From d5f85ac4f4e96646f88b8246daa5f05c81f8cf6a Mon Sep 17 00:00:00 2001 From: Canopy bot Date: Mon, 20 Nov 2023 16:59:52 +0000 Subject: [PATCH] updated from main (commit 5b861c349c3f7e23ff6065a378f882e3915940a8) --- About Us/Network | 4 +- About Us/Team | 20 +++--- Donate | 4 +- Home | 10 +-- Our Work/Projects | 30 ++++----- Our Work/Publications-and-Talks | 20 +++--- Our Work/Services | 6 +- Our Work/Technology-Employed | 16 ++--- Projects/Reproducible_builds | 18 ++--- atom | 114 ++++++++++++++++---------------- index.html | 10 +-- 11 files changed, 126 insertions(+), 126 deletions(-) diff --git a/About Us/Network b/About Us/Network index 3b5f818..1e5619d 100644 --- a/About Us/Network +++ b/About Us/Network @@ -1,5 +1,5 @@ -Network

Network

Published: 2019-09-10 (last updated: 2023-09-21)

Collaborations

+Network

Network

Published: 2019-09-10 (last updated: 2023-09-21)

Collaborations

Änderwerk gGmbH
Änderwerk is a "back-end provider" for the open source community. They work with Robur to assist us in our financial processes and administration.

Least Authority @@ -13,7 +13,7 @@ OCaml Labs is an initiative within the Cambridge Computer Laboratory started by

Tarides
Is a for-profit distributed engineering team based in Paris and Cambridge that makes software for MirageOS. Robur works alongside Tarides to expand the MirageOS ecosystem and collaborate on some projects.


-

Grant Funders

+

Grant Funders

NGI Pointer
NGI pointer is a EU funded project which funds the next generation ecosystem of Internet architects. They funded our reproducible builds work.

NLnet Foundation
diff --git a/About Us/Team b/About Us/Team index 98c1238..7c71f60 100644 --- a/About Us/Team +++ b/About Us/Team @@ -1,38 +1,38 @@ Team

Team

Published: 2019-09-10 (last updated: 2023-09-21)

Robur is a software development cooperative specializing in robust and secure digital infrastructure written in OCaml.

-

Current members

-

Hannes

+

Current members

+

Hannes

Hannes enjoys living in Berlin, Germany. Until end of 2017, he used to be a research associate at the University of Cambridge in the rems project. He enjoys to write code, and also traveling and repairing his recumbent bicycle, and being a barista.

Hannes did his PhD in computer science about formal verification of imperative code (using a higher-order separation logic and the theorem prover Coq). Hannes co-authored not-quite-so-broken TLS, a TLS implementation from the ground up in OCaml, and contributes to the MirageOS project as a core team member. He is working on various projects, including opam signing and netsem, an executable formal model of TCP/IP which can act as a test validator.

His blog is at https://hannes.robur.coop.

-

Reynir

+

Reynir

Reynir goes foraging, sniffing and picking interesting plants found in nature, cycling with one, two or more wheels, and knits now and then. Based in Århus, Denmark he goes winterbathing in the cold sea.

Reynir studied computer science at Aarhus University with an interest in programming languages and formal verification. After some years working in industry with heterogenous unix systems followed by two years of various volunteer work he joined Robur in 2020. He is still heavily involved as a developer and system administrator in data.coop, an association that collectively owns and run servers offering digital services for their members.

-

dinosaure

+

dinosaure

Dinosaure wants the majority of its services to be unikernels in OCaml. A big reader of RFCs, it implements protocols and formats in OCaml. He has been participating in MirageOS for quite some time and continues to promote its use and develop usable unikernels such as paste.osau.re, bob, and his blog.

-

Former members

-

Joe

+

Former members

+

Joe

Joe is an independent IT consultant located in Copenhagen.

Joe has a background in penetration testing, protocol design, applied cryptography, and architectural IT security system design for customers, especially in the banking, insurance, and pension fund sectors. He has been consulting on BPAY integration in Australia, and conducting web and network security assessments for customers throughout the world.

Lately he has spent the last couple of years writing OCaml and has been working with IT security, dev-ops and automated deployment for customers specializing in Enterprise Resource Planning, Internet of Things, and medical technology.

In his spare time he dabbles in research into similar topics and serialization frameworks, in addition to the enjoyable pursuit of tabletop roleplaying and social interactions in smoky pubs - two disciplines that he excels in, but that have somehow not been of particular interest to paying customers (yet).

-

Martin

+

Martin

Martin has been programming since before programming was trendy, eating Sharp SC61860A machine code for breakfast since before it was healthy, and using Linux way back when it was just Linus Torvalds’ glorified terminal emulator.

A founding member of Unikernel Systems (later acquired by Docker), Martin has been involved in a number of library operating system projects since 2014, including the Rumprun unikernel and MirageOS. He is a co-author of Solo5, a secure execution environment for unikernels, and joins Robur in 2018 to continue his work towards creating secure software that “just works” and other ambitious projects.

Martin lives with his family in Bratislava, Slovakia and in his spare time enjoys hiking, yachting and the arts.

-

Mindy

+

Mindy

Mindy ran the first MirageOS unikernel in the public cloud in 2014. Mindy has worked extensively on the MirageOS TCP/IP network stack and various protocol implementations, and is a member of the project's core team. She managed the release of MirageOS's latest major version.

Mindy is interested in freeing software from unnecessary dependencies, including monolithic kernels. While she finds testing and bug-fixing rewarding, her true goal is to apply techniques that remove entire bug classes to broader classes of computation. Memory safety isn't just for application code!

In her free time, Mindy enjoys bothering cats, playing board games, riding bicycles, and embroidery. She lives in beautiful Madison, Wisconsin in the United States.

-

rand

+

rand

rand fell in love with OCaml and functional programming since university, where he studied philosophy and computer science on a humanistic/technological BSc. He especially likes solving problems in elegant and interesting new ways. Been part of the Functional Copenhageners meetup for a range of years - where he's also held several talks.

He's worked fullstack with with OCaml and Scala since university - working on a varied set of things like entity clustering, entity merging, custom data visualizations, service oriented architecture, PostgreSQL, Elasticsearch, natural language parsing, Linux, server management.

Spends much of his time with his daughter and doing experimental art with his video synthesizer niseq, of course written using pure FRP in OCaml (:

Can be found at https://r7p5.earth/.

-

Stefanie

+

Stefanie

Stefanie is an infrastructure software engineer and a researcher.

She studied Applied Computer Science in the Natural Sciences, and developed a typechecker for a compiler of a language for optimization problems. In her PhD project she developed metrics to compare forest data structures, with an application in molecular structure comparison. Working as a postdoc in cancer research on molecular structure prediction, she found her way to Brooklyn and Berlin.

In the US tech industry, she works on infrastructure problems with distributed systems at a large scale with millions of users, developing API infrastructure and search infrastructure, with a focus on stateless systems.

diff --git a/Donate b/Donate index 00f9e8c..01c7b67 100644 --- a/Donate +++ b/Donate @@ -3,7 +3,7 @@

Unfortunately such projects aren't always easy to get full grants for, and public donations really help us in completing such work.

If you want to assist us continue these projects we would be grateful for a donation and promise to spend your money well (for more information on how we spend the funds we get please see our funding page).

As Robur is a project of the nonprofit Änderwerk we are tax deductible in Europe.

-

How To Donate

+

How To Donate

  • Direct debit or Paypal: visit this page and select "DONATION robur" from the dropdown menu.

    @@ -17,7 +17,7 @@ BIC: GENODEM1GLS
    Bank: GLS Gemeinschaftsbank, Christstrasse 9, 44789 Bochum, Germany

-

Tax Deductibility

+

Tax Deductibility

For Germany, you can download a general donation receipt that together with your bank statement is sufficient to claim taxes on donations up to 300€.

For other European countries and larger donations, we're happy to provide individual donation receipts and work with you on their recognition. For that, please send your full name and postal address and the date of your transaction to finance@aenderwerk.de.

Contact diff --git a/Home b/Home index 25dec7d..afd720f 100644 --- a/Home +++ b/Home @@ -2,11 +2,11 @@ robur

Published: 2017-09-16 (last updated: 2019-09-10)



-

R obust Infrastructure

-

O pen Source Projects

-

B ottom-up Approach

-

U nderscoring Security

-

R eliable Technology

+

R obust Infrastructure

+

O pen Source Projects

+

B ottom-up Approach

+

U nderscoring Security

+

R eliable Technology



Contact diff --git a/Our Work/Projects b/Our Work/Projects index 614ae45..f673890 100644 --- a/Our Work/Projects +++ b/Our Work/Projects @@ -1,16 +1,16 @@ -Projects

Projects

Published: 2019-09-10 (last updated: 2022-03-01)

Robur Reproducible Builds

+Projects

Projects

Published: 2019-09-10 (last updated: 2022-03-01)

Robur Reproducible Builds

In 2021 we in Robur have been working towards easing deployment of reproducible mirage applications. The work has been funded by the Eurepean Union under the Next Generation Internet (NGI Pointer) initiative. The result is online.

The overall goal is to push MirageOS into production in a trustworthy way. We worked on reproducible builds for Opam packages and MirageOS - with the infrastructure being reproducible itself. Reproducible builds are crucial for supply chain security - everyone can reproduce the exact same binary (by using the same sources and environment), without reproducible builds we would not publish binaries.

Reproducible builds are also great for fleet management: by inspecting the hash of the binary that is executed, we can figure out which versions of which libraries are in the unikernel - and suggest updates if newer builds are available or if a used library has a security flaw -- albatross-client-local update my-unikernel is everything needed for an update.

Several ready-to-use MirageOS unikernels are built on a daily basis - ranging from authoritative DNS servers (secondary, let's encrypt DNS solver), DNS-and-DHCP service (similar to dnsmasq), TLS reverse proxy, Unipi - a web server that delivers content from a git repository, DNS resolver, CalDAV server, and of course your own MirageOS unikernel.

read more

-

Bitcoin Piñata

+

Bitcoin Piñata

The Bitcoin Piñata is a transparent bug bounty: it holds the private key for a bitcoin wallet. It is a MirageOS unikernel designed to test our TLS and all underlying transport implementations.

Its open communication channels are HTTP and HTTPS, and a TLS client and TLS server endpoint, all written in OCaml. The cryptographic material for TLS is generated on startup in the Piñata and is supposed to never leave it. However, if an attacker manages to establish a mutually authenticated (using certificates) TLS channel, the private key to the bitcoin wallet is transmitted over this channel, and the attacker gains access to the bait (the bitcoins).

The project was launched on February 10th 2015. At this time friends from the IPredator project lent us 10 bitcoins (back then worth ~2000 EUR) for the bait. By 2018 no one had successfully cracked the Piñata and the bitcoins, by this point worth ~200 000 EUR, were repurposed for other projects, however the project remains live, with a small amount of bitcoins in it, for anyone wishing to try to crack it.

Hannes Mehnert and David Kaloper-Meršinjak designed the Bitcoin Piñata to attract security professionals to look into our TLS stack, developed purely in OCaml since early 2014.

-

More technical information:

+

More technical information:

On startup, the Piñata generates its certificate authority on the fly, including certificates and private keys, this means that only the Piñata itself contains private keys which can authenticate successfully.

The codebase is thousands of lines of code smaller than equivalent implementations and we did not use many external libraries, and those we had to use we read carefully to avoid security issues.

The attack surface is any part of the unikernel (or deployment) - anything allowing you to get a valid certificate (signed by the cryptographic material which shouldn't leave the Piñata), or reading the memory location where the private key to the bitcoin wallet is stored, an exploitable flaw in any software layer (OCaml runtime, virtual network device, TCP/IP stack, TLS library, X.509 validation, or elsewhere), or anything else.

