Chaos Computer Club - archive feed

We'll be covering happenings, learnings and new challenges running and supporting systemd in production on the Facebook fleet throughout the past year. This talk is a followup to systemd @ Facebook — a year later that was presented last year. We'll cover the latest developments, how we're leveraging new systemd features, how we continue rolling systemd on the fleet, and finally discuss a number of...

It is now possible to run Android ontop of an entirely Open Source Linux Graphics stack, this talk will dig into how you can do it too! Finally, it is possible to run Android on top of mainline Graphics! The recent addition of DRM Atomic Modesetting and Explicit Synchronization to the kernel paved the way, albeit some changes to the Android userspace were necessary. The Android graphics stack is b...

Early boot provisioning systems aim to enable automated, declarative, immutable patterns for Linux systems. In this talk, I'll discuss the CoreOS Ignition system and illustrate how it works and addresses real-world use cases on bare-metal, cloud providers, and hypervisors. I'll share experiences using and integrating early provisioning and highlight new challenges for contributors to explore. With...

Container security often focuses on runtime best-practices whilst neglecting delivery of the software in the supply chain. Application, library, and OS vulnerabilities are a likely route to data exfiltration, and emerging technologies in the container ecosystem offer a new opportunity to mitigate this risk. Treating containers as immutable artefacts and injecting configuration allows us to "upgrad...

Welche politischen Anforderungen könnten wir an neue Netzwerkdienste stellen? In diesem Vortrag sollen die politischen Anforderungskataloge für das GNU Name System und GNU Taler kurz vorgestellt werden. Danach zeigen wir, wie diese Anforderungen technisch umgesetzt wurden. about this event: https://2018.fiffkon.de/program/events/2.html

I’d like to show you how to find bugs in Linux systems using machine learning, when paired with the totally seemingly useless and annoying false positives that come out of your integration tests. I’d like to show you how to find bugs in Linux systems using machine learning, when paired with the totally seemingly useless and annoying false positives that come out of your integration tests. We’ve al...

How Facebook uses Chef to manage many different largescale heterogenous environments. Facebook uses chef to deploy and manage a wide array of environments across our fleet, ranging from network switches to mobile phones to LXC containers to off-network devices. This talk will explore our toolchain for building, testing, and running Chef code in this diverse ecosystem of environments and includes s...

This talk presents TAPS (Transport Services), a proposed abstraction for a new Networking API, and calls for the Linux community to get involved. Even decades after its introduction, the Socket API is still the de-facto standard Networking API on many systems. Its simplifying abstraction of a network connection as a file helped making networking easier to integrate into applications in the early d...

A more generic approach to ensure you have what you'd expect to have A side effect of the many new ways to package filesystems (here's looking at you, containers!), is that filesystems are being copied around without many of the features that traditional packaging provided (i.e. `rpm -qV ...`). Much progress has been made for reproducible digests of containers. In this talk Vincent Batts will revi...

Whether you are interested in multimedia programming in specific or curious about how Rust programming language can enable you to write almost-bug-free code without having to compromise on efficiency, this talk is for you. GStreamer is a popular framework of choice for multimedia programming in the Linux world, especially for embedded. Since efficiency is a typical core requirement for embedded so...

Sick of insecure PXE booting over TFTP? Come learn about our efforts to write modern boot loaders in Linux's user space. LinuxBoot is a project to put Linux kernels into firmware. LinuxBoot means we have the full toolset of modern languages like Go at our fingertips: let's use them! We can now easily develop boot loaders with trivial support for HTTPS-, gRPC- or TPM-based network booting. about th...

Recently, work that we have been doing on Endless OS to allow peer to peer OS and flatpak updates has been reaching maturity and nearing wider deployment. This talk will give an overview of how we support LAN and USB updates of OSTrees, how it fits in upstream in OSTree and flatpak, and what you’d need to do to enable peer to peer updates for your OSTree system. about this event: https://cfp.all-s...

