Jenny from the blog

Insecure Zendesk SSO implementation by generating JWT client-side

Sun, 08 Sep 2019 12:20:23 +0000

Belle of the Ball

Two months ago I submitted a security bug report to Trint Ltd. on HackerOne. It got disclosed today and managed to get ranked on top of hacktivity feed ;)

Below you can find the report originally submitted here.

Summary

app.trint.com implements SSO to Zendesk, it does this by using JWT as described at https://support.zendesk.com/hc/en-us/articles/203663816-Enabling-JWT-JSON-Web-Token-single-sign-on

This functionality has not been implemented securely because the JWT generation happens in the client-side. This is done by the Zendesk secret being hardcoded in the JavaScript code. The secret is used to create JSON Web Tokens and then you can use the generated token to impersonate any customer in Zendesk. (therefore potentially getting access to their support tickets)

Whilst support.trint.com is marked as out of scope for the program, the described vulnerability isn’t caused by Zendesk. The vulnerable component is in app.trint.com.

Assessment

The JavaScript source map files are available next to the minified production files. This significantly makes analysing this issue easier.

JavaScript file: https://app.trint.com/static/js/app.e984c9df.js
Sourcemap file: https://app.trint.com/static/js/app.e984c9df.js.map

Looking at some of the UI views, I stumbled upon static/js/modules/auth/pages/ZendeskLoadingPage.jsz I’ve attached a stripped version which shows the JWT generation:

import { ZENDESK_DOMAIN } from 'modules/core/constants/index';

const { REACT_APP_ZENDESK_SECRET } = process.env;


function RedirectToZendesk(props) {
  const { user, history } = props;

  function generateZendeskTokenAndRedirect() {
    const TIME_NOW_OBJECT = moment(Date.now());
    try {
      const payload = {
        iat: TIME_NOW_OBJECT.unix(),
        jti: uuid.v4(),
        name: `${user.profile.firstName} ${user.profile.lastName}`,
        email: user.username,
      };

      // encode zendesk token
      const zendeskToken = jwt.sign(payload, REACT_APP_ZENDESK_SECRET);
      window.location = `${ZENDESK_DOMAIN}/access/jwt?jwt=${zendeskToken}`;
    } catch (err) {
      history.push('/error');
    }
  }

  useEffect(
    () => {
      generateZendeskTokenAndRedirect(user);
    },
    [user],
  );

  return <Loader />;
}


export default ZendeskLoadingPage;

Searching for REACT_APP_ZENDESK_SECRET in the sourcemap will show the JWT secret:

var REACT_APP_ZENDESK_SECRET = "oq1HJ4jXo99Wt41bwvLh9BXBVdgpi52CjkXbThow7UhWQGtJ"; ` Generating the JWT on the client-side like this allows anyone to mint an arbitrary JWT. It would probably be better to generate this on the server-side.

Reproduction steps

As logged-in user press “Support” on https://app.trint.com Intercept the traffic and see the call to https://trintsupport.zendesk.com/access/jwt?jwt=[JWT_TOKEN] Logout of Zendesk Put the JWT token from above URI into https://jwt.io and decode it. Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1NjI3MDk2NTksImp0a
SI6IjIxZDAyOTg3LWU3YWItNDQ5MC05N2Q3LTc2YTBmMzJhOTVjOCIsIm5hbWUiOiJUZ
XN0IFRlc3QiLCJlbWFpbCI6ImIzODcxNjk0QHVyaGVuLmNvbSJ9.mnnx7dbpXbvU7xr
5Bp5pad2eHVN01mSsXApmZoFj73c
{
  "iat": 1562709659,
  "jti": "21d02987-e7ab-4490-97d7-76a0f32a95c8",
  "name": "Test Test",
  "email": "b3871694@urhen.com"
}

Now we can continue with tampering the JWT Change IAT to the current Unix timestamp Change JTI to a random UUID v4 Change email to the victim email address Insert oq1HJ4jXo99Wt41bwvLh9BXBVdgpi52CjkXbThow7UhWQGtJ as HMAC secret. Use the resulting JWT in a call to https://trintsupport.zendesk.com/access/jwt?jwt=[JWT_TOKEN]. You will be logged in as the victim.

