The Linux Foundation hired Sheryl Chamberlain to fill the newly-created position of chief of staff. She’ll oversee operational activities for the foundation and be the point of contact between executive management and stakeholders in its numerous open sourceprojects.
Previously, Chamberlain was a partner VP at the consulting company Capgemini where she led activities to assist Dell Technologies. Prior to joining Capgemini, she worked at EMC in a variety of roles, including chief operations officer in the corporate office of the CTO.
At the Linux Foundation, Chamberlain will help take the organization’s knowledge on topics such as governance, development processes, community outreach, and intellectual property management and share it across projects.
The Xen Developer and Design Summit schedule is now live! This conference combines the formats of the Xen Project Developer Summits with the Xen Project Hackathons. If you are part of the Xen Project’s community of developers and power users, come join us in Budapest, Hungary, July 11 – 13 for this must-attend event!
The conference will cover many different topic areas including community, embedded/automotive, performance, tooling, hardware, security and more. The format will include traditional panels and presentation, as well as design and problem solving sessions.
Design and problem solving session proposals will be accepteduntil July 7. This is a great way to meet other developers face-to-face to:
Discuss and advance the design and architecture of future functionality
Coordinate and plan upcoming features
Discuss and share best practices and ideas on how to improve community collaboration
Hear interactive sessions covering lessons learned from contributors, users and vendor
Submit your design and problem solving ideas here.
Keynotes this year are coming from Lars Kurth, Xen Project Chairperson and Director of Open Source Solutions at Citrix; Oleksandr Andrushchenko, Lead Software Engineer at EPAM Systems; Stefano Stabellini, Virtualization Architect at Aporeto; and Wei Liu, Senior Software Engineer at Citrix.
Here’s a small sampling of other speaking sessions during the conference:
Automotive
Dedicated Secure Domain as an Approach for Certification of Automotive Sector Solutions from Iurii Mykhalskyi of GlobalLogic
Harmony of CPU Scheduling Between RT Guest OS and Rich Guest OS in Automotive Virtualization from Sangyun Lee of LG Electronics
Security
Hypervisor-Based Security: Bringing Virtualized Exceptions Into the Game from Mihai Dontu of Bitdefender
Uniprof: Transparent Unikernel Performance Profiling and Debugging from Florian Schmidt of NEC
Future of Xen
Intel GVT-g: From Production to Upstream from Zhi Wang of Intel
Recent and Ongoing Xen Related Work in the Linux Kernel from Jürgen Groß of SUSE
General Hypervisor
Bring up PCI Passthrough on ARM from Julien Grall of ARM
EFI Secure Boot, Shim and Xen: Current Status of Developments from Daniel Kiper of Oracle
You can view the entire schedule here. Early bird specials for tickets (price is $250) are available until May 31st.
A special thank you to our Diamond Sponsor Citrix and Gold sponsors ARM, Intel and Superfluidity. We look forward to seeing you at the event in July, and please stay informed on Xen Project updates by following us on social (Twitter and Facebook) and registering to our xen-announce mailing list.
The countdown to this year’s OPNFV Summit is on! We’re headed to Beijing June 12-15 for four days of connecting global communities via tutorials, sessions, demos and keynotes targeted toward a diverse set of industry attendees. The largest gathering of OPNFV developers and community members from across the globe, OPNFV Summit is an annual conference to collaborate, innovate and explore the latest developments in open source Network Functions Virtualization (NFV). OPNFV is The Linux Foundation’s open source project for integrated testing of the full, next-generation networking stack. Will you join us? As a special offer to Linux.com readers, you can register here using code LNXCNOPNFV17 for 15% off.
With just a few weeks to go, we are pleased to announce our preliminary lineup of expert keynote speakers ready to share their insights and perspectives along the NFV journey.
