hackers and end-users. We are currently in the process of forming our organisational model which help us make decisions collectively and work towards financial stability.

In this presentation, I'll give a status update on the Co-op Cloud ecosystem and where we're going. The thinking and principles of the project closely overlap with the ideas of the Sovereign Cloud and the intersection of the needs of end-users and infrastructure providers.

The level of privacy awareness once reserved for messaging applications is reaching other forms of online collaboration such as office suites. Many companies, including "big tech", claim that their platforms enable users to privately collaborate. However, the definition of what privacy actually means varies widely. While there are no ways to verify claims made about proprietary software, the impact on users is very tangible.

CryptPad is an end-to-end encrypted open source collaboration suite. It seeks to reconcile collaboration and privacy. Users make changes to documents and these are encrypted by their client (web browser) before being sent to the server for real-time synchronization. In this talk I will detail CryptPad's privacy definition and introduce the assumed threat model of an honest-but-curious server. While users have to trust the server to not actively attack their privacy, they can nevertheless protect themselves against a passively sniffing server. I will show why end-to-end encryption is not enough, but must be combined with open source to achieve reasonable privacy in this model.

I am an R&D engineer who joined the team a few months ago with a focus on cryptography. I quickly realized that security and privacy in CryptPad rely on much more than just algorithms.

Passwordless authentication is making a lot noise. Use of FIDO2/WebAuthn tokens and other passwordless means to login to web services is all the rage but there isn't that much available to make the technology usable without troubles for 'traditional' Linux systems, locally and remotely.

For past several years FreeIPA and SSSD teams have been working on enabling end to end passwordless access in centralized and local environment, be it corporate or home deployment. This talk will go into details of our progress in passwordless access implementation for Linux systems.

In 2022 FreeIPA project introduced ability to authenticate users against OAuth2 identity providers (IdPs). This functionality allows to obtain Kerberos credentials after authentication and authorization has been done by the external IdP. As many OAuth2 IdPs allow passwordless authentication with WebAuthn tokens, a true passwordless transition across Linux systems is now available, from login to console, raising privileges within PAM services (e.g. sudo access), to accessing remote systems over SSH. We hope to expand this support with native FIDO2/WebAuthn integration as well.

The work is not complete yet and needs a lot of collaboration across multiple open source projects. Come to this talk to see a demo and discuss how we can improve our passwordless experience together.

Zone parsers, like other parsers, are mostly sequential. To improve zone loading performance NLnet Labs researched ways to tune the process for much higher throughput. We analyze why current parsers are relatively slow and present ideas to leverage data parallelism (Single Instruction Multiple Data, or SIMD) and adjacent technologies to achieve a performance of (eventually, hopefully) GB/s.

Although the focus is on parsing, vectorization has a much wider area of application. We hope to familiarize (DNS) developers with vectorization concepts and show performance can be improved by taking a slightly different programming approach.

(Please note that this talk replaces one entitled "External DNS Operator in Kubernetes" that was due to have been given by Servesha who sadly could not make it)

How much power is used by Firefox every day? What is it used for? What is the carbon footprint? Come learn how we get data on these topics, and what can we do about it!

With insights from telemetry and power profiling, the presentation will show how much power is used by various parts of Firefox, explain what we have done to reduce power use, and share ideas we have to improve further.

A word of welcome by the Energy Devroom managers.

Confidential compute is a powerful new paradigm. However yet it is not easy to use and many developers are hampered from enclaiving their applications. We have developed and open-sourced THE BASE, a set of 18 containerized applications by default leveraging Intel SGX technology. THE BASE covers popular open source applications, such as mariadb, mongodb, redis or runtime environments like python, java, go, rust, ruby. With THE BASE project we aim to help developers to enclave their workload without investing to much time. THE BASE is docker, docker swarm and kubernetes compatible, and requires no change to devops or code.

In this talk I'll present the project.

This talk will shortly present how a patch gets merged for the rust compiler and how the whole process happens and what happens after it was merged.

To provide more details about the talk, I will speak about the tools and processes involved depending on the kind of contribution to be merged and what each involves.

Collabora Online (COOL) brings LibreOffice technology to the browser and integrates with a large number of different Open Source products. Come and hear how you can plug into new APIs we have for Grammar checking (with LanguageTool), Bibliography Management (with Zotero), and translation integration (with DeepL). Hear how an integration can work, and the new SDK samples to build on that we provide to make things easy for developers. Also catch a glimpse of the many improvements to the product that we've made to improve collaboration performance, interactivity, as well as core LibreOffice technology pieces around intereoperability and performance. Hear about our plans around off-line in the browser, and ask any questions you have.

How Meta manages to take offline millions of pictures, videos and text that violate its community standards, all of them adversarially engineered, in a catalog that counts in the trillions. We'll talk about open source technologies that embrace vector search, state of the art in neural and non-neural embeddings, as well as turnkey solutions.

Content moderation is a problem that affects every service that hosts user uploaded media. From the avatars to a personal collection of pictures, the platform holds the responsibility of removing the violating content. The problem can be tackled with clssifiers, human moderators and by comparing media signatures; this presentation will be about the latter. Similarity Detection is an approach that tries to detect media based on an archive of "definitions" (yes, like the antiviruses) of things that have already been classified as violating. But how do we measure similarity between images from the perspective of a machine (not to mention video/audio clips of different lenghts)? The answer is not MD5... We'll talk how we do it, what technologies you can use too and how we can leverage a public, crowdsourced archive of signatures to defeat various threats, from terrorism to misinformation to Child Exploitation.

This year the Client SDK engineering team made the leap into the world of Kotlin Multiplatform. With one “simple” goal, to unify the Android, iOS and JS SDK.

This year the Client SDK engineering team made the leap into the world of Kotlin Multiplatform. With one “simple” goal, to unify the Android, iOS and JS SDK. We take a dive into why the team wanted to make this move, the history of the SDK and multiplatform efforts up until that point and finally how the new SDK was built! But more importantly, we will talk about some surprising benefits of moving to Kotlin Multiplatform and how this might be the solution for your next multi-platform project!

This talk doesn't require any past knowledge of Kotlin Multiplatform and assumes a basic level of developer understanding. We talk much more in concepts and the real world experience of one engineering team's pains!

The Good Governance Initiative (GGI) proposes a management framework to help shape, build and develop an OSPO, from the roadmap definition to the actual implementation of best practices, and further down the road to a full strategy that will actually deliver the greater benefits of the community and ecosystem.

In this session, we will briefly present the method and content of the Good Governance Initiative Handbook, and demonstrate how to put it in action through the automatic deployment of a personalized dashboard to implement the method in a local context. We will also review how you can participate and contribute to the initiative and help translate it into your own language.

Every organization nowadays heavily relies on open source software and ecosystem; therefore, enabling a solid and resilient software supply chain and innovation has become a key topic for many. Open Source Program Offices are an essential enabler for this change, yet many organizations still lack the proper understanding and vision to actually define and organize them.

The GGI methodology is a community-built framework, part of the OSPO Alliance launched in 2021 by European non-profit organizations (OW2, Eclipse Foundation, OpenForum Europe and Foundation for Public Code) and developed as an OW2 Initiative. It is entirely managed as an open source project, collaboratively developed on GitLab, and is progressively enriched and fueled by end-users feedback.

GNU Guix is our beloved reproducible software deployment toolbox. It is a package manager also able to create isolated computational environments. It is even able to produce pack containers. Or, it can be a complete system. In addition of focusing on reproducibility, it provides some key features as roll-back, declarative configuration, or time-machine, to name some. GNU Guix respects the four essential freedoms: run the program as you wish; study how the program works and change it for computing as you wish; share copies for helping others; distribute modified versions for improving.

Open science considers that scientific practices must be more open, transparent, collaborative and inclusive, coupled with more accessible and verifiable scientific knowledge subject to scrutiny and critique. Such enterprise will improve the quality, reproducibility and impact of science, and thereby the reliability of the evidence needed for robust decision-making and policy and increased trust in science. Quoting UNESCO.

Wait, Guix and Open science seems so well matched. This presentation is an attempt to illustrate how the Guix project is helping Open science. We emphasize two features of Guix that implement Open science principles: transparent and long-term.

Quick overview of variable-length vector processing instruction set extensions (ARM SVE2 and RISC-V Vectors).

4 decades later, vector processing is making a coming in 2 instructions sets. We will (very quickly) review how this differs from traditional SIMD and how to take those new vector extensions into use in open-source multimedia inner loops.

A migration to LibreOffice Technology is in a professional deployment a complex technical and non-technical task. Over time both worlds - the proprietary and the open - evolve further, so new or changing technical challenges for a migration appear and motivations for doing it are changing since the beginning of such projects over 20 years ago. May it be e.g. technical new devices like mobile/tablets or online apps or may it be motivations changing from cost arguments to a gain on digital sovereignty for example, all these new developments should be covered by state of the art migrations. A short journey through old but still present and new aspects are presented in this talk and how The Document Foundation proof quality of migration consultants for this with its certification program.

Hare is a systems programming language designed to be simple, stable, and robust. Hare uses a static type system, manual memory management, and a minimal runtime. It is well-suited to writing operating systems, system tools, compilers, networking software, and other low-level, high performance tasks.

At this meeting we'll sum up the state of affairs with Hare, our plans for the future, and encourage discussions with the community. We'll also demonstrate a few interesting Hare projects, including Helios, a micro-kernel written in Hare, and encourage each other to work on interesting projects in the Hare community.

Go is a pragmatic choice for developing reliable and robust programs, especially in cloud environments. However, with big data demands, the expensive economy and the ecology aspects, every Go developer will inevitably be required to handle efficiency issues in critical parts of their Go applications or services.

In this talk, Bartek Płotka, author of "Efficient Go" O'Reilly book and maintainer of open-source Go projects, will walk you through 5 simple steps that will guide you on how to make effective and pragmatic optimizations in your code in a data-driven manner. The audience will learn about essential open-source tools and strategies that allow them to make their code faster or use fewer resources like memory or CPU when needed. There will also be a chance to win free signed copies of the "Efficient Go" book!

OS kernel on embedded ARM64 systems requires PSCI interface to bring CPU cores up/down, suspend/resume/reset/power off. U-Boot bootloader provides a PSCI interface and this talk explains it.

The talk consists of five parts -- how the PSCI interface works, where and how OS kernel calls it, how and in which hooks on the bootloader side do those calls land, and how those hooks in U-Boot provide functionality required by OS. Last part is an example of U-Boot configured to provide PSCI interface on contemporary SoC .

The benefit of using the U-Boot PSCI interface over other PSCI interface providers is twofold. First, it allows for utilizing the full potential of U-Boot, and especially the SPL preloader, which can then boot OS kernel directly and quickly. Second, removing one software component from the boot stack reduces the Software BoM.

New technologies such as Kubernetes and methodologies such as microservices are changing how software is developed, delivered, and deployed. Additionally, bringing new products to the hands of users is happening much faster than before, making Continuous Delivery a critical aspect of doing business. The way we do business is evolving at a tremendous pace and keeping up with the technology and tooling can often put strains on companies regardless of size or number of employees. Knowing where to start is one issue but then once you’ve started how do you scale. Do you need more tools, which tools do you need, what resources do you have to help you pick the right path to keep your company running efficiently, how do you train your developers while they continue to do their day jobs? The CD Foundation was formed and incubates projects that address these challenges in an open-source, vendor-neutral manner.

Using best practices from graduated projects like Jenkins and Tekton as well as incubating projects like CDEvents and Spinnaker, the CD Foundation is working on the CD Reference Architecture to help take the guesswork out of tooling and scaling and creating a blueprint on how to establish, structure or modernise your CI/CD infrastructure. This talk will go over some examples of the CD Reference Architecture and resources available to help make CD accessible for your organisation.

In 2022, we saw growing concerns around app stores as run by Apple, Google, and Microsoft -- and meaningful legislative and regulatory interest. The concerns came from many different directions, including privacy, antitrust, gatekeeping decisions, and platform exclusivity.

I'll discuss this recent activity with a focus on how it all has impacted or may impact user freedom. I'll survey the responses we've seen from free software projects and organizations, and share insights about current app store terms in relation to free software licenses (especially copyleft), and alternative models of distribution like F-Droid.

This will lead to an assessment of what this all means for the future -- are there opportunities for the free software movement to get more involved in influencing ongoing policy conversations that could dramatically impact our future, and our ability to get free software into the hands of users?

The talk will give you an overview of managing Ceph with the Ceph Dashboard and how we tried to simplify the management of the Ceph cluster. We will talk about the current architecture of the Ceph Dashboard and how you can easily deploy and manage and monitor the Ceph cluster. This talk will also cover the current and newly added features of the Ceph Dashboard and also talk about its future. This will also cover how as a developer and user you can contribute to the Ceph Dashboard.

We will also have a demo at the end where we'll show how easily we can deploy the Ceph Cluster starting from zero and then how you can manage different components of Ceph and monitor the insightful information of the cluster.

Agenda: Introduction to Dashboard, Why we need management, Architecture of Dashboard, Key features, what's coming Next?, Demo

Target audience: Ceph, Ceph Management and Monitoring

The twitter-explorer is an open-source research tool that allows users without programming skills to collect, transform and visualize Twitter data through the paradigm of networks. After a short presentation of the program itself, we shall discuss the intricacies of tool-building for the social sciences, more specifically the use and interpretability of force-directed layout algorithms.

The twitter-explorer is an open-source research tool that allows users without programming skills to collect, transform and visualize Twitter data through the paradigm of networks. It represents different types of platform-specific interaction patterns (retweet, mention, quote, reply) as interactively explorable networks, 2D-spatialized through a force-directed layout algorithm. The tool, and more specifically its interactive aspect, which allows users to read tweets of users from within the network visualization, was built out of a necessity to go back to the actual data in order to understand why certain nodes find themselves in the position they are in. We call this process "guided close-reading": the structural overview given by the spatialized network allows the social scientist to find, sort and then analyze relevant content through traditional methods from discourse analysis in order to generate hypotheses about the underlying debate on Twitter.

In this presentation, I would mainly like to discuss the intricacies of tool-building for the social sciences, more specifically the use and interpretability of force-directed layout algorithms, as well as get feedback on the architecture of the tool itself, which is written in Python and JavaScript.

