Author: simon

Closing Stuff

• Special Badge given out

• Projects from Junior Group from Club Penguin
• Rusty Wrench award to Joshua Hesketh

Lightning Talks

• 3 minutes each
• Martin Kraft
  • Digital trust and trust in the real world
  • In real world it is wired into our brains
  • Aunt’s Laptop. Has Trusted CAs, Debian.
  • Doesn’t know what lock on browser means
  • Imaging that trust is a competition that happens in real time, that takes interactions, mood, random stuff.
  • Maybe when you visit a good vs bad website the browser looks visably different
  • Machine Learning
• Brimly Collings-Stone
  • Maori language not available on AAC outputs
  • Need a device that speaks Maori and represents Maori grammar accurately
• Mathew Sherborn
  • RSI
  • Got it in the past, tried various keyboards
  • Type-Matrix but it broke
  • ErgoDox – open source keyboard
  • Mascot.com – Keyboard in batch orders
  • Like the ErgoDox-E – $500 but good – web app to program
  • Change the Dvorak keyboard with special keyboard
• Emma Springkmeier
  • What do I do when it all goes wrong
  • Potentially stressful situations – phone calls, meetings.
  • eg last year’s lightning talk
  • What I do to cope
  • Talk to friends, explain how I feel to others, listening to calming music, breathing techniques ( 4s in, 4s hold, 4 out, 4 holding, repeat )
• Karl Kitcher
  • Secretary of the NZ Open Source Society
  • Charity since 2008
  • Reducing in interest in the recent years
  • Open source is not so prevalent, people not really caring, trying to maintain the momentium
  • Open vs Fauxpem
  • nzoss.nz – signup to the mailing list
  • Various services to projects
• Leon Wright
  • About Leon’s badge
  • Twitter bot hooked to hug detector in his badge
  • 2017 badge detects hugs
  • 2018 version 2 . So good twitter shadow banned his account
  • 2019 – Docker containers and other crazy stuff
• Talia White
  • At LCA since 2018 – Was only 8. Now 12
  • Ordered a robot kit for ardiano
  • Made various projects
  • Don’t give up, struggled to start with coding, got better
• Brenda Wallace
  • Works for the NZ Govt
  • Sometimes abigious
  • Going to publish for some legislation as python rules
  • rules.nz
  • eg Social welfare rules,
  • Unit tests
• Paul Gunn Stephen
  • GDP per km of coastline
  • %coastline length for area
  • Means hard to get Tsunami warning systems
  • Cheaper
  • ETC Lali system approach
  • Every Village has a local warning system
  • Redundant system
• E Dunham
  • You should speak at conferences
  • 54th talk in 5 years
  • Promotes your company
  • Intersection: What you know, what conference needs and what the attendees needs
  • Find conference want to attend
  • Write abstract
  • Submit a lot, get rejected a lot
  • Each reject is how you dodged a bullet
• Charell
  • CVE-2019-3462
  • Bug in apt that allows injection of bad content
  • Why https
  • Attestation
  • apt-transport-https – enable
• Jen Zajac
  • Project scaffolding eg Cookiecutter, yoeman
  • Lots of generating options
  • Creates templates for a project
• Hugh Blemmings
  • Ardionu and Beagleboard
  • Cool but not high performance
  • A True open and HP computer
  • Open Hardware, Open software stack, no bin blobs, No unexpected software, No cost/perf penality
  • openpowerfoundation.org
• Benno Rice
  • Cobol
  • Over 50 years old
  • Not used much
  • What Language is the new Cobol?
  • PHP is the new COBOL
  • Perl is the new COBOL
  • Python2 ?
  • Javascript ?
  • C ?
  • Y2K – Maybe the real Cobol is the maintenance we incurred along the way
  • Maybe you should support software before it bites you back

Closing Stuff

• 652 people attended
• 2.4TB transferred over the SSID
• 3113 Coffee vouchers

Lots of sponsors and suppliers and staff thanked

Linux.conf.au 2020 is in …. Gold Coast

• Linux.conf.au 21st birthday!
• Gold Coast convention and Exhibition centre
• 13 – 17th January 2020

