Recherche avancée

Sur d’autres sites (8639)

• How to verify signatures for Piwik release packages

  19 novembre 2014, par Piwik Core Team — Security

  We are proud to announce that Piwik project now cryptographically signs the Piwik releases using PGP following requests from several community members. In this post we will explain how you can verify the signatures of the Piwik release you downloaded, with instructions for Windows, Mac OS X and Linux.

  What is a signature and why should I check it ?

  ---

  How do you know that the Piwik platform you have is really the one we made ? Some software sites list sha1 hashes alongside the software on their website, so users can verify that they downloaded the file without any errors. These “checksums” help you answer the question “Did I download this file correctly from whoever sent it to me ?” They do a good job at making sure you didn’t have any random errors in your download, but they don’t help you figure out whether you were downloading it from a compromised server. The better question to answer is : “Is this file that I just downloaded the file that Piwik intended me to get ?”. Over the years several Piwik users have requested that we start signing our releases.

  Where do I get the signatures and the keys that made them ?

  ---

  Each file on our release server builds.piwik.org is accompanied by a file with the same name as the package and the extension .asc. These .asc files are GPG signatures. They allow you to verify the file you’ve downloaded is exactly the one that we intended you to get. For example, piwik-2.9.0.zip is accompanied by piwik-2.9.0.zip.asc<code>.

  Currently Matthieu Aubry is the release manager and signs the Piwik releases. His signature can be found here : builds.piwik.org/signature.asc

  How to verify signatures on Windows

  ---

  You need to have GnuPG installed before you can verify signatures. Download it from http://gpg4win.org/download.html.

  Once it’s installed, use GnuPG to import the key that signed your package. Since GnuPG for Windows is a command-line tool, you will need to use cmd.exe. Unless you edit your PATH environment variable, you will need to tell Windows the full path to the GnuPG program. If you installed GnuPG with the default values, the path should be something like this : C :\Program Files\Gnu\GnuPg\gpg.exe.

  Import Piwik Release manager Matthieu’s key (0x416F061063FEE659) by starting cmd.exe and typing :

  "C :\Program Files\Gnu\GnuPg\gpg.exe" —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

  After importing the key, you can verify that the fingerprint is correct :

  "C :\Program Files\Gnu\GnuPg\gpg.exe" —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

  You should see :

  pub   4096R/5590A237 2013-07-24
        Key fingerprint = 814E 346F A01A 20DB B04B  6807 B5DB D592 5590 A237
  uid                  Matthieu Aubry <matt@piwik.org>
  uid                  Matthieu Aubry <matthieu.aubry@gmail.com>
  uid                  Matthieu Aubry <matt@piwik.pro>
  sub   4096R/43F0D330 2013-07-24
  

  To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :

  "C :\Program Files\Gnu\GnuPg\gpg.exe" —verify C :\Users\Alice\Desktop\piwik-2.9.0.zip.asc C :\Users\Alice\Desktop\piwik-2.9.0.zip

  The output should say "Good signature" :

  gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237
  gpg : Good signature from "Matthieu Aubry <matt@piwik.org>"
  gpg :                 aka "Matthieu Aubry <matthieu.aubry@gmail.com>"
  gpg :                 aka "Matthieu Aubry <matt@piwik.pro>"
  

  Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.

  Mac OS X and Linux

  ---

  On Linux GnuPG is usually installed by default. On Mac OS X, you need to have GnuPG installed before you can verify signatures. You can install it from http://www.gpgtools.org/.

  Once it’s installed, use GnuPG to import the key that signed your package. Matthieu Aubry signs the Piwik releases. Import his key (814E346FA01A20DBB04B6807B5DBD5925590A237) by starting the terminal (under "Applications") and typing :

  gpg —keyserver keys.gnupg.net —recv-keys 814E346FA01A20DBB04B6807B5DBD5925590A237

  After importing the key, you can verify that the fingerprint is correct :

  gpg —fingerprint 814E346FA01A20DBB04B6807B5DBD5925590A237

  You should see :

  pub   4096R/5590A237 2013-07-24
        Key fingerprint = 814E 346F A01A 20DB B04B  6807 B5DB D592 5590 A237
  uid                  Matthieu Aubry <matt@piwik.org>
  uid                  Matthieu Aubry <matthieu.aubry@gmail.com>
  uid                  Matthieu Aubry <matt@piwik.pro>
  sub   4096R/43F0D330 2013-07-24
  