@@ -27,7 +27,7 @@
  • Usenix security research paper on TLS stack
    • -

    CalDAV Server

    +

    CalDAV Server

    The CalDAV server is a protocol for synchronizing calendars. Our goal was to develop a calendar server that is robust and less complex to configure and maintain than other services, allowing more people to run their own digital infrastructure.

    The CalDAV server project began in 2017 when Stefanie Schirmer and Hannes Mehnert got a grant from The Prototype Fund for developing a CalDAV server (RFC 4791) over a period of 6 months. After that funding period, Tarides sponsored us further, allowing us to achieve the current status of the CalDAV server.

    Currently all basic features of a calendar are implemented, for example "please add this event to the calendar", and "modify the weekly meeting from now on to start half an hour later", and it is tested with a variety of CalDAV clients.

    @@ -35,12 +35,12 @@

    Our CalDAV server has a very small codebase which provides a number of security benefits and it stores all the data in git so there is a history of changes, it can easily be exported and converted to and from other formats, and if a client behaves badly (by removing entries they cannot deal with), this can be tracked and reverted.

    We would like to develop the CalDAV server further, adding notifications about updates and invitations sent via Mail (as described in RFC 6638). We also aim to integrate the related protocol CardDAV (address book), which could be integrated into the same unikernel.

    If you are interested in supporting further work on the CalDAV server through a donation, with a grant, or require additional features to be implemented to accommodate your project’s needs please get in touch with us!

    -

    More technical information:

    +

    More technical information:

    Based on existing HTTP and REST libraries, we developed a WebDAV library adequate for CalDAV (e.g. no locks, but ACLs, reports). The REST library needed some extensions to support more HTTP verbs that are used in WebDAV. We also developed an iCalendar (.ics, RFC 5545) decoder and encoder.

    The CalDAV unikernel uses the developed libraries to serve requests from clients, which may be "what is the last update to the calendar?", or adding events or changing times of events. Access control is done by the attached metadata to the resource (i.e. only user Tim may access Tim's calendar, groups are possible). User and group (in WebDAV lingo principals) data are stored in the same storage as the calendars. For enrolling new users and groups, we provide HTTP endpoints. The administrator password is provided as boot argument.

    The storage of our CalDAV unikernel can use any mirage-kv implementation, being it a non-persistent only in-memory (not too useful for a real calendar since it is not persistent), a UNIX file system (if the unikernel runs as a UNIX process), or a remote git repository (which we recommend).

    The CalDAV server is open source, with the code available on GitHub for the server and calendar.

    -

    DNS

    +

    DNS

    The Domain Name System is used like a phone book for the internet - it translates human-memoizable domain names (e.g. robur.coop) to machine-routable IP addresses (e.g. 198.167.222.215) and other records such as where eMail should be sent to. DNS is a fault-tolerant hierarchical decentralized key-value store with caching. DNS has been deployed on the Internet since 1987.

    On the one side, the authoritative server, which has delegated responsibility for a domain, provides that mapping information (i.e. that a certain IP is the right one for a certain domain), and on the other side a resolver provides the functionality to figure out which server to request for each query a client has.

    Since 2017 we have developed DNS, server, resolver, and client as a spare-time project. They serve different purposes in our ecosystem: the server is used by domains such as nqsb.io and robur.coop as an authoritative server; we use a caching resolver for our bi-annual hack retreats in Marrakesh; and the client is used by any MirageOS unikernel that needs to resolve domain names.

    @@ -48,42 +48,42 @@

    Since mid-August 2019 our DNS implementation replaced the existing, but incomplete and barely maintained OCaml implementation. It is released to the opam repository.

    A specific use case for this project is to combine a DNS resolver with a local zone (where it acts as server), and a DHCP server - a protocol used for dynamic IP address configuration - into a single service. We recently received confirmation of a grant from Nlnet via the next generation internet initiative from the EU to develop such a service based on our DNS library.

    If you are interested in supporting this work, or knowing more about it please get in touch with us.

    -

    More technical information:

    +

    More technical information:

    Our DNS implementation handles extensions such as dynamic updates, notifications on changes, authentication of update requests, zone transfers (all useful for provisioning X509 certificates via letsencrypt.org).

    Using expressive types in OCaml we can ensure that for a given query type the reply record has a specific shape: querying an address record (A) results in a set of IPv4 addresses. Encoding such invariants in the type system reduces the boilerplate (or unsafety) which is there in other implementations.

    The DNS code is available on GitHub for the library and unikernels.

    -

    Firewall

    +

    Firewall

    Online security is vital and an important way to improve a network's or computer's security is a firewall that can block unwanted traffic going in and out. We are developing a lightweight firewall in the secure programming language OCaml that is specifically designed to be implemented in QubesOS, a security-orientated operating system.

    The Qubes-Mirage-Firewall is based on a project by Thomas Leonard. It is implemented as a MirageOS unikernel, it is more lightweight and with a smaller codebase compared to the original Linux based firewall in QubesOS which has security and useability benefits.

    In 2019, we received a grant from The Prototype Fund for 6 months work on this project. We would like to continue developing it further and if you wish to support this project with a donation, grant, or just want to hear more about the project please get in touch with us.

    -

    More technical information:

    +

    More technical information:

    Thus far we have refactored the NAT library, made the firewall react to rule changes from the Qubes interface, and added a DNS client to the firewall. We added the ability to read rule changes from QubesDB. We added the ability to resolve domain names via a DNS client so that the rules can be written in a human-friendly way, and not just as computer-friendly IP addresses.

    The smaller unikernel uses less memory, which is a rare resource in QubesOS, since Qubes runs many virtual machines. As opposed to the first prototype, it can react to rule changes without the need to rebuild and reboot the firewall VM.

    The code for the firewall is on GitHub, but still on several branches since we recently reworked the DNS parts.

    -

    OpenPGP

    +

    OpenPGP

    OpenPGP is a much-used standard of encryption and is widely used to encrypt text, files and emails, amongst other things.

    Robur is implementing OpenPGP in OCaml, for use in MirageOS and any other compatible platform or software that is looking for OpenPGP written in a secure language.

    This work is funded through donations and is still an ongoing project, which means that it may not currently possess all the features required for various use-cases. Currently our implementation can sign, verify, compress, encrypt and decrypt.

    You can assist us in implementing more of the OpenPGP protocol through a donation. If you are interested hearing more about the project, require additional features to be implemented to accommodate your project’s needs, or are able to assist with a grant please get in touch with us!

    -

    More technical information:

    +

    More technical information:

    Robur maintains a partial, opinionated implementation of OpenPGP version 4 (RFC 4880) and the related standards, written in OCaml and compatible with MirageOS.

    The software consists of a library, and various UNIX tools that make use of the library, and can be used to interact with systems that are currently using GnuPG or other OpenPGP implementations for file encryption or verification using OpenPGP signatures. Notably it can be used from within MirageOS applications without having to bundle a C implementation, and the UNIX binaries are separated from the library so that your applications can use the library directly, unlike GnuPG or libgpgme whose API translates to repeated executions of the gpg2 binary and parsing of the textual output from that.

    Currently we have implemented signing/verification and encryption/decryption, but there is no support for elliptic curve cryptography. Decompression of ZLIB streams is supported through the use of a pure OCaml library called decompress. While some things are implemented with a streaming API, many operations make use of an in-memory buffer, which introduces memory constraints on the file handled (this is an area where there is definitely room for improvement).

    The software is available on Github.

    -

    OpenVPN

    +

    OpenVPN

    OpenVPN is a virtual private network protocol that started from a single implementation developed in C, without any specification document. Over time flaws were found in the implementation which lead to further revisions. Also several extensions were developed for coping with other needs.

    This history meant that overall OpenVPN has a number of flaws and is overly complex due to revisions on revisions. We implemented only the most recent protocol version and require the current key derivation and authentication method.

    We started from scratch developing it in OCaml using existing cryptographic libraries and parsers. This approach allowed us to take some design decisions that have security benefits and our codebase is minimal. We strive for compatibility of the configuration file, so our OCaml OpenVPN can be a drop-in replacement.

    We began this work in 2018 with a grant from The Prototype Fund. Whilst the code is available on Github we have not released it yet as it needs further work (in terms of testing, performance evaluation).

    If you are interested in supporting further work on our OpenVPN implementation through a donation, with a grant, or just want to hear more about the project please get in touch with us!

    -

    More technical information:

    +

    More technical information:

    Our main goal is a client implementation as a MirageOS unikernel (either forwarding all traffic to a single IP address or NAT of a local network via the OpenVPN tunnel), but we also developed a UNIX client which configures a tap device on the host and adjusts the hosts routing table accordingly. We extended our protocol implementation with a server as well. Testing is done against existing OpenVPN servers.

    Our implementation has stronger security promises since we do not implement old protocol versions that are brittle. In addition it is fail-hard when using the NAT unikernel: if the tunnel is down, all packets are dropped (instead of sent unencrypted). We do not support questionable configuration options and we have safe defaults for the configuration.

    -

    Solo5

    +

    Solo5

    Solo5 is a sandboxed (separated) execution environment built using unikernels (a.k.a. library operating systems), including but not limited to MirageOS unikernels. Conceptually it provides a common interface between the unikernel and various host operating systems or hypervisors.

    Solo5's interfaces are designed in a way that allows us to easily port them to run on different host operating systems or hypervisors. Implementations of Solo5 run on Linux, FreeBSD, OpenBSD, the Muen Separation Kernel and the Genode Operating System Framework.

    Currently Solo5 is ready for use by early adopters and we plan to continue developing it further, if you are interested in supporting this development with a donation or want to hear more about the project please get in touch with us.

    -

    More technical information:

    +

    More technical information:

    Solo5 features include:

    • a sandboxed environment (CPU, memory) to execute native code in diff --git a/Our Work/Publications-and-Talks b/Our Work/Publications-and-Talks index 5138245..9ec3080 100644 --- a/Our Work/Publications-and-Talks +++ b/Our Work/Publications-and-Talks @@ -1,7 +1,7 @@ Publications and Talks

      Publications and Talks

      Published: 2019-09-10 (last updated: 2020-01-07)

      We regularly give talks and write publications about our work, OCaml and MirageOS and other aspects of coding, security and computer science that we have expertise in. Below are some examples of these, if you are interested in having a Robur member speak at your event please reach out to us.

      -

      Hannes Mehnert

      -

      Talks:

      +

      Hannes Mehnert

      +

      Talks:

      Chaos Communication Congress 2019 (36c3) - Leaving Legacy Behind
      Presenting the current state of MirageOS unikernels, with a focus on the reduction on resource usage (carbon footprint) of network services.

      CERN Computing Seminar 2019 – MirageOS: robust and secure services for the cloud
      @@ -12,26 +12,26 @@ Presents a formal model of TCP/IP (developed 2000-2009 and refurbished since 201 This is a continuation of earlier talks at BornHack (2016, 2017), and goes into detail of some active projects, such as: community repository signing (for secure updates), DNS infrastructure, our Prototype Fund sponsored CalDAV-server.

      Chaos Communication Congress 2018 (35c3) - Domain Name System
      Discusses the basic usage of DNS, including stub and recursive resolver, server; various protocol extensions including zone transfer, dynamic updates, authentication, notifications; privacy extensions (query path minimization, DNS-over-TLS); provisioning let's encrypt certificates; and attacks (poisoning, amplification). Explains the Robur implementation of DNS with above mentioned extensions as minimized MirageOS unikernels.

