Brussels, the 6 June 2018

Dear Data Protection and IT Professionals,

The EU’s new law General Data Protection Regulation (GDPR for short) applies from 25 May 2018 onwards. It consists of 99 articles and 173 recitals that fill together 88 pages in the official publication. Different than a technical standardisation document, many of those articles must first be interpreted under consideration of case law from past judgements and published opinions of data protection authorities. As a result, even compliance questions for relatively simple applications such as a mailing list cannot be answered without profound study of many legal documents. Complex concepts such as privacy by design and pseudonymisation are the source for many questions yet to be answered.

At the same time, the tech industry has worked for many years on solutions to setup fairly easy personal data processing applications. Thanks to e.g. Google Sheets, Doodle, Mailchimp, or Wordpress, even non-experts can nowadays become data controllers with only few clicks or swipes. The development of peer-to-peer protocols for distributed databases, e.g. Bitcoin, Dat, or IPFS, has the potential to further lower the initial hurdle to become a data controller—up to the point of unconsciousness of the controller.

To allow for a rapid adoption of data protection obligations, and in turn an overall increase of data hygiene, training for data controllers and processors is needed and must be accessible not only for those who can afford to dedicate resources, but at best to all data controllers and processors. For this reason, we call for the foundation of a collaborative Internet knowledge database under a free creative commons license to ensure its broad and continuous availability.

So far, freely accessible practical advice is often, if not mostly, offered by stakeholders that may have conflicting business interests. Online service providers, law firms and training institutes may gear advice towards their own services. Restrictive licenses may prevent good advice from being freely shared. Erroneous or out-dated advice may not be updated. Especially, the latter is important as GDPR compliance is a moving target. New judgements or advances in state-of-the-art privacy engineering¹ require continuous updates.

As data protection is an interdisciplinary field, the knowledge database should be co-authored jointly by legal experts and computer engineers and must accommodate the needs of both communities. The platform Stack Exchange provides communities with a software solution for collaborative freqently asked questions (FAQ). The platform is well-known to most computer engineers for offering stackoverflow.com and started more recently law.stackexchange.com². The collaboration is organised as follows:

• Questions, answers and meta-data are published in the Internet under a free license (cc by-sa) and are available for download in machine-readable form.
• Anybody can ask or answer a question.
• The best answers are voted to the top.
• Users earn reputation points for every vote they receive.
• Users unlock privileges as they earn reputation, like the ability to comment or vote.
• Moderators are elected among users, and top users have access to special tools to help moderate.

To provide for an overall high quality of answers, references to primary sources shall be used where opinions are inevitable. This rule is also employed by Wikipedia and can be enforced by both moderators and top users.

The signatories support the foundation of such a collaborative data protection knowledge database in form of frequently asked questions.

Authors and Initial Signatories:

• Robert Riemann, Brussels
• Xavier Lavayssière, Paris
• Franz Ritschel, Köln

Contact:

If you want to receive updates or if you have questions, please send your request to gdpr-faq@riemann.cc. If you want to become a signatory, send a mail to gdpr-faq-sign@riemann.cc. Requests in French language are answered at gdpr-faq@lesbricodeurs.fr and for signing at gdpr-faq-signer@lesbricodeurs.fr.

List of Recipients:

• the Internet Privacy Engineering Network (IPEN for short), an initiative of the European Data Protection Supervisor
• Stack Overflow, the company behind the famous knowledge database stackoverflow.com for programmers
• the European Digital Rights (EDRi for short), an association of civil and human rights organisations from across Europe
• the participants of the 2018 edition of the Annual Privacy Forum (APF for short)
• the organisation committee of the international conference Computers, Privacy and Data Protection (CPDP for short)
• and non-disclosed individual recipients

Brüssel, den 6. Juni 2018

Sehr geehrte Datenschutz- und IT-Expert_innen,

Die neue EU-Datenschutz-Grundverordnung (DSGVO) gilt ab dem 25. Mai 2018. Sie besteht aus 99 Artikeln und 173 Erwägungsgründen und umfasst 88 Seiten in der amtlichen Fassung. Anders als technische Normen ist die DSGVO ein Gesetz und wird von der Rechtsprechung und den Rechtsanwender, allen voran den Datenschutzbehörden, durch Urteile bzw. Stellungnahmen ausgelegt. Dadurch können auch Fragen zu simplen Anwendungen wie Mailinglisten nicht ohne gründliches Studium vieler Rechtsdokumente beantwortet werden. Komplexe Konzepte wie Privacy by Design oder Pseudonymisierung sind erst recht Quelle vieler Fragen, die es zu beantworten gilt.

