APACHE LOG4J SHELL VULNERABILITY ANALYSIS

The Apache log4j implementation is a highly scalable, robust, and versatile logging framework. This API simplifies the writing of logging code within an application, yet allows the flexibility of controlling logging activity from an external configuration file. It also allows us to publish logging information to desired granularity depending on the detail of the logging information suitable to each application.KeywordsPrefer DestinationConfiguration FileProperty FilePublic ClassPublic VoidThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

A new data acquisition program for personal computers with the Windows operating system has been built at Charles University van de Graaff laboratory. It allows fast data acquisition from VME, CAMAC, and other PC interface cards using an interrupt or polling mode via several types of crate controllers. The program also facilitates basic on-line analysis and visualization of acquired data in graphs and histograms. The program is written as a combination of MSVC6.0++ and ROOT macros and offers easy customization to individual user requirements via external configuration files, without need of recompilation. A driver interface supports PCI bus devices (W-IE-NE-R PCI-CC32) or older ISA bus devices with internal drivers. In this paper, a description of the program concepts and features is given. The program was extensively tested with several combinations of hardware and software, and results of the tests are shown.

This paper describes AnnaBot, one of the first tools to verify correct use of Annotation-based metadata in the Java programming language. These Annotations are a standard Java 5 mechanism used to attach metadata to types, methods, or fields without using an external configuration file. A binary representation of the Annotation becomes part of the compiled “.class” file, for inspection by another component or library at runtime. Java Annotations were introduced into the Java language in 2004 and have become widely used in recent years due to their introduction in the Java Enterprise Edition 5, the Hibernate object-relational mapping API, the Spring Framework, and elsewhere. Despite that, mainstream development tools have not yet produced a widely-used verification tool to confirm correct configuration and placement of annotations external to the particular runtime component. While most of the examples in this paper use the Java Persistence API, AnnaBot is capable of verifying anyannotation-based API for which “claims”—description of annotation usage—are available. These claims can be written in Java or using a proposed Domain-Specific Language, which has been designed and a parser (but not the code generator) have been written.

This article presents the development and validation of a digital twin of a galvanic production line and a multi-agent system using the Unity environment as a simulation platform. The primary objective was to create a tool that supports the analysis, testing and optimization of process flows and intralogistics involving autonomous mobile robots. The model replicates the actual structure of the technological line, taking into account the sequence of operations, energy consumption, processing times and transport logic. By applying a modular architecture, input data—such as layout configuration, energy usage and operation sequences—are imported from external configuration files, enabling rapid generation and comparison of various scenarios. A series of simulation experiments was conducted and the results were compared with an idealized mathematical model. The analysis revealed the presence of bottlenecks, shifting throughput limitations, as well as queuing and routing conflicts that cannot be captured by simplified analytical models. Furthermore, it was shown that expanding the process structure increases total energy consumption but improves energy efficiency per produced unit. The developed digital twin enables safe testing of structural and operational changes and provides a foundation for future integration with MES or SCADA systems, as well as the advancement of predictive production process management.

There are many ways to license open source software. Given the attention paid recently to the General Public License (GPL) and its latest version (GPLv3), you may be interested to know that there are other licenses that satisfy the principles of free and open source software without the confusion and polemics that surround the GPL. Other open source licenses have been approved by Open Source Initiative and adopted by commercial companies and by open source projects. Most of those other licenses are professionally written by lawyers to express clearly the licensing objectives of software copyright and patent owners and to ensure that they are valid and enforceable in all important jurisdictions. I wrote one of those licenses, the Open Software License. The third version of this license, OSL 3.0, was approved by Open Source Initiative in 2005. This article explains why it is a better license for software than the GPL. Software licensors choose their licenses based upon their particular philosophy and business models, and they intend their licenses to define the expected behavior of their licensees around the world. Because philosophies and businesses differ, so do licenses. In the open source world, there are two general categories of licenses: (1) Those licenses that allow derivative works of the software to be used and distributed as part of proprietary programs, and (2) those that require derivative works to be distributed under the same open source license as the original. The BSD license is the archetype of the first kind, what I call academic licenses. The GPL (version 2) is the most popular of the second kind, the so-called reciprocal or copyleft licenses. The license philosophies of these two categories of licenses are inherently irreconcilable, the first being compatible with proprietary derivative works and the other not, but they each make a valid point about the freedom to copy, change, and use software. I pass no judgment between them, since it is a licensor's right to choose a license for his own copyrightable works, not his lawyer's choice. The complete text (which is shorter than this article) of OSL 3.0 and its companion licenses is posted at www. rosenlaw.com/OSL3.0-comparison.pdf.

