uk: Комп'ютерні науки

description: Podcasts are inherently decentralized. As a medium, they rely on open standards and simple, straightforward tools to allow them to reach as wide an audience as possible. In recent years, however, the desire to monetize the format has started to change the shape of the podcasting landscape. With the acquisition of popular podcasts, platform holders such as Spotify have started a precipitous downward trend into centralization which flies in the face of what podcasts stand for. Luckily, there are many emerging platforms within the world of free software which aim to make the publication and dissemination of podcast content easier, more accessible, and more decentralized to combat this trend towards neo-corporate radio. As the developers of one of these platforms, the Funkwhale project has faced and still faces unique challenges designing the necessary tooling and anti-abuse features to enable users to host their own podacasting platform. This talk explores some of these issues, some of the solutions we have found, and why we believe it is important that users have free and open alternatives to centralized podcast hosts.

uk: вхід без авторизації

name: Funkwhale and the Importance of Decentralized Podcasting


Binärgewitter Talk Live

Ingo Ebel

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Ein IT Talk Podcast mit Themenschwerpunkt zu Open Source, Netzpolitik und Security. Wir sprechen zu 3 oder zu 4 über die Themen der letzten Wochen und geben euch Tipps zum Lesen, Nachdenken oder zum Anschauen.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: de

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

Chaos Computer Club e.V.

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


Ultraschall 5 - eine Einführung

uk: Комп'ютерні науки

description: Der Vortrag stellt die wesentlichen Neuerungen der neuen Ultraschall 5 Version zur Produktion von Podcasts vor. Es geht dabei weniger um einen vollständigen Überblick als darum, die grundsätzlichen neuen Ideen zu vermitteln.

uk: вхід без авторизації


Ogunhe Podcast - Black Scientist

uk: Комп'ютерні науки

description: Hint: the podcast will be in portugese. Ogunhê, podcast about the contributions of black scientists to the world: the goal is to rescue the history of scientists and give visibility to the science they make, so that black people feel more represented and also seeking to show how the achievements have helped society in that we live. The podcast on spotify was heard in 22 different countries. The idea is to talk about the process behind the episodes and the research of black scientists.

@language: en

uk: вхід без авторизації


Katalonien Eintopf - Ein Crossover

uk: Комп'ютерні науки

description: Ceelights Eintopf ist ein noch relativ junges Format - entstanden aus der Community rund um audiodump. Wir (Patric und Ceelight) sprechen unregelmäßig über unsere Erfahrungen aus der Tech-Welt, E-Autos und was uns noch so im privatem Umfeld bewegt und passiert.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Als Podcastpat*in habe ich dieses Jahr auch viel dazu erzählen müssen, wie man podcastartige Produktionen in der Schule didaktisch einsetzt. Nachdem "Podcasts" jetzt neu und toll sind, braucht es eine didaktische und methodische Einordnung. Dieser Vortrag stellt Podcasting als Methode des produktorientierten Unterrichts vor und versucht die Alleinstellungsmerkmale des Mediums in einen pädagogisch-didaktischen Kontext zu setzen.

uk: вхід без авторизації

name: Podcasting als produktive Unterrichtsmethode


PrivacyWeek – der Podcast

uk: Комп'ютерні науки

description: Das Team der PrivacyWeek startet einen eigenen Podcast. Die Nullnummer soll bei der rC3 über den Sendetisch gehen

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Entbehrliches - Unterhaltsames Wissen aus der Wikipedia


uk: Комп'ютерні науки

description: Raoul und Benjamin sprechen über Science Fiction Literatur. Dabei überlassen sie die Literaturkritik denen die Ahnung davon haben und stürzen sich direkt auf den wissenschaftlichen Background. Was ist Fiction, was ist wissenschaftlich haltbar? Viele mögen das Phänomen kennen, als “Experte” auf seinem Gebiet hat man einen ganz eigenen Blick auf Filme und Literatur. Geschichtliche und geographische Fehler sind vielleicht die populärsten Fehler die man kennt. Da tauchen in Filmen Grenzen auf die es zum Zeitpunkt der Handlung so noch gar nicht gab oder Erfindungen existieren in den Filmen vor deren eigentlichen Erfindung. Für Wissenschaftler ist ein Genre für solche spitzfindigen Betrachtungen besonders prädestiniert: Science Fiction. Der Name beschreibt es schon. Wir erwarten Wissenschaft und Fiktion. Manchmal klar getrennt manchmal eng verknüpft. So beruht StarWars kaum auf Science ist aber eine grandiose Fiktion. In Liu Cixins Romane findet man dagegen wenig Fiktion. Aber wie gut recherchiert ist der wissenschaftliche Hintergrund in der Science Fiction denn wirklich? Wir besprechen jeweils ein Buch oder Film und versuchen einige wissenschaftliche Aspekte genauer zu beleuchten. Euch erwartet ein wilder Ritt durch unser wissenschaftliches Dreiviertelwissen und unsere Versuche anhand von wissenschaftlicher Literatur Phänomene in der Science Fiction zu erklären.

uk: вхід без авторизації

name: Realitätstheorie - Ein Podcast über SciFi und die Wirklichkeit


uk: Комп'ютерні науки

description: NSU-Watch: Aufklären & Einmischen. Der Podcast über den NSU-Komplex, rechten Terror und Rassismus mit dem Jahresrückblick 2020. Den meisten wird das Jahr 2020 als das Jahr der Corona-Pandemie in der Erinnerung bleiben. Auch uns beschäftigt diese Entwicklung und wir sehen mit Blick auf die Demos der Corona-Leugner*innen die Gefahr von rechtem Terror steigen. Denn dort traf sich in den letzten Monaten auch das rechtsterrornahe Milieu von NSU-Netzwerk bis Nordkreuz, von Atomwaffen Division bis zum Umfeld des mutmaßlichen Mörders von Walter Lübcke. Sie alle sehen sich in ihrer Phantasie vom nahenden Tag X, der nationalen Revolution, von den Corona-Protesten bestärkt. Begonnen hat das Jahr 2020, zu unserem Entsetzen, wie das vom rechten Terror geprägte Jahr 2019 aufhörte: Mit einem rassistischen Anschlag. Am 19 Februar wurden in Hanau Ferhat Unvar, Mercedes Kierpacz, Sedat Gürbüz, Gökhan Gültekin, Hamza Kurtović, Kaloyan Velkov, Vili Viorel Păun, Said Nesar Hashemi, Fatih Saraçoğlu und die Mutter des Attentäters ermordet. Die Angehörigen kämpfen seitdem um Aufklärung und Erinnerung. Seit der zweiten Jahreshälfte beobachten wir den Prozess zum Mord an Walter Lübcke und zum Angriff auf Ahmed I. und den Prozess zum antisemitischen und rassistischen Anschlag von Halle. Während beim Halle-Prozess die Nebenklage neue Standards erkämpft hat, wenn es um die juristische Aufarbeitung von rechtem Terror geht, scheint der Prozess in Frankfurt auf vielen Ebenen die Fortsetzung des NSU-Prozesses zu sein. Das schriftliche Urteil des NSU-Prozesses, das sich am NSU-Komplex völlig unzureichend und kalt abarbeitet, veröffentlichten wir im Juni gemeinsam mit Frag den Staat. Über all das wollen wir mit unseren Gästen sprechen und mit ihnen auch einen Ausblick auf das nächste Jahr wagen, von dem wir hoffen, dass rechter Terror endlich aufgeklärt und zurückgedrängt werden kann.

uk: вхід без авторизації

name: NSU-Watch: Aufklären & Einmischen - Der NSU-Watch Jahresrückblick 2020


uk: Комп'ютерні науки

description: In dringender Angelegenheit: Die Welt ist an einem Wendepunkt. Wer übernimmt die Führung? Wer putzt heute das Klo? Wer holt uns eine Happy Pizza?

uk: вхід без авторизації

name: Neues vom Peng! Collective: Die Suche nach dem Alten Weißen Mann


Ballern 3.0 – create a safer party

uk: Комп'ютерні науки

description: Sonar – Safer nightlife Berlin steht für safer use und safer spaces im nightlife. Was muss ich wissen, wenn ich im nightlife Drogen nehme - wie mach ich's so richtig? Ein kurzer Input verschafft euch einen Überblick - welche Nightlife Projekte gibt es und um welche Inhalte geht es dabei? Wo können sich User*innen und Clubbetreibende/ Kulturschaffende informieren? Was sind die wichtigsten Basics. Im Anschluss wird es auch Zeit für Fragen geben.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Gemeinsam mit der Schweizer NGO Humanitarian Pilotes Initiative(HPI) betreibt Sea-Watch seit dem Frühjahr 2017 ein ziviles Aufklärungsflugzeug über dem zentralen Mittelmeer namens Moonbird. Ein großer Bestandteil der Arbeit ist auch die Dokumentation von Menschenrechtsverletzungen auf See durch die so genannte libysche Küstenwache und unterlassener Hilfeleistung von Handelsschiffen. Die Crew dokumentiert während ihrer Mission Seenotfälle auf der zentralen Mittelmeerroute, und versucht Rettungsmaßnahmen aus der Luft einzuleiten. Dabei werden sie Zeugen von verzweifelten Fluchtversuchen von Menschen, die in hochseeuntauglichen Booten die gefährliche Fahrt von Libyen nach Europa wagen und dabei ihr Leben riskieren.

uk: вхід без авторизації

name: 5 Jahre blutiger Deal mit Libyen: Ein Einblick in die zivile Luftaufklärung von Sea-Watch


uk: Комп'ютерні науки

description: Medizinisch-wissenschaftliche Hintergrundinformationen zur Corona Pandemie aus einer radikal aktivistischen und regierungskritischen Perspektive. Gefährliches Halbwissen, mißinterpretierte Statistiken und richtige Fakten, mit denen falsch argumentiert wird, bestimmen den öffentlichen Diskurs über die Corona Pandemie und ihre Auswirkungen. Medizinisches Wissen, Epidemiologie, Statistik, gesellschaftliche und wirtschaftliche Auswirkungen, sowie politische Stellungnahmen werden wild durcheinander geworfen und die absurdesten Zusammenhänge gezogen. In diesem Vortrag sollen die wichtigsten medizinischen Grundlagen zur aktuellen Pandemie vereinfacht dargelegt (immunologisch, infektiologisch und intensivmedizinisch), ein Blick auf die weltweite Geschichte der Pandemien geworfen, kurz das Themengebiet Statistik gestreift und Einblicke in den Alltag in einem Level-2-Corona-Krankenhauses gegeben werden. Auf der Basis dieser wissenschaftlichen Perspektive einer Medizinerin mit der praktischen Erfahrung einer Krankenhaus-Angestellten soll ein Input aus der Perspektive einer regierungskritische Aktivistin gegeben werden. Schon immer waren die Bereiche Antikapitalismus, Antirassismus, gesundheitspolitische (Un)Gerechtigkeit und der Kampf gegen die Privatisierung des Krankenhaussystems und die Macht der Pharmakonzerne die Kernthemen der Referentin. Heute soll es darum gehen, diese Themen in der aktuellen Debatte (ohne ein Abrutschen in die Schwurblerecke) weiterhin hochzuhalten und einen Weg der wissenschaftlichen Rationalität mit Kritik an der Regierung und dem Gesundheitssystem aufzuzeigen.