Impact

Access to the Zendesk account of Trint customers. This includes potentially the support history of said user.

I haven’t verified whether the same SSO flow can also be used against Zendesk administrators. If so, the risk would be higher.

A security review of phpList REST API

Thu, 20 Sep 2018 12:20:23 +0000

APIs are essential for building applications that are open and can integrate with other applications and services, yet with the openness of APIs comes a challenge: APIs can create additional security risks, as they increase the number of ways in which malicious actors could get into applications. Therefore, when developing APIs, careful design and security are important. As part of my internship at phpList, I had the opportunity to work on performing a risk assessment for the REST API.

On a personal note, it has been a challenging and exciting experience. I would like to share the research with the community as a learning opportunity for readers and myself. Please note that all high severity risks have been addressed and resolved already in the various related code repositories.

Recap on the phpList REST API

The phpList REST API provides functions for superusers to manage lists and subscribers. It uses functionality from the phpList core module .

This new REST API can also be used to provide REST access to an existing phpList 3 installation. For this, phpList 3 installation and the phpList 4 installation with the REST API need to share the same database.

Local demo with Postman

You can try out the REST API by using pre-prepared requests and the Postman GUI tool. Install Postman as a browser extension or stand-alone app, open the phpList 4 REST API Demo collection and click “Run in Postman”. For more information on how to install and try phpList REST API , please read the documentation.

Tools used

Reading “The Web Application Hacker’s Handbook”, helped me quite a lot in the process of reviewing the security of phpList REST API. Curl Another tool that I used was BurpSuite Community Edition, which was also mentioned in the book. Burp is widely used by security professionals to find security vulnerabilities in web applications and I had the opportunity to play around with it for this risk assessment. Burp can test any HTTP endpoint. The process is to proxy the client’s traffic through Burp and then test it in the normal way. Burp interface

I also used cURL to consume the API calls. It is an open source software command line tool that is used to transfer data with URLs.

The REST API topic has been also covered in several sites such as OWASP (The Open Web Application Security Project) REST Security, which is a good starter reference to learn about the main security challenges of REST.

On a personal note, it has been a challenging and exciting experience. I would like to share the research with the community since the found high severity risks have been resolved.

Implementation of the API during testing

Here is a technical overview of how the REST API was implemented during my testing.

Session creation

For authentication a user has to call the /api/v2/sessions route and provide username and password within the POST body:

POST /app.php/api/v2/sessions HTTP/1.1
Host: 10.211.55.4:82
User-Agent: curl/7.54.0
Accept: */*
Content-Type: application/json
Content-Length: 58
Connection: close

{
    "login_name": "admin",
    "password": "admin1234"
}

The controller then queries the existing phpList database for an administrator and user with this password:

public function postAction(Request $request): View
{
   $this->validateCreateRequest($request);
   $administrator = $this->administratorRepository->findOneByLoginCredentials(
       $request->get('login_name'),
       $request->get('password')
   );
   if ($administrator === null) {
       throw new UnauthorizedHttpException('', 'Not authorized', null, 1500567098);
   }

   $token = $this->createAndPersistToken($administrator);

   return View::create()->setStatusCode(Response::HTTP_CREATED)->setData($token);
}

The controller is creating a new session key of 256 bytes and returning the MD5 representation of it. The user can then use those credentials for authentication.

Session verification

For authentication purposes a trait AuthenticationTrait is implemented, this trait implements a function requireAuthentication:

private function requireAuthentication(Request $request): Administrator
{
   $administrator = $this->authentication->authenticateByApiKey($request);
   if ($administrator === null) {
       throw new AccessDeniedHttpException(
           'No valid session key was provided as basic auth password.',
           null,
           1512749701
       );
   }

   return $administrator;
}

When this function is invoked, it calls \PhpList\Core\Security\Authentication::authenticateByApiKey, this function is implemented as following.

