Running Linux applications on FreeBSD

uk: Комп'ютерні науки

description: While FreeBSD has been able to run Linux binaries for many years, the large ecosystem of Docker images leads to some interesting use cases for FreeBSD developers and users. This talk will review how the various kernel modules execute Linux binaries, several ways to use this functionality, and the work in progress to improve the Linux syscall compatibility. FreeBSD has been able to run Linux binaries since 1995, not through virtualization or emulation, but by understanding the Linux executable format and providing a Linux specific system call table. Originally, this was for the noble goal of playing the video game, Doom. Over time, many Linux applications and libraries have been packaged and made available through the FreeBSD Ports Collection. But because FreeBSD tools do not understand Linux package dependencies, this process is manual and time consuming. Docker has popularized the use of Linux Containers, similar to FreeBSD's jails, but more importantly, has lead to publishing a wide variety of both Linux system and application images. These images allow FreeBSD users to download a variety of Linux system images and use their native tools to provide applications not available through the Ports Collection. This started as a simple quest to build Linux device drivers and applications on my FreeBSD system, but the journey has lead to an understanding of the inner workings of the Linux Binary Compatibility layer. It started by running applications from ports, progressed to chroot'd Docker image based environments, and has end up in Docker image based jails. The talk will cover the technology behind this capability as well as examples of using this in practice. Additionally, it will cover some of my work-in-progress to enhance the Linux support for network sockets, capabilities (a.k.a. privileges), mremap, and others.

uk: вхід без авторизації


Devin Teske

type: Person

cs: Informatika

de: Informatik

fi: tietojenkäsittelytiede

uk: Комп'ютерні науки

en: Computer Science

fr: Informatique

da: Datalogi

es: Ciencias de la Computación

nl: Informatica

cs: Technické vědy

de: Ingenieurwissenschaften

fi: tekniikka

uk: Інженерія

en: Engineering Sciences

fr: Ingénierie

da: Ingeniørvidenskab

es: Ingeniería

nl: Engineering

description: I would like to present a new utility called dwatch that I added to FreeBSD 12.0 Using dwatch, in this talk you will learn how to: Watch processes entering system CPU scheduler Print arguments being passed to functions Easily watch multiple probes simultaneously Globally watch all function traversal from every process/thread Filter output by user or group, including the ability to use regex Watch jail activity Use patterns or regular expressions to match on executable name(s), pid, etc. Look for a particular path being created, removed, accessed, etc. Watch interprocess communication signaling Log network data events Schedule timed samplings for events of interest Dump process trees for processes triggering a probe Watch child processes Show commands being executed in realtime Write modules to centralize logic into easy-to-access profiles Share modules with each other and help your community More... With dwatch, using DTrace has never been so fun and painless.

TIB AV-Portal

type: Service

type: WebContent

type: MediaObject

@language: en

cs: přihlášení není vyžadováno

de: keine Anmeldung erforderlich

uk: вхід без авторизації

en: no login required

nl: geen login vereist

name: All along the dwatch tower: A DTrace tool for the masses

Berkeley Software Distribution (BSD)

type: Organization

cs: Video

de: Video

fi: Video

uk: Відео

en: Video

fr: Vidéo

da: Video

nl: Video

es: Video


uk: Комп'ютерні науки

description: For IPv6 stateless address auto configuration the KAME IPv6 stack, shared by all the BSDs, parses router advertisement messages in the kernel. These messages are fairly complicated, with optional parts and varying lengths. Parsing them is dangerously close to string handling in the kernel. If a mistake is made only a few mitigations stand in the way of a full-system compromise. Moving this functionality to user land with much more powerful mitigations is prudent. We present slaacd, the stateless address auto configuration daemon. It was written from scratch following the well established pattern of privilege separated OpenBSD daemons. We will show how pledge(2) annotations guided the privilege separation, leading to a secure design. Other systems that lack OpenBSD's pledge annotations and kernel enforcement can still benefit from the secure design when slaacd gets ported to them.

uk: вхід без авторизації

name: slaacd(8): A privilege separated and sandboxed IPv6 Stateless Address AutoConfiguration Daemon


uk: Комп'ютерні науки

description: Since the TrueOS project was started in the middle of 2016 as a re-focus of the PC-BSD project, we have been seeing massive growth in our user base and the number of active contributors to the project. This session will go over the differences that TrueOS brings to the table compared to PC-BSD/FreeBSD, the reasoning behind those decisions, and how those changes are currently implemented within TrueOS. The TrueOS project was started in July of 2016 as a re-focus of the PC-BSD project. This change allowed us to address several key issues that we were having with using FreeBSD releases as the "core" of PC-BSD. Since then, we have seen significant growth in the use of TrueOS not only as a Linux-desktop alternative but also as the foundation for server-focused appliances. This session will be going into detail about the issues that necessitated the change, the attempted solutions to those issues, and the final changes that are seen in TrueOS today.

uk: вхід без авторизації

name: The TrueOS Difference: Changing Methodologies for Changing Times


The Evolution of FreeBSD Governance

uk: Комп'ютерні науки

description: This talk describes the evolution of the governance of the FreeBSD project from the time of its conception until the present day. All open sources projects develop a culture. Often the culture builds organically, but as a project becomes larger and more successful it is necessary to put more formal governance in place to ensure that the culture is robust and welcoming. This talk studies the evolution of the culture and governance of the FreeBSD project. It begins by looking at the formation of the FreeBSD project and the organizing principles of its founders. As the project became more successful, it began being used and depended on by companies which in turn required that the adhoc governance become more structured and documented through the adoption of a set of bylaws. The talk will cover the governance issues that the project has had to handle in recent years including: FreeBSD Source-Code Control FreeBSD Workflow Guidelines on How to Work and Play Together FreeBSD Recruitment FreeBSD Development Model FreeBSD Core Team Interaction with the FreeBSD Committers FreeBSD Security Team The talk concludes by prognosticating on future governance issues that may have to be handled.

uk: вхід без авторизації


How to bootstrap a BSD conference

uk: Комп'ютерні науки

description: In this talk we will share everything before/during/after a BSD conference and the secret behind the scenes. We will also talk about what we learned from other conferences. In 2017, we hold a whole new BSD conference in Asia. We choose Taipei, Taiwan because it is the birthplace of AsiaBSDCon in 2004. The plan was started in late March and everything happened in 8 months. We recruited a small but powerful group of experience conference volunteers and had a good conference for the first year. We hope these experiences and ideas can help existing conference toward an even better level, and encourage people hold more BSD conferences.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: One of the original goals of ZFS was to “end the suffering” of system administrators, by making storage easier to manage. A big part of that is reducing the restrictions on how ZFS can be configured, thus reducing the need for advance planning and investment. This talk covers two new features that further this goal: Device Removal and RAID-Z Expansion. In this talk, you'll learn how these features work under the hood, as well as how to best take advantage of them. Device Removal decreases the total amount of usable space in the pool, allowing disks to be removed from the system. As part of the removal process, allocated space on the device is copied to the remaining disks in the pool. There are two primary use cases for this: A mistake was made when adding a device to the pool. E.g. the wrong device was added, or it was added as the wrong type. Storage migration. E.g. moving the pool from six 4TB drives to four 10TB drives. Device Removal is available in FreeBSD CURRENT. RAID-Z expansion — adding a single disk to an existing RAID-Z group — is perhaps the most-requested OpenZFS feature ever. This feature will make it easy to add small amounts of storage incrementally to modest-sized pools. System administrators will no longer be trapped by their past decisions of RAID-Z group size, forced to continue with a suboptimal RAID-Z stripe size, or rebuild their pool from scratch. This talk will explore the design trade-offs of RAID-Z Expansion, as well as some implementation details. To give an example: all the data needs to be read and rewritten in the new layout. If there is a disk failure while this is in progress, we must ensure that we can still reconstruct the data, which means that the sectors of each logical stripe must all be on different disks. But with RAID-Z’s variable stripe with, this is nontrivial to ensure, because we don’t know where each logical stripe starts and ends, without an expensive scan of all the pool’s metadata to find every block pointer. RAID-Z Expansion is coming to OpenZFS and FreeBSD, made possible by a partnership between the FreeBSD Foundation, iXsystems, and Delphix.