The Naval Research Laboratory (NRL) is currently in creasing its capability to perform high fidelity particle-in-cell (PIC) simulations of high power microwave (HPM) sources. Different PIC codes are available from commercial, government, and open source efforts, including LSP, ICEPIC, and VSim. Most of the algorithms in these codes are similar, but some algorithms important to high power microwave simulations are different, such as the exact treatment of fields at curved surfaces, the particle emission algorithms, and the energy conservation properties on various mesh resolutions. Understanding how these differences affect simulation results is the goal of this work. The codes will be benchmarked by looking at the simulations of a radial planar magnetron (RPM) at a frequency of 1 GHz. The simulated performance of the RPM HPM source will be evaluated across these codes on supercomputing clusters, comparing typical HPM source parameters of interest such as predicted output power as well as typical numerical metrics such as CPU runtimes. As part of the evaluation process, a list strengths and weaknesses will be generated for each of the codes taking in to account the workflow of the code and any ancillary tools used in the execution of the code.

When a computing environment is operating in a multilevel mode, where users have different clearances, and data exists at multiple levels of classification, supporting commercial-grade operating systems and applications is a major challenge. The Monterey Security Architecture (MYSEA) at the Naval Postgraduate School is a proposed solution. A testbed has been developed to research and prototype the architecture. One part of the architecture requires thin clients -- workstations with no ability to save data or state locally. One approach to provide a reasonable thin client in the short term is to boot an operating system from optical media, such as a CD or DVD. Knoppix is an open source effort that provides a pre-packaged bootable Linux operating system on CD. However, the current version of Knoppix does not provide the configuration and applications required for the MYSEA testbed. This document provides a generic process for re-mastering (or re-packaging) the Knoppix CD, as well as the specific steps for producing a Knoppix CD that is usable in the MYSEA architecture.

Open source software (OSS) is computer software that has its underlying source code made available under a licence. This can allow developers and users to adapt and improve it (Raymond, 2001). Computer software can be broadly split into two development models: • Proprietary, or closed software, owned by a company or individual. Copies of the binary are made public; the source code is not usually made public. • Open-source software (OSS), where the source code is released with the binary. Users and developers can be licenced to use and modify the code, and to distribute any improvements they make. Both OSS and proprietary approaches allow companies to make a profit. Companies developing proprietary software make money by developing software and then selling licences to use the software. For example, Microsoft receives a payment for every copy of Windows sold with a personal computer. OSS companies make their money by providing services, such as advising clients on the GPL licence. The licencee can either charge a fee for this service or work free of charge. In practice, software companies often develop both types of software. OSS is developed by an ongoing, iterative process where people share the ideas expressed in the source code. The aim is that a large community of developers and users can contribute to the development of the code, check it for errors and bugs, and make the improved version available to others. Project management software is used to allow developers to keep track of the various versions. There are two main types of open-source licences (although there are many variants and subtypes developed by other companies): • Berkeley Software Distribution (BSD) Licence: This permits a licencee to “close” a version (by withholding the most recent modifications to the source code) and sell it as a proprietary product; • GNU General Public Licence (GNU, GPL, or GPL): Under this licence, licencees may not “close” versions. The licencee may modify, copy, and redistribute any derivative version, under the same GPL licence. The licencee can either charge a fee for this service or work free of charge. Free software first evolved during the 1970s but in the 1990s forked into two movements, namely free software and open source (Berry, 2004). Richard Stallman, an American software developer who believes that sharing source code and ideas is fundamental to freedom of speech, developed a free version of the widely used Unix operating system. The resulting GNU program was released under a specially created General Public Licence (GNU, GPL). This was designed to ensure that the source code would remain openly available to all. It was not intended to prevent commercial usage or distribution (Stallman, 2002). This approach was christened free software. In this context, free meant that anyone could modify the software. However, the term “free” was often misunderstood to mean no cost. Hence, during the 1990s, Eric Raymond and others proposed that open-source software was coined as a less contentious and more business-friendly term. This has become widely accepted within the software and business communities; however there are still arguments about the most appropriate term to use (Moody, 2002). The OSMs are usually organised into a network of individuals who work collaboratively on the Internet, developing major software projects that sometimes rival commercial software but are always committed to the production of quality alternatives to those produced by commercial companies (Raymond, 2001; Williams, 2002). Groups and individuals develop software to meet their own and others’ needs in a highly decentralised way, likened to a Bazaar (Raymond, 2001). These groups often make substantive value claims to support their projects and foster an ethic of community, collaboration, deliberation, and intellectual freedom. In addition, it is argued by Lessig (1999) that the FLOSS community can offer an inspiration in their commitment to transparency in their products and their ability to open up governmental regulation and control through free/libre and open source code.

