uk: Комп'ютерні науки

description: Cilium provides an alternative option for the current Service Mesh ecosystem which eliminates service mesh sidecars to improve performance and reduce latency, operational complexity, and resource usage. By the end, the audience will be able to understand and implement a Cilium service mesh that meets their requirements. Service meshes are becoming the secure, observable networking layer for distributed computing systems like Kubernetes. However, they are also known for their operational complexity and steep learning curve. This talk will help clear up the mess around service mesh. We will start by introducing what a service mesh is intended to do before diving into hands-on demos using Cilium Service Mesh powered by eBPF. The audience will learn how to monitor service-to-service connectivity, collect tracing data and golden metrics using standard Prometheus, Grafana, and OpenTelemetry with eBPF. The talk will close by discussing how eBPF eliminates service mesh sidecars to improve performance and reduce latency, operational complexity, and resource usage. By the end, the audience will be able to understand and implement a service mesh rather than mess.

uk: вхід без авторизації

name: Service MESH without the MESS: Latest of eBPF Powered Cilium Service Mesh


Luca Deri

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: Due to the uniqueness in infrastructure (e.g. ICS vs corporate network), protocols, and cybersecurity threats, network administrators need to have a simple yet effective way to define rules for accounting, detecting and alerting users when specific conditions are met. In this talk, we want to show how ntopng can be used as a scriptable system capable of reacting to network events, by autonomously triggering actions or emitting notifications thanks to its scriptable detection engine based on checks, scriptable actions and notifications. With the ongoing growth of the Internet and corporate traffic, links speed and number of connected devices and users, monitoring and controlling the infrastructure to ensure reliable and safe communications becomes more and more a hard task. Due to the uniqueness in infrastructure (e.g. ICS vs corporate network), protocols, and cybersecurity threats, network administrators need to have a simple yet effective way to define rules for accounting, detecting and alerting users when specific conditions are met. In this talk, we want to show how ntopng can be used as a scriptable system capable of reacting to network events, by autonomously triggering actions or emitting notifications thanks to its scriptable detection engine based on checks, scriptable actions and notifications. ntopng performs network traffic analysis through checks that are executed on various entities including flows (network communications), hosts and networks and can be used to: - save man time by automating manual operations - inform management about critical events, including network performance - implement cybersecurity threat detection and response create custom traffic reports - emit alerts when specific traffic patterns are observed The scripting API is currently available for Lua and Python in addition to C++, and it has been designed not to reduce the application performance during traffic processing.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: ntopng: an actionable event-driven network traffic analysis application: How ntopng can be used as a scriptable system capable of reacting to network events.

FOSDEM VZW

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: Connecting from the browser to a public server with a valid TLS certificate is easy. But what if the server has a self-signed certificate? What if it isn't public? What if it is another browser? This talk covers the intricacies of browser communication beyond the standard browser-to-server use-case. I will give an overview of the many protocols available and how they can be used in a peer-to-peer fashion without sacrificing authenticity, confidentiality or integrity. We will leverage the new WebTransport for secure communication to public servers with self-signed certificates and WebRTC for secure communication to other browsers, using hole puching, without the dependency on central infrastructure.

uk: вхід без авторизації

name: Peer-to-peer Browser Connectivity: Leveraging WebRTC and the new WebTransport protocol to connect libp2p browser nodes.


uk: Комп'ютерні науки

description: Kubernetes is a great solution for hosting highly available endpoint applications, but network functions can still prove challenging. VPN gateways are notably tricky, with overlay and underlay conflicts making their deployment an interesting dance. Performance is also a challenging topic when speaking about scale, most importantly when common optimizations like GSO don't really apply. Leveraging the Calico CNI with a VPP dataplane mixed with multus, allowed us exposing multiple k8s managed interfaces to pods, and thus building complex network functions that still benefit from k8s constructs (HA, service discovery, ...). In the end building an highly available Wireguard gateway gets as easy as building any other application. And it can even leverage accelerated interfaces and cryptographic engines, to reach multiple Gbps without hassle. Hoping this architecture could benefit Kubernetes at large, we started drafting a KEP, proposing to upstream the concept of multiple isolated networks, and standardizing their interaction with existing k8s resources.

uk: вхід без авторизації

name: Need to connect your k8s pods to multiple networks? No problem [with calico/vpp]!: Multi-legged containers running wild with calico/vpp


keywords:
YANG
performance
latency
IPFIX
RSS
profiling
developer tools

uk: Комп'ютерні науки

description: The Swiss ISP SWITCH has developed a scalable IPFIX exporter built using Snabb. In 2022 the application gained many new features, and was upstreamed into the main Snabb repository. We will showcase a production-grade Snabb application, and discuss implementation challenges and how Snabb helps you deal with them.

uk: вхід без авторизації

name: Snabbflow: a scalable IPFIX exporter: A tour of the IPFIX exporter developed at SWITCH


uk: Комп'ютерні науки

description: Time Sensitive Networking is not a new thing per se, since nowadays many dedicated real-time fieldbusses have been replaced by ethernet, and the deterministic transfer of data over ethernet has now become a necessity in a variety of industries. From audio-visual data, over industrial control, to steering data in automotive or avionic applications, all these applications require continuous and reliable delivery of data in predetermined timeframes. This talk will give a brief introduction into the requirements of said applications and provide an overview over the different hardware and software components of TSN applications and how they can be implemented using a Linux system.

uk: вхід без авторизації

name: So you want to build a deterministic networking system: A gentle introduction to Time Sensitive Networking


uk: Комп'ютерні науки

description: "Mesh" is the new hotness when it comes to Wi-Fi. Routers, extenders and wireless range extenders all propose to work together to optimize your Wi-Fi experience. This is where prplMesh comes in. prplMesh is an open source implementation of the Wi-Fi Easymesh standard. It helps organize your network by making onboarding easier, coordinate settings between devices and steer devices to the correct access point. In this presentation, I'll go over some of the challenges of coordinating Wi-Fi devices, and how we use (and develop) open source and open standards to make Wi-Fi better for everyone.

uk: вхід без авторизації

name: prplMesh: open source Wi-Fi mesh: Solving home Wi-Fi


uk: Комп'ютерні науки

description: Internet-based data sources and resources continue to grow exponentially, making the mechanisms for searching and discovering insights, and making sense of data, a crucial field of research. Our talk will present two sister projects, Next Generation Internet (NGI) Search and OpenWebSearch focused on improving the way we search for information in the internet and creating new mechanisms to improve transparency, privacy, and trust, contributing to the overall vision of a more human-centric Internet. Internet-based data sources and resources continue to grow exponentially, making the mechanisms for searching and discovering insights, and making sense of data, a crucial field of research. Our talk will present two sister projects, Next Generation Internet (NGI) Search and OpenWebSearch. The objective of the former is to support innovative projects to develop trustworthy solutions towards the development of new ways of searching data by addressing the challenges of power cognitive search, natural language processing, and social computing amongst other cutting-edge fields through five Open Calls. The projects will be compliant with open, collaborative and unbiased values. On the other hand, NGI OpenWebSearch has its origins in concerns over the imbalance of the search engine market, that are dominated and limited by a few gatekeepers. Thus, information as public good, with free, unbiased, and transparent access is not under public control anymore. Over the next three years the researchers will develop the core of a European Open Web Index (OWI) as a basis for a new Internet Search in Europe. Both projects will lead to more transparency and choice with a focus on privacy and trust, contributing to the overall vision of a more human-centric Internet.

uk: вхід без авторизації

name: NGI Search and OpenWebSearch.EU projects: Two sister initiatives for a paradigm change in open search and discovery on the internet


uk: Комп'ютерні науки

description: In this talk I will tell a success story of how I managed to drive Nix adoption at Profian starting with reproducible release binary builds, to project CI and all the way to using NixOS in production. I will discuss the benefits gained from the company-wide Nix adoption, share the approach used for achieving this, my strategy for introducing colleagues to Nix, lessons learnt, pitfalls and hurdles encountered, as well as problems identified in the process.

uk: вхід без авторизації

name: A success story of adopting Nix at a workplace: From reproducible CI builds to production


Contracts for free!

uk: Комп'ютерні науки

description: Nix lacks of a static type system could be really annoying when we want to debug our expression, and understand what's part of code or data is wrong. Dynamic types libraries[1][2] comes to the rescue, giving a simple API to assert that data is valid.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Present the newly created Nix team, and give a glimpse at the Nix development process. Nix has for a long time been struggling with a very low (~1) bus factor and a lack of clear development process, leading to some frustration from both users and contributors. To remedy that, we've recently created the Nix team with the goal of collectively “tak(ing) ownership of the Nix source code”. This talk presents that Nix team, and gives a glimpse at the Nix development process.

uk: вхід без авторизації

name: The Nix package manager development process


uk: Комп'ютерні науки

description: How Nix can turn the complexities of developer environments into a set of simple values without making any sacrifices. I'll show how the design is extensible beyond the core features and how any programming language ecosystem in the world can be supported.

uk: вхід без авторизації

name: devenv.sh - Fast, Declarative, Reproducible, and Composable Developer Environments


uk: Комп'ютерні науки

description: Yup, you heard me right! I am two years into Nix and NixOS bause I endedup working with a team deeply involved with such technology that I never hear about even if I spent 8years out of 10 doing cloud computing, automation and YAML! I have to admit it is not easy to pick up, nix is weird, you never know what options to use and now it is all about flakes but I feel powerful. In this talk I want to show you my dotfiles and how I manage my little homelab. I will talk to you about netbooting, nixos-rebuild build-vm. A practical and driven by frustration approach to NixOS

uk: вхід без авторизації

name: I am excited about NixOS, I want to tell you why!


