Free Security 2018 – yet again a pleasure to participate!

You might know that Alex, the Senior Drupal Architect of WS Agency, participated in Free Security congress in 2017. It is the biggest international annual IT event in the Southern Mexico. This year Alexander was also invited to participate in the congress where he dedicatedly participated during the week of Oct 1 – Oct 5.

If you are interested in more details about the previous year, refer to the previous blog entry, https://ws.agency/blog/free-security-2017-congress.

In short, it’s a 3 days intensive conference hosted and organized with the facilities of the Instituto Nacional de Tecnologico de Tuxtepec, Oaxaca. Topics covered this year varied anywhere between personal data privacy, network security, Linux kernel, and much more.

Based on experience from previous year, Alexander proposed a list of sessions and workshops. After selection process the following were accepted:

• 1 hr introduction session to Linux kernel

• 10 hrs workshop on Linux kernel (yes, it was a very ‘juicy’ workshop! Never Alex did have a chance to talk continuously for so long about kernel!)

• 10 hrs workshop on HTTP protocol

It comes without saying, that by the end of the congress Alex stood happy, satisfied, and.. voiceless (21 hrs of talks in 3 days).

Introductory session to Linux kernel

So it all began with a one hour talk about how kernel works, a nearly impossible mission one would say. Kernel is a very complex and versatile organism and it originally appeared a great challenge to Alexander. However, while participating as a speaker in another conference in Albania Alex had a chance to see how a speaker managed to deliver a very intensive and full of hard facts talk on Linux kernel in 30 (!) minutes. After seeing it done in 30 minutes, 60 in fact seemed even excessive.

During these 60 minutes we have explored the concepts of kernel vs user mode of execution, the concept of a user, a file, a process. Once equipped with these primitive structures we peaked into how processes interact with files (file descriptors) and block storage device works. Lastly, we touched the topic of RAM memory and the concept of virtual memory to enforce appropriate security and to amplify physical RAM with a swap partition.

Alexander’s main concern was the difficulty and intensiveness of the talk. Thanks to occasional jokes and visual materials it was a success – from audience reaction it was obvious that attendees had followed the speaker and learnt a great deal about how Linux works.

Linux kernel workshop

One hour talk acted more of a teaser to the workshop which followed next day. Unfortunately, the format of workshop implied a much fewer number of attendees. So the intention was to quickly expose a greater audience to low-level Linux while allowing those truly interested in the subject to come and explore the subject in much bigger depth during the workshop.

Throughout the 10 hours of workshop it seemed that Alexander at times was running out of presentation tools – he would project a VM Ubuntu terminal onto the whiteboard and would draw with markers on top of the projected image or would keep running back and forth between the laptop and the white board, constantly saying something, moving his arms all over the place… In short, Alex was very enthused with the opportunity to share his 6 years of Linux experience with the audience.

It was a myriad of topics covered, just to mention few of them:

• how processes are getting created in Linux

• most common commands and syntax of Bash

• [custom] login shell; account information storage (/etc/{passwd,shadow})

• partitions, file systems, inodes, blocks of data, mounting/unmounting

• file permissions, sticky user and group bits

• difference between interpreting a textual file and executing a compiled binary from Linux kernel perspective

• CPU consumption, load average… To much of Alexander’s disappointment we would probably need additional 2 hours to cover the question of process scheduling on a CPU

• Process memory: pages, copy-on-write, in-RAM file system cache, swap, OOM killer

HTTP protocol workshop

Lastly, on the 3rd day there was another 10 hours workshop executed by Alexander and dedicated to HTTP protocol.

As a warm-up we embraced an overview of TCP/IP, then moved on to actual HTTP 1.1 specification: client, server, request, response, headers, body. After ten whiteboards-full of pictures and diagrams the attendees were exposed to the protocol in a nutshell.

From there on important consequences of the HTTP protocol were considered, such as security (stealing of cookie/session), techniques for caching on HTTP level and other performance boost tricks.

To make it more practical, once equipped with understanding of how HTTP works, the students went ahead and analyzed the homepage of Facebook in terms of the protocol.

Afterword

Alexander would like to express his enormous gratitude towards the organizers of the Free Security 2018 congress. As it always happen in Latin America, speakers received nothing but cheerful attentive hospitality from the staff. They are the ones who made it happen!