  To verify the signature of the package you downloaded, you will need to download the ".asc" file as well. Assuming you downloaded the package and its signature to your Desktop, run :

  gpg —verify /Users/Alice/piwik-2.9.0.zip.asc*,

  The output should say "Good signature" :

  gpg : Signature made Thu 13 Nov 2014 17:42:18 NZDT using RSA key ID 5590A237
  gpg : Good signature from "Matthieu Aubry <matt@piwik.org>"
  gpg :                 aka "Matthieu Aubry <matthieu.aubry@gmail.com>"
  gpg :                 aka "Matthieu Aubry <matt@piwik.pro>"
  

  Notice that there may be a warning in case you haven’t assigned a trust index to this person. This means that GnuPG verified that the key made that signature, but it’s up to you to decide if that key really belongs to the developer. The best method is to meet the developer in person and exchange key fingerprints.

  That’s it ! In this article you have learnt how you can verify that the Piwik package you have downloaded on your computer was the same as the one Piwik team has officially created. We hope this helps you use Piwik with more security.

  Source : this article was copied and adapted from the great Tor Browser project website page How to verify signatures for Tor packages

• How do I convert RTSP stream for iOS browser viewing

  6 mars 2017, par humble_coder

  TL ;DR

  I need to convert full RTSP (A/V) stream from Axis IP cameras to be viewed in a fully-contained/not-full-screen div in an iOS browser. Think : "Youtube live stream as viewed from iOS browser". I’ve seen several links that hint at the issue. . .

  • Streaming via RTSP or RTP in HTML5
  • RTSP tunneled HTTP, FFMPEG
  • How can I display an RTSP video stream in a web page ?
  • Embed RTSP Stream into Browser

  . . .but they’re either "incomplete" or out of date.

  The solution must be local and remain behind site firewall (so no external services).

  MORE DETAIL

  I’m currently writing a custom "Axis IP Camera Manager" Vue/Laravel web app for a client. The initial requirements were very simple :

  1. scan network for axis devices and store addresses/info for future use

  2. display grid of MJPEG for selected camera(s).

  The initial requirements were fairly straightforward. Now, though, there are additional requirements :

  3. Record RTSP stream to [seconds] long MP4 streams.

  4. Convert an RTSP stream from AXIS IP CAMERA to something viewable in both desktop and mobile browsers with full A/V.

  I’ve successfully managed #3 by using ffmpeg to capture and store the stream to MP4. However, I’m no video aficionado, and the nature of #4 is still a bit fuzzy to me. Per my understanding I can’t watch RTSP streams in a browser in iOS, but I also can’t stream an "in-process" MP4 over HTTP. I’ve seen references to several items such as Red5, Live555, Wowza, ffserver (discontinued ?), etc. but I’m completely unfamiliar with them. In the short term, I’m looking for a quick "live" conversion solution. In the long term, I’m interested in a deeper understanding of the issue(s) at hand. Any current info/expertise/links/manuals would be appreciated.

• How to make Matomo GDPR compliant in 12 steps

  3 avril 2018, par InnoCraft

  Important note : this blog post has been written by digital analysts, not lawyers. The purpose of this article is to briefly show you where Matomo is entering into play within the GDPR process. This work comes from our interpretation of the UK privacy commission : ICO. It cannot be considered as professional legal advice. So as GDPR, this information is subject to change. We strongly advise you to have a look at the different privacy authorities in order to have up to date information.

  The General Data Protection Regulation (EU) 2016/679, also referred to RGPD in French, Datenschutz-Grundverordnung, DS-GVO in German, is a regulation on data protection and privacy for all individuals within the European Union. It concerns organizations worldwide dealing with EU citizens and will come into force on the 25th May 2018.

  The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier. It includes cookies, IP addresses, User ID, location, and any other data you may have collected.

  We will list below the 12 steps recommended by the UK privacy commissioner in order to be GDPR compliant and what you need to do for each step.

  The 12 steps of GDPR compliance according to ICO and how it fit with Matomo

  As mentioned in one of our previous blog post about GDPR, if you are not collecting any personal data with Matomo, then you are not concerned about what is written below.