The keynote presentations will cover a wide range of topics, including:
Accelerating the maturity and adoption of NFV
Turning networks to meet the needs of global communities
Deployment experience of vEPC in commercial networks
Cloudification of the telco network
Here are a few of the industry leaders participating as keynote speakers/panelists:
Heather Kirksey, Director, OPNFV
Zhang Fan, Chief Architect of Packet Core, ZTE
John Healy, VP, Data Center Group, GM, Datacenter Network Solutions Group, Intel
Susan James, Head of Product Line NFV Infrastructure, Ericsson
Forrest Lee, OPNFV Open Source Development Team Director, Huawei
Prodip Sen, CTO of NFV, HPE
Lingli Deng, Principal Engineer, China Mobile Research Institute
Chongfeng Xie, Director, IP and Future Network Research Center, CTBR
Eric Debeau, Head of R&D Team, Orange
Wei Leping, China SDN/NFV Alliance
Along with our featured keynote presentations, this year’s event will feature a diverse set of more than 65 presentations and demos spanning session tracks that include: Community and Upstream; Futures and Research; NFV Applications and Orchestration; NFV Platform Requirements; NFV Strategy and End User Stories; and Testing, Infrastructure and DevOps. You can view the full Summit agenda, including keynotes, breakout sessions, and demos, here: http://events.linuxfoundation.org/events/opnfv-summit/program/schedule
OPNFV Summit 2017 will be here in just a few weeks! Make your plans to join us now.
To register for the OPNFV Summit — including information on traveling, accomodations, and visas — please visit http://events.linuxfoundation.org/events/opnfv-summit/attend/registration(use codeLNXCNOPNFV17 for 15% off). Members of the media who would like to reserve a complimentary press pass to OPNFV Summit should contactpr@opnfv.org.
As we mentioned in the previous article, web browsers present the largest and the most exposed attack surface on your Linux workstation. We’ve already discussed some best practices that Linux sysadmins can follow to reduce the impact of a compromised browser, such as upgrading to Wayland, using a different browser for work/high-security sites, and using Firejail to create a sandbox around Linux applications.
This time, we’ll cover a few more best practices involving 2-factor authentication and password creation and use.
Use Fido U2F for website 2-factor authentication
Fido U2F is a standard developed specifically to provide a mechanism for 2-factor authentication and combat credential phishing. Regular OTP (one-time password) mechanisms are ineffective in the case where the attacker is able to trick you into submitting your password and token into a malicious site masquerading as a legitimate service.
The U2F protocol will store site authentication data on the USB token that will prevent you from accidentally giving an attacker both your password and your one-time token if you try to use it on anything other than the legitimate website. See the following site for a curated list of services providing Fido U2F support:
Note, that not all browsers currently support U2F-capable hardware tokens, and if you use sandboxes or virtualization-based isolation around your browser, you may have to work extra hard to enable USB pass-through from the application to your USB token.
Password managers
Using strong, unique, randomly generated passwords should be a critical requirement for every member of your team. Credential theft is happening all the time — either via compromised computers, stolen database dumps, remote site exploits, or any number of other means. No credentials should be reused across different sites, ever.
In-browser password manager
Every browser has a mechanism for saving passwords that is fairly secure and can sync with vendor-maintained cloud storage while keeping the data encrypted with a user-provided passphrase. However, this mechanism has important disadvantages:
1. It does not work across browsers
2. It does not offer any way of sharing credentials with team members
Several well-supported, free or cheap password managers are well integrated into multiple browsers, work across platforms, and offer group sharing (usually as a paid service). Solutions can be easily found via search engines.
Standalone password manager
One of the major drawbacks of any password manager that comes integrated with the browser is the fact that it’s part of the application that is most likely to be attacked by intruders. If this makes you uncomfortable (and it should), you may choose to have two different password managers — one for websites that is integrated into your browser, and one that runs as a standalone application. The latter can be used to store high-risk credentials, such as root passwords, database passwords, other shell account credentials, etc.
It may be particularly useful to have such tool for sharing superuser account credentials with other members of your team (server root passwords, ILO passwords, database admin passwords, bootloader passwords, etc.).
A few tools can help you:
• KeePassX, which improves team sharing in version 2
• Pass, which uses text files and PGP and integrates with Git
• Django-Pstore, which uses GPG to share credentials between admins
• Hiera-Eyaml, which, if you are already using Puppet for your infrastructure, may be a handy way to track your server/service credentials as part of your encrypted Hiera data store
The next, and final, article of this series will cover how to secure SSH and PGP private keys — another essential step in guarding your Linux sysadmin workstation from potential attackers.
