First things first: Happy Birthday FOSDEM!

I was surprised when Nicolas asked me, if I want to join the Free and Open Source Developers European Meeting together with some other colleagues. Back then I was the new kid in the block, working almost a month here and already got an invitation for a conference. I quickly checked my calendar and in the same minute I agreed to visit FOSDEM for my first time.

After a few hours of a smooth train ride, we arrived in Brussels, Belgium. The country known for its wafers, chips, (chocolate), tasty beer and of course FOSDEM. So these are the ingredients for this weekend. Two days packed with over 800 talks taking place at Université Libre de Bruxelles.

Day 1

After some good croissants, a warm tea and the opening talk, I start my journey through the talks I bookmarked in the FOSDEM app, which is really helpful to keep an overview of the schedule.

The Ethics Behind Your IoT

IoT devices can be very handy, useful and mostly try to make our everyday life easier. But at what cost? Most of these devices need an internet connection to work. You can’t set it up to only run in your local controlled network. For example smart surveillance cameras. They store the recordings in the cloud. Somewhere in the no-one-read-it-ever license agreement you agreed, that the manufacturer can access these recordings in the cloud and that they may be shared with government agencies.

Imagine now that your neighbourhood uses those cameras. As a teenager, you can’t just sneak away late at night or sneak back in, without no one noticing. So the next generation of teenagers, may don’t ever make that experience like the other generations did. If they know, there is someone watching, they stop doing it, because of fear of the consequences. This leads us to the known Chilling Effect.

So the question is: How does these kind of IoT devices change our life and what happens to society if more and more people use them? If you’re interested in this topic, I can recommend to check out the recorded talk of Moly de Blanc.

Secure logging with syslog-ng

How does Airbus ensure the integrity and confidentiality of their system logs in an airplane, so they can be used as a trustworthy evidence? Stephan Marwedel speaks about their creation of a plugin for syslog-ng and how they solved this problem.

The problem:

• If the file was tampered, you can’t trust its content anymore.

The goal:

• Detect changes of the file without throwing the whole file away, because it was tampered

The solution:

• Encrypt every single log line in the file with a forward secrecy system.

In my view this is a very interesting topic, because how often do you check the logs after something happen? What if an attacker just removed his traces in the logfiles, you usually check? Especially when it comes to security monitoring log files are an essential part of it. Do still trust you logs? Details about this you can find in the talk recording, the slides or in the paper.

Mandos

Ever wondered how you can boot a server with full disk encryption (FDE) without typing a password and NOT storing the password on the server itself? Then maybe Mandos is something for you. This was a short 15 minutes lightning talk of Teddy Hogeborn, one of the maintainers.

While I was in the talk, I started to remember that I already read about Mandos. I was looking for this kind of solutions to use FDE on Linux clients without the users need to know nor to type a password at boot. Another tool which I found at that time, was Clevis and Tang. They both offer Network Bound Disk Encryption, this means your machine needs to be in the correct network to boot (at least). If it’s physically stolen, the attacker only sees garbage on the disk. Never forget the attack vector you wan to defend with these kind of solutions.

Some (hidden) sudo features

I sat in the same room as my colleague for this talk, so you point to his post or you go directly to the talk of Peter Czanik

The stands and sticker hunters

Somewhen between the talks I wandered through the building K, where the stands have been placed on two floors. All the bigger and smaller projects were present. The people at the stands are easy going and open to talk with you about their project. Some of them had flyers, mini events/challenges, t-shirts and hoodies you could buy and almost everyone had stickers. Stickers everywhere! And where you can get stickers, the sticker hunters are not far. It was funny to see that many hackers like to collect stickers of their favourite projects. So do I.

Kiwi TCMS

At one stand I got in touch with the Kiwi TCMS project. It’s all about management of test cases. Testing can be hard, especially in bigger environments. This tool can help you and your organization to manage testing of your software, system, integration or whatever you want or need to test.

Day 2

The second day offered again a huge number of different talks you can choose from. I directly started in the community track, which even offered free cookies and cakes, a perfect way to start in the morning.

Applying Open Culture Practices across Distributed Teams

My first talk for the day, was about applying open culture practices across distributed teams. How do you work with people you never met face to face before? What needs to be done to keep staying in the loop without the chitchat in front of the coffee machine at the office? This is what Katrina Novakovic from Red Hat let us know.

