You must be logged in to use the filter favorited.
You must be logged in to use the filter favorited.

Schedule

Der Hub wird spätestens Ende Januar archiviert, alle nutzerbezogenen Inhalte, Boards und auch einige Wiki-Seiten werden dabei entfernt. Alle öffentlichen Assemblies, Projekte und Veranstaltungen bleiben. // The hub will be archived by end of January. All user-provided content, boards and several wiki pages will be deleted. All public assemblies, projects and events will remain.
Schedule
















 

Day 4
09:00

09:30

10:00

10:30

11:00

11:30

12:00

12:30

13:00

13:30

14:00

14:30

15:00

15:30

16:00

16:30
Asahi Linux - Porting Linux to Apple Silicon (en)

sven

In this talk, you will learn how Apple Silicon hardware differs from regular laptops or desktops. We'll cover how we reverse engineered the hardware without staring at disassembly but by using a thin hypervisor that traces all MMIO access and then wrote Linux drivers. We'll also talk about how upstreaming to the Linux kernel works and how we've significantly decreased our downstream patches in the past year. As an example, we will use support for the Type-C ports and go into details why these are so complex and required changes across multi subsystems. In the end, we'll briefly talk about M3/M4/M5 and what challenges we will have to overcome to get these supported.

CCC&T - Cosmic ray, the Climate Catastrophe and Trains. (en)

FantasticMisterFux

How can we predict soil moisture by measuring cosmic ray products and what have trains to do with it? Ever wondered how this Dürremonitor works, that you heared about in ther german news? These question and some more I will try to answer while I give an overview of some of the research that is done by the Helmholtz Centre for Environmental Research (UFZ).

Security of Cardiac Implantable Electronic Devices (en)

dilucide

Cardiac Implantable Electronic Devices (CIED), such as cardiac pacemakers and defibrillators, are a fairly niche target for security researchers, in part due to a lack of manufacturer cooperation and device accessibility. This talk aims to provide insights into the challenges in device development and methods with which to research device security. Data accessibility to patients will be touched upon.

Breaking BOTS: Cheating at Blue Team CTFs with AI Speed-Runs (en)

Leo Meyerovich, Sindre Breda

After we announced our results, CTFs like Splunk's Boss of the SOC (BOTS) started prohibiting AI agents. For science & profit, we keep doing it anyways. In BOTS, the AIs solve most of it in under 10 minutes instead of taking the full day. Our recipe was surprisingly simple: Teach AI agents to self-plan their investigation steps, adapt their plans to new information, work with the SIEM DB, and reason about log dumps. No exotic models, no massive lab budgets - just publicly available LLMs mixed with a bit of science and perseverance. We'll walk through how that works, including videos of the many ways AI trips itself up that marketers would rather hide, and how to do it at home with free and open-source tools. CTF organizers can't detect this - the arms race is probably over before it really began. But the real question isn't "can we cheat at CTFs?" It's what happens when investigations evolve from analysts-who-investigate to analysts-who-manage-AI-investigators. We'll show you what that transition already looks like today and peek into some uncomfortable questions about what comes next.

Security Nightmares (de)

Constanze Kurz, Ron

Was hat sich im Jahr 2025 im Bereich IT-Sicherheit getan? Welche neuen Methoden, Buzzwords und Trends waren zu sehen? Was waren die fiesesten Angriffe und die teuersten Fehler?

I Hated All The Cross-Stitch Software So I Made My Own: My Deranged Outsider Software Suite For Making Deranged Outsider Art (en)

yomimono

I wanted to design beautiful header diagrams and ASCII tables suitable for stitching on throw pillows, but found existing tools for cross-stitch design to be all wrong. I made my own set of command-line tools for building this chunky, pixelated visual art. If you've never seen a cross-stitch sampler that had bitrot, this talk will fix it.