Make Anyone Use Nix: "It'll be fine"TM

uk: Комп'ютерні науки

description: Who cares about immutability, declarative configuration and reproducibility? Well, certainly not the people whom I want to get to use Nix. Let's be creative for our plan to make Nix take over all package management. Tricks, treachery, lies... anything goes to "nixify" the heck out of the world!

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Nickel is a generic configuration language, heavily inspired by Nix but adding a number of features such as a gradual type system and a built-in merge system for records. This in turn allows for a better developer experience (error reporting, powerful LSP server, introspectability), more runtime guaranties, and eventually better performances (since there's no need to encode a computationally costly module system into it). Nixel is an experimental Nickel library allowing to use Nickel for writing Nix configurations. This makes it possible to leverage the niceties of the language for writing modular and user-friendly configurations.

uk: вхід без авторизації

name: Nixel: a nicer way to write your Nix expressions


uk: Комп'ютерні науки

description: Nix, and by extension NixOS, are incredible tools to define infrastructures and deployments of dedicated machines. Unfortunately, sometimes the load is too big for even an optimized network stack and we need to get dedicated equipment such as load balancers to handle the load. What if we could configure those from within Nix? P4, a Domain Specific Language intended to produce highly optimized network processing code, allows for that. It can produce code that can be synthesized to FPGAs or even configure network ASICs in order to have optimized solutions to those problems. Points we'll touch on: Writing a transpiler in Nix, Automatic (re-)deployment of synthesized code, hardware definition for Nix-reprogrammable hardware.

uk: вхід без авторизації

name: P4 in Nix: Bringing hardware accelerated network to the masses!


uk: Комп'ютерні науки

description: What happens when you have access to large clusters, but have little control over the software installed on the machines? Unfortunately, this is the current scenario that researchers often find in HPC clusters, which include very old software stack, a brittle environment and non-cooperative sysadmins. We have been experimenting with Nix to provide an up-to-date system running on top of the already existing software, without root permissions with the help of user namespaces. In this talk we give a tour on the problems we found and how we solved them: Starting from the installation and configuration of nix to be used by multiple users when we lack a shared /nix store. - Avoiding library contamination from /usr/lib with an isolated root mount - Interactive development while compiling the code inside the isolated environment with a patched nix-portable - Adding custom compilers to the stdenv Building packages tuned to an specific CPU with vectorization optimizations in mind. - Running the benchmarks with SLURM inside the isolated environment with multiple compute nodes. Improving MPI fast zero-copy transfer inside user namespaces.

uk: вхід без авторизації

name: Playing with Nix in adverse HPC environments


Towards Secure Boot for NixOS

uk: Комп'ютерні науки

description: This talk gives an overview about the state of Lanzaboote, a set of tools that enable Secure Boot for NixOS. UEFI Secure Boot is a firmware security feature that prevents untrusted code from booting on a system. Users can utilize this technology to prevent certain kinds of attacks that involve booting malicious code on their computers. Unfortunately, NixOS has no support for Secure Boot yet. The talk will give a short background of Secure Boot, go through NixOS-specific challenges, and explain the strategy we took for enabling Secure Boot in NixOS. We will highlight the newly developed components, such as a custom UEFI boot stub and companion Linux userspace tool, which are both written in Rust. Finally, we will explain the current state of upstreaming Secure Boot support in NixOS.

uk: вхід без авторизації


NOVA Microhypervisor Feature Update

uk: Комп'ютерні науки

description: NOVA is a modern open-source microhypervisor that can host unmodified guest operating systems next to critical host applications. After adding support for multiple instruction sets (ARMv8-A and x86_64), NOVA's code base has been restructured to share as much code between architectures as possible. I will give an overview of the new abstractions that make NOVA fit for the next decade and discuss how advanced features, such as boot-time relocation and code patching, multiple resource spaces, support for suspend/resume, cache allocation technology, control-flow protection and multi-key total memory encryption have increased NOVA's flexibility, security and performance even further.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This talk will be about Nym, a new anonymous overlay network for the internet based on mixnet. Unlike other privacy-enhanced technologies like OpenVPN and Tor, Nym defends against global passive adversaries that have a "God's eye" view of the entire network, like the NSA. Nym does this by mixing internet packets at nodes so they do not exit the mixnet in FIFO, as well as adding fake traffic. Like Tor, any application and use SOCKS proxies to bind to Nym. As Nym is built in Rust, it also allows WebSockets and other direct integration. We can demonstrate how the Nym mix network hides network-level metadata from everything from Bitcoin to Telegram. Nym has been supported by both H2020 PANORAMX and Next Generation Internet projects on the EU level. Although the original project was started by a Neuchatel-based startup, the project takes contributions from volunteers. Mix nodes are ran in a decentralized manner and keep track of their reputation using the NYM token. Currently, there are approximately 500 mix nodes, but new nodes and applications are welcome. Nym works well for asynchronous, message-based traffic like instant messaging and e-mail, while Tor works better for synchronous, circuit-based traffic like Web browsing. Both projects should be able to work together to provide full-privacy for users.

uk: вхід без авторизації

name: The Nym Mixnet: Intro to a new anonymous communication network


uk: Комп'ютерні науки

description: In a world characterized by an increasingly complex geopolitical climate, war and with vital challenges like climate change begging for immediate and substantial action, the open source community has a unique role to play and has a vital chance to deliver solutions for these long standing issues at a pace and effectiveness that no single individual or public or private entity could. In this session we will explore how contributors, maintainers, public and private sector are, should come together through the positive-sum game that open source is to impact not only the future of technology but drive impactful outcomes is some of the most pressing global social challenges. If software is eating the world, then, by all metrics, Open Source is eating software. That means that collaborations and innovation that happen every day in the open source community don't only have a major impact on technology but, as every industry and nation states undergo the "digital transformation", have a unique potential to make a lasting impact in our daily lives and offer novel solutions to long standing issues like climate change, incurable illnesses, financial inclusion and food scarcity, as well as bridge historical geopolitical rifts to continue to deepen in an increasingly divided world. This session will provide an overview of existing open source projects which are making already a huge impact on fundamental areas like Energy and Climate, Public Healthcare, Agricultural innovation and financial inclusion, as well as hone in on areas where open source collaboration can build bridges across historically divided, if not hostile, regions and states by putting forward a model for a positive sum-game that all actors in the open source community, from individuals to the private and public sector, can benefit from, while delivering immense collective value. Developers and especially open source contributors have a unique power in their hands if we collectively are able to harness it towards higher and higher order challenges: this talk will be an open letter and call to action to everyone, with a particular focus on policy makers and governments around the world, to focus our efforts towards making the world a better place through open collaboration.

uk: вхід без авторизації

name: Making the world a better place through Open Source: Focusing the unique power of Open Source Communities as force of social good in today's complex geopolitical landscape


uk: Комп'ютерні науки

description: Formal verification is the act of proving the correctness of software using mathematics. That means proving that your code is free of bugs and/or follows its specifications. SPARK is both a language (subset of Ada) and a set of tools that bring automatic formal verification in the hands of any developer. This technology is getting more interest from the industry (e.g. NVIDIA recently) for its extremely powerful properties in terms of safety and security. However, it is not widely known that SPARK is both open source and very easy to start using. In this talk I will provide quick and easy instructions to start your first formally verified library in SPARK. Using only free and open-source tools and resources (compiler, package manager, IDE, verification tools).

uk: вхід без авторизації

name: Get Started with Open Source Formal Verification


uk: Комп'ютерні науки

description: The Good Governance Initiative (GGI) proposes a management framework to help shape, build and develop an OSPO, from the roadmap definition to the actual implementation of best practices, and further down the road to a full strategy that will actually deliver the greater benefits of the community and ecosystem. In this session, we will briefly present the method and content of the Good Governance Initiative Handbook, and demonstrate how to put it in action through the automatic deployment of a personalized dashboard to implement the method in a local context. We will also review how you can participate and contribute to the initiative and help translate it into your own language. Every organization nowadays heavily relies on open source software and ecosystem; therefore, enabling a solid and resilient software supply chain and innovation has become a key topic for many. Open Source Program Offices are an essential enabler for this change, yet many organizations still lack the proper understanding and vision to actually define and organize them. The GGI methodology is a community-built framework, part of the OSPO Alliance launched in 2021 by European non-profit organizations (OW2, Eclipse Foundation, OpenForum Europe and Foundation for Public Code) and developed as an OW2 Initiative. It is entirely managed as an open source project, collaboratively developed on GitLab, and is progressively enriched and fueled by end-users feedback.

uk: вхід без авторизації

name: Open Source Good Governance – GGI Framework presentation & deployment: A quick introduction to the OSPO Alliance handbook and resources


uk: Комп'ютерні науки

description: By design, OSv has always been a "fat" unikernel and by default has provided a large subset of glibc functionality and has included full standard C++ library (libstdc++), the ZFS implementation, drivers for many devices, and has supported many hypervisors. On one hand, it makes running arbitrary applications on any hypervisor very easy using a single universal kernel. On another hand, such universality comes with the price of the bloated kernel with many symbols and drivers and possibly ZFS unused, thus causing inefficient memory usage, longer boot time, and potential security vulnerabilities. In addition, the C++ applications linked against a version of libstdc++ different than the version the kernel was linked against, may simply not work. In this presentation, I will talk about enhancements in the new release 0.57 to address these issues. More specifically, I will focus on a new experimental build mode to hide the non-glibc symbols and libstdc++ and extract ZFS code out of the kernel in form of a dynamically linked library. I will also explain another new build option to tailor the kernel to a set of specific device drivers - 'driver profiles', and another new mechanism to allow building a version of the kernel with a subset of glibc symbols needed to support a specific application. Finally, I will also cover other interesting improvements and optimizations like "lazy" stack, minimal netlink support, and novel ways to build and run ZFS images.