Vom Foto-Verbot zum Ende strukturierter Visitenkartensammlungen. Vom großen Blogsterben zu Zahnärzten und ihren Datenschutz-Tonbandansagen. Von überforderten Aufsichtsbehörden zu jubelnden Silicon Valley Riesen: Die DSGVO hat all den bekannten Kontroversen des Datenschutzrechts neuen Diskussionsstoff gegeben. Die Twitter-Szene hat die großen, kleinen (und vermeintlichen) Aufreger dankend aufgegrif...

Traceleft is a framework built upon eBPF which allows generation of system events such as file operations and network calls via a configuration driven system. It can act as a foundation for building auditing and incident analysis or monitoring tools that work at the system level and need targeted and filtered information. While traditionally, eBPF based analysis requires writing scripts in a limit...

Cockpit makes Linux discoverable. But it's really a Linux session in a web browser, accessing the native system APIs and tools directly from javascript. Does that sound scary? How can we be sure that accessing Linux from a web browser is secure? What about the web server stack? What about authentication and privilege escalation? We'll talk about how Cockpit deals with security, authentication, pri...

To bring cool ideas to life, the Linux kernel and user space need to work together. The core kernel is a stable ABI base, a common denominator for everything that builds on top. In contrast, BPF is a specific know-how, a secret sauce of the cool idea. The Linux kernel needs BPF to stay relevant, and BPF has to become friendlier to programmers. This talk explores the steps taken towards this long-t...

nettools is a yet-to-be-released project providing low-level libraries for network configuration. Within the scope of the project falls protocols like DHCP, NDP, IPv4 Address Conflict Detection, and IPv4LL. The first library scheduled to be released is IPv4ACD, a pre-release version of which is already used by NetworkManager. This talk gives an overview of the design principles of the project, the...

What exactly is Red Hat up with CoreOS .....and what were they thinking when they announced a Fedora CoreOS? In this talk, we'll briefly look at some of the excellent work pioneered by the Container Linux team around the self-driving, container focused operating system. We'll also overlay how the container ecosystem has changed over the past 5 years and what we're doing at the OS-level to refocus...

Uyuni, an opinionated fork of the Spacewalk project, provides open source lifecycle management for today's datacenter. With the help of Salt for configuration management it keeps your workloads up to date and secure. Uyuni manages all your Linux workloads. It bootstraps physical servers, creates VMs for virtualization and cloud, builds container images, and tracks what runs on your Kubernetes clus...

Titus is a multitenant scheduler that runs a variety of workloads that vary from online workloads which serve customer traffic to big data workloads which perform machine learning. Getting all of these workloads to cooperate on a shared pool of resources together. Just to add a bit of complexity to the mix, these workloads all run on the cloud, and a shared storage and network fabric. Come to this...

At some stage in your programming life you may well have used a debugger, but did you wonder how it was able to step into and control your executable? In this talk we'll see how debuggers work by building one from scratch in a few lines of Go. In this talk Liz will explore how a debugger gains control of a process with the all-powerful ptrace system call. You'll see how we can find the machine cod...

Portable Services bring certain aspects of containers to classic system service management. Let's discuss them in technical detail! Portable Services bring certain aspects of containers to classic system service management. With systemd v239 Portable Services are for the first time complete and ready for users to take advantage of. In this talk we'll have a look on the underlying technical concept...

In a distributed world, monitoring system calls with kauditd can present challenges. In this talk we will address some of those challenges and give a use case of how we build an event pipeline for monitoring file system events. With the rise of containers and generic container based operating systems we find ourselves with a large quantity of nodes that do general compute tasks. These nodes produc...

Logging could be considered simple when dealing with a few applications, but in environments with distributed systems where log data comes from multiple sources and likely in different formats it becomes complex and data analysis harder. In this session I will dig into the challenges of logging for distributed systems and the experience of building a tool called Fluent Bit to solve the problems as...

In Instagram, we have been experimenting with casync as an alternative package format for deployment of the site. This talks describe our findings Last year when Lennart presented in ASG about casync, we were excited to check it out. So we checked what was necessary to deploy parts of our sites with it. and we spend some times experimenting... This talk show our results, so far... about this event...