From a324ba7b649840c16d365b757b19db2849991f11 Mon Sep 17 00:00:00 2001 From: jaseg Date: Mon, 30 Jun 2025 14:48:34 +0200 Subject: WIP --- content/blog/epa-sgd-crypto/index.rst | 36 ++++++++++++++++++++++ .../jupyterlab_notebook_file_oneliner/index.rst | 21 +++++++++++++ themes/conspiracy/layouts/_default/baseof.html | 22 ------------- themes/conspiracy/layouts/_default/list.html | 18 ----------- themes/conspiracy/layouts/_default/single.html | 23 -------------- .../conspiracy/layouts/_partials/breadcrumbs.html | 7 +++++ themes/conspiracy/layouts/_partials/card.html | 17 ++++++++++ themes/conspiracy/layouts/_partials/footer.html | 6 ++++ themes/conspiracy/layouts/_partials/head.html | 10 ++++++ themes/conspiracy/layouts/_partials/header.html | 23 ++++++++++++++ themes/conspiracy/layouts/baseof.html | 22 +++++++++++++ themes/conspiracy/layouts/home.html | 25 +++++++++++++++ themes/conspiracy/layouts/index.html | 25 --------------- themes/conspiracy/layouts/list.html | 18 +++++++++++ .../conspiracy/layouts/partials/breadcrumbs.html | 7 ----- themes/conspiracy/layouts/partials/card.html | 17 ---------- themes/conspiracy/layouts/partials/footer.html | 6 ---- themes/conspiracy/layouts/partials/head.html | 10 ------ themes/conspiracy/layouts/partials/header.html | 23 -------------- themes/conspiracy/layouts/single.html | 23 ++++++++++++++ 20 files changed, 208 insertions(+), 151 deletions(-) create mode 100644 content/blog/jupyterlab_notebook_file_oneliner/index.rst delete mode 100644 themes/conspiracy/layouts/_default/baseof.html delete mode 100644 themes/conspiracy/layouts/_default/list.html delete mode 100644 themes/conspiracy/layouts/_default/single.html create mode 100644 themes/conspiracy/layouts/_partials/breadcrumbs.html create mode 100644 themes/conspiracy/layouts/_partials/card.html create mode 100644 themes/conspiracy/layouts/_partials/footer.html create mode 100644 themes/conspiracy/layouts/_partials/head.html create mode 100644 themes/conspiracy/layouts/_partials/header.html create mode 100644 themes/conspiracy/layouts/baseof.html create mode 100644 themes/conspiracy/layouts/home.html delete mode 100644 themes/conspiracy/layouts/index.html create mode 100644 themes/conspiracy/layouts/list.html delete mode 100644 themes/conspiracy/layouts/partials/breadcrumbs.html delete mode 100644 themes/conspiracy/layouts/partials/card.html delete mode 100644 themes/conspiracy/layouts/partials/footer.html delete mode 100644 themes/conspiracy/layouts/partials/head.html delete mode 100644 themes/conspiracy/layouts/partials/header.html create mode 100644 themes/conspiracy/layouts/single.html diff --git a/content/blog/epa-sgd-crypto/index.rst b/content/blog/epa-sgd-crypto/index.rst index f2dd79f..ccbf648 100644 --- a/content/blog/epa-sgd-crypto/index.rst +++ b/content/blog/epa-sgd-crypto/index.rst @@ -45,10 +45,44 @@ Healthcare providers in Germany need to be registered with GKV Spitzenverband to insurance providers. Since these public providers constitute approximately 90% market share, the vast majority of healthcare providers are registered this way. +Before the new national health record system, a number of healthcare IT processes have already been standardized and +implemented by the parties above. In particular, every insured person already owns a cryptographic smartcard that acts +as their proof of identity when accessing healthcare services. On the other side of such transactions, healthcare +providers are likewise identified by cryptographic smartcards. Until now, these cards were used to facilitate billing of +services from healthcare providers to insurers and to transfer prescriptions from prescribing doctors to pharmacies. + +A central role in this existing infrastructure is assumed by VPN gateways that link healthcare providers to +the centrally-run backend infrastructure. Gematik GmbH calls these devices "Konnektor". They are specially-built +hardware devices that contain multiple smart cards to authenticate the VPN connection towards the backend, and besides +acting as a standard VPN gateway for client applications in the healthcare provider's network to tunnnel their backend +requests through, the Konnektors also perform cryptographic operations in some of Gematik GmbH's protocols, such as +authenticating certain requests using signatures. + ## Design principles +The new