Marta Rybczynska

Financing Open Source projects has been one of the main difficulties for years. Currently, well-funded projects usually depend on a small number of big companies. Donations from physical persons (and users) are also a common revenue source. Hundreds (thousands?) of small companies are using Open Source in Europe. Regularly donating only a small amount can make a difference for many projects they depend on. Marta will share the experience of giving by a small company in France with the list of "DOs and DON'Ts."

Building embedded systems is complex, especially if they will last. This talk will be a collection of (funny!) cases and stories of errors made in different projects. Examples cover a wide range of situations, for example, not using git at all (or poorly) or optimizing too early. Marta will also show best practices to follow instead and how to convince customers and coworkers actually to follow those practices.

The talk applies to an intermediate audience, but experts could also find a suggestion or two.

A Linux distribution is a great playing field for testing tools for vulnerability scanning. It is even a better playing field if it includes more operating system kernels, like the Eclipse Oniro project does. Eclipse Oniro targets the Internet of Things (IOT) domain, where fixing security issues is critical.

In this talk, Marta is going to present a return on experience of scanning for known vulerabilities (CVEs) in the Eclipse Oniro project. The presentation is going to start with an overview of tools based on Yocto's cve-check and additions from the Oniro project. Then it will cover examples of fixes, situations when we found errors in databases and tools, and how we fixed them. Finally, Marta is going to describe ideas of improvements in existing tools and propose new tools that can help the community.

Inaugural secure enclave platforms operate at the single user process level (e.g. SGX), meaning a single address space with potentially multiple threads, with a standard OS outside the enclave responsible for resource management and scheduling. More recent platforms (AMD SEV, Intel TDX, AWS Nitro Enclaves) operate at the VM level. This provides significant new capabilities for multi-process abstractions such as mmap and fork, which will be beneficial for enclavizing legacy software.

However, taking a VM image and running it in an enclave is not great from a TCB minimization standpoint. For platforms where there's currently no alternative (AMD, AWS), how can we build--with a minimal TCB--an abstraction that's similar to single-process enclaves? Of course you can “just run Linux” with a single process but this again is clearly suboptimal. We'll explore the solution space in this interactive session.

Other people: Vasily A. Sartakov Mike Bursell Jo Van Bulck Jethro G. Beekman Hugo Lefeuvre

In this talk Marta is going to present a map of the trusted computing landscape, explaining different types hardware support. She is going to put it in a context of implementing secure boot and trusted execution in an embedded distribution, namely Yocto-based Eclipse Oniro project.

The trusted computing landscape could be hard to understand for newcomers. Just at the beginning, they encounter a number of abbreviations like TEE, OPTEE, SEV, TF-A, TF-M and many more.

In this talk Marta is going to present a map of those technologies, illustrate how they are (or are expected to) be used, which market needs they address. She will show how they could be implemented in practice in an embedded distribution. The example will be the secure boot work in the Eclipse Oniro project, an embedded multi-OS distribution for Internet of Things (IOT) devices. The multi-OS specificity of Oniro will be used how the trusted computing technologies compare on different types of processors running Linux and Zephyr, with different security hardware support.

What is new in your Open Source project? The answer to this question is both important and interesting for developers and users. When the project is small, browsing the revision system log is an easy way to get the answer. Then the project becomes a success and the answer is getting more complicated to obtain.

In this talk we would like to show how we produce the KDE Commit Digest, the weekly oveview of the developer activity in KDE. We will show the whole system. This starts with the infrastructure that allows semi-automatic classification. Then we have the KDE revision control system and the special tags developers may put to mark the most important changes. We will finish with the team that handles this by reviewing, writing the summary and publishing.