uk: вхід без авторизації

name: Evolution of OSv: Towards Greater Modularity and Composability


uk: Комп'ютерні науки

description: Passbolt is an open source password manager designed for collaboration and built on top of OpenPGP. In this presentation we will give a quick overview of the product functionalities, the security model and review the differences with other existing password managers. We'll have a high level look at the code architecture as well as our methodology and tooling for developing and testing the product. Finally we will touch based on the latest feature development and the roadmap for 2023 and beyond.

uk: вхід без авторизації

name: Passbolt: Open source password manager for teams


Announcing pg_statviz

uk: Комп'ютерні науки

description: Announcing pg_statviz, a minimalist extension and utility pair for time series analysis and visualization of PostgreSQL internal statistics. This talk will be the official announcement of pg_statviz, a new extension and utility pair created for snapshotting PostgreSQL's cumulative and dynamic statistics, and performing time series analysis on them. The accompanying utility can produce visualizations for selected time ranges on the stored stats snapshots, enabling the user to track PostgreSQL performance over time and potentially perform tuning or troubleshooting.

uk: вхід без авторизації


Update on #JavaOnRaspberryPi and Pi4J

uk: Комп'ютерні науки

description: Controlling electronics with Java and Pi4J is a perfect way to further extend your knowledge and learn about hardware and various communication protocols. In 2022 articles were published on Foojay.io about using SDKMAN, JBang, Vaadin, Kotlin, and many more on the Raspberry Pi. These prove that Java and the JVM are a perfect match with this small and inexpensive Linux PC for experiments, pet projects, learning, etc. Let's take a look back at what has been realized in 2022 regarding #JavaOnRaspberryPi and what we can expect in 2023.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Over the pandemic years, conference organizers have had a crash course in running online events, but now that the world is returning to normality, they're under pressure to keep the on-line portion of the conference for a hybrid remote/local event. Linux Plumbers Conference is a usually in-person event that specializes in direct in-person interactions as well as more traditional presentations. This year was the first time we tried to take our on-line infrastructure and repurpose it for hybrid in Dublin in September. One of the big factors in running a hybrid conference is that it's no longer just the committee and a server farm, you have a venue, a local audio team, an external A/V handler and the technology all to plumb into a seamless experience. Plumbers online was based on BigBlue Button and Matrix, which is what we also used for hybrid. This presentation will be the story of how it was put together, how the in-person and local components were designed to interact, how it worked in the field and, although plumbers received universal acclaim for being one of the most successful hybrid conferences, the many things that went wrong during the conference and how we surmounted, or at least worked around, them. Our technology infrastructure was set up identically to virtual: BigBlue Button (BBB) handling the audio/video but with the in BBB chat element replaced by matrix. The reason we have an external A/V company in the mix above is because we've always done streaming from the in-person conference, and this was planned to be our free tier of the conference; view the stream and be able to interact with the room chat over matrix. We've discussed before the scaling problems of this setup (and so won't go over scaling in this presentation), but we'd fixed this in virtual and had no scaling issues in hybrid. Of great importance to getting the interaction to function was audience training. We used the same methodology for virtual (essentially only unmute your video if you want to interject) and hybrid, so we already had the on-line training ready to go. Part of the on=site issues were caused by the steep learning curve the external A/V company had to go through to manage the room BBB console as well as getting the in room sound setup correct (onsite audio isn't used to having a remote feed, but they can be persuaded to treat it like an audio feed from the presenter). Our biggest problem actually turned out to be the size of our onsite committee tech team (2 people) which was insufficient to the number of live rooms (six) we were running.

uk: вхід без авторизації

name: Running a Hybrid Event with Open Source: The Plumbers Experience


uk: Комп'ютерні науки

description: Podcasting has been around for 20 years. Many revolutions have happened since then: DSL connections, smartphones, social networks, artificial intelligence everywhere… But Podcasting stayed still and its decentralized architecture resisted to the big corporations. In this talk we will show how the Podcasting 2.0 community is reinventing Podcasting by adding tons of new features, while keeping all this interoperable. We will quickly demonstrate how this actually works with Castopod, an open-source podcast hosting solution.

uk: вхід без авторизації

name: Podcasting 2.0: it's all about Interoperability: How Podcasting 2.0 will save the Open Internet


uk: Комп'ютерні науки

description: In this session we will briefly describe Apache Pulsar and Jakarta JMS. We will see how Apache Pulsar concepts map to the Jakarta Messaging Specifications. You will also see how to connect a Jakarta EE application to Pulsar just by dropping a Resource Adapter in your application server and basically zero code changes.

uk: вхід без авторизації

name: Modernizing Legacy Messaging System with Apache Pulsar


uk: Комп'ютерні науки

description: Java is a great programming language, however 'traditional' Java isn't so great to work with when it comes to modern, Cloud Native development. Quarkus is a (fairly) new Java stack that addresses issues such as the typical slow startup time and rather large memory usage that hinder the adoption of Java in container and/or Serverless workloads. Quarkus is not just useful for optimizing resource usage though. There is also a big focus on improving the developer experience. In this session we'll demonstrate how Quarkus is very easy to work with and allows developers to work with containers and external dependencies such as databases, Kafka clusters, Kubernetes etc without being experts in any of these technologies. After this session, the audience should come away with inspiration to build modern Cloud Native applications with Java, and have fun doing so!

uk: вхід без авторизації

name: Quarkus 101: Intro To Java Development With Quarkus


uk: Комп'ютерні науки

description: Rosegarden is an open-source Linux MIDI, Audio sequencer and Notation editor, originally created for a university project in 1992 and is still going strong over 30 years later. The current incarnation of Rosegarden for Linux was kick-started in 2001 by Chris Cannam, Guillaume Laurent and Richard Bown. In this talk, one of the original creators of this legendary piece of OSS history takes you through the project's history and analyses some of the critical elements for its continued success to this day. The 'current' version of Rosegarden was actually a complete bottom-up rewrite that started in 2001. The previous incarnation (Rosegarden 2.1) was initially written for IRIX and then ported to other UNIX variants, including in 1995, Linux. The current version has not significantly changed since its original architecture was settled in 2001-2004. What's so good about it that keeps it working to this day? How many people are working on it now? And what do current users think of the project and where is it going next? Join Richard for an entertaining and exciting ride through Linux audio history as well as the history and architecture of Rosegarden.

uk: вхід без авторизації

name: Rosegarden: A Slumbering Giant: How a 20-year old OSS project is still going strong


uk: Комп'ютерні науки

description: Started in 2014, the gccrs project is working toward creating an alternative compiler implementation for the Rust programming language. At the moment, the project targets the 1.49 version of the language and hopes to catch up once that milestone is reached. In that talk, we will explore some of the components inside gccrs, as well as dive into some of the hurdles encountered during the project's lifetime. Finally, we will explore ways to cross-pollinate with the Rust community, in order to help and benefit both projects. Specifically, we will dive into some ways we plan to share components with rustc, and how to achieve that: namely, we will look at how we plan on integrating the Polonius project to perform borrow-checking inside gccrs, what our efforts with running the rustc 1.49 testsuite are, and what we need to achieve to start being useful to the Rust- for-Linux project.

uk: вхід без авторизації

name: A deep dive inside the Rust frontend for GCC


uk: Комп'ютерні науки

description: CHERI defines hardware extensions to encode access constraints on pointers, enabling hardware enforcement of such restructions based on metadata stored alongside pointers. There is an ongoing drive to support compiling Rust code in a way that can make use of these extensions. Doing this provides another layer of protection. We can encode knowledge about provenance validity, bounds and other access restrictions that the compiler (and OS/etc.) knows about in a way the hardware can enforce at runtime. The Rust memory model is famous for being able to enforce these types of restrictions at compile time, but not for unsafe Rust code. Unsafe Rust code needs to be written sometimes, which presents situations which can only be verified at run time. Some other nice benefits could come from this work. For example, runtime bounds checking can now be done by hardware rather than software, and since provenance information is necessary for operations on capabilities, closing gaps where it is not currently preserved forms a part of this work. This talk is a discussion on what is required for this support, and gives an overview of the state of the various attempts to implement this support.

uk: вхід без авторизації

name: A Rusty CHERI - The path to hardware capabilities in Rust: A status report on ongoing efforts to support CHERI architectures in Rust


uk: Комп'ютерні науки

description: Atuin aims to make your experience with your shell history delightful. It stores every command and the context around it (eg, directory it ran in, duration, etc) in a SQLite database, and then provides fuzzy search on top of that. Along with the Atuin sync server, this history can be made available on every machine the user has. I'll be walking the audience through how the project works, what problems it solves, as well as how it was implemented. I will assume the audience has some working familiarity with the shell, but the talk will be friendly for Rust beginners or anyone curious about the language.

