uk: Комп'ютерні науки

description: The commonalization of desktop, phone & tablet, with the goal of providing the most user-friendly shell to the hands of users. With years of development behind it and a strong community of enthusiasts around it, Lomiri is well positioned to provide a delightful experience to both power users as well as ordinary users, powered by future-proof technologies. In this presentation he will demonstrate how over the last 5 years Ubuntu Touch convergence has evolved from vision to reality. Switching from the custom windowing protocol it used to a commonly shared one, adapting to the defacto-standard systems layer for GNU/Linux systems, software pieces that work in tandem to provide UI features such as workspaces with window snapping and resolution specific window scaling, and managing app lifecycles in a scenario-based way.

uk: вхід без авторизації

name: Lomiri Mobile Linux in Desktop mode: Lomiri and the myth of the pocket size desktop computer


Luca Weiss

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Porting mainline Linux to new Qualcomm SoCs seems like a daunting task but it actually isn't too bad! Let's take a look into the support of the Fairphone 4, which is based on the Qualcomm Snapdragon 750G, what is working after about 1.5 years of working on it and what is still missing.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: Mainline Linux on recent Qualcomm SoCs: Fairphone 4: A look into the work of getting a modern Qualcomm SoC into mainline Linux.

FOSDEM VZW

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


meta netdevices

uk: Комп'ютерні науки

description: In this presentation we deep dive our path into achieving host networking performance characteristics for containers and Kubernetes Pods. As part of that we developed a veth driver replacement called meta devices which can be made programmable through eBPF. We outline the design of this driver, benchmarks with flamegraph comparison and next steps for upstreaming.

uk: вхід без авторизації


Mobian: to stable... and beyond!

uk: Комп'ютерні науки

description: Over the past 3 years, Mobian has grown from a one-person hobby project to one of the main actors in the mobile Linux community. As we're preparing for the upcoming release of Debian 12 (bookworm), and the first Mobian stable release (shortly) following it, we want to share our plans for this transition and the future of Mobian and Debian on mobile devices. Back when Debian 11 (bullseye) was released, both the Mobian project and the mobile ecosystem were still young and lacked maturity. We therefore chose to stay an in-development, rolling-release-like distribution based on Debian testing. Fast-forward 2 years, Linux-based mobile phones have become more and more usable, the ecosystem has gained a lot of maturity and the Mobian team has been working towards reducing our delta with upstream Debian, both through upstream contributions and by maintaining Mobian packages directly in Debian. We feel it is now time to switch to a more usual (at least in the Debian world) stable+testing release and development scheme, and will detail during this talk how we plan to do so. We will more specifically emphasize our past and present contributions to Debian, as well as our goals and plans for the next development cycle (trixie).

uk: вхід без авторизації


uk: Комп'ютерні науки

description: For years, the privacy engineers at Mozilla have known that online trackers use every identifier they can get to track and re-identify people all over the internet. In this talk, I'll give an overview of the work we've done over the years to protect more and more of these identifiers, and where we are now.

uk: вхід без авторизації

name: Over a decade of anti-tracking work at Mozilla


uk: Комп'ютерні науки

description: Presentation and background on recent work by the Accessibility team to improve performance, and the on-going collaboration with the Performance team to measure and quantify it. Includes overview of architecture, metric shaping, and current results of this ongoing project. After this presentation, a segway into a more-open ended discussion about accessibility and perceived performance, with input from audience members about current pain points and ideas for future work.

uk: вхід без авторизації

name: Cache The World: Adventures in A11Y Performance


uk: Комп'ютерні науки

description: Europe’s new rulebook to ensure safe, ethical and transparent online spaces, the Digital Services Act (DSA), entered into force on November 16th. In a few months, this regulation will apply to a range of digital services operating in the EU, from intermediary and hosting services to social media platforms and search engines. The DSA will require big changes from the biggest players in social media and search (those with over 45 million ‘active monthly users’ in the EU); content moderation capacities, data access transparency tools and annual audits will now be mandated and governed. This groundbreaking text is the first of its kind, and has already inspired both legislation and voluntary corporate practices around the world. This lighting talk will speed through the major implications of the DSA and the changes big tech is likely to roll out in response. On October 27, the Digital Services Act was published in the Official Journal of the EU, culminating years of legislative and advocacy effort. The regulation will impose a sweeping new regime imposing transparency and accountability requirements on digital services operating in the EU. The DSA is asymmetric in structure, with the largest obligations falling to the largest platforms and search engines - those with a systemic role in society. Specifically, these big players will need to - improve content moderation capacity and reporting mechanisms - provide access to data for vetted researchers - assess and mitigate their systemic risks - have annual third party audits - abide by relevant codes of conduct - ban targeted advertising on online platforms by profiling children or based on special categories of personal data such as ethnicity, political views or sexual orientation - provide a recommender system not based on user profiling (under the GDPR definition) - refrain from ‘dark patterns' on their interfaces Against the backdrop of Elon Musk’s acquisition of Twitter and Meta’s gutting of its transparency tool Crowdtangle, the DSA is the EU’s promise to reset a big tech ecosystem.

uk: вхід без авторизації

name: The Digital Services Act 101: What is it and why should you care


uk: Комп'ютерні науки

description: How much power is used by Firefox every day? What is it used for? What is the carbon footprint? Come learn how we get data on these topics, and what can we do about it! With insights from telemetry and power profiling, the presentation will show how much power is used by various parts of Firefox, explain what we have done to reduce power use, and share ideas we have to improve further.

uk: вхід без авторизації

name: Understanding the energy use of Firefox: With less power comes more sustainability


uk: Комп'ютерні науки

description: Like many programming communities, the Java community lacks a simple open-source profiling UI. In the quest to build such a UI, I found the Firefox Profiler to be the closest to an adaptable polyglot profiling UI. This talk presents my Java JFR Profiler plugin for IntelliJ and gives an overview of how to adapt and integrate the Firefox Profiler to use it to view profiling data from different sources, like JDK Flight Recordings.

uk: вхід без авторизації

name: Firefox Profiler beyond the web: Using Firefox Profiler to view Java profiling data


The Road to Intl.MessageFormat

uk: Комп'ютерні науки

description: The internet is global, and its future is by no means written or spoken only in English. With the upcoming Intl.MessageFormat addition to JavaScript, we're making it easier than ever to write and maintain apps and systems that not only speak your language, but also the languages of your users. To do that, we're redefining how localisation really works, and building a system that's interoperable with all existing data formats, workflows and processes, as well as (hopefully!) all the ones we can't even imagine yet. Let me show you this new world, and where it might lead us.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Mozilla Pontoon is a translation management system used and developed at Mozilla. It specializes in open source localization that is driven by the community and uses version control systems for storing translations. Since Pontoon code is available under the BSD license, it is also used externally. In this talk you'll learn how Pontoon works and how you can set it up to localize your own software project.

uk: вхід без авторизації

name: Localize your open source project with Pontoon


uk: Комп'ютерні науки

description: Multipath TCP (MPTCP) support in the Linux kernel has started in v5.6. At that time, only a single path could be used. The MPTCP development community has steadily expanded from the initial baseline feature set to now support a broad range of MPTCP features on the wire and through the socket and generic Netlink APIs. An overview of MPTCP will be presented with an explanation of what is possible today in the Linux kernel and what should come next. The development of MPTCP in the Linux kernel is particular and has not been directly available on a vanilla kernel. Indeed, after 10 years of experimentations on the side -- in an Open-Source "out-of-tree" kernel -- the implementation has been rewritten (almost) from scratch to get an "upstreamable" result that is still being improved today. On the other hand, the out-of-tree kernel was and is still used today in production on large deployments with million of users. Maintaining this out of tree kernel with more than 21k modified lines for each different LTS version has a cost and also introduce some risks and complex situations that are interesting to share.

uk: вхід без авторизації

name: MPTCP in the upstream kernel: A long road that started almost 15 years ago


Fear the mutants. Love the mutants.