Compiler-rt is a set of runtime routines present in LLVM infrastructure to support and provide an implementation of various builtin functions for multiple architectures. It consists of – builtin libraries, sanitizer runtimes, profile runtimes, and block runtimes. This talk focuses on one of the compiler rt components- sanitizers. Compiler-rt sanitizers are used to perform runtime checks on compiled code. These checks can include detecting and preventing common programming errors, such as buffer overflows and memory leaks, as well as more sophisticated checks, such as undefined behavior sanitization, which can help detect and prevent subtle bugs that can be difficult to find using other methods. This talk will provide an introduction to compiler rt sanitizers in LLVM, and how to use them on various architectures starting with an example of memory sanitizer for x86 architecture. Second part of the talk will cover – how compiler-rt sanitizers can be used for 32-bit and 64-bit ARM architecture and integrate in development and testing using Software development kit (SDK) built with Yocto. Also useful for the development of applications for memory-constrained embedded devices using clang and LLVM.

Bottlerocket is a free and open source Linux distribution purpose-built for hosting containers. Since its launch in 2020, Bottlerocket has been adopted by companies large and small as a platform for running their containerized workloads in production.

It has only what you need to run containers reliably, and is built with standard open source components. Bottlerocket-specific additions focus on reliable updates and on its management and configuration API.

Some notable features include:

• API access for configuring your system
• Fast and reliable image-based system updates
• Defense-in-depth protections such as a read only root filesystem, minimized attack surface, and more
• Built in integration with container orchestration platforms

This talk will provide an overview of Bottlerocket, covering some of the benefits of using a container-optimized OS. We will cover how Bottlerocket is similar to general purpose Linux distributions and point out the ways it is different. During the talk we'll get hands on and show what it is like to use and administer Bottlerocket nodes. We will provide all the details on how to get involved and participate in the community. We'd love for you to join the Bottlerocket open source project

It's the fall of 2021. Bidirectional charging (V2G) is a tech buzzword, but even all those EV owners whose cars support V2G have to wait for the industry to offer them optimal and automated operation. All of them? No. A small but growing group of Nissan Leaf owners are not waiting, but install a stack of open technologies in their home and live the new energy future. This talk will explain how HomeAssistant, FlexMeasures and NextCloud were put together to take a step into the future. In open source, we should build combined solutions from strong existing tools more often! We'll look at one year of data and discuss what could happen next.

Vehicle-to-grid charging (V2G), also referred to as bidirectional charging, means your car battery is not only drawing power from the grid, but might also discharge (back) into the grid. The consequences for the power system are highly consequential, but also from the user perspective: You can save a lot of money if you use your own solar power or use dynamic tariffs. Yet, commercial vendors are slow to offer optimized charging to households, let alone V2G. There are reasons for this, but we set out to show that they are not fundamentally technical. While the industry world is dragging their feet, the power and maturity of open source allowed us to put together an open stack to allow cost-optimized and automated bidirectional charging at home, with a user-friendly UX design built on top, as well. We used strong, existing tools, and added a thin application layer (a HomeAssistant plugin). This design approach should be on the table more often in the open-source community. We will explain the design of this stack, as well as the data we collected and potential monetary benefits for the user. At the moment, the stack is rolled out at the homes of other enthusiastic front-runners. This will make sure the solution becomes more mature and makes steps to scalability. As industry is also dragging their feet on supporting the OCPP protocol, we can only support one charger right now, the Wallbox Qasar, but there is no technical limit to supporting other bidirectional chargers. We are curious if others are interested to support more chargers, and make the stack even easier to install and monitor. Soon, the commercial world will roll out more bidirectional chargers and cars (we use the Nissan Leaf), as well as home energy management solutions which lock users into specific vendor relationships (where the car is just one of the managed services). It's crucial to provide an open-source alternative, to provide independence for users, and to inspire startups.

What motivates a potential code contributor? And a full-time free-software developer? A fun project. LibreOffice development is fun, but also a real challenge, so we must consciously find the flow in it (not quite an oxymoron). While I present my recent LibreOffice, Numbertext, LibreLogo and Hunspell developments, partially sponsored by FSF.hu Foundation, Hungary, I collect the ten funniest moments of them, that were left out of the release notes (i.e. https://wiki.documentfoundation.org/ReleaseNotes/7.5#Default.E2.80.9Cspellout.E2.80.9Dnumberandcurrencyformats, https://wiki.documentfoundation.org/ReleaseNotes/7.4#Newtypographicsettings, https://wiki.documentfoundation.org/ReleaseNotes/7.4#NewnumberinginShowChanges_mode etc.).

Many teams want to have quality documentation, but often fail to keep their docs up-to-date. Maintaining docs can be a frustrating and tedious for smaller teams. In this talk, we are going to explore how we can use a CI/CD workflow to encourage teams to write and maintain documentation. I will demonstrate how tools such as Github actions and Vale can improve the quality and readability of documentation in the fraction of the time needed teams usually need to produce docs. In this talk I will discuss:

• the importance of quality docs
• how to ensure that your docs maintain a consistent writing style
• how to maintain you docs using Vale and Github actions

LibreOffice can import SmartArt from the MS Office files. Here I discuss the status of the support, and the road ahead. I mainly discuss the remaining bugs and expected features.

Eurorack is the leading standard for building modular music hardware, arguably cause for some of the wierdest sounds in the electronic music industry. Despite the existence of development platforms for Eurorack focused on using commodity microcontrollers and the availability of (closed source) FPGA-based synthesizer modules, there is currently no easy way to get started in creating your own FPGA-based music synthesizer hardware.

In this talk Sebastian will present his 'eurorack-pmod' project, a collection of open-source hardware, gateware and software that makes it easy to get started in the world of FPGA-based audio synthesis using only open-source tools (such as Yosys + KiCAD). This talk begins with an overview of music synthesis in the context of Eurorack and illustrates how the 'eurorack-pmod' hardware and gateware makes it easy for you to get started making your own high performance music hardware.

Guix is a 100% free software distribution that can be used in a wide variety of ways.

Unlike other GNU/Linux distributions, all its packages and configuration is defined in scheme (with Guile). To do that it uses software abstractions. That abstraction enables to reuse the same packages or configurations in various contexts (for instance to build container, to build packages for other distributions, etc).

This re-usability can enables other project to use Guix in various ways (for testing, for project infrastructure, etc).

This talk will look at how and why Replicant (a 100% free software Android distribution certified by the FSF) uses or depends on Guix, where it didn't use Guix and why, and future directions with the usage of Guix by the Replicant project.

This talk will mostly be about real life usage of Guix from the point of view of another software project (here an Android distribution). It will therefor show both advantages and limitations of Guix in that context.

It will also have the necessary background information on Replicant and Guix (if it wasn't already presented in another presentation before).

Game developing is hard: models, concurrency, physics and so on are difficult without any helps from the framework. In this talk we introduce Bevy Engine library that allows us to create simple games in a smart way. With the merely excuse to build a Snake Game, in this talk we create Snake Game compiling it as native application and webapp (wasm) application.

The story of this talk starts eight years ago, with the creation of a mapping-interface [1] to explore one of the fined grained statistical dataset on the french population (number of inhabitants / km², the average income per consumption unit, the percentage of low-income households, ...). These data were derived from localized tax revenues of households and were available in a very fine way i.e on pixels of only 200m x 200m, they were delivered at this time by the French National Institute of Statstics (INSEE) throught a massive spatial data file, which limited their use to a very limited number of people able to handle it. The proposed interface changed this and allowed almost any-body to visualize easily these data in their browser. In this presentation we will mainly discuss how to make such massive spatial data easily accessible to the public. The proposed solution is based on multi-scale aggregation: at high scales, the data are aggregated and at fine scales the final resolution of 200m by 200m is recovered. This interface, which heavily rely on zoom in/zoom out interactions allows users to deal and play with one of the well known problem in geography and spatial statistics namely the Modifiable Areal Unit Problem [2] (ie. Data tabulated for different spatial scale levels or according to different zonal systems for the same region will not provide consistent analysis results). This tool has leads to several interactions with new users (journalist, researchers, simple citizen,...) that seem to demonstrate its interest. Since this first project, several other massive datasets (one concerning an updated of the same data-set and one concerning a dataset on all french building) were made available with almost the same system [3,4]. From a technical perspective, this talk will covers the different evolution and open-sources projects that has made this project possible (d3 / postgres / postgis / mapLibre,Leaflet, ...), discussing vector tiles formats, map viewer evolution and a little bit of spatial databases and the development of a little python tool to help other build the same type of visualization.

[1] Francepixels, https://www.comeetie.fr/galerie/francepixels

[2] D.W. Wong, Modifiable Areal Unit Problem, Editor(s): Rob Kitchin, Nigel Thrift, International Encyclopedia of Human Geography, Elsevier, 2009, Pages 169-174,

[3] Francepixels2019, https://www.comeetie.fr/galerie/francepixels209

[4] FrancepixelsBati, https://www.comeetie.fr/galerie/francepixelsbati

We can observe in the latest years that individuals, companies and institutions are more driven towards Open Source Software due to privacy concerns, vendor lock in, data lock in and ethical reasons. When choosing a tool for Knowledge Management, many great Open Source tools are available and can meet any needs from documentation networks to digital intranets and even public websites. 

However, migrating from a tool to another can be difficult and discouraging due to missing modules, incompatibility, unclear documentation or a steep learning curve. At XWiki we understood these concerns and made efforts to continuously improve our migration tools and welcome any user wishing to migrate from other software to XWiki. 

During this presentation we will demonstrate how to seamlessly migrate from Confluence and Sharepoint to XWiki while maintaining the content structure, history, and metadata. 

The strength of FOSS lies in their corresponding licenses. Public administrations however sometimes have a hard time wrapping their heads around the specifics of FOSS licenses although they more and more understand the advantages.

In this talk we want to illustrate the underlying reasons for the existing problems and present ideas how the procurement of FOSS can be improved and made easier for all those involved. We combine this with an outlook to the impending changes and developments with regard to the public procurement of FOSS in Germany.

When procuring software the German administration usually works with standardized model contracts (the so-called EVB-IT) which are not ideally designed for the procurement of FOSS.

In 2022 members of the Open Source Business Alliance performed a number of workshops with the German Ministry of Interior that maintains the EVB-IT in order to remove existing barriers and to eventually reform these standardized model contracts. Additionally a survey among members of the Open Source Business Alliance revealed typical recurring practical problems that companies face when offering Open Source Software or corresponding services to public administrations.

We use Go, containers, and integration testing to reimplement Tailscale’s (https://tailscale.com/) control server, the closed source SaaS product that coordinates their Open Source WireGuard-based client. This talk tells the story of how we managed to build a stable version of the control server that is now starred by almost 10k on Github and has users all over the world through extensive focus on integration tests.

Tailscale is a modern mesh VPN built on top of Wireguard (https://wireguard.com/). It works like an overlay network between the computers of your networks - using NAT traversal.

The Tailscale’s core client, Android client, and supporting libraries and software are Open Source. The SaaS control server and client UIs to proprietary OS (macOS, iOS and Windows) areis closed source. Headscale implements this control server and allows self-hosters and open source aficionados to use Tailscale’s clients without having to use a closed source product.

In this talk we will tell the story of how we started reimplementing the control server based on the code from Tailscale’s official client. We went through stages of “man this works surprisingly well” to “how does this even work” after we started to use aggressive integration testing to improve the “correctness” of our implementation. For every test we added, we found tons of issues to fix, and eventually, we got to a stage where we could improve headscale with great confidence.

Today, integration testing is potentially the most vital part of our development cycle and we both use it to fix “old and broken”, and add “new and shiny”. We have managed to take what started out as a learning project to understand how Tailscale worked and built it into a healthy open source project and community.

This year we enabled the Firefox Profiler by default in Firefox, to replace the Firefox Devtools' performance panel. Since then we were busy improving the UI even more to provide more information to our users. In this talk we'll give a quick summary of the improvements and new additions we made to the Firefox Profiler. You'll learn about the new Power Tracks, as well as the new information and changes to the user interface that make your usage more pleasant.

FIM (Fbi IMproved) is a `swiss army-knife' image viewer. You can use it under the Linux Framebuffer, under X, or in text terminals (ASCII Art), with a consistent interface and with many powerful features. Whether for occasional image viewing, creation of tagged pictures collections, tailoring short and specialized scripts or custom actions, or viewing graphics on a Raspberry Pi, there are many situations where the unique features of FIM make the difference. FIM grew out a fork of the FBI image viewer, and its name is inspired by the VIM text editor. This talk will tour peculiar use cases where FIM shines.

​​Koin is the Kotlin dependency injection framework well known for its ease of use and efficiency. It has been greatly appreciated by the Android community since 2017.

In 2022, a new major version of the framework is released: Koin 3.2. Let’s explore the great new DSL that still continues to simplify our writings, also the new module hierarchy organization capacity, and much more.

The Koin Annotations project is also getting to its first stable version: 1.0. It’s a great time to see all you can do with these annotations, powered by Google KSP under the hood.

Intel Owl is an Open Source Intelligence, or OSINT solution to get threat intelligence data about a specific file, an IP or a domain from a single API at scale. It integrates a number of analyzers available online and a lot of cutting-edge malware analysis tools. It is for everyone who needs a single point to query for info about a specific file or observable. This Lightning Talk will guide the audience through how this software works and how it can be leveraged by security analysts to save time and optimize their work during their day-to-day activities.

Embedded doesn't mean we can't have nice things. As Linux kernel developers we have grown accustomed to the comfort afforded to us by Kconfig, device trees, the device-driver model, multi-platform kernel images, the kernel having sane defaults and virtual filesystems giving us shell-level access to debug and introspect the system.

Why can't we have this in the boot environment? We can and you'll see how, welcome to barebox.

What began as a rejected patchset for adding Kconfig to U-Boot has now been a full-fledged bootloader in its own right for 13 years. barebox is powering millions of devices around the world.

In his talk, Marco will give a brief overview of barebox from a kernel developer's point of view and show how easy it is to add support for a new i.MX8M board. The attendees will see barebox in action and learn how to leverage the VFS for hardware bringup, kernel debugging and booting the system in production.