uk: вхід без авторизації

name: Über mutierte Viren, tödliche Impfungen und den täglichen Wahnsinn in der Notaufnahme: Medizinisch-wissenschaftliche Hintergrundinformationen zur Corona Pandemie aus einer aktivistisch regierungskritischen Perspektive


uk: Комп'ютерні науки

description: Ob Notebook oder Bluetooth-Lautsprecher: wenn Ihr ein neues Elektrogerät auspackt, ist da meist auch ein Netzteil beigelegt. Habt Ihr Euch auch schon mal gefragt, was diese dutzenden Symbole, die alle auf der Rückseite eng an eng aneinandergedruckt sind, eigentlich alle bedeuten? Klar, zwei oder drei der Symbole kennt eigentlich jeder von uns. Aber die anderen? Sind die für uns relevant? Bescheinigen die uns, das wir ein tolleres Produkt erhalten haben? Oder verpflichten uns diese Symbole gar zu etwas, was wir gar nicht so genau wissen...?

uk: вхід без авторизації

name: Die wunderliche Welt der Netzteilhieroglyphen: Was die ganzen Labels, Logos und Emojis auf einem Gerät bedeuten. Und wofür man mitbezahlt


uk: Комп'ютерні науки

description: Polizeibeamt:innen, die die gesetzlichen Grenzen für den Einsatz von Gewalt überschreiten, machen sich gemäß § 340 StGB wegen Körperverletzung im Amt strafbar. Den amtlichen Statistiken zufolge werden die allermeisten angezeigten Fälle durch die Staatsanwaltschaften eingestellt; wenig bekannt ist bislang über das Dunkelfeld dieses Deliktsbereichs. Der Vortrag präsentiert Ergebnisse aus dem Forschungsprojekt KviAPol, das erstmals für Deutschland systematisch übermäßige polizeiliche Gewaltanwendungen untersucht. Welche Personen sind in welchen Situationen auf welche Weise von übermäßiger polizeilicher Gewalt betroffen? Warum entscheiden sie sich für oder gegen eine Anzeige? Wie kommt es zu der hohen Einstellungsquote? Wie wird in der Polizei mit derartigen Verfahren umgegangen? Welche Rolle spielen Rassismus und Diskriminierungserfahrungen?

uk: вхід без авторизації

name: Körperverletzung im Amt durch Polizeibeamt:innen: Ergebnisse aus dem Forschungsprojekt KviAPol


uk: Комп'ютерні науки

description: The depiction of Nazis in games tends to downplay their atrocities and facilitate the normalization of fascist aesthetics and ideologies. Even in a playful and lighthearted context, this normalization has consequences that can and should be avoided by everyone in gaming communities – including developers, content creators, and players. World War II might be just one of many historical settings in games, but the representation of Nazis makes it a particularly tricky one. Especially if developers are trying to sell an entertainment product and provide players with all the freedom they might wish for, they frequently decide not to depict the Holocaust, for example. Such a decision, however, contributes to an embellished picture of Nazi Germany, which is then offered to players – some of which are apparently craving Nazi content. Their ideology, weaponry, and aesthetics seem to appeal to certain players in a peculiar way, as can be seen in user-created content, profiles, and discussions. No matter what the intention behind such behavior is, the abundance of Nazi representations in gaming communities has harmful consequences. By keeping the line between role-play and actual propagation of fascist ideologies blurry, gaming communities make themselves a rather uncomfortable place for all but the most privileged of players, while at the same time offering an excellent playground for actual fascists. Players, moderators, and developers regularly face backlash when advocating for more inclusive communities – at least whenever making a positive change would require dropping supposedly “edgy” behavior or content in an environment that has long been used to it. Tackling these issues demands more awareness and responsibility from all involved parties, from the players to the developers and their marketing divisions. Luckily, we could recently witness various good practice examples of ways to oppose fascism in gaming. Such examples are still rare, they require effort and dedication, but they harbor promise of a better future for gaming – for everyone except literal Nazis.

uk: вхід без авторизації

name: Nazis in Games: Depiction, Normalization, Consequences


uk: Комп'ютерні науки

description: Wir sind die Radikalen Töchter und schlagen da auf, wo es passiert: auf dem Land, in Dörfern und Kleinstädten. Wir durchkämmen Deutschland auf der Suche nach aufgeweckten, engagierten Menschen und verbreiten in Delitzsch, Gera und Jamlitz die frohe Botschaft der Aktionskunst. bye bye 17 Minuten Politikunterricht in der Woche, hello Ausbildungscamps in Aktionskunst. Wir sind die Radikalen Töchter und schlagen da auf, wo es passiert: auf dem Land, in Dörfern und Kleinstädten. Wir durchkämmen Deutschland auf der Suche nach aufgeweckten, engagierten Menschen und verbreiten in Delitzsch, Gera und Jamlitz die frohe Botschaft der Aktionskunst. Macht kommt von Machen. Unser Trainingsplan aus Aktion, Kunst und Politik hinterlässt eine kritische Masse von Menschen, die für die Demokratie brennt. In den nächsten Jahren werdet ihr von ihnen hören.

uk: вхід без авторизації

name: Radikale Töchter: Macht kommt von Machen


uk: Комп'ютерні науки

description: With her transdisciplinary works, media artist Theresa Schubert manages to make the fine connective tissue between human / nature on the one hand and science / technology on the other visible and, above all, tangible. Often, organic materials such as slime moulds, fungi or bacteria are the starting point for an experimental exploration via practices of posthuman self-organisation or interspecies communication. In her lecture, she will present some of her art projects and her methodological approaches - such as biohacking, theoretical analysis or performative interpretation.

uk: вхід без авторизації

name: Biohacking in art: An interdisciplinary foray from slime moulds to fungi and cell culture


uk: Комп'ютерні науки

description: xHamster ist die meistbesuchte Pornoseite Deutschlands und eine der meistbesuchten Websites der Welt. Aber was tut xHamster dagegen, dass dort Aufnahmen sexualisierter Gewalt kursieren? Kritische Fragen zu dem Thema blockt die Firma hinter xHamster konsequent ab. Also haben wir uns dort undercover als Löscharbeiter beworben und uns ein eigenes Bild gemacht. Nach wochenlangem Social Engineering und mehreren Monaten Recherche wissen wir: xHamster schützt Opfer von sexualisierter und digitaler Gewalt nur mangelhaft. Die Ergebnisse der Recherche “Inside xHamster” haben wir in einer Artikelserie auf VICE.com veröffentlicht. Wochenlang haben wir undercover als Löscharbeiter für xHamster gearbeitet und mutmaßlich illegale Fotos aussortiert. Wir waren Teil eines Teams aus offenbar mehr als 100 Freiwilligen, die anonym und ohne Bezahlung über sensible Inhalte entscheiden. Neben den Freiwilligen gibt es noch ein Support-Team aus bezahlten xHamster-Mitarbeitern, über dessen Arbeit die Plattform wenig verrät. Ein Anfangsverdacht reicht nicht aus, um eine Aufnahme zu löschen. Ob mutmaßliche Vergewaltigung oder bildbasierte, sexualisierte Gewalt: Verdächtige Fotos sollen die Löscharbeiter nur entfernen, wenn sie sich zu 100 Prozent sicher sind, dass sie gegen die Regeln von xHamster verstoßen. Bewerten können sie die Fotos aber nur nach Augenschein. Das hat drastische Folgen, zum Beispiel für den Kampf gegen strafbare Jugendpornografie. Die Löscharbeiter von xHamster müssen aus dem Bauch heraus entscheiden, ob eine fremde Person schon volljährig ist oder nicht. Entfernen sollen sie ein verdächtiges Foto nur, wenn sie die Wahrscheinlichkeit, dass die abgebildete Person unter 18 ist, subjektiv als "hoch" einstufen. Minderjährige können also nur geschützt werden, wenn sie kindlich genug aussehen. Das und mehr geht aus dem internen Regelwerk von xHamster hervor, das wir auf VICE.com veröffentlicht haben. Es besteht im Kern aus lediglich rund 2.800 Zeichen und 38 Beispielfotos. xHamster hat auf unseren Katalog aus 67 Fragen nur mit knappen Statements reagiert. Unsere Fragen zum Regelwerk der Löscharbeiter wurden inhaltlich nicht beantwortet – wie ein Sprecher mitteilte aus "technischen Gründen" und aus Gründen der "Sicherheit". Wir sollten "versichert" sein, dass "Kontrollen existieren". Wenn etwas gegen die Nutzungsbedingungen verstoße, werde es entfernt. Das Justizministerium teilt vor dem Hintergrund der Recherche mit, Anbieter dürften sich nicht durch "bewusstes Wegschauen" einer Verantwortlichkeit entziehen. Ein derzeit geplantes Gesetzespaket auf EU-Ebene, der "Digital Services Act", könnte Pornoplattformen wie xHamster strenger in die Pflicht nehmen. Unterm Strich existiert derzeit aber kein wirksamer Schutz für Betroffene. Da es aktuell nicht einmal Meldepflichten für Rechtsverstöße auf Pornoplattformen gibt, kann die Öffentlichkeit das Ausmaß sexualisierter und digitaler Gewalt im Netz nur erahnen. Die Recherche bietet erstmals Einblicke in den Maschinenraum einer der größten Pornoplattformen der Welt.

uk: вхід без авторизації

name: Inside xHamster: Undercover im Löschteam von Deutschlands meistbesuchter Pornoseite


Encrypted DNS, Eposide II

uk: Комп'ютерні науки

description: Warum es wichtig ist, dass wir DNS-Traffic vor Einblicken schützen und wie das technisch in Clients-Systemen implementiert ist.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: "In 2014, Alberto Daniel Hill, an expert in cybersecurity, found a security issue in a medical provider’s website. In reporting the issue, it led him to become the first person imprisoned in Uruguay for a computer-related crime—a crime he didn’t commit, and one that probably never even happened. Alberto, a hacker, was the perfect target for a judicial system that doesn’t understand cybersecurity or cybercrimes. Through police misconduct and incompetence, his life was thrown into upheaval, and he is still recovering from a system where there are no guarantees of a fair trial. Rife with injustice and anguish, Alberto’s story doesn’t have a fairy tale ending. It is a lesson for Uruguay and the world to implement fair processes for prosecuting cybercrimes. Alberto’s tale will stand as a stark reminder of the dangers of a judiciary system that hasn’t caught up to the technology of the 21st century." Stephanie Holland, Editor of the book "Operacion Bitcoins: Login To Hell" This talk is presented by Alberto Hill from his view and features a lot of Q&A from the live audience.