uk: Комп'ютерні науки

description: Code coverage (the percentage of your code tested by your tests) is a great metric. However, coverage doesn’t tell you how good your tests are at picking up changes to your codebase - if your tests aren’t well-designed, changes can pass your unit tests but break production. Mutation testing is a great (and massively underrated) way to quantify how much you can trust your tests. Mutation tests work by changing your code in subtle ways, then applying your unit tests to these new, "mutant" versions of your code. If your tests fail, great! If they pass… that’s a change that might cause a bug in production. In this talk, I’ll show you how to get started with mutation testing and how to integrate it into your CI/CD pipeline. After the session, you’ll be ready to use mutation testing with wild abandon. Soon, catching mutant code will be a routine part of your release engineering process! Developers often use metrics as targets. Code coverage is one of the most common, and most prone to corner-cutting and abuse. Goodhart's Law states: When a metric becomes a target, it ceases to be a good metric (and trust us, we have a lot of memes to share with you about this!) Mutation score is different. Because it tests your tests, coverage isn't enough - you have to write tests that are resistant to all the mutated code that wants nothing more than to sneak through your CI/CD pipeline into production.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: From the minute 16:50 of video does not have audio. In this talk we present how to visualize the NPM dependencies ecosystem of your node project using the elevated city of BabiaXR, in VR using the webXR standards. We will start with a step-by-step tutorial on how to retrieve the needed data from the node project, and how to build a VR scene for the browser using only a few lines of HTML, including the BabiaXR toolset based on A-Frame. We will analyze the important features of the project, such the license usage, vulnerabilities, community, and employment of the dependencies installed. All of these metrics are mapped to building aspects (height, area, and color). The continuous emergence of OSS web development projects makes the \npm network a field of study and most important the dependencies that these projects install, adding community, vulnerabilities, or size issues to the software development process. NPM registry is a network where most web developers upload their packages, this network has been shown to grow with time. The need to control these ecosystem dependencies is an active field in academia and industry. We present a VR city for analyzing the NPM dependencies of a node project with the goal of understanding the information about the licenses, vulnerabilities, community, and employment of the dependencies installed in order to detect and prevent issues derivated from there. For creating the VR scene in the browser, we will use BabiaXR, a toolset for data visualization in VR for the web, in this case, we will focus on the elevated city, being the buildings the packages installed by npm, and the level of the dependency represented as an elevated quarter of the city. In this talk, we will follow a step-by-step tutorial for retrieving the data and needed metrics and we will show how to use this VR scene and how to change these metrics in real time, updating the city in order to see information about the license usage, vulnerabilities, community or package employment. This talk requires basic knowledge of the NPM ecosystem, nothing else beyond that.

uk: вхід без авторизації

name: Visualize the NPM dependencies city ecosystem of your node project in VR


uk: Комп'ютерні науки

description: When discussing contributions, we still see a lot of emphasis on the code contributions into project repositories. But the open source world is extensive and diverse, and everyone can find their place there. Your project will benefit from various experiences that non-coders can bring to the table. Isn’t that cool when you receive an issue with an interesting bug from the community, read about a user case in a blog or a review, or someone makes a video guide for your product? And more! In this talk, we will look into different types of non-code contributions to the open source project. We will discuss how they can provide value to your project and team, and how to invite, engage and empower non-code contributors. We will cover various ways to find and measure those contributions and recognize individuals based on the experience that Percona Community Team gained working with non-code contributions to Percona repositories.

uk: вхід без авторизації

name: Nurturing, Motivating and Recognizing Non-Code Contributions


uk: Комп'ютерні науки

description: Testing large systems with multiple microservices is hard to understand. You need to understand the whole system, all connections, and how the microservices interconnect. With tracing you get a map of everything which makes your whole system easier to understand. I want to showcase traditional test-driven development vs the new observability-driven development. I'll use open-source tools like Tracetest and OpenTelemetry to showcase how to use trace-based testing and enrich integration tests with trace data. What's the problem? Testing large systems and multiple microservices is hard to understand. Such a big system can quickly become convoluted. You need to be a specialist in that area to understand the whole system, all connections, and how the microservices interconnect. How do we solve it? With tracing you get a map of everything which makes your whole system easier to understand. I want to showcase traditional test-driven development vs the new observability-driven development with Tracetest and OpenTelemetry. With observability-driven development, you can improve your traces by using trace-based testing to enrich integration tests. No more black boxes when running integration tests. You'll know exactly what's happening in each microservice. You'll also be able to add test specs and assertions for every step the transaction takes through your distributed system! What's our production use case? Test-driven development is your thing. But, you’re using OpenTelemetry for traces? You have everything you need to move to observability-driven development. It will leverage your OpenTelemetry traces to create integration tests with more details and precision than ever before. We call it trace-based testing. It’s becoming popular to test systems at an integration or end-to-end level by applying assertions against the data contained in an OpenTelemetry trace. These tests can check your code, they can verify your trace info is added correctly and can verify processes that show up deep in the trace worked as expected. We’re building an open-source tool called Tracetest (https://github.com/kubeshop/tracetest) to make observability-driven development mainstream. It leverages the observability enabled by OpenTelemetry traces to allow you to create trace-based tests. These tests can check your code, they can verify your trace info is added correctly and can verify processes that show up deep in the trace worked as expected.

uk: вхід без авторизації

name: Observability-driven development with OpenTelemetry: Use traces to enrich your integration tests!


uk: Комп'ютерні науки

description: Introducing the new version of the on-device installer for Linux Mobile.

uk: вхід без авторизації

name: Ondev2: Distro-Independent Installer For Linux Mobile


uk: Комп'ютерні науки

description: Debian, openSUSE and Fedora have founded together the Linux Distributions Working Group at the Open Mainframe Project for achieving better support for the mainframe architecture s390x and collaboration for providing solutions. That has been such success, that SUSE, Red Hat, Canonical (Ubuntu), AlmaLinux and Rocky Linux have joint also. The question has poppeed up, whether we should be restrictly open only for all Linux Distributions or should we include also important upstream projects in our Linux Distributions Working Group. In this presentation we will represent the existing benetif for all Linux distributions and go into detail, which (base) upstream projects should be included/invited and why. Finally, we want to receive feedback during the Q&A session with a discussion, how we should proceed with this idea.

uk: вхід без авторизації

name: Upstream Collaboration and Linux Distributions Collaboration - Is that excluded?: The Linux Distributions Working Group @ The Open Mainframe Project


uk: Комп'ютерні науки

description: Looking back at 4 years of Open research tools and technologies devroom, we propose an open discussion on what's been done and what's to do. The panel will be held by the devroom organisers and will present a brief wrap-up of the 2023 edition, before opening the floor to the attendance. We are looking for feedback regarding the event itself, and inputs about its part in the community. Where are we, and where should we go from here?

uk: вхід без авторизації

name: Open Research Open Panel: Open discussion among the open research tools and technologies community


Setting up OpenQA testing for GNOME

uk: Комп'ютерні науки

description: Integration testing of GNOME, a desktop environment built from more than 200 separate components, is tricky. Since 2010 folk have been working towards better testing, and one outcome is the testing-only VM image "GNOME OS", built from the latest "main" and "master" branches of GNOME. Now we're trialling OpenQA to automatically detect regressions in GNOME OS as soon as they happen. In this talk, I'll speak a bit about how we got here, where we're going and some tips for getting started with your own OpenQA testing.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: CorTexT Platform is the digital platform of the Interdisciplinary Laboratory for Science, Innovation and Society (LISIS) held in Paris. This platform aims at empowering open research and studies in social sciences about the dynamic of science, technology, innovation and knowledge production. It covers a large variety of methodological research fields, such as scientometrics, Social Networks Analysis, Natural Language Processing and spatial analysis. Its web application gathers most of the original methods produced by the platform team members (https://www.cortext.net/members/). Twelve years after its creation, CorTexT Manager is facing a growth of its usages: in number of users, type of institutions, and locations of the users. Back in 2021, more than 1300 active users came to analyze data on it, producing more than 66 000 calculations, from a wide variety of organizations (laboratories, government agencies, firms, newspapers...) located in 60 countries across the world. In 2019, our users were coming from 39 different countries. In the meantime, scientific production published using one or more sets of methods accessible through CorTexT Manager has nearly doubled: a total of 67 scientific documents citing or mentioning CorText Manager has been identified for 2021 (https://www.cortext.net/publications/). Addressing these changes has required significant transformations of CorTexT Manager: both for its technical infrastructure as well as for how its codebase is produced and its academic visibility. This presentation will give a brief overview of what is CorTexT Manager and focus on: the importance of user documentation for scientific reproducibility, questions related to the ownership and copyright of the source code when engineers and developers are supported by multiple research organizations, and how to ensure its academic visibility.

uk: вхід без авторизації

name: CorTexT: An open platform for social sciences and humanities Methodological expertise


uk: Комп'ютерні науки

description: Scientific articles built on executable notebooks are already common in the domain of scientific publication, where they are an effective tool that brings transparency and openness in research communication (FAIR). However, they’re not yet widely praised in the humanities. Luckily, in the digital humanities, Jupyter notebooks play an important role in data analysis and exploration. They provide a free, powerful and open source platform for analyzing text corpora and other datasets in many programming languages - Julia, Python and R; they flawlessly integrate the browsers and many JavaScript data visualization libraries. In general, digital humanists know very well how to make use of Jupyter notebooks to quickly create and share documents containing live code, equations, visualizations, and narrative text. That’s why we naturally decided to work on Jupyter notebooks when we started playing with the idea of funding a Journal for digital historians in conjunction with the publisher DeGruyter. Developed by the C²DH (Luxembourg Centre for Contemporary and Digital History and DeGruyter, the Journal of Digital History (https://journalofdigitalhistory.org) now publishes peer-reviewed, open access articles that are Jupyter notebooks in their essence. With a difference: we wanted authors to reflect on their use of algorithms and digital methods, so we asked them to write their articles as compositions of three layers: narrative, data and hermeneutics. In our presentation we will explore the ecosystem of tools and methods we have prepared together with the authors: GitHub, Docker, MyBinder, Zotero. We will present the process we follow with them from scratch notebooks to published multi-layered, reproducible scientific articles.

