Canvas fingerprinting is an effective technique for implicitly re-identifying visitors to a Web site based on subtle variations in the graphical rendering of specific "test canvases". Different fingerprinting actors make use of distinct canvases for this purpose and thus, as we show, it is possible to ''fingerprint the fingerprinters'' by grouping together identical canvases that are employed for these tests. In this paper, we document the prevalence of canvas fingerprinting (finding that 12.7% of the top 20K sites engage in it), use this grouping technique to measure and characterize the online footprint of widely-used fingerprinting services, and finally analyze the context in which these services are used to shine light on their intended purpose.

Abstract The security of the web improved greatly throughout the last couple of years. A large majority of the web is now served encrypted as part of HTTPS, and web browsers accordingly moved from positive to negative security indicators that warn the user if a connection is insecure. A secure connection requires that the server presents a valid certificate that binds the domain name in question to a public key. A certificate used to be valid if signed by a trusted Certificate Authority (CA), but web browsers like Google Chrome and Apple’s Safari have additionally started to mandate Certificate Transparency (CT) logging to overcome the weakest-link security of the CA ecosystem. Tor and the Firefox-based Tor Browser have yet to enforce CT. In this paper, we present privacy-preserving and incrementally-deployable designs that add support for CT in Tor. Our designs go beyond the currently deployed CT enforcements that are based on blind trust: if a user that uses Tor Browser is man-in-the-middled over HTTPS, we probabilistically detect and disclose cryptographic evidence of CA and/or CT log misbehavior. The first design increment allows Tor to play a vital role in the overall goal of CT: detect mis-issued certificates and hold CAs accountable. We achieve this by randomly cross-logging a subset of certificates into other CT logs. The final increments hold misbehaving CT logs accountable, initially assuming that some logs are benign and then without any such assumption. Given that the current CT deployment lacks strong mechanisms to verify if log operators play by the rules, exposing misbehavior is important for the web in general and not just Tor. The full design turns Tor into a system for maintaining a probabilistically-verified view of the CT log ecosystem available from Tor’s consensus. Each increment leading up to it preserves privacy due to and how we use Tor.

The European Space Agency (ESA) as many other companies is interested in capitalizing its business assets. With the space programmes often lasting 10 to 20 years, the software system migration problems arise frequently. The Object Management Group promotes the model driven architecture (MDA) concept and proposes the architecture driven modernization (ADM) approach for model-based platform migration. SOFTEAM, Fraunhofer FOKUS and GTI6 performed an ESA-funded study on round trip engineering for space systems. During this study the state-of-the-art methods and tools for ADM and MDA were combined with state-of-the-art model based testing (MBT) approaches to safeguard the modernization process. Both techniques were assessed by applying them to a real-life use case - the migration and testing of a distributed archive and versioning system. In this article we overview the combined platform migration and testing methodology used in the project and summarize our experience during its application to the ESApsilas File Archive System. We specially focus on real life experience with MBT and discuss lessons learned.

In large scale and self-managing systems the autonomy of the system has a major impact on the management of such systems. Even if the system can run in a high degree of autonomy a certain level of control over the properties of the system at run-time might be useful, to ensure the system does the right things. In particular, in dynamic environment, where system structure often changes it is desirable to monitor the status of a system to be sure it is still in a normal condition. This paper describes an approach how to use model driven system management for evaluation of global constraints. This allows an automatic or semi-automatic monitoring of autonomous systems, which helps to identify malfunction and wrong self-management of such systems. The approach has been used to check constrains on distributed system realized as CORBA components

This paper presents an approach to support the MDA like design of component based distributed applications through the provision of a suitable MOF based modeling infrastructure. This infrastructure is open to a variety of modeling techniques and features the transformation of models based on different meta models. As a concrete example, we will show how EDOC and CCM can be integrated with this modeling infrastructure and consequently how EDOC models are transformed to CCM models.