uk: вхід без авторизації

name: Login To HELL: The nightmares of an infosec professional in South America


R3S Closing

uk: Комп'ютерні науки

uk: вхід без авторизації


R3S Opening

uk: Комп'ютерні науки

description: Opening RheinRuhrStage R3S, Monheim / Rhein

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Im Juni 2020 habe ich mit der Implementierung der Exposure Notifications API auf einem ESP32 begonnen. In diesem Vortrag möchte ich über die Implementierung, Einschränkungen und die Vorteile der Nutzung eines Mikro-Controllers mit BLE und WiFi als Hardware-Token für (Corona-) Kontaktverfolgung und Verbindung mit der deutschen Corona Warn App sprechen. Da sich im Sommer Steini und andere CADUS-Mitglieder an mich gewandt haben, werden wir zusammen auch einen Blick auf den aktuellen Status unseres Prototyps und zukünftige Pläne werfen, die Hardware in Flüchtlingslagern einzusetzen.

uk: вхід без авторизації

name: Corona Warn App als Hardware-Token | ESP-ENA + PanTra


Oh du fröhliche, oh du smarte Welt...

uk: Комп'ютерні науки

description: Neue Technologien sollen unser Leben bequemer und komfortabler machen, doch der Preis, den wir dafür zahlen, ist hoch. Wir werden ohne unser Wissen überwacht, werden zu unmündigen Bürgern. In dem Talk möchte ich euch einen Überblick geben über die Gefahren der Digitalisierung im Alltag und was wir alle tun können, damit neue Technologien nicht uns in der Hand haben, sondern wir sie. Bei "Oh du fröhliche, oh du smarte Welt" geht es darum, euch aufzuzeigen, was Apps und vernetzte Geräte alles über euch wissen, was mit euren Daten geschieht und wie ihr eure Privatsphäre im Alltag schützen könnt und was für als Gesellschaft ändern müssen, damit Technologie nicht uns im Griff hat, sondern wir sie! Mitgestalten statt verwalten, so das Motto. Diese Themen werden behandelt: Überwachung und Sicherheitslücken bei Smart Home Systemen, venetztem Spielzeug, digitalen Assistenzwanzen, Apps, aber auch durch Gesichtserkennung. Plus: Perspektiven zur digitalen Selbstbestimmung und Mitgestaltung von Technologie. Die Beispiele und Strategien, die ich euch präsentiere, habe ich im Buch "Hilfe, ich habe meine Privatsphäre aufgegeben!" (erschienen im Dezember im mitp Verlag) gesammelt.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: What happened in these 10 years, as our communities saw courageous hackers and journalists sharing skills and joining forces to expose the lies, corruption and war crimes of the World... and are now witnessing a mass-campaign of intimidation of journalists, publishers and whistleblowers? What did we lose on the way? What is at stake? 10 years ago, major WikiLeaks releases revolutionized the way investigative journalism was being done through the biggest cooperation of big and small news outlets wordwide. An unprecedented alliance of ethical hackers and courageous journalists introduced to the general public techniques such as anonymization of sources, secure communications, un-censorable publication, data-mining and data-based journalism, around the publication of "Collateral Murder", "Cablegate", the Iraq and Afghanistan "War Logs". Since then, the Obama administration initiated an unprecedented war on journalism, using the 1917 espionage act against whistleblowers and publishers more times than it has ever been used before. Trump continued this repressive effort and next week, on Jan 4th 2021, a verdict is due in Assange's US extradition case, where he faces 175 years in Colorado's super-max prison. This open discussion, in the form of a cross-interview, will bring together investigative journalists who partnered with WikiLeaks in 2010 and have followed closely the Assange and WikiLeaks story since. They have covered Assange's extradition hearing and gave their expert witness testimonies in court. They will discuss hackers and journalists' common history, the current state of things and, hopefully, perspectives for the future.

uk: вхід без авторизації

name: Ethical Hackers + Investigative Journos... GAME OVER?


uk: Комп'ютерні науки

description: Can a journalist reveal state secrets when they cover up very serious human rights violations, war crimes and torture? This is what the Julian Assange and WikiLeaks case is about. Assange's persecution is a judicial case that will decide how far journalism can go in Western democracies. For the first time in the history of the United States a journalist may end up in prison for publishing truthful information in the public interest. It’s unprecedented. And it should be a wake up call: our democracies are getting so dystopian that the war criminals enjoy impunity, whereas a journalist exposing war crimes faces life imprisonment. We can't afford to lose this case: we must save Julian Assange and the WikiLeaks journalists. In this presentation Stefania Maurizi, Italian investigative journalist who partnered with WikiLeaks will go back ten years into the most complex, intricate and crucial case concerning journalism and free speech today. As a first-hand witness working with Assange within the Ecuadorian embassy and a witness before the UK court, she will detail her work documenting some of the most obscure aspects of the long-term campaign of attacks against WikiLeaks, spanning accross five jurisdictions.

uk: вхід без авторизації

name: Why We Must Save Julian Assange and WikiLeaks


uk: Комп'ютерні науки

description: Thunderbolt is a computer port for high-speed data transmission between a PC or laptop and other devices. It is found in hundreds of millions of devices worldwide. We present Thunderspy, a new class of vulnerabilities that break all primary security claims for Thunderbolt 1, 2 and 3. We give a live demo of the attacks, and present a tool for determining whether a system is vulnerable. Finally, we conclude our talk demonstrating our new research on designing and implementing protections against Thunderspy. Thunderbolt is a high-bandwidth interconnect promoted by Intel and included in laptops, desktops, and other systems. Being PCIe-based, Thunderbolt devices possess Direct Memory Access (DMA)-enabled I/O. In an "evil maid" DMA attack, where adversaries obtain brief physical access to the victim system, Maartmann-Moe (Inception), Frisk (PCILeech) and others have shown Thunderbolt to be a viable entry point in stealing data from encrypted drives and reading and writing all of system memory. In response, Intel introduced "Security Levels", a security architecture designed to enable users to authorize trusted Thunderbolt devices only. To further strengthen device authentication, the system is said to provide "cryptographic authentication of connections" to prevent devices from spoofing user-authorized devices. We present Thunderspy, a series of attacks that break all primary security claims for Thunderbolt 1, 2 and 3. So far, our research has found seven vulnerabilities: inadequate firmware verification schemes, weak device authentication scheme, use of unauthenticated device metadata, downgrade attack using backwards compatibility, use of unauthenticated controller configurations, SPI flash interface deficiencies, and no Thunderbolt security on Boot Camp. Finally, we present nine practical exploitation scenarios. In an "evil maid" threat model and varying Security Levels, we demonstrate the ability to create arbitrary Thunderbolt device identities, clone user-authorized Thunderbolt devices, and finally obtain PCIe connectivity to perform DMA attacks. In addition, we show unauthenticated overriding of Security Level configurations, including the ability to disable Thunderbolt security entirely, and restoring Thunderbolt connectivity if the system is restricted to exclusively passing through USB and/or DisplayPort. We conclude with demonstrating the ability to permanently disable Thunderbolt security and block all future firmware updates. All Thunderbolt-equipped systems shipped between 2011-2020 are vulnerable. Some systems providing Kernel DMA Protection, shipping since 2019, are partially vulnerable. The Thunderspy vulnerabilities cannot be fixed in software, impact recently introduced standards such as USB 4 and Thunderbolt 4, and will require a silicon redesign. Finally, we conclude our talk demonstrating our on-going research on designing and implementing protections against Thunderspy.

uk: вхід без авторизації

name: When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security


uk: Комп'ютерні науки

description: Replay NO Commentary - This talk will explain what Deepfakes are, the technology behind them (GANs) and why we need to be careful when using them. Replay NO Commentary - GANs (short for "Generative Adversarial Networks") have been revolutionising the generation of images and videos since 2014. While this machine learning architecture is being used in arts, science and video games, it is also abused to steal people's identities, for example by generating fake news with putting words into politician's mouths which they never said or creating porn with faces of famous actors and actresses. In this talk I will first give a short overview over what GANs are and how they work. The second part dives into the new dark world that it opened up to us and why we need to be careful - because with great power comes great responsibility.

uk: вхід без авторизації

name: But this politician said «xyz»! - no Commentary: The technology behind Deepfakes and its ethical implications


Solitude: A Privacy Analysis Tool

uk: Комп'ютерні науки

description: Solitude is an open source privacy analysis tool that enables anyone to conduct their own privacy investigations. Whether a curious novice or a more advanced researcher, Solitude makes the process of evaluating an app’s privacy accessible for everyone. Oftentimes the only way for the end user to figure out where their private data goes once they enter it into a web application or mobile device is through the apps privacy policy. Privacy policies not only have a notorious history of being difficult to understand but don’t always tell the truth about an application’s data collection practices. Solitude was built to make proxying your web and mobile traffic easier and make the process of conducting privacy investigations of your favorite apps more streamlined and straight forward. Solitude can be configured to look for any data that you input in a mobile or web application and reveal where that data is going. The application inspects all outbound HTTP traffic, looks for various hashes of your data and recursively decodes common encoding schemes (base64,URL). This talk will discuss how Solitude is built, how to use it and give some real world examples of privacy violations discovered in the wild using Solitude. The real world examples will cover different approaches for finding different classes of privacy issues and how to use Solitude to accomplish this.

uk: вхід без авторизації


Playing with words

uk: Комп'ютерні науки

description: If you are on countercultural meanders, you probably know the why-there-is-no-word-for-that feeling. Kamil, your host, is representing a group of friends working-playing to minimize this kind of puzzlement. Regular focus on language brought them to unexpected places: emerging text displaying technologies, future of text, polyamory, philosophy, and linguistics. After months of playing with words we can't get enough! We find it thought provoking and fun. We want to share our enthusiasm with you! Why stop on pronouns? What happens when you get loose and try to change many words in your daily use? During the event you will see funny and thought provoking examples of redefinitions, new words and, perhaps, syntactic constructions. They will be woven with perspectives from various fields and personal observations. But, creature, beware! This is nothing serious or pompous. We do not claim to 'reprogram our brains' or anything in this vein. We just observed that definitions are arbitrary and we personally like to tweak them. Can't wait to hear comments, thoughts & feelings from you as well - during the event there will surely be a place for that.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In a time and space where even basic human interaction has to be facilitated by computer systems, we find ourselves in a web of systems that aggregate data in places we are unaware of. The vast scope of surveillance capitalism makes us yearn for protest and disruption. Yet, while fighting the power is a worthwhile cause, we suggest a complementary approach in wining and dining the power, and making bureaucracy do the dirty work for you. Strap in for a ride where asserting your God-given data rights isn’t only your duty as citizen, but easy, accessible and fun. The right to access, right to rectification, right to erasure, right to restriction of processing, right of notification of processing, right to data portability and right to objects are just some of the rights EU citizens enjoy since May 25th 2018, whether the website is hosted and operated in the EU or not. These rights should make it easy for citizens to get a grip on their personal information. We’ve taken the law into our own hands, and found out what it’s like excercising these rights. Spoiler alert: not good. We’ll walk you through the 58 requests we sent out, and the hilarious and dumbfounding ways they are set up currently. In addition to ventilating our frustration into the void, we make the case for automated data rights: retrieving, editing and removing your data should be as easy a changing your Facebook status. This vision is made real in the form of Aeon: a desktop app that gathers, visualises and allows for modification of your data.