uk: вхід без авторизації

name: Executable papers in the Humanities, or how did we land to the Journal of Digital History


uk: Комп'ютерні науки

description: This presentation illustrates how the Guix project provides software deployment for reproducible research. GNU Guix takes care about the computational environment from the package management to producing container (Docker, Singularity) and also being an alternative for virtual environment. Open science means transparent and collective; transparent because a scientific result needs to be scrutinized and studied bug-to-bug, and collective because an independent observer must observe the same result–at least when speaking about computational processing–and this observation needs to be sustainable. Guix is an attempt to implement, for the computational environment, these two items. By applying functional programming concepts to package management, pioneered by Nix, Guix is deeply transparent by design. The whole computational environment is captured and its inspection, from source code to binary, becomes tractable. As a nice consequence, this computational environment is reproducible from one machine to another. What about missing source code? Guix is able to transparently fallback to the Software Heritage archive. The reproduction of this computational environment becomes sustainable–to some extent. In short, this presentation try to convince how Guix and 3 command lines can helps open science.

uk: вхід без авторизації

name: Guix, toward practical transparent, verifiable and long-term reproducible research


MuPhyN - MultiPhysical Nexus

uk: Комп'ютерні науки

description: Matlab + Simulink is a very powerful tool. This tool allows engineers to simulate real devices. In open sources, some tools exist, such as Scilab + Xcos. With the growing community of Python, some tools appeared: NumPy, SciPy... Those tools intend to propose a Matlab alternative environment equivalent for Python. MuPhyN is an interface that is intended to reproduce the Simulink capabilities. The goal is to produce a community-based simulation software. It is based on a Qt interface and uses a simulator core. It is fully written in Python and uses YAML as the descriptive language. The library feature proposed allows users to add as many boxes and schedulers as they want. The already created boxes take advantage on the SciPy and NumPy libraries to produce their behaviors.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Crowdsourced datasets starts to become common, we can cite the Wikipedia and Wikimedia projects or the OpenStreetMap database as well known examples. The UMRAE research lab collect data from thousands users around the world with its NoiseCapture application. Assess the quality of the sound spectrum recorded by hundreds of differents smartphones models is a challenge by itself and people are working on it. But in the mean time, we ask ourself if we can extract information from the tags provided by the users. This talk will present the 2017 - 2020 collection dataset, the analysis of the recordings' tags and the complete FOSS toolset we used. We will present the challenges we faced, the solutions we found and the issues we will have to mitigate in the future.

uk: вхід без авторизації

name: Preliminary analysis of crowdsourced sound data with FOSS


uk: Комп'ютерні науки

description: PIMMI is a Python software that performs visual mining in a corpus of images. Its main objective is to find all copies, total or partial, in large volumes of images and to group them together. Our initial goal is to study the reuse of images on social networks (typically, our first use is the propagation of memes on Twitter). However, we believe that its use can be much wider and that it can be easily adapted for other studies. The main features of PIMMI are therefore: - ability to process large image corpora, up to several millions files - robustness to some modifications of the images (crop, zoom, composition, addition of text, ...) - adaptability to different use cases (mainly the nature and volume of the image corpus) A study using PIMMI will generally be broken down into several steps: 1. constitution of a corpus of images (jpg and/or png files) and their metadata 2. choice of PIMMI parameters according to the criteria of the corpus 3. indexing the images with PIMMI and obtaining clusters of reused images 4. exploitation of the clusters by combining them with the descriptive metadata of the images The development of this software is still in progress and we warmly welcome beta-testers, feedback, proposals for new features and even pull requests!

uk: вхід без авторизації

name: PIMMI: a command line interface to study image propagation


uk: Комп'ютерні науки

description: Isn’t it a cool idea to understand societies of interstellar civilization? While this may look like a fictional scenario, I believe academically serious studies can be done through simulations. Because special relativity plays a role in this scenario, it is not a strict forward task to implement interstellar social model using existing social simulation framework. As a result, I have created an open source simulation framework, Relativitization, to ease the model development. In this presentation, I will introduce the architecture of the framework and how the framework can be used. Besides that, I will introduce a complex social model, a.k.a., a turn-based strategy game, developed based on the framework. I believe the game is useful for educating relativistic physics to the public. As a Ph.D. student in social science with a background in physics, developing an open source software is a challenging process. I will also share my experience in overcoming the challenges.

uk: вхід без авторизації

name: Relativitization: an interstellar social simulation framework and a turn-based strategy game


uk: Комп'ютерні науки

description: Driving research based on large collection of data often demands in the humanities a strong collaboration between researchers and data engineers. Data are the corner stone on which the research is based. Caring about our research data is not only a good practice to drive and open our research, it's also a good way to foster collaboration between researchers and engineers. In this talk we will present how, in a Digital Humanities research project, controlling the data quality and structure through a frictionless data package leverage the a great data productivity. Please note that this talk replaces one entitled "Data flowing the right way" that was due to have been given by María Arias de Reyna, who has sent his apologies but is now unable to attend the conference.

uk: вхід без авторизації

name: RICardo and GeoPolHist: Exploring trade relations between the geopolitical entities of the world from c. 1800 to 1938


Tackling disinformation with OSS

uk: Комп'ютерні науки

description: Disinformation on has become a crucial issue for our democracies, nowadays. This presentation, based on a real use case will show how to efficiently identify the real owner of a disinformation website by using OSINT techniques based on open-source software. We will also present the methodology and tools we used to better understand the ecosystem of disinformation this website evolves in, its influence out of the far-right social platforms, and the financial motivation of its creator behind the scene.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The Turing Way is an open-source, community-led, and collaboratively developed project on making data science and research skills accessible, comprehensible, and beneficial for a wider research community. We bring together individuals from diverse fields and expertise to develop practices and learning resources that can make data research comprehensible and useful for everyone, as well as translate these tools and ways of working across cultural and disciplinary contexts. These resources are organised as an online book with over 250 chapters across five guides on reproducibility, project design, collaboration, communication and ethics in research. This talk will introduce The Turing Way project, and invite participants to get involved. All questions, comments, recommendations, and discussions are facilitated through an online GitHub repository. The Turing Way is an open-source, community-led, and collaboratively developed project on making data science and research skills accessible, comprehensible, and beneficial for a wider research community. We bring together individuals from diverse fields and expertise to develop practices and learning resources that can make data research comprehensible and useful for everyone, as well as translate these tools and ways of working across cultural and disciplinary contexts. These resources are organised as an online book with over 250 chapters across five guides on reproducibility, project design, collaboration, communication and ethics in research. This talk will introduce The Turing Way project, how it has evolved over time, and invite participants to get involved. All questions, comments, recommendations, and discussions are facilitated through an online GitHub repository.

uk: вхід без авторизації

name: The Turing Way: Changing research culture through open collaboration


uk: Комп'ютерні науки

description: The twitter-explorer is an open-source research tool that allows users without programming skills to collect, transform and visualize Twitter data through the paradigm of networks. After a short presentation of the program itself, we shall discuss the intricacies of tool-building for the social sciences, more specifically the use and interpretability of force-directed layout algorithms. The twitter-explorer is an open-source research tool that allows users without programming skills to collect, transform and visualize Twitter data through the paradigm of networks. It represents different types of platform-specific interaction patterns (retweet, mention, quote, reply) as interactively explorable networks, 2D-spatialized through a force-directed layout algorithm. The tool, and more specifically its interactive aspect, which allows users to read tweets of users from within the network visualization, was built out of a necessity to go back to the actual data in order to understand why certain nodes find themselves in the position they are in. We call this process "guided close-reading": the structural overview given by the spatialized network allows the social scientist to find, sort and then analyze relevant content through traditional methods from discourse analysis in order to generate hypotheses about the underlying debate on Twitter. In this presentation, I would mainly like to discuss the intricacies of tool-building for the social sciences, more specifically the use and interpretability of force-directed layout algorithms, as well as get feedback on the architecture of the tool itself, which is written in Python and JavaScript.

uk: вхід без авторизації

name: Interactive network visualizations as "guided close reading" devices for the social sciences: Development of the twitter-explorer


uk: Комп'ютерні науки

description: This talk is an interim report on a journey to enhance scientific programming in Python within the French social sciences. Scientific programming is a stepstone to develop open and reproductible data projects. In numerous field, tools and libraries were developed thanks to Python to become standards. Backed by detailed documentations, those tools diffuse beyond specialties and frontiers and opens new prospects. Nevertheless, social sciences in France seem to stand appart. One reason may be the precedence of R as a programming langage, with highly specialized libraries lacking sometime of documentation or update. Another one may be the diversity of traditions, data and approaches that can hinder shared practices and ease of use of existing libraries. Based on the experience of a small Python library - PySHS - and the organization of training sessions, I will argue that there is a need (and space) for an high-level and easy to use scientific programming framework in Python dedicate to social sciences that can bridge current practices with the state of the art libraries. Such library could in return help to clarify methodologies. This opens two main question that should be addressed : first, how to maintain the flexibility of scientific programming against overtly specialized tools ; second : how to build a meta-framework with other programming langages as R to avoid fragmentation.

uk: вхід без авторизації

name: The under-equipped social scientist ?: Why do we need more dedicated, flexible and documented Python libraries for social sciences.