uk: вхід без авторизації

name: Flexible Disk Use in OpenZFS: Device Removal & RAID-Z Expansion


Oh a new Unix shell

uk: Комп'ютерні науки

description: Oh is an attempt to reduce the Unix shell's strangeness while retaining its fundamental characteristics. Oh is familiar and recognizable as a Unix shell but with: - A more consistent and extensible syntax; - Richer data types, including first-class pipes, objects, and methods; and - Support for concurrent, higher-order and modular programming. You love your shell. You’ve been using it for ages and are extremely efficient with it but there are times when its little quirks are enough to drive you mad. Maybe it's: - Word splitting turning a file name with spaces into multiple file names that may or may not exist; - An undefined variable sending rm on a mission to delete all the files in the root directory; - Having to resort to various workarounds just to write a function that returns a string; or - Wishing there was some option for importing a module other than sourcing a file and dumping everything into the current context. You know that because the Unix shell "must satisfy both the interactive and programming aspects of command execution, it is a strange language, shaped as much by history as by design", but the Unix shell feels overly strange. Oh is an attempt to reduce the Unix shell's strangeness while retaining its fundamental characteristics. Oh is familiar and recognizable as a Unix shell but with: - A more consistent and extensible syntax; - Richer data types, including first-class pipes, objects, and methods; and - Support for concurrent, higher-order and modular programming. Oh is MIT-licensed, open-source software and is available on Github The author currently uses oh as his login, and primary interactive, shell on a machine running FreeBSD.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: We introduce PASTE, an extension to the netmap framework for end systems to exploit high speed NICs, kernel TCP/IP stack and emerging persistent memory. We describe design and implementation of PASTE, as well as how to write applications on top of it. New hardware, such as high-speed NICs and persistent memory introduces significant challenges in system software design and implementation. Today's socket APIs are already unable to serve on 10 Gbps under message-oriented workloads. Suppose a server that runs a poll/kqueue event loop to handle concurrent TCP connections. Arriving messages create a long queue of ready sockets where each must be processed by a pair of read/write system calls; If the application is notified of 100 messages on parallel TCP connections, it requires 200 system calls to process this single event, significantly reducing throughput and increasing end-to-end latency. Persistent memory eliminates a bottleneck of disks/SSDs because of 2-3 orders of magnitude lower access latency, which makes the network stack be a bottleneck even when the application persists receiving data. In particular, data copy from socket buffer to persistent memory comes at significant cost. To solve these problems, we introduce PASTE, an extension to the netmap framework. Unlike the original netmap, it supports TCP/IP in the kernel, yet offering the netmap API to applications for zero copy and batching of system calls and packet I/O, even across multiple TCP connections. PASTE further supports emerging persistent memory, allowing applications to persist data without copying data since NIC's DMA. Applications can form persistent data structures using netmap's packet buffers backed by a file. PASTE was initially implemented in Linux for research purpose and demonstrated notable performance improvements. We are now porting it to FreeBSD. We will report software architecture and performance of our FreeBSD prototype. We then would like to discuss necessary extensions beyond the netmap framework, which include socket structures and NVDIMM supports. With PASTE, we believe the netmap API to be an even more generic, promising networking API of FreeBSD beyond packet I/O framework, and to enable building efficient end systems by exploiting emerging hardware.

uk: вхід без авторизації

name: PASTE: Fast End System Networking with netmap


uk: Комп'ютерні науки

description: This talk presents the efforts and results of porting Vagrant to OpenBSD by writing a plugin that uses vmd(8) as a 'provider' to create and manage OpenBSD VMs and to properly detect OpenBSD as a host system and expose the needed capabilities, most notably NFS to exchange data between host and guest. With such a localized environment it becomes easy and straightforward to develop, test and run automated installations of OpenBSD within the VM guests. The talk will show how this is done under different objectives and prerequisites like per-VM, per-Location, etc. customization while installing over a dozen (or 100) VMs fully automated in parallel while minimizing the effort to do so.

uk: вхід без авторизації

name: Vagrant for OpenBSD: make installations by the busloads easy: Integrate vmd(8) in Vagrant and leverage autoinstall(8)


uk: Комп'ютерні науки

description: ZFS send and receive, performance issues and improvements Encryption, pipes and context switches need to go! Traditional Unix pipes are not known for their high performance. Designed for use for "piping" text between commands, they have been put to use in ways far in excess of their original design. One such use is for local and network "ZFS send" which is the mechanism that the OpenZFS file system uses to transfer file systems and snapshots of file systems between one another. This talk will present a new ZFS send and receive that relies on network sockets rather than pipes. Three things are to be discussed: 1) The local use of zfs send | zfs receive. Due to context switching and data copying between the kernel and user process for each buffer of data there are changes that can be made to the pipe code to improve performance. 2) The remote use of zfs send | ssh zfs receive, and zfs send | nc The selection of encryption protocols can have a significant impact on performance when using ssh as a transport, in many cases you only need authentication, and in some cases you just need to transport the data over the network. 3) A new option to zfs send and receive, socket. The in kernel implementation of zfs send and receive uses a file descriptor for the read and write of data, by adding socket setup code to the zfs(8) command many of the performance issues no longer exist. Data is transported using the networking code purely within the kernel, no context switches or copy out and in from the user context occur reducing the load on the CPU.

uk: вхід без авторизації

name: ZFS send and receive, performance issues and improvements: Encryption, pipes and context switches need to go!


uk: Комп'ютерні науки

description: The basics of deploying Ansible on FreeBSD specifically for networking environments. The talk focuses on the basics of deploying Ansible on FreeBSD specifically for networking environments (the kind of libraries that are required, what are the potential alternatives etc). A small demo will be presented on how this deployment would be done with a breakdown version of the command structure and demonstration from the command line. The talk will additionally focus on difficulties/challenges in deploying this on FreeBSD compared to deploying in on a Debian-based system.

uk: вхід без авторизації

name: Automating Network Infrastructures with Ansible on FreeBSD


100x Faster Clone Deletion for ZFS

uk: Комп'ютерні науки

description: Why is deleting a clone so much slower than writing one? Does it have to be? This talk will cover how ZFS clone deletion works today and why its performance is terrible in certain situations. I will present a new algorithm which addresses this problem and speeds up clone deletion by 100x. I’ll cover the design details and performance tradeoffs of the new method. ZFS can create and modify clones (mutable copies) of large filesystems extremely quickly. These operations are fast because ZFS employs a copy-on-write strategy, meaning that all blocks of the original filesystem are shared with the clone until a block is modified. Deleting a clone is not as fast nor as simple. It requires disentangling these block dependencies, locating the blocks that belong only to the clone and are not relied upon by the original. The current clone deletion algorithm achieves this by traversing the entire block tree, ignoring sections that are still shared. This talk will cover an alternate method of clone deletion: keeping track of clone blocks when they are modified so that, when it’s time to delete, the clone-specific blocks are already at hand. We see a performance gain because now deletion work is proportional to the number of clone-modified blocks, not the size of the block tree. I’ll go over the implementation details of this algorithm and the performance gains I saw. Further, I’ll discuss how I addressed scalability concerns such as bounding the size of the block-tracking data structure, managing the new performance costs incurred at write time, and determining the point of diminishing returns when we should revert to the old method.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: NetBSD has had support for cross compilation for some time now. We covers the features and changes in NetBSD enabling a new comer to set out from obtaining a copy of the NetBSD source code and pkgsrc onto building an OS and firmware for an ARM board from scratch on an operating system of their choice. This works was leveraged as the basis for a series of workshops aimed at introducing the NetBSD operating systems to hardware enthusiasts, with the intention to demonstrate how you can make someone who is not necessarily interested in software, easier. NetBSD has had support for cross compilation for some time now. This talk covers the features and changes in NetBSD enabling a new comer to set out from obtaining a copy of the NetBSD source code and pkgsrc to building an OS & Firmware for an ARM board from scratch on an operating system of their choice. This was leveraged as the basis for a series of workshops aimed at introducing the NetBSD operating systems to hardware enthusiasts. The workshops covered: Introducing project resources (source repo & documentation) Cross compilation with ease The Lua subsystem - a high level language interface to the system Working locally using simulation Rapid prototyping with rump Tamper resistance with veriexec

uk: вхід без авторизації

name: BSD from scratch from source to OS with ease on NetBSD


RoCE as a performance accelerator

uk: Комп'ютерні науки

description: RDMA (Remote Direct Memory Access) and its RoCE (RDMA over Converged Ethernet) implementation, currently available in FreeBSD, is growing in popularity as a way to transfer large amounts of data with high bandwidth, low latency and minimal CPU involvement. This session will describe the RDMA stack update done in FreeBSD, focusing on the addition of RoCEv2 (Routable RoCE) and complementary protocols. We will also present the performance benefits of RDMA, demonstrating the enhancement of several storage protocols relaying on RoCE transport, starting with what is already part of FreeBSD – iSER, an iSCSI extension for RDMA, and moving on to more opportunities available on other platforms which can be introduced to FreeBSD.

uk: вхід без авторизації


eBPF Implementation for FreeBSD

uk: Комп'ютерні науки

description: This talk introduces a work-in-progress implementation of the eBPF(Extended Berkeley Packet Filter) for FreeBSD. First we show an overview of Linux's eBPF system structure and how we implemented that on FreeBSD. After that, we demonstrate how it is useful for the FreeBSD with some concrete use cases such as fast and flexible packet processing with eBPF-enabled VALE/mSwitch software switch with some performance number. eBPF is an in-kernel virtual machine with an independent 64-bit instruction set architecture with C calling convention. It was appeared in the Linux kernel in 2014 as an extension to the existing BPF. Compared to the classic BPF, the instruction set is extended to make it a highly-flexible domain-specific language. Although BPF was originally designed for packet classification, eBPF in Linux is used as a building block of data processors which require complexity and flexibility. Today many applications such as dynamic tracing, resource control, and system call filtering are proposed and implemented by using eBPF in Linux. In the network community this is hot technology for programming high performance network packet processor including in-kernel packet processing framework like XDP, software switch like OpenVSwitch or even NICs like Netronome NFP. We will break up existing Linux eBPF system into several components and explain how each component works. It makes clear what should be implemented when porting it to FreeBSD, what design choices are available and what we need to concern from security point of view.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: If you are buying an appliance for your corporate network you probably expect that it meets the highest standards, right? When you buy a security appliance the expectations are even higher. Let’s discuss why FreeBSD is the ideal operating system for building such devices. FreeBSD is one of the most popular Unix-like operating systems, though there are not many appliances that around it. The situation looks even more pessimistic, once we discuss security appliances. The speaker, in his daily job, has spent the last 4-years building the most advanced PAM solution in the world, which is based on the FreeBSD operating system. In this presentation we will discuss which- and more importantly how - FreeBSD features can be used to build appliances. The presentation will only present features that are available in the base system and not in third-party programs. The speaker looks forward to presenting all the nuances and best practices of using FreeBSD as the main component of the appliance. One of the major reasons for using FreeBSD is the best support for ZFS and all its features. Another reason is GELI and GBDE encryption methods, which have never been breached. Furthermore, we also have Capsicum which will help in compartmentalization. There are a host of other benefits of using FreeBSD which we will discuss in the presentation.