uk: вхід без авторизації

name: Life, liberty and the pursuit of personal information: Sticking it to the algorithm with GDPR data rights


Jugendliche als Kontributoren

uk: Комп'ютерні науки

description: Das Ziel unseres Vortrages ist es, Entwicklergemeinden zu zeigen, dass sie die Jugend als wichtigen Bestandteil der Softwareentwicklung erkennen. Ebenfalls möchten wir sie motivieren, Kinder und Jugendliche an der Entwicklung von freien Projekten teilhaben zu lassen. Die Computer- und Internetwelt ist ein Platz, an dem alle Generationen vertreten sind. Warum sollten alle Generationen dann nicht auch an der Entwicklung dieses Ortes beteiligt sein. Oftmals ist die Entwicklergemeinschaft in einen bestimmte Altersbereich vertreten heute und jüngere Personen sind außen vor, obwohl die Jugend einer Generation angehört, die praktisch mit dem Internet aufgewachsen ist. Junge Menschen können die Softwareentwicklung in neue Bahnen lenken und andere Sichtweisen mit einfließen lassen. Eine Entwicklergemeinde die diverse Altersgruppen beteiligt und sich aktiv dafür einsetzt, dass Jugendliche und Kinder involviert sind, können kreativer und innovativer handeln. Jedes Softwareprojekt, dass erfolgreich sein möchte, braucht Kontributoren. Da aber keine Kontributoren Kontributoren sein können, bevor sie gelernt haben Software zu entwickeln, müssen für potentielle neue Entwickler und alle Anderen, die sich in jeglicher Form an einem Softwareprojekt beteiligen wollen, Personen in das Thema eingeführt werden. Im Idealfall stoßen junge Menschen aufgrund ihres Interesses auf das Thema und beschließen, sich weiter mit diesem Projekt auseinander zu setzen. Handelt es sich hierbei um Projekte, die frei sind, erhalten Interessierte die besten Möglichkeiten sich mit ihrem Können, Wissen oder auch einfach nur ihrem Interesse engagieren. Da aber nur selten Jugendliche und Kinder von freier Software und seinen Potentialen gehört haben, bedarf es andern Wegen. Es muss aktiv dafür geworben und aufmerksam gemacht werden. Dies kann beispielsweise in Schulen, aber auch in den eigenen Entwicklerkreisen geschehen. Der Teckids e.V. konnte feststellen, dass das sehr gut funktionieren kann. So stellten Kinder Bugs in einer Entwicklungsumgebung fest und konnten daraufhin mit der Hilfestellung Erwachsener eigenständig diese Fehler beheben. Dieses Beispiel soll zeigen, dass zwischen Softwareentwicklung und Kindern keine Distanz herrschen muss, sondern beide erfolgreich interagieren können

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Viele soziale Netzwerke und kooperative Systeme bieten Räume für den öffentlichen Diskurs und die Meinungsbildung. Dabei fällt auf, dass die Betreiber allein darüber bestimmen, wie diese Räume gestaltet sind, wer sie betreten darf und welche Regeln für ihre Nutzung gelten. Obwohl diese Systeme und Plattformen Online Communitys beherbergen, entziehen sie sich weitgehend dem Einfluss der jeweiligen Gruppe oder Gemeinschaft. Im Vortrag vergleichen wir Online Communitys und virtuelle Gruppen mit demokratisch organisierten Strukturen und stellen die Frage, warum wir uns immer noch als “Nutzer” der Gunst von Plattformbetreibern unterwerfen, anstatt als mündige Bürger im Web demokratisch Einfluss auszuüben. In einer virtuellen Gemeinschaft gibt es viele Entscheidungen zu treffen: Wer darf der Gemeinschaft beitreten? Wer soll ausgeschlossen werden? Welche Regeln gelten innerhalb der Gemeinschaft? Welche Informationen sollen nach draußen gelangen? Wer hat welche Rollen inne und darf über was entscheiden? Welche Features sollen verfügbar sein? Bestenfalls werden Fragen dieser Art irgendwie einvernehmlich geklärt. Ab einer gewissen Anzahl von Mitgliedern funktioniert das jedoch nicht mehr. Erst recht nicht, wenn die von der Gemeinschaft gewählte oder ihr auferlegte Plattform keine ausreichenden Kommunikations- und Abstimmungsmittel bereitstellt. Im schlimmsten Fall wird die Gemeinschaft autokratisch gelenkt, so dass die Entfaltungsmöglichkeiten durch Regeln definiert und durch technische Gegebenheiten determiniert sind. Nicht selten profitieren dabei diejenigen, die die Kompetenz und Kontrolle über die technischen Systeme inne haben – die Administratoren, Moderatoren, Plattform-Betreiber bzw. deren CEOs. Im ersten Teil des Vortrags beleuchten wir problematische Machtstrukturen am Beispiel von Groupware Systemen und Social Media Plattformen und kontrastieren diese mit effektiven Systemen und Verfahren zur Umsetzung bindender demokratischer Entscheidungen in virtuellen Gemeinschaften. Dabei betrachten wir Entscheidungen auf den Ebenen Content, Partizipation, Regeln des Miteinanders und der technischen Gestaltung. Im zweiten Teil des Vortrags stellen wir euch einen exemplarischen Lösungsansatz für ein verbreitetes CMS vor und berichten von den Erfahrungen der derzeitigen Anwender, die damit bspw. über die Vergaben von Nutzerrollen und die Gestaltung von Community-Regeln abstimmen, Inhalte nach dem N-Augenprinzip veröffentlichen und ihrem Admin effektiv den Zugriff auf den Content entziehen.

uk: вхід без авторизації

name: Demokratische Entscheidungen in Online Communitys


uk: Комп'ютерні науки

description: After Izmir Earthquake happened on October 30th 2020, a citizen collective for measuring earthquake effects started to work. In 3 weeks, the collective collected the hazard data, visualized data and created reports & analysis as an alternative approach for government work. Two different NGO’s, Yer Cizenler (Earth Drawers) and National Chambers Union of Architects and Engineers of Turkey, got together after minutes from the Izmir Earthquake. This presentation will be an explanation about the field work, data visualization and crowdsourced disaster response they have done.

uk: вхід без авторизації

name: Citizen Measurements for Izmir Earthquake - Creating an Alternative for Damage Assessment


uk: Комп'ютерні науки

description: Schon seit mehreren Jahren (und lange vor Corona) spielen wir in einer kleinen feinen Gruppe Online Pen-and-Paper Rollenspiele - im Terminal - mit dem Emacs Editor - mit ganz normalen Menschen (also auch Nicht-Nerds). Wie das funktioniert möchten wir Euch in diesem Workshop erzählen und zeigen. Plattformen (Roll20, Discord …) sind einfach, bequem und voll nützlicher Funktionen. Aber die vielen Funktionen lenken ab, beim Pen-and-Paper Rollenspiel ist die beste Grafik im Kopf. Plattformen engen ein, fesseln den Benutzer, sammeln Daten, sind zum konsumieren und nicht “selber machen”. Wir machen unser Online-RPG selber, mit einfachen Werkzeugen. Dezentral. Mit Freier Software. Für uns macht es Spass, im Cyberpunk Grosskonzerne auszutricksen, ohne in dieser Welt ein Sklave grosser Konzerne zu sein. Wir möchten motivieren, die Fesseln der Plattformen abzustreifen und das Online-Hobby zu befreien. Kommt mit auf ein Abenteuer! In diesem Mini-Workshop gibt Carsten Strotmann seinem Gesprächspartner padeluun einen Einblick in die Welt der remote pen&paper Spiele.

uk: вхід без авторизації

name: Spiele lieber dezentral: ASCII-and-[Vo]IP - Online Pen-and-Paper Rollenspiel abseits von Roll20 und Discord


uk: Комп'ютерні науки

description: We have ended up in a world where UNIX and Windows have taken over, and most people have never experienced anything else. Over the years, though, many other system designs have come and gone, and some of those systems have had neat ideas that were nevertheless not enough to achieve commercial success. We will take you on a tour of a variety of those systems, talking about what makes them special. In particular, we'll discuss IBM i, with emphasis on the Single Level Store, TIMI, and block terminals Interlisp, the Lisp Machine with the interface of Smalltalk OpenGenera, with a unique approach to UI design TRON, Japan's ambitious OS standard More may be added as time permits.

uk: вхід без авторизації

name: What have we lost?: Interesting ideas from forgotten systems


Elektronische Beweisführung

uk: Комп'ютерні науки

description: Das Internet – es wird gehandelt, sich vernetzt und gelebt. Dass dabei Straftaten passieren, gegen die rechtlich vorgegangen werden kann, ist klar. Beweismittel Nummer 1 sind oft Screenshots, doch diese sind nicht fälschungssicher und auch das deutsche Rechtssystem ist noch nicht endgültig in der Digitalisierung angekommen. Im Rahmen des Vortrags sollen praktische Beispiele für das Manipulationspotenzial aufgezeigt werden und erste Handlungsvorschläge gegeben werde, welche Optionen der Gesetzgeber, die Rechtsprechung sowie die Wissenschaft hätten, um diesen unbefriedigenden Zustand zu lösen. Immer mehr Zeit unseres Lebens verbringen wir im Internet, einer der größten Faktoren dabei sind die Social Media™. Galt dies lange als oberflächliche Teenagerbeschäftigung wird nun immer klarer, dass wie wir uns verhalten und was wir dort erleben auch unser soziales Zusammenleben und unsere Gesellschaft formen, ja diese sich immer mehr ins Digitale verlagern. Die Digitalisierung führt an keiner anderen Stelle in so einem großen Bogen vorbei, wie an den Gerichten und der Verwaltung. Dass die elektronische Aktenführung an den Bundesgerichten erst seit dem 02.04.2020 möglich ist (vgl. § 2 BGAktFV) lässt bereits Fragen nach sich ziehen. Während aber die elektronische Gerichtsakte an den Gerichten spätestens zum 01. Januar 2026 zur Verfügung stehen sollen (vgl. Art. 3 EAkteJEG) und für die AnwältInnen bereits jetzt eine passive Nutzungspflicht des besonderen elektronischen Anwaltspostfachs (beA) gilt, besteht die Gerichtswirklichkeit im Alltag im Jahr 2020 aus Handakten und Faxgeräten. Ein viel größeres Problem existiert jedoch im Rahmen der elektronischen Beweisführung, da der Beweiswert eines Screenshots der freien richterlichen Beweiswürdigung ( § 286 ZPO) freigestellt wird. Ein Zustand, der unter Umständen dazu führen kann, dass eine Transaktion über Ebay gerichtlich nicht anerkannt wird, weil der Vertragsschluss hier ausschließlich über den Emailaustausch oder Screenshots der Plattform nachgewiesen werden kann. Dadurch können sich Gerichtskosten nicht unerheblich erhöhen, da Sachverständige zur Feststellung der Echtheit eines Screenshots hinzugezogen werden müssen. Kennt eine Richter*in diese Beweise ohne jegliche weitere Überprüfung auf Echtheit als solche an, werden dadurch die Urteile jedoch anzweifelbar. Die Gefahr, dass Screenshots gefälscht werden, ist jedoch nicht unbegründet, da man mit einfachen technischen Mittel diese problemlos manipulieren kann. Sowohl was dokumentiert werden soll als auch Erstellungsdatum und -Uhrzeit können ohne tiefergehendes technisches Verständnis leicht manipuliert und dementsprechend angezweifelt werden. Auch wie ein rechtlich verwertbarer Screenshots überhaupt auszusehen hat ist nicht allgemein bekannt und kann dazu führen, dass eine Klage nicht möglich wird.