The popularity of Open Source Software and the usage of Open Source Licenses has greatly increased in the last few years. While some years ago, working on an Open Source basis was merely done by some alternative programmers, Open Source Projects have by now become an established, efficient and cost-saving way of realizing difficult and extensive projects and a real competition to proprietary software. Open Source licenses have become interesting for software enterprises, too. Some companies recognised that the Open Source community on the internet may constitute a strong support for projects, if it is possible to create enthusiasm for a project within the community. A recent, well-known example is the new web browser publicised by Google, Chrome, which is based on Open Source Software. In some cases, it might also be attractive for a software company to sell services, warranties, addons or other valuable products related to an Open Source product, which itself is given away for free. In this connection, however, it has become an important topic for enterprises to what extent it is possible to commercially exploit the results of Open Source Projects. This commercial usability strongly depends on the Open Source license chosen for a certain project. Therefore, the people responsible for a project have to conduct a thorough analysis on which license to choose. As the most common licenses GPL (GNU Public License) and LGPL (Lesser GNU Public License) do not constitute an ideal solution in this regard. This article will, in particular, take a closer look at alternative licenses existing.

Over the past few years, Microsoft has promoted a project called ‘Shared Source Initiative’, which allows certain customers (e.g., research institutions and independent software vendors) access to its source code on a restricted basis. As part of this initiative, Microsoft introduced some licences that appear to give unrestricted access to source code and closely resemble ‘traditional’ Open Source licences. In July 2007, two of these ‘shared source’ licenses (the Microsoft Community Licence and the Microsoft Permissive Licence) were submitted to the Open Source Initiative (OSI) and subsequently approved by the OSI as certified Open Source licences. Thus Microsoft's Shared Source Initiative and its partial embrace of Open Source appear to be a significant step towards closing the ideological rift between developers of proprietary software and the Free/Open Source software movement, and more than just another attempt to appease consumers and/or critics in terms of software transparency. By analysing the ‘evolution’ of Microsoft's Shared Source licences, this article aims to shed some light on the question what is needed for a ‘predator’ (i.e., proprietary, software developer) such as Microsoft to become ‘prey’ (i.e., be part of the Open Source community). This article concludes that, although Microsoft's efforts are to be lauded, it is highly unlikely that the company will embrace fully the Open Source philosophy in the near future.

Over the past decade, numerous computer-assisted retrosynthesis reaction prediction methods have been reported in the chemical literature, several of which are also shared as open-source code. Reports of integrating these modern open-source retrosynthetic prediction techniques into the chemical education classroom, however, is largely absent. This article describes our efforts to teach a computer-assisted retrosynthesis workshop series using open-source reaction prediction software and methods. In addition to three workshops on selected open-source reaction prediction methods, the series included workshops on Python programming and introductory cheminformatics using the RDKit cheminformatics toolkit. A pre and post survey was distributed to better understand participant familiarity and workshop outcomes. Participants indicated that they had minimal experience with cheminformatics, and open-source retrosynthesis software, however after the workshop series they indicated increased familiarity, interest, and desire to pursue additional training related to open-source retrosynthesis software and methods. We conclude this article with our experiences and ideas for future improvements. The workshop materials and code are available with an open source license, and educators are encouraged to adapt and improve the lessons (https://github.com/UA-Libraries-Research-Data-Services/retrosynthesis).

In the software industry, commercial open-source software vendors have recognized that providing services to help businesses derive greater value in the implementation of open source–based systems can be a profitable business model. Moreover, society may greatly benefit when software originators choose an open-source development strategy as their products become widely available, readily customizable, and open to community contributions. In this study, we present an economic model to study how software licensing attributes affect a software originator’s decisions, aiming to provide policy makers with insights into how welfare-improving, open-source outcomes can be incentivized. We show that when a competing contributor is apt at reaping the benefits of software development investment, a less restrictive open source license (e.g., Berkeley Software Distribution, or BSD style) can improve welfare. On the other hand, when the originator is better at leveraging investment and service costs are high, a more restrictive license (e.g., General Public License, or GPL style) can be best for social welfare even when a contributor can cost-efficiently develop the software. The online appendix is available at https://doi.org/10.1287/isre.2017.0726 .