health record system was built on top of the existing infrastructure described above. In particular, access to +health records is managed through keys stored in the patient's and the healthcare provider's existing smartcards, and +all backend communication is tunneled through the existing VPN. Access to the files is mediated through the healthcare +provider's existing patient management software. While in early drafts of the system, access to healthcare records +through the patient's smartcard was gated behind a PIN, the impracticality of making the entire patient populace +remember PINs led the implementors to scrap this provision, meaning that the patient's smartcard is all a healthcare +provider needs to access the patient's record. + +A critical cornerstone in the system's design is that the system's designers decided that a lost smartcard should not +lead to any data loss. As a consequence of this decision, while some of the record's access keys are kept on the +patient smartcard, in contravention to conventional smartcard designs the same keys are kept accessible in a centralized +key escrow system named "Schlüsselgenerierungsdienst" and abbreviated as SGD. Furthermore, these keys are not generated +on the smartcard either -- instead, the key escrow system generates these access keys, one copy of which is then +transmitted and stored inside the smartcard. + +The system supports re-issuing a smartcard to gain access to a healthcare record. Since the record's privacy pivots on +this process, the system incorporates some organziational countermeasures that aim to make it hard to gain access to a +re-issued copy of a patient smartcard without the patient's help or otherwise multiple colluding parties. + ## Cryptographic design + + ## The implied adversary model While Gematik GmbH publishes detailed specifications of the systems they standardize, these specifications and some @@ -59,6 +93,8 @@ threat model or an adversary model. As a result of this, we will deduce an adver published standards in the national healthcare setting. We will base our further analysis of the system on this adversary model. + + ## Previous reviews and audits of the system [0] https://www.destatis.de/DE/Themen/Arbeit/Arbeitsmarkt/Qualitaet-Arbeit/Dimension-2/krankenversicherungsschutz.html diff --git a/content/blog/jupyterlab_notebook_file_oneliner/index.rst b/content/blog/jupyterlab_notebook_file_oneliner/index.rst new file mode 100644 index 0000000..8885c4c --- /dev/null +++ b/content/blog/jupyterlab_notebook_file_oneliner/index.rst @@ -0,0 +1,21 @@ +--- +title: "Getting the .ipynb Notebook File Location From a Running Jupyter Lab Notebook" +date: 2025-06-30T23:42:00+01:00 +summary: > + If you need to get the path of the ipynb file in a running #Jupyter notebook, this one-liner will do the trick. It + seems chatgpt is confused, and a bunch of other approaches on the web look fragile and/or unnecessarily complex to + me. +--- + +If you need to get the path of the ipynb file in a running #Jupyter notebook, this one-liner will do the trick. It seems +chatgpt is confused, and a bunch of other approaches on the web look fragile and/or unnecessarily complex to me. + +.. code:: python + + import sys + Path(json.loads(Path(sys.argv[-1]).read_bytes())['jupyter_session']) + +The way this works is that for each notebook, jupyter starts a python "kernel" process that actually runs the notebook's +code. That kernel gets a json file with info on the notebook's location on the disk passed through its command line. +Since we're running code in that exact python process, we can just grab that json file from sys.argv, and read it +ourselves. diff --git a/themes/conspiracy/layouts/_default/baseof.html b/themes/conspiracy/layouts/_default/baseof.html deleted file mode 100644 index 9557f19..0000000 --- a/themes/conspiracy/layouts/_default/baseof.html +++ /dev/null @@ -1,22 +0,0 @@ - - - {{- partial "head.html" . -}} - - {{- partial "header.html" . -}} - {{- block "main" . }}{{- end }} - {{- partial "footer.html" . -}} - - - - diff --git a/themes/conspiracy/layouts/_default/list.html b/themes/conspiracy/layouts/_default/list.html deleted file mode 100644 index 02703b4..0000000 --- a/themes/conspiracy/layouts/_default/list.html +++ /dev/null @@ -1,18 +0,0 @@ -{{- define "main" }} - {{- if not .IsHome | and .Title }} -
-