Gleichzeitig arbeiten Technologiefirmen schon seit Jahren an Lösungen, um die Verarbeitung von persönlichen Daten relativ einfach zu gestalten. Dank Google Sheets, Doodle, Mailchimp oder Wordpress können heutzutage auch Nicht-Experten mit wenigen Klicks zu Verantwortlichen im Sinne der DSGVO zu werden. Peer-to-Peer-Protokolle für verteilte Datenbanken, z.B. Bitcoin, Dat oder IPFS könnten die Zugangsbarrieren weiter abbauen—bis hin zur Unmerklichkeit der Verarbeitung seitens der Verantwortliche.

Um aber Datenschutzverpflichtungen schnell und wirksam übernehmen zu können und um damit insgesamt einen Beitrag zu einer höheren Datensicherheit zu leisten, sind wohl oder übel Schulungen für Verantwortliche und Auftragsverarbeiter nötig. Diese dürfen nicht nur wenigen Profis zugänglich sein, sondern sollten allen Verantwortlichen und Auftragsverarbeitern offen stehen. Aus diesem Grund rufen wir zur Gründung einer englisch-sprachigen, kollaborativen Internet-Wissensdatenbank auf, die unter freier Lizenz betrieben werden soll um eine hohe Reichweite zu ermöglichen.

Bislang wurden frei zugängliche praktische Ratschläge oft, wenn nicht sogar überwiegend, von Diensteanbietern angeboten, die eigene, eventuell entgegengesetzte, Geschäftsinteressen verfolgen. So geben etwa viele Online-Diensteanbieter, Anwaltskanzleien oder Ausbildungsinstitute Ratschläge um auch eigene Diensteistungen zu bewerben. Restriktive Lizenzen der Ratschläge verhindern, dass guter Rat kostenlos weitergegeben werden kann. Fehlerhafte und veraltete Ratschläge können zumeist nicht verbessert werden. Letzteres ist besonders wichtig, da die Einhaltung der DSGVO ein bewegliches Ziel ist, denn durch neue Urteile oder Fortschritte in der modernen Privatsphäre entwickelt sich der Datenschutz ständig weiter¹. Ratschläge müssen deshalb kontinuierlich angepasst werden können.

Da Datenschutz ein interdisziplinäres Feld ist, sollte die Wissensdatenbank gemeinsam von Rechts- und IT-Experten angelegt werden und muss daher die Bedüfnisse beider Gruppen beachten. Die Plattform Stack Exchange bietet für die Beantwortung häufig gestellter Fragen (FAQ) eine passende Softwarelösung. Die Plattform ist den meisten IT-Experten bereits von der Seite stackoverflow.com vertraut und bietet mit law.stackexchange.com² seit kurzem auch ein englisch-sprachiges Angebot für Rechts-Experten. Die Zusammenarbeit ist stets wie folgt organisiert:

• Fragen, Antworten und Metadaten werden im Internet unter einer freien Lizenz (cc by-sa) veröffentlicht und stehen in maschinenlesbarer Form zum Download bereit.
• Jede Person kann eine Frage stellen oder beantworten.
• Die besten Antworten werden an die Spitze gewählt.
• Nutzer_innen erhalten für jede abgegebene Stimme Reputationspunkte.
• Benutzer entsperren Privilegien, wenn sie sich Reputation verdienen, und können dann zum Beispiel Inhalte kommentieren oder bewerten.
• Moderatoren werden unter Benutzern ausgewählt, und Top-Benutzer bekommen die Möglichkeit bei der Moderation zu helfen.

Um eine insgesamt hohe Qualität der Antworten zu gewährleisten, soll auf Primärquellen verwiesen werden, wenn Meinungen unvermeidbar sind. Diese Regel wird unter anderem von Wikipedia angewendet und kann sowohl von Moderatoren als auch von Top-Benutzern durchgesetzt werden.

Die Unterzeichner unterstützen die Gründung einer solchen kollaborativen Wissensdatenbank zum Thema Datenschutz in Form von häufig gestellten Fragen (FAQ).

Autoren und Erstunterzeichner:

• Robert Riemann, Brüssel
• Xavier Lavayssière, Paris
• Franz Ritschel, Köln

Kontakt:

Wenn Sie Updates erhalten möchten oder Fragen haben, senden Sie bitte Ihre Anfrage an gdpr-faq@riemann.cc. Wenn Sie Unterzeichner werden möchten, senden Sie eine E-Mail an gdpr-faq-sign@riemann.cc. Anfragen in Französischer Sprache werden von gdpr-faq@lesbricodeurs.fr beantwortet and von gdpr-faq-signer@lesbricodeurs.fr um Unterzeicher zu werden.

