DOCSLIB.ORG

Artikel Open Source Im Visier

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Artikel Open Source Im Visier Artikel Open Source im Visier André Gasser ISPIN AG Version 1.1 21. Februar 2011 Inhaltsverzeichnis 1 Summary 3 2 Einleitung 3 3 Blick in die Vergangenheit 4 4 Schutzmassnahmen 6 4.1 Für Plattform-Betreiber . 6 4.2 Für Software-Entwickler . 7 4.3 Für Endbenutzer . 8 5 Fazit 9 6 Quellennachweis 9 2 1 Summary Angrie auf Open Source Projekte häufen sich in letzter Zeit. Aktuellstes Ereignis ist der Angri auf die SourceForge-Infrastruktur Ende Januar 2011. Es scheint, als hätten die Angreifer einen neuen und zugleich eektiven Weg gefunden, um Schadcode zu verbreiten. Gelingt es Angreifern erstmal, Zugri auf die kritischen Server der Hoster zu erhalten, so besteht für Angreifer die Möglichkeit, unbemerkt Schadco- de in dort gehostete Software-Projekte einzuschleusen. Betreiber, Software- Entwickler und Endbenutzer sollten sich der Gefahren bewusst werden und entsprechende Gegenmassnahmen vorsehen. Dieser Artikel zeigt anhand vergangener Ereignisse auf, welchen Risiken die Betreiber von Quellcode-Repositories, Software-Entwickler und Endbe- nutzer ausgesetzt sind und wie sie sich dagegen schützen können. Dieser Artikel erhebt keinen Anspruch auf Komplettheit. Feedback zu diesem Artikel nimmt der Autor gerne entgegen. 2 Einleitung Der gezielte Angri vom 28. Januar 2011 auf die SourceForge-Server zeigen es deutlich: Angreifer haben ein neues und zugleich lukratives Ziel für Angrie gefunden: Hoster von Open Source Software. Der Angri auf die SourceForge-Infrastruktur wurde noch rechtzeitig erkannt. Gemäss SourceForge stellten die Administratoren ungewöhnliches Verhalten auf einigen der Server fest. Als Folge davon wurden einzelne Diens- te vom Netz genommen. Den Angreifern gelang es dabei, über ein Root Privilege Escalation Vul- nerability Schadcode auf einem SSH-Server von SourceForge zu platzieren, der Passwörter aufzeichnen sollte. Dank der schnellen Erkennung des An- gris und einer gut durchdachten Netzwerk-Segmentierung konnte die wei- tere Ausbreitung des Angris verhindert werden. Wäre der Angri unent- deckt geblieben, hätten die Angreifer über legitime Zugänge zur SourceForge- Infrastruktur verfügt und wären somit in der Lage gewesen, gezielt Schadco- de in dort gehostete Open Source Projekte einzuschleusen. Dieser wäre dann wohl verbreitet worden, bevor die betroenen Projektbetreiber das rechtzei- tig bemerkt hätten. Obwohl gemäss SourceForge keine Projekte direkt mit Schadcode belastet wurden, war die Infrastruktur doch während rund zwei Wochen nicht voll ein- satzbereit. Als präventive Massnahme wurde zudem eine globale Passwort- Reset-Kampagne initiiert, bei dem die Passwörter der SourceForge-Accounts zurückgesetzt wurden. In der Folge mussten alle Konteninhaber ihre Pass- wörter neu vergeben. 3 3 Blick in die Vergangenheit Was im Fall SourceForge für Aufsehen sorgte, passierte nicht zum ersten Mal. Schon in der Vergangenheit versuchten Kriminelle, sich Zugang zu den Servern von diversen Linux-Distributionen zu verschaen, um so Schadcode in die Pakete der Distributionen einzuschleusen. Man wollte bereits da die Autoupdate-Mechanismen der Distributionen missbrauchen, um Schadcode zu verteilen. Ein sehr lohneswertes Ziel für einen solchen Angri sind dabei die Signing- Server, welche die Pakete jeweils mit dem Schlüssel des Projekts signieren. Bei der Installation der Pakete auf den Clients werden jeweils die Signatu- ren überprüft. Falls es dem Angreifer gelingt, die Schlüssel zu kopieren und dessen Passphrase zu erraten oder anderweitig in Kenntnis zu bringen, ist er in der Lage, Pakete beliebig zu manipulieren und anschliessend mit dem korrekten, privaten Schlüssel zu signieren. Er kann das Paket nun in ein Update-Repository einschleusen und es so