A distributed team can already be the case if they work in different buildings, countries or even completely remote. Common challenges are very different and can be:

• (Mis)Communication transparency and visibility
• Changing priorities and productivity
• Culture and language
• Isolation, Balance and Burnout

We’ve got 40 different timezones! So don’t mind to regularly change the time for meetings, so every participant can join the meeting at their favourite time. If someone can’t join, because they may sleep at that time, how about recording the meeting? You can even include that person, if you say “Hi” to them and give them the chance for feedback after watching the recording. This also strengthens the inclusion of that colleague.

My main takeaways of this talk were:

• Document everything! And keep it up2date!
• Define how you use communication tools, doesn’t matter what tools for Sync/Async communication
• Get to know the people. Not only work related but also what they do off-work.
• Face2Face is very important. Ask in advance for video chats and if everyone feels comfortable with it. Can also be only a part of the meeting.
• Try to create a blame free fail fast culture/environment, where you can try new methods without fear to find what best worked out in the team.
• “People are looking for solutions without asking, why do I have the problem in the first place?” Peter Crone

The slides and recordings of her talk you find here.

The Ethics of Open Source

Don Goodman-Wilson is talking about the critical part of Open Source and its ethics. In the first place the focus have been on code. Everyone has the freedom to use the code, change it and do whatever they like to do with it. This is also true for evil people. This view doesn’t take morality and ethics into place. What do you think, if you created a great piece of code and companies weaponize your code to harm other people with it, because it’s their business case? For example face recognition to discriminate a minority?

What do we tolerate in sense of “openness”? To learn more about this talk, check out the recording and his link collection about this topic.

Few days after FOSDEM I came across the Hippocratic License which defines that aspects of a ethical use of code. Another source you can find at The Ethical Source Movement.

Reinventning Home Directories

I tried to enter the rather small room a session before, but it was already full and after the talk, no one left the room and behind me was a roughly 10, 15 meter queue of hackers who wanted to see Lennart Poettering live as well. So I moved on and watched the live stream instead.

Do you remember the last change how home directories are used?

Not? Yes, that’s the problem for today’s usage. With systemd-homed their is a new project focusing on requirements how a home directory would be of better use than today. For example: You can use your known homedir, including authentication and encryption, on a USB drive and just plug it to any computer with systemd-homed support and your known environment is ready to use. With the old concept of home directories this can’t be used that easy. That’s maybe the next big thing the systemd project changes in how we use home directories? Check out Lennarts talk here.

From Zero to Useless to Hero

Last but not least a talk from two guys working for Deutsche Telekom.

This talk is a story about how they created an awesome, distributed tracing tool, including logging and monitoring correlation starting at Day 1 of a big distributed software development project. They made a useless tool for their future users.

They were faced with cultural problems and needed to adapt how their users understand the usage and benefits of the operating and observability solution they built. Today no one of their users want to miss that tool and are shouting if it’s not available. So what did they do, to make their tool useful(= Utility + Usability)? Check out their talk here.

Summary

It have been two intensive days with a lot of information, interesting ideas, tasty food and beer. For me it was impressive to see so many people use their time on- or/and off-work for being a part in one of the many open source communities. I can recommend FOSDEM as a good organized conference to all, that never have been there before. If you starting binge watching all the talks, you would need over half a year to see them all.

And here we go again. The second year in a row I find myself on a train directed to Bruxelles, Belgium. I will join the mass of hackers a professionals grouping at the Université libre de Bruxelles for this year’s FOSDEM.

I went through the schedule and bookmarked the most suited talks for me, while knowing that this won’t be a fixed program as rooms get pretty full and I’ll have to have a backup plan ready.

Saturday, 1st February 2020

My day starts with the welcome talk in Janson. The room is nearly full. The rules get explained by the staff and after a short introduction we get to the real talks.

Podman

I go as quickly as possible in the containers devroom. I know leaving and entering this room again will be really hard, as it attracts an enormous amount of people.

Sascha Grunert presents us Podman with some cool slides and I have already some takeaways from it.