uk: Комп'ютерні науки

description: The story of this talk starts eight years ago, with the creation of a mapping-interface [1] to explore one of the fined grained statistical dataset on the french population (number of inhabitants / km², the average income per consumption unit, the percentage of low-income households, ...). These data were derived from localized tax revenues of households and were available in a very fine way i.e on pixels of only 200m x 200m, they were delivered at this time by the French National Institute of Statstics (INSEE) throught a massive spatial data file, which limited their use to a very limited number of people able to handle it. The proposed interface changed this and allowed almost any-body to visualize easily these data in their browser. In this presentation we will mainly discuss how to make such massive spatial data easily accessible to the public. The proposed solution is based on multi-scale aggregation: at high scales, the data are aggregated and at fine scales the final resolution of 200m by 200m is recovered. This interface, which heavily rely on zoom in/zoom out interactions allows users to deal and play with one of the well known problem in geography and spatial statistics namely the Modifiable Areal Unit Problem [2] (ie. Data tabulated for different spatial scale levels or according to different zonal systems for the same region will not provide consistent analysis results). This tool has leads to several interactions with new users (journalist, researchers, simple citizen,...) that seem to demonstrate its interest. Since this first project, several other massive datasets (one concerning an updated of the same data-set and one concerning a dataset on all french building) were made available with almost the same system [3,4]. From a technical perspective, this talk will covers the different evolution and open-sources projects that has made this project possible (d3 / postgres / postgis / mapLibre,Leaflet, ...), discussing vector tiles formats, map viewer evolution and a little bit of spatial databases and the development of a little python tool to help other build the same type of visualization.

uk: вхід без авторизації

name: Webmapping and massive statistical data, a democratization story


uk: Комп'ютерні науки

description: This presentation is aimed for operator developers that plan to add or want to improve their operator monitoring. We will present best practices and new tools that will help you get the best monitoring for your operator with a shorter and easier implementation. All operators start small. Usually the first metrics that we add, to a new operator, are the basic ones that help us in the development process. When adding the first metrics, developers that are not yet experienced with monitoring, might add metrics that would later cause issues. Like, metrics names that would need to be changed, metrics code that would complicate the core operator code, etc and the same for Alerts. This presentation will help developers to avoid pitfalls when implementing monitoring to their operator and will direct them for best practices and new tooling that we added to Operator SDK to assist developers in the first steps in implementing monitoring.

uk: вхід без авторизації

name: Best Practices for Operators Monitoring and Observability in Operator SDK


uk: Комп'ютерні науки

description: Penpot will be launched shortly before FOSDEM takes place, for a reason. Three years ago we presented our vision to the audience and we promised we would build a design & prototyping platform that was all about open standards (SVG, HTML, CSS) and open source, but also about collaboration between designers and developers at the design process level. We wanted to make FOSDEM 2023 the community event at which we demoed Penpot "GA", what it brings, why it matters, and what's next. We are extremely excited to share the good news with the open source design community! 2022 has been a breaking year for us. We moved out from Alpha into Beta, enjoyed a ton of love from the community (libraries, templates, features, translations, tutorials) and we have kept adding features and making sure we are actively listening to users.

uk: вхід без авторизації

name: Penpot official launch!: We made it! We're ready for our breaking moment!


uk: Комп'ютерні науки

description: With Phosh (a Wayland shell for GNOME on mobile devices) and it's associated ecosystem being adopted more widely we want to highlight some of the progress made during 2022. This talk will give a short overview of the state of Phosh and related software components, what you can do today and what you can expect in the future.

uk: вхід без авторизації

name: What's new in the world of phosh?: and the wider ecosystem


uk: Комп'ютерні науки

description: When creating a plugin system for a UI project, some of the questions one will undoubtedly have to answer are: What should we allow to be extended? What should the lifecycle of plugins be? How can developers test and distribute plugins? In this presentation we will share the issues and questions we faced when developing a plugin system for Headlamp, a Kubernetes UI project, and how we addressed them. UIs and their effectiveness can be very subjective. What works for some users will very likely not please many others. In Open Source, a full adaptation of a project to one's needs can be achieved by forking and modifying a project but that often results a massive effort to keep the fork or downstream changes close to upstream. An alternative to maintaining a fork can be a comprehensive plugin system. Such systems allow a project’s functionality to be extended via code that's dynamically loaded. Such extensions or plugins allow developers to isolate their changes and focus on them, thus avoiding having to fork and modifying the original project (or keeping changes to a minimum), and it becomes the base project maintainers' responsibility to keep the plugins working. JavaScript is a very flexible language to accomplish such extensions in a project by dynamically loading code, and React allows to reuse components in an isolated way, but developing a plugins system comes with many decisions and implications: What should we allow to be extended (and how)? When should we load plugins? What if they fail to load? What about the lifetime of plugins’ React components? How to avoid bundling modules that will be available in the base project when plugins are loaded? How should end users run the plugins? How can they test the plugins? We had to figure out all these questions when developing Headlamp, a Kubernetes UI that can be run as a web or desktop app and was created to offer a generic UI in its core but allowing users to modify and brand it through plugins, instead of having to maintain a fork of it. In this presentation we will share how we addressed the questions around creating a plugin system: how we used webpack’s external modules to avoid bundling core modules, how we first shipped only type definitions of the libraries plugins use (and later decided we needed to ship the source code itself), how we created a helper script to bootstrap and keep updates under control, and many other considerations. Hopefully this will help early-stage projects keep these implications and possible solutions in mind when developing their own extension points. We’d also like to get others’ perspectives and comments on what we could have done differently, in the Q&A session.

uk: вхід без авторизації

name: The problems you will have when creating a plugins system for your shiny UI project


uk: Комп'ютерні науки

description: Postgres provides a plethora of performance metrics useful for monitoring tools available through SQL. However monitoring a traditional relational database using modern observability tools presents some unique challenges. Postgres's metrics can be extremely detailed and provide rich information about the relationships between the different database objects. However this requires custom SQL queries and the getting the right level of detail depends heavily on understanding style of architecture of the database schema. This kind of customization makes it difficult to deploy and maintain any dashboards, or alerts. Even on a mundane level deploying an agent to interface through SQL introduces operational difficulty requiring additional custom work to coordinate the agent and database deploy and introducing many failure modes which can result in inaccurate metrics, no metrics, or even cause database outages. I'm currently working on improving Postgres's support for modern observability tools and I have plans and challenges to talk about. Ideally I want to make things work smoothly out of the box without having each site have to write custom queries and design custom dashboards to get the right level of data for their database and adapt it to their deployment environment.

uk: вхід без авторизації

name: Observability in Postgres: The Good, the Bad, and the Ugly


uk: Комп'ютерні науки

description: Do you ever find yourself pondering life’s important questions: What does a DBA actually do? How has the role changed over the years? What will it look like in the future? Why are DBAs so grumpy? It shocked me to realise recently that it’s almost a quarter of a century since I started work as a junior database administrator, fresh out of university. Just like everything else in the IT world, the role of the DBA has evolved massively in that time. Has it changed beyond recognition, or does today’s DBA still do fundamentally the same job? I don’t imagine most DBAs currently spend their time reorganising their datafiles to create contiguous blocks of free space that the database can make use of. And I’m fairly certain the world is a better place for it. My 21 year-old self could never have imagined managing a self-healing, automated, scalable database cluster on Kubernetes. On the other hand, the questions of data modelling, disk capacity, query performance, and user management are as relevant today as they were back then. Let’s take a light-hearted look at the changing role of the DBA over the past couple of decades, with some guesses about what the DBA of the future will be doing. Or will autonomous databases finally have put us all out of work?

uk: вхід без авторизації

name: DBA Evolution: the Changing Role of the Database Administrator


Deep Dive Into Query Performance

uk: Комп'ютерні науки

description: If you look at data store as just another service, the things Application cares about is successfully establishing connection and getting results to the queries promptly and with correct results. In this presentation, we will explore this seemingly simple aspect of working with PostgreSQL in details. We will talk about why you want to go beyond the averages, and how to group queries together in the meaningful way so you’re not overwhelmed with amount of details but find the right queries to focus on. We will answer the question on when you should focus on tuning specific queries or when it is better to focus on tuning the database (or just getting a bigger box). We will also look at other ways to minimize user facing response time, such as parallel queries, asynchronous queries, queueing complex work, as well as often misunderstood response time killers such as overloaded network, stolen CPU, and even limits imposed by this pesky speed of light.

uk: вхід без авторизації


Don't Do This

uk: Комп'ютерні науки

description: Based on the legendary "Don't Do This" PostgreSQL wiki page, this talk will explore some of the common pitfalls and misconceptions that Postgres users can face - and show possible ways to undo them or workarounds. Some of the topics to be covered: - Correct types for data storage - (Sub-)Partitioning -- And how to get it wrong - Bad SQL habits - Table inheritance -- And how to undo it - Security issues -- Unsafe configurations and usage - Connections -- Number of, and properly handling

uk: вхід без авторизації


uk: Комп'ютерні науки

description: One of the sayings about development in the Postgres world is “it’s not just open source, it’s open engineering.” In the spirit of openness, this talk will show you how to increase the impact and the reach of your Postgres blog posts. These best practices begin with empathy for your readers—and cover lots of ground from there, including key things to know about SEO, as well as tips on how to promote your blog post. This talk is an updated version of the PGConf EU 2022 talk I gave in Berlin and it's not just theory: real-world examples are included throughout the talk.