uk: вхід без авторизації

name: atuin: magical shell history with Rust: useful shell history on all of your machines


uk: Комп'ютерні науки

description: In this talk I share the motivation, goals, and architecture of my new project Aurae. Informed by my experience of operating large production platforms I discuss my thesis of how bringing deliberate runtime controls to a node will unlock a new generation of higher order distributed systems. The audience walks away with an in-depth understanding of the current state of affairs Rust and the Aurae runtime project. We learn about my journey to Rust from working with Go in Kubernetes. I am an accomplished Go engineer who has made the jump into Rust and I believe my story is worth compiling and sharing with FOSDEM. I believe there will be many like me in the future. Aurae is on a mission to be the most loved and effective way of managing workloads on a single piece of hardware. My hope is that by bringing a better set of controls to a node, I can unlock brilliant higher order distributed systems in the future. Aurae takes ownership of all runtime processes on a single piece of hardware like systemd, and provides mTLS encrypted gRPC APIs (Aurae Standard Library) to manage the processes. Aurae has a new style of isolation called "Aurae Cells" that manage cgroups and namespaces directly from pid1. With Aurae Cells the project offers a way to slice up a system using various isolation strategies for enterprise workloads including MicroVMs. Learn about 3 specific parts of the project and how they influenced the decision to move to Rust. Managing cgroups (v1/v2) directly with Rust, and how kata containers and systemd influenced the container runtime module. mTLS encrypted gRPC with tonic and rustls. Learn why I have given up on OpenSSL and where rustls is working well and not so well for us. Serving ephemeral short lived microVMs with Aurae, and how we "spawn" a new host and kernel into a microVM that shares properties with the parent instance of Aurae. I talk about my journey to Rust from Go and why I believe it is necessary to reimagine parts of Kubernetes in Rust.

uk: вхід без авторизації

name: Aurae: Distributed Runtime: A new node init system written in Rust


uk: Комп'ютерні науки

description: Application developers working and testing with a specific kernel version should be able to easily control their application compatibility behavior with previous (and future) kernel versions as well. We developed a Landlock library (for security sandboxing purpose) that protects users as much as possible while making the work of application developers easier and safer. This talk gives feedback about the development of a security library that needs to deal with backward and forward compatibility, because of security features tied to specific kernel versions, handling different use cases in a safe and secure way. We explain patterns that we used to make it possible to fine tune the requested (optional) features while providing a safe default behavior. For simple use cases, the idea is to provide a best-effort security approach for potentially unsupported kernel features: use available features and ignore others. However, in more complex use cases, we may want to make some features depend on others. We may also want to handle errors differently based on unsupported features.

uk: вхід без авторизації

name: Backward and forward compatibility for security features


uk: Комп'ютерні науки

description: We present BastionLab, a Rust open-source privacy framework for confidential data science collaboration. We aim to help data owners open access to their datasets to outside data scientists. The current approaches, such as opening Jupyter notebooks, provide no elaborate control over what is shared. Datasets can easily be extracted from them, which means they offer little privacy guarantees and make data collaboration difficult. BastionLab provides an interactive interface for data scientists to explore remote datasets, yet answers the privacy concerns of data owners, as only results compliant with the privacy policy defined by the data owners can be communicated. Data exposure is limited as data scientists never have direct access to the data, they can only use a limited set of operators which preclude arbitrary code execution to exfiltrate data, and a strict access control policy is put in place. Differential Privacy and Trusted Execution Environments are supported as well to ensure maximum privacy. We will provide an example to show how a COVID dataset could be shared to a remote data scientist to perform data exploration, cleaning and visualization, while making sure only anonymized results are communicated. The server side of BastionLab is developed in Rust for its memory safety, performance and community. It allows the use of cutting-edge libraries like polars, an open source DataFrame library in Rust several times faster than pandas, the go-to solution in Python.

uk: вхід без авторизації

name: Presentation of BastionLab, a Rust open-source privacy framework for confidential data science collaboration


uk: Комп'ютерні науки

description: Follow me as I walk through my journey of building lnx, a distributed search engine written in Rust akin to Elasticsearch or Algolia that aims to be faster and more efficient using tantivy. I cover the challenges and solutions I encountered while developing lnx over the last year, the tradeoffs made and how you can build your own search engine using the tools the Rust ecosystem provides. In the first part of the talk we'll look at what a search engine like Algolia or Elasticsearch does, how tantivy works, what things we need to do in order to make it suitable for user-facing search and how we implement it into our code to build our own application. In the second part of the talk I talk about the biggest issue you run into when building a search engine or any other system designed to store data... Fault tolerance and replication, together we'll go through the challenges of implementing this for a search engine using tantivy, keeping the performance competitive, reliable and the tradeoffs that are made to make it work. We'll look at some existing implementations like Raft and take a dive into the world of eventual consistency! With any luck, you'll have a better understanding of how we can build services like search engine using libraries like tantivy along with solving technical challenges like consensus and replication for distributed systems in Rust.

uk: вхід без авторизації

name: Building a distributed search engine with tantivy: How lnx is solving the challenges of builing a distributed search engine in Rust


uk: Комп'ютерні науки

description: Sorting is one of the most common algorithms used in programming, and virtually every standard library contains a routine for it. Despite also being one of the oldest problems out there, surprisingly large improvements are still being found. Some of these are fundamental novelties, and others are optimizations matching the changing performance landscape in modern hardware. In this talk we present Glidesort, a general purpose in-memory stable comparison sort. It is fully adaptive to both pre-sorted runs in the data similar to Timsort, and low-cardinality inputs similar to Pattern-defeating Quicksort, making it to our knowledge the first practical stable sorting algorithm fully adaptive in both measures. Glidesort achieves a 3x speedup over a Rust’s standard library Timsort routine on sorting random 32-bit integers, with the speedup breaking the order of magnitude barrier for realistic low-cardinality distributions. It achieves this without the use of SIMD, processor-specific intrinsics or assumptions about the type being sorted: it is a fully generic sort taking an arbitrary comparison operator. Using Glidesort as the motivating example we discuss the principles of efficient stable in-memory partitioning and merging on modern hardware. In particular attention is paid to eliminating branches and interleaving independent parallel loops to efficiently use our modern deeply-pipelined superscalar processors. The lessons learned here are widely applicable to efficient data processing outside of sorting. We also go into more detail on the various intricacies that Glidesort has to overcome in our Rust implementation. In particular how to deal with splitting and concatenating slices in a safe manner using GhostCell-style branding, the problems faced when dealing with panics in the comparison operator, and potential issues with interior mutability in comparison operators.

uk: вхід без авторизації

name: Glidesort: Efficient In-Memory Adaptive Stable Sorting on Modern Hardware


uk: Комп'ютерні науки

description: Pydantic is a data validation library for Python that has seen massive adoption over the last few years - it is estimated that Pydantic is now used by about 10% of professional web developers! Over the last year I've been working full time to rebuild Pydantic from the ground up, using Rust for virtually all the validation and serialization logic. Pydantic V2, with these changes included, will be released early in 2023. In this talk I will give a brief introduction to Pydantic V2 before diving into how the use of Rust has allowed us to completely change the architecture of Pydantic to make it easier to extend and maintain while also improving performance significantly. The majority of the talk will be devoted to using examples from the pydantic V2 code base (rust and python) to demonstrate the advantages (and disadvantages) of writing libraries like Pydantic in Rust. This talk should be interesting to any Rust or Python developer who's interested in combining the two languages - no knowledge of Python or Pydantic is required.

uk: вхід без авторизації

name: How Pydantic V2 leverages Rust's Superpowers: Using Rust to build Python extensions


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Let's write Snake game!: Using Bevy engine, we will code together a snake game from scratch


Merging process of the rust compiler

uk: Комп'ютерні науки

description: This talk will shortly present how a patch gets merged for the rust compiler and how the whole process happens and what happens after it was merged. To provide more details about the talk, I will speak about the tools and processes involved depending on the kind of contribution to be merged and what each involves.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: In programming we use editors and IDEs all the time. Previously if one use Vi/Vim like text editor it typically means you just edit soruce code as simple text, but nowadays things have been changed. Especially after releasing support of the Language Server Protocol(LSP), which works as a client to LSP servers for example rust-analyzer. This talk gives deep dive of Language server Protocol implementation for Rust and how to build friendly relationships between rust-analyzer and Neovim. In this talk i’ll start from brief of what’s LSP and rust-analayzer, some missing features you probably didn’t know about? E.g. go-to-definition, find-references, hover, completion, rename, format, refactor, etc., using semantic whole-project analysis. Also i’ll show you how to write you first plugin using Rust and interact with some LSP primitives. to turn you editor in God mode surf trough it like a pro.

uk: вхід без авторизації

name: Neovim and rust-analyzer are best friends


uk: Комп'ютерні науки

description: In this talk I'm going over some lessons learned from building internal APIs in Rust as well as some public APIs such as the Redis rust crate, the insta snapshot testing library, the MiniJinja template engine and more. It covers lessons learned from making mistakes, more crafty abstractions with generics and more of building libraries in Rust for 10 years.

uk: вхід без авторизації

name: Rust API Design Learnings: Lessons learned from building Rust libraries


uk: Комп'ютерні науки

description: Graphs are used in many different applications as they are an intuitive way for representing complex relationships between entities, as for example in social, communication, financial or geographical networks. Graphs in these domains can be very large, potentially spanning multiple millions and even billions of nodes and edges. In order to get analytical insights out of these structures, scalable implementations of graph algorithms are necessary. Rust is the ideal language for implementing such algorithms, due to its well-known aspects, such as "fearless concurrency" and memory safety as well as its great out-of-the-box performance and its expressive type system. In our presentation, we will talk about the "graph" project, a collection of open source crates that we are working on. The project includes an in-memory graph representation, APIs for building in-memory graphs from various data sources, and a small collection of high-performance graph algorithms. In addition to these building blocks, we started developing a Python wrapper called graph-mate for a NetworkX-like experience and an Apache Arrow endpoint for integrating the project in distributed applications. The presentation will include a project overview, a walk through the Rust API, and a demo for using the project via Python.