As an example you can share PID namespaces with podman between containers

podman run --pid container:containername --name myname -d alpine

Podman, as the names tells us, can create even pods on a single node:

podman pod create --name mypod

We can than start a new container inside this pod

podman run --pod mypod alpine command

And from that, we can generate Kubernetes manifests:

podman generate kube -f pod.yml mypod

and obviously replay those inside podman:

podman play kube pod.yml

Lazy distribution of container images

Akihiro Suda is the next guy showing up in the container devroom. He shows us some interesting new way of running container images, by downloading first what is really needed by the container so that it can start up faster. It reduces start up time of a container by a factor of 5.

The project is based on stargz (seekable tar.gz) from Brad Fitzpatrick (Ex-Googler). The idea behind it is having an index.json inside the archive to make a direct search of files possible.

The plugin is available here.

ONLYOFFICE talk

I get out of the container devroom to go to building AW and listen to some talks on collaborative applications. The first one is the ONLYOFFICE team showing up and explaining to us how its application works and how well they can be integrated into Nextcloud.

They also talk about the amount of features they are planing on implementing. I didn’t even know it was possible to have such a big feature list for a collab app.

Nextcloud Hub

Nextup is Nextcloud regarding its new HUB feature, where they install all applications (mail, calendar etc.) by default.
This video recaps the talk pretty good.

Live migration of containers

Yes, I’m back in the container devroom again. This time it was pretty hard to get in, as the queue was very long, but in the end, I succeeded.

Thanks to CRIU and Adrian Rebers talk I know now how to live migrate a container from one host to the other (with it’s memory!)

Go check the recording of the talk out, as he has also a demo in it.

Hint: there is a podman container checkpoint command

Below K8s: Demystifying container runtimes

Thierry Carrez started drawing a dashboard some years ago to show how K8s works to make containers run. He started adding stuff as CRI and OCI came along and the final drawing he ended up with, is quite helpful for some folks.

 

Immutable Deployments

Matteo Valentini shows us that Kubernetes isn’t always the solution to a problem. With his toolchain consisting of Git, Terraform, Ansible and Packer he convinces us how easy it is to have immutable deployments and go for an approach of a full CI/CD pipeline, starting by building a cloud image with Packer and Ansible and deploying it to the cloud with Terraform.

Go check it out on (not yet documented) GitHub repo.

Kubernetes Clusterf*ck

Kris Nova. This is the highlight for me. The room in building K is already quite full as I get in. Over 800 people will be listening to her.

She gets quite technically and hacks during her 50 minutes talk a Kubernetes cluster as a normal cluster user. By using a privileged container, she manages to gain control of the whole Kubernetes cluster as cluster admin. The solution? With Falco you could prevent that from happening. The talk is quite interesting and she gets a big applause at the end. Well done! Everything is obviously available on her GitHub.

SELinux with Container Runtimes

No, this time I’m not ending up in the container devroom again. It’s the security devroom. Lukas Vrabec informs us on generating SELinux policies for container with a new project called Udica. Thanks to this tool generating SELinux policies for our container will be as easy as eating cake (but I’d still rather have cake than SELinux policies).

This two commands make it look pretty easy:

podman inspect -l | udica my_container

semodule -i my_container.cil

End2End encryption in instant messaging

For the end of the day Winfried Tilanus gives a talk regarding the challenges we’re confronted when trying to get end to end encryption for instant messaging. Spoiler: it’s not that easy.

His slides are available here.

Sudo

Last but not least, Mr Czanik is up, and I can profit quite a lot from his talk. Sudo can do a lot more than just give you root access to a system. Some plugins and his demo on how sudo can also be run in pair programming/engineering gets a good round of applause.

Go check it out!

Sunday, 2nd February 2020

Close lid to encrypt

I start my day by joining the decentralized internet and privacy devroom. I will be staying in here a lot today. The first talk is about closing the lid of your laptop and actually encrypting the HD again (Encrypt on suspend). The talk gets quite technical but basically, the processes get freezed and memory saved to disk before the encryption happens. It’s quite a hack and not at all stable, but it works.

This time, the code is hosted on debian.org.

Identity Box

Wow, a decentralized identity tool! Today I will be seeing a few of those. Identity box is a little different than the others, because it comes with hardware. The demo even works well and shows us how to add a new friend to identity box. At this point I wish people were more alert about their privacy and would want something like this in their homes. Their homepage promises a lot.

