Chaos Computer Club - archive feed

Ich lese Textpassagen vor und erzähle, was mir hierzu einfiel. Keine Vorkenntnisse nötig. Ich möchte einige interessante Textpassagen aus George Orwells "1894" vorlesen (deutsche Übersetzung) und erzählen, was mir spontan zu diesen einfiel. Folgende Themen kommen darin vor: * (Video)Überwachung durch staatliche Einrichtungen ** Auswirkungen von Überwachung auf Gesellschaft ** Nutzen von öffentlicher Videoüberwachung * Zensur * Ethische Aspekte zu diesem Komplex: ** Verhaltensänderung durch Überwachung, Disziplinargesellschaft ** Überwachung und Sozialdarwinismus ** Michel Foucault: Macht- und Wahrheitsstrukten ** Sprachökonmie, Sapir-Whorf-Hypothese Ich würde auch kurz auf die Metadaten des Werks eingehen, jedoch nicht auf die Handlung. Es ist _nicht_ notwendig, das Buch vorher gelesen zu haben. Den Vortrag hielt ich in ähnlicher Form bereits im November 2022 in der Otto-von-Guericke-Universität Magdeburg in der Lehrveranstaltung "Informatik und Ethik". about this event: https://talks.datenspuren.de/ds23/talk/9Z9QHK/

Eine Einführung in das Thema Sicherheit auf Linux für Neulinge Seid ihr unsicher, wie ihr zeitgemäß und sicher einen Computer betreiben könnt? Hier möchte ich euch einen Überblick über relevante Themen verschaffen, wie ihr von der Einrichtung eures Rechners über Endanwendungen bis hin zu Online-Diensten euren Alltag gut und sicher gestalten könnt. about this event: https://talks.datenspuren.de/ds23/talk/RZWYPH/

Ein deprimierender Überblick und ein hoffentlich weniger deprimierender Ausblick. Das Meme mit dem "This is fine"-Hund in Flammen ist beliebt. Aber damit morgen besser als heute wird, müssen wir aushalten, das vieles so gar nicht in Ordnung ist. Nicht nur, wenn es um Klimakatastrophe und Co. geht, sondern auch in Bezug auf den Grundrechteabbau in unserer digitalen Welt - trotz der vermeintlichen "Fortschrittskoalition". Ein deprimierender Überblick zur Halbzeit der Legislatur, was brennt. Und ein hoffentlich nicht ganz so deprimierender Ausblick, was wir tun können, um die Brände zu löschen. Damit übermorgen besser als heute wird. about this event: https://talks.datenspuren.de/ds23/talk/YJUHK9/

http, ssl, html, js, Werbeblocker ublock origin, noscript, ghostery. ... Was passiert wenn wir uns ins Neuland begeben? In diesem Talk wird eine Reise ins Neuland unternommen. about this event: https://talks.datenspuren.de/ds23/talk/KBWS7U/

Opening about this event: https://talks.datenspuren.de/ds23/talk/VY99KZ/

Podcast Soiree Wir reden wie immer über die News des Monats sowie über OT-Sicherheit. Außerdem füllen wir eure Podcast-Queue. about this event: https://talks.datenspuren.de/ds23/talk/DJYKKS/

Presentation from Solidarity Zone initiative that support those repressed for actions against war Solidarity zone's member will talk about political context, led to the failure of peaceful protest, screws tightening and appearing of individual acts of militant resistance against russian imperialism and military aggression in Ukraine. In our helping work we face, on the one hand, with symbolic actions, and on the other, with more prepared acts of sabotage. Both of them seem to be significant for further understanding of ongoing social processes and political inertia of russian society. about this event: https://talks.datenspuren.de/ds23/talk/KVBND9/

Presentation about repressions in Belarus and anarchists movement in exile In August 2020 belarusian people rose against dictatorship of Alexander Lukashenko hopying to overthrow a regime, existing in Belarus since 1994. Several months of protests ended up in mass wave of repressions and political migration from the country. With thousands of political prisoners out of which at least 30 are anarchists, Belarus is the country with one of the highest levels of repressions in Europe this days. Couple of years later Vladimir Putin started full scale invasion of Ukraine with support of belarusian regime. This created even more problems for the rest of resistance against dictatorship in Belarus. During this talk member of ABC-Belarus will present the current political situation inside the country and in diaspora organized in Poland/Lithuania. What are the perspectives of the people trying to overthrow dictatorship and what is the role of anarchists in the whole story? The talk will be around 90 minutes with space for questions and a discussion. about this event: https://talks.datenspuren.de/ds23/talk/FWVA3H/