“End Of 10”: How the FOSS Community is Combatting Software-Driven Resource and Energy Consumption (en)

Joseph P. De Veaugh-Geiss, Carolina Silva Rode, Bettina Louis

The end of free support for Windows 10 was 14 October 2025. Well, sort of. Microsoft moved the date to 2026, one more year the FOSS community can introduce users to sustainable software. 14 October is also KDE's birthday, International E-Waste Day, with International Repair Day following on 18 October. The irony is deep, but what is not ironic is that millions of functioning computers will end up becoming security risks or discarded as e-waste. This means manufacturing and transporting new ones, the biggest waste of all: hardware production accounts for over 75% of a device's CO2 emissions over its lifespan. The FOSS community had an opportunity and we took it! In 2024, KDE Eco's Opt Green project began a global, unified campaign across FOSS and repair communities to upgrade unsupported Windows 10 computers to Linux. We held BoFs at SFSCon, CCC, and FOSDEM. We thought big and acted boldly. In this talk End Of 10 contributors will discuss the campaign, what has worked and what the challenges have been, and how FOSS provides a solution to software-driven resource and energy consumption.

Fossile Industrie liebt KI! (de)

Rike, Moritz Leiner

Der Hype um generative KI und die Gasindustrie bilden in Zeiten der Klimakrise eine bedrohliche Allianz für die Zukunft des Planeten.

We, the EU, and 1064 Danes decided to look into YouTube: A story about how the EU gave us a law, 1064 Danes gave us their YouTube histories, and reality gave us a headache (en)

David, LK Seiling

We explore what happens when Europe’s ambitious data access laws meet the messy realities of studying major digital platforms. Using YouTube as a central case, we show how the European Union’s efforts to promote transparency through the GDPR, the Digital Services Act (DSA), and the Digital Markets Act (DMA) are reshaping the possibilities and limits of independent platform research. At the heart of the discussion is a paradox: while these laws promise unprecedented access to the data that shape our digital lives, the information researchers and citizens actually receive is often incomplete, inconsistent, and difficult to interpret. In this talk, we take a close look at data donations from over a thousand Danish YouTube users, which at first glance did not reveal neat insights but sprawling file structures filled with cryptic data points. Still, if the work is put in, these digital traces offer glimpses of engagement and attention, and help us understand what users truly encountered or how the platform influenced their experiences. The talk situates this challenge within a broader European context, showing how data access mechanisms are set up in ways that strengthen existing power imbalances. Application processes for research data vary widely, requests are rejected or delayed without clear justification, and the datasets that do arrive frequently lack the granularity required for meaningful analysis. Yet the picture is not purely bleak. Citizens, researchers, and civil society already have multiple legal levers to demand greater transparency and accountability. The fundamental question is no longer whether democratic oversight is possible, but how we can use the tools at hand to make it real.

Infrastructure Review (en)

nicoduck

Infrastructure teams present what they did for this years congress and why they did it that way.

How to keep Open Source open without leaving our communities open to threats (en)

Quintessence

The Four Freedoms (defined ~40 years ago) and the Four Opens (~15 years ago) for Open Source provided canonical definitions for what are the cornerstones of Open Source Software communities today. While the ethos still applies today, the cultural norms that blossomed to put it into practice are from an era with different challenges. To build a better world, we need to both keep and protect the value system of the Four Freedoms and Four Opens. To do that, we need to re-assess our risk and threat models to balance that allows beautiful minds to flourish as well as introduce responsible friction to prevent harm from coming to them.

What You Hack Is What You Mean: 35 Years of Wiring Sense into Text (en)

Torsten Roeder

Encoding isn’t just for machines — it’s how humans shape meaning. This talk traces 35 years of hacking text through the Text Encoding Initiative (TEI), a community-driven, open-source standard for describing the deep structure of texts. We’ll explore how TEI turns literature, research, and even hacker lore into machine-readable, remixable data — and how it enables minimal, sustainable self-publishing without gatekeepers. From alphabets to XML and the Hacker Bible, we’ll look at text as a living system: something we can read, write, and hack together.