      -

      Publications:

      +

      Publications:

      Engineering with Logic: Rigorous Test-Oracle Specification and Validation for TCP/IP and the Sockets API (JACM vol 66, January 2019), full paper. (Steve Bishop, Matthew Fairbairn, Hannes Mehnert, Michael Norrish, Tom Ridge, Peter Sewell, Michael Smith, Keith Wansbrough)

      Not-quite-so-broken TLS: lessons in re-engineering a security protocol specification and implementation (Usenix security 2015), video presentation (David Kaloper-Meršinjak, Hannes Mehnert, Anil Madhavapeddy, Peter Sewell)

      Not-quite-so-broken TLS 1.3 Mechanized Conformance Checking - TLS 1.3 Ready or Not (TRON), workshop website (David Kaloper-Meršinjak and Hannes Mehnert)

      -

      Martin Lucina

      -

      Talks:

      +

      Martin Lucina

      +

      Talks:

      FOSDEM 2019 - Solo5: A sandboxed, re-targetable execution environment for unikernels
      Explains Solo5 which is a microkernel-friendly, sandboxed, re-targetable execution environment for unikernels, with a taste for minimalism. Presents the interfaces it offers to the unikernel/library operating system/application developer. Using existing library operating systems, such as MirageOS, demonstrates the developer experience for various Solo5 targets, going on to show how rigorously applying minimalist principles to interface design is used to our advantage, blurring traditional lines between unikernels, processes, kernels and hypervisors.

      -

      Publications:

      +

      Publications:

      Unikernels as Processes - ACM Symposium on Cloud Computing 2018 (Dan Williams, Ricardo Koller, Martin Lucina, Nikhil Prakash)

      -

      Mindy Preston

      -

      Talks:

      +

      Mindy Preston

      +

      Talks:

      DevOpsDays MSN 2018 - FuzzOps
      Discusses testing software to find bugs before deploying software, including continuous integration solutions and property-based testing. Looks at issues of testing frameworks, including common human errors. Explains fuzzers - a solution to this important problem in which computers generate inputs and find counter examples to enable more complete code testing and bug finding.

      Confreaks 2017 - DHCP: IT’S MOSTLY YELLING!! Discusses how the Dynamic Host Configuration Protocol (DHCP) is structured and how it is used in a network. Explains how addressing and packet structure (or yelling) in DHCP works to establish a connection, and what can go wrong. Looks at tcpdump as a way to examine this yelling along with DHCP options to help establish a quieter and more secure connection.

      Strange Loop 2015 - Non-Imperative Network Programming
      Discusses how network programming is often taught and practiced in C, but it doesn't have to be. We can build better network stacks -- ones more expressive, intuitive, and robust -- in other languages! There are many non-C network stacks in the world, and we can learn a lot from the diversity of solutions for common problems.

      -

      Stefanie Schirmer

      -

      Talks:

      +

      Stefanie Schirmer

      +

      Talks:

      Radical Networks 2019 - A Firewall for Your Radical Network (recording)
      Discusses how to give a general understanding and strategy plan for network security tailored to everyone's individual needs. Explains what a network protocol is and how we read it, including insecure and secure protocols. Looks at tools to analyze and learn about a network (e.g. wireshark, traceroute). The idea of QubesOS and how to structure your system into different Qubes and run them, focusing on configuring and testing a firewall and why it has been obscure in the past, using our [Qubes-Mirage-Firewall](/Our Work/Projects#Firewall).

      Berlin Buzzwords 2018 - Your Search Service as a Composable Function
      diff --git a/Our Work/Services b/Our Work/Services index 6429a1d..fa96d9d 100644 --- a/Our Work/Services +++ b/Our Work/Services @@ -1,14 +1,14 @@ Services

      Services

      Published: 2019-09-10 (last updated: 2019-09-10)

      We can work with you to design, develop and audit software and infrastructure to assist you in enhancing your technical security and reliability. Whilst we are not a service provider, and so can not offer to host applications, we can assist you in deploying MirageOS and OCaml services.

      -

      Design

      +

      Design

      Working with you to understand the needs of your organization, and how your software infrastructure is currently setup and used, we can assist you in working out any improvements you might require.

      We can consult on design for specific products to ensure you plan the best solution for a single application, or take a more holistic view of your infrastructure and protocols to improve speed, security and ease of use.

      We’re experienced in designing and reviewing serialization frameworks, network protocols, cryptographic protocols, and system architectures, and with solutions built on the FreeBSD and Linux operating systems, including sandboxing, hardening and exploit mitigations.

      -

      Develop

      +

      Develop

      Working with OCaml and MirageOS we can develop specific applications that give you high assurance of their security and functionality, which seamlessly integrate in your existing infrastructure.

      We can also work on a full stack approach to meet your needs and help a smooth migration plan for your organization.

      We can bring a variety of solutions, including basic network services, DNS, DHCP, TLS, persistent storage (like git), and are happy to expand these to your needs.

      -

      Audit

      +

      Audit

      We can provide code auditing services, particularly focusing on security and reducing code base. We have team members who have thorough experience working with OCaml, C (embedded, kernel and userspace), x86 assembly, Scala, Java, Android, Haskell, PHP and Python.

      Our audits can help ensure your environment is secure whilst also working with you to reduce attack service and increase speed. While we generally prefer “white-box” audits because we believe they yield the best results for the time invested, we also have experience with “black-box” penetration testing.

      Please contact us if you are interested in any of the above and we can discuss how we can assist you in developing a more secure architecture and for your organization.

      diff --git a/Our Work/Technology-Employed b/Our Work/Technology-Employed index 85e11d9..ac7a70c 100644 --- a/Our Work/Technology-Employed +++ b/Our Work/Technology-Employed @@ -1,5 +1,5 @@ -Technology Employed

      Technology Employed

      Published: 2019-09-10 (last updated: 2019-10-31)

      MirageOS

      +Technology Employed

      Technology Employed

      Published: 2019-09-10 (last updated: 2019-10-31)

      MirageOS

      MirageOS is a software suite to build custom-tailored operating systems from (mostly open source) small individual libraries. It has been developed since 2009 at the University of Cambridge, UK and is written in the programming language OCaml.

      It compiles the necessary OCaml libraries into a unikernel - a small operating system, each built for a certain purpose. For each unikernel we can pick from hundreds of permissively licensed open source libraries which implement network protocols, storage on block devices, or interfaces to network devices via the hypervisor or host operating system. As we only put into each one exactly what is needed, each unikernel is fast; instantly booting and, as there is less code base, it is easier to maintain and keep secure.

      As an example to see how lines of code compare, here are the number of lines of code needed for different elements of our Bitcoin Pinata, measured in thousands of lines of code:

      @@ -13,7 +13,7 @@

      MirageOS is an event-based operating system - it can manage tasks asynchronously. A task gives up the CPU it was using once its execution is finished, or if it has to wait for input. This model leads to a cooperative multitasking programming style, which is much less error prone to one that multi-tasks.

      A recent example for code which is not safe that used multitasking is in Ethereum, which lead to a huge amount of the cryptocurrency ether being stolen. Even established software like the Firefox JavaScript engine, or PHP shows similar problems on a regular basis.

      -

      More Technical Information on MirageOS:

      +

      More Technical Information on MirageOS:

      MirageOS is a library operating system where specialization of the running image is done at compile-time. It contains only the runtime system and application code, rendering all of the usual operating system kernel services obsolete, for example our DNS unikernel only needs OCaml runtime and UDP stack, not a full TCP/IP stack. Time and other resources from the OS are explicit instead of implicit, so if a random number generator, console, network interface or file system are needed they are explicitly configured. The simple design of the runtime, with smaller images, create a very fast runtime and MirageOS can boot in just milliseconds.

      MirageOS unikernels are clean slate operating systems, not POSIX compatible, that are written in a high level functional language, OCaml. The minimal code base, with minimal use of mutable state, allows us to reason about entire systems with adherence to specification. This leads to single-purpose systems with a minimal attack surface, where lots of layers of complexity (file system, scheduler, process management, virtual memory subsystem) are avoided.

      These unikernels can be a compiled natively as UNIX processes (with a size of about 4% of a UNIX based system), allowing for testing and debugging in a UNIX environment, and can then be deployed as a standalone virtual machine on a cloud service or hypervisor. On top of the hypervisor, a small layer of C code unifies the interface on which OCaml runs but there is no need to carry the whole C library.

      @@ -36,26 +36,26 @@


      -

      OCaml

      +

      OCaml

      OCaml is a mature programming language that is used both in industry (Facebook, Jane Street Capital, Docker, ahrefs, simcorp, lexifi) and academia.

      A large reason MirageOS and Robur software have security advantages over other technical projects is the programming language used - OCaml.

      OCaml is a functional programming language - the way in which one is forced to construct code minimizes potential bugs in the code, for example by remembering what events have taken place already in the code and not allowing these states to change unless specifically changed. All inputs, outputs and effects of a function are known.

      OCaml also helps avoid many common programming errors through automated memory management to avoid memory corruption, and type checking.

      OCaml's speed once complied is comparable to C code, one of the fastest languages. OCaml can also be compiled to JavaScript, so both client and server side of a web application can be developed in the same language, allowing for easier understanding of the full application and enhancing security.

      -

      More Technical Information on OCaml:

      -

      Concepts of the Language

      +

      More Technical Information on OCaml:

      +

      Concepts of the Language

      OCaml is a functional programming language with declarative code that minimizes side effects and mutable state. Its functional programming concepts give us a list of security advantages for MirageOS. OCaml avoids the root causes of common flaws in computer security and exploits in a number of ways.

      It is a memory safe language so the behavior of our core protocol logic is only dependent on arguments not arbitrary memory, avoiding memory corruption. OCaml's strings are immutable by default and type checking allows us to avoid many common programming errors, including guarding against leaky abstraction.

      A major advantage of functional programming is localized reasoning about program code. All inputs, outputs and effects of a function are known. Immutable data structures and cooperative multitasking allow us to reason about the state of the entire system, even if we use parallelism and complex distributed systems.

      OCaml lends itself by default to a programming style with explicit error handling. OCaml provides for isolated side effects like timers, IO and mutable state which is then giving an effectful layer on top of the pure protocol logic for the side effects. OCaml does supports exceptions, but they are not present in the type signatures [of functions] (unlike Java), and thus from the outside (e.g. when calling a function), it is not clear whether exceptions can be raised or not. For that reason, the coding style of exception-based error handling is avoided in MirageOS. Instead of relying on exceptions, we employ explicit error handling using result types and an error monad.

      -

      Verification

      +

      Verification

      A large subset of the OCaml semantics has been mechanically proven sound in a proof assistant.

      OCaml is the implementation language of the well-known proof assistant Coq. Development in Coq can be extracted to OCaml code, as demonstrated by CompCert, a formally verified optimizing C compiler, in order to be compiled and executed. The opposite direction is also possible: OCaml code can be translated into Coq definitions (using Coq of OCaml).

      -

      Compilation

      +

      Compilation

      OCaml code compiles to native code, which is competitive, and comparable to compiled C code. As an example, our TLS library has up to 85% of the bulk throughput of OpenSSL (using AES128-CBC). The TLS handshake performance is comparable with OpenSSL.

      The OCaml compiler generates native code for x86, arm, etc., and has a bytecode backend, which can target microcontrollers (PIC18 family in the OcaPIC project). OCaml can also be compiled to JavaScript, so both client and server side of a web application can be developed in the same language with shared interface code (more details at the Ocsigen project).

      In 2016, Facebook developed ReasonML, a dialect of OCaml which syntax is closer to JavaScript, and easier to comprehend for beginners coming from that family of programming languages. ReasonML and OCaml code can be easily combined into a single application, since they use the same compiler.

      -

      Further Information

      +

      Further Information

      There is active work on OCaml language development and its runtime system. More literature on why OCaml is a good choice has been written by Yaron Minsky (Jane Street) in the article OCaml for the masses, and more recently by the crypto-ledger Tezos.

      Contact Donate

      diff --git a/Projects/Reproducible_builds b/Projects/Reproducible_builds index 4a0c2f4..c6e0133 100644 --- a/Projects/Reproducible_builds +++ b/Projects/Reproducible_builds @@ -3,12 +3,12 @@

      The overall goal is to push MirageOS into production in a trustworthy way. We worked on reproducible builds for Opam packages and MirageOS - with the infrastructure being reproducible itself. Reproducible builds are crucial for supply chain security - everyone can reproduce the exact same binary (by using the same sources and environment), without reproducible builds we would not publish binaries.

      Reproducible builds are also great for fleet management: by inspecting the hash of the binary that is executed, we can figure out which versions of which libraries are in the unikernel - and suggest updates if newer builds are available or if a used library has a security flaw -- albatross-client update my-unikernel is everything needed for an update.

      Several ready-to-use MirageOS unikernels are built on a daily basis - ranging from authoritative DNS servers (secondary, let's encrypt DNS solver), DNS-and-DHCP service (similar to dnsmasq), TLS reverse proxy, Unipi - a web server that delivers content from a git repository, DNS resolver, CalDAV server, and of course your own MirageOS unikernel.

      -

      Brief robur and MirageOS introduction

      +

      Brief robur and MirageOS introduction

      MirageOS is an operating system, developed in OCaml, which produces unikernels. A unikernel serves a single purpose and is a single process, i.e. only has the really needed dependencies. For example, an OpenVPN endpoint does neither include persistent storage (block device, file system) nor user management. MirageOS unikernels are developed in OCaml, a statically typed and type-safe programming language - which avoids common pitfalls from the grounds up (spatial and temporal memory safety issues).

      Robur is a collective that develops MirageOS and OCaml software with open source license. It was started in 2017, and is part of the non-profit company Änderwerk gGmbH. We received funding from several projects (prototypefund, NGI pointer), donations, and commercial contracts.

      -

      Deploying MirageOS unikernel

      +

      Deploying MirageOS unikernel

      To run a MirageOS unikernel on your laptop or computer with virtualization extensions (VT-x - KVM/BHyve), you first have to install the solo5 and albatross packages. Afterwards you need to setup a virtual network switch (a bridge interface) where your unikernels will communicate, and forwarding.

      -

      Host system package installation

      +

      Host system package installation

      For Debian and Ubuntu systems, we provide package repositories. Browse the dists folder for one matching your distribution, and add it to /etc/apt/sources.list:

      $ curl -fsSL https://apt.robur.coop/gpg.pub | gpg --dearmor > /usr/share/keyrings/apt.robur.coop.gpg
 $ echo "deb [signed-by=/usr/share/keyrings/apt.robur.coop.gpg] https://apt.robur.coop ubuntu-20.04 main" > /etc/apt/sources.list.d/robur.list # replace ubuntu-20.04 with e.g. debian-11 on a debian buster machine
@@ -39,7 +39,7 @@ $ Ctrl-C # kill that process

      Voila, we have a working albatross installation. Albatross also supports a remote client (using a TLS handshake) albatross-client --ca <ca.pem> --ca-key <ca.key> --server-ca <cacert.pem> --destination <myhost>, monitoring of unikernels (albatross_stats and albatross_influx services), and a TLS endpoint (inetd/systemd: albatross-tls-endpoint).

      Please ensure to have albatross in version of at least 2.0.0 to follow this page.

      -

      Network for your unikernel

      +

      Network for your unikernel

      Next we want to setup networking for our unikernels. We use a so-called "bridge" interface for this, which is a virtual network switch where you connect "tap" interfaces (layer 2 ethernet devices). A MirageOS unikernel uses tap interfaces for communication. We give our bridge the name "service" (and for example for monitoring and management you may want to setup another bridge "management").

      If you're using a network manager that is capable of setting up bridge interfaces, use that interface.

      If not, on Linux you can add the following to /etc/network/interfaces (the reason for adding a dummy interface to the bridge is that otherwise Linux uses the mac address of the first connected tap interface, and there'll be rather confusing issues):

      @@ -74,7 +74,7 @@ $ Ctrl-C # kill that process $ albatross-client destroy my-website # kills the unikernel

      When you reached this point, you have successfully launched a MirageOS unikernel, and are able to communicate from your computer with it. This uses the OCaml networking stack, and the host bridge interface.

      -

      Routing and Internet

      +

      Routing and Internet

      Your unikernel may want to communicate not only with your host, but also with the Internet. The other way around is also important (the Internet wants to talk with your unikernel).

      There are several options, depending on your setup:

        @@ -85,7 +85,7 @@ $ albatross-client destroy my-website # kills the unikernel
      • Your computer acts as a router for a subnet.
      -

      NAT

      +

      NAT

      This won't allow your unikernel to be reachable from the outside.You'll need to:

      • enable IPv4 forwarding @@ -102,13 +102,13 @@ $ iptables -t nat -A POSTROUTING -o enp0s20f0 -j MASQUERADE # replace enp0s20f0 $ echo 'pf_enable="YES"' >> /etc/rc.conf # enables the packet filter $ echo "nat pass on em0 inet from 10.0.42.0/24 to any -> (em0)" >> /etc/pf.conf # replace em0 with your ethernet interface) -

        Public IP addresses

        +

        Public IP addresses

        To put your unikernels on the same network as your host system, add that external network interface to the bridge:

        On Linux, add up ip link set dev enp0s20f0 master service in /etc/network/interfaces (replace enp0s20f0 with your ethernet interface). On FreeBSD, add ifconfig_service="addm em0" to /etc/rc.conf (replace em0 with your ethernet interface).

        -

        Router

        +

        Router

        Enable IPv4 forwarding, and setup one IP address on the bridge (replacing the 10.0.42.1/24 above).

        -

        Unikernel execution

        +

        Unikernel execution

        Let's test that your unikernels have access to the Internet by using the traceroute unikernel:

        $ wget https://builds.robur.coop/job/traceroute/build/latest/bin/traceroute.hvt
 $ albatross-client console my-traceroute & # this is sent to the background since it waits and displays the console of the unikernel named "my-traceroute"
diff --git a/atom b/atom
index 21a08a1..9e8e743 100644
--- a/atom
+++ b/atom
@@ -2,12 +2,12 @@
 <p>The overall goal is to push MirageOS into production in a trustworthy way. We worked on reproducible builds for <a href="https://opam.ocaml.org">Opam</a> packages and <a href="https://mirageos.org">MirageOS</a> - with the infrastructure being reproducible itself. Reproducible builds are crucial for supply chain security - everyone can reproduce the exact same binary (by using the same sources and environment), without reproducible builds we would not publish binaries.</p>
 <p>Reproducible builds are also great for fleet management: by inspecting the hash of the binary that is executed, we can figure out which versions of which libraries are in the unikernel - and suggest updates if newer builds are available or if a used library has a security flaw -- <code>albatross-client update my-unikernel</code> is everything needed for an update.</p>
 <p>Several ready-to-use MirageOS unikernels are built on a daily basis - ranging from <a href="https://builds.robur.coop/job/dns-primary-git/">authoritative DNS servers</a> (<a href="https://builds.robur.coop/job/dns-secondary/">secondary</a>, <a href="https://builds.robur.coop/job/dns-letsencrypt-secondary/">let's encrypt DNS solver</a>), <a href="https://builds.robur.coop/job/dnsvizor/">DNS-and-DHCP service (similar to dnsmasq)</a>, <a href="https://builds.robur.coop/job/tlstunnel/">TLS reverse proxy</a>, <a href="https://builds.robur.coop/job/unipi/">Unipi - a web server that delivers content from a git repository</a>, <a href="https://builds.robur.coop/job/dns-resolver/">DNS resolver</a>, <a href="https://builds.robur.coop/job/caldav/">CalDAV server</a>, and of course your own MirageOS unikernel.</p>
-<h2>Brief robur and MirageOS introduction</h2>
+<h2 id="brief-robur-and-mirageos-introduction">Brief robur and MirageOS introduction</h2>
 <p><a href="https://mirageos.org">MirageOS</a> is an operating system, developed in OCaml, which produces unikernels. A unikernel serves a single purpose and is a single process, i.e. only has the really needed dependencies. For example, an OpenVPN endpoint does neither include persistent storage (block device, file system) nor user management. MirageOS unikernels are developed in <a href="https://ocaml.org">OCaml</a>, a statically typed and type-safe programming language - which avoids common pitfalls from the grounds up (spatial and temporal memory safety issues).</p>
 <p><a href="https://robur.coop">Robur</a> is a collective that develops MirageOS and OCaml software with open source license. It was started in 2017, and is part of the non-profit company <a href="https://aenderwerk.de">Änderwerk gGmbH</a>. We received funding from several projects (<a href="https://prototypefund.de">prototypefund</a>, <a href="https://pointer.ngi.eu">NGI pointer</a>), donations, and commercial contracts.</p>
-<h2>Deploying MirageOS unikernel</h2>
+<h2 id="deploying-mirageos-unikernel">Deploying MirageOS unikernel</h2>
 <p>To run a MirageOS unikernel on your laptop or computer with virtualization extensions (VT-x - KVM/BHyve), you first have to install the <code>solo5</code> and <code>albatross</code> packages. Afterwards you need to setup a virtual network switch (a bridge interface) where your unikernels will communicate, and forwarding.</p>
-<h3>Host system package installation</h3>
+<h3 id="host-system-package-installation">Host system package installation</h3>
 <p>For Debian and Ubuntu systems, we provide package repositories. Browse the <a href="https://apt.robur.coop/dists">dists</a> folder for one matching your distribution, and add it to <code>/etc/apt/sources.list</code>:</p>
 <pre><code>$ curl -fsSL https://apt.robur.coop/gpg.pub | gpg --dearmor &gt; /usr/share/keyrings/apt.robur.coop.gpg
 $ echo &quot;deb [signed-by=/usr/share/keyrings/apt.robur.coop.gpg] https://apt.robur.coop ubuntu-20.04 main&quot; &gt; /etc/apt/sources.list.d/robur.list # replace ubuntu-20.04 with e.g. debian-11 on a debian buster machine
@@ -38,7 +38,7 @@ $ Ctrl-C # kill that process
 </code></pre>
 <p>Voila, we have a working albatross installation. Albatross also supports a remote client (using a TLS handshake) <code>albatross-client --ca &lt;ca.pem&gt; --ca-key &lt;ca.key&gt; --server-ca &lt;cacert.pem&gt; --destination &lt;myhost&gt;</code>, monitoring of unikernels (<code>albatross_stats</code> and <code>albatross_influx</code> services), and a TLS endpoint (inetd/systemd: <code>albatross-tls-endpoint</code>).</p>
 <p>Please ensure to have albatross in version of at least 2.0.0 to follow this page.</p>
-<h3>Network for your unikernel</h3>
+<h3 id="network-for-your-unikernel">Network for your unikernel</h3>
 <p>Next we want to setup networking for our unikernels. We use a so-called &quot;bridge&quot; interface for this, which is a virtual network switch where you connect &quot;tap&quot; interfaces (layer 2 ethernet devices). A MirageOS unikernel uses tap interfaces for communication. We give our bridge the name &quot;service&quot; (and for example for monitoring and management you may want to setup another bridge &quot;management&quot;).</p>
 <p>If you're using a network manager that is capable of setting up bridge interfaces, use that interface.</p>
 <p>If not, on Linux you can add the following to <code>/etc/network/interfaces</code> (the reason for adding a dummy interface to the bridge is that otherwise Linux uses the mac address of the first connected tap interface, and there'll be rather confusing issues):</p>
@@ -73,7 +73,7 @@ $ Ctrl-C # kill that process
 $ albatross-client destroy my-website # kills the unikernel
 </code></pre>
 <p>When you reached this point, you have successfully launched a MirageOS unikernel, and are able to communicate from your computer with it. This uses the OCaml networking stack, and the host bridge interface.</p>
-<h2>Routing and Internet</h2>
+<h2 id="routing-and-internet">Routing and Internet</h2>
 <p>Your unikernel may want to communicate not only with your host, but also with the Internet. The other way around is also important (the Internet wants to talk with your unikernel).</p>
 <p>There are several options, depending on your setup:</p>
 <ul>
@@ -84,7 +84,7 @@ $ albatross-client destroy my-website # kills the unikernel
 <li>Your computer acts as a router for a subnet.
 </li>
 </ul>
-<h3>NAT</h3>
+<h3 id="nat">NAT</h3>
 <p>This won't allow your unikernel to be reachable from the outside.You'll need to:</p>
 <ul>
 <li>enable IPv4 forwarding
@@ -101,13 +101,13 @@ $ iptables -t nat -A POSTROUTING -o enp0s20f0 -j MASQUERADE # replace enp0s20f0
 $ echo 'pf_enable=&quot;YES&quot;' &gt;&gt; /etc/rc.conf # enables the packet filter
 $ echo &quot;nat pass on em0 inet from 10.0.42.0/24 to any -&gt; (em0)&quot; &gt;&gt; /etc/pf.conf # replace em0 with your ethernet interface)
 </code></pre>
-<h3>Public IP addresses</h3>
+<h3 id="public-ip-addresses">Public IP addresses</h3>
 <p>To put your unikernels on the same network as your host system, add that external network interface to the bridge:</p>
 <p>On Linux, add <code>up ip link set dev enp0s20f0 master service</code> in <code>/etc/network/interfaces</code> (replace enp0s20f0 with your ethernet interface).
 On FreeBSD, add <code>ifconfig_service=&quot;addm em0&quot;</code> to <code>/etc/rc.conf</code> (replace em0 with your ethernet interface).</p>
-<h3>Router</h3>
+<h3 id="router">Router</h3>
 <p>Enable IPv4 forwarding, and setup one IP address on the bridge (replacing the 10.0.42.1/24 above).</p>
-<h2>Unikernel execution</h2>
+<h2 id="unikernel-execution">Unikernel execution</h2>
 <p>Let's test that your unikernels have access to the Internet by using the <a href="https://hannes.robur.coop/Posts/Traceroute">traceroute</a> unikernel:</p>
 <pre><code>$ wget https://builds.robur.coop/job/traceroute/build/latest/bin/traceroute.hvt
 $ albatross-client console my-traceroute &amp; # this is sent to the background since it waits and displays the console of the unikernel named &quot;my-traceroute&quot;
@@ -116,7 +116,7 @@ $ fg # back to albatross-client console
 $ Ctrl-C # kill that process
 </code></pre>
 <p>That's it. Albatross has more features, such as block devices, multiple bridges (for management, private networks, ...), restart if the unikernel exited with specific exit code, assignment of a unikernel to a specific CPU. It also has remote command execution and resource limits (you can allow your friends to execute a number of unikernels with limited memory and block storage accessing only some of your bridges). There is a daemon to collect metrics and report them to Grafana (via Telegraf and Influx). MirageOS unikernels also support IPv6, you're not limited to legacy IP.</p>
-urn:uuid:a225bf44-9230-569f-8852-1b5d2132a749Robur Reproducible Builds2023-09-21T14:46:48-00:00canopy2019-09-10T19:40:14-00:00<h1>MirageOS</h1>
+urn:uuid:a225bf44-9230-569f-8852-1b5d2132a749Robur Reproducible Builds2023-09-21T14:46:48-00:00canopy2019-09-10T19:40:14-00:00<h1 id="mirageos">MirageOS</h1>
 <p>MirageOS is a software suite to build custom-tailored operating systems from (mostly open source) small individual libraries. It has been developed since 2009 at the University of Cambridge, UK and is written in the programming language <a href="/Our%20Work/Technology-Employed#OCaml">OCaml</a>.</p>
 <p>It compiles the necessary OCaml libraries into a unikernel - a small operating system, each built for a certain purpose. For each unikernel we can pick from hundreds of permissively licensed open source libraries which implement network protocols, storage on block devices, or interfaces to network devices via the hypervisor or host operating system. As we only put into each one exactly what is needed, each unikernel is fast; instantly booting and, as there is less code base, it is easier to maintain and keep secure.</p>
 <p>As an example to see how lines of code compare, here are the number of lines of code needed for different elements of our <a href="/Our%20Work/Projects#Bitcoin%20Pinata">Bitcoin Pinata</a>, measured in thousands of lines of code:</p>
@@ -130,7 +130,7 @@ $ Ctrl-C # kill that process
 </table>
 <p>MirageOS is an event-based operating system - it can manage tasks asynchronously. A task gives up the CPU it was using once its execution is finished, or if it has to wait for input. This model leads to a cooperative multitasking programming style, which is much less error prone to one that multi-tasks.</p>
 <p>A recent example for code which is not safe that used multitasking is in Ethereum, which lead to a huge amount of the cryptocurrency ether being stolen. Even established software like the Firefox JavaScript engine, or PHP shows similar problems on a regular basis.</p>
-<h4>More Technical Information on MirageOS:</h4>
+<h4 id="more-technical-information-on-mirageos">More Technical Information on MirageOS:</h4>
 <p>MirageOS is a library operating system where specialization of the running image is done at compile-time. It contains only the runtime system and application code, rendering all of the usual operating system kernel services obsolete, for example our DNS unikernel only needs OCaml runtime and UDP stack, not a full TCP/IP stack. Time and other resources from the OS are explicit instead of implicit, so if a random number generator, console, network interface or file system are needed they are explicitly configured. The simple design of the runtime, with smaller images, create a very fast runtime and MirageOS can boot in just milliseconds.</p>
 <p>MirageOS unikernels are clean slate operating systems, not POSIX compatible, that are written in a high level functional language, OCaml. The minimal code base, with minimal use of mutable state, allows us to reason about entire systems with adherence to specification. This leads to single-purpose systems with a minimal attack surface, where lots of layers of complexity (file system, scheduler, process management, virtual memory subsystem) are avoided.</p>
 <p>These unikernels can be a compiled natively as UNIX processes (with a size of about 4% of a UNIX based system), allowing for testing and debugging in a UNIX environment, and can then be deployed as a standalone virtual machine on a cloud service or hypervisor. On top of the hypervisor, a small layer of C code unifies the interface on which OCaml runs but there is no need to carry the whole C library.</p>
@@ -153,43 +153,43 @@ $ Ctrl-C # kill that process
 <br />
 <br />
 <br />
-<h1>OCaml</h1>
+<h1 id="ocaml">OCaml</h1>
 <p>OCaml is a mature programming language that is used both in industry (Facebook, Jane Street Capital, Docker, ahrefs, simcorp, lexifi) and academia.</p>
 <p>A large reason MirageOS and Robur software have security advantages over other technical projects is the programming language used - OCaml.</p>
 <p>OCaml is a functional programming language - the way in which one is forced to construct code minimizes potential bugs in the code, for example by remembering what events have taken place already in the code and not allowing these states to change unless specifically changed. All inputs, outputs and effects of a function are known.</p>
 <p>OCaml also helps avoid many common programming errors through automated memory management to avoid memory corruption, and type checking.</p>
 <p>OCaml's speed once complied is comparable to C code, one of the fastest languages. OCaml can also be compiled to JavaScript, so both client and server side of a web application can be developed in the same language, allowing for easier understanding of the full application and enhancing security.</p>
-<h4>More Technical Information on OCaml:</h4>
-<h3>Concepts of the Language</h3>
+<h4 id="more-technical-information-on-ocaml">More Technical Information on OCaml:</h4>
+<h3 id="concepts-of-the-language">Concepts of the Language</h3>
 <p>OCaml is a functional programming language with declarative code that minimizes side effects and mutable state. Its functional programming concepts give us a list of security advantages for MirageOS. OCaml avoids the root causes of common flaws in computer security and exploits in a number of ways.</p>
 <p>It is a memory safe language so the behavior of our core protocol logic is only dependent on arguments not arbitrary memory, avoiding memory corruption. OCaml's strings are immutable by default and type checking allows us to avoid many common programming errors, including guarding against leaky abstraction.</p>
 <p>A major advantage of functional programming is localized reasoning about program code. All inputs, outputs and effects of a function are known. Immutable data structures and cooperative multitasking allow us to reason about the state of the entire system, even if we use parallelism and complex distributed systems.</p>
 <p>OCaml lends itself by default to a programming style with explicit error handling. OCaml provides for isolated side effects like timers, IO and mutable state which is then giving an effectful layer on top of the pure protocol logic for the side effects. OCaml does supports exceptions, but they are not present in the type signatures [of functions] (unlike Java), and thus from the outside (e.g. when calling a function), it is not clear whether exceptions can be raised or not. For that reason, the coding style of exception-based error handling is avoided in MirageOS. Instead of relying on exceptions, we employ explicit error handling using result types and an error monad.</p>
-<h3>Verification</h3>
+<h3 id="verification">Verification</h3>
 <p>A large subset of the OCaml semantics has been mechanically proven sound in a proof assistant.</p>
 <p>OCaml is the implementation language of the well-known proof assistant Coq. Development in Coq can be extracted to OCaml code, as demonstrated by CompCert, a formally verified optimizing C compiler, in order to be compiled and executed. The opposite direction is also possible: OCaml code can be translated into Coq definitions (using Coq of OCaml).</p>
-<h3>Compilation</h3>
+<h3 id="compilation">Compilation</h3>
 <p>OCaml code compiles to native code, which is competitive, and comparable to compiled C code. As an example, our TLS library has up to 85% of the bulk throughput of OpenSSL (using AES128-CBC). The TLS handshake performance is comparable with OpenSSL.</p>
 <p>The OCaml compiler generates native code for x86, arm, etc., and has a bytecode backend, which can target microcontrollers (PIC18 family in the OcaPIC project). OCaml can also be compiled to JavaScript, so both client and server side of a web application can be developed in the same language with shared interface code (more details at the Ocsigen project).</p>
 <p>In 2016, Facebook developed ReasonML, a dialect of OCaml which syntax is closer to JavaScript, and easier to comprehend for beginners coming from that family of programming languages. ReasonML and OCaml code can be easily combined into a single application, since they use the same compiler.</p>
-<h3>Further Information</h3>
+<h3 id="further-information">Further Information</h3>
 <p>There is active work on OCaml language development and its runtime system. More literature on why OCaml is a good choice has been written by Yaron Minsky (Jane Street) in the article <a href="https://queue.acm.org/detail.cfm?id=2038036">OCaml for the masses</a>, and more recently by the crypto-ledger <a href="https://tezos.com/static/position_paper-841a0a56b573afb28da16f6650152fb4.pdf">Tezos</a>.</p>
 urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaTechnology Employed2019-10-31T12:06:40-00:00canopy2019-09-10T19:40:14-00:00<p>We can work with you to design, develop and audit software and infrastructure to assist you in enhancing your technical security and reliability. Whilst we are not a service provider, and so can not offer to host applications, we can assist you in deploying MirageOS and OCaml services.</p>
-<h3>Design</h3>
+<h3 id="design">Design</h3>
 <p>Working with you to understand the needs of your organization, and how your software infrastructure is currently setup and used, we can assist you in working out any improvements you might require.</p>
 <p>We can consult on design for specific products to ensure you plan the best solution for a single application, or take a more holistic view of your infrastructure and protocols to improve speed, security and ease of use.</p>
 <p>We’re experienced in designing and reviewing serialization frameworks, network protocols, cryptographic protocols, and system architectures, and with solutions built on the FreeBSD and Linux operating systems, including sandboxing, hardening and exploit mitigations.</p>
-<h3>Develop</h3>
+<h3 id="develop">Develop</h3>
 <p>Working with <a href="/Our%20Work/Technology-Employed#OCaml">OCaml</a> and <a href="/Our%20Work/Technology-Employed#MirageOS">MirageOS</a> we can develop specific applications that give you high assurance of their security and functionality, which seamlessly integrate in your existing infrastructure.</p>
 <p>We can also work on a full stack approach to meet your needs and help a smooth migration plan for your organization.</p>
 <p>We can bring a variety of solutions, including basic network services, DNS, DHCP, TLS, persistent storage (like git), and are happy to expand these to your needs.</p>
-<h3>Audit</h3>
+<h3 id="audit">Audit</h3>
 <p>We can provide code auditing services, particularly focusing on security and reducing code base. We have team members who have thorough experience working with OCaml, C (embedded, kernel and userspace), x86 assembly, Scala, Java, Android, Haskell, PHP and Python.</p>
 <p>Our audits can help ensure your environment is secure whilst also working with you to reduce attack service and increase speed. While we generally prefer “white-box” audits because we believe they yield the best results for the time invested, we also have experience with “black-box” penetration testing.</p>
 <p>Please <a href="/Contact">contact us</a> if you are interested in any of the above and we can discuss how we can assist you in developing a more secure architecture and for your organization.</p>
 urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaServices2019-09-10T22:09:34-00:00canopy2019-09-10T19:40:14-00:00<p>We regularly give talks and write publications about our work, OCaml and MirageOS and other aspects of coding, security and computer science that we have expertise in. Below are some examples of these, if you are interested in having a Robur member speak at your event please <a href="/Contact">reach out</a> to us.</p>
-<h1>Hannes Mehnert</h1>
-<h3>Talks:</h3>
+<h1 id="hannes-mehnert">Hannes Mehnert</h1>
+<h3 id="talks">Talks:</h3>
 <p>Chaos Communication Congress 2019 (36c3) - <a href="https://media.ccc.de/v/36c3-11172-leaving_legacy_behind">Leaving Legacy Behind</a><br />
 Presenting the current state of MirageOS unikernels, with a focus on the reduction on resource usage (carbon footprint) of network services.</p>
 <p>CERN Computing Seminar 2019 – <a href="https://cds.cern.ch/record/2674523">MirageOS: robust and secure services for the cloud</a><br />
@@ -200,26 +200,26 @@ Presents a formal model of TCP/IP (developed 2000-2009 and refurbished since 201
 This is a continuation of earlier talks at BornHack (2016, 2017), and goes into detail of some active projects, such as: community repository signing (for secure updates), DNS infrastructure, our Prototype Fund sponsored CalDAV-server.</p>
 <p>Chaos Communication Congress 2018 (35c3) - <a href="https://media.ccc.de/v/35c3-9674-domain_name_system">Domain Name System</a><br />
 Discusses the basic usage of DNS, including stub and recursive resolver, server; various protocol extensions including zone transfer, dynamic updates, authentication, notifications; privacy extensions (query path minimization, DNS-over-TLS); provisioning let's encrypt certificates; and attacks (poisoning, amplification). Explains the Robur implementation of DNS with above mentioned extensions as minimized MirageOS unikernels.</p>
-<h3>Publications:</h3>
+<h3 id="publications">Publications:</h3>
 <p><a href="https://dl.acm.org/citation.cfm?id=3243650">Engineering with Logic: Rigorous Test-Oracle Specification and Validation for TCP/IP and the Sockets API (JACM vol 66, January 2019)</a>, <a href="https://www.cl.cam.ac.uk/~pes20/Netsem/paper3.pdf">full paper.</a> (Steve Bishop, Matthew Fairbairn, Hannes Mehnert, Michael Norrish, Tom Ridge, Peter Sewell, Michael Smith, Keith Wansbrough)</p>
 <p><a href="https://usenix15.nqsb.io">Not-quite-so-broken TLS: lessons in re-engineering a security protocol specification and implementation (Usenix security 2015)</a>, <a href="https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/kaloper-mersinjak">video presentation</a> (David Kaloper-Meršinjak, Hannes Mehnert, Anil Madhavapeddy, Peter Sewell)</p>
 <p><a href="https://tron.nqsb.io">Not-quite-so-broken TLS 1.3 Mechanized Conformance Checking - TLS 1.3 Ready or Not (TRON)</a>, <a href="https://www.ndss-symposium.org/ndss2016/tron-workshop-programme/">workshop website</a> (David Kaloper-Meršinjak and Hannes Mehnert)</p>
-<h1>Martin Lucina</h1>
-<h3>Talks:</h3>
+<h1 id="martin-lucina">Martin Lucina</h1>
+<h3 id="talks-1">Talks:</h3>
 <p>FOSDEM 2019 - <a href="https://archive.fosdem.org/2019/schedule/event/solo5_unikernels/">Solo5: A sandboxed, re-targetable execution environment for unikernels</a><br />
 Explains Solo5 which is a microkernel-friendly, sandboxed, re-targetable execution environment for unikernels, with a taste for minimalism. Presents the interfaces it offers to the unikernel/library operating system/application developer. Using existing library operating systems, such as MirageOS, demonstrates the developer experience for various Solo5 targets, going on to show how rigorously applying minimalist principles to interface design is used to our advantage, blurring traditional lines between unikernels, processes, kernels and hypervisors.</p>
-<h3>Publications:</h3>
+<h3 id="publications-1">Publications:</h3>
 <p><a href="https://dl.acm.org/citation.cfm?id=3267845">Unikernels as Processes - ACM Symposium on Cloud Computing 2018</a> (Dan Williams, Ricardo Koller, Martin Lucina, Nikhil Prakash)</p>
-<h1>Mindy Preston</h1>
-<h3>Talks:</h3>
+<h1 id="mindy-preston">Mindy Preston</h1>
+<h3 id="talks-2">Talks:</h3>
 <p>DevOpsDays MSN 2018 - <a href="https://www.youtube.com/watch?v=BtJsakoXxdY">FuzzOps</a><br />
 Discusses testing software to find bugs before deploying software, including continuous integration solutions and property-based testing. Looks at issues of testing frameworks, including common human errors. Explains fuzzers - a solution to this important problem in which computers generate inputs and find counter examples to enable more complete code testing and bug finding.</p>
 <p>Confreaks 2017 - <a href="https://www.youtube.com/watch?v=enRY9jd0IJw">DHCP: IT’S MOSTLY YELLING!!</a>
 Discusses how the Dynamic Host Configuration Protocol (DHCP) is structured and how it is used in a network. Explains how addressing and packet structure (or yelling) in DHCP works to establish a connection, and what can go wrong. Looks at tcpdump as a way to examine this yelling along with DHCP options to help establish a quieter and more secure connection.</p>
 <p>Strange Loop 2015 - <a href="https://www.youtube.com/watch?v=GNc1t6Q5Dls">Non-Imperative Network Programming</a><br />
 Discusses how network programming is often taught and practiced in C, but it doesn't have to be. We can build better network stacks -- ones more expressive, intuitive, and robust -- in other languages! There are many non-C network stacks in the world, and we can learn a lot from the diversity of solutions for common problems.</p>
-<h1>Stefanie Schirmer</h1>
-<h3>Talks:</h3>
+<h1 id="stefanie-schirmer">Stefanie Schirmer</h1>
+<h3 id="talks-3">Talks:</h3>
 <p>Radical Networks 2019 - <a href="https://radicalnetworks.org/participants/stefanie-schirmer/">A Firewall for Your Radical Network</a> (<a href="https://livestream.com/internetsociety/radnets19/videos/197991963">recording</a>)<br />
 Discusses how to give a general understanding and strategy plan for network security tailored to everyone's individual needs. Explains what a network protocol is and how we read it, including insecure and secure protocols. Looks at tools to analyze and learn about a network (e.g. wireshark, traceroute). The idea of QubesOS and how to structure your system into different Qubes and run them, focusing on configuring and testing a firewall and why it has been obscure in the past, using our [Qubes-Mirage-Firewall](/Our Work/Projects#Firewall).</p>
 <p>Berlin Buzzwords 2018 - <a href="https://www.youtube.com/watch?v=4Yag3SrAMnI">Your Search Service as a Composable Function</a><br />
@@ -232,18 +232,18 @@ Talks about the case study of building an API-first architecture at Etsy. She ta
 According to Wikipedia a shell script is a computer program designed to be run by a command line interpreter. Typical operations performed by shell scripts include file manipulation, program execution, and printing text. Sounds complicated? In this talk Stefanie Schirmer shows how to build a shell in ten minutes.</p>
 <p>JSConf EU 2015 - <a href="https://www.youtube.com/watch?v=6Qx5ZAbfqjo">Functional programming and curry cooking in JS</a><br />
 This talk explores functional programming concepts, which help us create powerful abstractions to master complex problems and create more simple and elegant programs. JavaScript allows us to ease into the functional programming style, letting us focus just on the concepts, without the distraction of learning a specific functional programming language. To make the dry functional programming concepts more digestible, we use cooking as an analogy. And since the logician Haskell Curry invented functional programming, we combine our journey in JavaScript with examples and recipes for tasty curry dishes.</p>
-urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaPublications and Talks2020-01-07T11:22:12-00:00canopy2019-09-10T19:40:14-00:00<h1>Robur Reproducible Builds</h1>
+urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaPublications and Talks2020-01-07T11:22:12-00:00canopy2019-09-10T19:40:14-00:00<h1 id="robur-reproducible-builds">Robur Reproducible Builds</h1>
 <p>In 2021 we in <a href="https://robur.coop/">Robur</a> have been working towards easing deployment of reproducible mirage applications. The work has been funded by the Eurepean Union under the <a href="https://pointer.ngi.eu/">Next Generation Internet (NGI Pointer) initiative</a>. The result is <a href="https://builds.robur.coop">online</a>.</p>
 <p>The overall goal is to push MirageOS into production in a trustworthy way. We worked on reproducible builds for <a href="https://opam.ocaml.org">Opam</a> packages and <a href="https://mirageos.org">MirageOS</a> - with the infrastructure being reproducible itself. Reproducible builds are crucial for supply chain security - everyone can reproduce the exact same binary (by using the same sources and environment), without reproducible builds we would not publish binaries.</p>
 <p>Reproducible builds are also great for fleet management: by inspecting the hash of the binary that is executed, we can figure out which versions of which libraries are in the unikernel - and suggest updates if newer builds are available or if a used library has a security flaw -- <code>albatross-client-local update my-unikernel</code> is everything needed for an update.</p>
 <p>Several ready-to-use MirageOS unikernels are built on a daily basis - ranging from <a href="https://builds.robur.coop/job/dns-primary-git/">authoritative DNS servers</a> (<a href="https://builds.robur.coop/job/dns-secondary/">secondary</a>, <a href="https://builds.robur.coop/job/dns-letsencrypt-secondary/">let's encrypt DNS solver</a>), <a href="https://builds.robur.coop/job/dnsvizor/">DNS-and-DHCP service (similar to dnsmasq)</a>, <a href="https://builds.robur.coop/job/tlstunnel/">TLS reverse proxy</a>, <a href="https://builds.robur.coop/job/unipi/">Unipi - a web server that delivers content from a git repository</a>, <a href="https://builds.robur.coop/job/dns-resolver/">DNS resolver</a>, <a href="https://builds.robur.coop/job/caldav/">CalDAV server</a>, and of course your own MirageOS unikernel.</p>
 <p><a href="/Projects/Reproducible_builds">read more</a></p>
-<h1>Bitcoin Piñata</h1>
+<h1 id="bitcoin-piñata">Bitcoin Piñata</h1>
 <p>The <a href="http://ownme.ipredator.se">Bitcoin Piñata</a> is a transparent <a href="https://en.wikipedia.org/wiki/Bug_bounty_program">bug bounty</a>: it holds the private key for a bitcoin wallet. It is a <a href="/Our%20Work/Technology-Employed#MirageOS">MirageOS unikernel</a> designed to test our TLS and all underlying transport implementations.</p>
 <p>Its open communication channels are HTTP and HTTPS, and a TLS client and TLS server endpoint, all written in <a href="/Our%20Work/Technology-Employed#OCaml">OCaml</a>. The cryptographic material for TLS is generated on startup in the Piñata and is supposed to never leave it. However, if an attacker manages to establish a mutually authenticated (using certificates) TLS channel, the private key to the bitcoin wallet is transmitted over this channel, and the attacker gains access to the bait (the bitcoins).</p>
 <p>The project was <a href="https://mirage.io/announcing-bitcoin-pinata">launched</a> on February 10th 2015. At this time friends from the IPredator project lent us 10 bitcoins (back then worth ~2000 EUR) for the bait. By 2018 no one had successfully cracked the Piñata and the bitcoins, by this point worth ~200 000 EUR, were repurposed for other projects, however the project remains live, with a small amount of bitcoins in it, for anyone wishing to try to crack it.</p>
 <p><a href="/About%20Us/Team">Hannes Mehnert</a> and David Kaloper-Meršinjak designed the Bitcoin Piñata to attract security professionals to look into our <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security">TLS</a> stack, developed purely in OCaml since early 2014.</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information">More technical information:</h4>
 <p>On startup, the Piñata generates its certificate authority on the fly, including certificates and private keys, this means that only the Piñata itself contains private keys which can authenticate successfully.</p>
 <p>The codebase is <a href="/Our%20Work/Technology-Employed#MirageOS">thousands of lines of code smaller</a> than equivalent implementations and we did not use many external libraries, and those we had to use we read carefully to avoid security issues.</p>
 <p>The attack surface is any part of the unikernel (or deployment) - anything allowing you to get a valid certificate (signed by the cryptographic material which shouldn't leave the Piñata), or reading the memory location where the private key to the bitcoin wallet is stored, an exploitable flaw in any software layer (OCaml runtime, virtual network device, TCP/IP stack, TLS library, X.509 validation, or elsewhere), or anything else.</p>
@@ -260,7 +260,7 @@ This talk explores functional programming concepts, which help us create powerfu
 <li><a href="https://usenix15.nqsb.io">Usenix security research paper on TLS stack</a>
 </li>
 </ul>
-<h1>CalDAV Server</h1>
+<h1 id="caldav-server">CalDAV Server</h1>
 <p>The CalDAV server is a protocol for synchronizing calendars. Our goal was to develop a calendar server that is robust and less complex to configure and maintain than other services, allowing more people to run their own digital infrastructure.</p>
 <p>The CalDAV server project began in 2017 when <a href="/About%20Us/Team">Stefanie Schirmer and Hannes Mehnert</a> got a grant from <a href="https://prototypefund.de">The Prototype Fund</a> for developing a CalDAV server (RFC 4791) over a period of 6 months. After that funding period, <a href="https://tarides.com">Tarides</a> sponsored us further, allowing us to achieve the current status of the CalDAV server.</p>
 <p>Currently all basic features of a calendar are implemented, for example &quot;please add this event to the calendar&quot;, and &quot;modify the weekly meeting from now on to start half an hour later&quot;, and it is tested with a variety of CalDAV clients.</p>
@@ -268,12 +268,12 @@ This talk explores functional programming concepts, which help us create powerfu
 <p>Our CalDAV server has a very small codebase which provides a number of security benefits and it stores all the data in git so there is a history of changes, it can easily be exported and converted to and from other formats, and if a client behaves badly (by removing entries they cannot deal with), this can be tracked and reverted.</p>
 <p>We would like to develop the CalDAV server further, adding notifications about updates and invitations sent via Mail (as described in <a href="https://tools.ietf.org/html/rfc6638">RFC 6638</a>). We also aim to integrate the related protocol CardDAV (address book), which could be integrated into the same unikernel.</p>
 <p>If you are interested in supporting further work on the CalDAV server through a <a href="/Donate">donation</a>, with a grant, or require additional features to be implemented to accommodate your project’s needs please <a href="/Contact">get in touch with us</a>!</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information-1">More technical information:</h4>
 <p>Based on existing HTTP and REST libraries, we developed a WebDAV library adequate for CalDAV (e.g. no locks, but ACLs, reports). The REST library needed some extensions to support more HTTP verbs that are used in WebDAV. We also developed an iCalendar (.ics, RFC 5545) decoder and encoder.</p>
 <p>The CalDAV unikernel uses the developed libraries to serve requests from clients, which may be &quot;what is the last update to the calendar?&quot;, or adding events or changing times of events. Access control is done by the attached metadata to the resource (i.e. only user Tim may access Tim's calendar, groups are possible). User and group (in WebDAV lingo principals) data are stored in the same storage as the calendars. For enrolling new users and groups, we provide HTTP endpoints. The administrator password is provided as boot argument.</p>
 <p>The storage of our CalDAV unikernel can use any <a href="https://github.com/mirage/mirage-kv">mirage-kv</a> implementation, being it a non-persistent only in-memory (not too useful for a real calendar since it is not persistent), a UNIX file system (if the unikernel runs as a UNIX process), or a remote git repository (which we recommend).</p>
 <p>The CalDAV server is open source, with the code available on GitHub for the <a href="https://github.com/roburio/caldav">server</a> and <a href="https://github.com/roburio/icalendar">calendar</a>.</p>
-<h1>DNS</h1>
+<h1 id="dns">DNS</h1>
 <p>The Domain Name System is used like a phone book for the internet - it translates human-memoizable domain names (e.g. robur.coop) to machine-routable IP addresses (e.g. 198.167.222.215) and other records such as where eMail should be sent to. DNS is a fault-tolerant hierarchical decentralized key-value store with caching. DNS has been deployed on the Internet since 1987.</p>
 <p>On the one side, the authoritative server, which has delegated responsibility for a domain, provides that mapping information (i.e. that a certain IP is the right one for a certain domain), and on the other side a resolver provides the functionality to figure out which server to request for each query a client has.</p>
 <p>Since 2017 we have developed DNS, server, resolver, and client as a spare-time project. They serve different purposes in our ecosystem: the server is used by domains such as nqsb.io and robur.coop as an authoritative server; we use a caching resolver for our bi-annual hack retreats in Marrakesh; and the client is used by any MirageOS unikernel that needs to resolve domain names.</p>
@@ -281,42 +281,42 @@ This talk explores functional programming concepts, which help us create powerfu
 <p>Since mid-August 2019 our DNS implementation replaced the existing, but incomplete and barely maintained <a href="/Our%20Work/Technology-Employed#OCaml">OCaml</a> implementation. It is released to the opam repository.</p>
 <p>A specific use case for this project is to combine a DNS resolver with a local zone (where it acts as server), and a DHCP server - a protocol used for dynamic IP address configuration - into a single service. We recently received confirmation of a grant from Nlnet via the next generation internet initiative from the EU to develop such a service based on our DNS library.</p>
 <p>If you are interested in supporting this work, or knowing more about it please <a href="/Contact">get in touch with us</a>.</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information-2">More technical information:</h4>
 <p>Our DNS implementation handles extensions such as dynamic updates, notifications on changes, authentication of update requests, zone transfers (all useful for provisioning X509 certificates via letsencrypt.org).</p>
 <p>Using expressive types in OCaml we can ensure that for a given query type the reply record has a specific shape: querying an address record (A) results in a set of IPv4 addresses. Encoding such invariants in the type system reduces the boilerplate (or unsafety) which is there in other implementations.</p>
 <p>The DNS code is available on GitHub for the <a href="https://github.com/mirage/ocaml-dns">library</a> and <a href="https://github.com/roburio/unikernels">unikernels</a>.</p>
-<h1>Firewall</h1>
+<h1 id="firewall">Firewall</h1>
 <p>Online security is vital and an important way to improve a network's or computer's security is a firewall that can block unwanted traffic going in and out. We are developing a lightweight firewall in the secure programming language <a href="/Our%20Work/Technology-Employed#OCaml">OCaml</a> that is specifically designed to be implemented in <a href="https://www.qubes-os.org/">QubesOS</a>, a security-orientated operating system.</p>
 <p>The Qubes-Mirage-Firewall is based on a project by Thomas Leonard. It is implemented as a <a href="/Our%20Work/Technology-Employed#MirageOS">MirageOS unikernel</a>, it is more lightweight and with a smaller codebase compared to the original Linux based firewall in QubesOS which has security and useability benefits.</p>
 <p>In 2019, we received a grant from <a href="https://prototypefund.de">The Prototype Fund</a> for 6 months work on this project. We would like to continue developing it further and if you wish to support this project with a <a href="/Donate">donation</a>, grant, or just want to hear more about the project please <a href="/Contact">get in touch with us</a>.</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information-3">More technical information:</h4>
 <p>Thus far we have refactored the NAT library, made the firewall react to rule changes from the Qubes interface, and added a DNS client to the firewall. We added the ability to read rule changes from QubesDB. We added the ability to resolve domain names via a DNS client so that the rules can be written in a human-friendly way, and not just as computer-friendly IP addresses.</p>
 <p>The smaller unikernel uses less memory, which is a rare resource in QubesOS, since Qubes runs many virtual machines. As opposed to the first prototype, it can react to rule changes without the need to rebuild and reboot the firewall VM.</p>
 <p>The code for the firewall is on <a href="https://github.com/yomimono/qubes-mirage-firewall/">GitHub</a>, but still on several branches since we recently reworked the DNS parts.</p>
-<h1>OpenPGP</h1>
+<h1 id="openpgp">OpenPGP</h1>
 <p>OpenPGP is a much-used standard of encryption and is widely used to encrypt text, files and emails, amongst other things.</p>
 <p>Robur is implementing OpenPGP in OCaml, for use in MirageOS and any other compatible platform or software that is looking for OpenPGP written in a <a href="/Our%20Work/Technology-Employed#OCaml">secure language</a>.</p>
 <p>This work is funded through donations and is still an ongoing project, which means that it may not currently possess all the features required for various use-cases. Currently our implementation can sign, verify, compress, encrypt and decrypt.</p>
 <p>You can assist us in implementing more of the OpenPGP protocol through a <a href="/Donate">donation</a>. If you are interested hearing more about the project, require additional features to be implemented to accommodate your project’s needs, or are able to assist with a grant please <a href="/Contact">get in touch with us</a>!</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information-4">More technical information:</h4>
 <p>Robur maintains a partial, opinionated implementation of OpenPGP version 4 (RFC 4880) and the related standards, written in OCaml and compatible with MirageOS.</p>
 <p>The software consists of a library, and various UNIX tools that make use of the library, and can be used to interact with systems that are currently using GnuPG or other OpenPGP implementations for file encryption or verification using OpenPGP signatures. Notably it can be used from within MirageOS applications without having to bundle a C implementation, and the UNIX binaries are separated from the library so that your applications can use the library directly, unlike GnuPG or libgpgme whose API translates to repeated executions of the gpg2 binary and parsing of the textual output from that.</p>
 <p>Currently we have implemented signing/verification and encryption/decryption, but there is no support for elliptic curve cryptography. Decompression of ZLIB streams is supported through the use of a pure OCaml library called decompress. While some things are implemented with a streaming API, many operations make use of an in-memory buffer, which introduces memory constraints on the file handled (this is an area where there is definitely room for improvement).</p>
 <p>The software is available <a href="https://github.com/roburio/ocaml-openpgp">on Github</a>.</p>
-<h1>OpenVPN</h1>
+<h1 id="openvpn">OpenVPN</h1>
 <p>OpenVPN is a virtual private network protocol that started from a single implementation developed in C, without any specification document. Over time flaws were found in the implementation which lead to further revisions. Also several extensions were developed for coping with other needs.</p>
 <p>This history meant that overall OpenVPN has a number of flaws and is overly complex due to revisions on revisions. We implemented only the most recent protocol version and require the current key derivation and authentication method.</p>
 <p>We started from scratch developing it in <a href="/Our%20Work/Technology-Employed#OCaml">OCaml</a> using existing cryptographic libraries and parsers. This approach allowed us to take some design decisions that have security benefits and our codebase is minimal. We strive for compatibility of the configuration file, so our OCaml OpenVPN can be a drop-in replacement.</p>
 <p>We began this work in 2018 with a grant from <a href="https://prototypefund.de">The Prototype Fund</a>. Whilst the code is available on <a href="https://github.com/roburio/openvpn">Github</a> we have not released it yet as it needs further work (in terms of testing, performance evaluation).</p>
 <p>If you are interested in supporting further work on our OpenVPN implementation through a <a href="/Donate">donation</a>, with a grant, or just want to hear more about the project please <a href="/Contact">get in touch with us</a>!</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information-5">More technical information:</h4>
 <p>Our main goal is a client implementation as a MirageOS unikernel (either forwarding all traffic to a single IP address or NAT of a local network via the OpenVPN tunnel), but we also developed a UNIX client which configures a tap device on the host and adjusts the hosts routing table accordingly. We extended our protocol implementation with a server as well. Testing is done against existing OpenVPN servers.</p>
 <p>Our implementation has stronger security promises since we do not implement old protocol versions that are brittle. In addition it is fail-hard when using the NAT unikernel: if the tunnel is down, all packets are dropped (instead of sent unencrypted). We do not support questionable configuration options and we have safe defaults for the configuration.</p>
-<h1>Solo5</h1>
+<h1 id="solo5">Solo5</h1>
 <p>Solo5 is a sandboxed (separated) execution environment  built using unikernels (a.k.a. library operating systems), including but not limited to MirageOS unikernels. Conceptually it provides a common interface between the unikernel and various host operating systems or hypervisors.</p>
 <p>Solo5's interfaces are designed in a way that allows us to easily port them to run on different host operating systems or hypervisors. Implementations of Solo5 run on Linux, FreeBSD, OpenBSD, the Muen Separation Kernel and the Genode Operating System Framework.</p>
 <p>Currently Solo5 is ready for use by early adopters and we plan to continue developing it further, if you are interested in supporting this development with a <a href="/Donate">donation</a> or want to hear more about the project please <a href="/Contact">get in touch with us</a>.</p>
-<h4>More technical information:</h4>
+<h4 id="more-technical-information-6">More technical information:</h4>
 <p>Solo5 features include:</p>
 <ul>
 <li>a sandboxed environment (CPU, memory) to execute native code in
@@ -359,39 +359,39 @@ This talk explores functional programming concepts, which help us create powerfu
 <p>If you like our approach to open source software and want to support our work please consider a <a href="/Donate">donation</a>.</p>
 <p>Or if you are a funder of open source projects focused on security and reliability and like our approach we would love to hear from <a href="/Contact">you</a>.</p>
 urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaOur Approach2019-09-10T22:16:40-00:00canopy2019-09-10T19:40:14-00:00<p>Robur is a software development cooperative specializing in robust and secure digital infrastructure written in OCaml.</p>
-<h2>Current members</h2>
-<h3>Hannes</h3>
+<h2 id="current-members">Current members</h2>
+<h3 id="hannes">Hannes</h3>
 <p>Hannes enjoys living in Berlin, Germany. Until end of 2017, he used to be a research associate at the University of Cambridge in the rems project. He enjoys to write code, and also traveling and repairing his recumbent bicycle, and being a barista.</p>
 <p>Hannes did his PhD in computer science about formal verification of imperative code (using a higher-order separation logic and the theorem prover Coq). Hannes co-authored not-quite-so-broken TLS, a TLS implementation from the ground up in OCaml, and contributes to the MirageOS project as a core team member. He is working on various projects, including opam signing and <a href="https://github.com/rems-project/netsem">netsem</a>, an executable formal model of TCP/IP which can act as a test validator.</p>
 <p>His blog is at <a href="https://hannes.robur.coop">https://hannes.robur.coop</a>.</p>
-<h3>Reynir</h3>
+<h3 id="reynir">Reynir</h3>
 <p>Reynir goes foraging, sniffing and picking interesting plants found in nature, cycling with one, two or more wheels, and knits now and then.
 Based in Århus, Denmark he goes winterbathing in the cold sea.</p>
 <p>Reynir studied computer science at Aarhus University with an interest in programming languages and formal verification.
 After some years working in industry with heterogenous unix systems followed by two years of various volunteer work he joined Robur in 2020.
 He is still heavily involved as a developer and system administrator in <a href="https://data.coop">data.coop</a>, an association that collectively owns and run servers offering digital services for their members.</p>
-<h3>dinosaure</h3>
+<h3 id="dinosaure">dinosaure</h3>
 <p>Dinosaure wants the majority of its services to be unikernels in OCaml. A big reader of RFCs, it implements protocols and formats in OCaml. He has been participating in MirageOS for quite some time and continues to promote its use and develop usable unikernels such as <a href="https://paste.osau.re">paste.osau.re</a>, <a href="https://bob.osau.re">bob</a>, and his <a href="https://blog.osau.re">blog</a>.</p>
-<h2>Former members</h2>
-<h3>Joe</h3>
+<h2 id="former-members">Former members</h2>
+<h3 id="joe">Joe</h3>
 <p>Joe is an independent IT consultant located in Copenhagen.</p>
 <p>Joe has a background in penetration testing, protocol design, applied cryptography, and architectural IT security system design for customers, especially in the banking, insurance, and pension fund sectors. He has been consulting on BPAY integration in Australia, and conducting web and network security assessments for customers throughout the world.</p>
 <p>Lately he has spent the last couple of years writing OCaml and has been working with IT security, dev-ops and automated deployment for customers specializing in Enterprise Resource Planning, Internet of Things, and medical technology.</p>
 <p>In his spare time he dabbles in research into similar topics and serialization frameworks, in addition to the enjoyable pursuit of tabletop roleplaying and social interactions in smoky pubs - two disciplines that he excels in, but that have somehow not been of particular interest to paying customers (yet).</p>
-<h3>Martin</h3>
+<h3 id="martin">Martin</h3>
 <p>Martin has been programming since before programming was trendy, eating Sharp SC61860A machine code for breakfast since before it was healthy, and using Linux way back when it was just Linus Torvalds’ glorified terminal emulator.</p>
 <p>A founding member of Unikernel Systems (later acquired by Docker), Martin has been involved in a number of library operating system projects since 2014, including the Rumprun unikernel and MirageOS. He is a co-author of Solo5, a secure execution environment for unikernels, and joins Robur in 2018 to continue his work towards creating secure software that “just works” and other ambitious projects.</p>
 <p>Martin lives with his family in Bratislava, Slovakia and in his spare time enjoys hiking, yachting and the arts.</p>
-<h3>Mindy</h3>
+<h3 id="mindy">Mindy</h3>
 <p>Mindy ran the first MirageOS unikernel in the public cloud in 2014. Mindy has worked extensively on the MirageOS TCP/IP network stack and various protocol implementations, and is a member of the project's core team. She managed the release of MirageOS's latest major version.</p>
 <p>Mindy is interested in freeing software from unnecessary dependencies, including monolithic kernels. While she finds testing and bug-fixing rewarding, her true goal is to apply techniques that remove entire bug classes to broader classes of computation. Memory safety isn't just for application code!</p>
 <p>In her free time, Mindy enjoys bothering cats, playing board games, riding bicycles, and embroidery. She lives in beautiful Madison, Wisconsin in the United States.</p>
-<h3>rand</h3>
+<h3 id="rand">rand</h3>
 <p>rand fell in love with OCaml and functional programming since university, where he studied philosophy and computer science on a humanistic/technological BSc. He especially likes solving problems in elegant and interesting new ways. Been part of the Functional Copenhageners meetup for a range of years - where he's also held several talks.</p>
 <p>He's worked fullstack with with OCaml and Scala since university - working on a varied set of things like entity clustering, entity merging, custom data visualizations, service oriented architecture, PostgreSQL, Elasticsearch, natural language parsing, Linux, server management.</p>
 <p>Spends much of his time with his daughter and doing experimental art with his video synthesizer <code>niseq</code>, of course written using pure FRP in OCaml (:</p>
 <p>Can be found at <a href="https://r7p5.earth/">https://r7p5.earth/</a>.</p>
-<h3>Stefanie</h3>
+<h3 id="stefanie">Stefanie</h3>
 <p>Stefanie is an infrastructure software engineer and a researcher.</p>
 <p>She studied Applied Computer Science in the Natural Sciences, and developed a typechecker for a compiler of a language for optimization problems. In her PhD project she developed metrics to compare forest data structures, with an application in molecular structure comparison. Working as a postdoc in cancer research on molecular structure prediction, she found her way to Brooklyn and Berlin.</p>
 <p>In the US tech industry, she works on infrastructure problems with distributed systems at a large scale with millions of users, developing API infrastructure and search infrastructure, with a focus on stateless systems.</p>
@@ -399,7 +399,7 @@ He is still heavily involved as a developer and system administrator in <a hr
 urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaTeam2023-09-21T14:46:48-00:00canopy2019-09-10T19:40:14-00:00<p>Twice a year the Robur team meet with others from the OCaml and MirageOS community at a week long hack retreat in Marrakesh, Morocco.</p>
 <p>We use these times to discuss and learn about new developments in the MirageOS ecosystem and meet in person about our Robur projects. And of course we have fun whilst we are at it!</p>
 <p>The retreats are held in a hostel in the center of the city, which we wholly rent out for the period, with food provided. If you are interested in participating in the next retreat please <a href="http://retreat.mirage.io/">see the MirageOS site</a> for more details and sign-up method.</p>
-urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaRetreats2019-09-10T21:40:09-00:00canopy2019-09-10T19:40:14-00:00<h1>Collaborations</h1>
+urn:uuid:a4887de7-8629-5578-836f-d31b51fe75aaRetreats2019-09-10T21:40:09-00:00canopy2019-09-10T19:40:14-00:00<h1 id="collaborations">Collaborations</h1>
 <p><a href="https://aenderwerk.de">Änderwerk gGmbH</a><br />
 Änderwerk is a &quot;back-end provider&quot; for the open source community. They work with Robur to assist us in our financial processes and administration.</p>
 <p><a href="https://leastauthority.com">Least Authority</a>
@@ -413,7 +413,7 @@ OCaml Labs is an initiative within the Cambridge Computer Laboratory started by
 <p><a href="https://tarides.com">Tarides</a><br />
 Is a for-profit distributed engineering team based in Paris and Cambridge that makes software for MirageOS. Robur works alongside Tarides to expand the MirageOS ecosystem and collaborate on some projects.</p>
 <br />
-<h1>Grant Funders</h1>
+<h1 id="grant-funders">Grant Funders</h1>
 <p><a href="https://pointer.ngi.eu">NGI Pointer</a><br />
 NGI pointer is a EU funded project which funds the next generation ecosystem of Internet architects. They funded our reproducible builds work.</p>
 <p><a href="https://nlnet.nl">NLnet Foundation</a><br />
diff --git a/index.html b/index.html
index 25dec7d..afd720f 100644
--- a/index.html
+++ b/index.html
@@ -2,11 +2,11 @@
 robur
        Published: 2017-09-16 (last updated: 2019-09-10)

        
 
        
 
        
-
        R obust Infrastructure
        
-
        O pen Source Projects
        
-
        B ottom-up Approach
        
-
        U nderscoring Security
        
-
        R eliable Technology
        
+
        R obust Infrastructure
        
+
        O pen Source Projects
        
+
        B ottom-up Approach
        
+
        U nderscoring Security
        
+
        R eliable Technology
        
 
        
 
        
 
        Contact