uk: вхід без авторизації

name: Building a security appliance based on FreeBSD


uk: Комп'ютерні науки

description: We needed to create a new driver for a new product, but we wanted to develop it in a way that reduced the number of bugs and would keep the code base maintainable in the future. We tried Test Driven Development. Testing a network driver on real hardware is painful: bugs can result in essential subsystems behaving strangely or causing the kernel to panic; and regardless of the presence of bugs, physical hardware needs to spend time being configured, rebooting, or sending/receiving network traffic. With the number and complexity of projects our team was tasked with increasing, we needed to find a way to reduce the amount of time spent fixing bugs or verifying that features work. So, we turned to the TDD (test-driven development) methodology which promises that more bugs can be discovered and fixed before they make it to testers (and users) while improving code maintainability. This talk focuses on how we made the CppUTest framework work with and compile our FreeBSD driver code, other frameworks and utilites we needed, the problems we encountered trying to get kernel source code to compile in C++ and run in userspace, and future plans and areas that we want to investigate with TDD.

uk: вхід без авторизації

name: Developing a FreeBSD driver using Test Driven Development: Could we develop a more maintainable driver with fewer bugs?


uk: Комп'ютерні науки

description: In 1998 the KAME project started to provide an IPv6/IPsec reference implementation for *BSD. Where have we gotten to with IPv6 in FreeBSD? The idea for this talk originated by me spotting my badge from BSDCan 2009 hanging on my office wall. For starters we'll go through the time from around back then until today showing how the IPv6 stack and related features evolved. The main will focus on a bit of advocacy (hey do you still need to be convinced to do IPv6?), a big pile of what you can do with all the knobs and features (here's to all sys-admins), and completed with some developer's talk garnish (in case some things need improving or you want contribute or do some research). For dessert you'll learn what else is on the menu and what's currently cooking in FreeBSD's IPv6 kitchen. Hungry for more bits? Then join for the bigger addresses and crunchy colons and learn what that 10 year old badge said.

uk: вхід без авторизації

name: Do you remember legacy IP?: What happened to FreeBSD's IPv6?


Frankenstein's Disk Drive

uk: Комп'ютерні науки

description: Emulated devices in FreeBSD's bhyve hypervisor exist to provide compatibility with older operating systems. But with a few small changes, we can take a Dr. Frankenstein approach and allow the user to dynamically modify their behavior to create something new and beautiful. Just kidding, the resulting havoc this wreaks on the guest operating system will bring out the villagers with their torches and pitchforks. This talk describes why you would want to do this and an implementation using the NVMe emulation. There is a programmer's adage that says untested code will not work entirely the way you expect. But how do you test code which handles hardware errors? This presupposes having hardware that misbehaves in predictable and repeatable ways. Since this sort of unicorn does not exist, programmers will often create error injection hooks in the code. But this approach is problematic as the hooks tend to be static, work at cross-purposes with the actual code, and do not have access to user-space libraries and scripting languages that can help simplify the task. FreeBSD's bhyve hypervisor and its emulated devices offers an alternative approach. To the guest software (a.k.a. the operating system), these appear to be actual hardware when in reality, they are small user-space programs. By adding hooks to the device emulation code, we can allow user defined plug-in's to modify the device behavior and allow better testing of device drivers and the code which relies on them. This talk will describe an experimental plug-in framework for bhyve's NVMe device emulation, example scripts, and the havoc that they can cause.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Although I started my hacking as a college student on FreeBSD, I shortly moved to Linux and remained a professional Linux developer for many years, a majority of the time as a graphics driver developer for i915. Returning now to FreeBSD development, later in my career, I bring a rare perspective and opportunity to highlight what's done well and what could use some improvement. With all due respect, many of the FreeBSD developers are insular folks who've worked in the project for their entire lives. It's not surprising given their passion that they haven't had much time to stick their head up and see how other projects do things. The obvious comparison is Linux, which from a user adoption perspective has been way more successful. I don't intend to propose how to make FreeBSD as successful as Linux, but I do hope to shed some light on how to make the FreeBSD operating system more appealing to both developers and users. I'll be using my experience as a Linux graphics driver developer and active Linux kernel contributor to highlight specific hurdles I've had (as well as pleasantries) in my switch to full-time FreeBSD development. While some of these hurdles seem trivial to grizzled FreeBSD veterans, it's often death by a thousand cuts that will dissuade fresh faces.

uk: вхід без авторизації

name: FreeBSD from a Linux developer's perspective: It's not all bad!


uk: Комп'ютерні науки

description: Modern C compilers include support for tools to help find bugs in code. These tools, the sanitizers, add instrumentation to the generated code that can be compiled into the kernel to help the kernel developers. In early 2018 I became interested in using these in the FreeBSD kernel to assist bug finding and debugging. This talk will discuss the current state of kernel sanitizers on FreeBSD. This will include the kernel coverage sanitizer that can be used with fuzzers, the undefined behaviour sanitizer to warn when code relies on undefined behaviour, and the address sanitizer to detect out of bounds accesses. It will also discuss future work to port new sanitizers and the use hardware based acceleration. The main fuzzer to use these sanitizers is the syzkaller fuzzer from Google. I will talk about my experiences using this, bugs it has found, and future work to port other fuzzers to work with the kernel.

uk: вхід без авторизації

name: Fuzzing the kernel: Porting the Clang Sanitizers to FreeBSD


uk: Комп'ютерні науки

description: A story about building a capture-the-flag (CTF) penetration testing challenge using OpenBSD for the Hack The Box platform, where most of the challenges are either based on Linux or Windows. Hack The Box is an online platform allowing you to test your penetration testing skills and exchange ideas and methodologies with other members of similar interests. It contains several challenges that are constantly updated. Some of them simulating real world scenarios and some of them leaning more towards a CTF style of challenge. After joining Hack The Box and completing several challenges, I noticed some technologies missing or underrepresented among the challenges available. In this talk, I will go over the process of developing a CTF challenge, the learning objectives for participants, what went well, what did not go well, and the virtues of OpenBSD as an OS for a CTF challenge. I will also walk through the challenge itself, what I learned building it, share feedback, and identify other OpenBSD features for future challenges.

uk: вхід без авторизації

name: Hack the Puffy: OpenBSD advocacy through CTF


keywords:
Michał Stanek
Kornel Duleba

uk: Комп'ютерні науки

description: The talk describes recent security additions in the FreeBSD boot process. TPM 2.0 devices are now supported in FreeBSD. They are most often referred to in the context of measured boot, i.e. secure measurements and attestation of all images in the boot chain. The TPM 2.0 specification defines versatile HSM devices which can also strengthen security of various other parts of your system. We will describe the basic features of TPM and mention some caveats and shortcomings which may have contributed to its limited adoption. The presentation will include practical TPM use cases such as hardening Strongswan IPSec tunnels by signing with the TPM and locking in secrets to a particular boot hash chain. The second part of the talk will describe UEFI Secure Boot support in the FreeBSD loader and kernel. The loader is now able to parse UEFI databases of keys and certificates which are used to verify a signed FreeBSD kernel binary, using BearSSL as the cryptographic backend. The talk describes recent security additions in the FreeBSD boot process. TPM 2.0 devices are now supported in FreeBSD. They are most often referred to in the context of measured boot, i.e. secure measurements and attestation of all images in the boot chain. The TPM 2.0 specification defines versatile HSM devices which can also strengthen security of various other parts of your system. We will describe the basic features of TPM and mention some caveats and shortcomings which may have contributed to its limited adoption. The presentation will include practical TPM use cases such as hardening Strongswan IPSec tunnels by performing IKE-related cryptographic operations within the TPM, using private keys which never leave the device. Another example will be sealing secrets in TPM NVRAM with specific boot measurements (hashes) stored in PCR registers so that the secrets are locked in to a specific boot chain. The second part of the talk will describe UEFI Secure Boot support in the FreeBSD loader and kernel. The loader is now able to parse UEFI databases of keys and certificates which are used to verify a signed FreeBSD kernel binary, using BearSSL as the cryptographic backend.

uk: вхід без авторизації

name: Improving security of the FreeBSD boot process: TPM and Secure Boot in FreeBSD


uk: Комп'ютерні науки

description: In this day and age, using hand-crafted servers is quickly becoming a losing proposition. Debugging a Python application that runs on custom made servers gets extremely tricky, and since apps no longer run on a single server, releases become increasingly resource intensive. It is therefore vital to have a process to control multiple FreeBSD servers simultaneously in the cloud from a single command. This talk goes through real life and practical examples to roll out orchestration and configuration management projects using Salt on FreeBSD. After going over the pains of manual deployments, we will introduce the open source tools Saltstack and Cloud Custodian to automate the management of FreeBSD servers in a public cloud. We will then walk attendees through a real case study to give a practical understanding of what rolling out orchestration and configuration management means. We will end with hard learned tips to guard against common pitfalls. Saltstack is a event-driven orchestration and configuration management platform written in Python. It lets you run a command across thousands of servers at once through its remote execution function. Its master can listen to events such as user logins or CPU usage thresholds and automatically have minions take corrective actions. Cloud Custodian is an event-driven compliance platform that was originally developed in Python by Capital One. It allows for an organization to ensure compliance in its cloud infrastructure via policies. Cloud Custodian can make sure the correct encryption keys and ciphers are used. It can ensure new applications are always built on the latest machine images. Cloud Custodian can dramatically reduce costs by automatically removing unused cloud resources. With a mandate to migrate all of their applications to the AWS public cloud, the client had to find a way to move their highly custom website hosted on FreeBSD. We used Salt to build the new cloud infrastructure using the APIs provided by AWS. It allowed Notre Dame to deploy new environments for testing or, in an emergency, spin up instances in another region that match identically the current production environment. We also used Salt to power the release process so that the web team can release to the multiple servers that make up the environment with one single command orchestrated from the Salt master. They do not have to have deep knowledge of the servers and command line to release changes to the site. Upfront choices about the operating system or distribution are critical to making this process of deploying simpler. The natural choice for deploying onto AWS might be to use Amazon Linux, but it turns out it has an older, more limited package manager. If you are expecting to use newer features of certain software such as HAProxy, you will need to ensure your distribution supports it out of the box. Managing extra builds and compiling from source is a short term solution as it will add the overhead of maintaining the environment.