uk: вхід без авторизації

name: Scalable graph algorithms in Rust (and Python)


Slint: Are we GUI yet?

uk: Комп'ютерні науки

description: Slint is an Open Source GUI toolkit for Desktop and Embedded. It is written in Rust, and comes with a declarative UI description language that compiles into native Rust code. We will present Slint and show how you can build an reactive GUI in Rust One of the question that often comes out is "Are We GUI Yet?". i.e. can you use Rust to create user interfaces? Our answer to that question is "Yes, with Slint" Slint is an Open Source GUI toolkit. It scales from desktop platforms all the way down to micro controllers with only a couple of hundred of KB of RAM. Thanks to the great tooling around Rust, it is also really easy to build a UI that can run on multiple different platform: Desktop native UI, wasm in the browser, or MCUs. This presentation will be a presentation of Slint, demonstrating what you can do with it and how to use it.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: When creating a script or a tool to manage your network configuration it is hard to decide which language should you use. In Nmstate we noticed we could get plenty of benefits from Rust. Nmstate is a library with an accompanying command line tool that manages host networking settings in a declarative manner written in Rust. In this talk, we are going to see how we combined several existing libraries and also created our own ones to create a powerful networking tool. In addition, we will share our lessons learned from rewriting a project from Python to Rust. Of course, the talk will be full of crabs, so don't miss it!

uk: вхід без авторизації

name: Using Rust for your network management tools!


uk: Комп'ютерні науки

description: Unikernels are specialized, single-address-space machine images built from library operating systems. They shrink the attack surface and resource footprint of cloud services. Applications that are compiled into unikernels are able to boot virtual machines. Using library operating systems enables static analysis of the image's whole software stack: from the kernel to the application. In this talk, we present the transition from the C-based HermitCore to the Rust-based RustyHermit unikernel. Using Rust's build system, the unikernel is split into components, whereby the end-user is able to specialize the application and the resulting boot image. QEMU's microvm virtual platform and Firecracker are lightweight virtual machines (microVMs), which are specialized for cloud environments. We show the benefits of the component-based architecture to build specialized applications for microVMs. Minimalistic design of unikernels and microVMs reduce the memory footprint and the attack surface of the complete software stack and build an ideal base for cloud services.

uk: вхід без авторизації

name: A Rust-Based, modular Unikernel for MicroVMs: RustyHermit @ FOSDEM 2023


uk: Комп'ютерні науки

description: OpenStack and Ceph have a long integration story that changed over the time to make the two technologies coexist in the same context as basic building blocks of Cloud infrastructures. ceph-ansible has been one of the most popular orchestrators for Ceph, but cephadm and the Ceph orchestrator have been a game changing in the way how operators interact with Ceph. To streamline the deployment process, OpenStack services need to be configured to interact with Ceph but there is also a need to bootstrap, configure and tune the Ceph cluster to meet the OpenStack workload. An example is Manila, where the new ceph mgr interface enabled new drivers and simplified the existing use cases. This talk will give an overview of the current state of the integration, and how projects in the OpenStack ecosystem changed and updated the reference architecture as a result of the introduction of cephadm and the Ceph orchestrator but also look towards at the Kubernetes integration, when a single Ceph cluster can be shared by OpenStack (rbd interface) and the Kubernetes workloads via pvc.

uk: вхід без авторизації

name: Present and future of Ceph integration with OpenStack and k8s


uk: Комп'ютерні науки

description: This presentation describes the new read (aka primary) balancer that is added to Ceph next version (Reef) and explains how the framework developed as part of this balancer for more sophisticated use cases. Specifically, it shows how you can use this framework and creates a policy that changes the SDS load dynamically so it can mitigate effects such as noisy neighbors and faulty network devices (NICs or ToR switch) without moving data around. This can be very useful when the effects described are temporary (for example noisy neighbor in hyper-converged environment) The new balancer is based on a policy that defines the desired primary configuration and the engine that changes the configuration to meet the desired configuration (or at least be as close to it as possible). The engine is fast and involves no data movement (only metadata changes). As a result, it can be executed periodically over relatively short periods. Given this feature, anyone can write policies that react to changes in the cluster behavior in near real time. We will show some use cases and the logic to build policies that maximize the cluster performance for these use cases.

uk: вхід без авторизації

name: Dynamic load change in SDS systems: How to make well behaved SDS systems in an ever changing cluster


uk: Комп'ютерні науки

description: We manage a 200TB glusterfs cluster in production. While we were managing this, we learnt some key points. In this session, we will share with you: - What are the minimal health checks that are needed for a glusterfs volume, to ensure high availability and consistency - What are the problems with the current cluster expansion steps(rebalance) in glusterfs we experienced? How did we manage to avoid the need for a rebalancing of data, for our use-case. Proof of concept for new rebalance algo for future. - How are we scheduling our maintenance activities such that we never have downtime even if the things go wrong. - How did we reduce the time to replace a node from weeks to a day. As the number of clients increased we had to scale the system to handle the increasing load, here are our learnings scaling glusterfs - How to profile glusterfs to find performance bottlenecks. - Why client-io-threads feature didn't work for us? How we improved applications to achieve 4x throughput by scaling mounts instead. - How to Improve the incremental heal speed and patches contributed to upstream Road map for glusterfs based on these findings

uk: вхід без авторизації

name: Lessons learnt managing and scaling 200TB glusterfs cluster @PhonePe


uk: Комп'ютерні науки

description: In this talk we are going to introduce you to the Rook Ceph Operator, which can be used to run Ceph clusters with ease on top of Kubernetes clusters. In helping make it easy to run a Rook Ceph cluster we will also be talking about the current state of the project development, the kubectl krew plugin and some more advanced features. There will be a demo about the rook-ceph krew plugin on how it is used to automate common management tasks and can make the troubleshooting process easier.

uk: вхід без авторизації

name: Intro to Ceph on Kubernetes using Rook: Rook Ceph in Kubernetes and the rook-ceph krew plugin


uk: Комп'ютерні науки

description: Ceph was originally designed to fill a need for a distributed file system within scientific computing environments but has since grown to become a dominant unified software-defined distribute storage system. Today, it is also notably used as an enterprise-quality block device and object store provider. This talk will cover the new development of an SQLite Virtual File System (VFS) on top of Ceph's distributed object store (RADOS). I will show how SQL can now be run on Ceph for both its internal use and for new application storage requirements. The talk will cover: - Existing storage abstractions on Ceph. - Very brief introduction to RADOS. - Very brief introduction to SQLite and its VFS abstraction. - The libcephsqlite library and how it works. - How to use libcephsqlite in an application. - How Ceph uses libcephsqlite. - What's in the future?

uk: вхід без авторизації

name: SQL on Ceph: An introduction to the new libcephsqlite library


uk: Комп'ютерні науки

description: There's a lot of consumer open-source products out there, beyond the realm of developer tools. There are now open-source competitors for almost any proprietary productivity, project and knowledge management, and other digital tools. But to fully take advantage of open-source so far required at least basic coding knowledge -- without it, one is not able to fork or self-host the software, and is confined to using the cloud version only. Open-source PaaS (Platform-as-a-Service) solutions such as Caprover and Gardens offer a way out. They allow to easily host server-side or web-apps through the UI or CLI, and automate most of the complexity usually associated with setting up and maintaining self-hosted software. This presentation tells a story of how these products came about and how they work.

uk: вхід без авторизації

name: Self-hosting for non-coders?: The open-source approach


uk: Комп'ютерні науки

description: For years, we’ve been told that Java suffers from cold starts in AWS Lambda and Serverless in general. Believe it not. Java is extremely fast to start, the simplest Java program starts in milliseconds. It’s the Java app servers, frameworks and libraries that usually slow things down. But there are now many ways to start Java apps fast. In this session, I want to show you the truth about Serverless Java and cold starts, what’s slow, what’s fast and why it matters. We’ll explore Piranha Cloud, one of the most modern and fastest Jakarta EE frameworks, and how it can start Java apps very fast. Then I’ll explain which Java Virtual Machine optimizations may help if you need to start apps even faster. You’ll see live for yourselves how Java AWS Lambda functions built with Jakarta EE can start fast and decrease the cold starts to the absolute minimum which you can barely notice.

uk: вхід без авторизації

name: Afraid Of Java Cold Starts In Serverless?: Fear Not, Java Is Super Fast!


uk: Комп'ютерні науки

description: How Meta manages to take offline millions of pictures, videos and text that violate its community standards, all of them adversarially engineered, in a catalog that counts in the trillions. We'll talk about open source technologies that embrace vector search, state of the art in neural and non-neural embeddings, as well as turnkey solutions. Content moderation is a problem that affects every service that hosts user uploaded media. From the avatars to a personal collection of pictures, the platform holds the responsibility of removing the violating content. The problem can be tackled with clssifiers, human moderators and by comparing media signatures; this presentation will be about the latter. Similarity Detection is an approach that tries to detect media based on an archive of "definitions" (yes, like the antiviruses) of things that have already been classified as violating. But how do we measure similarity between images from the perspective of a machine (not to mention video/audio clips of different lenghts)? The answer is not MD5... We'll talk how we do it, what technologies you can use too and how we can leverage a public, crowdsourced archive of signatures to defeat various threats, from terrorism to misinformation to Child Exploitation.