Closing session of All Systems Go! 2023 about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/PKSMVD/

In this talk we’ll discuss antlir2, Meta’s solution to building container and bare metal operating system images. We’ll talk about how we have built performant, hermetic and deterministic image building infrastructure on top of buck2 (Meta’s new open source build system) and how we enable users to compose their own multi-language projects with full operating systems, write tests and deploy their images. Along the way, we’ll also cover how antlir2 wrangles dnf and other upstream tooling to behave more predictably for better, more reliable images. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/9E9MLC/

sdbusplus generates ergonomic and compile-time type-checked dbus bindings built atop sd-bus. This library is heavily used within the OpenBMC project to provide all IPC between its many userspace processes. This talk will give an overview of how OpenBMC leverages dbus, how sdbusplus facilitates its usage, as well as an introduction on our approach for asynchronous programming with C++ co-routines. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/QUMHR3/

BuildStream is a tool for building / integrating software stacks. In a way, it has a similar goal to bitbake / yocto and Android repo, but takes a completely different approach. It can be used to take software from various sources, build it with various buildsystems in a reproducible sandbox, and cache results for speedy rebuilds. In this talk I give a brief overview of Buildstream, how it is used to build GNOME OS, and the challenges we face in using it. I also go over freedesktop-sdk which is a base runtime that can be used as a base to build your own system. I also discuss the challenges we encountered with using buildstream with ostree and the steps we're taking to support updating with systemd-sysupdate. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/G8UZGL/

A quick journey through the Azure infrastructure, specifically looking at how image-based Linux is used for Azure Boost, what it enables, what interesting security and performance features were added and where to find them upstream. Believe it or not, today Linux is right at the core of Microsoft Azure's infrastructure, on the very nodes that run all those fancy virtual machines. Getting there was not easy, and a lot of work was needed to meet the very stringent security and performance goals that were set. We built a custom distribution, added several security features such as signed dm-verity and kernel-enforced code integrity, came up with a way to keep state alive across kexec with PMEM, and implemented the stackable Portable Services image model that ultimately became sysexts and confexts. And much more! This talk will walk through this effort, starting with a peek under the cover at the hardware that powers it and what it enables, passing through the custom OS and ending up at all the features we added to systemd and elsewhere that you all can enjoy as well. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/7URRNC/

mkosi is a tool for building operating system images. In this talk we'll give an introduction to mkosi, how we use it to develop systemd and discuss how we want to support running and updating systems with mkosi and other systemd tooling. Github repository: https://github.com/systemd/mkosi/ Initial blog post on mkosi: https://0pointer.net/blog/mkosi-a-tool-for-generating-os-images.html about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/ASV8ZM/

Are you using container images with hundreds of known vulnerabilities? The majority of us are using images based on the Docker official images available on the Docker Hub. This includes base images – such as Debian and Ubuntu – as well as application images such as nginx and redis. Unfortunately these images often have hundreds of known vulnerabilities due to excessively large dependency trees with out-of-date packages. This security debt can lead to unnecessary security risks and slower development cycles. Wolfi (​​https://github.com/wolfi-dev/) is a new Linux distribution optimized for building minimal, secure container images. Wolfi maintainers prioritize a rolling release model built on a rapid package update cycle, which ensures that new vulnerabilities are remediated quickly. This talk not only describes the problems that motivate Wolfi but also provides hands-on knowledge to help developers take advantage of Wolfi. By the end of the talk, developers will learn about packaging techniques with apko and melange, tools specifically designed to build Wolfi packages and turn them into minimal, low- or no-vulnerability containers. Key Takeaways and Highlights Popular, off-the-shelf base images and containers often have hundreds of known vulnerabilities (“CVEs”), which can, at worst, be a security risk and, at best, be a giant time suck. Wolfi is a new secure-by-default linux distribution that prioritizes rapid package updates and, by extension, fast mean time-to-remediation for known vulnerabilities. Packages in Wolfi can form the foundation of secure, minimal base images and containers, freeing developers of tedious vulnerability management tasks and increasing security for cloud-native applications. Talk Outline The Cloud-Native Application Status Quo: Bloated, Outdated, Vulnerability-Laden Images Containers 101 Show the results of running security scanners against popular Dockerhub official images Use (grype, an open source scanner) to scan golang:latest and nginx:latest. Show via command line. Show data and analysis on package counts, package staleness, vulnerability counts of official Docker Hub images Draw on six months of daily scanning results collected by presentation team Overview of Wolfi Fast package update times Fast vulnerability mean time-to-remediation Granular packages Wolfi packages are often packaged at a more granular level than their counterparts in other distributions, which allows developers to pick and choose only the components that are essential for an image, without dragging in unnecessary functionality and attack surface. Rolling release Why not alternative approaches, either other minimal images or using other distros? Google distroless Debian-based so there can be slow update times for packages Debian - Slow package updates How to build images with Wolfi packages Explain melange and building packages Example of building a package with melange Explain apko and building images Demo of building an image with apko about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/V9EZSS/