Laser Beams & Light Streams: Letting Hackers Go Pew Pew, Building Affordable Light-Based Hardware Security Tooling (en)

Patch, Sam. Beaumont (PANTH13R)

Stored memory in hardware has had a long history of being influenced by light, by design. For instance, as memory is represented by the series of transistors, and their physical state represents 1's and 0's, original EPROM memory could be erased via the utilization of UV light, in preparation for flashing new memory. Naturally, whilst useful, this has proven to be an avenue of opportunity to be leveraged by attackers, allowing them to selectively influence memory via a host of optical/light-based techniques. As chips became more advanced, the usage of opaque resin was used as a "temporary" measure to combat this flaw, by coating chips in a material that would reflect UV. Present day opinions are that laser (or light) based hardware attacks, are something that only nation state actors are capable of doing Currently, sophisticated hardware labs use expensive, high frequency IR beams to penetrate the resin. This project demonstrates that with a limited budget and hacker-and-maker mentality and by leveraging more inexpensive technology alternatives, we implement a tool that does laser fault injection, can detect hardware malware, detect supply chain chip replacements, and delve into the realm of laser logic state imaging.

Battling Obsolescence – Keeping an 80s laser tag system alive (en)

Trikkitt

Keeping old projects working can be an uphill battle. This talk explores how the laser tag system Q-Zar (Quasar in the UK) has been kept alive since the company behind it failed in the 90s. The challenges encountered, the lessons learnt, and how those can be applied to our own future projects to maximise the project lifetime.

Welcome to the last CDC day (en)

Diego Salazar

What went on and what is coming next.

NextGraph Demo: Local First, E2EE, RDF graph DB, and a Reactive ORM SDK (en)

Laurin Weger

[NextGraph](https://nextgraph.org/) is a framework aimed at making live collaboration, offline support, end to end encryption, and application interoperability easy. In this demo, I will walk you through the basics of NextGraph and our new TypeScript SDK. The new TypeScript SDK turns RDF graph database records into ordinary, typed objects with instant two‑way binding. By proxying those objects and emitting signals, the SDK provides a framework‑agnostic reactive layer that integrates cleanly with React, Vue, and Svelte. **You will** get a short introduction to NextGraph, RDF (a graph data format designed for interoperability), and a live demo walking through a simple property change, showing how a mutation is instantly persisted to the database, syncronized, and reflected in UI components across React, Vue, and Svelte.

SeedSigner DIY Bitcoin signing device build workshop (en)

freerk

Build your own open-source Bitcoin signing device with a Raspberry Pi Zero, camera and display! We have kits for 45€

Whats new in Reticulum (en)

fluorescent_beige, Liam

We will give a brief introduction to the Reticulum Network Stack and announce what is new in 2025: - Reticulum will soon be available in Rust, which will allow users of embedded systems a better performance. - The new Reticulum BLE Interface enables the creation of autonomous mesh networks without any further hardware or central server. The interface can be used on Linux and Android. - The Columba App for Reticulum lowers the barrier of entry for using Reticulum.

Solidarity Finance on P2P Rails (en)

Joshua Davila

What would it look like to build financial infrastructure for solidarity rather than speculation? While blockchain technology has largely been captured by libertarian and extractive market logic, it certainly does not need to be that way. In this talk, we'll explore Solidarity Primitives, development and architectural design patterns designed to forge economic solidarity between individuals and collectives. Drawing from our work at Bread Cooperative and research I've documented through my podcast, The Blockchain Socialist, we'll examine concrete examples like the BREAD community token, savings circles implementation, and the Solidarity Fund mechanisms that enable participatory funding without relying on venture capital or traditional financial intermediaries. We'll discuss how these primitives address a critical gap: the technical and coordination barriers that have historically made alternative economic models difficult to implement at scale. From worker cooperatives to mutual aid networks, the infrastructure simply hasn't existed. Peer-to-peer technologies can change that but only if designed with solidarity, not profit maximization, as the core principle. This talk is for anyone interested in the practical dimensions of building a post-capitalist economy: what does it actually look like to write code for collective autonomy? How do we ensure decentralized systems serve communities rather than concentrating power?