{{ .Title }}

- {{- partial "breadcrumbs.html" . }} -
- {{- end }} -
- {{- if .Content }} -
- {{ .Content }} -
- {{- end }} - {{- range .Pages }} - {{ partial "card.html" . }} - {{- end }} -
-{{- end }} diff --git a/themes/conspiracy/layouts/_default/single.html b/themes/conspiracy/layouts/_default/single.html deleted file mode 100644 index c7135f8..0000000 --- a/themes/conspiracy/layouts/_default/single.html +++ /dev/null @@ -1,23 +0,0 @@ -{{- define "main" }} - {{- if not .IsHome | and .Title }} -
-

{{ .Title }}

- {{- partial "breadcrumbs.html" . }} - {{- if .Params.Date }} {{ .Date.Format "2006-01-02" }}{{- end }} -
- {{- end }} - {{- if .Params.noindex }} -
- {{- else }} -
- {{- end }} - {{- if .Params.external_links }} - - {{- end }} - {{ .Content }} -
-{{- end }} diff --git a/themes/conspiracy/layouts/_partials/breadcrumbs.html b/themes/conspiracy/layouts/_partials/breadcrumbs.html new file mode 100644 index 0000000..ff82e73 --- /dev/null +++ b/themes/conspiracy/layouts/_partials/breadcrumbs.html @@ -0,0 +1,7 @@ +{{/* https://github.com/adityatelange/hugo-PaperMod/blob/master/layouts/partials/breadcrumbs.html */}} + diff --git a/themes/conspiracy/layouts/_partials/card.html b/themes/conspiracy/layouts/_partials/card.html new file mode 100644 index 0000000..21eeebf --- /dev/null +++ b/themes/conspiracy/layouts/_partials/card.html @@ -0,0 +1,17 @@ +
+ {{- if .Title }}

{{ .Title }}

{{- end }} + {{- if and .Date (not (isset (index .Ancestors 0).Params "hide_date")) }}{{ .Date.Format "2006-01-02" }}{{- end }} + +
+ {{ .Summary | safeHTML }} + Read more +
+ + {{- if .Params.external_links }} + + {{- end }} +
diff --git a/themes/conspiracy/layouts/_partials/footer.html b/themes/conspiracy/layouts/_partials/footer.html new file mode 100644 index 0000000..adf7aee --- /dev/null +++ b/themes/conspiracy/layouts/_partials/footer.html @@ -0,0 +1,6 @@ +
+ Copyright © {{ now.Year }} {{ site.Copyright }} + {{- range site.Params.footer_links }} + / {{ .name }} + {{- end }} +
diff --git a/themes/conspiracy/layouts/_partials/head.html b/themes/conspiracy/layouts/_partials/head.html new file mode 100644 index 0000000..1196d00 --- /dev/null +++ b/themes/conspiracy/layouts/_partials/head.html @@ -0,0 +1,10 @@ + + + {{ if .IsHome }}{{ else }}{{ if .Title }}{{ .Title }} | {{ end }}{{ end }}{{ site.Title }} + + + + + {{- $stylesheet := resources.Get "css/style.css" | resources.ExecuteAsTemplate "style.css" . }} + + diff --git a/themes/conspiracy/layouts/_partials/header.html b/themes/conspiracy/layouts/_partials/header.html new file mode 100644 index 0000000..0b9ea44 --- /dev/null +++ b/themes/conspiracy/layouts/_partials/header.html @@ -0,0 +1,23 @@ + diff --git a/themes/conspiracy/layouts/baseof.html b/themes/conspiracy/layouts/baseof.html new file mode 100644 index 0000000..9557f19 --- /dev/null +++ b/themes/conspiracy/layouts/baseof.html @@ -0,0 +1,22 @@ + + + {{- partial "head.html" . -}} + + {{- partial "header.html" . -}} + {{- block "main" . }}{{- end }} + {{- partial "footer.html" . -}} + + + + diff --git a/themes/conspiracy/layouts/home.html b/themes/conspiracy/layouts/home.html new file mode 100644 index 0000000..f865cd3 --- /dev/null +++ b/themes/conspiracy/layouts/home.html @@ -0,0 +1,25 @@ +{{- define "main" }} +
+