Liste der Empfänger:

• das Internet Privacy Engineering Network (kurz IPEN), eine Initiative des Europäischen Datenschutzbeauftragten
• Stack Overflow, das Unternehmen hinter der bekannten Wissensdatenbank stackoverflow.com für IT-Experten
• der Verband European Digital Rights (kurz EDRi) von Bürger- und Menschenrechtsorganisationen aus ganz Europa
• die Teilnehmer des Annual Privacy Forums (kurz APF) 2018
• das Organisationskomitee der internationalen Konferenz Computer, Privacy and Data Protection (kurz CPDP)
• und weitere einzelne Personen

Bruxelles, 6 giugno 2018

Cari professionisti della protezione dei dati e dell’IT,

Il nuovo Regolamento Generale sulla Protezione dei Dati (in breve RGPD) si applica a decorrere dal 25 maggio 2018. È costituito da 99 articoli e 173 considerando che occupano 88 pagine nella pubblicazione ufficiale. A differenza di un documento di normalizzazione tecnica, molti di questi articoli devono essere prima interpretati alla luce della giurisprudenza già consolidata e dei pareri precedentemente emanati dalle autorità di protezione dei dati. Di conseguenza, persino questioni di conformità per applicazioni relativamente semplici come una mailing list non possono essere risolti senza uno studio approfondito di diversi documenti giuridici. Concetti complessi come la privacy by design e la pseudonimizzazione sono fonte di molte domande a cui si deve ancora rispondere.

Allo stesso tempo, da molti anni nel settore dell’alta tecnologia si lavora a soluzioni agili che permettano la raccolta e il trattamento dei dati personali. Grazie a Google Sheets, Doodle, Mailchimp, o Wordpress, anche i non esperti, oggigiorno, possono diventare responsabili del trattamento di dati personali in pochi clic o passaggi. Lo sviluppo di protocolli peer-to-peer per database modulabili, come Bitcoin, Dat o IPFS, è in grado di ridurre ulteriormente le difficoltà iniziali per diventare responsabile del trattamento di dati, fino ad uno stadio di inconsapevolezza del responsabile.

Per consentire una rapida adozione degli obblighi di protezione dei dati e, di conseguenza, un aumento generale della qualità dei dati, è necessaria una formazione per i responsabili del trattamento dei dati e gli incaricati del trattamento e deve essere accessibile non solo a coloro che possono permettersi di dedicarvi le risorse. Per questo motivo, chiediamo la creazione di una banca dati di conoscenze collaborativa su internet sotto la licenza Creative Commons per garantire la sua ampia e continua disponibilità.

Finora, i consigli pratici liberamente accessibili sono spesso, se non per lo più, offerti da parti interessate che possono avere interessi commerciali in conflitto. Fornitori di servizi online, studi legali e istituti di formazione possono orientare la consulenza verso i propri servizi. Le licenze restrittive possono impedire che un buon consiglio venga condiviso liberamente. I consigli errati o datati potrebbero non essere aggiornati. Quest’ultimo punto è particolarmente importante in quanto la conformità al RGPD è un obiettivo mobile. Nuove sentenze o avanzamenti tecnici in materia di protezione della vita privata¹ richiedono aggiornamenti continui.

Poiché la protezione dei dati è un settore interdisciplinare, la banca dati di conoscenza dovrebbe essere redatta congiuntamente da giuristi e ingegneri informatici e soddisfare le esigenze di entrambe le comunità. La piattaforma Stack Exchange fornisce alle comunità una soluzione software per domande frequenti (FAQ) collaborative. La piattaforma è ben nota alla maggior parte degli ingegneri informatici via stackoverflow.com e ha avviato più recentemente law.stackexchange.com². La collaborazione è organizzata come segue:

• Le domande, le risposte e i loro metadati sono pubblicati su internet sotto una licenza gratuita (cc by-sa) e sono scaricabili e leggibili da dispositivo elettronico.
• Chiunque può chiedere o rispondere a una domanda.
• Le risposte migliori vengono votate.
• Gli utenti guadagnano in reputazione per ogni voto che ricevono.
• Gli utenti sbloccano dei vantaggi attraverso la reputazione guadagnata, così come la possibilità di commentare o votare.
• I moderatori sono eletti tra gli utenti e i principali utenti hanno accesso a strumenti speciali per aiutare a moderare.

Per fornire un’alta qualità globale delle risposte, i riferimenti alle fonti principali dovrebbero essere utilizzati laddove vi siano dei punti soggetti ad opinioni divergenti. Questa regola è anche utilizzata da Wikipedia e può essere applicata dagli moderatori e dagli utenti principali.