uk: вхід без авторизації


Better Justification for the Web

uk: Комп'ютерні науки

description: The quality of justified text in the web browser in 2020 is still way behind the quality of justified text set in professional dtp software. Why is that? In my talk I explore the reasons from a designer’s perspective. Furthermore I present different approaches for improving the quality of justified text on the web by using advanced line-breaking algorithms and variable fonts. The quality of justified text in the web browser is way behind the quality of justified text set in professional dtp software. There are several reasons for this. Some are systematic (manual line-breaking is impossible in a fluid and responsive environment), some are technical limitations: 1) hyphenation has been a problem for a very long time. 2) There is currently no implementation of advanced line breaking algorithms like the knuth-plass-algorithm in any of the browsers. Why is that? In my master thesis I explored several ways to improve justified text on the web. I achieved significant improvement by applying a javascript-implementation of the knuth-plass-algorithm (by Bram Stein) and by implementing additional parameters such as variable fonts and opentype ligatures. With my short presentation I want to raise awareness for the ongoing problems with justification on the web and demand action from the browser makers.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Eine wichtige Komponente von Freifunk ist die Verfügbarkeit von Firmware für viele Geräte. Diese Firmware basiert bei vielen Communities auf [Gluon](https://gluon.readthedocs.io/). Ein wichtiger Schritt vor der Veröffentlichung einer Firmware für eine Community ist das Testen des Gluon mit den eigenen Anpassungen und der eigenen Konfiguration. In diesem Talk wird eine Implementierung für das automatisierte Testen von Gluon-basierter Firmware auf echter Hardware vorgestellt. Um Gluon in der eigenen Freifunk-Community einsetzen zu können muss Gluon für die eigenen Anforderungen konfiguriert werden. Zu dieser Konfiguration gesellen sich bei vielen Communities noch eigene Änderungen und Erweiterungen. Es bietet sich an, die Summe dieser Anpassungen vor der Veröffentlichung zu testen. Hier vereinfacht die Automatisierung der Tests das Leben und macht diese reproduzierbar. In diesem Talk stellen wir die Architektur unserer Testautomatisierung vor. Diese haben wir in [pytest](https://docs.pytest.org/) geschrieben und führen sie mit [Labgrid (https://labgrid.readthedocs.io/) auf echter Hardware aus. Durch diesem Talk wollen wir andere Communities motivieren selbst Testautomatisierung für Gluon aufzubauen, um so gemeinsam die Qualität von Gluon und Freifunk zu steigern.

uk: вхід без авторизації

name: Der faule Admin automatisiert: Gluon auf echter Hardware testen


uk: Комп'ютерні науки

description: Freifunk München: Jitsi at scale (Freifunk Meet), Wireguard at its best, new datacenters, 10000 tickets, neuer Verein und Ausblick. 2020 war ein Jahr der großen Veränderungen bei Freifunk München. Wir haben ein erweitertes Team, viele neue Unterstützer und mit unserem Jitsi-Cluster Freifunk Meet große, europaweite Aufmerksamkeit bekommen. Zudem haben wir ein neues RZ in Betrieb genommen und unser eigenes ASN als Freie Netze München e.V. realisiert. In unserem Talk geben wir (@awlnx @krombel @pkoerner81929) Euch einen Einblick in unser Setup, ein Blick in die Technik mit vielen TIpps für andere Communities.

uk: вхід без авторизації

name: FFMUC goes wild! Infrastructure Recap 2020


uk: Комп'ютерні науки

description: Nach kurzer Darstellung, was Freie Software ist, wird erläutert, welche Vorzüge sie Anwendern - auch professionellen - bietet und wo Anwender sie bereits einsetzen.

uk: вхід без авторизації

name: Freie Software - Was ist das und was hat der Anwender davon?


uk: Комп'ютерні науки

description: Peter F. Müller, investigative journalist; Paul Reuvers and Marcus Simons, Cryptomuseum Eindhoven; Markus Kompa, writer. Peter F. Müller revealed in February a delicate collaboration between BND and CIA for harvesting SIGINT via backdoors. It turned out that this was just the tip of an iceberg. While researching a documentary about the German foreign intelligence agency Bundesnachrichtendienst (BND), Peter F. Müller came across a top secret document (MINERVA) about a delicate collaboration between BND and CIA. Since 1970 the spy agencies secretly owned and controlled the Swiss based Crypto AG, the world market leader for encrypting devices. They were selling rigged crypto-machines to more then 100 countries in the world and CIA and BND were thus able to intercept and decrypt the diplomatic and military communications from those countries. Peter F. Müller put together an international team of investigative journalists to find out more about this intelligence operation, including Paul Reuvers from the Cryptomuseum in Eindhoven as technical adviser. While the BND is often portrayed as a looser, operation RUBIKON as it was called by the BND was a success story for over half a century. Security expert Prof. Richard J. Aldrich rates the project “as probably the most important intelligence operation in history.” To protect the method the gouvernments of USA and Germany had to pretend blindness even when they learned about war crimes. The revelation in February which was nicknamed #CRYPTOLEAKS raised a political scandal in Switzerland. The story continued when Peter F. Müller revealed a parallel running secret sharing alliance for intercepted information between five European states called operation MAXIMATOR. There is more to come.

uk: вхід без авторизації

name: #CRYPTOLEAKS: How US and German intelligence spied on the world


uk: Комп'ютерні науки

description: I talk about failures of AI/ML, how it more often affects minorities, can even have deadly consequences, what the reason for those failures are and what we can do to prevent this from happening in the future. Nowadays “Artificial Intelligence” is everywhere! And rightly so, it does enable us to do really cool things, things we couldn’t even imagine doing just a decade ago. In fact, it sometimes just feels like magic. This ‘magic’ behind it is often powered by “Machine Learning”. But even “AI” has its limitations. I’ll show examples where “AI” and ML have failed (sometimes with horrible consequences) and will explain why failures are unavoidable in ML but also mention what we can do to reduce them in the future. Furthermore, I’ll showcase how current AI implementations discriminate against minorities and how that in some cases even leads to a higher risk of death for those groups. I’ll cover the bias that humans introduce and I’ll explain how poor choice of data makes our world even more unjust than it already is. The takeaway for the audience: AI can fail and sometimes it has horrible consequences. Why is AI so hard to “do right”? How can we make AI better?

uk: вхід без авторизації

name: Artificial Intelligence? - more like Artificial Stupidity!


Bundesanzeiger Crawling

uk: Комп'ютерні науки

description: Wieso liegen öffentliche Finanzdaten in der Hand von einigen wenigen zahlenden Firmen? Der Bundesanzeiger Verlag ist seit 2006 komplett privatisiert. Unternehmen sind gesetzlich verpflichtet ihren Jahresabschluss über den Bundesanzeiger kostenpflichtig zu veröffentlichen. Der Verlag verdient gleichzeitig am Verkauf dieser Daten, die eigentlich öffentlich zugänglich sein sollten. Wir beleuchten das Problem und stellen die rechtlichen und technischen Hürden vor, die auf einen zukommen, wenn man diese Daten nutzen möchte. Wir hoffen, dass der Bundesanzeiger analog zum Projekt "OffeneGesetze.de" der Open Knowledge Foundation zukünftig öffentlich durchsuchbar sein wird. Unternehmen sind laut § 325 HGB gesetzlich verpflichtet ihren Jahresabschluss kostenpflichtig im Bundesanzeiger zu veröffentlichen. Der Bundesanzeiger Verlag gehört zur DuMont Mediengruppe und ist seit 2006 komplett privatisiert. Grundsätzlich sind die dort veröffentlichten Jahresabschlüsse und weitere Firmeninformationen öffentlich einsehbar, allerdings nur einzeln über eine altbackene Webseite und mit Captcha Schutz. Diese rückständige Veröffentlichung macht es uns unmöglich diese Informationen maschinell zu analysieren, obwohl sie der Öffentlichkeit explizit zur Verfügung stehen sollen. Der Bundesanzeiger besitzt damit ein staatliches Monopol auf eine der wichtigsten Informationsquellen zu deutschen Unternehmen. Neben der Unzugänglichkeit der Daten setzt der Bundesanzeiger Verlag noch einen drauf. Unter dem Namen "Validatis" verkauft er die gleichen Daten, die er öffentlich zugänglich machen soll. Zitat: "Nutzen Sie valide Unternehmensdaten aus erster Hand - passgenau für Ihr Business." Praktisch, wenn jedes Unternehmen gesetzlich verpflichtet ist das Datenmonopol des Bundesanzeigers anzureichern. Wir erzählen von den rechtlichen Stolpersteinen, die der Bundesanzeiger bereithält, wenn man die Daten befreien möchte. Außerdem erzählen wir, wie man die technischen Hürden, um an die Daten zu kommen aus dem Weg räumen könnte. Wir konstruieren einen verteilten Crawler für den Bundesanzeiger, der mittels neuronalem Netzwerk Captchas löst. Disclaimer: Natürlich haben wir den Crawler praktisch nicht eingesetzt, um uns nicht strafbar zu machen.

