Recherche avancée

Sur d’autres sites (4590)

• Matomo Further Invests in Security by Doubling Bug Bounty Rewards

  7 janvier 2022, par erin — Community, Press Releases

  Matomo is the leading open-source analytics solution free from data limitations. 

  As our mission states, we aim to create, as a community, the leading open digital analytics platform that gives every user full control of their data. 

  To do this, we operate a Security Bug Bounty Programme. This programme is designed to reward the hard work of skilled security researchers who sacrifice their time and energy to find and report security and vulnerabilities. 

  To continue our investment in security, privacy and transparency, we are increasing the security bug bounty reward to as much as $10,000 USD. This is an increase of 100% from our previous 2020 bug bounty announcement.

  How much can I earn for reporting security bugs ?

  Reward amounts vary depending on the impact :

  • Low issues receive $222
  • Medium issues receive $555
  • High issues receive $1,000
  • Critical issues receive $10,000

  How can I take part ? 

  As of January 2022, global independent security researchers have identified and suggested 138 security related improvements. If you are interested in joining this growing community, head to our Security Bug Bounty Programme to find out how you can take part. 

  We thank you for keeping Matomo safe for our users and theirs.

  About Matomo

  Matomo is the leading open-source analytics solution free from data limitations. Make more informed decisions and enhance your customer experience while ensuring data privacy and ownership. Matomo is the trusted solution for over 1.5 million websites globally. Take back control of your data ownership and challenge the status quo.

• Convert MPEG4 to MPEGTS on Android with FFmpeg

  3 juin 2013, par Ardoramor

  Ok, so obviously I know very little to none about ffmpeg API when I made the original post... it is quite overwhelming when one starts learning about digital media and conversion details. After reading quite a bit more and going through ffmpeg source, I was able to get a working output from mp4 to mpegts. The concept is similar to executing :

  ffmpeg -i in.mp4 -vcodec copy -acodec copy -vbsf h264_mp4toannexb out.ts

  But as I mentioned before, I need to implement it with ffmpeg API in C.

  So, although I am able to generate a playable .ts file, its video and audio streams are not synced. That is, playing them back on Android tablet plays the video very slowly while audio is playing at normal speed and then (once audio stream ends) video plays at normal speed to the end. Playing the same generated .ts file in VLC produces a very condensed audio (as though fast-forwarded) and plays video fine.

  There are still many aspects of media conversion that I am not familiar with. I am sure that some of them prevent me from successful conversion.

  Here is some information (via ffprobe) about the files :
   in.mp4 - file generated via Android recording - MPEG4 (H.264 + AAC)
   ffmpeg.ts - file generated via ffmpeg conversion - MPEG2TS (H.264 + AAC)
   out.ts - file generated via my code - MPEGTS (H.264 + AAC)

  in.mp4

  filename=in.mp4
  
  nb_streams=2
  
  format_name=mov,mp4,m4a,3gp,3g2,mj2
  
  format_long_name=QuickTime/MPEG-4/Motion JPEG 2000 format
  
  start_time=0:00:00.000000
  
  duration=0:00:09.961383
  
  size=4.730 Mibyte
  
  bit_rate=3.983 Mbit/s
  
  TAG:major_brand=isom
  
  TAG:minor_version=0
  
  TAG:compatible_brands=isom3gp4
  
  TAG:creation_time=2013-05-28 17:06:57

  ffmpeg.ts

  filename=ffmpeg.ts
  
  nb_streams=2
  
  format_name=mpegts
  
  format_long_name=MPEG-2 transport stream format
  
  start_time=0:00:01.400000
  
  duration=0:00:09.741267
  
  size=5.132 Mibyte
  
  bit_rate=4.419 Mbit/s

  out.ts

  filename=out.ts
  
  nb_streams=2
  
  format_name=mpegts
  
  format_long_name=MPEG-2 transport stream format
  
  start_time=0:00:00.000000
  
  duration=0:00:09.741267
  
  size=5.166 Mibyte
  
  bit_rate=4.449 Mbit/s

  Firstly, I was unable to affect my output file's start_time. Next, upon examining the -show_packets output of probe, I saw the following :

  ffmpeg.ts

  [PACKET]
  
  codec_type=video
  
  stream_index=0
  
  pts=N/A
  
  pts_time=N/A
  
  dts=N/A
  
  dts_time=N/A
  
  duration=0
  
  duration_time=0:00:00.000000
  
  size=20.506 Kibyte
  
  pos=564
  
  flags=K
  
  [/PACKET]
  
  [PACKET]
  
  codec_type=video
  
  stream_index=0
  
  pts=N/A
  
  pts_time=N/A
  
  dts=N/A
  
  dts_time=N/A
  
  duration=0
  
  duration_time=0:00:00.000000
  
  size=11.727 Kibyte
  
  pos=22936
  
  flags=_
  
  [/PACKET]
  
  ...
  