uk: вхід без авторизації

name: Master & Minions or the Dream of Python Automation


uk: Комп'ютерні науки

description: They say MQTT is a PUB/SUB protocol for the Internet of Things, which it was originally designed for, but it's also well suited for monitoring machines and services, in other words, for our daily bread. We take a close look at the MQTT protocol and show you applications for MQTT, focusing on putting it to use for systems administration tasks, for monitoring, and for connecting microcontrollers to your server farms (strike that part when you show this to your boss). They say MQTT is a PUB/SUB protocol for the Internet of Things, which it was originally designed for, but it's also well suited for monitoring machines and services, in other words, for our daily bread. We take a close look at the MQTT protocol and show you applications for MQTT, focusing on putting it to use for systems administration tasks, for monitoring, and for connecting microcontrollers to your server farms (strike that part when you show this to your boss). We'll divulge what a last will and testament has to do with MQTT and monitoring, and we'll also discuss some real-world integrations and applications of MQTT and Unix system utilities. Attendees will be able to understand how they can profit from using MQTT for monitoring programs, and they will benefit from being able to use the protocol for lightweight messaging. Be warned: there will be blinkenlights!

uk: вхід без авторизації

name: MQTT for system administrators (and for the IoT)


uk: Комп'ютерні науки

description: Netflix has built a CDN to distribute streaming media through most of the world. The content caches run a lightly customized version of the FreeBSD operating system's head branch. This presentation will describe Netflix's development process, and give some reflections on Netflix's experience using FreeBSD head in production. Netflix has built a CDN, called Open Connect, to distribute streaming media through most of the world. According to Sandvine, Netflix accounts for approximately 15% of all downstream traffic volume across the entire internet. The content caches in the Netflix CDN, also known as Open Connect Appliances (or, simply, OCAs), run a lightly customized version of FreeBSD. In some ways, this is nothing special: many products are based on an open-source operating system. However, Netflix does something slightly unusual, in that its OCA operating system code closely tracks the FreeBSD "head" branch (their development branch). In fact, a commit to the upstream FreeBSD development branch will usually be fully deployed across Netflix's CDN within 4-12 weeks. Although it might seem scary to run "development" code in production, we find that it works very well in practice. The FreeBSD development branch is usually quite stable. Additionally, we expect that we will find some bugs. However, we find that it is much better to find and fix those sooner, rather than later. Also, Netflix is committed to upstreaming most of our customizations that have general applicability. Tracking the upstream development branch keeps us in the best position to easily upstream our changes. In this presentation, Jonathan Looney will explain how Netflix uses the FreeBSD development branch code to help Netflix produce the robust operating system which supports the Netflix CDN. The presentation will describe Netflix's development process, and give some reflections on Netflix's experience using FreeBSD head in production.

uk: вхід без авторизації

name: Netflix and FreeBSD: Observations from~3 Years of RunningHead


Network booted OpenBSD Workstations

uk: Комп'ютерні науки

description: OpenBSD is a general purpose operating system. Its a common practice to use it as a router, firewall or as a server for other back-end services. Fewer people use it as a desktop system. This talk shows a way to introduce OpenBSD as a desktop system in your company's network without changing the existing OS installation. The lecture shows how easy it is to setup and run a single server that serves diskless(8) OpenBSD desktop systems for a whole company network. Our company uses Unix-like systems for workstations since it was founded. We started with BSD/OS in the 90's and using Linux from the 2000's till today. With that experience and the infrastructure created around it over the years, we were able test an OpenBSD setup on production network without ruin the existing installations. Thus, every employee was able to test this experimental setup without any fear of data lost or waiting time for an installation. In this talk I will give a walk-through to our diskless(8) server setup. Also, I will show how we completed some gaps of the diskless(8) manpage. Further, I will give some tips and best practices how to centralize the administration of such desktop system. At the end, I will talk about my personal UX with an OpenBSD network booted desktop system in a daily usage over several month.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: While NetBSD runs on 16 different types of CPU architectures, it did not run on the RISC-V. In order to live up to the slogan “Of course it runs NetBSD” the project of completing the port of the NetBSD kernel to the new RISC-V architecture was started. Adapting the kernel to take advantage of the new platform features while still maintaining NetBSD’s portability was challenging, but became and interesting problem to solve. While many issues were discovered in the process, the final outcome of booting a kernel on a new architecture was informative and rewarding.

uk: вхід без авторизації

name: Porting NetBSD to the RISC-V: "Of course it runs NetBSD!"


uk: Комп'ютерні науки

description: As of OpenBSD 6.4, VMD supports QEMU's QCOW2 disk format. This talk will go over what QCOW2 is and how it's implemented internally. Until recently, OpenBSD's VMD only supported raw disk images. Raw images are large, lack snapshot support, and are clunky overall. In OpenBSD 6.4, support for QCOW2 disk images landed. QCOW2 is a copy on write disk format that supports lazy growth and external snapshots, among other features. It does this by keeping a page-table like cluster map. This keeps space use down, and allows a lot of nifty snapshotting features. But there's no such thing as a free lunch: QCOW2 images pay a price in both performance and robustness. In this talk, I'll give an overview of QCOW2 features before making a sharp turn into into the details of the disk format, how to use it, and how I implemented it on OpenBSD.

uk: вхід без авторизації

name: QCOW2 in VMD: Snapshots 'Til the Cows Come Home


uk: Комп'ютерні науки

description: There will be a few short announcements before and after the keynote. The opening session with have some magic giveaways of hardware. Please be there to win. Or perhaps not. More Info:

uk: вхід без авторизації

name: The Technical BSD Conference 2019 - The opening session


uk: Комп'ютерні науки

description: Many of us spend days and weeks planning, and implementing strategies for disaster recovery in the server room, whether corporate or personal. How many of us, however, can really say we're prepared to recover our primary computing system in the office ... or on the go? Or that it's secure enough that if it were lost, stolen, or seized we wouldn't lose important data, or lose sleep? In this talk we'll look at the various strategies available to us to ensure our laptops are secure, synchronized, backed up and ready to recover. Whether at the office or at home, we spend a lot of time ensuring our systems are secure and backed-up, ready to recover in case of disaster. When it comes to our workstations, which are often laptops, we've often done little more than enable full-disk encryption and perhaps the odd occasional rsync for backups. Full-disk encryption is usually adequate protection against data loss due to opportunistic theft or casual loss. 10 years ago that might have been enough. But the times have changed. Today our laptops carry more than just our working files. They often include the entire corporate code repository, passwords and authentication keys, as well as personal files and data. Are our portable computers hardened against directed attack? Are we prepared for border-patrol agents or other state officials demanding passwords or unfettered access to our computing systems ... or online accounts? We're also more mobile. We expect to work when we want and where. How many of us can honestly say we could recover all -- or enough -- of our computing environment from bare metal in a day, half-day, or hour to be productive ... halfway across the globe? In this talk we'll look at the risks to the vast amounts of data we so casually carry around. We'll review strategies and techniques to reduce or mitigate those risks, as well as prepare our systems for easier recovery, at rest or on the go. We'll look at: Risks Machine physical security Encryption Data synchronization options On-the-go backup solutions On-the-go recovery Preparing to cross international borders

uk: вхід без авторизації

name: Road Warrior Disaster Recovery: Secure, Synchronized, and Backed-Up


Automated Firewall Testing

uk: Комп'ютерні науки

description: Automatically testing the pf firewall, using network stack virtualisation. For fun and profit, or at least for the sake of fewer bugs. We're all convinced that automated tests are a good idea. For some applications (e.g. grep, awk, cc, ...) this is very straightforward. Others are a lot harder to test, for example firewalls. Typically testing firewalls takes two to three hosts. One to send traffic, the firewall test host and one to receive traffic. This makes automated test orchestration complex and brittle. This in turn means that tests either don't get written, are difficult to write and/or suffer random failures unrelated to issues in the firewall itself. Virtualisation has made this all somewhat easier, but it's still fiddly and difficult to make robust. It's also slow. FreeBSD 12 will ship with network stack virtualisation (known as VIMAGE or vnet). This is an important feature for many applications, one of which is automated network stack and firewall testing. As of FreeBSD 12 PF fully support VIMAGE, allowing users to configure a firewall for each jail. This talk will introduce VIMAGE and show how it can be used to easily write firewall tests. If there's time a few interesting bugs and their test cases will also be discussed.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Unveil in OpenBSD Last year the unveil() system call was introduced in OpenBSD 6.4 Unveil has continued to evolve and be included in more programs in OpenBSD base, as well as some in the OpenBSD ports tree. Unveil has gained new features and semantics as a result, with some of the underlying implementation details in the kernel changing considerably. This talk discusses unveil, how it is used in programs, as well as new changes to semantics. We also will touch on how unveil() is implemented in the kernel to handle some of the changes.

uk: вхід без авторизації

name: Unveil in OpenBSD: The Unveil system call, it's use in Programs, and new semantics for it


uk: Комп'ютерні науки

description: DNS is easy. You type bsdcan.org in your browser's address bar, hit enter and you will be greeted by your favorite BSD conference's start page. Actually... We will start by giving a short introduction into DNS from the perspective of a client. We will explore: where to send questions to: upstream resolvers learned from dhcp / router advertisements / static quad-x resolvers vs. doing recursion ourselves, what questions to ask: qname-minimization (yes or no), what to do with the answer: benefits and limitations of DNSSEC. We will then introduce unwind(8) - an always-running, validating DNS recursive nameserver, answering queries on localhost (127.0.0.1). We will explain its privilege-separated design and show that it is secure to run this daemon by default. We will then show how its novel approach of observing changes in network location and actively probing the quality of the local network improve the user experience in DNS resolution. The focus will be on laptops that move through many networks, some good, some bad, some outright hostile. We will compare unwind(8) to prior solutions and show how its design enables it to run without user intervention. While unwind(8) is developed on OpenBSD it is intended to be portable. We will give pointers on a few OpenBSD specific features.