Software compartmentalization decomposes applications into lesser-privileged components that only have access to what they need to do their job. Properly applied, compartmentalization can limit the impact of many memory safety issues by containing corruption within the vulnerable component. Use-cases are plentiful: library sandboxing, protection of SSL keys, sandboxing of network-facing code, and more.

In the last decade we have seen the appearance of many new mechanisms that enable compartmentalization at a relatively low performance cost (Intel PKU, the upcoming Intel PKS, CHERI hardware capabilities, vmfunc). This generated a lot of research with a strong focus on compartmentalizing existing software, at a fine grain (isolating libraries or components), and as automatically as possible. The promises are great: the compartmentalization of legacy software, with a low engineering effort, and at a low performance cost.

Alas, in this process, the interfaces between compartments are often neglected: they are hard to reason about and difficult to secure automatically, and compartmentalizing at finer and finer-grain exacerbates the issue. This is a major problem, as weak interfaces enable for many attacks well-known in the confidential computing world.

In this talk I will present the result of a study on the impact of neglecting compartment interfaces. I will define and classify compartment interface vulnerabilities, and present a fuzzer specialized to catch them. Having applied it to 25 popular applications and 36 possible compartment APIs, revealing 629 interface vulnerabilities, I will present insights into what makes interfaces vulnerable, and how to make them more resilient when compartmentalizing.

A fully distributed network does not have - by definition - a central authority. Nevertheless overlay networks, like I2P ("Invisible Internet Project") do have the need for a DNS. Also, by definition, there is nothing like trust between peers of such a network. Typically such a problem might be solved using a distributed storage layer driven by a byzantine fault tolerant consensus algorithm. Students of the Lucerne University of Applied Science and Arts created mid December 2022 a prototype solution including an API.

The presentation has the following content:

• Short introduction to the concept of the I2P network and its b32 naming space (3')
• Motivation: Why the I2P network needs a DNS (4')
• Setup: the tools, a distributed layer to store data and an I2P test network (3')
• Byzantine Fault Tolerance as consensus algorithm (2')
• Design and usage of the DNS API for I2P (5')
• Review and outlook (3')
• Discussion: feedback from DNS devs (10')

Processing the wealth of Bugzilla data the LibreOffice generates can be done in R, and presenting it in Shiny is a good fit for it. Making a useful dashboard for the community is not only about pretty graphs and an avalanche of stats, it's also about directing potential QA contributors to relevant information and specific tasks, and prioritising some of the most pressing onces.

We have been working to bring multi-architecture support using SYCL to the LLVM Clang project. Our original approach was to implement a "Plugin Interface" to add support for a PTX back-end and subsequently we have also added support for GCN enabling NVIDIA and AMD GPUs. This short presentation will outline our approach to designing this multi-architecture back-end and recent work to formalise the interface in the SYCL specification. This work is enabling researchers using the pre-exascale Perlmutter and Polaris supercomputers and exascale Summit supercomputer to write code using open standard SYCL and deploy on these machines.

Platform APIs are usually tough to test. They hide complexity from users and abstract a wide range of backend services, ranging from heavy infrastructure over to simple SaaS APIs. Sometimes these processes can take up to hours to finish.

In this talk we will share our experience testing the platform API and introduce you to the tools we have written along the way.

The actual platform API is provided through crossplane. Writing crossplane compositions is not always easy and testing them with all possible combinations and outcomes is even harder. It requires a lot of effort to make sure all components are deployed correctly and work as expected – especially if you have a lot of them. Since everything is written in YAML and crossplane is a relatively new technology, there is no standard set of tools to test everything yet.

To test our compositions automatically, we have set up a CI pipeline that consists of two test stages: A static code analysis using our self-written linter for Crossplane that runs various checks, like ensuring that all patches are pointing to an existing resource property. The second stage consists of end-to-end tests built with Kuttl and compares the status of real provisioned infrastructure with the expected outcome.

The unittest code had grown a lot in the past years, creating a lot of duplicated and unstructured code. It was time to give it some love and clean it up.

For years there was this notion that Kubernetes secrets are inherently insecure. There are certainly concerns about how Kubernetes stores and handles secrets, but base64 encoding (that most people often call out) is not the issue.

Regardless of how Kubernetes attempts to secure secrets, frequently rotating those secrets is certainly a best practice. It also poses a huge challenge, especially when done manually in a highly distributed environment: ensuring secrets are rotated in time, everywhere without affecting availability without making mistakes is no job for humans.

In my presentation, I will explain why secret rotation is important, what challenges it poses and how to do it in a Kubernetes environment.

We are developing an open source federatable management system for FabLabs, Makerspaces and Hackerspaces. FabAccess aims to manage access to machines in order to avoid accidents. FabAccess has three main functionalities: - Machine management - Authorization system - User management

Machine management

We want to combine Neil Gershenfeld's idea of users learning to operate machines independently with the requirements of open workshops that users do not injure themselves in the process. Thus, users need instruction for dangerous machines, and this principle is then reflected in the authorization system.

The principle of FabAcces is to switch machines on and off via the power connection or via internal firmware. This way, machines are normally de-energized and therefore harmless. Only when users are at the machine who are competent and instructed for safe operation, the machine gets connected to the power supply by FabAccess.

The management of machines that require cleaning after use is supported, either. This ensures the usability of machines for the next user and reduces wear and tear.

We also support the reservation of machines, but we do not want to take over scheduling for the users. Therefore, as a compromise we implement that users can reserve machine only for half an hour (as a modifiable parameter). So they don't have to worry about someone else using the machine while they commute to the FabLab.

Authorization system

The authorization system makes it possible to allow access to machines only for certain users. Thus, it can be used to map instructions for dangerous machines, but more complex mappings are possible due to the high configurability of the RBAC system (role-based access system).

It is also possible to map simple machines that do not require instruction but need to be used in a somehow structured way (workplaces, tools, lockers, ..).

User management

The user administration should make it possible not to lose track of the users in the space. FabAccess is intended to be used as a SmartCard system, so each user receives an NXP Mifare DESFire (FabCard) card to authenticate himself at the machine.

In order to reduce the administrative effort, users can register on their own and can then be activated after the operator has checked their data. The user contract is mapped in the process and may be integrated into other systems.

The energy transition poses new challenges to all parties in the energy sector. For grid operators, the rise in renewable energy and electrification of energy consumption leads to the capacity of the grid to near its physical constraints. Forecasting the load on the grid in the next hours to days is essential for anticipating on local congestion and making the most of existing assets.

The open source package OpenSTEF provides a complete software stack which forecasts the load on the electricity grid for the next hours to days. Given a timeseries of measured (net) load or generation, a fully automated machine learning pipeline is executed which delivers a probabilistic forecast of future load. This works for energy consumption, (renewable) generation or a combination of both. 

During this presentation, we will show how we have implemented this opensource tooling at the Dutch Distribution System Operator Alliander to fully automated forecast the load on the grid.

In this talk we are going to introduce you to the Rook Ceph Operator, which can be used to run Ceph clusters with ease on top of Kubernetes clusters. In helping make it easy to run a Rook Ceph cluster we will also be talking about the current state of the project development, the kubectl krew plugin and some more advanced features. There will be a demo about the rook-ceph krew plugin on how it is used to automate common management tasks and can make the troubleshooting process easier.

Scientific articles built on executable notebooks are already common in the domain of scientific publication, where they are an effective tool that brings transparency and openness in research communication (FAIR). However, they’re not yet widely praised in the humanities. Luckily, in the digital humanities, Jupyter notebooks play an important role in data analysis and exploration. They provide a free, powerful and open source platform for analyzing text corpora and other datasets in many programming languages - Julia, Python and R; they flawlessly integrate the browsers and many JavaScript data visualization libraries. In general, digital humanists know very well how to make use of Jupyter notebooks to quickly create and share documents containing live code, equations, visualizations, and narrative text. That’s why we naturally decided to work on Jupyter notebooks when we started playing with the idea of funding a Journal for digital historians in conjunction with the publisher DeGruyter. Developed by the C²DH (Luxembourg Centre for Contemporary and Digital History and DeGruyter, the Journal of Digital History (https://journalofdigitalhistory.org) now publishes peer-reviewed, open access articles that are Jupyter notebooks in their essence. With a difference: we wanted authors to reflect on their use of algorithms and digital methods, so we asked them to write their articles as compositions of three layers: narrative, data and hermeneutics. In our presentation we will explore the ecosystem of tools and methods we have prepared together with the authors: GitHub, Docker, MyBinder, Zotero. We will present the process we follow with them from scratch notebooks to published multi-layered, reproducible scientific articles.

In this talk, I would like to present the importance of the core Collaborative Softwares using by individuals and companies in this stack and the progress and challenges of the Open Source communities providing alternative solutions and the importance of all European countries to collectively support the actors in the Open Source communities providing solution in this area.

In the latest years, the subject of European Digital Sovereignty is gaining ground. Clearly the dominant position of the BigTechs is making both European companies, Countries but also individual increasingly dependent on the product and services of the BigTechs. In order to regain our sovereignty we need to look at the full stack, from hardware, to cloud and to the software running on those hardware and clouds.

In this talk, I would like to present the importance of the core Collaborative Softwares using by individuals and companies in this stack and the progress and challenges of the Open Source communities providing alternative solutions and the importance of all European countries to collectively support the actors in the Open Source communities providing solution in this area.

I will show the progress made in the last years by different providers of Open Source solutions (NextCloud, Matrix, BigBlueButton, Jitsi, XWiki, CryptPad and many others), describe the challenges and difficulties when building Open Source products and competing with the extremely powerful actors that we are facing (including monopoly abuses), but also make proposals on how we could make them work better together.

Having your Office suite crashing is rather annoying, but crashing while opening or saving files is unsolvable for end users. The upstream LibreOffice project regularly runs testing against this on master - but is it possible to do it on stable branches maintained for customers? In this talk I'll introduce the set of test files and upstream scripts, and show how we use them to deliver added stability of LibreOffice for our customers.

Please note that this talk has been cancelled as Nicolai is no longer able to attend FOSDEM.

LLVM has a bunch of global state, which causes pains when using LLVM as a shared library from anything that looks like a plugin -- which includes drivers for OpenGL and Vulkan. This is a quick reminder and update on the removal of ManagedStatic and llvm_shutdown, whose goal is to reduce some of these pains.

Forth is an extremely minimalistic yet powerful language. Its minimalism has historically made it the language of choice to explore and directly interact with the lowest levels of systems, traditionally the hardware. However, you can also use Forth to explore the low levels of the web platform: WebAssembly.

In this talk, I’ll dive into the details of WAForth, a tiny but complete Forth interpreter and dynamic compiler for and written in WebAssembly. You’ll see some Forth in action, read hand-written WebAssembly code, get introduced to tools used for working with WebAssembly, hear about JIT compilation for WebAssembly, and learn how you can move all this outside the web platform into native code.

Wildfires, flood, severe windstorms and heatwaves are just a few of the “new” emergencies that have become more frequent in the European Union. While we’re used to preparing for major disasters - earthquakes, cyclones - it’s time to start thinking about how good maps can save lives and help us navigate better these increasingly common events.

With a view to preparedness and disaster reduction, we’ll take a look at features worth mapping in OpenStreetMap -- parking lots, vacant businesses, gas stations, ad hoc "cooling centers" -- that you might otherwise overlook and give a short overview of tools like Mapillary and StreetComplete.

This talk will illustrate how organizations can configure and deploy OSS enterprise search server Fess, based on our own experiences.

Fess is, by and large, a well-documented, user-friendly tool. Yet, no matter how good the tool is, deploying a search server on your own brings a number of challenges. I will talk about the challenges we had and how we overcame them. Our hope is that

1. You will have a good grasp of what it is like to configure and deploy an enterprise search server, whether or not you are considering deploying one at the moment.
2. Should you decide to deploy one, you can (hopefully) do so with a significantly lower cost.

Today's technology companies often use multiple content management systems, resulting in information (e.g. source code, document files, and wiki pages) fragmented and stored in many places. Consequently, engineers sometimes end up searching multiple locations one by one, repeating the same query at each place, to look for the information they need.

A solution would be to build and deploy a search server which, given a query, fetches the relevant code and documents from all the content management systems, much like a web search, such as Google, does on the Internet.

This would be a daunting task, as it would essentially mean setting up and maintaining the whole end-to-end system of search as a service, from web crawlers to search box UI. Fortunately, there is an OSS search server built for this exact purpose. We are here to share the knowledge, experiences, and insights we have gained so far, so that you can build your own enterprise search server, using OSS.

In this talk, I will first explain what search-related problems we had to solve, as well as briefly touching on what enterprise search is in general.

Next, I'll go over what Fess is and explain its core features, which will serve as an introductory, informational session for this lesser-known OSS enterprise search server.

Moving on to the core part of the talk, I will dive deep into how we configured, customized, and deployed Fess for our specific purpose. Our objectives were

1. to index contents on issue tracking/project management tools we use (GitLab & Redmine) and in repositories (Git & Subversion)
2. to enable users to search the indexed contents from a single search box.

We achieved both of these objectives but we had to overcome several hurdles. I will share things such as what pitfalls/shortcomings Fess has and how to overcome them.

I will also talk about what we have made and contributed; our dev team wrote several patches for fixing and customizing Fess. 3 of the patches are bug fixes and 2 of them have been merged into the mainline. 2 other patches are customizations designed to meet our specific requirements. One of them allows the crawler to pass the custom authentication page of our GitLab implemented with SAML and Keycloak. The other patch re-maps the crawled filesystem paths to the webpage URLs; this was crucial to cut the time to index contents in repositories by reading files on the local filesystem instead of following links on the webpages.

The goal of this segment is to provide the information which will allow future Fess users to deploy it with a dramatically smaller time and effort investment.

Then, I will share our experiences with our preliminary deployments inside TOSHIBA. We will explain resource requirements and performance, such as how long it takes to crawl and index a given size of resources (basically web pages and files) using how much computing resource. This will help future Fess users make estimates on how much computing resource they need to secure in order to deploy it. Along with that, we will reveal details such as how Fess's ability to index contents inside Microsoft Office documents and PDF files helped engineers.

Free and Open Source Software not only permeates nearly all of our digital technology systems, but we see increasing amounts of institutions actively contributing to its creation and maintenance. From technology monoliths to universities to governments, the number of “open source developers” has increased, and with it, open source software. It is no secret that Open Source has “won,” according to many. However, despite the sheer scale of FOSS development today, has the form much of our FOSS infrastructure has taken benefited all in the ways that we expect?