Who's afraid of anonymity? A philosophical and political toolkit (en)

Casey Ford

Online anonymity is being demonized and undermined. But anonymity has an important social function for preserving individuals and group against social threats. We will argue for the philosophical and political value of being anonymous, especially against the rising state of capture in state and corporate surveillance. Anonymity is more than namelessness: it's a tool of resistance.

Mutual Vend - decentralized coop vending machine (en)

Ron Turetzky

Mutual-vend.com - smallest self contained coop decentrally owned and operated infra

Building the next web (en)

Ryta

Looking at how decentralized social networks, AI, XR, blockchain, and other technologies come together to shape the next stages of web evolution.

Offworld Voyage @ 39c3: Astronaut Collectives Are Beautiful (A progress report) (en)

Scott Beibin, Elizabeth Jane Cole

++ ++ ++ ++ ++ ++ ++ ++ The closing presentation at the Critical Decentralization Cluster assembly during 39C3 is a progress report on Offworld Voyage, a Space Analog Research project dedicated to the design of environmentally sustainable interplanetary exploration training habitats that also solve for adaptation to climate biodevastation on Earth. The talk will focus on some of the various ways in which Free/Libre Open Source technologies are incorporated into the project - with a strong focus on the development of decentralized and distributed coordination systems for autonomous and collective action - and how creative technologists can plug in and participate in the project. As a special show-and-tell treat Scott Beibin and Elizabeth Jane Cole, founders of Offworld Voyage will display the new pressurized training spacesuit prototypes they recently commissioned Smith Exploration Garments to build for the project. See you there!

Who's afraid of emotions? From helplessness to impactful activism (en)

aline

This workshop aims to equip techies and activists with some understanding to recognize and address emotional concerns in the context of digital rights. Together, let’s cultivate a flourishing community that prioritizes well-being and empowerment in the face of technology-driven challenges.

Bündnis Hansaplatz - Coalition Against AI CCTV and Displacement (de)

Gnitze

Brief presentation of the Hansaplatz Coalition Against AI Camera Surveillance.

Für ein europäisches Grundrecht auf Verschlüsselung (de)

Kai Bojens

Auf dem Bundesparteitag der Grünen habe ich den Antrag gestellt, sich für ein europäisches Grundrecht auf Verschlüsselung einzusetzen. Dieser Antrag wurde angenommen und ich will jetzt mal schauen, inwiefern dieses Thema außerhalb der Politik auf Unterstützung trifft und wie man zum Beispiel in der Zivilgesellschaft dafür Verbündete finden kann.

Chaos prepping in case of communication collapse (de)

Sapi, Clara & Co.

Chaos prepping in case of communication collapse Was würden wir tun, wenn dies der letzte Congress wäre, wo wir in der gewohnten Art miteinander kommunizieren oder uns frei miteinander treffen könnten - wenn ein nächster Congress wegen Faschisten, Überwachung und/oder anderer Katastrophe in dieser Form nicht mehr möglich wäre? What would we do, if this would be the last congress in which we could meet freely and communicate in the known way, if a next congress somehow would not be possible this way, because of faschism, surveillance and/or other catastrophe? Ein kurzer Austausch zu Szenarien und Ansätzen, damit umzugehen. A brief exchange on scenarios and possible ways to deal with them.

Langsames Internet, Schnelles Geld: Wie die Telekom das Internet kaputt macht (de)

Thomas Lohninger

In Europa ist die Netzneutralität ein im EU-Recht verankertes Prinzip, das besagt, dass alle Daten im Internet gleich behandelt werden müssen. Doch was geschieht, wenn große Anbieter wie die Deutsche Telekom dieses Prinzip durch ihre Zusammenschaltungspraktiken systematisch verletzen?

