November 2016 - FOSDEM - lists.fosdem.org

ham-radio
by Kristoff 01 Feb '17

01 Feb '17

Hi, For any fellow hams who happenn to have taken their handheld radio with them, I am visiting FOSDEM today and will be QRV and calling "CQ FOSDEM" at 433.500 Mhz (calling frequency 70 cm) FM inbetween talks. Cheerio! kr. Bonne (ON1ARF)

8 12

FOSDEM 2017: SDR Track CfP
by Martin Braun 11 Dec '16

11 Dec '16

Dear friends and fans of software defined radio, next year's FOSDEM (the free and open source developer's meeting in Brussels, Europe) will, once again, feature a track on Software Defined Radio. Therefore, we invite developers and users from the free software radio community to join us for this track and present your talks or demos. Software Radio has become an important tool to allow anyone access the EM spectrum. Using free software radio libraries and applications and cheap hardware, anyone can now start hacking on wireless communications, remote sensing, radar or other applications. At FOSDEM, we hope to network all these projects and improve collaboration, bring new ideas forward and get more people involved. The track's web site resides at: http://gnuradio.org/redmine/projects/gnuradio/wiki/FOSDEM Here, we will publish updates and announcements. The final schedule will be available through Pentabarf and the official FOSDEM website. ** Submit your presentations To suggest a talk, go to https://penta.fosdem.org/submission/FOSDEM16 and follow the instructions (you need an account, but can use your account from last year if you have one). You need to create an 'Event'; make sure it's in the Software Defined Radio track! Lengths aren't fixed, but give a realistic estimate and please don't exceed 30 minutes unless you have something special planned (in that case, contact one of us). Also, don't forget to include time for Q&A. You aren't limited to slide presentations, of course. Be creative. However, FOSDEM is an open source conference, therefore we ask you to stay clear of marketing presentations. Of course, we like nitty-gritty technical stuff. Here's a list of topics that will most likely be included: - SDR Frameworks + Tools - Wireless security - Radio hardware - Telecommunications - Random fun wireless hacks We will reserve time for interactiveness, it won't all be talks. ** Important Dates FOSDEM is February 4th and 5th, 2017. * December 9th 2016: Submission Deadline * January 2nd 2017: Announcement of final schedule * February 4th 2017: SDR Track (Saturday) These dates are not set in stone. However, the least years we were always full to the brim with presentations, so if you want to present, please make sure to submit your abstracts soon! ** Steering Committee The track committee consists of: * Phil "catvideos" Balister (OpenEmbedded / OpenSDR) * Martin "mbr0wn" Braun (GNU Radio) * Sylvain "tnt" Munaut (OsmoCom) Hope to hear from you soon! And please forward this announcement. Martin

1 2

CfP - FOSDEM Geospatial devroom @FOSDEM 2017
by Johan Van de Wauw 08 Dec '16

08 Dec '16

Please forward! FOSDEM is a free and non-commercial event bringing together about 5000 developers in Brussels, Belgium. The goal is to provide open source software developers and communities a place to meet and share thoughts. The participation is free of charge, although donations are welcome. The next edition will take place on 4 - 5 February 2017. For the third (!) time there will be a Geospatial devroom and will be happening on Sunday 5/2/2017! Geospatial technologies and mapping used to be specialist work, but nowadays location and maps are becoming part of many projects/applications, which usually use only a small subset of the possibilities the data and software offer. The geospatial devroom is the place to talk about open, geo-related data and software and their ecosystem. This includes standards and tools, e.g. for spatial databases, and online mapping, geospatial services, used for collecting, storing, delivering, analysing, and visualizing purposes. We welcome submissions about: * Web and desktop GIS applications; * Collaborative editing / versioning of geodata and metadata; * Interoperable geospatial web services and specifications; * Collection of data using sensors / UAVs / satellites; * Geo-analytic algorithms / libraries; * Geospatial extensions for classical databases (indexes, operations) and dedicated databases; * Big geodata, scalable GIS applications; * Volunteered Geographic information - Crowdsourced geodata. HOW TO SUBMIT YOUR PROPOSAL FOR A TALK Are you thrilled to present your work to other open source developers? Would you like to run a discussion? Any other ideas? Please submit your proposal at: https://fosdem.org/submit Make sure to select the 'Geospatial devroom' as 'Track'. If you have an account from previous years, you should be using the same. Please specify in the notes if you prefer for your presentation either a short timeslot (lightning talks ~10 minutes) or a long timeslot (20 minutes presentation + discussion). However, note that time slots are indicative and will be assigned according to the timing of the session. The DEADLINE for submissions is Thursday **1st December 2016**. Notification of acceptance will be sent to the Authors by 11/12/2016 at the latest. Should you have any questions, please do not hesitate to get in touch with the organisers of the devroom at fosdem-geospatial at gisky.be! Want to know what FOSDEM geospatial is like? Check out the videos and the presentations of our previous two editions: [1,2] The organizers Johan Van de Wauw Margherita Di Leo Anne Ghisla Martin Hammitzsch [1] https://archive.fosdem.org/2015/schedule/track/geospatial/ [2] https://archive.fosdem.org/2016/schedule/track/geospatial/