uk: вхід без авторизації

name: Similarity Detection in Online Integrity: Fighting abusive content with algorithms


uk: Комп'ютерні науки

description: Snap! is a Scratch-like programming language that treats code-blocks as first class citizens instead of confining them to an editing modality. Snap! has been developed for UC Berkeley’s introductory computer science course named “The Beauty and Joy of Computing”. Embracing nested data structures and higher order functions Snap! lets learners create arbitrary control structures and even custom programming languages with just blocks. Thus, Snap! bridges the space from low-floor motivational introductory activities to supporting sophisticated rigorous studies of computer science. In this presentation members of the core Snap! development team will deliver a hands-on demo of exemplary projects that exhibit our understanding of both "fun" and intellectual stimulus.

uk: вхід без авторизації

name: Snap! - Build Your Own Blocks: A visual programming language for Computing Education


uk: Комп'ютерні науки

description: The open source community has become vulnerable to new kinds of attacks on the software supply chain and there have been efforts by many to address those challenges. Those efforts require new processes, new tools, and new initiatives to drive adoption. Heightened interest, particularly by governments of the world, has driven the open source community to respond with a mobilization plan to achieve specific goals. The Linux Foundation and OpenSSF delivered a first-of-its-kind plan to broadly address open source and software supply chain security outlining approximately $150M of funding over two years to rapidly advance well-vetted solutions to the ten major problems facing open source software security. These concrete action steps are designed to produce immediate improvements and build strong foundations for a more secure future. Find out what you can do to be more secure and support this global security effort.

uk: вхід без авторизації

name: Building Strong Foundations for a More Secure Future: Addressing The Systemic Issues in the Software Supply Chain that Led to Log4Shell


Distributed Storage in the Cloud

uk: Комп'ютерні науки

description: Cloud brought many innovations - one of them is inexpensive, scalable and sometimes secure Distributed Storage options. In this presentation we will talk about distributed storage Options modern clouds offers ranging from elastic block devices and object storage to sophisticated transactional data stores. We will discuss the benefits and new architecture options such distributed storage systems enable as well as the challenges pitfalls you need to be aware about.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Lessons learned from managing Kubernetes cluster resources in an open-source community in a transparent git-ops way. We will discuss the design patterns for Kubernetes resource management in cluster fleets in order to achieve uniformity, auditability, transparency, and effectiveness. In particular, we will talk about cluster policies, and effective repository structures promoting manifest reuse and collaboration through Kustomize. Kustomize is a first-party tool for manifest composition allowing cluster admins to create simple yet powerful and context-aware file structures for resources that require centralized management. This lightning talk aims to share our personal experience in Operate First Community Cloud in this regard.

uk: вхід без авторизації

name: Effective management of Kubernetes resources for cluster admins


uk: Комп'ютерні науки

description: Solid is a protocol powered by W3C standards and the Semantic Web that intends to change the way the Web works by letting users bring their own storage to applications. It was introduced here at FOSDEM back in 2019, and many new developments have happened ever since. I have been making Solid Apps for 4 years now, and in this talk I will go through my journey starting from having no idea about the Semantic Web. I'll share the lessons I learned along the way, and some of the challenges that are still ahead. Solid is a protocol, so even though I've got my stack of choice this talk will be framework agnostic. I will focus on the challenges and learnings that can be useful to any developer. If you've heard about the Solid Protocol before and are wondering what developing apps is like, this is the talk for you!

uk: вхід без авторизації

name: From Zero to Hero with Solid: Lessons learned making apps using the Solid Protocol


uk: Комп'ютерні науки

description: A journey from single documentation files to a meaningful information architecture. The Sovereign Cloud Stack combines the best of Cloud Computing in one unified standard. SCS is built, backed, and operated by an active open-source community worldwide. As only the sum of different repositories complete the SCS Stack, it is important to have an easy and accessible documentation of the SCS Project in one place. In this talk you will be taken on our journey on how we have developed a low invasive workflow to bring together all individual docs to a unified collection that is being generated to single page application using docusaurus. A journey that takes us from a mere collection of markdown documents to a meaningful information architecture. With this talk we not only want to convey our story but invite you to feedback your experiences with such endeavours.

uk: вхід без авторизації

name: How we created a Documentation Framework that works across a group of vendors in the sovereign cloud stack community


uk: Комп'ютерні науки

description: Cloud and Open Source have a very intricate relationship! In this talk we will look at the history of how the impact of Cloud on Open Source changed through the years, examine the current state as well as make a case for a particular way to use Cloud and Open Source Together. If you cherish the values of Open Source - you will do well by using Cloud as Commodity Infrastructure Provider and run Open Source Software on top of it. Consider Kubernetes in particular as your API of choice with its ubiquitous availability among all major public cloud providers and private cloud software vendors. We will show what while this ecosystem may not be as mature as proprietary solution from cloud vendors it is moving rapidly and becoming a great fit for more and more situations.

uk: вхід без авторизації

name: Is Open Source Coming back to your Cloud?


uk: Комп'ютерні науки

description: There has been a significant shift from on-premise data centers to the cloud in the last fifteen years. This process was due to the perceived cost difference between the legacy on-premise data centers and the newer and shinier cloud. Due to a renewed interest in privacy and data sovereignty, many organizations are returning to the on-premise. For the success of such initiatives, it is fundamental to learn from the past and understand how a modern on-premise data center would be structured. I started working in 2004 when almost everything was on-premise, and I had a front-row seat to the migrations that occurred in this period thanks to my roles as a Systems and Solutions Architect. In this talk, we will recap the last twenty years of migrations to learn some key lessons, and then we will analyze what a modern on-premise data center would look like, which technologies might help and which could be risky bets.

uk: вхід без авторизації

name: On-premise data centers do not need to be legacy: We can and should learn from legacy on-premise data centers and the migration to the cloud to ensure the computing platform's future is bright


uk: Комп'ютерні науки

description: Open source has become the defining way of developing software. But how do we open-source the operation of software? The Operate First Community Cloud is a peer-to-peer mentoring environment for running software in production, as well as a community for Cloud Native SREs to share knowledge about production practices. Using the same community-building process of open source projects, but extended to ops procedures and data. Experienced SRE’s find an outlet for sharing their knowledge and new talent get’s a chance to grow into an SRE role and get their hands on cloud-native projects in a production environment. Could this be a blueprint for a sovereign cloud? We’ll discuss how opening operations can free up a cloud deployment and lead to the same independence that open source brought to software.

uk: вхід без авторизації

name: Operate First community cloud: A blueprint for a sovereign cloud?


uk: Комп'ютерні науки

description: In this short talk, we'll present a way to see the discourse around digital sovereignty through a climate lens - understanding how the concepts that support having a vibrant diverse set of cloud providers can result in a healthy ecosystem climate wise , and also in terms of values alignment too. We'll introduce a useful model, known as the Green Web Triangle, for talking about the trade-offs we currently make when choosing digital services that can help technologists have productive conversations with budget holders and policy makers. Finally we'll explore how competing on transparency with open source is a valid strategy where existing incumbent cloud providers cannot do the same - organisations with legally binding carbon reductions are now required by investors and policy to report on efficiency and sustainability in ways that are currently impossible with most incumbent providers, but doing so will be a legal necessity, as new laws around sustainability reporting come into effect in 2024. We'll end with Q and A to explore these new developments and how to make the most of the changing policy landscape to move towards a more open, diverse ecosystem of companies building the cloud platforms we need for a sustainable, pluralistic diverse internet.

uk: вхід без авторизації

name: Responsible Clouds and the Green Web Triangle: How to make the climate case for a diverse cloud ecosystem


uk: Комп'ютерні науки

description: Co-op Cloud is a software stack that aims to make hosting libre software applications simple for small service providers such as tech co-ops who are looking to standardise around an open, transparent and scalable infrastructure. It uses the latest container technologies and configurations are shared into the commons for the benefit of all. The project launched public beta in May 2022 and has seen a lot of interest from hosters, hackers and end-users. We are currently in the process of forming our organisational model which help us make decisions collectively and work towards financial stability. In this presentation, I'll give a status update on the Co-op Cloud ecosystem and where we're going. The thinking and principles of the project closely overlap with the ideas of the Sovereign Cloud and the intersection of the needs of end-users and infrastructure providers.

uk: вхід без авторизації

name: The Co-operative Cloud: Public interest infrastructure


uk: Комп'ютерні науки

description: In this talk, I would like to present the importance of the core Collaborative Softwares using by individuals and companies in this stack and the progress and challenges of the Open Source communities providing alternative solutions and the importance of all European countries to collectively support the actors in the Open Source communities providing solution in this area. In the latest years, the subject of European Digital Sovereignty is gaining ground. Clearly the dominant position of the BigTechs is making both European companies, Countries but also individual increasingly dependent on the product and services of the BigTechs. In order to regain our sovereignty we need to look at the full stack, from hardware, to cloud and to the software running on those hardware and clouds. In this talk, I would like to present the importance of the core Collaborative Softwares using by individuals and companies in this stack and the progress and challenges of the Open Source communities providing alternative solutions and the importance of all European countries to collectively support the actors in the Open Source communities providing solution in this area. I will show the progress made in the last years by different providers of Open Source solutions (NextCloud, Matrix, BigBlueButton, Jitsi, XWiki, CryptPad and many others), describe the challenges and difficulties when building Open Source products and competing with the extremely powerful actors that we are facing (including monopoly abuses), but also make proposals on how we could make them work better together.