in Umlauf bringen. Repositories sind häug gespiegelt und werden von den Autoupdate-Mechanismen der Client-PCs kontaktiert. Dass solche Angrie keine reine Utopie sind, zeigen folgende Ereignisse: • Januar 2011: Angrie auf Server von Fedora Am 22. Januar 2011 erhielt ein Fedora Projekt-Mitglied eine Email vom Fedora Account System, in welchem er informiert wurde, dass seine Kontendaten geändert wurden. In der Folge informierte er das Fedora Infrastructure Team, welche nach einer eingehenden Analyse die Kompromittierung des Accounts bestätigten. Der Angri war möglich, da das Mitglied ein schwaches Passwort verwendete. • Dezember 2010: Angri auf Source Code Repository der Free Software Foundation Die Quellcode-Verwaltungs-Software der Free Software Foundation, GNU Savannah, wurde Opfer eines Angris. Dabei gelang es den Angreifern, mittels SQL Injection Methoden, die Datenbank mit den Usernamen und den MD5-gehashten Passwörtern zu stehlen und die Passwörter teilweise mittels Brute-Force-Methoden zu knacken. Dies war möglich, da die Hashwerte der Passwörter ohne Random Salt generiert wurden. Somit konnten die Angreifer mittels Dictionary-Attack (Wörterbuch- Angri) die Passwörter ermitteln. Der Plattform-Betreiber nahm in der Folge die Server, 48 Stunden nach dem erfolgten Angri, vom Netz. • Dezember 2010: Angri auf die ProFTPD Server Angreifern gelang es, den Hauptserver des populären Open Source Pro- jekts zu hacken und ein Backdoor einzuschleusen, welche Vollzugri auf das System ermöglichte. Der Angri blieb während 3 Tagen unbemerkt 4 und führte dazu, dass zahlreiche Benutzer Opfer der kompromittierten Version von ProFTPD wurden. Die Angreifer erhielten den Zugang über eine ungepatchte Sicherheitslücke in der FTP-Applikation selbst. • April 2010: Angri auf Apache Projekt Der Angri erfolgte über JIRA, dem Bug Tracking System der Apache Software Foundation. Die Angreifer eröneten dort einen Bug Report, der einen Link auf eine Webseite, welche eine Cross Site Scripting- Vulnerability ausnützte, beinhaltete. Die Angreifer modizierten in der Folge die Loginmaske zum Bug Tracking System und zeichneten wäh- rend 3 Tagen die Passwörter auf. Im weiteren Verlauf des Angris gelangten die Angreifer zusätzlich in den Besitz einer sehr umfangreichen Passwortdatenbank von Nutzern des Bug Tracking Systems. Obwohl die Passwörter in der Datenbank mittels Einweg-Hashes gesichert waren, waren Teile der Passwortdaten- bank anfällig auf einen Wörterbuch-Angri (Dictionary Attack). Der Grund dafür war, weil Atlasian, der Hersteller von JIRA, für die Ge- nerierung der Hashwerte kein Random Salt verwendete. Random Salt schützt die Passwörter bzw. die Hashwerte vor Wörterbuch-Angrien. • September 2009: Apache Projekt gehackt Server der Apache Software Foundation wurden Opfer eines Angris. Obwohl die Server stark gesichert waren, gelang es den Angreifern, sich Zugang zu den Systemen zu verschaen. Der Hack begann mit der Kompromittierung von apachecon.com, der Webseite der ApacheCon Konferenz. Die Angreifer verschaten sich auf der Maschine root-Privilegien und zerstörten einen Grossteil der Logdaten. Obwohl diese Maschine nicht direkt von der Apache Soft- ware Foundation betrieben wurde, besassen einige Mitglieder der Apa- che Software Foundation Accounts auf dieser Maschine, unter anderem existierte auch ein Account für Backupzwecke. Von da aus versuchten die Angreifer erfolglos, mittels bekannten Account- Passwörtern einen der Server der Apache Software Foundation anzu- greifen. In einem zweiten Versuch, verwendeten die Angreifer erfolg- reich den SSH-Key des Backup-Accounts. Anschliessend panzten die Angreifer CGI-Skripte in die document root-Verzeichnisse, die ab die- sem Zeitpunkt extern sichtbar waren. • August 2008: Angrie auf Server von Fedora Im August 2008 gelang es Angreifern, kurzzeitig die