Recently, atomic updates via image based systems have become more relevant for servers and desktops, as they allow predictable management of large fleets. In the embedded Linux space, this approach has been the default for many years and proven updaters exist already. In this talk, we will delve into RAUC and look at how its design and features have been driven by the requirements for robust, atomic updates. The presentation will introduce the fundamental concepts surrounding A/B fallback and update signing in the context of embedded Linux updates. We will then explore the commonalities and differences between RAUC and systemd's sysupdate. The discussion will progress to cover RAUC's bundle-based update system, which allows for comprehensive system updates without the need for local storage, thanks to HTTP streaming. Additionally, we will demonstrate how adaptive updates minimize download sizes without necessitating version-specific patch management. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/NEQ9TX/

openSUSE Aeon (formerly MicroOS Desktop) aims to be a fully fledged modern Linux Desktop leveraging as many of the latest user space innovations available including: - Immutable OS with Transactional Updates - Secure Boot - TPM Encryption - Flatpaks & OCI containers as primary application delivery This talk will introduce the distribution, highlight the adoption of some of the latest foundational user space technologies as well as share some of the pain points being faced and invite the audience to contribute to this exciting platform. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/RV3UZD/

Network operating systems commonly provide a stable userspace platform for networking devices. Integration of userspace applications as well as low-level hardware support are handled by firmware build systems. Existing build systems for network operating systems display numerous limitations by either targeting only distinct types of devices, using cumbersome methodologies to add additional features or offering insufficient capabilities regarding what to include in the firmware image. In this presentation, we provide an overview of these limitations and how we mitigate them with Replica.one, an Open Source firmware builder which targets the entire networking stack. We will focus on the solution's optimization features, its capability to generate firmware for diverse classes of devices across the entire networking stack, and the flexibility to select the desired operating system between various Linux-based distributions. The presentation targets Linux users who are interested in replacing their existing build system infrastructure with a single unified software platform. The flexibility of image-based network operating systems will allow organizations and its users to operate their existing hardware resources more efficiently and securely. Professionals who are working in the domain of firmware build systems to integrate applications and features will benefit from Replica.one’s ease of use as well as powerful image customization capabilities. The novel element of a single platform running on an entire networking infrastructure stack will be of particular interest to a wide range of organizations and companies looking to reduce their operating cost while reaping the benefits of open source community effort. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/LBWXKL/

systemd-repart has recently learned many features to make it useful for building discoverable disk images. In this talk, we'll give a deep-dive on the new features and how they can be used to assemble discoverable disk images. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/VPQADA/

A/B partitioning is great - you hermetically drop-in the whole new OS and boot into it. Although, how can we manage and migrate the RW configuration and state files that lie within? Can we do that reliably on both OS upgrades and downgrades? This talk will explore the design used on the SteamDeck, the issues we've seen while drawing analogies, and future inspiration with "Fitting Everything Together" by Lennart Poettering in mind. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/MPAEFK/