Self-Restricting Software Workshop (en)

oxzi

Computer programs run with all privileges of the running user. If your user can read your emails, then so can any other program you run. However, many programs do not need most permissions and perhaps should not have them at all. This workshop demonstrates quite simple ways in which software can self-restrict itself. The focus will not be on foreign, potentially malicious software, but on hardening programs against misconduct and future security vulnerabilities. Several operating systems have developed different interfaces that restrict software beyond its normal scope. This workshop will focus on POSIX and especially OpenBSD because of its user-friendly APIs. Although other operating systems, such as Linux, will be discussed, they will not be covered in depth due to their more complicated APIs. Within the workshop part, software with known security vulnerabilities is then patched together - usually with almost a single line. Ideally, an exploit has hardly any effect afterwards, although the vulnerability is still present. This is not intended to encourage carelessness, but rather to demonstrate the development of a further safety net for software. A basic understanding of programming is required and, more importantly, an interest in the topic. You will need to bring an SSH client, for example a laptop with (almost) any operating system. The language will be either English or German, depending on who shows up.

Running a NGO empowered by with Software Freedom (en)

Tobias

Can organisations with limited resources be digitally sovereign and still provide modern services? It is not trivial, but the FSFE proves it's possible. In this workshop we want to share our story and hear from you how you are running your NGO on FreeSoftware.

Wie spielt man eigentlich Bridge? (de)

Jasmin (she/her) und Luisa (she/her)

Was haben Buster Keaton, Omar Sharif, Winston Churchill und Mahatma Gandhi gemeinsam? Sie alle waren leidenschaftliche Bridgespieler. Tauche mit uns in diesem Crashkurs ein in die faszinierende Welt des bekanntesten Stich-Kartenspiels der Welt. Denn Bridge ist nicht nur das "Spiel der alten Damen in englischen Filmen" sondern bietet jede Menge Möglichkeiten zu knobeln, ständig neues zu lernen, für Teamwork und ausgefeilte, analoge Kommunikationssysteme. Ihr lernt bei uns die Grundregeln des Spiels und könnt euch direkt selbst am Problemlösen probieren. Wir haben ein paar Karten dabei, wenn ihr aber selbst Spielkarten (Französisches Blatt, 52 Karten) habt, bringt gerne welche mit.

FSFE meetup at Bits & Bäume Habitat (de)

Bonnie

You are a FSFE volunteer or you would like to know more about the Free Software Foundation Europe? Then this is the place to be. We will be discussing current activities, future activities, and what will be happening next. You are welcome to join us for some food and drinks while sharing your ideas and learning all about the FSFE and its current activities.

Global Climate Justice & Digital Empowerpent ! B&B Community Meet-Up (de)

benks

Du bist schon Teil von Bits & Bäume oder interessierst dich Bits & Bäume kennen zu lernen? Komm beim Tägliches Meetup zum Austausch und Vernetzen zu Themen globaler Gerechtigkeit und Digitaler Selbstbestimmtheit.

Wikidata Introduction (en)

Lucas Werkmeister

An introduction to Wikidata, the free knowledge base.

Transitous Meetup (en)

Julius Tens, Volker Krause, Jonah Brüchert

This is a meetup for people interested in the Transitous project, including but not limited to users, developers and contributors.

A whirlwind tour through the land of Wikidata-powered apps (en)

Lucas Werkmeister

In this presentation, we’ll take a quick look at lots of different applications that use Wikidata data.

Federating knowledge: exploring ways to bridge wikis and notes (en)

Tommi

Most people and organizations have their very own way of acquiring, organizing, archiving, sharing, and collaborating on knowledge repositories. A broad spectrum of opinions and approaches resulted in a diverse and rich ecosystem of knowledge management solutions. Nevertheless, this also implies scattered and disconnected knowledge sources. What would it mean to build bridges among wikis and federate knowledge?

Collaboration Architecture - Because WhatsApp Groups are Terrible (en)

Anke Holst

WhatsApp groups have become the default tool for coordinating anything. Also, WhatsApp groups are terrible. We all have stories. From an architectural point of view, they are terrible because the least configurable platform. There is a 1 and a 0 - you are a member of a group and get every message, or you are not a member and get no message. We used to have tools that worked better. Every forum built on free forum software would work better. The problem is - everyone who hears "we should organise" immediately imagines a WhatsApp group. There is knowledge out there about how to build tools and help people organise through them - but we have no language. I am proposing Collaboration Architecture. What do we think?