As one can see, it searches the AdministratorTokenRepository for an unexpired key and then verifies whether the token belongs to an administrator:

public function authenticateByApiKey(Request $request)
{
   $apiKey = $request->headers->get('php-auth-pw');
   if (empty($apiKey)) {
       return null;
   }

   $token = $this->tokenRepository->findOneUnexpiredByKey($apiKey);
   if ($token === null) {
       return null;
   }

   /** @var Administrator|null $administrator */
   $administrator = $token->getAdministrator();
   if ($administrator === null) {
       return null;
   }

   try {
       // This checks for cases where a super user created a session key and then got their super user
       // privileges removed during the lifetime of the session key.
     // In addition, this will load the lazy-loaded model from the database,
       // which will check that the model really exists in the database (i.e., it has not been deleted).
       if (!$administrator->isSuperUser()) {
           $administrator = null;
       }
   } catch (EntityNotFoundException $exception) {
       $administrator = null;
   }

   return $administrator;
}

This is done by querying the table phplist_admintoken for the current session key.

In the controllers, authentication is enforced by calling \PhpList\RestBundle\Controller\SessionController::validateCreateRequest in every function such as the following:

public function cgetAction(Request $request): View
{
   $this->requireAuthentication($request);

   return View::create()->setData($this->subscriberListRepository->findAll());
}

Lists Route

\PhpList\RestBundle\Controller\ListController implements cgetAction, getAction and deleteAction. Those functions allow an administrator to:

Get a collection of lists
Get information about a single list
Delete a list

The information is returned to the user as a JSON string with a Content-Type of application/json:

HTTP/1.1 200 OK
Date: Thu, 21 Jun 2018 14:45:33 GMT
Server: Apache/2.4.18 (Ubuntu)
Cache-Control: no-cache, private
Content-Length: 210
Connection: close
Content-Type: application/json

{"name":"newsletter","description":"Sign up to our newsletter<h1><script>alert(1)<\/script>","creation_date":"2018-06-20T13:29:07+02:00","list_position":0,"subject_prefix":"",
"public":true,"category":"","id":2}

Subscribers route

\PhpList\RestBundle\Controller\SubscriberController implements postAction. This function allows an administrator to:

Create a subscriber

The information is returned to the user as a JSON string with a Content-Type of application/json:

HTTP/1.1 201 Created
Date: Thu, 21 Jun 2018 15:05:17 GMT
Server: Apache/2.4.18 (Ubuntu)
Cache-Control: no-cache, private
Content-Length: 219
Connection: close
Content-Type: application/json

{"creation_date":"2018-06-21T17:05:17+02:00","email":"xhenitest@xheni.me",
"confirmed":false,"blacklisted":false,"bounce_count":0,
"unique_id":"498f3de0e0b033665f58bb4b3c3f3c21",
"html_email":false,"disabled":false,"id":7}

The controller performs the required authentication checks and doesn’t expose any functionalities not yet available to superusers. The security level is thus adequate.

Security concerns and mitigation

Note: High severity risks have already been mitigated; the other risks identified have been addressed by hardening the pertinent code.

Disabled admins can still use REST API

Administrators that are disabled in phpList are still able to login using the REST API.

Mitigation: Adjust the authenticateByApiKey to check if the user is disabled. Note: This issue has already been fixed.

Invalid login attempts using the REST API are not logged. The regular web interface is logging those in the event log. From these logs you can monitor activity and potentially discover any patterns or excessive usage activity.

Mitigation: Add logging of login events to REST API.

Insecure storage of sensitive information

As the session tokens are stored unencrypted, a leak of the phplist_admintoken table will allow a malicious actor to authenticate as phpList administrator.

Mitigation: Adjust the login logic to use a strong and expensive hashing algorithm such as bcrypt or scrypt.

Insecure querying of a secret (“Timing attack”)

As the session token is stored in a VARCHAR(255) field in the database this may be vulnerable to timing attacks. An attacker may be able to infer a correct session token based on the responses. This risk is however quite a bit mitigated, as timing attacks require a close proximity to the server as well as a lot of session tokens. (due to detecting timing differences in milliseconds).

Mitigation: This would be addressed as well by using an hashing algorithm with a salt (e.g. bcrypt).