I firmatari supportano la creazione di tale banca dati collaborativa di conoscenze sulla protezione dei dati collaborativo sotto forma di domande frequenti.

Autori e firmatari iniziali:

• Robert Riemann, Brüssel
• Xavier Lavayssière, Paris
• Franz Ritschel, Köln

Contatto:

Se si desidera ricevere aggiornamenti o se si hanno domande, si prega di inviare la richiesta a gdpr-faq@riemann.cc. Se si desidera diventare firmatario, si prega di inviare una mail a gdpr-faq-sign@riemann.cc. Le richieste in lingua francese sono da indirizzare a gdpr-faq@lesbricodeurs.fr e per la firma a gdpr-faq-signer@lesbricodeurs.fr.

Elenco dei destinatari:

• Internet Privacy Engineering Network (IPEN), un’iniziativa del garante europeo della protezione dei dati
• Stack Overflow, la società dietro il famoso database di conoscenze stackoverflow.com per i programmatori
• European Digital Rights (EDRi), un’associazione di organizzazioni a difesa dei diritti civili e umani di tutta Europa
• i partecipanti all’edizione 2018 dell’Annual Privacy Forum (APF)
• il comitato organizzativo della conferenza internazionale Computer, Privacy and Data Protection (CPDP)
• una lista di singoli destinatari

GRUB_DISABLE_SUBMENU="y"

The openSUSE Conference 2018

I visited the openSUSE conference this year, it took place in Prague, at the same place as few years ago. You can check the schedule and the list of the talks here.

The Interesting Topics

Here are some interesting sessions I visited, for the complete list see the schedule link above.

• The openSUSE Leap 15.0 has been released!

• If you want to share a service without a having a public IP address the tor network might be an option. Using setting up a service using Docker makes it really easy.

• The package dependencies can be improved using Supplements dependency this way:

  Supplements: (foo and bar)
  

  This would automatically install the package when both packages are installed.

• The openSUSE distribution is also yours, openSUSE is what you make it.

• The openSUSE Kubic is a Tumbleweed flavor designed specially for running container workloads.

• There is a tumbleweed-cli package which makes using the Tumbleweed snapshots much easier.

• The transactional updates provide a completely new way how to update the running system.

• The btrfs filesystem provides a lot of interesting features. But if something goes wrong it might a bit tricky to fix it. The most important thing is that the btrfs check --repair command should used as the very last option (if at all). There are other more safe options to try first.

• Using the LetsEncrypt certificates should be much easier in the openSUSE Leap 15.0 because the automatic certificate renewal is supported out of box.

• If you miss some packages in SLE which are present in openSUSE then the SUSE PackageHub might help you.

• The OBS (Open Build Service) can also build container images, that can help with testing and distributing your packages. If you want to start in an easy way then you can choose from many image templates.

• If you want to try the openSUSE Kubic you might be interested in some basic concepts behind.

• Developing the community and the enterprise products separately has many disadvantages, it is much better to develop them together.

Portainer

One of the Kubic presentations mentioned the portainer.io project which looks really interesting.

If you are new to the Docker and the container world and you would like to use some GUI at the beginning to make the start easier than the portainer.io project looks very interesting. It provides a nice web UI for managing the Docker containers. And obviously it is provided as a Docker image.

What is nice that starting it is basically a matter of running two commands:

docker volume create portainer_data
docker run -d -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data portainer/portainer

Then point your web browser to http://localhost:9000/ and that’s it!

Conclusion

The conference was really good and I’d like to say thank you to the presenters, the organization team and the sponsors to make this happen!

Challenge:

Root-cause:

Resolution:

This post has been migrated to my new blog that you can find here:

https://pureooze.com/blog/posts/2018-05-21-unit-testing-browser-extensions/

In April I became the maintainer of Saka, a browser extension that allows users to search through their tabs, bookmarks and history. The original goal of Saka was to provide an elegant tab search but this soon evolved to include recently closed tabs, bookmarks and history when the original maintainer eejdoowad recognized that users search for tabs the same way they search bookmarks and history. This was an important insight and it has helped make Saka a valuable productivity tool.

When I became the maintainer I was surprised at the absence of tests in the project. There were several components with complicated logic but no tests to be found anywhere. One of the most important things I have learned as a developer is that tests are the easiest ways to write reliable, easy to refactor code. Was the old maintainer just lazy? Did he simply not care about the quality of his code? No. The opposite in fact, he cared a lot.