In this talk, I will take participants on a journey through the history of labor in FOSS development to better understand the political economy of FOSS development and what it means for individual FOSS contributors. This talk will use economic analysis to bring up many inspiring steps forward we have taken and also raise many worrying questions about the software we are building.

The contents of this talk will be based on the 2021 research paper “The Evolution of Open Source: Winners and losers in volunteer production,” which can be found at the following DOI: 10.17605/OSF.IO/4CHFN. This paper discusses the material history of FOSS and provides an economic analysis of how labor is the primary means of control of FOSS rather than copyright. Therefore institutions that control significant amounts of labor through the hiring and coercion of workers can dictate the primary benefits of FOSS infrastructure in many of the same ways one could through utilizing copyright.

Cosign, fulcio, rekor are all components in keyless signing with Sigstore. Each piece has its responsibility to provide a smooth developer experience for container signing. How does it all work together to complete that complicated dance to tie identity to cryptographic signatures? And what's more cryptic than rugby? In this talk, James and Lewis will educate attendees about sigstore and container signing using examples from the best sport in the world, rugby. If you're interested in learning more about sigstore and what a hooker does, this talk is for you.

How Mozilla uses machine learning to streamline its development process: automating various aspects of bug management (such as accurately assigning components, detecting types, and identifying spam), trying to predict potential regressions and selecting relevant tests for specific patches. In addition, an overview of future directions for privacy-respecting machine learning usage in Firefox, with the support of the community.

For years, the privacy engineers at Mozilla have known that online trackers use every identifier they can get to track and re-identify people all over the internet. In this talk, I'll give an overview of the work we've done over the years to protect more and more of these identifiers, and where we are now.

Java is now more than 25 years old and throughout the Age of Java there has been many tools for shrinking, optimizing and obfuscating Java bytecode. This was and is especially important for mobile devices, which have certain resource constraints, from the early J2ME devices to today's Android devices.

Today, in the Age of Kotlin, shrinking is more relevant than ever and not just for mobile applications. As well as mobile Android applications, desktop & server applications are also ever growing in size; for example Compose for Desktop typically generates large application packages. JetBrains has recently integrated ProGuard into the Compose for Desktop Gradle plugin to tackle this issue.

But what has changed and how does Kotlin affect shrinkers like ProGuard (which is 20 years old and originally created to process Java compiler produced bytecode)? How does ProGuard shrink classes produced by the Kotlin compiler? The Kotlin compiler just produces Java bytecode anyway, so nothing changes?

The talk will take a look at ProGuard under the hood and what's required to process Kotlin apps & libraries. In particular, there will be a deep dive into Kotlin metadata and how ProGuard (via the ProGuardCORE library) makes use of JetBrains' kotlinx.metadata library to read & write the metadata.

SourceHut is a free software forge for developing software projects, providing git and mercurial hosting, continuous integration, mailing lists, and more. We'll be meeting here again in 2023 to discuss the platform and its community, the completion of the GraphQL rollout and the migration to the EU, and any other topics on the minds of the attendees.

Yosys and nextpnr made FPGA development very attractive for developers that prefer to use open-source tools over proprietary vendor tools. Affordable and well documented boards with ECP5 FPGAs lowered the entry threshold for hobbyists even further.

Michael will show how to use LiteX to use these tools to build soft-core RISC-V SoCs that are capable of running Linux and combine them with use-case specific cores to custom FPGA bitstreams.

LiteX provides a framework to build FPGA SoCs including a few examples of SoCs that are capable of running Linux. However, for fully leveraging the capabilities of FPGAs, one would not only reproduce existing designs, but also implement use-case specific cores and add them to the FPGA bitstream.

Michael will give an update on Steffen's and his experiences with using the open-source FPGA tools to build FPGA bitstreams. In recent years, they presented how to build the LiteX example SoCs, run Linux on them, and how to make the systems reproducible by using Yocto. This talk will focus on how to add custom cores that are written in Verilog and Migen to the SoC to implement use-case specific features.

"We're going to build a new type of database in Go" – "Are you mad?!" This was the common reaction when back in 2019, we decided to build an open-source vector database in Go. Today, Weaviate's downloads have exceeded 1.5M (at the time of writing), and we're over the moon with how far we've come. But oh boy, they were right; it was crazy indeed:

In this talk, I would like to take you on a journey of the less common and crazier parts of Go: You will learn about pure-assembly optimizations, obscure pitfalls, tricks of heap allocations, and memory management in general.

To get the most out of this talk, you should have at least an intermediate experience level of Go. The talk touches on database internals, but no prior knowledge of inner-database mechanics is required.

So buckle up. This is going to get nuts!

The European Union adopted its Budget for the next year in November 2022. The EU 2023 Budget was amended to include the pilot project “De-monopolized access to EU applications”. The project, as tabled by Marcel Kolaja, (Member of the European Parliament, Czech Pirate Party) aims at asking EU institutions to release their apps in repositories that constitute alternatives to major app stores like Apple App Store and Google Play, and to release the source code of the apps. The presentation will explain the pilot project, will explore potential opportunities for FOSS communities, and invite on the same panel F-Droid to bring in the first perspective from their side.

The Turing Way is an open-source, community-led, and collaboratively developed project on making data science and research skills accessible, comprehensible, and beneficial for a wider research community. We bring together individuals from diverse fields and expertise to develop practices and learning resources that can make data research comprehensible and useful for everyone, as well as translate these tools and ways of working across cultural and disciplinary contexts. These resources are organised as an online book with over 250 chapters across five guides on reproducibility, project design, collaboration, communication and ethics in research. This talk will introduce The Turing Way project, and invite participants to get involved. All questions, comments, recommendations, and discussions are facilitated through an online GitHub repository.

The Turing Way is an open-source, community-led, and collaboratively developed project on making data science and research skills accessible, comprehensible, and beneficial for a wider research community. We bring together individuals from diverse fields and expertise to develop practices and learning resources that can make data research comprehensible and useful for everyone, as well as translate these tools and ways of working across cultural and disciplinary contexts. These resources are organised as an online book with over 250 chapters across five guides on reproducibility, project design, collaboration, communication and ethics in research.

This talk will introduce The Turing Way project, how it has evolved over time, and invite participants to get involved. All questions, comments, recommendations, and discussions are facilitated through an online GitHub repository.

Deploying to "the cloud" is incredibly convenient, but that convenience normally comes at a cost. The host necessarily becomes a major part of the applications trust domain, and a compromised host means a compromised application or a network of thereof. This prevents several highly-regulated sectors, such as medical or financial, from directly deploying to "the cloud" as opposed to building their own infrastructure. Solutions to this problem exist, but most require a custom and correct implementation tied to a particular hardware vendor and SDK. I will present a hardware-agnostic and cloud provider-agnostic solution to this issue, which, with minimal changes to the implementation, can be used to secure a network of applications and demonstrate strong trust assertions produced by doing so.

The broadcast industry are getting more and more interested in sub second media ingestion and media delivery but already have particular standards integrated into their workflows such as SRT or NDI - bridging the gap between WebRTC and these protocols and technologies is ever more important to increase the continued adoption of WebRTC - both WHIP and WHEP play a vital part in this increased adoption. In this session we'll take a look at what the broadcast industry have available to them today and the challenges involved in merging these worlds with Open Source technology.

• summary of common C library calls to translate name to IP address(es) and back
• We have getaddrinfo() calls and nsswitch modules for different name resolution backends. But they provide blocking only calls.
• BSD sockets allows hundreds or thousands concurrent connections from a single thread application. But resolving 4 different names in parallel is difficult from a single thread application.
• When we have common GUI application loops for GLib or Qt, why we lack API integrating with them well?
• Most of GUI applications should avoid blocking calls in main thread today.
• Is it necessary to block on name resolution? How name resolution works and why I think asynchronous calls would work as well.
• Why using just raw DNS libraries might not be a solution for everyone
• Use .local zone plugin nss-mdns as example why a simple to use API for name resolution is needed not only for unicast DNS queries.
• How to handle LLMNR protocol and not break other things, which happens with current systemd-resolved

LibreOffice now supports dark mode on its major ports. Apple and Microsoft effectively omitted to support dark mode in the various APIs LibreOffice was using to render its widgets, making this surprisingly difficult to implement.

This talk is about my personal story and experiences around energy use cases at home, which I have mainly realized with the smart home software openHAB. It starts with energy monitoring of the smart home from electricity to heating and room temperatures and goes on to tracking a photovoltaic system and managing its surplus production, e.g. for charging an electric vehicle.

Besides the technical use-cases, we will also have a look at environmental impact and the potential cost savings.

MLIR allows you to define your own intermediate representation (IR) while benefiting from the infrastructure it provides. However, getting started with creating your own IR, called dialect in the MLIR universe, is sometimes tricky. This tutorial addresses some of the challenges arising with the CMake configuration and explores projects like the standalone MLIR dialect example in more detail. Furthermore, we take a look at how TableGen files that define a single dialect can be split.

Even with tutorials on MLIR like the MLIR tutorial presented at the LLVM Developers' Meeting in 2020 [1] and the "Creating a Dialect" [2] as well as the Toy tutorial [3] in the MLIR docs, building an MLIR dialect can feel difficult. This can be especially the case when it comes to the CMake configuration. Good starting points are the standalone MLIR dialect example [4] and especially the tutorial [5] given by S. Neuendorffer at last years LLVM Developers' Meeting.

In addition to the existing tutorials, we will look into the details of the CMake configuration of an out-of-tree dialect like [4]. Furthermore, we dive into more complex CMake configurations for projects like MLIR-EmitC [6], showing how to build a project standalone or embedded into another project. In addition to the CMake configuration, it is briefly covered how to architecture TableGen files. In particular, it is shown how to use multiple TableGen files to define a single dialect, e.g. to define the base dialect, operations, attributes and types.

[1] M. Amini & R. Riddle "MLIR Tutorial", 2020 LLVM Developers' Meeting, https://youtu.be/Y4SvqTtOIDk
[2] https://mlir.llvm.org/docs/Tutorials/CreatingADialect/
[3] https://mlir.llvm.org/docs/Tutorials/Toy/
[4] https://github.com/llvm/llvm-project/tree/main/mlir/examples/standalone
[5] S. Neuendorffer, "Architecting out-of-tree LLVM projects using cmake", 2021 LLVM Developers' Meeting, https://youtu.be/7wOU7csj1ME
[6] https://github.com/iml130/mlir-emitc

Squashfs images provides a read-only compressed filesystem. OCI content delivered in squashfs format provide several benefits when compared to tar. Images do not need to be extracted before being used. Images can be verified by their content-addressed names against signed OCI metadata before use, and dmverity will ensure the integrity of the contents themselves. This makes for very fast yet verified storage bringup. Overlay provides the ability to give writable access and take advantage of OCI’s layered images. I’ll show how users can build (stacker), host (zot) and run squashfs images (LXC) with available opensource software.

The really easy stuff is mostly done. This talk is about several improvements to LibreOffice which required lots of prep work and interesting challenges to get improvements in a very large and messy codebase.

Sorting is one of the most common algorithms used in programming, and virtually every standard library contains a routine for it. Despite also being one of the oldest problems out there, surprisingly large improvements are still being found. Some of these are fundamental novelties, and others are optimizations matching the changing performance landscape in modern hardware.

In this talk we present Glidesort, a general purpose in-memory stable comparison sort. It is fully adaptive to both pre-sorted runs in the data similar to Timsort, and low-cardinality inputs similar to Pattern-defeating Quicksort, making it to our knowledge the first practical stable sorting algorithm fully adaptive in both measures. Glidesort achieves a 3x speedup over a Rust’s standard library Timsort routine on sorting random 32-bit integers, with the speedup breaking the order of magnitude barrier for realistic low-cardinality distributions. It achieves this without the use of SIMD, processor-specific intrinsics or assumptions about the type being sorted: it is a fully generic sort taking an arbitrary comparison operator.

Using Glidesort as the motivating example we discuss the principles of efficient stable in-memory partitioning and merging on modern hardware. In particular attention is paid to eliminating branches and interleaving independent parallel loops to efficiently use our modern deeply-pipelined superscalar processors. The lessons learned here are widely applicable to efficient data processing outside of sorting.

We also go into more detail on the various intricacies that Glidesort has to overcome in our Rust implementation. In particular how to deal with splitting and concatenating slices in a safe manner using GhostCell-style branding, the problems faced when dealing with panics in the comparison operator, and potential issues with interior mutability in comparison operators.

In a continuously changing IT world, not being able to adapt is the difference between yesterday's and tomorrow’s projects. Everybody wants the benefits of changes but nobody wants to endorse its associated risk. I’ll share why we created Updatecli, an open-source declarative dependency manager. How automation helps us to anticipate, and fix early, our day-to-day challenges, and where the traps lie.

Looking back at 4 years of Open research tools and technologies devroom, we propose an open discussion on what's been done and what's to do. The panel will be held by the devroom organisers and will present a brief wrap-up of the 2023 edition, before opening the floor to the attendance. We are looking for feedback regarding the event itself, and inputs about its part in the community. Where are we, and where should we go from here?

At Scaleway, we built a large-scale PXE-based imaging infrastructure to manage the fleet of machines that power our various storage services. Using this infrastructure, we can reliably deploy new machines—and reconfigure existing ones—in predictable ways. In this talk, we will explain the problems we had to solve, how we reasoned through these issues, and what we built to solve the problems. Improved reliability, decreased time to production, increased stability, and all of this without sacrificing usability or end-user experience.

At the outset of the project, the existing fleet deployment and management systems—which had grown organically over the previous years—were in need of an upgrade. We embarked on a new initiative with an aim to reduce the time to deployment, increase the reliability of those deployments, and improve the maintainability of the management infrastructure as a whole. Leveraging PXE, Ansible, chroot, DHCP, and a clean monorepo backend, we were ultimately able to scale the number of managed machines by orders of magnitude—without linearly scaling the time or resource commitments for the sysadmins. In this talk, we’ll look at architectures, code examples, decision trees, challenges, and solutions. At the end of the session, the audience will have a better understanding of not only the technologies involved, but also the business cases behind those choices.