  [PACKET]
  
  codec_type=audio
  
  stream_index=1
  
  pts=126000
  
  pts_time=0:00:01.400000
  
  dts=126000
  
  dts_time=0:00:01.400000
  
  duration=2089
  
  duration_time=0:00:00.023211
  
  size=285.000 byte
  
  pos=109416
  
  flags=K
  
  [/PACKET]
  
  [PACKET]
  
  codec_type=audio
  
  stream_index=1
  
  pts=128089
  
  pts_time=0:00:01.423211
  
  dts=128089
  
  dts_time=0:00:01.423211
  
  duration=2089
  
  duration_time=0:00:00.023211
  
  size=374.000 byte
  
  pos=-1
  
  flags=K
  
  [/PACKET]
  
  ...
  
  [PACKET]
  
  codec_type=video
  
  stream_index=0
  
  pts=N/A
  
  pts_time=N/A
  
  dts=N/A
  
  dts_time=N/A
  
  duration=0
  
  duration_time=0:00:00.000000
  
  size=20.000 Kibyte
  
  pos=87232
  
  flags=_
  
  [/PACKET]
  
  [PACKET]
  
  codec_type=video
  
  stream_index=0
  
  pts=N/A
  
  pts_time=N/A
  
  dts=N/A
  
  dts_time=N/A
  
  duration=0
  
  duration_time=0:00:00.000000
  
  size=16.852 Kibyte
  
  pos=112800
  
  flags=_
  
  [/PACKET]

  out.ts

  [PACKET]
  
  codec_type=audio
  
  stream_index=1
  
  pts=0
  
  pts_time=0:00:00.000000
  
  dts=0
  
  dts_time=0:00:00.000000
  
  duration=2089
  
  duration_time=0:00:00.023211
  
  size=285.000 byte
  
  pos=22936
  
  flags=K
  
  [/PACKET]
  
  [PACKET]
  
  codec_type=audio
  
  stream_index=1
  
  pts=1024
  
  pts_time=0:00:00.011378
  
  dts=1024
  
  dts_time=0:00:00.011378
  
  duration=2089
  
  duration_time=0:00:00.023211
  
  size=374.000 byte
  
  pos=23312
  
  flags=K
  
  [/PACKET]
  
  ...
  
  
  
  [PACKET]
  
  codec_type=video
  
  stream_index=0
  
  pts=N/A
  
  pts_time=N/A
  
  dts=N/A
  
  dts_time=N/A
  
  duration=0
  
  duration_time=0:00:00.000000
  
  size=11.727 Kibyte
  
  pos=25004
  
  flags=_
  
  [/PACKET]
  
  [PACKET]
  
  codec_type=audio
  
  stream_index=1
  
  pts=7168
  
  pts_time=0:00:00.079644
  
  dts=7168
  
  dts_time=0:00:00.079644
  
  duration=2089
  
  duration_time=0:00:00.023211
  
  size=299.000 byte
  
  pos=55460
  
  flags=K
  
  [/PACKET]

  As you can see, ffmpeg.ts starts out with video packets that do not have pts/dts. The audio packets that follow contain pts/dts. This repeats until the end. All video packets do not have pts/dts according to ffprobe output.

  However, out.ts starts with audio packets and alternate with video packets. Here, video packets also do not have pts/dts. The difference is that here there is one video packet between a series of audio packets. What happened to the rest of the video packets (ffmpeg.ts has 5 audio followed by 5 video).

  Obviously, I'm still learning and don't know way too much yet... Does anything jump out as obvious a problem to anyone ? I will greatly appreciate any info / suggestions but will continue to grind at it !!

• Lawful basis for processing personal data under GDPR with Matomo

  30 avril 2018, par InnoCraft

  Disclaimer : this blog post has been written by digital analysts, not lawyers. The purpose of this article is to explain what is a lawful basis and which one you can use with Matomo in order to be GDPR compliant. This work comes from our interpretation of the following web page from the UK privacy commission : ICO. It cannot be considered as professional legal advice. So as GDPR, this information is subject to change. GDPR may be also known as DSGVO in German, BDAR in Lithuanian, RGPD in Spanish, French, Italian, Portuguese. This blog post contains public sector information licensed under the Open Government Licence v3.0.