uk: вхід без авторизації

name: The Importance of Collaborative Applications for European Digital Sovereignty: Progress and challenges of alternatives facing the BigTechs


uk: Комп'ютерні науки

description: Pandemics and wars have woken up countries and companies to the strategic vulnerabilities in their infrastructure dependencies, with digital sovereignty now being a top concern, especially in Europe. In this short talk, Thierry Carrez, the General Manager for the Open Infrastructure Foundation, will explore the critical role that open source has to play in general in enabling digital sovereignty. In particular, he will explore how Open Infrastructure (open source solutions for providing infrastructure), with its interoperability, transparency and independence properties, is essential to to reach data and computing sovereignty.

uk: вхід без авторизації

name: The role of Open Infrastructure in digital sovereignty


uk: Комп'ютерні науки

description: Launched by the European Commission in December 2021, under the sponsorship of Commissioner Thierry Breton, the European Alliance for Industrial Data, Edge and Cloud has the objectives of strengthening the position of the EU industry on cloud and edge technologies, and meeting the needs of EU businesses and public administrations that process sensitive categories of data. The Alliance brings together relevant stakeholders from the private and public sector to jointly define strategic investment roadmaps to enable the next generation of highly-secure, distributed, interoperable, and resource-efficient sovereign cloud and edge technologies. This talk will provide a summary of the role that open source plays in the EU technological roadmap that the Alliance will be publishing by the end of January 2023, and will explore the different ways in which collaboration around open source technologies can contribute to building a future European sovereign cloud.

uk: вхід без авторизації

name: The Role of Open Source at the EU Technology Roadmap for a European Sovereign Cloud


uk: Комп'ютерні науки

description: Sovereignty is more than having control over data and complying to data protection legislation. We'll dive into some important aspects and link it to the Open Source movement. The presenter will share how the Sovereign Cloud Stack translates these aspects into its project. Digital Sovereignty and Sovereign Clouds are becoming hot topics in the public discussion. However, we observe the terms being used in inflationary manners -- which reminds us of greenwashing marketing campaigns. So let's discuss what aspects there are of digital sovereignty. What options, possibilities, powers could operators and consumers of digital technology have and what balance can be stricken between them? How can technology change the balance? In particular how do modern cloud/container platforms play into this? Technology does make a difference. The Sovereign Cloud Stack has identified three areas where it wants to contribute in support of the consumers: Standards, Fully Open Implementation, and Open Operations. These topics will be introduced and filled with real-world experience from the SCS project.

uk: вхід без авторизації

name: What is Digital Sovereignty and how can OSS help to achieve it?: Demystifying an important term that has become a buzzword


Staging of Artifacts in a Build System

uk: Комп'ютерні науки

description: At a time where make was developed, a simple and computationally cheap solution to the problem of how to handle the relation between artifacts and files was needed. Each artifact is associated with a file in the filesystem and the timestamp of the file was used to determine which actions (recipes) need to be executed. Traditionally, to be backwards compatible with make, subsequent build systems also implemented this concept. However, there is no technical reason to do it like this. Instead, it even has a couple of advantages if this concept is abandoned and no association of artifacts with the filesystem is done. Nowadays, where content-addressable storage is a widely applied concept and actions are anyway executed in an isolated environment may it be in a separate directory or in a sandbox, this problem can be tackled by a complete separation between physical and logical paths, which is also called staging. Input and output paths of an individual action are abstracted away. Thus, each target has its own view of the world and can place generated artifacts at any logical path they like. Consuming targets may place these generated artifacts at a different logical location. This allows to define build targets independently of their actual location and in particular allows to refer to targets from other repositories. This simplifies the handling of different repositories. All what matters is how the target is defined and not where. This concept is implemented in an open-source build system, which is publicly available under the following link: https://github.com/just-buildsystem/justbuild.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: There are multiple ways how FOSS projects coordinate and inform about their localization effort. Wiki pages, forums, READMEs, etc. And there are different platforms and servers. Should there be something unified to ease the orientation for translators? Something like TRANSLATE.md?

uk: вхід без авторизації

name: Should there be a standard in libre localization?: Ideas on how to make it easy for translators to contribute to any FOSS project they like


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Open Source in Environmental Sustainability: Preserving climate and natural resources with openness


uk: Комп'ютерні науки

description: FOSS powers the digital world we live in, but ensuring the long-term sustainability of the software and community can be challenging. In this talk, we will explore sustainable open source from three key perspectives: community, financial, and engineering practices. All three perspectives — community, financial and engineering practices — are vital for long-term sustainability of free and open source software projects. Abby will share insights and case studies on how well-crafted processes in each area can create a strong foundation for future success. She will draw on her experience as a maintainer of key open science projects, as well as a mentor and supporter to over 700 open source projects in GitHub's Top Maintainer program, UNICEF Venture Funds, and Mozilla Open Leaders. She will also discuss practical strategies for building effective open-source ecosystems, and ways to ensure the longevity of projects. The audience will leave with a better understanding of the importance of investing in sustainable open source practices, with tangible strategies for creating and sustaining successful projects. Join us for an engaging discussion on how to build a strong foundation for the future of free and open source software!

uk: вхід без авторизації

name: Sustaining Free and Open Source Software: Exploring Community, Financial, and Engineering Practices


uk: Комп'ютерні науки

description: Tableaunoir is an online collaborative blackboard tool with fridge magnets available in many languages. "Tableau noir" means blackboard in French. Contrary to plenty of other collaborative boards on the Internet, with Tableaunoir you can create interactive animations via the use of fridge magnets.

uk: вхід без авторизації

name: Tableaunoir: an online blackboard for teaching


uk: Комп'ютерні науки

description: Java upgrades are sometimes seen as difficult and many applications are still running on an older version of Java. This session describes Java's current six months release process and why applications should use a recent Java version. After that, I'll explain the challenges of upgrading and provide some useful tips to make the process easier. Java upgrades are sometimes seen as difficult and many applications are still running on an older version of Java. This session describes Java's current six months release process and why applications should use a recent Java version. After that, I'll explain the challenges of upgrading and provide some useful tips to make the process easier. Concrete examples (including solutions) will be used to show you what changed in which version of Java and how to handle the changes. After this session you're ready to upgrade your applications to Java 17 and prepare for Java 21.

uk: вхід без авторизації

name: Why And How To Upgrade To Java 17 (And Prepare For 21)


uk: Комп'ютерні науки

description: MIT App Inventor is an Apache-licensed visual programming environment for building mobile phone apps. In this presentation, we will explore the MIT App Inventor web interface and build a simple image classifier app for Android devices. We will explore collecting training data, training a small machine learning model, and deploying that model as part of an App Inventor app. By the end of the talk, participants will be able to test or install their creation onto an Android device. We will also provide a brief overview of educational resources available to teachers.

uk: вхід без авторизації

name: Building Personalized AI Apps with MIT App Inventor


uk: Комп'ютерні науки

description: Running your own custom applications is one of the most important features that make unikernels fit for the cloud. As related work has shown, unikernels can achieve this by compiling or linking them (native) or by providing a binary-compatible interface (e.g., Linux system call ABI). Both modes have their pros and cons, and because specialization is our key concept for the Unikraft OSS project, we support both. In this talk, we will present our implementation design, the challenges that we solved, and the lessons that we learned. Additonally, we will show a demonstration with nginx running in both modes. Unikraft is an open source Xen Project incubator under the auspices of the Linux Foundation. The Unikraft open source project is the basis for Unikraft GmbH, a company that aims to build the next generation of cloud with unikernels for production and enterprise use.

uk: вхід без авторизації

name: Building a Linux-compatible Unikernel: How your application runs with Unikraft


uk: Комп'ютерні науки

description: Java profiling relies heavily on the AsyncGetCallTrace API. But this API has major drawbacks: It is unofficial, not well-tested, and omits important information. I propose AsyncGetStackTrace (JEP Candidate 435) as an improved replacement. This talk will give an overview of AsyncGetCallTrace and AsyncGetStackTrace, their implementations, differences, and use cases.

uk: вхід без авторизації

name: AsyncGetStackTrace: The Improved Version Of AsyncGetCallTrace (JEP 435)


uk: Комп'ютерні науки

description: Do you really know what your users think about you? If you’re not doing user interviews, you probably don’t. In this talk, Emily Omier will help attendees understand why user interviews are so important, how to run an interview that provides good information and what to do with the information you get. Spoiler: often the best interviews are also the most awkward.

uk: вхід без авторизації

name: Do more awkward user interviews: Do you feel awkward interviewing users about how they use your project? That's ok — awkward interviews are often good interviews.


uk: Комп'ютерні науки

description: Scalability under load. The holy grail of much of a developer's life is that our software survives its beginning. The system went live. Made it to production. Got its first user. But surely, the true test of good software is how it lives up to expectation over its lifetime? After all, you wouldn't say a bridge or building was successful just because the first 100 cars made it across safely. In other forms of engineering, things are load tested under demand either by weight, shocks or overload. As a software developer we should be ensuring SLAs or exploring error conditions under extreme load. But what is “load” in the context of software? And how do we test its many different definitions? In this talk, I will present a relationship made in heaven, the relationship between the actor model and the answer to these questions. I will also introduce you to a library that applies all this knowledge in a ready-to-use dependency.

uk: вхід без авторизації

name: The Actor Model as a Load Testing Framework


uk: Комп'ютерні науки

description: Gleam is a friendly statically typed language that targets the BEAM and JavaScript. In this talk we'll take a tour of Gleam by looking at its features, the ecosystem, and its interop with other BEAM languages as well as Javascript. All the while we'll be building up a distributed audio application that allows multiple clients to play with music and audio in real time. Prior knowledge of Gleam isn't necessary to get something out of this talk, and both those that are curious and skeptical of static typing are encouraged to attend and learn how Gleam might fit into their practice.