Stored Cross-Site Scripting

Some browsers such as Internet Explorer require the nosniff header to be set and potentially dangerous characters to be encoded. Otherwise other websites embedding this resource could trigger a XSS vulnerability. According to wikipedia (link )

MIME sniffing was, and still is, used by some web browsers, including notably Microsoft’s Internet Explorer, in an attempt to help web sites which do not correctly signal the MIME type of web content display correctly.[1] However, doing this opens up a serious security vulnerability,[2] in which, by confusing the MIME sniffing algorithm, the browser can be manipulated into interpreting data in a way that allows an attacker to carry out operations that are not expected by either the site operator or user, such as cross-site scripting.

So when Internet Explorer sees HTML in a page it can be tricked to execute such. That’s why the nosniff header is required, this tells the browser “do not try to magically interpret what this could be”.

Mitigation:

Add a X-Content-Type-Options header with nosniff option.
Add a Content-Security-Policy header disabling all script execution.
Add X-Frame-Options’ header and set it to DENY.
Use JSON_HEX_TAG when using json_encode. This also encoded characters such as < and >.

The security headers have been added and the fourth one is another hardening that I’m working on.

Security headers added to response

Future Development

Some additional fixes remain a work in progress and I will submit them soon. Meanwhile, everyone should feel free to open their Pull Requests and report any issues identified. Check out the contributor guidelines on GitHub to get started!

DOKU.TECH and the young spirit of Prishtina

Thu, 28 Jun 2018 21:20:23 +0000

DOKU.TECH is an annual conference in Kosova and one of the leading tech events in the Balkans that is devoted to idea sharing, igniting discussions, interactive workshops, DIY sessions, fun-filled days and musical evenings. During the past four editions, DOKU.TECH has welcomed over 5,000 attendees who came from the Balkans, Europe, and United States. This year’s DOKU.TECH motto was: “One person’s craziness, is another one’s reality.”

Official DOKU.TECH poster

DOKU.TECH in collaboration with Open Labs offered 15 participants the opportunity to take part at DOKU.TECH with cover travel and accommodation. I was very excited about going there, because I had never been in Prishtina before (Shame on me). The trip from Tirana to Prishtina was nice, not only because I read 100 pages of “A pragmatic programmer” book, but also because of stunning views of beautiful mountains, rivers and lakes and of course funny people in the bus.

Stunnning view in Kukes, Albania

Open Labs Girls at DOKU.TECH

The conference itself was good, some of the presentations were very interesting and the main hall was always full of people interested in Tech. Also, young people outside sitting and chilling out with their friends, playing games etc.

One of the interesting talks at DOKU.TECH

I had the chance to visit Prishtina Hackerspace. Do you that they even produce their own beer? I was very impressed by the nerdy space, artistically nice rooms, hacker tools and “vishnjet”( something like wild cherries).

Prishtina Hackerspace

I have to say though that it lacks diversity a bit, but it is something that it can be improved in the future. The capital city of Kosovo was smaller than I expected and a bit chaotic urban-wise, but it’s a city with a positive vibe, friendly and warm people with young spirit.

The view from Cathedral of Saint Mother Teresa, Pristina

It has a lively night life, a lovely boulevard and people who like to drink beer. All in all, I had a pleasant experience and will visit it again.

Starting my journey as a Pragmatic Programmer

Mon, 28 May 2018 15:20:23 +0000

I recently started reading The Pragmatic Programmer: From Journeyman to Master, by Andrew Hunt and David Thomas, which was published in 1999. The book is well organized in short and self-contained chapters. Each chapter has tips that offer advice on several subjects such as testing, prototyping, debugging, how to communicate effectively, exception handling, best practices and challenges.

This book is highly recommended and it’s amazing to see how a software development book could remain influential and a-must-read for this long(two decades). I have read only two chapters until now and the reason why I am writing this blog post is that I find it very useful and want to memorise as much as I can by writing and sharing some tips. I intend to do so in every two weeks. I like to challenge myself sometimes :wink: .

What is a Pragmatic Programmer?

They say it’s a style, an attitude, and a philosophy of approaching problems and their solutions. They think beyond the immediate problem, always trying to place it in its larger context and to be aware of the bigger picture. After all, without this bigger picture, how can a programmer be pragmatic? How can they make intelligent compromises and smart decisions?

Are you a pragmatic programmer?