The issue is that the lack of documentation on the topic means that almost no one is able to test their extension. Having no confidence in my ability to make changes without breaking the code, this was a big problem. But as fate would have it after trying a dozen different approaches I ended up finding a solution.

Why We Test

As developers we want to be sure that the code we write today is not going to become a burden to maintain later in the lifetime of the application. One way we avoid creating these burdens is by writing tests. The great thing about tests is that outside of just verifying the behavior of functions, tests allow us to provide documentation for future developers. For example by creating unit tests we declare the valid inputs and outputs for a given function. This makes it easier to refactor code because we can have confidence that our code is working correctly when all our tests pass.

The Testing Approach

This post will focus on setting up the environment and writing some basic unit tests. I have a separate post at this link which you can use to perform integration testing.

To read the rest of this post it can be found on my new blog here:

https://pureooze.com/blog/posts/2018-05-21-unit-testing-browser-extensions/

Unit Testing Browser Extensions was originally published in Information & Technology on Medium, where people are continuing the conversation by highlighting and responding to this story.

We always enjoy that new people join openSUSE community and help them in their first steps. Because of that, openSUSE participates again in GSoC, an international program in which stipends are awarded to students who hack on open source projects during the summer. We are really excited to announce that this year four students will learn about open source development while hacking on openSUSE projects. The coding period started last week, so our students are already busy hacking and they have written some nice articles about their projects. :blush:

Matheus de Sousa Bernardo

Matheus is a Software Engineering student in the University of Brasília. He will be working in Trollolo, together with his mentors Ana Martínez (me :stuck_out_tongue_winking_eye:) and Cornelius Schumacher. Trollolo is a cli-tool which helps teams using Trello to organize their work. Matheus’ project includes improving Trollolo’s API and workflow. If you want to know more about him and his project, check his beginning blog post: https://matheussbernardo.me/gsoc/2018/04/24/hello-internet-gsoc

Xu Liana

Xu is a Software Engineering student in the Chongqing Normal University, China. She will work, together with her mentors ZhaoQiang, epico and Hillwood Yang, in integrating Cloud Pinyin (the most popular input method in China) on ibus-libpinyin. Check her beginning blog post with more details about her and the project: https://liana.hillwoodhome.net/2018/05/20/the-blog-for-the-first-week-during-gsoc-libpinyin-project-coding

Ankush Malik

Ankush is pursuing a Bachelor of Technology in Computer Science in the Maharaja Agrasen Institute of Technology, India. He will be working on improving people collaboration in the Hackweek tool, together with his mentors David Kang and Stella Rouzi. He just released his GSoC Journey blog post which you can find here: https://medium.com/@ankushmalik631/my-gsoc-journey-4f02818fdb8d

Asad Syed

Asad is from Pakistan and is studying a Masters degree in Informatics at the Technical University of Munich, Germany. He will develop a container-based backend for openQA with the help of his mentors Santiago Zarate, Ettore Di Giacinto and Stephan Kulow. Read here about his experiences with openSUSE and past participations in Google Summer of Code: https://medium.com/asadpiz/google-summer-of-code-2018-with-opensuse-part-1-9f514ac2e7ae

As you see, there is a lot of great work coming in from our new talented contributors. Stay tuned because they will keep blogging about their GSoC experience! :wink:

I am incredibly happy because of three big things that are going on in librsvg right now:

1. Paolo Borelli finished porting all the CSS properties to Rust. What was once a gigantic RsvgState struct in C is totally gone, along with all the janky C code to parse individual properties. The process of porting RsvgState to Rust has been going on since about two months ago, and has involved many multi-commit merge requests and refactorings. This is a tremendous amount of really good work! The result is all in Rust now in a State struct, which is opaque from C's viewpoint. The only places in C that still require accessors to the State are in the filter effects code. Which brings me to...

2. Ivan Molodetskikh, my Summer of Code student, submitted his first merge request and it's merged to master now. This ports the bookkeeping infrastructure for SVG filters to Rust, and also the feOffset filter is ported now. Right now the code doesn't do anything fancy to iterate over the pixels of Cairo image surfaces; that will come later. I am very happy that filters, which were a huge barrier, are now starting to get chipped away into nicer code.

3. I have started to move librsvg's old representation of CSS properties into something that can really represent properties that are not specified, or explicitly set to inherit from an SVG element's parent, or set to a normal value. Librsvg never had a representation of property values that actually matched the SVG/CSS specs; it just knew whether a property was specified or not for an element. This worked fine for properties which the spec mandates that they should inherit automatically, but those that don't, were handled through special hacks. The new code makes this a lot cleaner. It should also make it easier to copy Servo's idioms for property inheritance.