Kontrolle über Server des Fedora-Projekts zu übernehmen. Einer der betroenen Ser- ver war ein sogenannter Signing Server, der Fedora-Paketen digital signiert. Der Angreifer war somit im Besitz des privaten Schlüssels zum 5 Signieren von Fedora-Paketen. Der Hersteller ersetzte sicherheitshalber den kompromittierten Signaturschlüssel durch einen neuen. • August 2008: Angrie auf Server von Red Hat Ein anderes Beispiel ist der Einbruch in die Red Hat Server im Jahre 2008, bei welchem sich die Angreifer ebenfalls Zugang auf die Signing Server verschaten und anschliessend manipulierte OpenSSH-Pakete, mit dem oziellen Red Hat Enterprise Linux Schlüssel signiert, in Um- lauf bringen wollten. Glücklicherweise scheiterten sie daran, die Pakete über das RHN (Red Hat Network) automatisch verteilen zu können. 4 Schutzmassnahmen 4.1 Für Plattform-Betreiber Mögliche Massnahmen für Plattform-Betreiber: • Sicherheitsoptimierte Netzwerkarchitektur Die Verteilung der Server auf verschiedene, separat geschützte Netz- werksegmente kann einen grossen Beitrag dazu leisten die Ausbreitung von Angrien in der Netzwerk-Infrastruktur zu verhindern. • Paket-Signierung erzwingen Betreiber von Quellcode-Repositories können die digitale Signierung von Paketen im Release-Prozess erzwingen. Somit ist es für Entwickler (und Angreifer) nicht mehr ohne Weiteres möglich, gültige Pakete zu publizieren. Der private Schlüssel (Private Key) bleibt dabei vollstän- dig im Besitz des Entwicklers. Die Signatur des Pakets kann mit dem öentlichen Schlüssel (Public Key) veriziert werden. • Zentralisierung der Logdaten Durch eine Zentralisierung der Logdaten können Angrie leichter nach- vollzogen werden, da die Daten nicht ohne Weiteres gelöscht werden können. • Regelmässiger Austausch der Signatur-Schlüssel Ein regelmässiges Austauschen des Schlüsselpaares zum Signieren der Software-Pakete ist eine gute Massnahme, um das Risiko der Kompro- mittierung des privaten Schlüssels zu minimieren. Das Debian-Projekt beispielsweise wechselt die Signatur-Schlüssel
Load more

Recommended publications
  • Free Software Needs Free Tools
    Free Software Needs Free Tools Benjamin Mako Hill [email protected] June 6, 2010 Over the last decade, free software developers have been repeatedly tempted by devel- opment tools that offer the ability to build free software more efficiently or powerfully. The only cost, we are told, is that the tools themselves are nonfree or run as network services with code we cannot see, copy, or run ourselves. In their decisions to use these tools and services – services such as BitKeeper, SourceForge, Google Code and GitHub – free software developers have made “ends-justify-the-means” decisions that trade away the freedom of both their developer communities and their users. These decisions to embrace nonfree and private development tools undermine our credibility in advocating for soft- ware freedom and compromise our freedom, and that of our users, in ways that we should reject. In 2002, Linus Torvalds announced that the kernel Linux would move to the “Bit- Keeper” distributed version control system (DVCS). While the decision generated much alarm and debate, BitKeeper allowed kernel developers to work in a distributed fashion in a way that, at the time, was unsupported by free software tools – some Linux developers decided that benefits were worth the trade-off in developers’ freedom. Three years later the skeptics were vindicated when BitKeeper’s owner, Larry McVoy, revoked several core kernel developers’ gratis licenses to BitKeeper after Andrew Tridgell attempted to write a free replacement for BitKeeper. Kernel developers were forced to write their own free software replacement: the project now known as Git. Of course, free software’s relationships to nonfree development tools is much larger than BitKeeper.