Grafana Metrics linked to Loki Logs and Jaeger Traces

I switch the room and stand in line to enter the monitoring and observability track. Andrej Ocenas shows us how to correlate Loki logs with Grafana metrics and link those to traces in Jaeger and viceversa. Quite interesting to me. With this linking possibility you get from traces to metrics and from there to logs and back very easy. Go look at his talk, he has a demo!

I listen to another talk but continue my journey back into the p2p & privacy devroom.

ID4me

As I said, another federated identity provider. This time it’s ID4me which is basically doing openID but federated.

Their homepage says it all.

GNUNet

Well, this are the talks I was waiting for. GNUNet. I’m so much into decentralized internet solutions, that I can’t decide which one is the best. As an example, I’m a weekly user of ZeroNet but GNUNet was something new for me.

It’s setup really easy on ArchLinux as there is a package for it. Martin Schwarzenbach shows us what where the challenges building this and what approach they took. I would love if this would fire up and a lot of apps would be built on it! The talk is really promising.

secushareBOX

P2P IoT! Why should we trust the cloud to control our lights, music boxes and doors in our home? This is where peer-to-peer IoT comes into play. And why not built it on GNUNet? Yes this looks to amazing to be true. But this guy, Devan Carpenter, had the idea. It’s not yet fully realized but he’s getting there! Wow, can’t w8 to try it out.

• Talk

Rook

No, I’m not switching room again. It’s getting too full to switch room quickly. And then I don’t want to miss the next talks in this devroom. So, opening up my laptop it is. Watching the stream of another devroom won’t hurt. The talk of Alexander Trost goes on about rook and its development. Very very interesting where this guys are heading. Go check them out!

DAT Protocol, Tor, OpenPush

Of course I already knew DAT before going to Belgium. I even used it a few times. The only thing I’m missing on DAT is the multiwrite capability, but they are getting there. DAT is a protocol which gives you a very easy way to share files p2p from one client to another. Heck, it even gives you the possibility to host your webpages on the DAT decentralized web. Some browser even support browsing dat:// sites. It’s kinda like ipfs but a few aspects are different.

The Tor project needs developers. This is my main take from next talk. Alexander FÊr¯y presents us the Tor organisation and how the teams are built. Shows us some statistics too, but the main objective of this talk is to get people to help out on the project. If you know C (I don’t) please go help or at least think about donating.

Why rely on Google to do the hole notification push thingy? This man has a point! If your Android apps have to use a proprietary software to push notifications it’s not FOSS anymore. This is why he takes the matter into his own hands and builds the OpenPush project. By the way, you should check out is homepage, he offers a lot of services if you know him.

P2P – Matrix

The room is full. What a surprise, the next talk is regarding Matrix. But this time we will be looking at the next-gen Matrix. What if you can have your homeserver on your device at any time? This means being fully peer-to-peer and not having to rely anymore on a self hosted home server. Well, that would be the dream. And the guys from Matrix are on this path. They even have a demo already out there working.

The idea was to try it out with the devroom, by downloading a docker image and starting a go binary in the background we should be able to connect with Matthew Hodgson, who gave the talk. It didn’t work for me, as we were using a different, hotspot network I couldn’t reach from the middle of the room (apparently there were some multicast issues with the FOSDEM network).

Go check out his recording to see how cool it would be.

Red Hat Container Storage (Ceph) on OpenShift

I’m free! That is the feeling you get leaving a full room. I go back to building H and join the Red Hat guys to let me introduce to the new Red Hat Container Storage on OpenShift 4.x which is basically Rook with a Ceph Backend.

The idea is to deploy this on OpenShift itself. I would never deploy software defined storage in containers, but as it is managed by an operator from Red Hat, I will trust them. I had a lot to do with OpenShift 4.x and it looks like they got this operator thingy working for them. No installs broke until yet, and all updates went through in the end. It looks like they built a very robust Kubernetes platform with OSCP 4.x.

To get Ceph now running, you bootstrap a few new nodes (on the cloud or baremetal) and define them as storage only. No other applications will run on them. Then the Operator takes over from there and deploys all Rook/Ceph components on them, in containers. I even asked if you could attach to the operator a pre-existing baremetal Ceph installation. And their answer was: “not yet, but we want to get there”.

• Talk

Maddog, 20 years of FOSDEM and closing

And it’s already Sunday 4 PM. Time to get back into Janson and listen to the great Jon ‘maddog’ Hall. This guy is extraordinary! Last year I was nearly crying at the end of his talk. He always has way too many slides and way too many side jokes ready to entertain us.