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Holt euch Personalausweise ohne Fingerabdrücke – solange es geht


uk: Комп'ютерні науки

description: I will go through the steps it takes to make Linux run on an Arm System-on-Chip where it previously didn't run, or only in a terribly outdated vendor fork. Sometimes you find yourself with a piece of hardware that runs Linux, but only a very outdated version of it. In such cases it can be interesting to port a modern version of Linux. I will go through the configuration and drivers you need to write in order to get Linux booting on an Arm SoC: - Early serial port debugging - Devicetree - Interrupt controller drivers - Timer interrupts - etc.

uk: вхід без авторизації

name: Porting Linux to your favorite obscure Arm SoC


uk: Комп'ютерні науки

description: This talk introduces utk-web, a feature-rich firmware image exploration tool that runs in the web browser. Based on [Fiano](https://github.com/linuxboot/fiano)'s `utk`, it aims to support firmware developers and analysts through quick navigation and tricks from the web development world. In addition to the functionalities themselves, a seamless and comprehensible user experience plays a key role. UEFI firmware has become increasingly popular in the industry, not only for x86, but also other architectures such as Arm and RISC-V. The complexity of UEFI requires rich tools to work with firmware images for both assembly and analysis. Closed, proprietary, non-public tools exist, and there are open source tools that can already parse and print out structured information, some offering reassembly features. The [Fiano](https://github.com/linuxboot/fiano) suite from the [LinuxBoot](http://linuxboot.org/) project includes `utk`, the UEFI toolkit. Following a [draft for a web UI](https://github.com/linuxboot/fiano/pull/306), utk-web was created, aiming to visualize `utk`'s output. After about three months of development, it has matured to a level where its usefulness already paid off in multiple occasions. Leveraging additional utilities such as [PSPTool](https://github.com/PSPReverse/PSPTool) and [uefi-firmware-parser](https://github.com/theopolis/uefi-firmware-parser), it is being extended to support others such as [Mimoja's Firmware Toolkit](https://github.com/Mimoja/MFT-AnalyserV2), [MEAnalyzer](https://github.com/platomav/MEAnalyzer) and [UEFITool](https://github.com/LongSoft/UEFITool) as well, potentially even more, depending on demand. What it means to integrate with all of these utilities, how to support different output formats and regions in firmware and how the encountered challenges could be solved conclude this talk.

uk: вхід без авторизації

name: Introducing utk-web - a web developer's view on firmware


uk: Комп'ютерні науки

description: 'No-Code/Low-Code' software by Tiki.org has blurred the lines, allowing for team member participation and engagement on digital and data initiatives on many levels. It goes well beyond many CRM, ERP, PM, etc, offerings which are good at what they do but typically narrow in focus, by giving users a wide mix of hundreds of tools in many categories - Front-end, Back-end, Databases, Admin and Mobile. Big 'Features', supporting 'Features' and countless small but handy plugins all combine, allowing users to literally create any app for any business sector. This less focused and 'utilitarian' nature is more relevant than ever as Tiki resolves a problem so many organizations today are struggling to solve - too many apps with little to no integration between them. Tiki offers so much, in fact, that it allows individuals to become Full Stack Developers - this is my story and where I'm at after using Tiki for over 8 years. However, since it's FLOSS software it also fits developers like a glove, as unlike proprietary 'No-Code/Low-Code' offerings where even developers would need to submit Bug Reports and wait for responses, Tiki allows them to get 'under the hood' and debug complex configurations at their convenience. This presentation briefly covers a few 'No-Code/Low-Code' development tools in each of the 5 categories that Full Stack Developers need, various user roles and the levels on which they can participate as well as gives examples of 'No-Code' and 'Low-Code' within Tiki.

uk: вхід без авторизації

name: Blurring the Lines: Tiki 'No-Code/Low-Code' Empowers: Full Stack Developer without knowledge of any programming languages


uk: Комп'ютерні науки

description: The Collabora Online code-base can bring the power of LibreOffice into an iframe inside your web app. Come and hear how we've made that power even prettier and more functional for your user's delectation. Collabora Online is super-easy to integrate with content management applications, come see some pictures of many successful integrations. Understand how the product works, scales and can bring a very easy to deploy bundle of interoperable document beauty to your application. See the internals of Collabora Online, and checkout how you can get involved with building, debugging, and developing it. Hear about our growing community, and all the changes we've done to make life better for our users, integrators and contributors in the last year.

uk: вхід без авторизації

name: Collabora Online for your documents: Hear how we have been improving Online's UX, features & community


uk: Комп'ютерні науки

description: The Interpeer Project attempts to provide the technical underpinnings for a human centric next generation internet. As sensors and compute nodes are now (close to) ubiquitous, it follows that there is no longer a static or traceable relationship between ownership of a physical processing unit and the personal identifiable data it processes. A future internet architecture must take this into account, whilst respecting and protecting user's privacy and data protection concerns, also from a regulatory point of view. At the same time, sharing data in this proliferation of processing units also favours distributed approaches over the web's decentralised architecture. This session outlines the future the Interpeer Project envisions, and reports on achieved outcomes to date. The Web has was designed with sharing of textual information in mind, and has by now outgrown this purpose. In the academic context in which it was conceived, and considering the technical constraints of the time, it made sense to design a centralised protocol for up- and downloading documents to a server managed by an institution or company. The Web has long evolved away from this, and added authentication, authorization and encryption as natural afterthoughts to the original design. Nowadays, we share more than documents. Our concept of sharing has evolved (for better and worse) from only adding to the public domain to selectively trusting groups or individuals with specific pieces of information. While services built on web protocols can and have modelled this new concept, it remains difficult to do well. This and financial incentives combined push developers to instead adopt half measures, whereby a central instance - the webserver and its legal owners - act as intermediaries to the process, weakening the sharing model to commercial, state or criminal exploitation. There are excellent organisations fighting to amend legislations to close such loopholes. The Interpeer Project recognizes that aside from the legal struggles, the practical consideration remains that it is much simpler for developers to build centralised, vulnerable products than those safe by design. It aims at making safe data sharing applications as easy or easier to build by starting from the ground up, and embedding the security and synchronization concepts for a highly distributed network directly into a new and open protocol stack. Empowering users in the context of this project means enabling them to do everything they're currently used to and more, but safely and without the strict need for centralised infrastructure.

uk: вхід без авторизації

name: Designing a human centric next generation internet: Vision and progress on the Interpeer Project


uk: Комп'ютерні науки

description: With the global pandemic, many teams have turned to remote work on a full-time basis. Prior, the XWiki team had been working distributively, building open-source software, for over 15 years. Some of us were working remotely full time. Other colleagues opted to go to the office. The majority of the team chose to blend the two, depending on their preferences and needs. Almost a year on, what seemed a temporary change feels like a permanent arrangement. Being able to work entirely remotely has been, in many ways, a privilege. But collaborating during a pandemic is not business as usual. This talk reflects on the specific challenges we faced, the changes and tools we implemented to address them, and the ways we tried to support each other through this uncertain period. While there’s no one size fits all, we hope sharing our experience will prove useful for teams navigating similar challenges. We’re in this together.

uk: вхід без авторизації

name: Lessons learned while collaborating remotely in a global pandemic


uk: Комп'ютерні науки

description: Using a new collaboration tools can be a challenge when it comes to pre-existing information. In this talk, we will look at available solutions when migrating data to the XWiki Open Source software. We will first review the differences between XWiki and alternate systems, namely Atlassian Confluence, Microsoft Sharepoint and document management systems. Secondly we will show multiple approaches to migrating data into XWiki and improving the quality of the information available. Finally we will demonstrate existing importing tools available in XWiki: Confluence Import & XWiki Batch Import.

uk: вхід без авторизації

name: Importing data in an Open Source Wiki: Move your data to XWiki from Confluence, Sharepoint or Document Management Systems


uk: Комп'ютерні науки

description: Two years ago I showed how to use XWiki as a development platform to build collaborative content centric applications while last year I did a short demo about how to use XWiki to setup a collaborative intranet in just 20 minutes. This year I propose a demo about how to create a public website with XWiki, and use XWiki like a content management system (but a collaborative one). The appeal of XWiki for such a usage is the possibility to integrate all usages in a single tool (intranet - see last year's talk - or any other content centric collaborative platform - see the talk from 2 years ago), while not completely missing the presentation features of "classical" content management systems.

uk: вхід без авторизації

name: From 0 to public website in 20 minutes with XWiki


uk: Комп'ютерні науки

description: SemApps is a collaborative, interoperable, generic and modular knowledge management system : Based on linked data & semantic web technologies and the SOLID specification, it allows the co-production of knowledge graphs. Built on open standards, it enables the development of interoperable information systems. Designed on a modular architecture, it gives everyone the opportunity to build and customize platforms on demand. SemApps is an open-source software project whose development is coordinated by the Virtual Assembly (VA), a French-based non-profit organization bringing together about fifty developers and activists. In a context of strong fragmentation of dynamics in the field of transition, VA aims to develop commons (digital tools, methodologies and projects) to promote the interconnection of transition movements. SemApps is one of the Virtual Assembly's core projects. Its mission is to foster interconnections between communities by creating synergies between their information systems. SemApps is a collaborative, interoperable, generic and modular knowledge management system : - Based on semantic web technologies and the SOLID specification, it allows the co-production of knowledge graphs. - Built on open standards, it enables the development of interoperable information systems. - Designed on a modular architecture, it gives everyone the opportunity to build and customize platforms on demand. Its code is released under the Apache 2.0 free license.

uk: вхід без авторизації

name: SemApps: A (Linked-)Data Management System based on SOLID and the semantic web: Fostering interconnections between communities by creating synergies between their platforms


uk: Комп'ютерні науки

description: Coriolis is a suite of software for taking chip designs and turning them into ASICs (aka VLSI design). It is silicon-proven, having been used with Alliance auto-scaleable nsxlib Cell Libraries to produce ("tape out") NDA-free GDS-II files that resulted in successful working 180nm ASICs, and has been used in ASICs up to 800k gates. The input is HDL (verilog, VHDL, and yosys RTLIL) and the output is 100% complete GDS-II, with IO pads, cells, SRAMs all fully "Placed and Routed", ready for ASIC manufacture. However unlike traditional P&R software (which may or may not have had, at some point in its development, a scripting language added as an afterthought), coriolis2 is written in a hybrid of c++ and python modules. Layout is done not by a file format that must be loaded by a GUI: layout for each ASIC is actually a python program that, through the coriolis2 python modules imported by that program, reads the HDL, reads the Cell Libraries, and, fully under parametric programmatic control, creates the layout. This talk provides a demo walkthrough of coriolis2 in action, to produce an actual GDS-II layout including the IO Ring and IO Pads.

uk: вхід без авторизації

name: Alliance / Coriolis2: parametric programmatic ASIC Place and Route using python


uk: Комп'ютерні науки

description: The architecture, engineering, and construction industry is a vast, diverse, but highly proprietary field. The primary means of data exchange between architects, structural, MEPF engineers, cost planners, surveyors, program schedulers, asset/facility management and more revolve around a concept known as Building Information Modeling (BIM) in addition to CAD. Many of these tools do not exist as free software, or are drastically better, or are dominated by a monopoly vendor market with lock-in business practices. Free software implementations of BIM have seen rapid growth in the past year, with new utilities available for OpenBIM building models, quality auditing, diffing, clash detection, issue management, facility management, environmental simulation, and more. This is supported by a newly formed community known as OSArch. Dion Moult, a main developer of the BlenderBIM Add-on, IfcOpenShell contributor, and one of the OSArch founders, will present a summary of these events, demonstrate how free software communities have collaborated and shared resources, and where this leads in the future. The BlenderBIM Add-on was recently awarded the buildingSMART 2020 Awards in Technology, the international standards body for BIM.