    [Show full text]
  • Master Thesis Innovation Dynamics in Open Source Software
    Master thesis Innovation dynamics in open source software Author: Name: Remco Bloemen Student number: 0109150 Email: [email protected] Telephone: +316 11 88 66 71 Supervisors and advisors: Name: prof. dr. Stefan Kuhlmann Email: [email protected] Telephone: +31 53 489 3353 Office: Ravelijn RA 4410 (STEPS) Name: dr. Chintan Amrit Email: [email protected] Telephone: +31 53 489 4064 Office: Ravelijn RA 3410 (IEBIS) Name: dr. Gonzalo Ord´o~nez{Matamoros Email: [email protected] Telephone: +31 53 489 3348 Office: Ravelijn RA 4333 (STEPS) 1 Abstract Open source software development is a major driver of software innovation, yet it has thus far received little attention from innovation research. One of the reasons is that conventional methods such as survey based studies or patent co-citation analysis do not work in the open source communities. In this thesis it will be shown that open source development is very accessible to study, due to its open nature, but it requires special tools. In particular, this thesis introduces the method of dependency graph analysis to study open source software devel- opment on the grandest scale. A proof of concept application of this method is done and has delivered many significant and interesting results. Contents 1 Open source software 6 1.1 The open source licenses . 8 1.2 Commercial involvement in open source . 9 1.3 Opens source development . 10 1.4 The intellectual property debates . 12 1.4.1 The software patent debate . 13 1.4.2 The open source blind spot . 15 1.5 Litterature search on network analysis in software development .
    [Show full text]
  • Snapshots of Open Source Project Management Software
    International Journal of Economics, Commerce and Management United Kingdom ISSN 2348 0386 Vol. VIII, Issue 10, Oct 2020 http://ijecm.co.uk/ SNAPSHOTS OF OPEN SOURCE PROJECT MANAGEMENT SOFTWARE Balaji Janamanchi Associate Professor of Management Division of International Business and Technology Studies A.R. Sanchez Jr. School of Business, Texas A & M International University Laredo, Texas, United States of America [email protected] Abstract This study attempts to present snapshots of the features and usefulness of Open Source Software (OSS) for Project Management (PM). The objectives include understanding the PM- specific features such as budgeting project planning, project tracking, time tracking, collaboration, task management, resource management or portfolio management, file sharing and reporting, as well as OSS features viz., license type, programming language, OS version available, review and rating in impacting the number of downloads, and other such usage metrics. This study seeks to understand the availability and accessibility of Open Source Project Management software on the well-known large repository of open source software resources, viz., SourceForge. Limiting the search to “Project Management” as the key words, data for the top fifty OS applications ranked by the downloads is obtained and analyzed. Useful classification is developed to assist all stakeholders to understand the state of open source project management (OSPM) software on the SourceForge forum. Some updates in the ranking and popularity of software since
    [Show full text]
  • Verso Project Application Report 0.6 Public Document Info
    Verso Project Application Report Tero Hänninen Juho Nieminen Marko Peltola Heikki Salo Version 0.6 Public 4.8.2010 University of Jyväskylä Department of Mathematical Information Technology Jyväskylä Acceptor Date Signature Clarification Project manager __.__.2010 Customer __.__.2010 Instructor __.__.2010 Verso Project Application Report 0.6 Public Document Info Authors: • Tero Hänninen (TH) [email protected] 0400-240468 • Juho Nieminen (JN) [email protected] 050-3831825 • Marko Peltola (MP) [email protected] 041-4498622 • Heikki Salo (HS) [email protected] 050-3397894 Document name: Verso Project, Application Report Page count: 46 Abstract: Verso project developed a web application for source code manage- ment and publishing. The document goes through the background of the software, presents the user interface and the application structure and describes the program- ming and testing practices used in the project. The realization of functional require- ments and ideas for further development are also presented. In addition, there is a guide for future developers at the end. Keywords: Application report, application structure, Git, Gitorious, programming practise, Ruby on Rails, software project, software development, source code man- agement, testing, WWW interface, web application. i Verso Project Application Report 0.6 Public Project Contact Information Project group: Tero Hänninen [email protected] 0400-240468 Juho Nieminen [email protected] 050-3831825 Marko Peltola [email protected] 041-4498622 Heikki Salo [email protected] 050-3397894 Customers: Ville Tirronen [email protected] 014-2604987 Tero Tuovinen [email protected] 050-4413685 Paavo Nieminen [email protected] 040-5768507 Tapani Tarvainen [email protected] 014-2602752 Instructors: Jukka-Pekka Santanen [email protected] 014-2602756 Antti-Juhani Kaijanaho [email protected] 014-2602766 Contact information: Email lists [email protected] and [email protected].