Here are some characteristics that make you a pragmatic programmer according to the authors:

Early adopter/ fast adapter. When you have an instinct for techniques and technologies and you also like to try things out. When you grasp new things quickly and integrate it with the rest of your knowledge.
Inquisitive. When you always tend to ask questions.
Critical thinker. When you rarely take things as given and you always smell a challenge.
Realistic. When you try to understand the underlying nature of each problem you face.
Jack of all trades. When you try to be familiar with a broad range of technologies and you are able to move to new areas and challenges.

First tips

Tip #1 Care about your craft

-There is no point in developing software unless you care about it doing it well.

Tip #2 Think about your work

Think about what you’re doing while you’re doing it, Constantly be thinking, critiquing your work in real time.

Tip #3 Provide options, don’t make lame excuses

Don’t say “The Cat ate my Source Code”, but take responsibility for everything you do. Don’t say it cannot be done, but explain what it can be done to salvage the situation. Also don’t be afraid to ask or that you need help.

Tip #4 Don’t live with broken windows

Don’t leave “broken windows” (aka bad design, poor code or wrong decisions) unrepaired.

Ready for Nextcloud hackweek

Wed, 04 Apr 2018 20:20:23 +0000

After attending the Nextcloud Conference 2017 and helping out at the Fosdem 2018 Nextcloud booth, I look forward to joining the other Nextclouders again, this time for a hackweek. I’m always up for some hacking.

Fosdem 2018

Nextcloud contributors from all over the world will gather in Stuttgart for a hackweek from the 9th of April to the 13th of April. During Nextcloud hackweeks, nextclouders focus on coding: going through issues, discussing and fixing them, and so on.

Jona Azizaj and I were Rails Girls Summer of Code students working on Nextcloud during the summer 2017. RGSoC is a dedicated scholarship program that aims to foster diversity in Open Source since 2013. This scholarship offered us a great opportunity to shape and develop our programming skills more.

Team Codeaholics at Nextcloud Conference. (Photo: Christoph Wurst, Creative Commons Attribution-Share Alike 4.0 International.)

Nextcloud will be one of the RGSoC projects again this year and I am delighted to see there are so many applications submitted to this project. I’m looking forward to the Hackweek, especially because I will meet Jessica and Arati, the Rails Girls Summer of Code 2018 students, and I will share my experience from last year with them, but also work together to fix some issues. I’m planning to contribute again to Contacts App as I know it better than the other applications, Gallery App because it has some good starter issues and I would like to challenge myself a bit with also working on the Full-Text Search.

#HappyHacking :blush:

Learning advanced PHP with phpList and Treehouse

Fri, 02 Feb 2018 10:04:23 +0000

The transition from being a student to the world of real work can be quite challenging. But if you are just starting out in the tech industry, combining online learning with contributing to Open Source allows you to develop your skills and gain experience in collaborative software development and management. I am a student and Open Source enthusiast who has contributed to several projects in recent years. During the last two months, I have combined online classrooms and workshops with an internship at phpList to develop my skills and practices. This has been my journey.

Enterprise skills with online learning

Two months ago my most daunting question was which training platform to use to sharpen my PHP skills. It needed to fit my skill level and learning style. There is no single “best” course that fits everyone’s needs; we needed to find a platform which met the criteria. I was looking to extend my existing programming skills with newer and more sophisticated PHP systems and techniques. The courses needed to suit my intermediate level and include coding exercises, as I like to learn ‘by doing’. While I found many PHP courses for beginners, intermediate and advanced courses were very difficult to find. Team Treehouse was the only offering that convinced me because it covered more advanced topics such as Object Oriented PHP and testing frameworks.

How Treehouse works

Treehouse has a library which is a complete catalog of all the content that they offer. You can browse by type, topic or difficulty. Furthermore, there are different tracks to choose from. Each track is a selection of courses with a common theme, like a certain programming language or a aspect of web development. The track acts as a roadmap so you know what to learn next, those are more of a guidance though and you are not forced to pick the courses in a specific order, allowing for a modular mix of topics. A course in Team Treehouse usually consists of video lectures, project code, code challenges and quizzes. The combination of these methods of delivering content is a good means for ensuring that students will retain the knowledge of each course. I absolutely like the Treehouse’s approach to their videos. Most of them are are very short with good pacing.