1 1

beer night gets UNESCO cultural heritage status?
by Daniel Pocock 30 Nov '16

30 Nov '16

UNESCO just discovered[1] what FOSDEMers already knew for years. Will ULB join the beer pipeline[2] any time soon? Regards, Daniel 1. https://www.theguardian.com/world/2016/nov/30/cheers-belgian-beer-added-une… 2. https://www.theguardian.com/world/2016/jul/08/bruges-pipe-dream-a-reality-b…

2 1

FOSDEM 2017 - Open Source Design submission deadline extended
by belen barros pena 30 Nov '16

30 Nov '16

Hi all, We have extended the submission deadline for the Open Source Design devroom until December 5th. Full call for proposals at http://opensourcedesign.net/events/2017/02/05/opensourcedesign-fosdem-2017 Cheers, Belén (on behalf of the Open Source Design people)

1 0

PGP keysigning: please submit your keys
by Johan van Selst 25 Nov '16

25 Nov '16

Our trusted keysigning infrastructure is ready for FOSDEM 2017. Same procedure as in previous years: if you intend to participate in the keysigning event, please submit the keys you'd like to have signed to ksp.fosdem.org. If you're using GnuPG, that can be easily accomplished with: % gpg --keyserver ksp.fosdem.org --send-key <your-keyid> Please check that your key was correctly submitted by pointing a browser at https://ksp.fosdem.org/keys/. If your key is missing after you submitted it, send me an email and I'll try to find out what's up. See https://fosdem.org/2017/keysigning/ for more information about the FOSDEM keysigning event. It will take place on Sunday at 14:00, in the corridor on the second level of the U building. Key submissions close a week before FOSDEM (27 January), to give us some time to generate and distribute the list of participants. Remember sure you bring a printed copy of this list to FOSDEM. Get submitting.