    [Show full text]
  • The Lcg Savannah Software Development Portal
    THE LCG SAVANNAH SOFTWARE DEVELOPMENT PORTAL Y. Perrin, D. Feichtinger#1, F. Orellana#2, CERN, Geneva, Switzerland, M. Roy, FSF France Abstract A web portal has been developed, in the context of ORGANIZATION AND the LCG/SPI project, in order to coordinate workflow FUNCTIONALITY and manage information in large software projects. It is LCG Savannah is organized in projects which are a development of the GNU Savannah package and grouped according to their type as entered at offers a range of services to every hosted project: Bug / registration time. All projects of the same type inherit a support / patch trackers, a simple task planning system, number of common characteristics and default values news threads, and a download area for software with, of course, the possibility to define new types and releases. Features and functionality can be fine-tuned to override the defaults for any given project. on a per project basis and the system displays content LCG Savannah should be seen as a development and grants permissions according to the user's status front-end for every project it hosts. It provides, in a (project member, other Savannah user, or visitor). A fully configurable and integrated way, the main highly configurable notification system is able to functions required by any significant software channel tracker submissions to developers in charge of development project. These include bug and support specific project modules. request tracking, task management, automatic The portal is based on the GNU Savannah package notification of people concerned, access to CVS which is now developed as 'Savane' with the support of repository, download area, news and mailing lists.
    [Show full text]
  • Bill Laboon Friendly Introduction Version Control: a Brief History
    Git and GitHub: A Bill Laboon Friendly Introduction Version Control: A Brief History ❖ In the old days, you could make a copy of your code at a certain point, and release it ❖ You could then continue working on your code, adding features, fixing bugs, etc. ❖ But this had several problems! VERSION 1 VERSION 2 Version Control: A Brief History ❖ Working with others was difficult - if you both modified the same file, it could be very difficult to fix! ❖ Reviewing changes from “Release n” to “Release n + 1” could be very time-consuming, if not impossible ❖ Modifying code locally meant that a crash could take out much of your work Version Control: A Brief History ❖ So now we have version control - a way to manage our source code in a regular way. ❖ We can tag releases without making a copy ❖ We can have numerous “save points” in case our modifications need to be unwound ❖ We can easily distribute our code across multiple machines ❖ We can easily merge work from different people to the same codebase Version Control ❖ There are many kinds of version control out there: ❖ BitKeeper, Perforce, Subversion, Visual SourceSafe, Mercurial, IBM ClearCase, AccuRev, AutoDesk Vault, Team Concert, Vesta, CVSNT, OpenCVS, Aegis, ArX, Darcs, Fossil, GNU Arch, BitKeeper, Code Co-Op, Plastic, StarTeam, MKS Integrity, Team Foundation Server, PVCS, DCVS, StarTeam, Veracity, Razor, Sun TeamWare, Code Co-Op, SVK, Fossil, Codeville, Bazaar…. ❖ But we will discuss git and its most popular repository hosting service, GitHub What is git? ❖ Developed by Linus Torvalds ❖ Strong support for distributed development ❖ Very fast ❖ Very efficient ❖ Very resistant against data corruption ❖ Makes branching and merging easy ❖ Can run over various protocols Git and GitHub ❖ git != GitHub ❖ git is the software itself - GitHub is just a place to store it, and some web-based tools to help with development.