uk: вхід без авторизації

name: How to Give Your Postgres Blog Posts: An Outsize Impact


uk: Комп'ютерні науки

description: Our industry talks a great deal about human error, with the idea that we can automate away human mistakes. However, we are generally missing a fundamental and technical model of how we as humans operate, and what can be done to minimize errors and maximize good outcomes. As much as "human error" sometimes gets us into problems, the human factor is the only thing that gets us out. Fortunately, as an industry, we do not have to figure this out all by ourselves. Medicine, rail operators, and most importantly, airlines have been on the forefront of research and training in this field. In this presentation you will learn: - The history of Crew Resource Management - Specific case-based examples on how database teams suffer the same problems that flight crews, fire crews, and medical teams face - What crew resource management training teaches - How to Implement Crew Resource Management in your teams or company - How Crew Resource Management training delivers benefits The speaker offers no commercial services in this field but has been involved in implementing crew resource management programs in database teams. Please note that this talk replaces the talk "SQL vs NoSQL? Get the Best of Both Worlds with JSON in PostgreSQL" by Shayon Sanyal, who unfortunately can't attend FOSDEM this year.

uk: вхід без авторизації

name: Why Database Teams Need Human Factors Training


uk: Комп'ютерні науки

description: Ever wondered what might be the best data type for a certain use case? Is it better to use INTEGER or BIGINT, and should you use TIMESTAMP or is it better to use TIMESTAMPTZ? When is the last time you migrated a legacy database and wondered what to use as replacement for VARCHAR2 or CHAR(255)? How to store IP addresses or geographical data, does that fit into VARCHAR or is there something more suitable? PostgreSQL 15 comes with around 40 different data types preinstalled. This talk looks beyond INTEGER and VARCHAR and dives into some of the lesser known PostgreSQL data types. Use cases and examples show which data type is a good fit for a certain situation.

uk: вхід без авторизації

name: Tour de Data Types: VARCHAR2 or CHAR(255)?


When it all GOes right

uk: Комп'ютерні науки

description: This talk covers how to use PostgreSQL together with the Golang (Go) programming language. I will describe what drivers and tools are available and which to use nowadays. In this talk I will cover what design choices of Go can help you to build robust programs. But also, we will reveal some parts of the language and drivers that can cause obstacles and what routines to apply to avoid risks. We will try to build the simplest cross-platform application in Go fully covered by tests and ready for CI/CD using GitHub Actions as an example.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: User experience is often overlooked in open source projects, and this was the case with OpenProject too. In 2021, OpenProject hired two UX designers (including me) to improve usability and bring it to even more people. In this talk, we'll look at the challenges, processes and learnings gleaned from the past year and half of setting up a UX team within an established open source project. One of the most common complaints about open source software is bad UX. This can mean a lot of things to a lot of people (and modern design isn't always great either) but generally, a lot of it seems to be designed for and by technical people who don't mind configuring, menu-diving and reading the manual. Open source projects also tend to not invest their (admittedly often limited) resources on UX and UX designers. OpenProject is an open-project management and collaboration tool that's been around for over ten years. The software went through its many versions and iterations without a dedicated design team and did so without this necessarily being a problem. But in August 2021 OpenProject GmbH hired not one but two UX designers to improve usability and user experience. I'm one of them. In this talk, we will look at: - Why OpenProject decided to invest in UX - The challenges of designing for (and around) a tool with lots of legacy code, architecture and design - How we're (slowly but surely) implementing a design system - How we balance a seemingly endless list of UX optimisations with new feature development - What we've learnt in the past year and a half - How we plan to go forward in 2023

uk: вхід без авторизації

name: Practical UX at OpenProject: Musing after 1½ years of working on the UX of open source software


uk: Комп'ютерні науки

description: With the popularity of observability tooling to analyze Logs, Metrics and Traces, it has become easier than ever to find the bottleneck in your software stack. Once you have identified the particular system introducing a user facing performance degradation, as its developer you need to understand which part (ideally down to the function and line of code) is slowing it down. With that insight you are able to effectively optimize your application. In this talk I will show how profiles are collected, how they can be aggregated and visualized. And then how those insights can be used to optimize your code. While there is a focus on the Go ecosystem, most of the content of the talk should be transferable to other languages

uk: вхід без авторизації

name: Adopting continuous-profiling: Understand how your code utilizes cpu/memory: Introduction into continuous-profiling and how it can help you writing more efficient code


uk: Комп'ютерні науки

description: From the minute 19:50 of video does not have audio. Web APIs have come a long way. You can create web apps that interact with devices via USB or BlueTooth with the respective Web API. You can build games on the web that is controlled via controllers! Join me to learn how I hacked a PS5 controller to play web games. The bridge between native apps and web apps is getting smaller and smaller, enabling developers to provide a native experience to their users. This is possible only because of the continuous work on the Web APIs. One such API is the WebHID API. In this talk, I'll introduce the WebHID API. I'll share all the possibilities and issues with the API. The talk will be accompanied by a live demo. In the demo, I'll code a web game that is controlled via a PS5 controller. The key takeaway will be the audience learning about the WebHID API which would hopefully get the community more involved!

uk: вхід без авторизації

name: Controlling the web with a PS5 controller


uk: Комп'ютерні науки

description: Do you want to promote Free Software in public administrations? Then the campaign framework of "Public Money? Public Code!" is the right choice for you; no matter if you want to do it as an individual or as a group; if you have a small or large time budget; whether you are targeting the national level or your local administration. In this talk, we will present some inspiring success stories from the campaign around Europe and invite you to follow their example. For this we will explain how the campaign framework can be used to push for the adoption of Free Software friendly policies in your area; be it your public administration, your library, your university, your city, your region, or your country. Communities are the backbone of the Free Software universe – not only in developing ideas and contributing code. Dedicated enthusiasts all over Europe help spreading the idea of software freedom and anchoring the call for public code on all levels. More than 200 organisations, and tens of thousands of individuals already signed the “Public Money? Public Code!” open letter, demanding that publicly financed software should be made publicly available under Free Software licenses. Together we contacted politicians, decision makers, and civil servants on all levels -- from the European Union and national governments, to city mayors and the heads of public libraries about this demand. This did not just lead to important discussions about software freedom with decision makers, but also already to specific policy changes. Already, we have administrations from Spain, Sweden and Germany supporting “Public Money? Public Code!”.

uk: вхід без авторизації

name: If it’s public money, make it public code!: How to effectively push for Free Software all over Europe


uk: Комп'ютерні науки

description: Digital autonomy has been at the heart of the public policy debate in the EU for a while now, with Commissioner Thierry Breton himself stating in 2021 that “in the digital decade, Open Source will be a key element to achieve Europe’s resilience and digital sovereignty”. In this session, which will also include an open debate with the audience, we will analyze the opportunities for open source when it comes to contributing to building Europe’s technological sovereignty, but also the challenges that this new policy landscape poses for the open source ecosystem in Europe (and beyond). Gaël Blondelle joined the Eclipse Foundation in 2013 and now serves as Chief Membership Officer. He has been involved in the open source arena for more than 18 years in a number of key roles. Gaël co-founded an open source start-up and worked as its Chief Technology Officer. Gaël then worked in business development for an open source systems integration company and managed highly strategic research IT projects aiming to create open source ecosystems for major industrial players. Gaël joined the Eclipse Foundation to pursue his goal of helping more companies work in open source, and to implement open, innovative and collaborative ecosystems for mission-critical applications. Alberto P. Martí has developed most of his career in Spain and in the UK, both in the IT sector and in Academia. As VP of Open Source Innovation at OpenNebula Systems, he deals with strategic collaborations with public cloud/edge providers, open source initiatives, and development teams from other tech vendors. Alberto coordinates the SovereignEdge.EU initiative and is involved in both the IPCEI-CIS and the European Alliance for Industrial Data, Edge and Cloud, where he supports the role of OpenNebula Systems as chairing company of the Cloud/Edge Working Group while co-leading one of its Task Forces. Alberto is particularly interested in the conjunction between open source, ethical innovation, and digital sovereignty.