Edge computing will not replace cloud computing, though the two approaches can complement each other.
The internet of things is real, and it’s a real part of the cloud. A key challenge is how you can get data processed from so many devices. Cisco Systems predicts that cloud traffic is likely to rise nearly fourfold by 2020, increasing 3.9 zettabytes (ZB) per year in 2015 (the latest full year for which data is available) to 14.1ZB per year by 2020.
One of more popular activities at DockerCon is our Hands-on Labs, where you can learn to use the Docker tools you see announced on stage, or talked about in the breakout sessions. This year we had eight labs for people to work through, ranging from 20 minutes to an hour in length.
We’ve now moved these apps into the Docker Labs Repo so that everyone can use them. The Docker Labs Repo is where we put a bunch of learning content for people who want to learn Docker, from beginner to advanced security and networking labs.
So first, some definitions. Pardon me for my hubris, but there are so many different definitions of “unit test” and “system test” and “acceptance test” out there that it seems to me someone ought to provide a single authoritative definition. I don’t know if these definitions will stick; but I hope some set of definitions does in the near future.
Unit Test: A test written by a programmer for the purpose of ensuring that the production code does what the programmer expects it to do. (For the moment we will ignore the notion that unit tests also aid the design, etc.)
Acceptance Test: A test written by the business for the purpose of ensuring that the production code does what the business expects it to do. The authors of these tests are business people, or technical people who represent the business. i.e. Business Analysts, and QA.
If you work in the technology industry, especially if you are paying attention to all of the exciting open source projects that come and go, it can be very easy to get distracted by the next exciting thing. The reality is that it rarely pays off to embrace something just because it’s new, and in fact this is a major risk for a project like Cloud Foundry. Our community is focused on end user productivity, above all else. This means that we work with other open source communities by first watching, then evaluating and finally participate where we believe it will benefit both groups. When the time is right in the evolution of a project — when technology is mature enough and proven in production — we then consider if and how we can adopt something into the Cloud Foundry platform.
The Cloud Foundry community’s approach to its Linux container runtime is a perfect example of our approach. So is the container networking interface.
Mistakes and missteps plague enterprise security. The Verizon 2017 Data Breach Investigations Report (DBIR) offers nuggets on what organizations must stop doing – now.
Datasets from the recent Verizon 2017 Data Breach Investigations Report (DBIR) show that some security teams still may be operating under false assumptions regarding what it takes to keep their organizations secure.
For starters, the same security standards don’t apply across all vertical industries, says Suzanne Widup, a senior consultant for the Verizon RISK Team and co-author of the Verizon DBIR.
The automotive electronic industry is now, more than ever, facing cybersecurity, connectivity, and software time-to-market challenges. Recently, in fact, vehicles have been hacked in several ways (e.g., physical and remote unlocking/control) and by different means (i.e., CAN bus, OBD-II, emulated cellular networks, etc.).
Consequently, car makers such as BMW, Fiat Chrysler Automobiles, General Motors, Nissan, and Tesla Motors struggled to shut down connected-car services, mailing updates to users on a USB stick, remotely delivering software updates, or in the worst cases going through vehicle safety recall procedures to fix vulnerabilities.
Michele Paolino
The first reason for such security problems is that cybersecurity, although widely recognized, has not been a top priority for designers and developers of automotive electronic systems. The second reason, which is more difficult to tackle, is that these systems are increasingly complex and difficult to maintain. Hundreds of sensors, actuators, and Electronic Control Units (ECUs) from different manufacturers, with heterogeneous connectivity requirements, are orchestrated together in a distributed way through communication protocols based on broadcast messages, with a very weak usage of encryption/authentication mechanisms.
To make things worse, future cars are expected to be always connected, producing terabytes of data per day, thus requiring high bandwidth/low latency connectivity for both safety critical (Vehicle to Vehicle, Vehicle to Infrastructure, etc.) and infotainment functions (video/audio streaming, social networks, etc.). Network Functions Virtualization (NFV) and 5G, the standardization group which aims at reshaping future telecom networks around the concept of virtualization and the proposed next wireless communication standard, are multiplying standardization efforts in the direction of hyper-connected cars. However, in this context, interoperability at all levels will be of utmost importance to make things really happen in terms of usability, quality of services. and security.