    [Show full text]
  • Producing Open Source Software How to Run a Successful Free Software Project
    Producing Open Source Software How to Run a Successful Free Software Project Karl Fogel Producing Open Source Software: How to Run a Successful Free Software Project by Karl Fogel Copyright © 2005-2013 Karl Fogel, under a CreativeCommons Attribution-ShareAlike (3.0) license [http:// creativecommons.org/licenses/by/3.0/]. Dedication This book is dedicated to two dear friends without whom it would not have been possible: Karen Underhill and Jim Blandy. i Table of Contents Preface ............................................................................................................................ vi Why Write This Book? .............................................................................................. vi Who Should Read This Book? ..................................................................................... vi Sources ................................................................................................................... vii Acknowledgments .................................................................................................... viii Disclaimer ................................................................................................................ ix 1. Introduction ................................................................................................................... 1 History ..................................................................................................................... 3 The Rise of Proprietary Software and Free Software ................................................
    [Show full text]
  • Release Early and Often: Developing Software with Origo
    Release early and often: Developing Software with Origo Till G. Bay Manuel Oriol Bertrand Meyer Chair of Software Engineering Chair of Software Engineering Chair of Software Engineering Swiss Federal Institute of Swiss Federal Institute of Swiss Federal Institute of Technology in Zürich Technology in Zürich Technology in Zürich CH-8092 Zürich CH-8092 Zürich CH-8092 Zürich [email protected] [email protected] [email protected] ABSTRACT General Terms Just as important as the technical activities of software de- Management, Human factors velopment – requirements, design, coding, documenting, com- piling, testing, debugging. – are the management and com- Keywords munication tasks: recording project events, managing project Wikis and web pages, sending out notifications, reconciling Software development process, software distribution and doc- changes, and many others. These tasks become ever more umentation, developer and user management, open- and delicate with the increasingly distributed nature of modern closed-source development software projects, small as well as large. If not handled properly they can not only consume considerable time but 1. INTRODUCTION also, just like bugs and other flaws in technical tasks, cause Modern distributed software development combines sev- considerable damage. eral applications and tools to allow developers to collaborate Origo is a comprehensive platform for addressing such over a network. The combination of these applications forms project needs by providing such facilities as project Web the information systems used in software projects. Releasing pages (both editable and generated), forums, mailing lists, software early and often requires that such an information bug tracking etc. All the facilities are also available through system fits well into the development process.
    [Show full text]
  • IFIP AICT 319, Pp
    Warehousing and Studying Open Source Versioning Metadata Matthew Van Antwerp and Greg Madey University of Notre Dame {mvanantw,gmadey}@cse.nd.edu Abstract. In this paper, we describe the downloading and warehousing of Open Source Software (OSS) versioning metadata from SourceForge, BerliOS Developer, and GNU Savannah. This data enables and supports research in areas such as software engineering, open source phenomena, social network analysis, data mining, and project management. This newly-formed database containing Concurrent Versions System (CVS) and Subversion (SVN) metadata offers new research opportunities for large-scale OSS development analysis. The CVS and SVN data is juxta- posed with the SourceForge.net Research Data Archive [5] for the pur- pose of performing more powerful and interesting queries. We also present an initial statistical analysis of some of the most active projects. 1 Introduction Versioning programs have been in use by open source software projects for many decades. Publicly available logs offer a development trail ripe for individual and comparative studies. In this paper, we describe the downloading and warehousing of such data. We also present some preliminary data analysis. The process is similar to that done in [2] which described an approach to populating a database with version control and bug tracking system data for individual project study. At Notre Dame, Jin Xu also took an individual project approach to retrieving and studying projects on SourceForge [6]. Xu built a similar retrieval framework however for web pages to gather project statistics. 2 SourceForge.net Data Most of SourceForge’s data is stored in a back-end database. The actual source code is stored in a Concurrent Versions System (CVS) or Subversion (SVN) repository.