uk: вхід без авторизації

name: Is “European open source” a thing?: Debating the role of open source in building Europe’s digital sovereignty


uk: Комп'ютерні науки

description: Spack is a software distribution targeted at HPC systems, with over 6,800 packages. While Spack has long been a source-only distribution, in June 2022 we added public build caches that offer fixed and rolling binary releases. With 400-500 pull requests per month, most of them package updates, this was a non-trivial task. The build cache model for Spack is similar to Nix and Guix — it assumes no ABI compatibility. Any change to dependencies triggers rebuilds of dependents. Despite these challenges we have been able to build a CI system that builds and tests packages on pull request and on release branches for a subset of several thousand builds for x86_64, Power, and aarch64, as well as for AMD and NVIDIA GPUs and Intel's oneapi compiler. This talk will cover some of the main challenges we have faced: reliable build infrastructure, integration with pull request workflows, Kubernetes auto-scaling and AWS instance selection, and optimizing build performance in the cloud. We’ll talk about the infrastructure, as well as the algorithmic complexities of choosing CI commits carefully to minimize builds. This talk is targeted at distribution maintainers, particularly people managing build farms for large distributions. The goal of the presentation is to highlight the challenges of managing a rolling release for continuously evolving distributions hosted on GitHub. Spack manages 400-500 pull requests/month and is a very active repository. Keeping all the builds working all the time, particularly in a build-from-source system where the recipes are templated, is a big challenge. We may have the same package built many different ways in Spack (e.g. for different CPUs, GPUs, or MPI implementations), and all of those are managed by the same recipe and a very smart dependency/package configuration resolver. The talk will cover how we’ve scaled build caching to manage PRs as well as release branches, and how we’ve set up infrastructure that allows us to request builders with specific processor microarchitectures. The CI system is orchestrated by a high availability GitLab CI instance in the cloud. Builds are automated and triggered by pull requests, with runners both in the cloud and on bare metal. We will talk about the architecture of the CI system, from the user-facing stack descriptions in YAML to backend services like Kubernetes, Karpenter, S3, CloudFront, and the challenges of tuning runners to give good build performance. We'll also cover a bit about security in a completely PR-driven CI system. Specifically, we cover how we guarantee that arbitrary public CI users can’t inject malicious code into our binaries. Choosing commits to build from the distribution tree has been a challenge as well, and in a build-cached system, choosing the right commit to merge a PR with can be a key factor in minimizing the number of builds that need to be done. Specifically, we are trying to maximize reuse of builds done on the rolling release branch while still allowing PRs to update frequently. Orchestrating this in CI, particularly when most systems want to merge with the head of the mainline, can be a challenge. Finally, we'll talk about some of the architectural decisions in Spack itself that had to change to better support CI — specifically with the dependency resolver and how we choose exactly which stack configurations to build in CI for the rolling release. All of this topics should help distribution managers better orchestrate build farms, and they should be particularly relevant to other distributions that are similar to Spack, like Nix and Guix.

uk: вхід без авторизації

name: Automating a rolling binary release for Spack: Scaling a modern CI workflow to a large distribution


uk: Комп'ютерні науки

description: SaaSS means using a service implemented by someone else as a substitute for running your copy of a program for a computing activity that is entirely your own. It is explained in detail at https://www.gnu.org/philosophy/who-does-that-server-really-serve.en.html. Services where the code is published as free software provides a huge mitigation to SaaSS, but to keep your software freedom, you need to identify it and avoid using it. This talk will first explain some finer points of SaaSS going beyond what is written on gnu.org. I will introduce the concept of the primary purpose of using a service and incidental computing. We will evaluate what parts of some popular services are SaaSS. I will introduce an edge case as an example that the line is not always black and white. The audience will gain confidence in evaluating services they encounter for whether any parts are SaaSS. There has been relatively little attention paid to SaaSS, but it is on the rise especially with AI services. I will suggest some practical cases and approaches for raising the issue of SaaSS. Is there a simpler way to put it? Maybe "That kind of service should only run on your own computer as free software." Publishing free sources for non-SaaSS services is also important and warrants some discussion. If most services aren't SaaSS, why does the FSF recommend the AGPL for all service software? Users of services and society at large deserve the sharing of service software for reasons other than SaaSS which I will discuss.

uk: вхід без авторизації

name: A Service as a Software Substitute (SaaSS) is unjust like proprietary software: Thinking carefully about services


uk: Комп'ютерні науки

description: Sailfish OS is an embedded Linux distribution developed by Jolla that’s designed to run primarily on phones. In this presentation I’ll talk about my journey porting Sailfish OS to various Xperia phones, via the Sony Open Devices Program, and how that’s made it possible to contribute changes upstream. If you’ve ever wondered what’s involved in porting a Linux operating system like Sailfish OS to a new hardware platform, or might even be interested to try, then this talk will describe one of the easiest routes to getting started. Sailfish OS is an embedded Linux distribution developed by Jolla that’s designed to run primarily on phone and tablet hardware. The Sailfish community has a proud hardware adaptation track record, having ported Sailfish OS to devices as wide ranging as watches, feature phones, smartphones, tablets and PC hardware. Despite the breadth of successful ports, the process of adapting Linux to a new phone platform can be daunting for new porters. On the other hand, the Sony Open Devices Program makes the process of opening up a selection of Sony’s Xperia mobile phones for use by porters as easy as possible. In this presentation I’ll look at the process of porting Sailfish OS to Sony Open Device Program devices, see how the Open Devices Program helps in practice, and also look at some of the tools, documentation and infrastructure made available by Jolla to help with this process. I’ll talk about my own journey as a porter, how I came to start porting and the work I’m doing now porting Sailfish OS to different Sony Xperia devices. I’ll also talk about how Sailfish porters are able to work with the Sony Open Devices Program for mutual benefit, pushing changes upstream that then flow back down to make porting Sailfish OS or other Linux variants to other Xperia phones in the Open Devices Program more streamlined and reliable. I will aim to provide enough technical detail so that developers who haven’t yet tried porting can go away and get started, but will also aim to include material that is of general interest to more casual mobile phone and Linux users. If you’ve ever wondered what the process of porting Linux to a new hardware platform involves, might even be interested in trying it yourself, then this talk will offer some essential groundwork and highlight one of the easiest routes to getting started.

uk: вхід без авторизації

name: Sailing into the Linux port with Sony Open Devices: A journey of adapting Sailfish OS to work on Sony Xperia phones


uk: Комп'ютерні науки

description: Build recorder: a system to capture detailed information An issue that is currently plaguing a number of people working in SBOMs is that, given a generated binary artifact of a project, it is not easy (or even possible) to point back to the exact files that were used for creating it. In a typical setup, a project has a number of source files written in a programming language and a build process creates a binary executable. However, in most cases only a subset of the files is being processed (others being test cases, for example), a number of other files are also used (standard header files residing elsewhere in the system), and a number of tools are being invoked (each introducing another dependency). In this presentation we will present build_recorder, an innovative command-line tool that allows tracking of complete and detailed information about every single file that somehow affects the build process. The tool works transparently while the software is being built, without requiring any change to the source code or build system. For each file used, a number of attributes are being saved, like name, full path, checksum and exact use. We will be detailing the information kept, the basics of operation, the generated output format, and planned future enhancements. This work has been the result of a 2022 Google Summer of Code project for the GFOSS organization.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: A open moderated discussion on different aspects of SBOMs, especially oriented towards embedded system images. Audience participation is expected and encouraged!

uk: вхід без авторизації

name: SBOM contents for embedded system images: Open discussion


uk: Комп'ютерні науки

description: FOSSology is a open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line or from web UI. FOSSology can generate SPDX SBOM for source code in RDF and tag-value formats, including other reports, and is becoming more SPDX compliant. With the new license naming changes in FOSSology, users can provide more elaborate and correct SPDX License Identifiers for the licenses. The tool has also improved its reporting using SPDX version 2.3 with new fields. FOSSology uses SPDX reporting formats to generate SBOM for source code. The project has recently improved the reporting by providing users and option to give SPDX License Identifier. This helps in maintaining the SPDX specified format for the reports in FOSSology. Apart from using SPDX reporting formats, FOSSology also supports following SBOM reports: - DEP5 format, which is predominantly used within Debian community. - CLIXML report, an in-house format, which reports about licensing and related information in XML.

uk: вхід без авторизації

name: FOSSology and SPDX: How FOSSology works with SPDX


Using SPDX for functional safety

uk: Комп'ютерні науки

description: Functional Safety evidences require a set of all documents that proofs the complete implementation and verification of all relevant work products. This does not only include code and tests, but also every other associated piece of documentation, like requirement specifications, architecture and designs, safety analysis etc. In terms of the typical functional safety development this set is called safety case. This safety case is nothing else than an (S-)BOM of the safety release. This talk will demonstrate how SPDX relationships can be used to generate this "Safety SBOM" as evidence for a complete safety case.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Hermine is a FOSS (AGPL 3) tool to ease collaboration inside organisations between lawyers, developers and product owners, and between legal teams of different organisations. It helps validating SBOMs from other tools and list the resulting concrete legal obligations according to the technical and business context of usage of the different FOSS components.

uk: вхід без авторизації

name: Hermine: converting SBOMS into legal obligations


uk: Комп'ютерні науки

description: SBOMs vary wildly in the data they offer to consumers and to make the truly useful we need to consider seven important points in their contents. Let's immerse ourselves into real-world software bill of materials data to look for the required features all great SBOMs ought to have. As a record of components, SBOMs can vary wildly in how they describe software. Some SBOMs lean toward security and some toward licensing. Some do a good job in their own niche, while others do not even offer enough information to even understand what it is they are talking about. In this talk, we will try to visit the 7 key data points (syntactic correctness, dependencies, licensing, semantic structure, software identifiers, supplier data, and software integrity info) required to make sure your SBOM is useful to the widest possible audience. We will take an inner look into real-world SBOMs using the Kubernetes bom outliner. We will inspect how they are structured, and the data they offer looking for clues on how we could improve them with the goal of learning what a great Software Bill of Materials looks like.

uk: вхід без авторизації

name: The 7 key ingredients of a great SBOM: Ensuring your SBOM includes enough data to be actionable


uk: Комп'ютерні науки

description: SBoM are becoming a critical component in ensuring the integrity of our Software Supply Chains. Many current tools for SBoMs generation focus on two ways of generating SBoMs: generating them from the initial source code, or post-mortem analysis of completed systems and artifacts. While these are both valid and useful methods of analysis, less focus has been put on the tooling that pulls upstream source code together and generates the completed system artifacts, such as a distro build system or more generically any "meta-build" system. Using OpenEmbedded as a case study, Joshua will cover the unique strengths that generating SBoMs in meta-build systems can provide, as well as the challenges when trying to do so.