PHP coding demonstration in a Treehouse video lecture

Each individual lesson within a course has a video lecture, project code to experiment with, and a “workspace” where you can make changes to the project code and see the results right away. If you have an active pro account, you can download course files such as videos and video transcript for offline learning. Over the last two months, I completed 9 Treehouse courses in all, each chosen for their real-world usefulness and relevance to phpList 3 and 4:

PHP Basics
Object-oriented PHP basics
Extending object-oriented PHP
PHP standards and best practices
PHP databases with PDO
PHP standards and best practices
PHP user authentication
Integrating PHP with databases
PHP testing

I also attended the following workshops:

Dependency Management with Composer
Basic Error Handling with PHP

Teacher’s Notes

The Teacher’s Notes for each video appear on the left-most tab below the video player. There you can find notes such as a summary of the lesson and useful links provided by the teacher. In my opinion, the links in the teacher’s notes worth the time to read because all knowledge that can improve your understanding is worth your time to read.

Quizzes and Code Challenges

A code challenge question on Treehouse

The quizzes require a certain number of correct answers to pass. The only thing that I don’t like about them is that I’m not told why my answer is wrong, especially for the fill in the blank questions. The code challenges require writing some real code to test your knowledge and skill. There are two components involved in the Code Challenge. One component is the editor interface that you interact with and this is the only component you really see and touch. The other is the component that actually evaluates the code you write to see if it is correct. The code challenges and the quizzes help you to solidify your understanding. If you pay attention to the videos and write down concepts, it makes passing the code challenges and quizzes much easier.

Workspaces

Workspace is a fully browser-based code editor. You can use it to work alongside a Treehouse course. Each Workspace has a total storage limit of 50 MB. Currently, students are allowed to have up to 100 Workspaces created at a time.

Motivational tracking tools

I earned +30 points for unlocking this badge

Team Treehouse really knows how to motivate students to complete their courses. First of all, there are badges. Everybody loves badges. Students get badges for reaching certain goals. There are always new badges being added to accompany new lessons and new courses. Another incentive tool is the motivational email you get from the teacher when you complete the course. Next is the points system. You get points in each area of Team Treehouse by completing courses and lessons. The more lessons you complete in, for example, PHP, the more points in the PHP area you get. Team Treehouse tracks both your points in each area and your total points. You also get points by posting on the Team Treehouse forum. Furthermore, it tracks your progress in percentage system. You can see what percent of the total amount of content in a given track you have completed. This is a really good measure of your progress, and it feels great to see how far you have come. These incentive methods are very good for keeping the student focused.

Treehouse community

Treehouse community is the best place to talk with your fellow students, asking questions, getting your questions answered, answering your fellow students’ questions and making it easier to make connections with like-minded folks going through the same journey as you are.

Cons

The course quality varies from teacher to teacher and the PHP courses are taught by different teachers. Some teachers may be skilled in their profession, but don’t manage to communicate well with students. Also, some of them did not offer coding challenges, but only quizzes. Furthermore, not all teachers sent out motivational emails at the end of the course which would have made for a nicer learning experience.

Getting familiar with phpList

It wasn’t the first time I took an online course, but it’s the first time I’ve been really enjoying it. But during the training time I felt like the coding exercises were not enough for me, so I asked my phpList mentor to assign me some real-world bugs to fix. The phpList source code was easy to find on on GitHub and I registered an account for myself on the project’s Mantis bug tracker. I started off with issues tagged as ‘quick-fix’ – these ones were well described and easy to fix. Soon I was working on the source code and submitting my first pull requests. This way I put my Treehouse knowledge to immediate use and my motivation got quite a boost once I saw my first PRs being merged.

Disclaimer: This article was originally published on phpList blog.

34c3 - Endlich, normale Leute...