Preface The present proceedings consists of the outcomes of the 7.5 hec master/PhD course ’CFD with OpenSource Software’, 2016. The course gives an introduction to the use of OpenSource software for CFD applications. It has a strong focus on how to efficiently use the Linux operating system and different softwares that are useful for CFD. A major individual project work in OpenFOAM forms a large part of the course. The project is defined according to the student’s special interests. The result of the project is a detailed tutorial for a specific application or library of OpenFOAM, which is presented to, and peer-reviewed by the students. The tutorials thus form a part of the course (Docendo discimus - Latin: ’by teaching, we learn’). The tutorials are made available through the proceedings, as a contribution to the OpenFOAM community, and to contribute to global learning. The tutorials are typically made available in the form of a report, a set of slides, possible source code, possible cases, and additional material, to be downloaded at http://www.tfd.chalmers.se/~hani/kurser/OS_CFD, under the corresponding year. The main requirements of a tutorial is that it should consider the following four aspects: • How to use it. • The theory of it. • How it is implemented. • How to modify it. This should be reflected by the specified learning outcomes of each tutorial, and should be evaluated by a set of study questions. It should be recognized that the tutorials are student project work, done as part of a course. For many of the students it is the first time they are introduced to OpenFOAM, C++ and object oriented programming, and some of the students have limited previous experience with Linux. Any reader should be aware that the tutorials might not be free of errors. Still, the tutorials might be useful for someone who would like learn something similar as the students learnt while doing the project work. The material has gone through a review process. The role of the reviewers is to go through the tutorial and make sure that it works, that it is possible to follow, and to some extent correct the writing. The reviewers have no responsibility for the contents, and it is thus up to the reader to make sure that any work that is derived from one of the tutorials is verified and validated. The Editor: Prof. Hakan Nilsson (Chalmers University of Technology)

A lot misinformation and mystery surrounds the topic of Open Source software. The conceptual misunderstanding of software is fostered, in some respects, by a lack of understanding within the professional ranks of the computer field. There are many different views of Open Source software today, based upon ones perspective. After about 20 years of evolution, the position of Open Source in our economy still has not coalesced. Few seems to understand whether Open Source is free software for running a computer (i.e., Linux) or just a way to obtain some software products without giving Microsoft ones money. “There is one thing stronger than all the armies in the world and that is an idea whose time has come” - Victor Hugo any view Open Source (OS) software as just a free alternative to proprietary software. The term does not mean that there is no cost associated with its procurement, although some vendors do provide free versions. The word “free” usually means the freedom to copy, modify, or distribute the software. One must be very careful when applying this broad, general meaning to Open Source software. There are many different Open Source licenses in use and it is imperative that users acquaint themselves with the legal ramifications of dealing with intellectual property rights. ` Open Source software should be viewed as a viable alternative in many software selection processes. Recently, the news has portrayed the report of India's Kerala state moving to Linux and OpenOffice for its 2,724 high schools. Likewise, OpenOffice is replacing Microsoft Office in many schools districts around the US. With tight school budgets, school superintendents are realizing significant cost savings by using the OpenOffice products for their campuses. Products such as OpenOffice may not be 100% compatible with their current proprietary counterpart, but for many applications, compatibility is not the issue. The price and the software license management of proprietary packages may be overwhelming.

For complex and popular software, project teams could receive a large number of bug reports. It is often tedious and costly to manually assign these bug reports to developers who have the expertise to fix the bugs. Many bug triage techniques have been proposed to automate this process. In this paper, we describe our study on applying conventional bug triage techniques to projects of different sizes. We find that the effectiveness of a bug triage technique largely depends on the size of a project team (measured in terms of the number of developers). The conventional bug triage methods become less effective when the number of developers increases. To further improve the effectiveness of bug triage for large projects, we propose a novel recommendation method called Bug Fixer, which recommends developers for a new bug report based on historical bug-fix information. Bug Fixer constructs a Developer-Component-Bug (DCB) network, which models the relationship between developers and source code components, as well as the relationship between the components and their associated bugs. A DCB network captures the knowledge of "who fixed what, where". For a new bug report, Bug Fixer uses a DCB network to recommend to triager a list of suitable developers who could fix this bug. We evaluate Bug Fixer on three large-scale open source projects and two smaller industrial projects. The experimental results show that the proposed method outperforms the existing methods for large projects and achieves comparable performance for small projects.