uk: вхід без авторизації

name: Distributed music programming with Gleam, BEAM, and the Web Audio API


uk: Комп'ютерні науки

description: Introductory talk about Elixir, elaborating on how it relates to Erlang. Is it really a new language or just an older idea in disguise? Let's talk about the key differences and what Elixir brings to the BEAM/Erlang ecosystem.

uk: вхід без авторизації

name: Elixir - Old wine in new casks: Intro talk about Elixir/Erlang


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Introduction to Gleam: by building type-safe Discord bots on the BEAM


uk: Комп'ютерні науки

description: How easy is it to get started with LiveView as a backend developer? Is the "No javascript needed" true? In this talk I'll try to give answers to these questions by telling the story of how I used LiveView to make a new user interface for an old Passap E6000 knitting machine.

uk: вхід без авторизації

name: LiveView keeps you warm!: Building a knitting machine UI with Phoenix LiveView


uk: Комп'ютерні науки

description: AtomVM is a tiny portable virtual machine that allows BEAM code to run on microcontrollers with less than 500KB of RAM such as ESP32, STM32 or RPI 2040 devices. In few words you can flash AtomVM on a microcontroller such as the ESP32 and get any virtually unmodified code compiled for the BEAM running on it.

uk: вхід без авторизації

name: Running Erlang and Elixir on microcontrollers with AtomVM: How to run BEAM code on a 3 $ microcontroller


Shorter feedback loops with Livebook

uk: Комп'ютерні науки

description: Learning from Python's Jupyter Notebooks, Livebooks are all about getting you up and running as fast as possible. Forget those throwaway prototypes. Livebook gives you a playground to get insights, document snippets and share ideas about anything code-related. I'll show how we use Livebook to mitigate risks early on in the conception phase. We've used it to assess the feasibility of using Elixir in our tech stack for building solutions in new problem domains, without the need to build the whole thing. Shorten your feedback cycle and get to the core of your problems even faster with Livebook.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Across the globe, in basements, factories, buildings and out of doors, millions of tiny (and not-so-tiny!) computers chatter with each other, constantly. But what do they say? And how can we talk to them? This talk is an introduction to binary pattern matching, a powerful syntax feature which Elixir has inherited from Erlang. When you learn it, it will open the doors to a world of communication that can otherwise seem obscure. During the talk, we will explore how binary pattern matching can be leveraged to implement low-level, binary communication formats in a succinct and performant manner.

uk: вхід без авторизації

name: Speak binary to me: Learn the powers of binary pattern matching


uk: Комп'ютерні науки

description: While the Wikimedia Foundation is best known for its flagship project, Wikipedia, and the MediaWiki software that powers it, the Foundation's open-source ecosystem extends far beyond these well-known projects. In this talk, we will explore the fascinating world of Wikimedia's open-source tools ecosystem and the cloud infrastructure that makes it possible. We will showcase some of the coolest tools and projects, and we will highlight the unique opportunity that the Foundation offers for contributing to its cloud infrastructure – a rare chance to work on infrastructure for a cause that does good in the world, supporting the Foundation's mission of providing free and open knowledge to the global community. Whether you are a seasoned open-source developer or a newcomer to the field, this talk will provide valuable insights and inspiration for getting involved in Wikimedia's vibrant community of contributors.

uk: вхід без авторизації

name: Beyond Wikipedia: Discovering Wikimedia's Open-Source Ecosystem


uk: Комп'ютерні науки

description: Setting your first steps in the world of programming can be a daunting task. The tools used are unforgiving, and learning materials are too often based on rote learning and writing code from scratch. Many learners feel excluded and like they do not belong, this is especially true for learners that are from groups underrepresented in programming education. In recent years the Predict-Run-Investigate-Modify-Make (PRIMM) approach has been proposed to help students by focusing on learning how to read code before moving on to learning how to write it. In this lightning talk we will discuss how open source micromaterials can be created as small side or hobby projects, taking into consideration these concepts. We will do so by discussing some open source micro-materials we made, but we will also take a look on how to ensure that your contributions provide educational value.

uk: вхід без авторизації

name: Breaking the Code of Inclusion: Designing Micro Materials Based on PRIMM Principles for Accessible Programming Education.


uk: Комп'ютерні науки

description: In the ARM world, Secure Boot is typically a BootROM feature, which allows for verification of the loaded binaries (firmware, bootloader, Linux kernel) before executing it. The main idea is to prevent untrusted code from running on our platform. The general approach is similar across vendors, but this area has no standardization. This is the 2nd edition of such an overview. During the presentation, we will check the status of the Secure Boot feature on ARM SoCs shown a year ago, and then we will expand this by describing examples on Rockchip and Mediatek based boards. The knowledge contained in this talk should help developers integrate Secure Boot into their platforms, contributing to increased security in the world of embedded devices.

uk: вхід без авторизації

name: Overview of Secure Boot state in the ARM-based SoCs 2nd edition: Open Source Firmware, BMC and Bootloader devroom


uk: Комп'ютерні науки

description: We will notably talk about interoperability between decentralized networks and how we mapped Matrix and ActivityPub concepts.

uk: вхід без авторизації

name: Bridging ActivityPub with Kazarma: Interoperability and "beyond-chat" Matrix


uk: Комп'ютерні науки

description: The tools necessary for 3D printing, CAM and CNC, and other maker-based activities are available to run instantly in the browser with no software to install. This is ideal for STEAM education, online coursework, maker spaces, or anywhere you either can't install software or can't keep it up to date. Modern browsers expose substantial computational power with access to multiple cores, shared memory, GPUs, and near-native code execution with Web Assembly. It is possible to present complete browser-based replacements for applications that were previously only the domain of desktop-installed software. Add in the capabilities of Progressive Web Apps, we get always-on, always up-to-date applications that start instantly and have a fraction of the footprint of their desktop counterparts. The focus of this talk, Kiri:Moto, was started in late 2013 as a 3D printing slicer when the cohort of available tools was very limited. It has since evolved to handle 4-axis CAM, laser cutters, and mSLA output targets. Kiri:Moto was one of the first slicers to support belt 3D printers. And this cutting-edge work will soon extend to 5 axis FDM. Kiri:Moto runs both online and offline (as a progressive web app) in standard browsers as well as mobile devices and tablets. It pushes the boundaries of what's possible inside the browser sandbox using web workers for distributed computing, WASM for accelerated computation, and ThreeJS for visualization. The active base of users skews toward college and high-school classrooms, maker-spaces, and individual creators. It is available (also free) inside of Onshape's web-based CAD, helping to make a complete in-browsers stack requiring no software installation to go from design to manufacture.

uk: вхід без авторизації

name: Maker Tools in the Browser: Zero Install, Always Up to Date


uk: Комп'ютерні науки

description: If you have a project or a business, how are you measuring growth, adoption, and success? Many companies need help understanding how open source community success translates into commercial success ( or a sustainable business ). The conversion from free open source users to paying customers is a challenging one, but there are some common techniques and practices successful companies deploy. For example: Optimizing your user journey is critical and can make or break your success. Did you know, for instance, some of the best companies can convert users browsing their documentation to those downloading their software at a 5:1 ratio, while others convert at a 500:1 ratio. How do you optimize your journey to enable people to not only easily download your software but use it? During this talk, I will outline the best practices, metrics, and processes you should follow when looking to build or grow your business.

uk: вхід без авторизації

name: Open Source Business Guidebook: Building a Scalable OSS Based Business


uk: Комп'ютерні науки

description: A presentation about implications and headaches we're facing when we want to provide Confidentiality in a Cloud Native Environment. Kubernetes has been transformative not onlyfrom the technical point of view, but also by introducing processes that democratized dealing with infrascture to some degree. To Enable developers to deploy their workloads independently required segmenting responsibilities of operating and using the cluster. The personas of Cluster Admin and API Users (and various shades in this spectrum) have been introduced to ensure teams can collaborate in a shared compute environment in safe and reliable manner. A multitude of extensions, tooling and processes have been introduced to protect a Kubernetes environment from malicious or erronous workloads (supply chain security). However, typically this model is still very much hierarchical: Cloud Service Providers (CSP) serve compute and control plane components which are then administered By Cluster Operators (CO) who configure the security and compliance boundaries in which Users can operate. Confidential Computing is challenging this model. The notion of rusted execution environments and trusted parties, which may exclude the CO and most likely the CSP turns a rigid pyramid of privileges into a more messy, bi-directional picture. We want to discuss some of the conceptual and technical challenges that we currently identifiy for Confidential Computing in a Cloud Native environment and review ongoing, practical efforts to reconcile both domains.

uk: вхід без авторизації

name: Tilting a Pyramid: Confidentiality in a Cloud Native Environment


uk: Комп'ютерні науки

description: IBM Z (s390x) has been supporting confidential virtual machines for a few years now. It is a Linux-first feature, fully supported by KVM and Qemu. This presentation will introduce the technology, the architectural extensions, the typical lifecycle of host and guest, the unique features, and how KVM and Qemu have been adapted to support it. Some of the interesting and unique features covered in the presentation are: * allowing for swapping guest memory in the host * not requiring encryption of guest memory when running * implicit attestation * explicit attestation * secure dumps The lifecycle of a secure guest will be presented including all interactions among the guest, the host, the trusted hardware/firmware (Ultravisor), and the attestation agent.

uk: вхід без авторизації

name: Introduction to Secure Execution for s390x: KVM confidential VMs on IBM Z