At NLnet Labs, we worked on creating an API and prototype implementation for 'connectbyname', library function that takes as input a (DNS) name and returns a TLS connection. The idea is to work towards a standard API for such a function, that can internally use asynchronous DNS lookups, implement Happy Eyeballs, support DANE, SVCB/HTTPS, encrypted client hello, etc. I will present the various prototype implementation we created.

During this work we found that supporting the many new DNS connection types (DNS over TLS, DNS over HTTPS, DNS over QUIC) from within a library is creating a nu mber of problems. To deal with this problem, we created a new EDNS(0) option called Proxy Control option, that allows stub resolvers to send requirements to a local proxy. I will present this option and how it can help to keep DNS stub resolvers simple.

In the talk, Pranam will explain and demonstrate how feature locking and restrictions work in Online. Using such methods integrators can control which features to deliver to which user or group.

Guile has a new garbage collector coming! The Whippet collector improve throughput and scalability of Guile programs, and is built in such a way that it can be swapped into most any language runtime that uses that BDW-GC. With minimal adaptations in user code, you get a collector that's competitive with the industry-standard Boehm-Demers-Weiser conservative collector, but which scales better for multiple allocation threads. As incremental changes are made in Guile to integrate Whippet, we will also gain the ability to compact the heap, even while keeping conservative scanning of the C stack. This talk presents the structure of whippet and some performance numbers for how it improves Guile program behavior.

The Whippet garbage collector provides an abstract interface that user programs (like Guile) can use to allocate memory, and also provides a number of collectors that implement that API. One of them is the BDW-GC collector: this will be the first step in Guile's switch to Whippet, to change to use the Whippet API but keep the same GC implementation. Compile-time flags choose the collector implementation, and in the next step, Guile will switch over to Whippet's main collector, an Immix-derived mark-region collector. This collector has a few modes, including a heap-conservative mode that mimics BDW-GC, as well as a stack-conservative mode that allows evacuation and compaction of objects that aren't referenced by conservative roots.

The talk will include a quick overview of Immix-style collectors, for context.

Whippet scales: it has been carefully designed to avoid contention during allocation, and avoid locking except during collection. Collection is optionally parallel and optionally generational. We'll examine the performance and practical impacts of these choices, in synthetic test harnesses and in real Guile programs.

Whippet is designed to be included into a user's C source code, as it needs compile-time configuration. The talk will show examples of the size of the collector and its memory efficiency when compared to BDW-GC and to a semispace collector.

Do you wanna add an extra layer of data protection to your Kubernetes workloads? In this talk, we introduce the open-source project Marblerun and discuss the challenges that arise when you deploy confidential computing-enabled workloads on K8s.

Please note that this talk was cancelled. The aim of this session is to discuss about Container Storage Interface (CSI), its specification and details on additional advanced operations provided by CSI-Addons. CSI specification defines an interface along with the minimum operational and packaging recommendations for a storage provider (SP) to implement a CSI compatible plugin. The interface declares the APIs that a plugin MUST expose: this is the primary focus of the CSI specification. The CSI-Addons project hosts extensions to the CSI specification to provide advanced storage operations. By adding new procedures to the CSI-Addons Specification, additional operations for storage systems can be provided. The reference implementation is done on Kubernetes, and maintained in the Kubernetes CSI-Addons repository. Some of the advanced storage operations that are currently supported are reclaim space, network fence, volume replication and encryption key rotation.

The presentation will cover the following outline: 1. Introduction to Container Storage Interface (CSI) - The Container Storage Interface (CSI) aims to enable Storage Providers to write one CSI compliant Plugin that “just works” across all Container Orchestrators (CO) that implement CSI. 2. Architecture & Terminologies - The primary focus of CSI specification is on the protocol between a CO and a Plugin. It SHOULD be possible to ship cross-CO compatible Plugins for a variety of deployment architectures. In this section, we will be discussing in-depth, the architecture of CSI-Specification and related terminologies. 3. All about CSI-Addons - The CSI-Addons project hosts extensions to the CSI specification that provide advanced storage operations. We will be discussing various aspects of the CSI-addons project further in our talk. 4. Working and Demonstration of Advanced storage operations provided by CSI-Addons: i. Reclaim Space: The Reclaim Space specification defines an extension to the CSI Specification that will enable Storage Providers (SP) to develop controllers/plugins that can free unused storage allocations from existing volumes. ii. Network Fence: The Network Fencing specification provides a mechanism that Storage Providers can implement to network-fence any client using corresponding CIDR (Classes Inter-Domain Routing) blocks. iii. Volume Replication: The Volume Replication specification provides a mechanism that Storage Providers can implement to support async-replication which can be used for disaster recovery operations. iv. Encryption key rotation: The Encryption Key Rotation specification provides a mechanism that Storage Providers can implement to rotate keys for encrypted volumes.

Many people miss event-driven architecture benefits because they believe it is complex and challenging to implement. In this talk, I will show you how my Watermill library can help you to build a basic event-driven application in Go in 20 minutes.

In this talk, I will show that building a basic event-driven application is not that scary with the open-source Watermill library (that I'm the author of). As part of this presentation, I will do live coding so you can see that building an event-driven application may be as straightforward as building an HTTP server. I will briefly overview event-driven architecture (EDA) and why it is a valuable tool for building scalable, resilient applications.

As open source network switching gathers momentum there is significant work being done to upstream support for network switch devices in the Linux kernel. The DENT project is an open source network operating system utilizing the Linux kernel, switchdev, and other Linux-based projects, hosted under the Linux Foundation. This talk will present case studies of driver development for platforms supported by the DENT project — the ONIE NVMEM driver and the switch BSP driver.

The challenge is to setup a live chatbot in 20 minutes, using exclusively Tock (https://doc.tock.ai) - the open conversational AI platform written in/for Kotlin.

The chatbot should implement, at least: - skills: Kotlin and no-code - multichannel capabilities - basic Web frontend - analytics

Bonus challenge: run the chatbot on a bare laptop, offline.

Story of an interoperability bug fixing adventure where the problem turned out to be deeper than it appeared at first glance. Showcasing how there are multiple approaches to a single interoperability problem. And the why, when and how of coming up with alternative solutions to already existing ones.

Scaling your object store is complex and payloads vary in size - objects can be as large as virtual machine images or as small as emails. In behaviour - some are mostly reading, writing, and listing objects. Other payloads delete objects, and some keep them forever. Using CPU and RAM to autoscale the pods horizontally or vertically is limited and may adversely affect the system. Treating our object store as a queueing system: converting HTTP requests to actions on disks may be the solution! Please note that this session was originally scheduled for 18:30.

In this talk, we would show how we use KEDA and Prometheus to track the backlog of work in an object store system orchestrated by Rook and to autoscale the object store pods based on different metrics. We show how autoscaling is impacting the performance and resource utilization in the environment by taking Ceph’s object store frontend (the RADOS Gateway daemon) as a use case. We will demonstrate how to use KEDA and Prometheus to solve a scaling problem that cannot be quickly resolved by the traditional HPA (horizontal pod autoscaling). We will show how the Rook operator orchestrates the different parts of the system. Attendees will learn how to use cloud-native tools to perform autoscaling, better utilize resources like CPU and I/O and increase the performance of their solutions.

Digital technology is a major contributor to environmental harm, whether it is the 'tsunami' of e-waste filling landfills or the CO2 emissions on a par with the aviation industry.

Oft overlooked is that software plays a crucial role. For instance, software bloat means less powerful hardware may stop working and end up as toxic waste in landfills, while new devices are manufactured unnecessarily -- the production of which often costs more energy than usage over their operating life. Moreover, software bloat also entails that the software will have higher energy demands and pump more greenhouse gases into the atmosphere -- in order to achieve the same result. Digital sustainability is, in many ways, a question of software.

The Blue Angel ecolabel, the official environmental label of the German government, began certifying software in 2020. In the award criteria, sustainability is closely linked with transparency and user autonomy. This connection has been one of the motivations behind the KDE Eco initiative since its beginning in 2021. In this talk I will present the environmental harm driven by software, with a focus on energy consumption. I will link the values of Free and Open Source software to sustainable software design. Finally, I will provide an overview of the work of the KDE Eco project and the new sustainability goals of KDE.

Animation creation pipelines have been largely dominated by proprietary software for ages. Fortunately, for a few years, we assist a shift largely led by Blender on both 2D and 3D animation productions. We'll see in this presentation the main steps needed to build an animation movie (in 2D and 3D), and what it requires in terms of asset and project management. Parallelly, we will see for each aspect what tools can be used and when open-source solutions can be used fully.

We'll first see how Blender covers all the main aspects of a 3D animation movie and how it can be used to achieve 2D animation with Grease Pencil. We'll include Krita in the talk to show that it can be used too to make backgrounds or textures. Then, we'll discuss how OpenPype and Kitsu can be used to cover the asset management aspect (files) and the project management aspect (tasks and deliveries). Finally, we'll talk about the compositing step with Natron. To finish, we'll mention some studios and productions that use Blender on a daily basis to make their movies.

Enabling third parties to integrate with your core application requires far more than allowing the use of the same API that your front-end already consumes. Access control and cross-domain requests are usually the first spots where problems appear. Based on the experience of integrating OpenProject with Nextcloud we cover the most typical road blocks that product developers should remove.

2023 is different: Like never before publicly funded initiatives strive for replacing big tech’s data hungry cloud services with open-source products. Development teams are busy improving the cross product user experience by developing integrations and hit the same obstacles again and again. This talk tries to create awareness for typical integration developer needs.

The CrowdSec project aims at providing a crowdsourced approach to common infrastructure defense problems by distributing free & open-source software allowing you to protect yourself and share information about malevolent actors.

In this Presentation, we will:

• Learn about CrowdSec project
• Learn how to install CrowdSec in Kubernetes
• Learn how you can detect and block attacks in your applications deployed in k8s

CrowdSec could be perceived as a modern form of Fail2ban, though for Cloud and container-based infrastructure as well, and capable of taking way more advanced decisions a lot faster. Mainly, it’s using a decoupled and distributed approach (detect here, remedy there) and an inference engine that leverages leaky buckets, YAML & Grok patterns to identify aggressive behaviors. It acquires signals from various data sources like files, syslogd, journald, AWS Cloudwatch and Kinesis, Docker logs, and Windows Event Log, normalizes them, enriches them to apply heuristics and triggers a bouncer to deal with the threat if need be. Since it’s written in Go, it’s compatible with almost any environment, fast in execution, and resource-conservative.

The endgame is the Reputation engine, though. If you want to partake in the network to benefit from its findings, CrowdSec captures all aggression signals (timestamp, IP, behavior) and sends them for curation. That way, it establishes a reliable IP blacklist that is constantly redistributed to the network members to achieve a form of Digital Herd Immunity. An IP caught aggressing WordPress sites will quickly be banned by all members using CrowdSec that subscribed to the WordPress defense collection. In that way, we share the IPs that are relevant to your technical context.

While Crowdsec is in charge of the detection, the reaction is performed by "bouncers" that aim to be deployable at any level of the applicative / infrastructure stack :

• via nftables/iptables/pf based on an IP set
• via Nginx lua plugin
• via Traefik middleware
• on Cloudflare via our bouncer that integrates with Cloudflare API
• Or GCP/AWS/Azure firewall, slack or scripting, notifications, etc.

.. or in many other ways. Over time the possibilities will increase as the application design basically supports anything.

This approach, combined with a declarative configuration and a stateless behavior, will make it an ideal candidate to enhance the security of modern stacks (containers, Kubernetes, serverless, and more generally automatically deployed infrastructures).

Furthermore, we intend to create and share the most accurate database of malevolent actors possible in the form of a real-time IP reputation system accessible through API. Whenever an attack is locally blocked/detected by Crowdsec, the "meta" information of the attack is shared amongst participants (source IP, date, and triggered scenario) for redistribution to network members.

We are committed to building a strong community with all that it implies : * a public hub to find, share and amend parsers, scenarios, and blockers * permissive open-source license to stay business-friendly * and overall a strong commitment to transparency and community-first mentality by tooling and behavior

The microservice architecture is the most significant security challenge in a Kubernetes cluster. Every application you deploy opens a new potential entry for attackers, increasing the attack surface. In this talk, we'll present the Crowdsec project and see how we can protect a Kubernetes cluster using Crowdsec and the power of the Crowd.

Operating Kubernetes clusters has never been easy. Managing the cluster lifecycle includes multiple aspects, starting from provisioning the underlying infrastructure to upgrading it. There is a possibility that the fleet of clusters will grow and potentially spread across multiple environments. How to keep all clusters under control? What if we use Kubernetes API for simplifying these tasks? Kubernetes is able to manage our container workloads, but it turns out it can also be extended to manage the lifecycle of multiple clusters. In this presentation, we will go over the fundamentals of cluster lifecycle management and how the Cluster API can help. We will do a deep dive into Cluster API building blocks and see a live demo of provisioning and upgrading clusters on various infrastructure providers. 

Europe’s new rulebook to ensure safe, ethical and transparent online spaces, the Digital Services Act (DSA), entered into force on November 16th. In a few months, this regulation will apply to a range of digital services operating in the EU, from intermediary and hosting services to social media platforms and search engines. The DSA will require big changes from the biggest players in social media and search (those with over 45 million ‘active monthly users’ in the EU); content moderation capacities, data access transparency tools and annual audits will now be mandated and governed. This groundbreaking text is the first of its kind, and has already inspired both legislation and voluntary corporate practices around the world.

This lighting talk will speed through the major implications of the DSA and the changes big tech is likely to roll out in response.

On October 27, the Digital Services Act was published in the Official Journal of the EU, culminating years of legislative and advocacy effort. The regulation will impose a sweeping new regime imposing transparency and accountability requirements on digital services operating in the EU. The DSA is asymmetric in structure, with the largest obligations falling to the largest platforms and search engines - those with a systemic role in society.

Specifically, these big players will need to - improve content moderation capacity and reporting mechanisms - provide access to data for vetted researchers - assess and mitigate their systemic risks - have annual third party audits - abide by relevant codes of conduct - ban targeted advertising on online platforms by profiling children or based on special categories of personal data such as ethnicity, political views or sexual orientation - provide a recommender system not based on user profiling (under the GDPR definition) - refrain from ‘dark patterns' on their interfaces

Against the backdrop of Elon Musk’s acquisition of Twitter and Meta’s gutting of its transparency tool Crowdtangle, the DSA is the EU’s promise to reset a big tech ecosystem.