Arch Linux has worked with its own packaging framework - Arch Linux Package Management (ALPM) - for about 20 years. This talk is about an effort to rewrite low-level components and to create specifications for related metadata files using the Rust programming language. It will cover new projects in the ALPM (https://gitlab.archlinux.org/archlinux/alpm/) group as well as several other related ones and give an outlook on future developments using the 🦀 Arch Linux (https://archlinux.org) has worked with its own packaging framework - Arch Linux Package Management (ALPM) - for about 20 years. The tooling consists mainly of scripts for package creation (e.g. `makepkg`, written in Bash) and a package manager (`pacman`, written in C). Over the last years several projects for the improvement of the packaging and package distribution ecosystem have been started. Some of which had to reinvent the wheel. This talk is about an effort to rewrite low-level components and to create specifications for related metadata files using the Rust programming language. It will cover new projects in the ALPM (https://gitlab.archlinux.org/archlinux/alpm/) group as well as several other related ones and give an outlook on future developments using the 🦀 about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/3LES8Z/

This talk will explore the ideas from Lennart's "Fitting Everything Together" blog post, particularly the A/B partitioning scheme and its bootloader design, comparing it with the approach used on the SteamDeck. Spoiler alert, we're not using sd-boot. We will focus on the requirements that drove us to the latter design, some implementation details, and hurdles we needed to overcome to achieve that project. Lastly, the idea of finding common ground will be entertained where audience participation is greatly encouraged. What features would be acceptable by the wider systemd community? Would those be enough for the SteamDeck to jump ship? about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/SMQPWM/

The build system should get out of the way to let us focus on our tasks, not be distracted by slow or unreliable builds, get fast feedback on changes, and let us know what’s in the software we’re shipping to our users. But, what does it take for a build system to be really fast and reliable? What does it take to know what’s in the software? It requires aggressive parallelism and distributed caching to avoid redundant work between colleagues. And it requires complete knowledge and control of dependencies, build isolation to identify mistakes, and reproducible builds to verify results across machines and strengthen supply-chain security. In this talk you will learn how [Google’s open source build system Bazel](https://bazel.build/) and the [purely functional package manager Nix](https://nixos.org/) join forces to provide fast, correct, and reproducible builds. In this talk I will explain what we mean by correct builds, and will motivate why fast and correct builds are important and why you would care about reproducible and isolated builds. We will see how many common build systems fail to provide these desirable properties. You will be introduced to [Google’s open source build system Bazel](https://bazel.build/) and will learn how it provides fast builds, how correctness and reproducibility is relevant, and how Bazel tries to ensure correctness. But, we will also see where Bazel falls short in ensuring correctness and reproducibility. You will learn about the [purely functional package manager Nix](https://nixos.org/) and how it approaches correctness and build isolation. And we will see where Bazel has an advantage over Nix when it comes to providing fast feedback during development. I will share how you can get the best of both worlds and combine Nix and Bazel and how you can get started with these tools. But, we will also touch on potential caveats and shortcomings of this approach. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/77YDZ8/

Modification of the kernel command line has historically been one of the easiest ways to customize system behavior. Bootloaders allow for persistent changes via config-files and on-the-fly changes interactively during system boot. System behavior changes made via the kernel command line are not limited to the kernel itself. Userspace applications from installers to init systems and beyond also take input from /proc/cmdline. It is clear that some kernel command line options are desirable (console=ttyS0 verbose) and possibly even necessary. Others, such as the cromulent 'init=/bin/sh', can allow circumvention of benefits that Secureboot and TPM provide. How to control access to kernel command line modification is a non-trivial subject. A recent pull request to systemd that added "command-line addons" garnered hundreds of comments. This talk will cover: * The stub loader 'stubby' and its allowed-list approach to kernel command line options. * Systemd-stub’s solution for command line customization * System changes that can be made through kernel command line. * Alternative channels such as smbios oem strings, or qemu 'fw_cfg' about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/T3QFGS/

This talk will be a whirlwind overview of NixOS modules and the lessons I've learned with maintaining and writing new ones. Nix modules are the core of how you organize configuration and service config, but there's a lot of "draw the rest of the owl" subtext as to how you actually go about writing them. This talk covers some best practices for how to write and organize your NixOS modules so that you can have fun and hopefully profit from it. about this event: https://cfp.all-systems-go.io/all-systems-go-2023/talk/DP3JXQ/