  The golden rule under GDPR is that you need to have a lawful basis in order to process personal data. Note that it is possible to not process personal data with Matomo. When you do not collect any personal data, then you do not need to determine a lawful basis and this article wouldn’t apply to you.

  “If no lawful basis applies to your processing, your processing will be unlawful and in breach of the first principle.“

  Source : ICO, based on article 6 of GDPR.

  As you may process personal data in Matomo, you have to :

  1. define a lawful basis.
  2. document your choice.
  3. inform your visitor about it in a privacy notice.

  Even if you think you don’t process personal data, we recommend reading this post about personal data in Matomo (personal data may be hidden in many ways).

  Note that if you are processing special category data (ethnic origin, politics, religion, trade union membership…) or criminal offence data ; extra responsibilities are applied, and we will not detail them in this blog post.

  1 – Define a lawful basis

  There are 6 different lawful bases all defined within article 6 of the GDPR official text :

  1. Consent : the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
  2. Contract : processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  3. Legal obligation : processing is necessary for compliance with a legal obligation to which the controller is subject.
  4. Vital interests : processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  5. Public task : processing is necessary for the performance of a task carried out in the public interest or in the exercise of an official authority vested in the controller.
  6. Legitimate interests : processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party ; except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

  As you can see, most of them are not applicable to Matomo. As ICO is mentioning it within their documentation :

  “In many cases you are likely to have a choice between using legitimate interests or consent.”

  “Consent” or “Legitimate interests” : which lawful basis is the best when using Matomo ?

  Well, there is no right or wrong answer here.

  In order to make this choice, ICO listed on their website different questions you should keep in mind :

  • Who does the processing benefit ?
  • Would individuals expect this processing to take place ?
  • What is your relationship with the individual ?
  • Are you in a position of power over them ?
  • What is the impact of the processing on the individual ?
  • Are they vulnerable ?
  • Are some of the individuals concerns likely to object ?
  • Are you able to stop the processing at any time on request ?

  From our perspective, “Legitimate interests” should be used in most of the cases as :

  • The processing benefits to the owner of the website and not to a third party company.
  • A user expects to have their data kept by the website itself.
  • Matomo provides many features in order to show how personal data is processed and how users can exercise their rights.
  • As the data is not used for profiling, the impact of processing personal data is very low.

  But once more, it really depends ; if you are processing personal data which may represent a risk to the final user, then getting consent is for us the right lawful basis.

  If you are not sure, at the time of writing ICO is providing a tool in order to help you make this decision :

  

  Note that once you choose a lawful basis, it is highly recommended not to switch to another unless you have a good reason.

  What are the rights that a data subject can exercise ?

  According to the lawful basis you choose for processing personal data with Matomo, your users will be able to exercise different rights :

  	Right to be informed	Right of access	Right to erasure	Right to portability	Right to object	Right to withdraw consent
  Legitimate interests	X	X	X		X
  Consent	X	X	X	X		X

   

  • Right to be informed : whatever the lawful basis you choose, you need to inform your visitor about it within your privacy notice.
  • Right of access : as described in article 15 of GDPR. Your visitor has the right to access the personal data you are processing about them. You can exercise their right directly within the page “GDPR Tools” in your Matomo.
  • Right to erasure : it means that a visitor will be able to ask you to erase all their data. You can exercise the right to erasure directly within the page “GDPR Tools” in your Matomo.
  • Right to portability : it means that you need to export the data which concern the individual in a machine-readable format and provide them with their personal data. You can exercise their right directly within the page “GDPR Tools” in your Matomo.
  • Right to object : it means that your visitor has the right to say no to the processing of their personal data. In order to exercise this right, you need to implement the opt-out feature on your website.
  • Right to withdraw consent : it means that your visitor can remove their consent at any time. We developed a feature in order to do just that. You can learn more by opening the page “Privacy > Asking for consent” in your Matomo.

  2 – Document your choice

  Once you choose “Legitimate interests” or “Consent” lawful basis, you will have some obligations to fulfill. From our interpretation, “Legitimate interests” means writing more documentation, “Consent” means a more technical approach.

  What should I do if I am processing personal data with Matomo based on “Legitimate interests ?

  ICO is providing a checklist for “Legitimate interests”, below is our interpretation :

  • Check that legitimate interests is the most appropriate lawful basis.

  Our interpretation : document and justify why you choose this lawful basis in particular. This tool from ICO can help you.

  • Understand your responsibility to protect the individual’s interests.

  Our interpretation : you need to take all the measures in order to protect your users privacy and data security. Please refer to our guide in order to secure your Matomo installation.

  • Conduct a legitimate interests assessment (LIA) and keep a record of it to ensure that you can justify your decision. This document is composed of a set of questions on those 3 key concerns : 1) purpose, 2) necessity, 3) balancing.

  1) Purpose :

  • Why do you want to process the data – what are you trying to achieve ?
  • Who benefits from the processing ? In what way ?
  • Are there any wider public benefits to the processing ?
  • How important are those benefits ?
  • What would the impact be if you couldn’t go ahead ?
  • Would your use of the data be unethical or unlawful in any way ?

  2) Necessity :

  • Does this processing actually help to further that interest ?
  • Is it a reasonable way to go about it ?
  • Is there another less intrusive way to achieve the same result ?

  3) Balancing :

  • What is the nature of your relationship with the individual ?
  • Is any of the data particularly sensitive or private ?
  • Would people expect you to use their data in this way ?
  • Are you happy to explain it to them ?
  • Are some people likely to object or find it intrusive ?
  • What is the possible impact on the individual ?
  • How big an impact might it have on them ?
  • Are you processing children’s data ?
  • Are any of the individuals vulnerable in any other way ?
  • Can you adopt any safeguards to minimise the impact ?
  • Can you offer an opt-out ?

  • Identify the relevant legitimate interests.
  • Check that the processing is necessary and there is no less intrusive way to achieve the same result.
  • Perform a balancing test, and be confident that the individual’s interests do not override those legitimate interests.
  • Use individuals’ data in ways they would reasonably expect, unless you have a very good reason.

  Our interpretation : use those data to improve user experience for example.

  • Do not use people’s data in ways they would find intrusive or which could cause them harm, unless you have a very good reason.

  Our interpretation : ask yourself if this data is representing a risk for the individuals.

  • If you process children’s data, take extra care to make sure you protect their interests.
  • Consider safeguards to reduce the impact where possible.

  Our interpretation : Check if your web hosting provider is providing appropriate safeguards.

  • Consider whether you can offer an opt out.

  Our interpretation : Matomo is providing you the opt-out feature.

  • If your LIA identifies a significant privacy impact, consider whether you also need to conduct a DPIA.

  Our interpretation : A DPIA can easily be conducted by using this software from the French privacy commission.

  • Regularly review your LIA and update it when circumstances change.
  • Include information about your legitimate interests in your privacy information.

  As you see, going for “Legitimate interests” requires a lot of written documentation. Let’s see how “Consent” differ.

  What should I do if I am processing personal data with Matomo based on “Consent” ?

  As previously mentioned, using “Consent” rather than “Legitimate interests” is more technical but less intense in terms of documentation. Like for “Legitimate interests”, ICO is providing a checklist for “Consent” which is divided into 3 key categories : 1) asking for consent, 2) recording consent, and 3) managing consent.

  1. Asking for consent :
     1. Check that consent is the most appropriate lawful basis for processing.
     2. Make the request for consent prominent and separate from your terms and conditions.
     3. Ask people to positively opt in. Don’t use pre-ticked boxes or any other type of default consent.
     4. Use clear, plain language that is easy to understand.
     5. Specify why you want the data and what you are going to do with it.
     6. Give individual (‘granular’) options to consent separately to different purposes and types of processing.
     7. Name your organisation and any third party controllers who will be relying on the consent.
     8. Tell individuals they can withdraw their consent.
     9. Ensure that individuals can refuse to consent without detriment.
     10. Avoid making consent a precondition of a service.
     11. If you offer online services directly to children, only seek consent if you have age-verification measures (and parental-consent measures for younger children) in place.
  2. Recording consent :
     1. Keep a record of when and how you got consent from the individual.
     2. Keep a record of exactly what you told them at the time.
  3. Managing consent :
     1. Regularly review consents to check that the relationship, the processing and the purposes have not changed.
     2. Have processes in place to refresh consent at appropriate intervals, including any parental consent.
     3. Consider using privacy dashboards or other preference-management tools as a matter of good practice.
     4. Make it easy for individuals to withdraw their consent at any time, and publicise how to do so.
     5. Act on withdrawals of consent as soon as you can.
     6. Don’t penalise individuals who wish to withdraw consent.

     3 – Inform your visitor about it in a privacy notice

     Privacy notices are an important part within the GDPR process. Read our blog post dedicated to privacy notices to learn more.

     We really hope you enjoyed reading this blog post. Please have a look at our Matomo GDPR guide for more information.

  The post Lawful basis for processing personal data under GDPR with Matomo appeared first on Analytics Platform - Matomo.