All are welcome for a facilitated group conversation about the impact of AI in software freedom legal and policy issues. We will be looking to cover issues related to ethics and licensing and shape the conversation around the participation of attendees in the room. Do feel free to submit thoughts or questions in advance of the panel to fosdem-legal@faif.us and we will do our best to include those submissions in the discussion.

Moving to Kubernetes opens the door to a world of possibilities, but as the number of resources, clusters and namespaces grows, it becomes increasingly difficult to manage.

We will show how at Adobe Experience Manager we continuously deliver changes to cluster resources and have implemented a way of doing feature flags and progressive rollouts with Kubernetes yaml definitions, across multiple clusters and regions using Jenkins, ArgoCD, and other open source projects.

Running a cloud service in multiple Kubernetes clusters across regions, forced us to have high levels of automation, tied with monitoring and alerting across the globe. The typical release train model (dev-stage-production) had shortcomings that soon became evident. Adopting Progressive Delivery allows us to move faster, safer, and reduce the mean time to recovery in case there are any issues. Both canary deployments and feature flags are typically used to implement Progressive Delivery at both application and operational service levels.

Teams collaborate with a DevOps philosophy and a "you build it, you run it" approach, with freedom, but also requiring tooling to help teams deliver value with the least interference as possible. We are continuously improving this tooling to make it as easy as possible to safely deploy changes.

Passbolt is an open source password manager designed for collaboration and built on top of OpenPGP. In this presentation we will give a quick overview of the product functionalities, the security model and review the differences with other existing password managers. We'll have a high level look at the code architecture as well as our methodology and tooling for developing and testing the product. Finally we will touch based on the latest feature development and the roadmap for 2023 and beyond.

As an embedded software engineer, I'm used to be at the border between software and hardware. However, for many years I delegated everything more complex than finding a GPIO number to a dedicated hardware team.

Now working as a freelance engineer, I've decided to get over the barrier, to be more independent. In this talk, I'll share my journey to the hardware world, from simple hardware designing and routing using free software to more complex design review.

As a big difference between hardware and software is the required equipment, I will also go through the equipment I had to buy and how I use it.

I hope to convey the message that while hardware is a vast world, it is a real advantage for the software engineer to get familiar with a few basic tools of our hardware colleagues.

PARCOACH is a static and dynamic analysis tool for High Performance Computing applications (using MPI and OpenMP for instance), based on LLVM. Its main purpose is to check that the APIs usage are correct (for instance that all processus or threads call a barrier to avoid a deadlock). It's not always possible to detect all errors statically, therefore the static analysis can be complemented by a dynamic instrumentation of the code to perform some correctness checks during the code execution.

This (out-of-tree) tool has been initially written based on LLVM 3.7, and is now based on LLVM 15. As a research project, it has seen a lot of contributions: from PhD students, from interns, and from researchers; with actually a low number of LLVM-specific engineers working on it until recently. The objective of the talk would be to focus on how the project has been using LLVM over the years (and how it's been maintained): - how the lack of maintainance had lead to a relatively high technical dept. - how LLVM tools and structure had been used: from a manual compilation of the code to "properly" using LLVM's CMake integration, from analysis code tangled in the transformation code to properly using the "new" analysis and passes manager. - how the CI/CD evolved to improve the user experience (eg: docker-based jobs, automated images and packages generation, docker-compose entry point). - the weaknesses remaining in the project (as far as LLVM is concerned), where they come from, and the plan to fix them. - and obviously take a look at some mistakes that have been done (trying to maintain compatibility with several LLVM versions at once just to name one).

While the content of the talk would not be "new" from a scientific point of view, we believe it would provide some interesting take-aways for people looking into developing or maintaining out-of-tree LLVM-based software.

LibreOffice was capable of handling form filling in Writer for a while already. In the meantime, the competition introduced Structured Document Tags, which is their default since 2007, and our fields and form shapes model them poorly. Writer Content Controls are meant to perform a great handling of this third type of form filling. Some recent developments also happened in this are in the past half year: PDF export, combo boxes, titles and aliases. Come and see how this now starts to work in Writer, what still needs doing and how you can help.

Since 2010, the Software Sustainability Institute (SSI) has facilitated the advancement of software in research by cultivating better, more sustainable, research software to enable world-class research (“Better software, better research”). To achieve this, the SSI has engaged a community of researchers; Research Software Engineers and developers; instructors and trainers that deliver research software training; research policymakers; and groups that provide services that support research software development. We will present an overview of the Institute’s main activities to engage the research software community, such as the Fellowship Programme, annual Collaborations Workshop, and Research Software Camps, and how you can get involved. We will also talk about resources that we have made available (e.g. the SSI Event Organisation Guide and other templates) that people are free to adapt and use to ease their own organisation of activities.

Expected prior knowledge / intended audience: No prior knowledge is required for this talk. The intended audience includes all developers and users of open tools and technologies used in a research/investigation context who are interested in joining and collaborating within an inspiring and supportive research software community.

Pydantic is a data validation library for Python that has seen massive adoption over the last few years - it is estimated that Pydantic is now used by about 10% of professional web developers!

Over the last year I've been working full time to rebuild Pydantic from the ground up, using Rust for virtually all the validation and serialization logic. Pydantic V2, with these changes included, will be released early in 2023.

In this talk I will give a brief introduction to Pydantic V2 before diving into how the use of Rust has allowed us to completely change the architecture of Pydantic to make it easier to extend and maintain while also improving performance significantly.

The majority of the talk will be devoted to using examples from the pydantic V2 code base (rust and python) to demonstrate the advantages (and disadvantages) of writing libraries like Pydantic in Rust.

This talk should be interesting to any Rust or Python developer who's interested in combining the two languages - no knowledge of Python or Pydantic is required. However if you'd like to get some context or learn more about the topics discussed, here are some useful resources:

• Pydantic V2 Plan - blog post about the plan for Pydantic V2
• pydantic-core - the python package that provides Rust logic in pydantic
• PyO3 docs - the amazing library that allows Rust to be embedded in Python
• Build your Python Extensions with Rust! by Paul Ganssle - good intro to building Python extensions in Rust

A presentation about fixing a seemingly small bug, that becomes more complex, as the bug was planned part of a feature, because of the difference between writer's, and word's multi-column footnote capability.

In this short tutorial you will learn how to remotely connect to embedded Linux devices running Wayland and Weston using Remote Desktop Protocol (RDP) on GNU/Linux distributions built with the Yocto Project and OpenEmbedded. Exact getting started steps will be provided. We will discuss the advantages and the disadvantages of RDP as well as some troubleshooting guidelines.

Wayland is an open source display server protocol aiming to replace X11 on Linux devices with a modern and secure windowing system. As of today most of the popular desktop Linux distributions, including Ubuntu, Debian, Fedora, support Wayland out of the box. Wayland is also widely used on embedded devices and it is supported by hardware running Automotive Grade Linux (AGL), COVESA (previously GENIVI), WebOS, Tizen, postmarketOS, Jolla, etc.

There are many compositors compatible with Wayland. Weston is a simple reference compositor. Remote Desktop Protocol (RDP) is a proprietary network protocol with graphical user interface for connecting to other computers developed by Microsoft. It works on Weston with the screen-share.so plugin.

This lightning talk will provide the exact steps how to build from scratch core-image-weston, setup RDP and remotely accesss the embedded device using wlfreerdp (for Wayland) or xfreerdp (for X11) from a personal computer with GNU/Linux distribution in the same network. The examples will be based on the long-term support release kirkstone of the Yocto Project.

The talk is appropriate for anyone interested in remote access to embedded Linux devices. Previous experience is not required.

iothnamed is a DNS server/forwarder/cache for the Internet of Threads supporting hash based IPv6 addresses and OTIP, i.e. one time IP.

Hash based IPv6 addresses: The host part of an IPv6 address can be computed as the result of a hash function computer on the fully qualified domain name. This eases the life of system administrators dealing with IPv6 networks.

One Time IP: OTIP means that the current IP address of a server changes periodically to prevent networking attacks. This method has mainly been designed for IPv6 networks.

Hash Based IPv6 address: The configuration of an IPv6 network is a rather daunting and error-prone procedure for system administrators. Each node must be provided with its own (128 bit long) IPv6 address and with a domain name manageable by human beings. Autoconfiguration methods can give addresses to interfaces but do not provide any means of configuring the DNS. So autoconfiguration is suitable for clients. If a host has to act as a server, it must have a fully qualified domain name and the DNS service has to map its name to its IP address. In the Internet of Thread scenario, the number of network nodes can be orders of magnitude higher than before, as each process or thread can be a node. This idea of hash based IPv6 addresses is a viable solution to the problem to manage the DNS resolution in IoTh environments.

One Time IP: Hosting servers use a finite number of IP addresses to connect on the net. Attackers can collect those by wiretapping the network and create a catalog of valid addresses and services in order to attack the servers. OTIP can prevent these attacks, or make them harder to succeed as the addresses collected by network sniffers expire in a short time. OTIP aims to provide one further layer of protection for private services.

Pandemics and wars have woken up countries and companies to the strategic vulnerabilities in their infrastructure dependencies, with digital sovereignty now being a top concern, especially in Europe.

In this short talk, Thierry Carrez, the General Manager for the Open Infrastructure Foundation, will explore the critical role that open source has to play in general in enabling digital sovereignty. In particular, he will explore how Open Infrastructure (open source solutions for providing infrastructure), with its interoperability, transparency and independence properties, is essential to to reach data and computing sovereignty.

Zig is a minimalistic new language that is unapologetically focused on performance, tellingly with a blazingly fast compiler. It is advertised as a replacement for Thompson, Ritchie, and Kernighan's C, but it may even replace C++ in places. Zig uses the C-ABI and does not do garbage collection, so it is ideal for binding against other languages, such as C, Python, Ruby etc. In this talk I will present combining GNU Guile with zig. I'll argue that everyone needs two languages: one for performance and one for quick coding. With Zig and Guile you can use both at the same time and you won't have to fight the Rust borrow checker either.

Zig is a minimalistic new language that is unapologetically focused on performance. In this talk I'll present binding Zig and Guile.

Please note that this talk was originally scheduled to be given at 15:55. The talk originally in this slot, "Zig and Guile for fast code and a REPL" by Pjotrs Prins will now take place at 16:55.

Control groups (or cgroups for short) are one of the most fundamental technologies underpinning our modern love of containerisation and resource control. Back in 2016, we released a complete overhaul of how cgroups work internally: cgroup v2, released with Linux 4.5. This brought many new and exciting possibilities to increase system stability and throughput, but with those possibilities have also come challenges of a type which we have largely not faced in Linux before.

This talk will go into some of the challenges faced in overhauling Linux's resource isolation and control capabilities, and how we've gone about fixing them. This will include some of the most complex and counter-intuitive practical effects we've seen in production, with details of how our expectations and knowledge have developed over the last 5 years using this on over a million machines in production, with insights that are immediately applicable to anyone who runs Linux at scale.

We will also go over the state-of-the-art of resource control in the "real world" outside of companies like Meta and Google, looking at how cgroup v2 is changing the technical landscape for distributions and containerisation technologies for the better.

CI/CD the GitOps way, involves automatically shipping your code from your local machine to the intended server, it could be a UAT or production environment. This is usually achieved through toolsets like source control provider (Gitlab/GitHub), CI tool (Jenkins/Github Action), Kubernetes Orchestrators among others. FluxCD is an Open-source tool that recently joined CNCF family. FluxCD treats Git as the source of truth and ensures desired synchronisation is done with the intended cluster. These is achieved through a set of cluster Operators that ensures git commits are automatically deployed to the cluster.

GitOps using flux not only automate the deployments but also integrates with a vast set of Open-source tools to ensure, cluster-wide and deployment Policies, enhanced Security, Visibility, and notification among others. It's architecture caters for velocity and Multi - Environment/teams and application deployments without compromising Privacy through Isolation.

FluxCD also facilitates cluster infrastructure management the GitOps way, infrastructure like service meshes, CNI, and any other Kubernetes CRDs can be managed using FluxCD.

The Research Software Engineering (RSE) Asia Association started as a project in Cohort 4 of the Open Life Science Programme in the year 2021. Since its launch, the RSE Asia Association has been deeply influenced by the Open Science principles. In this talk, we highlight how the Open Life Science programme helped us shape the RSE Asia Association and the benefits we derived by building a community based on Open Science principles. We will also highlight the journey and future plans of the RSE Asia Association.

If you are a Gopher, the mention of the term Object-Oriented Programming is likely triggering for you because Object Oriented represents everything that Gophers love to hate, from over-complicated design to unpredictable execution. But could Go be in fact OO? Experienced or new to Go, this talk is aimed to help you understand where Go fits within the realm of programming languages. Ronna will take you on a journey through the history of OO and the choices that were made when designing Go so that you can decide for yourself if Go is or isn't OO.

In early 2023, the European Commission will publish its proposal for a regulation on Standard-Essential Patents (SEPs) to address issues of legal uncertainty, the vulnerability of SMEs, and transaction costs. This regulation could bring some peace of mind, or it could make matters worse. While software patents are not enforced by courts in Europe, the European patent offices continue to grant software patents. And with the Unified Patent Court (UPC) possibly coming in 2023, European software developers are not safe from patent uncertainty.

In this presentation we will outline the European Commission's motivations, the input they're working from and the solutions they're considering. The Commission mentions FRAND licensing terms among the solutions, but, is it thinking of a type of FRAND licensing that truly doesn't discriminate against free software? We will discuss definitions for FRAND which could give real protections for free software and we will look into precedents which could be used as a basis for protecting the use, development and distribution of software against patents. Since the Commission's preparatory documents state "legal certainty" as one of the main objectives for this regulation, and knowing that software developers would like to be free from the current legal uncertainty around patents, we might be able to find a basis for agreement on a solution. If the EU institutions are serious about being fair, reasonable and non-discriminatory, and if they're serious about standards and interoperability, this could be our chance to get a regulation which ensures that patents never block free software from abiding by standards.