OpenLI: Lawful Intercept Without the Massive Price Tag
– Shane Alcock

• Police get Warrent to ISP
• ISP Obligations
  • Can’t tip off person being intercepted
  • Both current and past intercepts must be private
  • Can’t accept other people’s communications
  • Must accept all communications
• NZ Lawful Intercept
  • All Providers with more than 4000 customers must be LI capable
  • Must be streamed live
  • TCP/IP over tunnel
  • Higher level agencies have extra requirements
  • 2 seperate handovers – IRI metadata for calls, IP sessions. CC= data packets
• Open LI
  
  • $10,000s – $100,000s costs to impliment and license from vendors
  • WAND had some experise in packet collection
  • Known my NZ Network Operator community
  • Voluntary contributions from NZ Network Operators
  • $10k+ each
  • Buys 50% of my time to work on it for a year.
  • Avoiding Free Rider problem
    • Early access for supporters
    • Dev assistence with deployment
    • Priority support for bugs and features
• Building Blocks
  • Developed and tested on Debian
  • Should work on other Linux flavours
  • Written in C – fast and likes writing C
  • Use libtrace from WAND
  • Data Plane Develop Kit
• Provisioner
  • Interface for operators
  • Not very busy
• Collector
  • Comms from Provisioner
  • Intercept instructions
  • Recommended run on bare-metal
  • 1RU Server with 10G interface with DPDK support
  • Supports multiple collectors
• Mediator
  • Gets data from Collector
  • Forwards to Agency based on instructions from Provisioner
• Target Identification
  • Nothing on the packets linked to target user
  • People get dynamic IPs, can change
  • For VOIP calls need to know RDP port
  • SIP for VIP , Radius to IP to ID the user’s IPs/Ports
  • Deriving caller identities from SIP packets can be tricky. Other headers can be used, depends on various factors
• Performance Matters
  • 1Gb/s plans are available to residential customers
  • ISP may have multiple customers being intercepted. Collector must not drop packets
  • Aim to support multiple Gb/s of data
  • libtrace lets use spread load across multiple interfaces, cpus etc
  • But packets now be in multiple threads
  • Lots of threads to keep things all in sync
• Status
  • All done and deployed by at least one ISP
  • Core fucntionally in place
  • 500k PPS with DPDK
  • On https://github.com/wanduow/openli
• Future
  • Build user-driver community around the software
• Questions
  • Can it handle a hotel? – maybe
  • ISPs or police contributing? – Not yet
  • What have people been doing so far? – They have been gettign away with saying they will use this
  • What about bad guys using? – This probably doesn’t give them any more functionality
  • Larger Operators? – Gone with Vendor Solutions
  • Overseas Interest? – One from Khazakstan , but targetted at small operators
  • Why not Rust, worry about parsing data – Didn’t have time to learn Rust

But Mummy I don’t want to use CUDA – Open source GPU compute
Dave Airlie

• Use Cases
  • AI/ML – Tensorflow
  • HPC – On big supercomputers
  • Scientific – Big datasets, maybe not on big clusters
• What APIs Exist
  • CUDA
    • NVIDIA defined
    • Closed Source
    • C++ Based single source
    • Lots of support libraries ( BLAS, CiDNN ) from NVIDIA
  • API – HIP
    • AMD Defined
    • Sourcecode released on github
    • C++ based single source
  • OPenCL
    • Khronos Standard
    • Open and Closed implimentations
    • 1.2 v 2.0
    • OpenCL C/C++ Not single source (GPU and CPU code separate)
    • Online vs offline compilation (Online means final compilation at run time)
    • SPIR-V kernel
  • SYCL
    • Khronos Standard
    • C++ Single source
    • CPU Launch via OpenMP
    • GPU launch via OpenCL
    • Closed (codeplay) vs Open(triSYS)
    • Opening of implementation in Progress (from Intel – Jan 2019)
  • Others
    • C++AMP – MS
    • OPenMP – Gettign better for GPUs
    • OpenACC
    • Vulkan Compute
      • Low level submission API
      • Maybe
  • Future
    • C++ standard
    • C++ ISO standards body, ongoing input from everybody
    • Implementations must be tested
    • Still needs execution environment
• Components of GPU stack
  • Source -> Compiler
  • Output of GPU and CPU code
• IR
  • Intermediate representation
  • Between source and final binary
  • NVIDIA PTX – liek assemble
• OpenCL Stacks
  • Vendor Specific
  • LLVM Forks
• Open Source
  • Development vs Release Model
  • Vendors don’t want to support ports to competitors hardware
  • Distro challenges
    • No idea on future directions
    • Large bodies of code
    • Very little common code
    • Forked llvm/clang everywhere in code
• Proposed Stack
  • Needs reference implementation
  • vendor neutral, runs on multiple vendors
  • Shared Code based (eg one copy of clang, llvm)
  • Standards based
  • Common API for runtime
  • Common IR as much as possible
  • Common Tooling – eg single debugger
  • SPIR-V in executable -> NIR -> HW Finaliser
  • Maybe Intel’s implementation will do this
• Questions
  
  • Vulkan on top of Metal/Molten ? – Don’t know
  • Lots of other questions I didn’t understand enough to write

Preventing the IoT Dystopia with Copyleft- Bradley M. Kuhn

• The S in IoT stands for Security
• Many stories of people hacking into baby monitors and home cameras
• IoT Devices often phone home to manufactorers website in order that you can access then remotely. “I suppose there are Chinese hackers watching my Dogs all day, I hope they will call me if they need water etc”
• Open source people have historically worked to get around problems like this.
• 1992 – If you wanted Linux, you downloaded the software onto floppies and installed it yourself. And Often had to work hard to make it work.
• Today only a small percentage of laptops sold have Linux on it.
• But Linux is commonly installed on IoT devices – 90% odd
• But
  • No [easy] way to reinstall it yourself
  • Much worse than laptops
  • GPL includes “The scripts used to control the compilation and install of the executable”
  • “Freedom to Study” is not enough
• Linksys Wifi router
  • OpenWRT Project
  • Release forced from Linksys and Cisco
  • “Source as received from Linksys from GPL enforcement”
  • Is OpenWRT a Unicorn
    • Few projects with serious alternative firmware project
  • Still sold new after 20 years
• BusyBox Lawsuits
  • Before IoT was even a term
  • At least one model of Samsung TV -> samygo.tv
  • “Baffles me as to why do the manufactorers want us to buy more hardware”
• Linux focuses to much on big corp users and ignores hobbyist users
  • Kernel peopel only care about the .c files. Don’t care about the install scripts etc.
  • People at top of Linux now got their start hacking on the devices in front of them.
  • The next generation of developers will be those hackers not from IBM and other big companies
  • You didn’t need anything but a computer and an internet connection to become and upstream developer in those days. This is becoming less true.
  • If the only thing you can install Linux on is a rackmount server, a cloud server or maybe a laptop and none of the IoT devices around you then things don’t look good….
• Linux was successful because users could install it on their own devices
• Linux won’t remain the most important GPL program if users can’t install their modifications. Tinkering is what makes Free software great.
• Upstream matters of course, but downstream matters more.
  • There may be 1000s of Linux developers
  • Put 2 billion people have Linux on their phone – Which is locked down and they can’t reinstall
• We don’t need a revolution to liberate IoT devices
  • because the words are already there in the GPL
  • We just have to take up our rights
• What you can do.
  • Request Linux sources on every device you own – Companies have figured out people almost never ask
  • Try to build and install them. If you can’t ask a friend or ask Conservancy for help
  • If it doesn’t build/install it is a GPL violation, report it Conservancy
  • Step up as a leader of a project devices that matter to you.
• Why this will work
  • The problem seems insurmountable now, only because we have been led astray
  • First and absolutely necessary step towards privacy and scurity on those devices
  • When the user controls the OS again, the balance of power can be restored
• Questions
  • Best way to ask for source code? Try email, the manual should say.
  • How to get the new code on the device? Needs some push onto industry
  • What if writing requires expensive equipment? Fairly rare, many devices allow over-the-air upgrades, we should be able to go the same way.
  • Is there a list of compliant devices? – Proposed in past. Want to go softly at first in many cases
  • Am I exposed to liability if I modify and distribute code I receive? – Almost certainly note, contact Conservatory if you are threatened.

Web Security 2019 – James Bromberger

• History of browser
  • No images
  • Images
  • Netscape with crappy ‘International Security”
  • https takeup is growing
  • Chrome is hitting 60-70%
  • 82% of browser are “modern”, crossover of chrome users to new version is about 3 months.
• PCI
  • Remove early TLS in mid 2018
  • TLS 1.1 and higher allowed
• The legacy browser has gone in the real world
  • Some envs still behind, but moving ahead
• What can we do with as little changes as possible?
• 0. Don’t use http, use https
  • Use letsencrypt
  • Stds reducing max length of certs from 5 years
• 1. TLS protocols
  • 7 versions out there (old ones SSL).
  • Most over 10+ years old
  • Only 6 in the wild
  • 3 not-known to be comprimised ( 1.1 1.2 1.3 )
  • Very few clients only support 1.1 and not 1.2 (small gap in 2006-2008 ). IE supports 1.2. So maybe disable 1.1
  • Log the protocol being used so you have data on your users
  • OTOH not much supports 1.3 yet
  • Use 1.2 and 1.3
  • Turn off on the Browsers to
  • Looks at which libraries you are using in code that makes https connections
• 2. Cypher Suite Optimisation
  • New EC certs for key exchange
  • New certs getting changed to ECDSA
  • AES is standard for bulk encryption. GCM mode is best although windows 9 can’t do (Upgrade to 10!)
  • MAC/Cehecksum – remove MD5, SHA1, remove SHA2-256+ , New ones coming
• Security Header
  • Content-Security-Policy
  • Referer-Policy – Usually locked down
  • Feature-Policy – lots of stuff
  • ” X-Content-Type-Options: no-sniff ” – don’t guess content type

• 4. CAA
  • Around 200 Cert Authorities
  • Authorized record type (CAA record) lists what CAs are allowed to issue certs for you.
  • DNS Sec is useful – But during US Govt shutdown DNS keys are expring
• 5. Sub Resource Integrity
  • Scripts included by html
  • Can include checksums in html calling to varify
• 6. Cookies
  • Secure – httpsonly
  • “SameSite=Strict” – Reduces cross site request forgery
• 7. Http2
  • Binary wire protocol
  • Apache 2.4 on debian
  • Forces better protocols
• 8. Lots more
  • New compression algorithms
  • Network error logs

• Bitcoin Billionare
• 1992
  • The days of SunOS
  • Read the GNU Manafesto
• 1995
  • Using GPP compiler at work
  • First patch accepted on November 1995
• 1997
  • USENIX Conference in california
  • UseLinux – Had a track for Linux
  • Hung around a bunch of top guys in Linux talked about added SMP to Linux
  • Talk on porting Linux to Sparc by David Miller & Miguel de Icaza. Going into improvements and showing how Linux port to sparc bet Solaris in the Lmbench benchmarks on same hardware.
  • Relaized lived in a world where students could create and port OS that bet the original OS from the vendor
• 1997 – 1998
  • Wrote (with another guy) and got ipchains added to Linux
  • “I woke up one morning and I was kernel firewall maintainer”
  • Got job people paid to work on Linux firewall code
• 1998
  • Decided needed an Australian Linux conference
  • Oct-Nov visited a bunch of LUGS to invite people and find person to collect money.
  • People not sure what they wanted to go to a Linux conference ( $380 bucks)
  • Invited John Maddog Hall
  • Created and ran a slashdot ad
  • Created card got into $14k negative
  • Last session of the 3rd day, reran the 3 best talks
• Three stories from 1998
  • Tutorial Books for each of the tutorials- Couldn’t get photocopies from commercial facility, so had to make 400 copies of books via 4 coin operated photocopiers
  • Tridge bought up a triple-CD burner. People ran it in relays
  • Somebody said. “I can’t believe you don’t have conference tshirts”. He bought white tshirts, got them screen printed and sold them.
• End of conference Tridge organised a gift from the Speakers to Rusty. Pewter Beer mug
• Linux.conf.au after 1999
  • 2001 scheduled 3 talks from Rusty. At the same time
  • Met Tridge at LCA – Moved to Canberra they did AusLabs
• How Great Projects
  • Smart and Capable enough to complete them
  • They are Dumb enough to try
  • When somebody tells you about a project?
    • That sounds Great, Tell me more
    • What can I do to help
  • Enable people’s enthusiasms
  • Collaboration is a super Power
  • Get along with people is a skill
  • “Constructive absenteeism”
• Headwinds to collaboration
  • Signs are welcoming to some people
  • Other people get signs that they are not so welcoming
  • Good are seeing them when they are aimed at them, not so good are even seeing they exist when they are not aimed at them.