uk: вхід без авторизації

name: The growth of free software in Building Information Modeling for architects, engineers, and construction: A summary of free software developments related to OpenBIM, OSArch, IfcOpenShell, the BlenderBIM Add-on, FreeCAD, and more


uk: Комп'ютерні науки

description: During this short talk, I will introduce CADCloud an online platform tightly integrated with FreeCAD and designed to manage version tracking and user collaborations in CAD. CADCloud aims to create a reference database of 3D models generated by FreeCAD users and allow them to easily handle their lifecycle and sharing. CADCloud is new online platform designed under an MIT licence, and hosted by the Open Compute Project. It aims to ease collaboration between CAD user around the world, share models and display them directly into a web browser. Full lifecycle management is under implementation. The platform leverage FreeCAD open file format, and is tightly integrated into it within version 0.19 through the Cloud workbench. The source code is free, open and can be self hosted.

uk: вхід без авторизації

name: CADCloud building an interactive online version control system for FreeCAD


CadQuery Assembly System

uk: Комп'ютерні науки

description: CadQuery (CQ) [1] is a Python library for building of parametric 3D models. The overarching design goal is to provide a fluent API that enables the user to express the design in a natural way. CQ is based on the open source CAD kernel from OpenCascade [2] and therefore offers industry standard B-Rep modeling capabilities and allows exporting to STEP and many other formats. With the upcoming 2.1 release [3] there many improvements coming to CQ. I will briefly summarize them but will focus on the new assembly system. The new CQ version allows the user to combine individual CQ objects into an assembly with the possibility of nesting. The individual object positions can be specified manually in terms of constraints that are solved using a numerical solver. Once an assembly is defined and all the positions specified it can be exported to STEP preserving the assembly structure or an internal OpenCascade XML format. In the I will discuss the current assembly system design, capabilities, limitations and possible future development directions.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: A discussion about the positive user developer interaction in an open source development environment. -presentation of the LinkStage3 dev. branch of freecad -short summary of differences between LinkStage3 and master -short presentation of the most exciting new features introduced in this branch -how the future might look for FreeCad and how to make that future a reality as far as merging those features in master

uk: вхід без авторизації

name: FreeCAD on steroids. A possible future. Featuring Zheng, Lei aka RealThunder.: Outcome of brilliant developers meeting user feedback.


KiCad Project Status 2021

uk: Комп'ютерні науки

description: Update on the KiCad project including the recent events, the upcoming version 6 release and what to expect during version 7 development.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In this presentation, we will give an overview of the state of libre mechanical software. What are some of the programs out there? What can be done with them? Of course, this task cannot possibly include every program out there, there are too many! However, with the most common tools we can get a good idea about the environment that is currently available to users. We will also discuss how are we currently doing and what the future may bring us. The structure is as follows: 1. Disclaimer 2. CAD 3. CAM 4. Meshing 5. Simulation 6. Visualization 7. HVAC and energy analysis 8. Extras 9. Current status (bad and good things) 10. Moving forward

uk: вхід без авторизації

name: A (very) quick overview of libre mechanical software


uk: Комп'ютерні науки

description: ngspice development is heading towards the ngspice-34 release. Three major activities are to be reported: We have integrated the high frequency bipolar model HICUM-2.4 from TU Dresden, Germany into the C sources of ngspice. Efficient simulation of GHz circuits becomes possible. ngspice has been adapted to efficiently serve the upcoming Open Source Skywater 0.13um CMOS PDK. adms for ngspice has been enhanced to allow integrating Berkeley BSIM Bulk and CMG models. Application examples will show the use of the ngspice statistical functions and control language for Monte Carlo simulation.

uk: вхід без авторизації

name: ngspice, status update and Monte Carlo simulation


uk: Комп'ютерні науки

description: KiCad has become a professional tool that can easily replace many commercial EDA packages. However, most companies will have many years worth of designs in propietary file formats requiring a significant amount of manual effort if a migration to KiCad is desired. Ideally KiCad would be able to import from every EDA tool, but this is a time consuming task requiring help from motivated contributors. This talk will cover the information necessary to develop an importer for KiCad, in the context of the CADSTAR importer that has been recently developed. Topics will include: - Reverse engineering an ASCII-based file format (Using the CADSTAR Archive format as an example) - Deep-dive into the inner workings of KiCad's PCB and Schematic importers - Overview of the necessary steps required to develop your own importer

uk: вхід без авторизації

name: Importing into KiCad from CADSTAR: ...and how you can develop your own importer


uk: Комп'ютерні науки

description: KiCad 6 features a new real-time netlisting system that is used to determine connectivity between items in schematics as the user draws them. Previously, netlisting in KiCad was a relatively slow operation that only took place when commanded by the user. I will discuss the motivations behind this system, some details of its implementation, benefits it brings, and some opportunities for future improvements. Netlisting is the process of generating a set of connected items from a schematic drawing. Traditionally this was needed for creating a "netlist" for PCB layout: a list of electrical nets, and all the component pins that are part of each net. We now also use this term in KiCad to refer to determining which graphical objects in a schematic are electrically connected to each other. This includes the component pins that are part of a traditional netlist, but also things like graphical wires and labels that are used to connect pins to each other.

uk: вхід без авторизації

name: Real-time Netlisting in KiCad: Motivation, Implementation, and Benefits


uk: Комп'ютерні науки

description: Ever found an interesting PCB design, but you are not able to open it with your favorite program? The world of EDA file formats is divided by vendors, with low flexibility to move from one program to another one. The design is for a proprietary program? Well you need to either buy the program, or hope to convert it to your favorite file-format using an error-prone conversation process. Not ideal, but better than nothing. This talk will show you the basics to write an importer yourself, with focus on reverse-engineering of the questionable file-format. Thus, going from seemingly arbitrary zeros and ones to the basic file structure and the actual data such as a track. While this is quite easy for text-based files such as the KiCad file format, binary files can be seen more like a puzzle to solve.

uk: вхід без авторизації

name: Reverse-Engineering of (binary) File-Formats: From seemingly arbitrary zeros and ones to a PCB file.


uk: Комп'ютерні науки

description: Presentation of the new features in sparselizard 202012. They include adaptive mesh refinement, interpolation order adaptivity (hpFEM), time-adaptivity, speedups, syntax optimization, link to gmsh, move to cmake and a large number of added functions.

uk: вхід без авторизації

name: Sparselizard: a general purpose multiphysics FEM c++ library


Evolving vulnerabilities in CycloneDX

uk: Комп'ютерні науки

description: CycloneDX is a software bill of materials (SBOM) standard designed for use in application security contexts and supply chain component analysis. It's developed in the open and widely implemented in open source tooling. As well as quick introduction to CycloneDX, this talk will look in particular at the vulnerability extension. Modelling vulnerabilities in software is surprisingly complex. In this talk we'll look at some of the current issues in the CycloneDX vulnerability extension, summarise some of the ongoing discussions in this area, and get people's input on proposals for improvements. No prior knowledge of CycloneDX will be required for this session. The basics of the specification are simple enough for folks interested in Software Composition Analysis to grok quickly. The main aim of the session is to raise awareness of the open specification and the process around it, and get more eyes on future improvements. The audience should come away with some insight into why CycloneDX is useful, why open standards are important and how to get involved in the project.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In this session we will demonstrate how to write a license policy in OSS Review Toolkit to automatically check the licenses found in a project and its dependencies. One of the reasons OSS Review Toolkit was started by its creators was a need to go beyond the usual allow/deny license policy in most SCA tools. For instance we wanted to be able to write checks with multiple levels of compliance depending on what was being reviewed or based on package meta data. In this session we will demonstrate how one can write license policy with checks/rules that take into account package metadata date or the code, license and product context.

uk: вхід без авторизації

name: Automating your license compliance policy with OSS Review Toolkit


uk: Комп'ютерні науки

description: SW360 is a Web application for managing the software bill-of-material ("SBOM") of software projects and products. It is an Eclipse project licensed under the EPL-2.0 and thus available for everybody as Open Source Software. The application has a Web UI and REST endpoints for entering or importing the SBOM from dependency or package management systems. In addition, the import of SBOM files using the SPDX spec is supported. Based on the imported SBOM or a software project, a number of functionality is possible, ref to management of vulnerabilities, license and trade compliance or statistics about component usage. The submitted talk introduces and presents SW360. SW360 is an open source software project licensed under the EPL-2.0 that provides both a web application and a REST API to collect, organize and make available information about software components. It establishes a central hub for software components in an organization. SW360 allows for tracking components used by a project/product, assessing security vulnerabilities, maintaining license obligations, enforcing policies, and maintain statistics. For example, SW360 can trigger a license scan process in the open source compliance tool FOSSology and import the resulting clearing reporting. Data is either stored in SW360’s database or on the fly imported from external sources. In future we plan to have federations of SW360 instances that share selected information. Besides its web-based UI, all functionality of SW360 is available through an API that allows an integration into existing devops tools.

uk: вхід без авторизації

name: Eclipse SW360 Presentation: Web application for managing software Bill-Of-Material


uk: Комп'ютерні науки

description: The very short time is some placeholder between presentation groups to have questions being asked and answered or just simple to have a break.

uk: вхід без авторизації

name: OSS Projects Update - Concluding Q&A: This slot is for Q&A covering the preceding presentations


CycloneDX Software Bill of Materials

uk: Комп'ютерні науки

description: This presentation will give a quick introduction to CycloneDX. CycloneDX is an open source software bill of materials specification. A software bill of materials provides unique benefits which complement those provided by traditional software composition analysis. This will be discussed along with some of the tooling available to make production and consumption of SBOMs manageable at scale.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: What is a software bill of materials, and why is there all the interest about it? In this session, a quick overview of the minimum viable fields to represent an SBOM, and efforts to help with automation of them.

uk: вхід без авторизації

name: Overview: Software Bill of Materials (SBOM)


uk: Комп'ютерні науки

description: Container and VM images contain many packages and are quite a challenge for composition analysis. The current industry standard for container compliance is to scan container images after they have been created in order to create a Software Bill of Materials (SBoM). Tern is an open source inspection tool that creates an SBoM for this very purpose. As the complexity of Cloud Native applications and the containers they are shipped with increases, however, the need for a better compliance strategy presents itself. This talk will discuss the current state of Cloud Native compliance practices and the efforts by the Open Source Technology Center at VMware to tackle these issues. This includes the work on the SPDX 3.0 linkage profile, building containers with intrinsic SBoMs, and feature implementations in Tern to support intrinsic compliance for container images.

uk: вхід без авторизації

name: Tern and the State of Cloud Native Compliance


uk: Комп'ютерні науки

description: A Software Bill of Materials (SBoM) can communicate details about a software package's contents, as well as the inputs and sources that were used to build it. However, SBoMs created by manual processes can often be incomplete, incorrect or out-of-date as a software package evolves. Effective use of SBoMs will typically require creating them during the build process itself using automated tooling. In this talk, I will present a proof-of-concept for generating an SPDX SBoM for CMake-based projects. I will discuss an experiment with leveraging the CMake file-based APIs to automatically create SPDX 2.2 SBoMs. The generated SBoM includes relationships to denote which source files were used as inputs for the corresponding build artifacts. I will present this in the context of the Zephyr project, an open source RTOS for embedded systems that leverages CMake. I will briefly discuss this proof-of-concept, some early results from it and thoughts for next steps.