This regulation will affect a large number of fields, including many fields where innovation is measured in how many patents were obtained this year. Software risks being collateral damage in a bigger tug-o-war between industrial sectors.

Ciarán O'Riordan, Senior Policy Advisor, OpenForum Europe

Panos Alevropoulos, Administrator, End Software Patents

Over the last few years, the idea of a carbon aware, fossil free internet by 2030, has become more than just interesting idea, and instead something that is socially and economically plausible, as well as desirable and inline with the latest climate science.

In this talk we’ll cover some of the key drivers to make this possible, and what key policy changes can accelerate our transition from fossil fuels in the technology sector.

We’ll cover some of the most promising ideas from the Internet Architecture Board’s recent workshops to explore how to reduce global ICT emissions inline with the science around staying within 1.5 degrees of warming. We'll give an overview of how new open source software like Ecovisors can do for on-site power what hypervisors have done for virtualisation of computing, how carbon-aware Computing schedulers and carbon aware networking routers can lead to an internet that can complement a shift to a grid powered by more variable renewable sources of energy, and we will also cover how a shift to hourly carbon accounting for electricity with new standards like Energy Tag’s Granular Certificates can cut through existing greenwash.

Finally we'll talk about some of the the regulatory drivers on the horizon can help technologists argue for more ambitious climate action, from the European Corporate Social Responsibility Directive to recent changes in international accounting standards from the IFRS (international financial reporting standards) Foundation.

Participants will leave with a good grounding of the progress made in the Greening of IT, the challenges facing us for the rest of the decade, and better idea of their role in the coming energy transition, particularly in the tech sector.

Gathering feedback, discussing Weblate plans, features, bugs, collaboration within the community, and anything Weblate. Everybody is welcome! Michal Čihař, Weblate founder and Benjamin Jamie, Community Manager will attend

FOSS powers the digital world we live in, but ensuring the long-term sustainability of the software and community can be challenging. In this talk, we will explore sustainable open source from three key perspectives: community, financial, and engineering practices.

All three perspectives — community, financial and engineering practices — are vital for long-term sustainability of free and open source software projects. Abby will share insights and case studies on how well-crafted processes in each area can create a strong foundation for future success. She will draw on her experience as a maintainer of key open science projects, as well as a mentor and supporter to over 700 open source projects in GitHub's Top Maintainer program, UNICEF Venture Funds, and Mozilla Open Leaders. She will also discuss practical strategies for building effective open-source ecosystems, and ways to ensure the longevity of projects.

The audience will leave with a better understanding of the importance of investing in sustainable open source practices, with tangible strategies for creating and sustaining successful projects. Join us for an engaging discussion on how to build a strong foundation for the future of free and open source software!

Gramine (formerly called "Graphene") is a lightweight library OS, designed to run a single Linux application in an isolated environment. Currently, Gramine runs on Linux and Intel SGX enclaves on Linux platforms. With Intel SGX support, Gramine can secure a critical application in a hardware-encrypted memory region and protect the application from a malicious system stack with minimal porting effort ("lift and shift" approach).

Since the last FOSDEM 2022 talk Gramine project has done two releases where we continue to enhance Gramine by adding new features, fixing bugs, and improving performance. Few of the features being, enabling CPU and NUMA topology, support more syscalls and adding Vtune profiling support. In addition, we have also enhanced our GSC (Gramine shielded Containers) tool to deploy Docker containers protected by Intel SGX enclaves. This talk will highlight the major enhancements, as well as the current status of the project and its future plans on enclave dynamic memory management support in Gramine.

Gramine github: https://github.com/gramineproject/gramine Gramine docs: https://gramine.readthedocs.io/en/latest/ Gramine support: https://gitter.im/gramineproject/community

Curated apps on Azure: https://azuremarketplace.microsoft.com/en-us/marketplace/apps/intelcorporation.curatedapppytorch?tab=Overview https://azuremarketplace.microsoft.com/en-us/marketplace/apps/intelcorporation.curatedappredis?tab=Overview

A recent blog on developer's guide to Gramine, https://techcommunity.microsoft.com/t5/azure-confidential-computing/developers-guide-to-gramine-open-source-lib-os-for-running/ba-p/3645841

Data-oriented programming encourages us to model data as (immutable) data, and keep the code that embodies the business logic of how we act on that data separately. This means stepping away from the traditional OO approach. In this talk I will go into what problems this solves, when to apply this pattern and how Kotlin’s data classes, sealed classes and powerful pattern matching can help you with this.

If you nowadays work with and on the cloud or simply *-as-Code, chances are you came into proximity of ‘Yet Another Markup Language’ (YAML). Deceptively simple in appearance, YAML provides you with a plethora of ways to shoot yourself in the foot. This talk discusses a number of common pitfalls. In a nutshell: Why YAML is not as easy as you may think.

Algorithm for fair multithreaded task scheduler for languages like C, C++, C#, Rust, Java. C++ version is open-sourced. Features: (1) formally verified in TLA+, (2) even CPU usage across worker threads, (3) coroutine-like functionality, (4) almost entirely lock-free, (5) up to 10 million RPS per thread.

"Task scheduling" essentially means asynchronous execution of callbacks, functions. Some kind of a "scheduler" is omnipresent in most services - an event loop; a thread-pool for blocking requests; a coroutine engine - you name it. Scheduler is an important basis on top of which the service’s logic can be built.

Gamedev is no exception. I work at Ubisoft - we have miles of code used in thousands of servers, mostly C++. There is a vast deal of task types to execute: download a save, send a chat message, join a clan, etc. Often they compose one multi-step task: (1) take a profile lock, (2) download a save, (3) free the lock, (4) respond to the player. Between each step there is a waiting time until the operation is done.

One of the game engines’ backend code had a simple scheduler generic enough to be used for every async job in all servers. It juggled tasks across several internal worker threads. But it had the following typical issues:

• Unfairness. Tasks were distributed to worker threads in a round-robin. If tasks differ in duration, some threads can appear choking while others are idle.

• Polling. In a naive scheduler multi-step task execution works via periodic wakeup of the task. When awake, the task checks if the current step is done and if it can go to the next one. With many thousands of tasks this polling eats notably more CPU than the actual workload.

The talk presents a new highly efficient general purpose threaded task scheduler algorithm, which solves these problems and achieves even more:

• Complete fairness - even CPU usage across worker threads and no task pinning;
• Coroutine-like - API to wake a task up on a deadline and for immediate wakeup;
• No contention - operation is mostly built on lock-free algorithms;
• Formal correctness - the scheduler is formally verified in TLA+;

After the scheduler was implemented in C++ and embedded into several highly loaded servers, it gave N-fold improvement of both RPS and latency (more than x10 speed up for one server).

At the same time the talk is not C++-specific. It is rather a presentation of several algorithms combined in the scheduler. They can be implemented in many languages: at least C, C++, Rust, Java, C#. Only need support of atomics and threads.

All that is completely open source - https://github.com/ubisoft/task-scheduler.

Presentation and background on recent work by the Accessibility team to improve performance, and the on-going collaboration with the Performance team to measure and quantify it. Includes overview of architecture, metric shaping, and current results of this ongoing project. After this presentation, a segway into a more-open ended discussion about accessibility and perceived performance, with input from audience members about current pain points and ideas for future work.

As has become a bit of a tradition, let's look at what's new in Nextcloud in 2023! 3 releases again, with tons of improvements all over.

A quick overview: bulk upload, profile page, appointment booking, Nextcloud Office and Nextcloud Backup in Nextcloud 24, which we named Hub II. 3 months later, Hub II/25 introduced User migration, smart file locking, 4x lower db load, Reactions & media tab in Talk, Reply to calls & messages in Desktop client, Undo send & schedule emails. Then, Hub 3 brought a complete design overhaul with much accessibility work, Photos 2.0 with image editor & face recognition, message expiration, polls and direct document creation in Talk, an org chart in Contacts, a lot of performance work and more. Don't think you can now skip the talk - there's a ton more!

Current developments in the field of quantum computer science bring a growing threat against the existing cryptographic algorithms used today, for example in secure Voice over IP and instant messaging applications. Although such a quantum computer has not yet been officially announced, some governments recommends protecting data against this type of attack by 2030. The encrypted data shared today could be stored and decrypted soon thanks to this breakthrough innovation.

The National Institute of Standards and Technology (NIST) launched in 2017 an international competition to standardise "post quantum algorithms". Such algorithms are expected to be resilient to an attack made by a generalist post quantum computer. They are meant to replace in the long term the algorithms that are used today in many secure protocols relying on cryptographic key exchange mechanisms. The Linphone application is most likely the first open source communication software in the world to have implemented the NIST finalist algorithm in the encryption key category, CRYSTALS-Kyber, as of today. One of the key steps: the development of a modified version of the standardized ZRTP encryption protocol.

A few challenges we have taken:

• Reach the same level of effectiveness even if cryptographic keys are much larger

• Remain resilient to classic attacks

• Be interoperable with encryption features offered by previous versions

The different steps that have been carried out:

• Integration of KEM in ZRTP protocol: creation of a modified version of ZRTP that accepts a key exchange algorithm of the type of Key Encapsulation Mechanism

• Hybridation : conception of an encryption engine combining a classic (EC)DH and a post quantum encryption. Modification of the ZRTP protocol so that it can negotiate two different key exchange algorithms at the same time and securely combine results.

• Fragmentation: addition of a mechanism to fragment ZRTP packets

• Integration in Linphone of this new ZRTP library with post quantum capacities and of configuration settings to activate/deactivate the post quantum mode

• Building of performance tests

Melrōse is both a language and a tool to create and listen to music interactively, The language uses musical primitives (note, sequence, chord) and many functions (map, group, transpose) that can be used to create more complex patterns, loops and tracks. Melrōse uses MIDI output to produce sound by any (hard or software) device attached. Melrōse can also react on MIDI inputs to start, record and stop playing musical objects. A plugin is available for Microsoft Visual Studio for the best usage experience.

Music is like a structured language so why not try to program parts of it. With Melrōse I found a good mix between writing music and interacting using audio feedback. The presentation will be come with lot of tunes, sounds and demos.

https://melrōse.org/

examples: https://www.youtube.com/results?search_query=Melr%C5%8Dse

Quick overview: Intro, use cases & updates from the past months and likely future!

Please note that this talk has been cancelled. The speaker is no longer able to attend FOSDEM. The objective of the talk is to highlight the various aspects and importance of two of the pillars of Observability: Metrics & Logs in Ceph Storage cluster. We will talk about the current architecture of metrics collection and logging, technology stack used and how you can easily deploy them in Ceph. This talk will also highlight the various aspects and importance of Centralized Logging, which can be very useful to view and manage the logs in a Dashboard view. We will also have a demo at the end where we'll show deployment of monitoring and logging services from Ceph dashboard Demos: Monitoring demo: Diagram showing metrics collection architecture Deployment of monitoring stack (ceph-exporter, Prometheus, Grafana) Prometheus targets and query page Grafana dashboards embedded in Ceph dashboard Centralized logging: Diagram showing centralized logging architecture Deployment of log collector an aggregation services (Promtail & Loki) Pattern based filtering in Loki

Agenda: Introduction to Monitoring and Centralized logging Dashboard in Ceph storage cluster and Demo

Target audience: Ceph, Monitoring, Admins / DevOps / SREs.

Over the last two years, Bluetooth® support has seen significant improvements in PipeWire and WirePlumber. In this talk, we'll take a closer look at these changes, including the recently added initial support for next generation Bluetooth LE Audio, and discuss future plans.

This talk targets everyone who cares about Bluetooth Audio support in Linux, not only for the Linux desktop but also for embedded Linux projects.

I held a presentation at LibreOffice Conference 2022 with the Title "LibreOffice graphics subsystems - History & Visions - From Win3.1 GDI to scene graphs". There I explained in detail the past, common and possible future graphics subsystems for LibreOffice. One aspect of this is the transition/escape path to get to new shores and allow to let old stuff completely behind, so reaching new shores. When I prepared that talk I started to implement a complete and working example how to do system-specific PrimitiveRenderers. I promised to continue and finish that in my private time, so I managed to get a working version. In this talk/presentation I want to talk about the process, what experiences I made to create the example, about upstream stuff that had to be done in master to prepare the ground for others and about the state of affairs. I will also make a short presentation/comparison with a version of the office that uses that new technic with the current one to present made achievements.

This talk shows the evolution of the C2 programming language. It also shows how to build/evolve your own compiler in a generic way.

Building your own compiler is a daunting task. But more and more people do give it a try nowadays. One factor of this is the availability of LLVM. LLVM is a generic compiler back-end, that saves you from having to generate Assembly code. The only problem now is how to generate LLVM code..

Launched by the European Commission in December 2021, under the sponsorship of Commissioner Thierry Breton, the European Alliance for Industrial Data, Edge and Cloud has the objectives of strengthening the position of the EU industry on cloud and edge technologies, and meeting the needs of EU businesses and public administrations that process sensitive categories of data. The Alliance brings together relevant stakeholders from the private and public sector to jointly define strategic investment roadmaps to enable the next generation of highly-secure, distributed, interoperable, and resource-efficient sovereign cloud and edge technologies. This talk will provide a summary of the role that open source plays in the EU technological roadmap that the Alliance will be publishing by the end of January 2023, and will explore the different ways in which collaboration around open source technologies can contribute to building a future European sovereign cloud.

One of the greatest obstacles to implementing FAIR (Findable, Accessible, Interoperable and Reusable) research practices, is the lack of awareness about what solutions are available across disciplines. Furthermore, most of the discussions around FAIR, Open and Good Data practices, as well as the solutions and requirements, occur at a higher level, distanced from the researchers who are the ultimate end-users of the solutions.

To bridge this gap, we launched FAIRPoints-an event series highlighting pragmatic measures developed by the wider research community towards the implementation of the FAIR data principles https://www.fairpoints.org/.
Our goal is to bring together; the research community- the ultimate user and producer of data, policy and decision makers- shapers of research practices, and the broader research support populace- to aid in the development of solutions for better Findability, Accessibility, Interoperability and Reuse by providing a platform for conversations to take place around realistic and pragmatic FAIR implementations

In this presentation, we will present some of the ongoing projects and community efforts driven by FAIRPoints.