    [Show full text]
  • Lilypond Contributor's Guide
    ☛ ✟ ✡ ✠ ☛ ✟ ✡ ✠ The music typesetter This manual documents contributing to LilyPond version 2.20.0. It discusses technical issues and policies that contributors should follow. This manual is not intended to be read sequentially; new contributors should only read the sections which are relevant to them. For more information about different jobs, see Section “Help us” in Contributor’s Guide. For more information about how this manual fits with the other documentation, or to read this manual in other formats, see Section “Manuals” in General Information. If you are missing any manuals, the complete documentation can be found at http://lilypond.org/. Copyright ⃝c 2007–2015 by the authors. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.1 or any later version published by the Free Software Foundation; with no Invariant Sections. A copy of the license is included in the section entitled “GNU Free Documentation License”. For LilyPond version 2.20.0 The LilyPond development team LilyPond Contributor’s Guide i 1.1 Help us ................................................... ......................... 1 1.2 Overview of work flow ................................................... .......... 2 1.3 Summary for experienced developers ............................................... 2 1.4 Mentors ................................................... ........................ 3 2.1 LilyDev................................................... ......................... 5 Installing
    [Show full text]
  • Generalized Procedure for Screening Open Source Software Applications
    LIMSforum – Generalized Procedure for Screening Free Software and Open Source Software Applications_V.0.303 Composed in LibreOffice Version: 4.4.5.2 Generalized Procedure for Screening Free Software and Open Source Software Applications Abstract Free Software and Open Source Software projects have become a popular alternative tool in both scientific research and other fields. However, selecting the optimal application for use in a project can be a major task in itself, as the list of potential applications must first be identified and screened to determine promising candidates before an in-depth analysis of systems can be performed. To simplify this process we have initiated a project to generate a library of in-depth reviews of Free Software and Open Source Software applications. Preliminary to beginning this project, a review of evaluation methods available in the literature was performed. As we found no one method that stood out, we synthesized a general procedure using a variety of available sources for screening a designated class of applications to determine which ones to evaluate in more depth. In this paper, we will examine a number of currently published processes to identify their strengths and weaknesses. By selecting from these processes we will synthesize a proposed screening procedure to triage available systems and identify those most promising of pursuit. To illustrate the functionality of this technique, this screening procedure will be executed against a selected class of applications. Introduction There is much confusion regarding Free Software and Open Source Software and many people use these terms interchangeably, however, to some the connotations associated with the terms is highly significant.
    [Show full text]
  • Repositórios 1
    MAC 5856 - Software Livre Professor: Fabio Kon REPOSITÓRIOS 1 ÁLVARO HENRY MAMANI ALIAGA POLIANA MAGALHÃES REIS RESUMO DA APRESENTAÇÃO Definições Vantagens Atividades Comuns Integração com outros Softwares Como funciona ? Repositórios Centralizados Repositórios Distribuídos 2 RESUMO DA APRESENTAÇÃO (CONT.) Sistemas de Controle de Versão Centralizados • RCS – Revision Control System • CVS – Concurrent Version System • SVN – Subversion • VSS – Microsoft Visual SourceSafe • Rational ClearCase Distribuidos • GIT • BAZZAR • Mercurial • GNU Arch • Monotone 3 • Darcs DEFINIÇÕES Um repositório pode ser um sistema de arquivos local ou um servidor remoto, e são extensamente usados em Sistemas de Controle de Versão. Um sistema de controle de versão, VCS (Version Control System) ou ainda SCM (Source Code Management) por sua vez, providencia árvore de versão para gerenciar versões diferentes de arquivos. EXEMPLO : Várias ferramentas de controle de versão usam arquitetura de cliente/servidor e os clientes podem pegar qualquer informações sobre qualquer arquivo acessando o repositório. 4 4 PRINCIPAIS VANTAGENS Controle do histórico Trabalho em equipe Marcação e resgate de versões estáveis Ramificação de projeto 5 INTEGRAÇÃO COM OUTROS SOFTWARES Os sistemas de controle de versões mais flexíveis permitem que seja possível integrá-los a outros softwares. A integração mais comum é em ambientes de desenvolvimento através de plugins . Alguns ambientes que suportam a integração de alguns sistemas são: IntelliJ IDEA, Eclipse, NetBeans e Visual Studio. O TortoiseSVN, o TortoiseCVS e o TortoiseHg, clientes do SVN, do CVS e do Mercurial, respectivamente, funcionam sobre o 6 Windows Explorer. COMO FUNCIONA O CONTROLE DE VERSÃO? 7 REPOSITÓRIOS CENTRALIZADOS 8 REPOSITÓRIOS CENTRALIZADOS VANTAGENS Mantém as informações referentes aos arquivos em um repositório único acessível a todos os desenvolvedores de um projeto.
    [Show full text]