uk: вхід без авторизації

name: Automated SBoM generation with OpenEmbedded and the Yocto Project: A case study of automated SBoM generation in meta build systems


Generating SBOM made easy with ORT

uk: Комп'ютерні науки

description: During this talk, Thomas will demonstrate how you can in a few simple steps likely generate SBOMs for your software projects using ORT and GitHub action or GitLab pipeline. He will highlight some of the challenges of creating an accurate SBOM that reflects the reality in the source code and how ORT and its community has build and shared the tooling, data and policies needed to overcome some of these challenges to enable you to produce enterprise-grade SBOMs.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: A panel discussion on different aspects of SBOMs. Audience participation is expected and encouraged!

uk: вхід без авторизації

name: Panel discussion: SBOM content, usefulness, and caveats


uk: Комп'ютерні науки

description: Developing, using, and re-using Free Software is fun, but declaring licensing and copyright information is not. REUSE changes that. With three simple steps, it makes declaring licensing and copyright information unambiguous and perfectly human- and machine-readable, making life easier for everyone involved in the software supply chain. In this presentation, we will present the latest learnings from big projects that recently became REUSE-compliant. In addition, we will provide you with an update on the latest features of the REUSE CLI tool. As software has gotten more complex over the last years, the importance of declaring licensing information has become even more crucial. The FSFE's REUSE initiative contributes to the goal of clearly displaying legal information in Free Software projects by embedding it into every file of the repository. Any project following the REUSE recommendations makes copyright and licensing information readable for both humans and machines. We ensure that individuals, organisations, and companies that are reusing code are aware of and respect the licence terms chosen by its original author, thus facilitating the communication of this legal information among everyone involved in the software supply chain. REUSE integrates seamlessly into development processes and other best practices of indicating Free Software licences. In addition, there are tools and documentation to help you get started. During this talk, we will take you through the learnings of large projects becoming REUSE compliant (e.g. curl or GNUHealth) and present the latest features of our REUSE helper tool, which makes declaring license information a quick and fun endeavour.

uk: вхід без авторизації

name: REUSE Software... or if you want nice a nice SBOM downstream, push REUSE upstream


A standard BOM for Siemens

uk: Комп'ютерні науки

description: Multiple teams at Siemens evaluated several SBOM formats available on the internet. All of them decided to use CycloneDX with some custom extensions. This talk is about the BOM format itself, why we decided to use CycloneDX as a base, and what the goals for this BOM are.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In the world of manufacturing, a bill of materials (BOM) constitutes a quantified list of raw materials and components used to produce, for instance, a given refrigerator. The equivalent in the software world would be a list of all third-party libraries needed to compile, test, and release a software product. There is, however, a significant difference between the BOM for a refrigerator and a software product. Unlike for refrigerators, not all software products' ingredients (i.e., third-party libraries) are actually used! In this talk, we will present findings from our recent academic research comparing SBOMs generated from different sources of abstraction (i.e., manifest data and call graph data) to highlight that potential inaccuracy can hamper the actionability of SBOMs. Evaluating the severity of security vulnerabilities in third-party libraries is one such example. Moreover, we will also demonstrate from a recent experiment that available tools generate different SBOMs for the same software product, showcasing that SBOMs are not trivial to standardize. Finally, we will wrap up the talk with a discussion on challenges and opportunities to establish a ground truth for SBOMs.

uk: вхід без авторизації

name: In SBOMs We Trust: How Accurate, Complete, and Actionable Are They?


uk: Комп'ютерні науки

description: In recent years, the Software Bill of Materials (SBOM) has emerged as an important practice to manage the risks in the software supply chain. To achieve this goal, understanding and managing the dependency is an indispensable task when applying the SBOM. In SW360 - a software component catalog application, we proposed features to manage SBOM in Software Package Data Exchange (SPDX) format last year (https://archive.fosdem.org/2022/schedule/event/howtomanageosslicenseobligationandsbomusingsw360new_features/). But because of the limitation of the old features, dependency management is still an urgent problem to be solved. The projects registered in SW360 can only create their dependency graphs by searching the components registered in SW360 dynamically. However, to apply SBOM, it's necessary to enable projects to store dependency graphs for themselves. Therefore, Adding the dependency management function for projects registered in SW360 is important for importing and managing SBOM information such as SPDX information in SW360. This function will also help in managing vulnerabilities of projects registered in SW360. To achieve this goal, TOSHIBA proposed and developed a series of features in SW360 to help users in managing the dependencies of their projects more conveniently. With these user-friendly features, users could register, view and modify the dependency graphs of their projects flexibly. Combined with the existing SBOM management function in SW360, the new features will help users to use SBOM in practice more easily. These features will also help SW360 to collaborate with other tools and explore more possibilities for managing vulnerabilities. In this presentation, I will first explain the issues related to dependency management in SW360. Then I would like to introduce and demonstrate these new features of SW360 developed by TOSHIBA. These features may include some that are still under development.

uk: вхід без авторизації

name: Understanding and Managing the Dependency in SBOM with the New Feature of SW360


uk: Комп'ютерні науки

description: Presenting the toolchain that we have created for Eclipse Oniro, we believe the single largest compliance effort by many metrics ever attempted for Yocto projects, featuring besides than the usual suspects (Fossology, Scancode, SPDX, BANG, Gitlab CI) some specifically developed tools, including a dashboard, aliens4friends, a graph database to map dependencies and license incompatibilities, a license resolver and way more. Yocto has (as a recent addition) its own facilities to create a SBOM. We worked on some complements that need to be added to consume it for all bells and whistles of a full OpenChain conformant software composition analysis. We have created a way to preserve this information throughout the entire process of creating a build and can demonstrate how it is possible to uniquely identify each and every file that goes into the final image, resolve each binary file license from a large mix of diversely licensed source files, find the dependencies, find potential incompatibilities and reuse this information by sharing it publicly. This for a project whose base of data and number of vetted licenses,files and packages is very large (one would say "huge"). Therefore, what we regard as an unprecedented amount of automation had to be put to work.

uk: вхід без авторизації

name: A complete compliance toolchain for Yocto projects: (even very large ones, yes)


Graphing tools for scheduler tracing

uk: Комп'ютерні науки

description: Understanding scheduler behavior can be important for understanding application performance. In this talk, we present some tools that we have developed to help understand scheduling behavior on highly multicore machines. The tools to be presented enable 1) obtaining a graph showing what tasks are running on what cores, with a variety of coloring schemes, 2) detecting overload situations, and 3) stepping through a recorded execution. All tools rely on traces collected using trace-cmd. The tools make it possible to get an overview of the execution, as well as to study specific execution intervals.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: A security researcher known by the nickname percidae has drawn my attention to the Angular compilations. By bundling a single page application without code splitting, SPAs can make the job for penetration testers easier. This talk will look into an Angular app and highlight areas, where means for performance optimisation can lead to a more secure app. At the end of the presentation you should have a good understanding about how to read a webpack compilation for a SPA. You will know where to look for your own code and what webpack pulls in in addition. Other SPA frameworks could be affected as well, but are out of scope given the time constraint of this presentation. Subtitles will be provided after the event as .srt if I can find the time. Otherwise I encourage you to contact me and I'll send them. Accessibility is a human right.

uk: вхід без авторизації

name: Secure by accident: How performance optimisation can lead to more secure apps


uk: Комп'ютерні науки

description: The CrowdSec project aims at providing a crowdsourced approach to common infrastructure defense problems by distributing free & open-source software allowing you to protect yourself and share information about malevolent actors. In this Presentation, we will: - Learn about CrowdSec project - Learn how to install CrowdSec in Kubernetes - Learn how you can detect and block attacks in your applications deployed in k8s CrowdSec could be perceived as a modern form of Fail2ban, though for Cloud and container-based infrastructure as well, and capable of taking way more advanced decisions a lot faster. Mainly, it’s using a decoupled and distributed approach (detect here, remedy there) and an inference engine that leverages leaky buckets, YAML & Grok patterns to identify aggressive behaviors. It acquires signals from various data sources like files, syslogd, journald, AWS Cloudwatch and Kinesis, Docker logs, and Windows Event Log, normalizes them, enriches them to apply heuristics and triggers a bouncer to deal with the threat if need be. Since it’s written in Go, it’s compatible with almost any environment, fast in execution, and resource-conservative. The endgame is the Reputation engine, though. If you want to partake in the network to benefit from its findings, CrowdSec captures all aggression signals (timestamp, IP, behavior) and sends them for curation. That way, it establishes a reliable IP blacklist that is constantly redistributed to the network members to achieve a form of Digital Herd Immunity. An IP caught aggressing WordPress sites will quickly be banned by all members using CrowdSec that subscribed to the WordPress defense collection. In that way, we share the IPs that are relevant to your technical context. While Crowdsec is in charge of the detection, the reaction is performed by "bouncers" that aim to be deployable at any level of the applicative / infrastructure stack : - via nftables/iptables/pf based on an IP set - via Nginx lua plugin - via Traefik middleware - on Cloudflare via our bouncer that integrates with Cloudflare API - Or GCP/AWS/Azure firewall, slack or scripting, notifications, etc. .. or in many other ways. Over time the possibilities will increase as the application design basically supports anything. This approach, combined with a declarative configuration and a stateless behavior, will make it an ideal candidate to enhance the security of modern stacks (containers, Kubernetes, serverless, and more generally automatically deployed infrastructures). Furthermore, we intend to create and share the most accurate database of malevolent actors possible in the form of a real-time IP reputation system accessible through API. Whenever an attack is locally blocked/detected by Crowdsec, the "meta" information of the attack is shared amongst participants (source IP, date, and triggered scenario) for redistribution to network members. We are committed to building a strong community with all that it implies : * a public hub to find, share and amend parsers, scenarios, and blockers * permissive open-source license to stay business-friendly * and overall a strong commitment to transparency and community-first mentality by tooling and behavior The microservice architecture is the most significant security challenge in a Kubernetes cluster. Every application you deploy opens a new potential entry for attackers, increasing the attack surface. In this talk, we'll present the Crowdsec project and see how we can protect a Kubernetes cluster using Crowdsec and the power of the Crowd.