Sun, 31 Dec 2017 15:04:23 +0000

The Chaos Communication Congress is an annual conference organized by the Chaos Computer Club. The congress features a variety of lectures and workshops on technical and political issues related to Security, Cryptography, Privacy and online Freedom of Speech. The event takes place regularly at the end of the year since 1984, with the current date and duration (December 27–30) established in 2005. It is considered one of the largest events of this kind, alongside the DEF CON in Las Vegas. This is what I read on Wikipedia before I decided to go there.

Chaos Communication Congress has been running for 34 years, and this was the first year that Congress was hosted in Leipzig. Around 15,000 people took part in this remarkable event. No doubt, it’s the biggest hacker conference in Europe. Apart from the official conference program, the CCC also offers space for assemblies, lightning talks, developer meetings, art installations, workshops, and special places for kids to play.

tuwat!

This year’s motto, “tuwat!”, which is a slang-dialect for “do something!”

My first Congress

A security professional told me how cool this conference is and convinced me to go there. But I went there with Jona, my RGSoC teammate. We arrived in Berlin one night before the CCC, and we almost missed our flixbus to Leipzig, because I wanted to see the Brandenburger Tor. What a night !!

CCC is more than a ‘hacker’ conference. It’s a community get-together and the community consists of all creatures of the web who share the common vision for an open and free technological society: hackers, programmers,hactivists, artists, philosophers, engineers, trollers, robots, aliens etc.

I have never been in other Congress Centers, but The Congress Center Leipzig (CCL) was huge and stunning. There was one huge hall (Hall 2), which was filled with all the assemblies and two halls filled with the big lecture halls. The coolest hall to hang out was the one with the Assemblies where hackerspaces and interest groups get together and bring their computers and coolest toys, doing what they do best —hacking.

There was also this “pool area” which was very outstanding and they played very good music. Nerds know how to party ;).

The big glass hall allowed daylight consumption and made it obvious when that was missing.

I was very amazed, especially at night, by all those neon lights, art decorations, nerdy atmosphere.

I obviously saw some talks about security, and even about open source satellites.

I visited assemblies, played some games, listened to robotic music, met some old friends and of course grabbed a lot of stickers. Totally enjoyable experience! I spend most of the time at Nextcloud assembly, together with other Nextclouders. By the way, on the third day, I was wearing the Nextcloud T-shirt and guess what? People came to me and asked about Nextcloud or just said: “I love Nextcloud, awesome software”. The real soul of the Congress is people getting together, making something crazy and temporary, learning new things, and simply having fun. I have seen strange things. What really got my attention was an impressive 3D zoetrope.

Also the pneumatic robot-dog-horse-with-gasmask, which is driven by an Arduino.

This one scared me.

Make Mate, not War

Do you know that Mate is geeks’ favourite drink?

Back in the “Real World”

Now that I have been to a Chaos Communication Congress, I know that feeling, the strange realization after it’s all over and that you’re back in the “real world”. It’s somehow alienating in comparison to being surrounded by computer geeks, artists, hackers, coders and other like-minded individuals over the four days of the Congress. There was this hand-written poster “Endlich, normale Leute” — “At last, normal people” — which is irony piled on irony but the sentiment is still right for certain strange values of “normal”. :rocket:

Random photos taken with my Samsung Galaxy Note 3

Git Workshop at Open Labs

Wed, 08 Nov 2017 10:04:23 +0000

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency. It is the most popular VCS used by thousand developers.

Before the Rails Girls Summer of Code, I barely had any experience with Git and I knew only some concepts. Thanks to the Git documentation and the very friendly community over at Nextcloud, I learned many new Git commands.:).

I am a member at Open Labs Hackerspace and I have noticed that many members of our community are interested in learning Git. Thus, I decided to organize a workshop about Git. Why not? Knowledge sharing is very important to me and it is the main reason why I advocate Open Source. It’s not tham I am a Git expert, not at all, but still I think that If know something that others don’t, share it with them. I talked with Sidorela, another open source enthusiast member of Open Labs about it and together we decided to host the first Git workshop at Open Labs. We proposed the idea of organizing a workshop at Open Labs Forum and as I expected they were interested in learning some commands. The workshop went very good. We talked a bit about Git history and Git design in general and then we explained some concepts to them. We practiced and run the most useful git commands.

A link of the presentation can be found on my Personal GitHub repo. The feedback that they gave us after the event was really good, and it encourages me to continue with Git workshops and not only.