This year he shows us what it was back in the day to work for FOSS, and how hard it was to make money out from it. I realize how lucky we are today. Opensource software is recognized that much and enterprises all over the world want to work with said software. But back in maddog’s early years, that wasn’t the case. Jumping from one lawsuit to the next he showed us what where the main events from the years 1970 – 2020.

Go checkout out the recording, it will be surely worth a look!

And there comes also Steven Goodwin into play. 19 attended FOSDEM and counting. This guy saw it all and presents us also the one guy who started it all. Raphael Bauduin. Who is in fact wearing the same shirt he wore at the first FOSDEM. What a bunch of nerds, I think for myself. Well I’m one too sitting here with my notebook full of stickers and copyleft hoodie.

The Staff presents to us ,without the beamer, as it had malfunctioning, the facts and numbers of this year’s FOSDEM. This is always nice to listen too, as it shows us how much time and money goes into such a project. At this point I just want to say thank you to all volunteers. We’ll see each other next year! PS: perhaps I’ll finally be able to grab a hoodie next time!

A free / open source office suite within the palms of our hands. Collabora Office is now available on iOS.

What seemed impossible for a long time has now become reality. There is now a free / open source office suite available on iOS: Collabora Office. The efforts for this are led by Adfinis SyGroup and Collabora. What started back in around 1992 as the well-known StarOffice, then was OpenOffice.org and now lives on as LibreOffice, is finally available on every relevant platform including (but not limited to) iOS, iPadOS, MacOS, Android, Chrome OS, Windows, Linux and also within the browser.

There is a lot we want to tell you about this first open source office app for iOS. In this blog we put more focus on the history of the story; the blog at Collabora, has more focus on the interesting technology.
But before we tell you more about the new app, we show you first what it looks like:

History shows strength of free / open source software

The journey from StarOffice to OpenOffice and from there to LibreOffice is quite an interesting piece of history. Most importantly it shows that free / open source software won’t just vanish if one stakeholder pulls the plug. The availability of the source code guarantees that free / open source software can continue to develop independently of the commitment or existence of individual economic players. The code of today’s LibreOffice originated from StarOffice, whose first word processor was already published in the 80s. The disclosure of the source code of StarOffice in 1999, which in the meantime had grown into a complete suite, enabled the development and rapid distribution of OpenOffice. Today, 200 million users worldwide trust its successor LibreOffice, which has been continuously developed under the umbrella of the Open Document Foundation and through the development work of 1000 volunteers and commercial software companies such as Collabora.

Collaborative document-processing becomes mobile

Collaborative work on documents requires that team members work independently of their location. One of the weak points in the past, however, was the limited availability on mobile devices. LibreOffice and OpenOffice were not available on iOS for many years. The situation on Android was not too golden either. Chances however turned with strong investments from Collabora to bring LibreOffice to the cloud. And once LibreOffice in the browser was a fact, it became feasible to leverage that technology for the LibreOffice apps on iOS and Android. The new iOS App enables iPhone, iPad and iPod Touch users not only to use LibreOffice Online from their mobile Apple devices, it also paves the way for a much faster extension of the functionality of the Android app. Collabora Office makes document processing mobile. Working with documents is always a matter of trust. Work from wherever you want, but maintain control over your data everywhere.

Why do we need an iOS app? A case study in the field of education

Of course, there are well-known reasons why an iOS app is important and good to have. But in this special case it started with a public tender of a public school where one of the primary aspects was to build an IT platform with data privacy in mind. The idea seems simple: let’s not send data from pupils to cloud providers who are going to use data analysis to create profiles of them. Instead let’s use self-hosted and free / open source software to build a private cloud that offers the same services as the proprietary vendors.

The solution we came up with combines are the following ones: Nextcloud (for file storage/sync), Mattermost (as Whatsapp alternative), Kolab (groupware) and Collabora Office (which is an enterprise ready solution of LibreOffice). The services run on Red Hat Linux in the data center of the customer. Everything was provisioned through Ansible and the end user will use Apple iPads to do their work.