  If you are processing personal data in any way, here are the 12 steps to follow along with some recommendations on how to be GDPR compliant with Matomo :

  1 – Awareness

  Make sure that people within your organization know that you are using Matomo in order to analyze traffic on the website/app. If needed, send them the link to the “What is Matomo ?” page.

  2 – Information you hold

  List all the personal data you are processing with Matomo within your record of processing activities. We are personally using the template provided by ICO which is composed of a set of 30 questions you need to answer regarding your use of Matomo. We have published an article which walks you through the list of questions specifically in the use case of Matomo Analytics. Please be aware that personal data may be also tracked in non-obvious ways for example as part of page URLs or page titles.

  3 – Communicating privacy information

  a – Add a privacy notice

  Add a privacy notice wherever you are using Matomo in order to collect personal data. Please refer to the ICO documentation in order to learn how to write a privacy notice. You can learn more in our article about creating your privacy notice for Matomo Analytics. Make sure that a privacy policy link is always available on your website or app.

  b – Add Matomo to your privacy policy page

  Add Matomo to the list of technologies you are using on your privacy policy page and add all the necessary information to it as requested in the following checklist. To learn more check out our article about Privacy policy.

  4 – Individuals’ rights

  Make sure that your Matomo installation respects all the individuals’ rights. To make it short, you will need to know the features in Matomo that you need to use to respect user rights (right of access, right of rectification, right of erasure…). These features are available starting in Matomo 3.5.0 released on May 8th : GDPR tools for Matomo (User guide).

  5 – Subject access requests

  Make sure that you are able to answer an access request from a data subject for Matomo. For example, when a person would like to access her or his personal data that you have collected about her or him, then you will need to be you able to provide her or him with this information. We recommend you design a process for this like “Who is dealing with it ?” and check that it is working. If you can answer to the nightmare letter, then you are ready. The needed features for this in Matomo will be available soon.

  6 – Lawful basis for processing personal data

  There are different lawful basis you can use under GDPR. It can be either “Legitimate interest” or “Explicit consent”. Do not forget to mention it within your privacy policy page. Read more in our article about lawful basis.

  7 – Consent

  Users should be able to remove their consent at any time. By chance, Matomo is providing a feature in order to do just that : add the opt-out feature to your privacy policy page.
  We are also offering a tool that allows you optionally to require consent before any data is tracked. This will be useful if a person should be only tracked after she or he has given explicit consent to be tracked.

  8 – Children

  If your website or app is targeted for children and you are using Matomo, extra measures will need to be taken. For example you will need to write your privacy policy even more clear and moreover getting parents consent if the child is below 13. As it is a very specific case, we strongly recommend you to follow this link for further information.

  9 – Data breaches

  As you may be collecting personal data with Matomo, you should also check your “data breach procedure” to define if a leak may have consequences on the privacy of the data subject. Please consult ICO’s website for further information.

  10 – Data Protection by Design and Data Protection Impact Assessments

  Ask yourself if you really need to process personal data within Matomo. If the data you are processing within Matomo is sensitive, we strongly recommend you to make a Data Protection Impact Assessment. A software is available from the The open source PIA software helps to carry out data protection impact assessment, by French Privacy Commissioner : CNIL.

  11 – Data Protection Officers

  If you are reading this article and you are the Data Protection Officer (DPO), you will not be concerned by this step. If that’s not the case, your duty is to provide to the DPO (if your business has a DPO) our blog post in order for her or him to ask you questions regarding your use of Matomo. Note that your DPO can also be interested in the different data that Matomo can process : “What data does Matomo track ?” (FAQ).

  12 – International

  Matomo data is hosted wherever you want. So according to the location of the data, you will need to show specific safeguard except for EU. For example regarding the USA, you will have to check if your web hosting platform is registered to the Privacy Shield : privacyshield.gov/list
  Note : our Matomo cloud infrastructure is based in France.

  That’s the end of this blog post. As GDPR is a huge topic, we will release many more blog posts in the upcoming weeks. If there are any Matomo GDPR topic related posts you would like us to write, please feel free to contact us.

  The post How to make Matomo GDPR compliant in 12 steps appeared first on Analytics Platform - Matomo.