Another dilemma is how cars with a lifecycle of about 15 years can coexist with connected services having a lifecycle that is a fraction of this time. For instance, Spotify, YouTube, Google Maps, and Twitter did not even exist 15 years ago and might not exist in the same way in 15 years from now.
Today, software automotive systems need to adapt themselves much quicker to new requirements from users, manufacturers, as well as from legal authorities. A big difference from the past is that all of this has to happen during the lifecycle of the very same single car.
This is not only about infotainment, as shown by Volkswagen’s diesel-gate for example, for which a huge deployment of software updates has been mandated by law.
As a result, to realize smart-connected vehicles and to tackle cybersecurity, connectivity, and software time to market challenges, the automotive industry needs a hardware and software architecture that guarantees security, simplified systems management, high processing/networking performance, open standards, interoperability, and flexibility.
This type of requirement fits perfectly with open source virtualization, which is able to provide strong isolation (helping to address cyber security requirements), limited overhead (achieving almost native performance), openness (leveraging on open standards/licenses/code speed up applications time to market and reduce vulnerabilities life), and consolidation (contributing to reduce costs and ease maintenance). This is what makes open source virtualization a smart connected vehicle enabler, and for this reason I believe it should be considered in any future automotive solution design.
AGL Virtualization Expert Group
This is why, in late 2016, I proposed to start the design/development an open source virtualization solution for Automotive Grade Linux (AGL), the most important open source automotive project under The Linux Foundation umbrella targeting to develop an industry reference software stack based on open technologies.
The proposal resulted in the creation of the AGL Virtualization Expert Group (EG-VIRT), which aims to integrate virtualization in the AGL distribution without targeting a specific technology, but building an open infrastructure able to support different potential solutions.
With this in mind, a number of ambitious tasks need to be considered, first and foremost being the choice of the target hypervisor(s). In fact, different architectures and implementations are available: unikernels (e.g., Rump kernel) are extremely thin but usually run simplified applications built for a specific purpose; containers (e.g., Docker) do not need hardware virtualization extensions but are strongly coupled with the host kernel; partitioning hypervisors (e.g., Jailhouse) can benefit from very simple implementations but provide no over commitment and need modified guests; and Type-1/Type-2 hypervisors (e.g., Xen or KVM) are today mature technologies that provide strong isolation/flexibility but slightly higher overhead.
On top of this, we must also provide an open source solution for GPU virtualization and hypervisor/OS certification, needed to finally have a real impact on the market where existing solutions are mostly based on Type-1 hypervisors (either completely closed or based on open source projects like XEN). Other solutions put together different virtualization technologies, e.g., Virtual Open Systems combines a system partitioner based on ARM TrustZone (VOSYSmonitor) with the Type-2 hypervisor KVM.
However, virtualization brings new opportunities, and one of the most important is related to (virtual) ECUs interconnection. In fact, running multiple ECUs in the same system means that there is a need to create new virtual communication mechanisms. This could be the right chance to redefine both physical and virtual ECUs interconnection, in a way that offers stronger security and higher bandwidth.
Briefly, although some say future cars look similar to modern smartphones, I believe reality is more complex than that, and smart connected vehicles are much closer to NFV systems, where a network of virtual ECUs (functions) works together through virtualization consolidation.
Conclusion
For the increasingly growing AGL/EG-VIRT community, the challenges outlined above are not impossible to address. In fact, there are multiple examples of open source projects that created innovation in a disruptive way.
In the meantime, EG-VIRT has taken on the challenge and has already started its activity, focusing on the implementation of a proof-of-concept based on a KVM-enabled AGL distribution on ARM. From this activity, a first set of patches have been published by Virtual Open Systems and will be demonstrated at theAutomotive Linux Summit 2017 in Tokyo during my presentation “How to Introduce Virtualization in AGL? Objectives, Plans and Targets for AGL EG-VIRT.” You are all invited to join the event and the online discussion!
The Automotive Linux Summit 2017, held May 31 – June 2 in Tokyo, gathers the most innovative minds from automotive expertise and open source excellence to drive the future of embedded devices in the automotive arena. Linux.com readers can save $25 with code LINUXRD5! Register now >>