In order to achieve the best possible user experience, we wanted to use native apps wherever possible. For mail, calendar and address book we could use the Apple tools and connect them through Active Sync with the Kolab. Mattermost offers a mature iOS app, Nextcloud does the same but with regard to LibreOffice, this was not accessible for the iOS Platform – until now!

After spending some time to evaluate the possible solutions it became clear that having a native LibreOffice app on iOS is the way to go. A first way to do that, would be making the visual layers of LibreOffice work on iOS. That however was not possible in a short amount of time. Luckily the Collabora developers came up with an even better idea: why not use the same approach for iOS and Android, that is used for the browser/online stack?  This approach uses modern browser technologies and builds a JavaScript/HTML based interface around the LibreOffice core. It has advantages such as the document rendering being the same way on all available platforms — a document won’t be damaged after it has been edited in the browser or on a mobile device and then opened on the desktop. It will always stay the same core and the document will always be displayed exactly like that! Furthermore, each of the said solutions would profit from same improvements by choosing the same approach for iOS and Android.

State of Collabora Office on iOS

After our first public  announcement a lot of work has been done to create an app that is stable, cool and useful. There are still some rough edges we have to remove but the overall result is getting better day by day.

There are currently two possible ways to get the app:

1. Download Testflight through the Apple Store and click here link to join. This will give you the latest releases – which are not yet tested
2. Download the app through the Apple Store here

Over the past months, more than 60 versions have been released and over 100 improvements and enhancements have been completed.

Some of the highlights of Collabora Office on iOS

• Native look and feel & finger usage. Although Collabora Office uses a different GUI toolkit, a lot of work has been invested in making the application look and feel like a native iOS app.
• The sidebar makes settings easily accessible. The sidebar contains contextual features and makes takes advantage of the wide screen of the iPad.
• Finger sized resize and rotate handles. Resizing or rotating images, changing the size of rows or columns in tables. Many functions can be controlled by finger gestures.
• Integrated iOS spellchecker. The app uses the iOS system spell checker to protect into the app.
• GUI widgets in iOS style. The application adapts the style guidelines for drop-down menus and check boxes in iOS.
• Straightforward image pasting. Take a picture with the device camera or select one from your image gallery — just like in other apps.

Learn more about the technical details and features of the app in the Collabora blog post.

What’s next for Collabora Office?

As you can read and experience yourself, there are very good reasons to be happy with what has been achieved so far. Of course, there is still a lot to do and so we already have the following things in mind:

• Create shiny templates
• Implement native widgets / improve UX
• Reduce latency
• Better support hardware keyboards (and shortcuts)
• Fix more rough edges
• Make more core features accessible (math formulas, image cropping, …)
• Reduce number of needed clicks for simple things (change cell background in a writer table, change text wrap of a picture, …)

Note: these points may change – this list is not a road map!

How does this help LibreOffice on Android?

As already described above, Collabora leads the effort to use the same approach we use in the iOS app to deliver a new Android app.

During GSOC 2019 Kaishu Sahu did a great job and improved the Android app a lot. Jan Holesovsky (Collabora) is working to improve the situation even further and we should see a public release not too far in the future.

If you’re interested to learn more about the Android efforts or how to join, please contact Collabora.

last but not least it’s a very good way to support the development of things like this iOS app!

Let’s be frank: money is very helpful to further speed up the development. So, if your organization plans to use LibreOffice on iOS (or any other platform) we’re happy to get you on board! Please don’t hesitate to contact us directly to discuss possible ways to support the development.

It’s your turn: you can help to make this better!

If you plan to use LibreOffice in an enterprise environment whether on the desktop, on Android or on an iPad – we strongly recommend the enterprise ready version offered by Collabora. You’ll get long-term support with SLAs and last but not least it’s a very good way to support the development of things like this iOS app!

Some words of thanks

This fantastic work would not be possible without the strong support and investment of Collabora. Their support and outstanding expertise form the solid base of this effort – without them, we would not have made it as we did. A special thank you goes to Tor Lillqvist who put a lot of work into this and did most of the engineering/coding. I’m delighted to be able to work with Tor on this and look forward to plan more such excited things with him.

Last but not least, Adfinis SyGroup pays some of the bills here as well – thanks to the entire crew works hard every day to provide more Free and Open Source solutions to the people out there! You’ll get support with SLAs, long-term support and It’s your turn: you can help to make this better!

 

The following images illustrate the state of the app: