Type de dépôt #5 (version complète) / De plus en plus de tâches humaines sont prises en charge par les algorithmes dans le domaine des arts. Avec les nouvelles techniques d’intelligence artificielle (IA) disponibles, qui reposent généralement sur le concept d’autoapprentissage, la frontière entre l’assistance informatique et la création algorithmique proprement dite s’estompe. À titre de mise en contexte, je présente, à l’aide d’exemples récents, un aperçu de la manière dont les artistes utilisent des algorithmes sophistiqués dans leur travail - et comment cette nouvelle forme d’art piloté par l’IA pourrait différer des premières formes d’art générées par ordinateur. Ensuite, sur la base de théories récentes issues d’une société post-humaniste et la montée de ce que certains auteurs appellent le dataisme, j’aborde des questions liées à l’autonomie, à la collaboration, aux droits d’auteur et au contrôle de la composition sur la création sonore et musicale. D’un point de vue pratique, je présente les logiciels libres et open source (FLOSS, de l’anglais Free/Libre and Open Source Software) qui ont pris une place constante dans mon processus de composition ; et je discute de la façon dont leur écosystème, principalement dans le domaine de l’IA, a façonné mon travail au fil des ans, tant d’un point de vue esthétique que pratique. Une série de trois pièces mixtes produites dans le cadre de ce projet de recherche-création est ensuite analysée. Je présente les différentes dimensions dans lesquelles le concept d’autorité algorithmique a pris part à mon processus de composition, des approches techniques aux choix esthétiques. Enfin, je propose des stratégies de notation musicale, basées sur des standards ouverts, visant à assurer la lisibilité, et donc la pérennité de mon travail. / Algorithms have taken over an increasing number of human tasks in the realm of the arts. With newly available AI techniques, typically relying on the concept of self-learning, the line separating computer assistance from actual algorithmic creation is blurring. To contextualize, through recent illustrative examples I elaborate an overview of ways in which artists are making use of sophisticated algorithms in their work – and how this new form of AI-driven art might differ from early computer-generated art. Then, based on recent theories concerning a post-humanist society and the rise of what some authors call dataism, I discuss issues related to autonomy, collaboration, authorship and compositional control over the creation of sound and music. From a practical perspective, I present the Free/Libre and Open Source Software (FLOSS) that have been a consistent presence in my compositional process; and discuss how their ecosystem, mainly in the domain of AI, has shaped my work over the last decade from both aesthetic and practical standpoints. A series of three mixed pieces produced as part of this research-creation project is then analyzed. I present the different dimensions in which the concept of algorithmic authority took part in my composition process, from technical approaches to aesthetic choices. Finally, I propose some strategies for music notation, based on open standards, aiming to assure the readability, and therefore the perpetuity of my work.

Im Zuge der Digitalisierung kommt es zu einem immer weiter anwachsenden Einsatz von Software in der Sächsischen Verwaltung. Aktuell wird dabei vor allem auf proprietäre Lösungen gesetzt. Open Source-Software ist nur vereinzelt im Einsatz. Die Open Source-Strategie der Sächsischen Staatsverwaltung definiert die Ziele zum Umgang mit Open Source und leitet die Grundlagen für die Umsetzung hin zu einem verstärkten Einsatz ab. Redaktionsschluss: 30.06.2023

Open Radio Access Networks (Open RANs) enable flexible cellular network deployments by adopting open-source software and white-box hardware to build reference architectures customizable to innovative target use cases. The Open Radio Access Network (O-RAN) Alliance defines specifications introducing new Radio Access Network (RAN) Intelligent Controller (RIC) functions that leverage open interfaces between disaggregated RAN elements to provide precise RAN control and monitoring capabilities using applications called xApps and rApps. Multiple xApps targeting novel use cases have been developed by the O-RAN Software Community (OSC) and incubated on the Near-Real-Time RIC (Near-RT RIC) platform. However, the Near-RT RIC has, so far, been demonstrated to support only a single xApp capable of controlling the RAN elements. This work studies the scalability of the OSC Near-RT RIC to support simultaneous control signaling by multiple xApps targeting the RAN element. We particularly analyze its internal message routing mechanism and experimentally expose the design limitations of the OSC Near-RT RIC in supporting simultaneous xApp control. To this end, we extend an existing open-source RAN slicing xApp and prototype a slice-aware User Equipment (UE) admission control xApp implementing the RAN Control E2 Service Model (E2SM) to demonstrate a multi-xApp control signaling use case and assess the control routing capability of the Near-RT RIC through an end-to-end O-RAN experiment using the OSC Near-RT RIC platform and an open-source Software Defined Radio (SDR) stack. We also propose and implement a tag-based message routing strategy for disambiguating multiple xApps to enable simultaneous xApp control. Our experimental results prove that our routing strategy ensures 100% delivery of control messages between multiple xApps and E2 Nodes while guaranteeing control scalability and xApp non-repudiation. Using the improved Near-RT RIC platform, we assess the security posture and resiliency of the OSC Near-RT RIC in the event of volumetric application layer Denial of Service (DoS) attacks exploiting the E2 interface and the E2 Application Protocol (E2AP). We design a DoS attack agent capable of orchestrating a signaling storm attack and a high-intensity resource exhaustion DoS attack on the Near-RT RIC platform components. Additionally, we develop a latency monitoring xApp solution to detect application layer signaling storm attacks. The experimental results indicate that signaling storm attacks targeting the E2 Terminator on the Near-RT RIC cause control loop violations over the E2 interface affecting service delivery and optimization for benign E2 Nodes. We also observe that a high-intensity E2 Setup DoS attack results in unbridled memory resource consumption leading to service interruption and application crash. Our results also show that the E2 interface at the Near-RT RIC is vulnerable to volumetric application layer DoS attacks, and robust monitoring, load-balancing, and DoS mitigation strategies must be incorporated to guarantee resiliency and high reliability of the Near-RT RIC. / Master of Science / Telecommunication networks need sophisticated controllers to support novel use cases and applications. Cellular base stations can be managed and optimized for better user experience through an intelligent radio controller called the Near-Real-Time Radio Access Network (RAN) Intelligent Controller (RIC) (Near-RT RIC), defined by the Open Radio Access Network (O-RAN) Alliance. This controller supports simultaneous connections to multiple base stations through the E2 interface and allows simple radio applications called xApps to control the behavior of those base stations. In this research work, we study the performance and behavior of the Near-RT RIC when a malicious or compromised base station tries to overwhelm the controller through a Denial of Service (DoS) attack. We develop a solution to determine the application layer communication delay between the controller and the base station to detect potential attacks trying to compromise the functionality and availability of the controller. To implement this solution, we also upgrade the controller to support multiple radio applications to interact and control one or more base stations simultaneously. Through the developed solution, we prove that the O-RAN Software Community (OSC) Near-RT RIC is highly vulnerable to DoS attacks from malicious base stations targeting the controller over the E2 interface.

Recent supply chain attacks on a larger scale in combination with a growing adoption of the set of automated software development and deployment practices commonly referred to as ’DevOps’, made us interested in the security of the underlying infrastructure supporting these practices. If a malicious commit in a piece of software can expose internal systems and networks of all users of said software to vulnerabilities, questions regarding trust and repudiation becomes central, in the platforms themselves as much as in each digitally signed software update version. GitLab is a DevOps platform that offer an open-source (Community Edition, (CE)) of their application, for anyone to use and even modify to better suit their own needs. Anyone who chooses to use GitLab will as a result thereof also choose to put the trust others put in them in the hands of the open-source community around GitLab. Since any vulnerability in GitLab could affect users or organizations that use software developed and shipped with the help of GitLab, we wanted to try finding one for ourselves. We employed well-known techniques from the ethical hacker playbook (threat modeling, risk assessment) in order to identify candidates for attack vectors, and found GitLab’s GraphQL Application Programming Interface (API) to be a great starting point since it not only was but still is under development, but that the body of previous work seemed to suggest inconsistencies in the business logic layer underneath. Our main findings are: at least two instances where we were able to gain unauthorized access to data within our self-hosted GitLab instance. We also found that a new feature could be used for privilege escalation under certain conditions. We were then able to conclude that open source software and a prolific bug bounty program does not guarantee the security of GitLab, in and of themselves. All findings have been reported to GitLab through their bug bounty program. / Under det senaste decenniet har mjukvaruutvecklande organisationer visat ett tilltagande intresse för de metoder för automatiserade utvecklings- och distributionstekniker som vanligen brukar samlas under termen DevOps. Den trenden taget i kombination med det senaste årets större försörjningskedjeattacker (SolarWinds, Microsoft Exchange Server) gjorde att vi började intressera oss för säkerheten kring den infrastruktur som möjliggör dessa metoder. Om en utvecklare med ont uppsåt lyckas få in en ändring i en mjukvara innan den digitalt signeras och distribueras till mjukvarans användare, kan denne lyckas utnyttja svagheten för att få tillgång till eller modifiera de system och nätverk mjukvaran körs på. Frågor om tillit och avsändarintegritet kring vem som står bakom ett kodavsnitt blir i förlängningen därav oerhört viktiga. GitLab är en DevOps-plattform som erbjuds i en version med öppen källkod, vilken alla kan använda och rent av anpassa för sina egna behov. Att använda GitLab innebär dock att man lämpar över den tillit och säkerhet ens användare lagt i ens händer på de som utvecklar plattformen. Eftersom en enskild sårbarhet i GitLab potentiellt kan påverka ett stort antal aktörer som aldrig själva använt GitLab gjorde att vi ville se efter om även vi kunde hitta en sådan sårbarhet. Vi använde oss av välbekanta metoderi etisk hackning-kretsar (hotmodellering) genom vilka vi identifierade GitLabs GraphQL-Application Programming Interface (API) som en potentiellt gynnsam attackvektor. Detta både eftersom API:t fortsatt är under utveckling och att tidigare forskning antytt logiska brister i applikations-lagret. Arbetet ledde fram till ett par fynd. Vi fick åtkomst till otillåten data vid två tillfällen. Med hjälp av en ny funktionalitet kunde vi under vissa omständigheter utöka en användares behörighet. Vi kunde därmed dra slutsatsen att öppen källkod och ett väletablerat bug bounty-program inte i sig är några garantier för säker mjukvara. Samtliga fynd har rapporterats till GitLab via deras bug bounty-program på plattformen HackerOne.

In the last decade, major developments in mobile and sensor network technologies, as well as in more secure data management solutions allowed an accelerated expansion of the Internet of Things (IoT) in different markets, including the smart lighting technology. These technological developments, currently shaping the lighting industry, have the power to enhance the liveability of spaces and improve people’s lives. However, in this thesis it is highlighted how such technological evolution is often marked by an engineering character over a design approach. In particular, this thesis focuses on smart lighting technology applied in urban environments and how the integration of information technology into the physical realm can enhance space quality and empower citizens’ participation. The main body is divided into two sections: The first part provides an overview of the technological solutions that are currently being implemented in the lighting design field. The second part advances a schematic projection of future trends, starting from the analysis of what is being developed in other related disciplines, such as urban planning and visual arts. Both parts are literature-based. The final section features the opinion of noteworthy lighting professionals about possible real-life applications of smart lighting technology. Since this thesis has been written during the Covid-19 pandemic, the author decided to include speculations regarding how this event might influence the future of urban lighting.

No description available.

No description available.

In my study, I present the mining, collection and analysis of GitHub projects data in an endeavor to understand how the activity and engagement on the different projects has been before and during the Covid-19 pandemic.  Data was collected from 20 repositories via Github API.  I eventually applied some statistical analysis of the data, applied the ANOVA tests measuring the p-values to understand the level of variance pre and during the Covid-19 pandemic.  Open-Source software have been used since long before and my study seeks to explore the magnitude to which Open-Source software participation on different projects has been affected by the different work environments that the users have become accustomed to lately.  Open-Source software has been under study previously by different authors ie on the participation of users etc.  No study has yet been done on the impact a global pandemic has on the engagement on Open-Source platform on different projects, analysing the trends of participation along the project’s life cycle pre and during the covid-19 pandemic.  In these unpredictable, interesting times the study is aimed at highlighting how Open-Source engagement has been behaving by looking at the trends, patterns of engagement, the decrease or increase of activity in certain projects.  From the results I realise trends and patterns in some projects and also interesting insights in the Github OS project lifecycles.  The findings of my study pointed to how participation and engagement on GitHub Open-Source increased During the Pandemic more than During the Pandemic and this is evidenced by 70% of all the 20 repositories I took under investigation. / <p>The presentation was held via Zoom </p>

No description available.

Open-source software (OSS) ecosystems, defined as environments composed of package managers and programming languages (e.g., NPM for JavaScript), are essential for software development and foster collaboration and innovation. Although their significance is acknowledged, understanding what makes OSS communities healthy and sustainable requires further exploration. This thesis quantitatively assesses the health of OSS projects and communities within the NPM, PyPI, Maven, and RubyGems ecosystems. We explore five research questions addressing project standards, community responsiveness, contribution distribution, contributor retention, and newcomer integration strategies. Our analysis shows varied documentation practices, insider engagement levels, and contribution patterns. Our findings highlight both strengths and different areas for improvement across ecosystems. For example, RubyGems excels in the adoption of project documentation and exhibits the most even distribution of contributions among all contributors, including highly active contributors. and a very responsive community, but it needs to improve contribution retention and attract newcomers to the projects. Meanwhile, NPM and Maven show a trend toward getting new contributors, characterized by a high ratio of individual contributions. They need to better adopt a code of conduct, pull request templates, and increase the number of active contributors in a project. This thesis offers insights to developers and maintainers on how to strengthen ecosystems and support vibrant communities effectively