uk: вхід без авторизації

name: Automating creation of Software Bills of Materials: Generating SPDX documents for CMake and Zephyr


uk: Комп'ютерні науки

description: Collaborations between open source projects and designers are difficult. Instead of focussing on a lack of tools or skills, I want to show that the difficulties are also rooted in different views on what makes a "good" user and a desireable mode of collaboration. Open Source projects, prototypically, focus on the developer/user who scratches an own itch and coordinates in an stigmergic, bazaar-like way, while design usually focusses on expertise in designing for others and a plan/execution model instead. While no easy fix can resolve these differences, I want to suggest some ways to ease communication for developers and designers.

uk: вхід без авторизації

name: The user in the cultures of UX design and open source


uk: Комп'ютерні науки

description: VulnerableCode is a free and open source database of vulnerabilities and the FOSS packages they impact. It is made by the FOSS community to improve the security of the open source software ecosystem. It’s design solves various pre-existing problems like licensing, data complexity and usability. Using software with known vulnerabilities is one of OWASP’s Top 10 security vulnerabilities . This is increasingly becoming more important as more and more software is built on top of existing free and open source software. From the perspective of software composition analysis, it then becomes increasingly important to know about vulnerable components being used. Naturally a database of mappings of packages and their vulnerabilities is required. Below are some of the problems with existing solutions and how VulnerableCode solves these.

uk: вхід без авторизації

name: Building the world’s first free open source database of FOSS and their vulnerabilities.: Learn why and how we are building VulnerableCode, a free and open source database of FOSS components and their vulnerabilities.


uk: Комп'ютерні науки

description: This presentation introduces the devroom on software composition - an emerging topic on understanding what softare is being made of.

uk: вхід без авторизації

name: Software Composition Analysis Devroom: Welcome


uk: Комп'ютерні науки

description: Software Composition Analysis (SCA) tools perform source-code analysis, comparison and identification of Open Source components. Sadly, none of the SCA vendors have embraced Open Source themselves, most of their tooling consists of proprietary code and their OSS Knowledge Bases are also closed. Software Composition Analysis (SCA) tools perform source-code analysis, comparison and identification of Open Source components. Sadly, none of the SCA vendors have embraced Open Source themselves, most of their tooling consists of proprietary code and their OSS Knowledge Bases are also closed. Most SCA vendors target large organizations, are expensive, and generally not economically viable for smaller companies who might be a critical part of larger software distribution chains. Smaller companies for these reasons can’t get access to proper SCA tooling, and large organizations will have to carry the expense of auditing their suppliers. Leading to a higher cost of OSS governance, no ability to compare results, exclusion of the OSS community behind a license-fee and a reliance on external auditing. With this proposal we aim to contribute a free, standardized and 100% open alternative.

uk: вхід без авторизації

name: SCANOSS: Democratising Open Source Risk Management: Open Source Inventorying designed for modern development (DevOps) environments


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Usages of Software Composition - Concluding Q&A: This slot is for Q&A covering the preceding presentations


uk: Комп'ютерні науки

description: In this talk I want to present the recently open sourced deepscan tooling, which allows the comfortable analysis of repositories for effective licenses, copyrights and known files. I will show how the tool is structured and how it works. How the similarity analysis is used and what the current results are. Also I will demonstrate how the free analysis service can be used and how it may be used to review and re-assess findings.

uk: вхід без авторизації

name: TrustSource DeepScan: Gaining insights and profit from sharing


OSS Review Toolkit - project update

uk: Комп'ютерні науки

description: In this session we will provide an update on OSS Review Toolkit (ORT) - which features have been recently added and what they ORT team is currently working on.

uk: вхід без авторизації


FOSSology SCA integration

uk: Комп'ютерні науки

description: FOSSology focusses on license compliance analyses. Recently, a number of new features have been published by the community to integrate better with software composition analysis. The presentation shows an introduction of the main and relevant development here. FOSSology is considered as one of the leading Open Source tools when it comes to license compliance. There are various ways with which someone can analyze a package in FOSSology. One can either do it manually or can do it programmatically. As the industry is heading towards automation, programmatic approach based on software composition analysis is more preferred and becomes more advantageous. Currently, FOSSology provides 3 different ways to integration with software composition approaches: utilizing FOSSology CLI tools, use one of the client libraries and from the REST API. The presentation will help by providing different strategies which can be used to automate analysis of software components in an automated environment. We will see how one can use the CLI tools of FOSSology or other FOSS projects built on FOSSology's REST API to push packages for analysis. We will also see how the enhanced API can provide much more information about a package and how analysis can be triggered on-demand. Finally, we will touch upon how one can gather the package information in a neat report for auditing.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This is a presentation of the latest features and updates in ScanCode toolkit and its companion projects. ScanCode toolkit is an open source scanner that thrives to provide best-in-class license, copyright and package manifest detection and data collection. This session presents the current, latest and upcoming features and developments, as well as new projects, data and tools to enable FOSS SCA.

uk: вхід без авторизації

name: ScanCode: FOSS Software Composition Analysis: Open source scanning


uk: Комп'ютерні науки

description: The Double Open project is developing an open solution for automating open source compliance in the Yocto build system, and embedded Linux systems as the wider target. The developed tooling utilizes the SPDX file format as its data storage throughout the pipeline to enable strong modularity and interoperability with other tooling. In this talk we are going to present a general overview of the pipeline.

uk: вхід без авторизації

name: Double Open: An automated open source compliance pipeline for Yocto built on SPDX: Automating embedded Linux open source compliance with open tools


uk: Комп'ютерні науки

description: Running Linux containers (e.g., Docker) on macOS is currently implemented with using Hypervisor.framework (or similar VMM) by hosting a (thin) Linux guest, and users operate it from the host macOS via same command-line interface. We go beyond this complete framework by exploiting library-OS/unikernel idea in a container runtime. We ported containerd to macOS first (*1), which is currently under review, and run Linux applications with Linux Kernel Library (LKL), a library version of Linux kernel, which have no compatibility concerns as LKL is derived from Linux kernel. As a bonus, we benefit from the extensibility of the kernel components of Linux containers (as Kata containers does), while keeping low resource footprint of containers (as Nabla or other unikernels implementations can). Because the containerd port is still undergoing, we aim this talk at giving a broader view the pull request, with why we've been worked on for this direction, how it internally works, what benefit we can obtain, and where we are moving forward. We will also give a simple demonstration of running Linux containers on macOS (on Intel but hopefully on arm64 if it's getting ready).

uk: вхід без авторизації

name: containerd port to darwin: Toward Running Linux containers on macOS


uk: Комп'ютерні науки

description: What if we told you that there is a way to build a powerful kubernetes cluster that can perform data-center-class workloads in a form factor that you can run at your home, under your lab bench, or at a conference. What if we further told you that this hardware comes from a sustainable supply chain that will lower the carbon footprint of computing. This talk will detail an open hardware design, built for a "home" form factor, with a chassis that can hold from 4 to 12 nodes; that contains almost 100 compute cores; 2TB of memory; and over 30 TB of storage. Join us for an overview through photos, video demonstration, and chats with the designers. Perhaps you work with scalable computing technology every day in far-off data centers or hosted in public clouds. What if you could have similar computing capability in your home, in your home lab, or in the premises of your small organization or business? What if you could run 1000s of containers in under 2000 watts? There are many reasons, from latency limitations, to cost constraints, to concerns over data sovereignty that might require the deployment of on-premise computing. We will overview and demonstrate a new computing form factor that brings a data center class cluster using hyperscale technology that you can plug into your home's power outlet. We also integrate these clusters using materials from the circular economy, building on a sustainable supply chain that decomposes servers from top tier data centers and builds new products based on open designs. The power of open hardware and open software creates the possibilities of executing many compute intensive workloads in diverse locations without the need of a data center. This talk will demonstrate on open hardware design for a powerful deskside chassis that can hold from 4 to 12 nodes of scalable computing running from a single 110V/220V outlet and hosting a range of elastic k8s container workloads. Our short talk will include video demonstration, photos, and Q&A with the system designers.

uk: вхід без авторизації

name: Datacenter class containers for the masses


uk: Комп'ютерні науки

description: BPF is becoming ubiquitous in today's modern container environments and thanks to the fast pace of innovations from Linux kernel developers in the BPF subsystem, cloud native networking software such as Cilium is able to bring these extensions to a mainstream user base for improving throughput, latency and reliability of workloads and services. This talk provides a deep dive on recently added BPF kernel as well as Cilium extensions for Kubernetes environments which significantly reduce application tail latencies with the help of the earliest departure time (EDT) model for egress bandwidth management. Furthermore, recently added BPF redirection helpers are discussed which offer a low-latency switch into Pod network namespaces. Last but not least the talk also covers how Cilium's BPF kube-proxy replacement improves reliability for its high-performance XDP-based north-south service load-balancing through a BPF-based Maglev consistent hashing implementation. We'll discuss our path towards implementing these features, our lessons learned as well as future follow-up work.

uk: вхід без авторизації

name: Advanced BPF kernel features for the container age


uk: Комп'ютерні науки

description: On most POSIX systems including Linux file ownership can only be changed globally, i.e. for all users through the chown*() syscall family. In this talk we will introduce idmapped mounts. Idmapped mounts allow to change the ownership of files under the mounts they appear in. File ownership is a global property on most systems that have a uid and gid concept. On POSIXy systems the chown*() syscall family allows to change the owner of a file or directory. If the ownership of a file is changed it will be changed for each user on the systems equally. But various use-cases exist where this can be problematic: - Portable home directories that are used on different computers where the user is assigned a different uid and gid. - Filesystems that allow to merge or unionize multiple filesystems are often shared between different users. - On Linux user namespaces used in containers also affect file ownership. - Chowning files on really large filesystems is costly. Idmapped mounts solve these problems and others by allow bind-mounts to specify idmappings allowing to change file ownership on a per-mount point basis. In this talk we will take a close look technical at the idmapped mount patchset, the use-cases it is intended to solve, and we will demo it's capabilities.

uk: вхід без авторизації

name: Idmapped Mounts: Flexible file ownership


uk: Комп'ютерні науки

description: DBaaS is the fastest growing way to deploy databases. It is fast and convenient and it helps to reduce toil a lot, yet it is typically done using proprietary software and tightly coupled to the cloud vendor. We believe Kubernetes finally allows us to build fully OpenSource DBaaS Solution capable to be deployed anywhere Kubernetes runs - on the Public Cloud or in your private data center. In this presentation, we will describe the most important user requirements and typical problems you would encounter building DBaaS Solution and explain how you can solve them using Kubernetes Operator framework.

uk: вхід без авторизації

name: Hybrid Cloud Open Source DBaaS with Kubernetes: Keeping Control of your data