uk: вхід без авторизації

name: unwind(8): A privilege-separated, validating DNS recursive nameserver for every laptop


Measuring Performance on OpenBSD

uk: Комп'ютерні науки

description: When you try a new software version, something may be wrong or slow. You want to figure out when the regression was introduced. After updating OpenBSD you might see that something does not work as it used to be. To simplify debugging it is helpful to determine the point in time when the change was introduced and search for the relevant commit. For functional regressions a test suite that is executed on a daily basis is sufficient. By providing recent test results, the relevant day can be seen and the responsible developer of that area is informed. Making statements about performance is more difficult. The requirements for measurements may change, new test programs are needed, test hardware is only available for a limited time. So it is not sufficient to store historic data on a daily basis. You want to change granularity or look back into the past. For that purpose I have created a system that can create a performance measurement of an OpenBSD kernel in the past. The kernel is compiled from a certain CVS checkout. That may sound easier than it is as the OpenBSD kernel is not self contained. It belongs to a base system, there may be incompatibilities with userland. The performance also depends on the compiler version that changes over an OpenBSD development cycle. My solution installs an OpenBSD release and updates the kernel from source in fixed time steps. If there is a relevant user land change within the step, the necessary parts of the system are updated. This allows quick progress while compiling the kernel without rebuilding the whole system. With each new kernel the performance is measured.

uk: вхід без авторизації


Grundlagen der Informatik II - 1

cs: Matematika

de: Mathematik

fi: matematiikka

uk: Математика

en: Mathematics

fr: Mathématiques

da: Matematik

es: Matemáticas

nl: Wiskunde

de: Mathematik, Naturwissenschaften

uk: Математика, природничі науки

en: Mathematics, Natural Sciences

description: Auf Basis analytischer Sachverhalte entwickeln wir algorithmische Ideen für Verfahren auf Graphen. Daraus entstehen zunächst generische Verfahren, welche formal bezüglich ihrer Korrektheit und Laufzeit analysiert werden. Im Anschluß daran werden in jedem Kapitel Techniken zur Verbesserung und Beschleunigung vorgestellt. Abgerundet wird der Stoffplan durch zahlreiche Modellierungs- und Anwendungsbeispiele und der (optionalen) Implementierung eines Benchmarks verschiedener algorithmischer Varianten. Die Veranstaltung vermittelt folgende Kompetenzen: - Grundlegende Algorithmen und Datenstrukturen auf Graphen beherrschen - Korrektheit und Laufzeit von Graphenalgorithmen analysieren - Exakte und heuristische Möglichkeiten zur Effizienzsteigerung anwenden - Ausnutzen spezieller Eigenschaften (Planarität, Dünnbesetztheit) und effizienter Datenstrukturen - Urteilsfähigkeit, welche Verfahren in der Praxis effizient einsetzbar sind - Implementierung verschiedener Varianten - Modellierung verschiedener Problemstellungen auf Basis von Graphen, u.a. Problemen aus dem Knowledge Processing und der Sprachtechnologie

@language: de

uk: вхід без авторизації

Technische Universität Darmstadt

addressCountry: DE

addressLocality: Darmstadt

addressRegion: Hesse


Grundlagen der Informatik II - 2

uk: Математика, природничі науки

uk: вхід без авторизації


Grundlagen der Informatik II - 3

uk: Математика, природничі науки

uk: вхід без авторизації


Grundlagen der Informatik II - 4

uk: Математика, природничі науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Demonstrations from Crossref and Altmetric

name: Digital Science and Research Solutions Ltd.


New Thinking in Altmetrics

uk: Комп'ютерні науки

description: - Has Anyone Seen My Data? - Social Media Metrics for New Research Evaluation - Altmetrics and Open Access Impact

uk: вхід без авторизації


Altmetrics Conference - Funder Panel

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: - Extension Programs, Altmetrics and the Scholarship of Engagement - Altmetrics & Academic Libraries - Using Altmetric to Boost Engagement and Track Trends on Social Media

uk: вхід без авторизації

name: Altmetrics Conference - Driving User Engagement


uk: Комп'ютерні науки

description: - What can Altmetric.com tell us about Policy Citations of Research? - Evaluating Societal Impact - Collecting, Calculating and Displaying Altmetrics with Open Source - Which Social Media Interactions Indicate Positive Opinions About Cited Publications? - The Impact of Low Back Pain Clinical Trials Measured by the Altmetric Score: Cross-Sectional Study - Scholarly Books – Citations v Alternative Metrics

uk: вхід без авторизації

name: Altmetrics Conference - Poster Lightning Talks


Developing Meaningful Metrics

uk: Комп'ютерні науки

description: - Broadening the Definition of Altmetrics - Altmetrics Should Be Based on Needs, Not Just on What Can Be Measured - Characterizing Social Media Events

uk: вхід без авторизації


uk: Комп'ютерні науки

description: - Making Headlines: An Analysis of US Government-Funded Cancer Research Mentioned in Online Media - Compatibility of Altmetrics Indicators for Science Politics and Management - The Effect of Social Media Exposure of Scholarly Articles on Facebook and Twitter: Perspectives of Social Media Engagement and Click Metrics - Examining the Nature and Relationship of Tweet Sentiments with Citation Impact and Altmetric Indicators

uk: вхід без авторизації

name: Altmetrics Conference - Research Roundup


uk: Комп'ютерні науки

description: - What can a journal do with altmetrics? - Using Altmetrics to Encourage and Track the Dissemination of a Potentially High Impact Paper - Monitoring the broad impact of the journal publication output on a country level: A Case Study for Austria

uk: вхід без авторизації

name: Using Altmetrics: Experiences From the Front Line


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Demonstrations from Cobaltmetrics and Plum Analytics


uk: Комп'ютерні науки

description: - Annotation in Researcher and Publishing Workflows - Annotation in Publisher and Researcher Workflow - Annotation and Metrics on Cambridge Core ...

uk: вхід без авторизації

name: Altmetrics Conference - Annotations Panel


The Polictics of Altmetrics

uk: Комп'ютерні науки

description: Ethical Challenges Around the Use of Social Media Data Glossing over the Truth: The Forgotten Clinical Trial Data Research Metrics in the Fake News Era

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: The Future of Altmetrics and Closing Remarks


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Research Reporting in the Mainstream Media


uk: Комп'ютерні науки

uk: вхід без авторизації

name: From Numbers to Narratives: An Everyday Tale of Impactful Folk


de: Umweltschutz

uk: Охорона навколишнього середовища

en: Environmental Protection

de: Biologie

uk: Біологія

en: Biology

uk: Математика, природничі науки

de: Raumplanung

uk: Містобудування та територіальне планування

en: Spatial Planning

description: Die Vorlesung „Einführung in die Nachhaltigkeit“ an der HS Weingarten wurde im Wintersemester 2019/20 aufgezeichnet. Prof. Ertel gibt einen Einblick in das Thema Nachhaltigkeit. Das erste Ziel der Vorlesung ist, zu verstehen, dass der überwiegende Teil der Menschheit heute nicht nachhaltig lebt. Unter anderem verbrauchen die Menschen in den Industriestaaten so viel Energie und Rohstoffe und zerstören die Umwelt so stark, dass die Lebensbedingungen in etwa 50 Jahren deutlich schlechter als heute sein werden. Neben einer Analyse des aktuellen Standes der Menschheit als Ganzes auf dem Planeten Erde spielen hier auch Prognosemodelle eine wichtige Rolle. Das zweite Ziel ist es, Wege aufzuzeigen, wie wir zu einer nachhaltigen Entwicklung kommen können. Dazu gehören zum Beispiel technologische Entwicklungen. Aber noch viel wichtiger sind Änderungen in unserem Wirtschaftssystem und in unserem Lebensstil. Eine bedeutende Rolle spielt hier das Zusammenwirken von Politik, Wirtschaft und Bürgern in einer demokratischen Gesellschaft.

uk: вхід без авторизації

name: Einführung in die Nachhaltigkeit 1. Vorlesung

Hochschule Ravensburg-Weingarten

addressLocality: Weingarten

addressRegion: Baden-Wurttemberg


uk: Комп'ютерні науки

description: What are the environmental implications of the European Union policy to have 10 % of the transport fuel come from renewable sources by 2020? Is it sufficient to switch the energy supply of the existing building stock of cities to renewable energy to achieve carbon footprint targets? Would agricultural autarchy redu¬ce pressure on the environment (locally and/or globally)? Policies and decision situations like these call for advanced life cycle assessment models. Different concepts of Consequential LCA have been introduced for that purpose. This forum updates you on the latest developments in Consequential LCA methodology. It provides the opportunity to learn about the motivation and reasoning of public and private decision makers who commissioned consequential LCAs. Results from and experiences gained with consequential LCA case studies and the current state of imple¬mentation of consequential LCA approaches in large LCA databases as well as new IT solutions to support consequential LCAs are presented. During a breakout session you have the opportunity to discuss issues of needs, contents and implementation of consequential LCA with the aim to draft a joint statement on areas of consensus and disagreement. This forum is targeted to LCA researchers, database developers as well as LCA commissioners interested in learning more about the current state of the art, possibilities and limitations of conse¬quential LCAs.

uk: вхід без авторизації

name: Application of consequential LCA to urban projects ecodesign

name: Eidgenössische Technische Hochschule Zürich (ETH Zürich)

addressCountry: CH

addressLocality: Zurich

addressRegion: Zurich


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Computationally based approaches to consequential LCA: agent based and economic modelling


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Consequential LCA and its consequences for LCA practice


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Consequential LCA system model: implementation in ecoinvent data v3 and illustration of consequences on selected supply chains


uk: Комп'ютерні науки

uk: вхід без авторизації

name: A path forward for CLCA and decision making


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Consequential system boundaries: Social responsibility, rebound effects, and aggregation error


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Customized versions of consequential system models to be applied to databases like ecoinvent


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 62nd LCA Discussion Forum - Discussion I


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 62nd LCA Discussion Forum - Discussion II


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 62nd LCA Discussion Forum - Discussion III


uk: Комп'ютерні науки

uk: вхід без авторизації

name: European energy policy analysis with GTAP model in a consequential prospective LCA framework


uk: Комп'ютерні науки

uk: вхід без авторизації

name: How to derive a consequential national electricity mix: The case of a Swiss municipality


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Modelling the production and recycling of rare earth elements in consequential LCA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 62nd LCA Discussion Forum - Welcome and Introduction


uk: Комп'ютерні науки

description: Assessments of land use related impacts on ecosystem resources covering biodiversity and soil production potential are still a difficult issue in life cycle assessment (LCA). Major challenges are that biodiversity and soil degradation need to be assessed within a specific bio-geographic context and that land use intensities need to be considered. While the real dynamics and complexity of ecosystem processes above and below ground require complex and data demanding models, LCA practitioners call for simple and easy to use assessment routines that are, however, prone to oversimplification. Impacts of land use on biodiversity and soil quality are a key issue for the food, feed, apparel, paper and bioenergy industries that are all based on agricultural and forestry-based products. On one hand, upcoming approaches like Natural Capital Valuation provide simplified assessments of biodiversity and soil quality impacts of land use changes. On the other hand, recent research activities have come up with more complex approaches that are not broadly applicable yet. Finally, the UNEP SETAC Life Cycle Initiative supports scientific harmonization activities in the assessment of biodiversity impacts of land use with the aim to provide a best practice environmental impact indicator applicable in life cycle assessment case studies and databases. Finding balanced solutions that adequately represent ecosystem complexity and that are still relatively easily applicable will be key to improve informed decision making on the sustainability of agricultural and forestry-based products. The goal of this discussion forum is to present and discuss the state-of-the-art of methods for assessing land-use related impacts on ecosystems, the possibilities and limits of those approaches and the needs of the industry to integrate such methods.

uk: вхід без авторизації

name: Assessing biodiversity impacts and benefits of sheep wool


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Biodiversity and land use in the Natural Capital Protocol


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Capturing the biodiversity benefits of responsible forestry practices in LCA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Discussion: Land use impact assessment methods – complementarity and differences?

name: Eidgenössische Technische Hochschule Zürich (ETH Zürich)


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Considering habitat fragmentation in LCIA: First proposals


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Hemeroby - linked with biodiversity and soil quality - as an impact category indicator for the integration of land use and biodiversity into the Life Cycle (Impact) Assessment


uk: Комп'ютерні науки

uk: вхід без авторизації

name: How to quantify soil quality impacts in LCA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Impact assessment methods for biodiversity and soil degradation: Challenges towards broad applicability in LCA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Land use biodiversity assessment in LCA – the case of the Finnish forests


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Land use impacts on biodiversity loss in LCA: A bottom-up approach including agricultural intensities and landscape structural diversity


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Life cycle impact assessment (LCIA) of soil degradation: Development of a new impact assessment method in LCA


Modelling Biodiversity in Fuzzy Terms

uk: Комп'ютерні науки

uk: вхід без авторизації


Soil Organic Carbon (SOC) in LCA

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Natural Capital Valuation of a T-Shirt with focus on biodiversity impacts


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 61st LCA Discussion Forum - Panel Discussion


uk: Комп'ютерні науки

uk: вхід без авторизації

name: UNEP-SETAC Life Cycle Initiative on the assessment of biodiversity impacts of land use in LCA


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Validation of LCA biodiversity impact assessment in agriculture across Europe: The example of SALCA biodiversity


uk: Комп'ютерні науки

uk: вхід без авторизації

name: 61st LCA Discussion Forum - Welcome and introduction into the topic


Wrap-up and announcements, Farewell

uk: Комп'ютерні науки

uk: вхід без авторизації


libtrue: You can't handle the truth

uk: Комп'ютерні науки

description: During a talk at EuroBSDCon 2016 it was mentioned FreeBSD had no GENERIC kernel for armv6. While this was true at the time the claim was made a GENERIC kernel configuration was committed before the talk finished. This talk will provide a history of how this kernel configuration, common on other architectures, was added to armv6. FreeBSD added support for the ARMv6 and ARMv7 architectures in 2012. At this time each System on Chip required its own kernel configuration, however there had the start of the work needed to get a single kernel with the requirement for Flatted Device Tree to enumerate hardware. We will look at why having a common kernel on 32-bit ARM is so difficult, and what was needed to make this possible. This will include support for Flattened Device Tree, the historical GENERIC kernel project branch, INTRNG, and the ARM platform and multi-delay work. With these changes a single FreeBSD can boot on at least six vendors SoCs, with more being added.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: This provides a discussion in to how the FreeBSD community has become what it is, what some of its problems are and one or two ideas on how to fix it. An open source project’s community is what makes it a living thing. Without its community the project is a static lump of code. FreeBSD is one of the largest and longest continuously running open source projects around. Not only that, it comes from an even longer lineage before it via the original BSD work at the University of California, Berkeley. That doesn’t necessarily mean that it is without its problems. While FreeBSD isn’t in any danger of disappearing any time soon, it does have issues with attracting new contributors, keeping its existing contributors and keeping its community healthy. These issues are not always unique to FreeBSD but FreeBSD provides an interesting case study. This presentation will cover: How FreeBSD’s community and its processes have evolved over the years and how this compares to other, often newer, projects. What FreeBSD could learn from other projects. How this all fits into broader issues around open source development communities and things that do and don’t work.

uk: вхід без авторизації

name: The Trouble with FreeBSD: How did the FreeBSD community become what it is today?


uk: Комп'ютерні науки

description: What do you do if you are trying to understand software and wonder about the impact your measurement tool has on your measurements? You look at your system from the outside. However most of us might find it hard to tap CPU pins with an oscilloscope these days (and would probably not even find what they are looking for there). As part of a research project I have been on the adventurous journey booting FreeBSD in a micro-architecural simulator to analyse a small set of selected problems under a network workload. The talk will start with a summary of the adventurous journey to get FreeBSD running in full-system mode for three architectures (X86_64, ARM v6/7, and ARM v8) in the gem5 simulator where Linux was just working already. You'd think BSD should just work as well, right? I'll talk about early discoveries that have already helped to improve certain bits of FreeBSD, explore the questions "does your code really do what you think it does?" and "do you really measure what you think you are measuring?". Being able to tune hardware to specific configurations, e.g., cache-sizes or simulating different pipeline models, I'll discuss micro-architectural effects of code under test and elaborate on the advantages and disadvantages of the trace-driven analysis methodology. Having all this understanding, can we go back to the initial question and describe the impact a measurement tool has on the system? Do our design-choices and optimisations make sense? I'll close with a couple of remarks and open questions of other possible use cases for this simulator based trace-driven methodology, and an outlook on where I think this can be taken to and be useful for the community beyond academic research.

uk: вхід без авторизації

name: From the outside: Measuring and understanding FreeBSD using the gem5 simulator.


uk: Комп'ютерні науки

description: As a small ISP providing a wide variety of services the challenge we have is to keep track of every service, maintain consistent systems and make sure that everything served is billed. Vybe Networks Inc. is a small ISP providing a number of services to our clients. We want to provide a simple interface that allows them to control everything. The system should manage all the configuration with minimal human interaction beyond activating clients and selecting services. some of the services we need to manage are: email (regular and virtual) web sites (regular and virtual) shell accounts databases (PostgreSQL and MySQL) telephones PBXs NetTask Manager (task management server) This presentation talks about how we manage this.

uk: вхід без авторизації

name: Centrally managing an ISP with NetBSD and PostgreSQL


The FreeBSD Tool Chain

uk: Комп'ютерні науки

description: As a BSD distribution FreeBSD has the concept of a base system, an integrated kernel, and core userland, which are developed, tested, and released together by a common team. The userland includes the C language runtime, the build toolchain, basic system utilities, and some third-party libraries and applications. The toolchain includes the compiler and linker, which translate source code into executable objects, the debugger, and related utilities for inspecting or modifying those objects. In this talk you will learn about the history of FreeBSD's toolchain, why certain choices were made when choosing toolchain components, the current state of the toolchain, and plans for the future. For most of its history FreeBSD relied on the GNU toolchain: the GNU Compiler Collection (GCC), the GNU binutils linker and binary inspection tools, the GNU debugger GDB. This was the case between 1993 and 2007, and the copy of the toolchain included in the FreeBSD tree was regularly updated throughout that period. In 2007 the Free Software Foundation migrated to version 3 of the GNU Public License (GPLv3), which included new restrictions that some FreeBSD users and developers found objectionable. Broad updates to the GNU toolchain ceased, and it quickly became outdated. A migration to permissively licensed toolchain components is in progress. FreeBSD now uses the Clang compiler for Tier-1 architectures, with ongoing effort to switch to Clang for the remainder. Work is ongoing to use LLVM's LLD linker, and it is currently usable on amd64. Binary utilities such as objcopy and readelf are obtained from the ELF Tool Chain project on all supported FreeBSD architectures. Runtime libraries largely come from the LLVM project. This includes the libc++ C++ runtime, the compiler-rt library used by the compiler, and sanitizer runtimes used for diagnostic and debugging tools. One library, libcxxrt, comes from Pathscale. A migration to LLVM's LLDB debugger is also underway.

uk: вхід без авторизації


FreeBSD ARM : Before Kernel

uk: Комп'ютерні науки

description: This lecture describe the boot process of FreeBSD on ARM and the ongoing effort to upstream our local patches for U-Boot (An opensource bootloader for embedded devices) and DTS (DeviceTree Source) into the Linux Kernel. Booting FreeBSD on an ARM board relies on three things : U-Boot (An opensource bootloader for embedded devices) ubldr (a version of loader (8) using the U-Boot API) DTB (Devicetree Blob, a file that describe the hardware that we are running on). You, of course, also need drivers for the board System On a Chip but this is beyond this talk. Therefore it is important to keep up with U-Boot release as adding support for a new board will require support for it in U-Boot. It is also important to keep up with the DTS (Devicetree Syntax, the file that will be converted in a DTB) that we import from the Linux Kernel project as new board means new DTS file for it.

uk: вхід без авторизації


uk: Комп'ютерні науки

description: We present the design of the Spanning Tree Protocols as documented in IEEE standard 802.1Q-2011 and their implementation in the FreeBSD kernel. We begin by explaining the theory behind the protocols and why they are needed. We look at how Spanning Tree became Rapid Spanning Tree and finally (for now) Multiple Spanning Tree. We then explore the FreeBSD implementations of these protocols, in particular the work sponsored by XipLink to support MSTP. While FreeBSD is well-known for its comprehensive support of layer 3 (IPv4, IPv6) and layer 4 (TCP, SCTP) networking protocols, the lower layers of its network stack enjoy rather less praise. XipLink has been successfully using FreeBSD for its network optimizer since the 1990s and has done many exciting things with the link-layer. Complexity arising in switched networks and the never ending quest for reliability pushed XipLink to integrate CARP with bridging and STP. Last year, when it came time to extend this work to support VLANs, they quickly realized that Multiple Spanning Tree is required to support complex VLAN topologies. XipLink is proud to sponsor the development of MSTP on FreeBSD. We present some of the FreeBSD limitations encountered trying to make CARP, Bridge, VLAN and STP work together, along with the challenges of implementing MSTP. We also offer suggestions for future work.

uk: вхід без авторизації

name: Not simply pieces of string: Ethernet in the 21st Century


uk: Комп'ютерні науки

description: From http://www.bsdcan.org/2017/schedule/events/865.en.html

uk: вхід без авторизації

name: The Foundation of IT Infrastructure culture


Save & Restore for bhyve

uk: Комп'ютерні науки

description: bhyve is the current FreeBSD hypervisor, but it lacks of Save/Restore feature for a running virtual machine. The aim of this project is adding save/restore feature in order to increase bhyve usability in production environments. Save/Restore feature for a running Virtual Machine on bhyve is a very complex operation due to the fact that you must ensure consistency by correlating the state of the guest with the internal data about the guest that is hold in the hypervisor. In order to create a minimal feature to save the state of a virtual machine which is running on ramdisk you must do the following: save the virtual machine memory on disk (dump all its memory on disk) save the virtual machine internal state from the hypervisor (internal state from userspace and from kernelspace) save the state of the devices In order to restore the state of a virtual machine: create an empty virtual machine restore its memory restore the internal structures from files In the above presented steps, one of the most tedious operation was saving the internal state of the hypervisor in a file. There were a lot of structures having pointers to each other that needed to be reinitialized and this induced a lot of bugs. Another issue about saving the state of the machine was to completely freeze it to be sure that one gets a consistent state. To increase the user experience while saving the whole memory (imagine you have a 32 GB of RAM VM) we used the copy-on-write mechanism: we freeze the VM, mark all the pages copy-on-write and we unfreeze it. If the VM would write something, a copy of the page will be created, leaving in place the initial state. This is currently a work-in-progress project. We are at the step of restoring the state of the virtual machine, having trouble with the internal hypervisor registers, specific to a virtual machine. The project was also sponsored by Matthew Grooms (he paid two students to work with me at this project).

uk: вхід без авторизації


uk: Комп'ютерні науки

description: Crash dumps, also known as core dumps, have been a part of BSD since its' beginnings in Research UNIX. Though 38 years have passed since doadump() came about in UNIX/32V, core dumps are still needed and utilized in much the same way they were then. This talk will provide an extensive background on core dumps, including a complete history, a summary of the present state and a discussion on the future of the core dump routine in FreeBSD. One might assume the core dump code has changed little over time but, with some research, this assumption has proven incorrect. What has changed over time is the amount of RAM in the machines we expect to be able to get a crash dump from. Because of this, underlying assumptions about the size of swap partitions in respect to the size of kernel virtual memory are proving incorrect, disabling core dumps in many machines. To avoid these pitfalls, several extensions to the core dump code have been created over time but have never made it upstream. These extensions include gzip compressed dumps and dumping over the network. In addition, other related operating systems like macOS (formerly Mac OS X) and Illumos have several of the features that would be useful in FreeBSD including dumping to swap on a ZVOL, live core dumps and tools to estimate the size of a core dump on a running machine. This talk begins with a quick background on what core dumps are and why operators might need them. Following that the current state of the core dump facility and some of the more common extensions in use are examined. We conclude with a call to action for upstreaming these extensions and modularizing the core dump code such that different methods of core dump can be dynamically loaded into the kernel on demand. By the end of this talk attendees will have a thorough knowledge of what core dumps are, why they're useful, how they've been done in the past and what improvements could be made in the future.

uk: вхід без авторизації

name: The History and Future of Crash Dumps in FreeBSD


uk: Комп'ютерні науки

description: Symbolic debuggers are one of the most important tools in the programmer’s toolkit, but also one of the most overlooked pieces of technology. They have to work in some of the harshest conditions, supporting a huge set of programming languages and aggressive transformations by compilers. This talk explores how these debuggers work, how the operating system could help, what makes them fail and how they can be used more effectively. In this presentation, we will take you on a journey to some of the darkest and most confusing pits of systems programming involving debug formats, compilers and process control. We will describe situations where debuggers have failed you, why and how they can be addressed. These failures include missing critical data, corrupted output, performance bottlenecks and more. Even a single snapshot of application state can yield important clues that can reduce time to resolution. This ranges from the classes of instructions involved, to run-time breadcrumbs from the garbage collector or memory allocator, to the relationships of objects in application memory. We will take a tour of commonly neglected areas of application state whose exploration can greatly reduce time to resolution of common classes of bugs. Various aspects of popular debuggers such as GDB and LLDB will be analyzed, including performance and debug information handling. Some of the worst bugs are ones that leave engineers with no visibility into application state. Perhaps a process is unable to dump core on your filesystem, or your debugger hangs extracting application state or your compiler has completely optimized out a crucial piece of information. What are the common pitfalls and how can they be resolved? We will investigate real-world situations where standard symbolic debugging techniques are insufficient or fail and how some of those situations can be mitigated.

uk: вхід без авторизації

name: Debugging the debugger: Why your debugger doesn't work when you need it to


Backpressure in FreeBSD I/O Stack

uk: Комп'ютерні науки

description: Dynamically tuning limits in the FreeBSD buffer cache provides better performance than the static limits. Providing feedback from the lower layers allows the upper layers to better schedule work. In addition, mixed storage system with spinning media and flash dynamically size the work load based on what storage units are capable of. FreeBSD's VM system uses a number of limits to moderate I/Os in the system. These limits were tuned in the 1990's well before Flash changed the dynamics of storage. Tuning the system's limits for good performance can be a bit of a black art. The back pressure work introduces a communication link between the lowest layers of the system and the upper layers. The current static limits try to guess what the I/O system can support, and the optimal load to get good performance. In addition, the policy of moderating the load with low and high water produces uneven performance. This work builds on the work that Isilon has done for the laundering of the system and made it possible. The buffer cache can manage the global limits, as well as schedule enough I/O to not swamp the drives in a system. In addition, bad performance on one drive no longer affects all the others in the system. Slow drives no longer will starve large drives of writes because the limits that were global are now influenced by drive performance. The work is fairly detailed, and getting into all the details will make for a boring talk. To make the talk more interesting, there will be a brief tutorial on the current system VM, buffer cache, how I/Os flow through system. Once the background has been given, I'll talk about the changes to the system, how to hook into the system

uk: вхід без авторизації


DTrace Internals: Digging into DTrace

uk: Комп'ютерні науки

description: DTrace is a powerful debugging and system introspection tool. BSD developers are merrily using DTrace to understand their systems, but how does DTrace actually work? You will find out in this talk. We will dig into the architecture and internals of the DTrace framework. We will discuss how both kernel and userland tracing work under the hood. We will also dig into DTrace's support for x86-64, ARMv8, and RISC-V on FreeBSD. Finally, we will answer the deep philosophical question: Can you dtrace DTrace?

uk: вхід без авторизації


uk: Комп'ютерні науки

description: OpenBSD includes a variety of tools for building robust web server solutions. The httpd web server is a lean, fast platform for serving web pages. Relayd allows you to distribute a site's load between multiple servers for redundancy, extra capacity, or both. These two servers, combined with CARP, PF, and other OpenBSD tools, let you slice hundreds of thousands of dollars off the cost of deploying your applications. OpenBSD includes a variety of tools for building robust web server solutions. The httpd web server is a lean, fast platform for serving web pages. Relayd allows you to distribute a site's load between multiple servers for redundancy, extra capacity, or both. These two servers, combined with CARP, PF, and other OpenBSD tools, let you slice hundreds of thousands of dollars off the cost of deploying your applications. This talk will cover: setting up web sites administering chroots for web apps Lua patterns OpenBSD's ACME client OCSP stapling multi-server clusters load balancer clusters Based on the forthcoming book "Httpd and Relayd Mastery," which should be out just before BSDCan.

uk: вхід без авторизації

name: The OpenBSD Web Stack: httpd, carp, and relayd


uk: Комп'ютерні науки

description: pkgsrc is a package management system, providing over 17.000 packages today. Even though it originates from the NetBSD Project, it supports many other platforms, even as the official source for packages for some of them. A key feature of pkgsrc is its ability to abstract the specificities of the host Operating System and build environment away. This versatile, centralized software repository provides a great opportunity to apply, experiment with and maintain security features for a complete software distribution. While some of the features and mechanisms mentioned in this document are well adopted in the industry, their integration into the pkgsrc project is still in progress. The project should also be able to help with the development of additional innovative techniques, for further hardening of the deployment of pkgsrc for its supported platforms and users. The pkgsrc project takes particular care of the security of the software it provides. It notably features two distinct teams handling security aspects for the project: the pkgsrc Security Team, and the pkgsrc Release Engineering Group. While the former is mainly in charge of tracking security issues (including the maintenance of a list of known vulnerabilities), the latter actually updates the stable releases, including for security issues. These updates are usually filed by official developers for the project (also known as "pull-up requests"). Regardless of the presence and efficiency of the security management for the project, updates may not reach the users of the software in a timely manner. This is where platform hardening can help mitigating security issues as they occur; thankfully, pkgsrc offers a number of possibilities in this regard: Stack Smashing Protection (SSP) Fortify, Position-Independent Executables (PIE) RELRO, reproducible builds. This list is not exhaustive, and each feature comes with corresponding challenges. Their effective implementation often implies modifications in the Operating System, as well as in the target software (or its build system). While pkgsrc cannot automatically implement all of these features, it can be used to attempt to enforce them, and even detect where they fail to function. This submission will attempt to explain how, document the current status, and gather ideas for future work in this direction.

uk: вхід без авторизації

name: Hardening pkgsrc: Securing packages, 17.000 at a time


The Realities of DTrace on FreeBSD

uk: Комп'ютерні науки

description: For more than a year we have been using DTrace as one of the three core components of a security research project, CADETS. Unlike earlier users of DTrace, which were focused on occasional, deep debugging sessions, the CADETS project uses DTrace to bring total system transparency to both the operating system and the applications that are running on top of it. The use of "always-on tracing" pushes the DTrace system up to, and often, past its limits and shows how some of the original design tradeoffs need to be revisited to address the needs of our project. Our talk covers our current efforts to extend and improve the DTrace framework in FreeBSD, including performance and programming improvements to address the needs of always-on tracing as well as integration with FreeBSD's audit subsystem and the addition of machine-readable output for use by creators of downstream security-analysis tools. This presentation is based upon the work of six authors: Jonathan Anderson, Graeme Jenkinson, Brian Kidney, George Neville-Neil, Amanda Strnad, Arun Thomas, and Robert Watson. For more than a year we have been using DTrace as one of the three core components of a security research project, CADETS. Unlike earlier users of DTrace, which were focused on occasional, deep debugging sessions, the CADETS project uses DTrace to bring total system transparency to both the operating system and the applications that are running on top of it. The use of "always-on tracing" pushes the DTrace system up to, and often, past its limits and shows how some of the original design tradeoffs need to be revisited to address the needs of our project. Our talk covers our current efforts to extend and improve the DTrace framework in FreeBSD, including performance and programming improvements to address the needs of always-on tracing as well as integration with FreeBSD's audit subsystem and the addition of machine-readable output for use by creators of downstream security-analysis tools.

uk: вхід без авторизації


Closing session: The wrap up

uk: Комп'ютерні науки

uk: вхід без авторизації


uk: Комп'ютерні науки

description: "From microservices to monoliths" -- A sysadmin's deep dive into migrating a complex web application stack to FreeBSD whilst ignoring as much conventional wisdom as possible. iwantmyname.com is a plucky domain name reseller allegedly based in New Zealand but actually distributed globally. It has an interesting tech stack of Puppet, Perl, Erlang, Apache CouchDB, RabbitMQ & more recently Elixir and Ansible. This talk runs through how we migrated this stack from Debian to FreeBSD, with plenty of juicy technical details on what FreeBSD-specific and Open Source tech we leveraged, and as well as revisiting the actual migration including some Epic Fails for our mutual amusement, as hindsight is always a gift to be shared liberally. Changing an Operating System is a big decision to take for any company, and we did not do so lightly. Many small virtual machines and continual patch updates had lead to increased latency for our users and customers, as well as increased effort on patching and maintaining the OS instead of delivering value to our business. The reasons for moving, and the specific advantages that FreeBSD brought, will be touched on, but are not the main focus for the talk. We put together a new architecture based on FreeBSD, to eliminate the major issues that had caused increasing problems in the preceding years. I'll be giving all the details on how we made this move, both in terms of step-by-step migration, and in the architecture we put together to support the business applications. We'll cover real-time and historic metrics out of our management & monitoring tools (Ansible, Hashicorp Vault, CollectD, Riemann, Graphite, rsyslog - see attachments for some quick examples), and the subsequent migration of our business apps and services (perl, Erlang, Elixir, Apache CouchDB, Kyoto Tycoon), as well as the infrastructure that supports this - carp-enabled clustered servers managed with Ansible, using iocage/iocell jails, secured with haproxy, spiped, pf, nginx, and how we make use of ZFS, dtrace, our git-hosted private & public FreeBSD ports trees. Finally, I'll close out with what we learned, what we wished we had done differently, and what I think is coming next for our FreeBSD cluster of happiness. This talk will be of interest to anybody with a sysadmin, or general technology background, with a healthy mix of specific technical information and general infrastructure tips.

uk: вхід без авторизації

name: From microservices to monoliths: A sysadmin's deep dive into migrating a complex web application stack to FreeBSD whilst ignoring conventional wisdom.


uk: Комп'ютерні науки

uk: вхід без авторизації

name: Universal Userland: Why do we need to be different just like everyone else?


uk: Комп'ютерні науки

description: Are you waxing your NIC trying to make it go faster? ZFS is so fast, but my replication is slow... why? SSH tries by default to be very responsive, and sacrifices throughput to remain interactive. This is usually what you want, but not always. We abuse SSH for many things, be in ZFS replication, rsync, ansible, etc. This work describes a number of proposed improvements to OpenSSH to increase the performance of non-interactive sessions used for bulk transfer. The author describes ongoing development and tuning work to maximize performance of bulk data transfer over SSH. Development includes improvements to the HPN patch sets to resolve problems with dynamic window scaling (both TCP and SSH windows), new functionality to manually specify a larger remote send/receive socket buffer for high latency networks, and development of the new NONEMAC feature. The author also presents detailed benchmarks on the performance tuning required to maximize transfer rates over both local and long-haul networks. A comparative analysis of the performance of various ciphers on modern amd64 hardware is also presented. With this work, transfers in excess of 15 gigabits per second were achieved using a pair of E5-1650 v3s back-to-back with 40gbps Chelsio NICs.

uk: вхід без авторизації

name: Abusing SSH for ZFS and Profit: SSH Bulk Transfer Performance Improvements


uk: Комп'ютерні науки

description: This talk introduces vmd(8) and the concepts of running virtual machines under OpenBSD. It gives a brief introduction of OpenBSD's vmm(4) hypervisor, that was written by Mike Larkin, but focusses on the userland part that is implemented in the vmd(8) and vmctl(8) tools. It will illustrate my work on the design and implementation of the daemon, and its security concepts to run VMs in a sandboxed and "pledged" environment to mitigate VM escapes. Some time ago, when Mike Larkin showed me the kernel's dmesg of a first proof-of-concept vmm(4) implementation, I got all excited and tried to persuade him to release it for OpenBSD. We made a deal that I will take care of a virtual switch implementation and help with the userland bits of vmm(4). After he finally imported the first version of vmd(8) and vmctl(8) into OpenBSD, I quickly jumped on it and turned it into to a privilege-separated, OpenBSD-style daemon with a proper configuration. Both vmd(8) and vmm(4) are still work in progress but the version in 6.1 is ready for general usage. vmd(8) does not support a BIOS or any other operating system except OpenBSD yet, but it got many improvements in reliability, configuration, and basic functionality. I implemented a simple bootloader to load OpenBSD kernels from the disk image, improved networking and configuration, added the concept of virtual switches, and implemented the vmmci(4) guest services device among many other improvements to make it ready for prime time. So why do we need another implementation of a hypervisor? We like diversity and the process of designing and implementing it in a way that fits into OpenBSD and aligns with our ideas. If you intend to run "Firefox VMs" on a laptop, or many virtual machines on a powerful server, vmd(8) will give you the ability to run them in a secure and OpenBSD-style way.

uk: вхід без авторизації

name: vmd: an virtual machine daemon for OpenBSD


uk: Комп'ютерні науки

description: TCP Synfloods have been with us for decades. Why are they still a problem? What countermeasures have been implemented in network stacks? How can we improve pf's synflood handling? I'm working on pf to detect synfloods and then cope better with them then we already do. I'll explain why this so old problem is still current and hasn't been solved. We'll then look at common countermeasures, their effectivity, and their downsides. And eventually, I'll detail the upcoming changes to pf improving synflood resiliency for pf itself and protection for the hosts behind.

uk: вхід без авторизації

name: tcp synfloods: an old yet current problem, and improving pf's response


Understanding NFSv4 ACL's

uk: Комп'ютерні науки

description: NFSv4 Access Control Lists are hard. Many people have a hard time understanding them let alone how to utilize them. The purpose of this talk is to explain in detail how they work and to demonstrate this in action. Demonstrations will be given and questions will be answered so everyone learns. Traditional UNIX permissions are very limited in the security they can provide. UNIX permissions can only be set for the owner, group and everyone else (other). NFSv4 access control lists can give a lot more flexibility in the security and access that can be provided. In the NFSv4 security model, owner, group, specific users, specific groups, everyone, etc can be configured. Complete control over the type of access you want is possible. This paper assumes you are running FreeBSD or FreeNAS. The object of this paper is to demonstrate how NFSv4 access control lists work by example with some explanation. It is assumed the reader is familiar with traditional UNIX permissions.

uk: вхід без авторизації