uk: вхід без авторизації

name: How to protect your Kubernetes cluster using Crowdsec


uk: Комп'ютерні науки

description: Since the first implementation of elliptic curves over finite fields for the GnuPG and the implementation on OpenSSL of the curves over finite and binary fields, back in the 2000s, many things have happened over this mathematical construction. We've witnessed instances like the birth and death of certain isogenies or searching for algorithms that resist quantum computing, which are only a few to mention. We moved from the NIST curves on the P1363 to use Edwards variety, and there is a recent proposal with Double-odd curves. So the assortment is increasing, but we need to squeeze them more. For each new curve, all users always share the same group. This talk will review the path walked and evaluate the progress in implementing the Double-odd Jacobi Quartic in Libgcrypt and GnuPG.

uk: вхід без авторизації

name: Elliptic curves in FOSS: More curves to the set


uk: Комп'ютерні науки

description: From the minute 10:37 of video does not have audio. Are you a sysadmin and feeling paranoid? Let's promote security hardening to another level. Perhaps, with the concept of Application Whitelisting you will be able to sleep again. In this session we are going to harden a Linux system with a file access policy daemon - fapolicyd. This daemon enables administrators to block or allow specific applications and executables using a fine-grained policy. We plan to explore the daemon’s possibilities and we want to get through its configuration. We will analyze multiple variations of set ups and evaluate their security aspects. We are going to demonstrate with an altered binary how integrity checking enablement prevents malicious attack. After the session, attendees will understand how to follow a problem and design their own policy with security in mind. This presentation is based on Red Hat/Fedora Linux environment. Please note that this talk replaces one entitled "Sudo logs for Blue Teamers" that was due to have been given by Peter Czanik, who has sent his apologies but is now unable to attend as he has fallen ill. We wish him a speedy recovery.

uk: вхід без авторизації

name: Hardening Linux System with File Access Policy Daemon


FIDO beyond the browser

uk: Комп'ютерні науки

description: FIDO security keys can be used effectively to secure access to websites and applications, rendering phishing attacks harmless with hardware-protected cryptographic keys while keeping a low-friction user experience. Security keys can however also be used for different use cases, that don't necessarily involve a browser. In this presentation we will briefly explain what FIDO Security Keys are and how they work. We will then show how security keys can be used as an alternative to more traditional hardware security solutions like smartcards. In particular we will explain how tools like OpenSSH can be used to not only authenticate users when accessing servers, but also to sign files or other data, such as git commits. We will explain how attestation works and how you can prove that a signature was made using a security key, and how to reliably determine the type of security key used. We will show what FIDO extensions can be used, for instance to store small data files such as certificates on a security key, or to derive symmetric keys that can be used to encrypt data. Finally, we'd like to collect feedback from participants in identifying other use cases that could benefit from security keys as a low cost and versatile way to secure applications.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: OpenSSL 3.0 key feature was FIPS-140-2 certification. As FIPS-140-2 is sunseting, we had to significantly patch OpenSSL to make it FIPS-140-3 capable. The presentation briefly describes major changes in OpenSSL 3.0 architecture, what happened to Old Good API and why deal with new, the provider concepts, and changes necessary to match the new standard. OpenSSL 3.0 key feature was FIPS-140-2 certification. To deal with it properly, the architecture was significantly changed, and applications have to deal with it. A lot of API calls were deprecated, the engines shouldn't be used now, and applications can't rely on all the algorithms are still with us. The brand new provider concept opens new way to extend OpenSSL functionality. As FIPS-140-2 is sunseting, the upstream version can't be taken as is for the future version of the standard. We had to significantly patch OpenSSL to make it FIPS-140-3 capable. We also provided some extra hardening to be sure that only up-to-date algorithms are in use, limited SHA-1 usage, and introduced many other changes.

uk: вхід без авторизації

name: OpenSSL in RHEL: FIPS-140-3 certification: From FIPS-140-2 upstream to FIPS-140-3 downstream


Converting HPKE to be PQ

uk: Комп'ютерні науки

description: Hybrid Public Key Encryption is a new standard which got finalized in February 2022. It uses asymmetric encryption to transfer a symmetric key between two participants which is then used to encrypt the communication. The standard itself is not post-quantum resistant. The presentation explains how to make it post-quantum resistant. Please note that this is a late addition to the schedule, and the programme because the presenter Naveen Srinivasan of previously selected talk "How do you trust your open source software?" was not able to attend on the last minute.

uk: вхід без авторизації


Hardware-backed attestation in TLS

uk: Комп'ютерні науки

description: Authentication among distributed workloads is a critical yet complex task. PKI-based authentication relies heavily on software to anchor the trustworthiness of workloads, therefore failing to reliably convey the security state of the workload in the face of impersonation and persistent attackers. This is most apparent in cases where the underlying platform is particularly exposed and out of the control of the owner, such as in cloud computing and IoT. Hardware features have thus been introduced to enable remotely verifiable “trust metrics” using attestation. Such hardware-backed features provide a cryptographic proof of the software stack, and strong guarantees that the cryptographic keys used by the workload are properly protected from exfiltration. However, remote attestation comes with its own need to share and verify metadata, which must be engineered into existing software. While the protocol used to exchange this metadata is largely irrelevant to the actual attestation procedure, its positioning in the networking stack can enable specific use-cases and enhance the performance of the entire system. An appealing approach is to allow the creation of secure channels (such as TLS connections) using attestation metadata as the authentication mechanism. Current designs either rely on running an attestation protocol on top of an existing secure channel, or modify the semantics of certificates to convey attestation information when establishing the secure channel. Our work focuses on standardising attestation metadata as first-class credentials in TLS. This new approach allows native, opaque metadata to be conveyed for authentication during the TLS handshake instead of (or together with) x509 certificates. Supporting flexibility in deployments without compromising on security has been a prime goal. Thus, we aim to cater to interaction models in which either the client, the server, or both can attest themselves, leveraging any hardware backend, and using different verification topologies. To showcase the standardisation effort, we are also developing an open-source, end-to-end proof-of-concept implementation of one of the interaction models supported. The PoC builds on top of two Linux Foundation projects – Parsec to abstract the root of trust attestation primitives, and Veraison to consume and verify the new evidence formats – and modifies mbedTLS to support a subset of the newly defined TLS extensions. As a hardware root of trust, the proof of concept is currently using a TPM2.0, with support for others being considered.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: The Kerberos PKINIT extension replaces password authentication with X.509 PKI. This bring some advantages but also new risks. This presentation explains and demonstrates how PKINIT works, and presents a novel attack against FreeIPA's PKINIT implementation. Kerberos is an authentication and single sign-on protocol based on symmetric cryptography. To avoid the drawbacks and risks of passwords, the PKINIT protocol extension enables clients to authenticate using public key cryptography and X.509 certificates. To further improve security, private keys can reside and signing/decrytion operations can be performed on hardware cryptographic tokens (smart card, PIV, TPM, etc). I will start the talk with a brief overview of the core Kerberos protocol. Next I will explain how the PKINIT extension works, and demonstrate how to set up and use PKINIT in a FreeIPA environment. (FreeIPA is a free software identity management system that includes MIT Kerberos and Dogtag PKI.) Finally I will discuss some of the risks that arise when using PKINIT, and security considerations for implementers and deployers. I will present and demonstrate a recently discovered PKINIT security flaw in some older (but still supported) versions of FreeIPA.

uk: вхід без авторизації

name: Kerberos PKINIT: what, why, and how (to break it)


Remote Attestation with Keylime

uk: Комп'ютерні науки

description: In various scenarios, it is necessary to attest the integrity of a remote machine, making sure that the system was booted securely, essential files were not modified and that only allowed software is executed. For this purpose, we present Keylime as a remote attestation solution. It leverages the trust from the Trusted Platform Module (TPM) in combination with UEFI Measured Boot and the Linux Kernel Integrity Measurement Architecture (IMA) which are probably available on your system today. We will present how Keylime works and real world applications for remote attestation.

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Post Quantum Cryptography in Voice/Video over IP