Exploring the hardware and software of an Ikea Dirigera zigbee hub. State of the opensource software used Is Ikea commited to opensource? API description

The Drink authoritative server was created both to have dynamic answers (such as the IP address of the resolver) and to be used as a platform for DNS experimentation. The talk will present its internal implementation and the choices made.

Drink is written in Elixir and makes use of several Elixir strengths, notably the parallelism, which is very important for a DNS server. Also, writing an Internet server means dealing with broken (or downright hostile) clients so robustness is important. We will discuss the technical decisions, their consequences, and the remaining problems.

Fuzion is a modern general purpose programming language that unifies concepts found in functional and object-oriented programming languages. It combines a powerful syntax and safety features with a simple intermediate representation that enables powerful optimizing compilers and static analysis tools to verify correctness aspects.

Since FOSDEM 2022, Fuzion has seen two major improvements: The introduction of Algebraic Effects and a unification of types parameters and argument fields.

Side-effects of functions are hard to model in a purely functional way, while object-oriented languages typically allow code to have arbitrary side effects. Algebraic Effects were introduced to Fuzion to help track and control side-effects of features. But there is much more: Algebraic Effects provide a clean mechanism to provide mutable state, to share global data, to provide an exception mechanism and much more.

Also, Fuzion now treats type parameters like argument fields that receive types as their values. Types themselves may define inner features creating a hierarchy parallel to the hierarchy of Fuzion features. This permits type parameters to provide operations such as constructing instances of a parametric type. This talk will show how this can be used to provide functionality such as abstract equality in a clean an consistent way.

Introduction

Fuzion is a new functional and object-oriented language that aims at unifying different concepts to reduce the complexity of the language and tools processing code written in Fuzion. The biggest difference between functional and object-oriented languages is the handling of side-effects: In an ideal functional world, all functions are pure, i.e., free from side-effects, while in object-oriented languages like Java it is common to make frequent use of side effects, e.g. a Java method to read data would usually be a function read() that would return the read data and have the side-effect of advancing the current position in the input to the next element.

Side Effects

Side-effects may come in very different forms: I/O operations that interact with the outside world are just one example, other side effects are access or modification of global state, program termination or early abortion of some operation (e.g., via throwing an exception), logging, thread interactions, yielding data to a co-routines, etc.

Algebraic Effects

An algebraic effect is a set of operations that provide a certain functionality that may include side-effects. The idea is that any function that requires such an operations must do this explicitly, static that it depends on the corresponding effect. Any caller of a function that requires a certain algebraic effect either itself requires that same effect, or it must provide a handler that implements that effect.

As an example, say a function f performs some logging operation, so it requires a logger effect that has an operation log that adds one line of logging data. Any caller g of f therefore also depends on the logger effect, unless g itself would provide an implementation of the logger effect to be used by f. If g, e.g., provides a no-op logger implementation that does nothing in its log operation, then g could be pure and not depend on an effect, all the logging information created by f would be ignored. If, however, g would provide a logger that writes the log messages to a file, then g would no longer require the logger effect, but instead require some file-I/O related effect.

Operations of an algebraic effect usually return a result, but they may also abort the current calculation and directly return the the place the effect was installed. This makes effects somewhat similar to exception handling in some languages. But effects are more general, an operation of an effect may resume (return) an arbitrary number of times.

Type Parameters

Type parameters or generic types are common in many languages. Usually, type parameters are treated completely separately from normal 'value' parameters. In Fuzion, this distinction has been removed, type parameters are treated like value arguments only that the their actual value is a type. This permits adding functionality to types and performing operations on types such as creating an value of a given type.

Fuzion Language Overview

Fuzion is a modern general purpose programming language that unifies concepts found in structured, functional and object-oriented programming languages into the concept of a Fuzion feature. It combines a powerful syntax and safety features based on the design-by-contract principle with a simple intermediate representation that enables powerful optimizing compilers and static analysis tools to verify correctness aspects.

Fuzion was influenced by many other languages including Java, Python, Eiffel, Rust, Go, Lua, Kotlin, C#, F#, Nim, Julia, Clojure, C/C++, and many more. The goal of Fuzion is to define a language that has the expressive power present in these languages and allow high-performance implementations and powerful analysis tools. Furthermore, Fuzion addresses requirements for safety-critical applications by adding support for contracts that enable formal specification and enable detailed control over run-time checks.

Many current programming languages are getting more and more overloaded with new concepts and syntax to solve particular development or performance issues. Languages like Java/C# provide classes, interfaces, methods, packages, anonymous inner classes, local variables, fields, closures, etc. And these languages are currently further extended by the introductions of records/structs, value types, etc. The possibility of nesting these different concepts results in complexity for the developer and the tools (compilers, VMs) that process and execute the code.

For example, the possibility to access a local variable as part of the closure of a lambda expression may result in the compiler allocating heap space to hold the contents of that local variable. Hence, the developer has lost control over the allocation decisions made by the compiler.

In Fuzion, the concepts of classes, interfaces, methods, packages, fields and local variables are unified in the concept of a Fuzion feature. The decision where to allocate the memory associated with a feature (on the heap, the stack or in a register) is left to the compiler just as well as the decision if dynamic type information is needed. The developer is left with the single concept of a feature, the language implementation takes care of all the rest.

Side-effects and Security

Unexpected side-effects in library calls are the cause of a number of recent security vulnerabilities such as log4shell. The talk will give some examples.

Algebraic Effects in Fuzion

In Fuzion, algebraic effects are features that inherit from a standard library feature effect. Algebraic effects are identified by their type, so different heirs of effect create different operations. So the declaration of an effect myeffect that provides an operation myoperation is a feature declaration of myeffect inheriting form effect and declaring an inner feature myoperation.

Since the caller of a feature has to provide an implementation of an effect, it is said that an effect has to be present in the environment of a given call. The syntax to access an operation myoperation of an effect of type myeffect uses the keyword env as follows: myeffect.env.myoperation, meaning that we take the implementation of myeffect from the current environment and then perform myoperation_ on it.

Algebraic Effect Examples

The talk will interactively show how effects can be declared, used and installed.

Type Parameters in Fuzion

The talk will present the syntax of type parameters and the declaration of operations associated with types. This enables a functional counterpart static methods in languages like Java without adding global state.

It will be shown how this can be used to implement an abstract equality operation that permits the definition of different implementations for different types along an inheritance hierarchy.

Conclusion and Next Steps

The addition of effects and type parameters were important steps to make the language more powerful while staying true to the spirit of Fuzion which is to simplify and unify aspects as much as possible.

A small team of developers is now working on the Fuzion implementation with a focus on the standard library, performance and interfaces with other languages.

Main points that are missing right now are

• a powerful standard library
• additional library modules for all sorts of application needs
• low-level foreign language interface for C
• actual implementations of static analyzers and optimizers
• highly optimizing back-ends
• garbage collection for the C back-end
• documentation, tutorials
• more enthusiastic contributors and users!

Please feel free to contact me in case you want to use Fuzion or want to help making it a success!

CNI 2.0 is coming. And we all rely on CNI for setting up our networking in Kubernetes. But what do YOU want to see in it? Doug wants to let you know what he’s been thinking about for CNI 2.0 – and invite you to join the revolution. Did you know CNI is container orchestration agnostic? It’s not Kubernetes specific. Should it stay that way? People are looking for translation layers between Kubernetes and CNI itself. Have you engaged in the war between JSON and YAML? If you’re a Kubernetes user, and a CNI user, maybe you have. We need a way to make sure these disparate worlds meet, peacefully. Let’s make sure CNI is here to stay to give the community the flexibility in Kubernetes networking that we all deserve, and fight the good fight for our sysadmins so we keep the CNI API alive to promote a healthy open source ecosystem and avoid vendor lock-in.

Graphs are used in many different applications as they are an intuitive way for representing complex relationships between entities, as for example in social, communication, financial or geographical networks. Graphs in these domains can be very large, potentially spanning multiple millions and even billions of nodes and edges. In order to get analytical insights out of these structures, scalable implementations of graph algorithms are necessary. Rust is the ideal language for implementing such algorithms, due to its well-known aspects, such as "fearless concurrency" and memory safety as well as its great out-of-the-box performance and its expressive type system.

In our presentation, we will talk about the "graph" project, a collection of open source crates that we are working on. The project includes an in-memory graph representation, APIs for building in-memory graphs from various data sources, and a small collection of high-performance graph algorithms. In addition to these building blocks, we started developing a Python wrapper called graph-mate for a NetworkX-like experience and an Apache Arrow endpoint for integrating the project in distributed applications. The presentation will include a project overview, a walk through the Rust API, and a demo for using the project via Python.

This talk will present a new data management IDE for CSV that provides functionality to describe, extract, validate, and transform tabular data. It's a logical continuation of the Frictionless Data project's standards and software with a focus on the non-technical audience: data publishers, librarians, and, in general, people who prefer visual interfaces over command-line interfaces and programming languages.

Confidential Containers uses a generic guest image to simplify the orchestration and validation of Pod VMs. While this has many benefits, it also introduces some subtle security considerations. This talk will describe a class of so-called Evidence Factory attacks where privilege escalation can lead to dangerous misuse of generic attestation evidence. Can these attacks be mitigated while still preserving the benefits of a generic guest image? This talk will dive into the details of how attestation works for Confidential Containers and expose crucial considerations for anyone working with Confidential Computing more generally.

Following GitHub’s adoption and ”flavouring” of Markdown in 2009, many other major projects such as Reddit, Stack Exchange have followed suit, even WhatsApp now uses it to add formatting to your instant messages. That’s mainstream!

Tiki has long wished for a common wiki markup language, starting with involvement in Wiki Creole and inclusion of PEAR Text_Wiki adaptors since 2010? we started integrating markdown and now, in Tiki 25, offer it as an alternative syntax in all text areas, such as wiki pages, blog posts, comments and so on. In future versions Markdown will become the only active syntax.

Computer attacks occur in a constantly changing environment. To meet these challenges, it is necessary to implement a global approach to risk management within the organization.

The mapping of the Information System allows to have a global view of all the elements which compose the information system to obtain a better readability, and thus a better control.

The elaboration of a cartography participates in the protection, the defense and the resilience of the information system. It is an essential tool for the control of its Information System and is an obligation for Operators of Vital Importance (OVI) and is part of a global risk management and a global risk management approach.

At a time when cyberattacks are growing in number and complexity, it is necessary for organizations to develop a general risk management strategy. As part of an overall approach, Mercator is a key tool in keeping control over the information system. It provides insight into all of the information system’s components and a clearer picture of the information system by presenting it from different angles.

Mercator helps organisations mapping their information systems in order for them to meet the operational requirements of cybersecurity. It helps to build a map in five simple, practical steps.

It can be used by any organisation, irrespective of their type, size, maturity in terms of cybersecurity or the complexity of their information system. It is Open Source and can be used by organisations in the public and private sectors alike.

I teach a university class about the history of computing. To explain how early computers worked, I created the Toy CPU emulator - a reduced instruction set computer in the style of the Altair 8800 or IMSAI 8080. In this presentation, I'll explain how I created the Toy, and how to create and enter programs into the Toy.

You enter programs into the Toy using "switches and lights" - the Toy simulates LEDs for each counter and instruction, and the accumulator value. We'll create a few simple programs and enter them into the Toy using 8-bit machine language. The Toy CPU is a great way to learn about machine language programming!

Like many programming communities, the Java community lacks a simple open-source profiling UI. In the quest to build such a UI, I found the Firefox Profiler to be the closest to an adaptable polyglot profiling UI. This talk presents my Java JFR Profiler plugin for IntelliJ and gives an overview of how to adapt and integrate the Firefox Profiler to use it to view profiling data from different sources, like JDK Flight Recordings.

Support for power profiling was recently added to the Firefox Profiler, enabling both Firefox engineers and web developers to get very precise measurements of the power consummed by running their code.

After a brief introduction to the Firefox Profiler, the presentation will explain how this power profiling feature works, where the data comes from, what the limitations are on the various platforms. Interesting things that could be measured on Firefox will be shown, and some surprising profiling results will be shared.

Public Invention is a non-profit that pivoted to human respiration during the pandemic. The PolyVent is a fully free-libre open mechanical ventilator educational platform for teaching and research. It is part of a proposed and partially implemented complete free ecosystem of medical devices for respiration called Freespireco. It runs VentOS free software which can drive any ventilator. These projects represent a burgeoning open source medical device movement.

Free-libre open design hardware grows out of free software. Hardware has greater capital costs than software and is much more expensive to deploy. Medical hardware is more expensive still. Nonetheless, the COVID-19 global pandemic showed that the fragility of our global supply chains kill people. Open source medical hardware is a potential solution to this predictable catastrophe. In coming decades, we hope it will be as common as free software is now.

The PolyVent ventilator was started to address a predicted shortfall in human mechanical invasive and non-invasive ventilators in 2020. This never came to pass in the West, for medical reasons, but it was not a panic—it was a reasonable surmise based on limited data at the time. Over 100 teams tried to create open source ventilators; PolyVent is one of the few still active and fully open.

The PolyVent is completely open and very modular to allow for educational tinkering and graduate-level research. It runs fully open software called VentOS which can drive any electromechanical ventilator based on an extensible hardware driver model. It uses a “super loop” Arduino framework deployed with PlatformIO.

Combined with other modules, such as the VentMon monitor which provides a clinical display in a public data lake and the GPAD (General Purpose Alarm Device), it is an educational platform that has been piloted at one University. Although not for clinical use, we hope for-profit firms will create clinical ventilators based on this design. We understand how to assist such firms in obtaining regulatory approval.

Our hope is that in the next decade, a complete ecosystem of cooperating medical devices, components, data standards, and software, will make safe, reliable, reasonably priced respiratory care available to all people in all nations.

Decathlon has more than 160 frontend products, including 50 dedicated to mobile applications. Due to this context, it is hard to align the user interface across all these projects while respecting the platform.

Vitamin is a Design System developed by Decathlon as a product which can be adapted to any context and with multiple technical implementations for Android, iOS and Web. In theory, you can use this Design System in your application and customize it to fit your theme and your needs.

In this presentation, I'll focus on Vitamin Compose, the design and technical architecture, biases and what are the next steps.

Spoiler alert: it's a clickbait title, I'm not really a rockstar! :-)