LibOCon and libre Ladies...

Thu, 12 Oct 2017 15:04:23 +0000

LibOCon is the annual gathering of the LibreOffice community. At LibOCon, LibreOffice users gather to network and meet key LibreOffice developers, designers, localizers, documenters, supporters and marketers, and to learn about the latest in LibreOffice development. I have been a LibreOffice user for many years and this year I joined the LibreOffice Conference from 11-13 October in Rome, Italy.

Suela and Xheni during their presentation. Credits: Redon Skikuli CC-BY-SA 4.0

LibOCon 2017 was hosted inside historical buildings, the property of the City of Rome. Suela and I talked about “How to retain new contributors?”, “Our experience as newcomers” and “Contributions to open source” - survey. Here are some of the results of the survey:

We had some interesting answers when we asked them “How do community activities affect your experience as a contributor?”

“It makes me feel that I am doing the things right. Each time I generate a contribution, I feel happiness because I am spending time of my life for the benefit of projects that will useful for other people around the world while I sharing this experience with other human beings”

“Gain experience and new friends ”

“In 1:1/groups brainstorming is much faster and enjoyable”

“Get to know more people in the same field of interests as mine”

“Community gives you outside connections, adds purpose and enjoyment to the work we’re all doing”

During LibOCon and HackFest I had the opportunity to meet other open source ladies who contribute to LibreOffice and we took this picture <3. LibreLadies CC-BY-SA 4.0

I had a great time in Rome. Beautiful city and good friends.

Ps: The next LibOCon will be held in Tirana. See you there! Roman Forum CC-BY-SA 4.0

CryptoParty in Tirana

Sun, 01 Oct 2017 15:04:23 +0000

Privacy is the space in which ideas are developed, to retreat into whenever you want. This space is not only physical but digital as well.

What is a CryptoParty?

CryptoParties are free and open for everyone, but especially those without prior knowledge, who haven’t yet attended one. CryptoParty is a decentralized movement with constantly happening activities in the entire world. The goal of this movement is sharing as much knowledge to as many individuals as possible on how to protect ourselves in the digital world. This worldwide effort introduces the basis of cryptography both in theory and practice, such as encrypted communication, prevention of espionage when navigating on the internet, anonymity on Tor netwyork, cryptography with public key, storage encryption, Virtual Private Networks (VPN) etc. The project consists of a series of workshops free and open for everyone .

The first CryptoParty in Albania

To join this worldwide effort and to inform about the dangers of the digital world, the importance of online privacy and exchange of practical knowledge to protect our privacy, Open Labs with the support of Arjen Kamphuis and Ardian Haxha have organized CryptoParty Tirana.

CryptoParty Albania. Credits: CC-BY-4.0 Andis Rado

The CryptoParty took place at Innovation Hub Tirana and gathered many technology enthusiasts , developers, students, academics, journalists and people who are concerned about privacy and information security. It was the first CryptoParty in Albania and it was really well-organized, with multiple talks and workshops like: private browsing, file-encryption, email-encryption, debian installation etc.

Data encryption workshop. Credits: CC-BY-4.0 Andis Rado

However, there were people who come down on the side of the government: “I have nothing to hide”… The nothing to hide argument states that government surveillance programs do not threaten privacy unless they uncover illegal activities, and that if they do uncover illegal activities, the person committing these activities does not have the right to keep them private. Hence, a person who favors this argument may state “I’ve got nothing to hide” and therefore does not express opposition to government surveillance.An individual using this argument may say that a person should not have worries about government or surveillance if he/she has “nothing to hide.”-Wikipedia.

My point is:

“Arguing that you don’t care about the right to privacy because you have nothing to hide, is no different than saying you don’t care about free speech because you have nothing to say.” – E. Snowden.

Emilio Mordini, philosopher and psychoanalyst, argued that the “nothing to hide” argument is inherently paradoxical. People do not need to have “something to hide” in order to hide “something”. What is relevant is not what is hidden, rather the experience that there is an intimate area, which could be hidden, whose access could be restricted. Psychologically speaking, we become individuals through the discovery that we could hide something to others.