1 0

[CFP] FOSDEM 2017 - Distributions Devroom
by Brian Stinson 22 Nov '16

22 Nov '16

FOSDEM 2017 - Distributions Devroom Call for Participation The Distributions devroom will take place 4 February, 2017 at FOSDEM, in room K.4.601 at Université Libre de Bruxelles, in Brussels, Belgium. Distributions are more than just hosted collections of software from various upstreams. Each distribution is responsible for problem-solving in building, testing, and releasing software as well as managing the lifecycle of each application in the collection. Additionally, distributions do very important work in ensuring that various versions of upstream software work well together and can co-exist. Distribution are also, often responsible, for "de-vendoring" upstream software so that security fixes can be applied more quickly. We welcome submissions targeted at contributors interested in issues unique to distributions, especially in the following topics: - Managing Build/Test/Release processes around shared ideas and resources - Lifecycle management, especially in the areas of sandboxing, containerization, vendoring, and bundling - Distribution construction tools and infrastructure development and implementation (building, signing, testing, distribution, etc.) - Cross-distribution collaboration on common issues, eg: content distribution, infrastructure, and documentation - Working with vendors and including them in the community - Building trust and code relationships with the upstream components of a distribution and between distributions - The future of distributions, emerging trends and evolving user demands from the idea of a platform - The place of distributions in today's world (including concepts of containerization, IoT, etc.) - Onboarding new users and mentorship, facilitating technical growth within the contributor base - Solving traditional problems like package management, and content management (eg. rpm/dpkg/ostree/coreos ) - Integration technologies like installers, deployment facilitation ( eg. cloud contextualisation ) - Principals of Rolling Releases, Long Term Supported Releases (LTS), Feature gated releases, and calendar releases Ideal submissions are actionable and opinionated. Submissions may be in the form of 25 or 50 minute talks, panel sessions, round-table discussions, or Birds of a Feather (BoF) sessions. Dates ------ Submission Deadline: 25-Nov-2016 Acceptance Notification: 5-Dec-2016 Final Schedule Posted: 11-Dec-2016 How to submit -------------- Visit https://penta.fosdem.org/submission/FOSDEM17 1.) If you do not have an account, create one here 2.) Click 'Create Event' 3.) Enter your presentation details 4.) Be sure to select the Distributions Devroom track! 5.) Submit What to include --------------- - The title of your submission - A 1-paragraph Abstract - A longer description including the benefit of your talk to your target audience, including a definition of your target audience. - Approximate length / type of submission (talk, BoF, ...) - Links to related websites/blogs/talk material (if any) Administrative Notes ---------------- We will be live-streaming and recording the Distributions Devroom. Presenting at FOSDEM implies permission to record your session and distribute the recording afterwards. All videos will be made available under the standard FOSDEM content license (CC-BY). If you have any questions, feel free to contact the devroom organizers: distributions-devroom(a)lists.fosdem.org (https://lists.fosdem.org/listinfo/distributions-devroom) Cheers! Brian Exelbierd (twitter: @bexelbie) and Brian Stinson (twitter: @bstinsonmhk) for and on behalf of The Distributions Devroom Program Committee

1 1

CfP for Monitoring and Cloud Devroom
by Richard Hartmann 20 Nov '16

20 Nov '16

Dear all, as this has not been on this list yet, there's a CfP for our Monitoring and Cloud Devroom; you can find it at: https://goo.gl/forms/bbfCH14ido5kMD4H3 Submissions through penta will obvioulsy be accepted as well. Richard

1 0

Re: [FOSDEM] CfP for FOSDEM 2017 security devroom
by Siarhei Siniak 18 Nov '16

18 Nov '16

Hello, Nikos! In few words: I demonstrate half-finished exploit of outdated MITM vulnerability in PEAPv0,v1: https://github.com/nartes/hostap-mitm-mschapv2-peapv1 - intermediate code; http://eprint.iacr.org/2002/163/ - vulnerability description. It is based on hostap code. To tell the whole story: There is MITM vulnerability in PEAPv0,v1 if cryptobinding is disabled. 1) The earliest mentioning belongs to the paper "Man-in-the-Middle in Tunneled Authentication Protocols", November 11, 2002, http://eprint.iacr.org/2002/163/ 2) The following draft describes mentioned protocol "draft-josefsson-pppext-eap-tls-eap-05.txt", September 2002, https://tools.ietf.org/pdf/draft-josefsson-pppext-eap-tls-eap-05.txt 3) The following draft desribes the latest version, i.e. PEAPv2 "draft-josefsson-pppext-eap-tls-eap-10.txt", 15 October 2004, https://tools.ietf.org/pdf/draft-josefsson-pppext-eap-tls-eap-10.txt 4) The key differences in respect to the vulnerability is the following: [2] (*10.txt, page10) As a result, where the NAS acts as a "passthrough" it does not have knowledge of the TLS master secret derived between the peer and the EAP server. In order to provide keying material for link-layer ciphersuites, the NAS obtains the master session key, which is derived from a one-way function of the TLS master secret as well as keying material provided by EAP methods protected within a TLS channel. This enables the NAS and EAP peer to subsequently derive transient session keys suitable for encrypting, authenticating and integrity protecting session data. However, the NAS cannot decrypt the PEAPv2 conversation or spoof session resumption, since this requires knowledge of the TLS master secret. [3] (*05.txt, page3) As a result, the NAS does not have knowledge of the TLS master secret derived between the EAP Peer and the backend authentication server, and cannot decrypt the PEAP conversation. In order to providing keying material for link-layer ciphersuites however, the NAS does obtain the master session keys, which are derived from the TLS master secret via a one-way function. In the [2], they added as well as keying material provided by EAP methods protected within a TLS channel. 5) The key idea is the absence of cryptobinding in [2] draft. And if the client doesn't verify cert of the server, then MITM behaviour allows to crack TLS, and proxy any internal Eap Authentication Protocol between the victim and the real server. It works only for those protocols who are unaware of being tunneled within TLS by PEAP. MSCHAPv2 is an example of such a one. 6) The following Presentation from Shmoocon2008 describes cracking of the TLS, then gathering password hashes, and their consequent bruteforcing with the help of asleap utility. http://www.willhackforsushi.com/presentations/PEAP_Shmoocon2008_Wright_Anto… But that's not the exact MITM with Proxying MSCHAPv2. It's just MITM and cracking collected passwords. 7.0) hostap implementation of PEAP protocol corresponds to [3] in many things. Particularly, if the cryptobinding is enabled, then the exploit doesn't work. The absence of server's cert verification doesn't help here. But still allows to obtain [1] behaviour. And to utilize the exploit we need the following casese: * Server: PEAPv1, Client: PEAPv1, Cryptobinding (on both sides): Any * Server: PEAPv0, Client: PEAPv1, or Server: PEAPv1, Client: PEAPv0, CryptobindingServer: NO_CRYPTOBINDING, CryptobindingClient: OPTIONAL or NO_CRYPTOBINDING The default config in hostap is: Server: PEAPv0, Client: PEAPv0 (but setting it to PEAPv1 will result in downgrading to the same PEAPv0, unless the client asks to force PEAPv1 with peapver=1) CryptobindingServer: OPTIONAL CryptobindingServer: CRYPTOBINDING The most interesting is that the server intiates cryptobinding. And having the client OPTIONAL value, doesn't raise any exception if the server has NO_CRYPTOBDING. 7.3) hostap project has the following option -DCONFIG_TESTING_OPTIONS which easily prints any incoming hashes as asleap command. That utility was used in Shmoocon2008 presentation [6]. I verified the option for MSCHAPv2 at least. 8) I decided to implement the exploit according to [1]. Here is the intermediate result: https://github.com/nartes/hostap-mitm-mschapv2-peapv1 I've implemented some kind of MITM protocol which is communicated between MITM Eap Peer and Eap Server. It carries all required information for proxying MSCHAPv2 packets between victim's Eap Peer and real Eap Server. To see what happens, run the follwing: $ git clone https://github.com/nartes/hostap-mitm-mschapv2-peapv1 $ cd hostap-mitm-mschapv2-peapv1/eap_example $ make eap_example $ ./eap_example | less Look for the 'MITM:' messages, they display actions of the attacker. To see default behaviour of eap_example: $ git checkout master $ make $ ./eap_example | less 9) I tried in [8] to do such patches, that are easily portable to hostapd and wpa_supplicant from eap_example. And keeping in mind that Linux and Android in particular are all using this software. There are many examples of real life server even now. And there are still those people who doesn't care for cert verification. Thus they are still under the risk. 10) I hope that commits' messages are informative. best regards, Siarhei Siniak

1 0

Submission deadline extended for SDN & NFV DevRoom: Nov 28th
by Dave Neary 17 Nov '16

17 Nov '16

Hi all, We are extending the deadline for the SDN and NFV DevRoom to get some more diversity in the submissions until November 28th 2016. The call for content is here: https://blogs.gnome.org/bolsh/2016/10/19/fosdem-sdn-nfv-devroom-call-for-co… And you can make a submission here: https://penta.fosdem.org/submission/FOSDEM17 Thank you! Dave. -- Dave Neary - NFV/SDN Community Strategy Open Source and Standards, Red Hat - http://community.redhat.com Ph: +1-978-399-2182 / Cell: +1-978-799-3338

1 0