{{ .Title }}

+
+
+ {{- if .Content }} +
+ {{ .Content }} +
+ {{- end }} + + {{ range $config := site.Params.homepage_categories }} +

{{ .title }}

+ {{ range $entry := first $config.count (where site.RegularPages "Section" "==" $config.key) }} + {{ partial "card.html" $entry }} + {{ end }} + + + {{ end }} +
+{{- end }} diff --git a/themes/conspiracy/layouts/index.html b/themes/conspiracy/layouts/index.html deleted file mode 100644 index 808ddc8..0000000 --- a/themes/conspiracy/layouts/index.html +++ /dev/null @@ -1,25 +0,0 @@ -{{- define "main" }} -
-

{{ .Title }}

-
-
- {{- if .Content }} -
- {{ .Content }} -
- {{- end }} - - {{- range $config := site.Params.homepage_categories }} -

{{ .title }}

- {{- range $entry := first $config.count (where site.RegularPages "Section" "==" $config.key) }} - {{ partial "card.html" $entry }} - {{- end }} - - - {{- end }} -
-{{- end }} diff --git a/themes/conspiracy/layouts/list.html b/themes/conspiracy/layouts/list.html new file mode 100644 index 0000000..02703b4 --- /dev/null +++ b/themes/conspiracy/layouts/list.html @@ -0,0 +1,18 @@ +{{- define "main" }} + {{- if not .IsHome | and .Title }} +
+

{{ .Title }}

+ {{- partial "breadcrumbs.html" . }} +
+ {{- end }} +
+ {{- if .Content }} +
+ {{ .Content }} +
+ {{- end }} + {{- range .Pages }} + {{ partial "card.html" . }} + {{- end }} +
+{{- end }} diff --git a/themes/conspiracy/layouts/partials/breadcrumbs.html b/themes/conspiracy/layouts/partials/breadcrumbs.html deleted file mode 100644 index ff82e73..0000000 --- a/themes/conspiracy/layouts/partials/breadcrumbs.html +++ /dev/null @@ -1,7 +0,0 @@ -{{/* https://github.com/adityatelange/hugo-PaperMod/blob/master/layouts/partials/breadcrumbs.html */}} - diff --git a/themes/conspiracy/layouts/partials/card.html b/themes/conspiracy/layouts/partials/card.html deleted file mode 100644 index 21eeebf..0000000 --- a/themes/conspiracy/layouts/partials/card.html +++ /dev/null @@ -1,17 +0,0 @@ -
- {{- if .Title }}

{{ .Title }}

{{- end }} - {{- if and .Date (not (isset (index .Ancestors 0).Params "hide_date")) }}{{ .Date.Format "2006-01-02" }}{{- end }} - -
- {{ .Summary | safeHTML }} - Read more -
- - {{- if .Params.external_links }} - - {{- end }} -
diff --git a/themes/conspiracy/layouts/partials/footer.html b/themes/conspiracy/layouts/partials/footer.html deleted file mode 100644 index adf7aee..0000000 --- a/themes/conspiracy/layouts/partials/footer.html +++ /dev/null @@ -1,6 +0,0 @@ -
- Copyright © {{ now.Year }} {{ site.Copyright }} - {{- range site.Params.footer_links }} - / {{ .name }} - {{- end }} -
diff --git a/themes/conspiracy/layouts/partials/head.html b/themes/conspiracy/layouts/partials/head.html deleted file mode 100644 index 1196d00..0000000 --- a/themes/conspiracy/layouts/partials/head.html +++ /dev/null @@ -1,10 +0,0 @@ - - - {{ if .IsHome }}{{ else }}{{ if .Title }}{{ .Title }} | {{ end }}{{ end }}{{ site.Title }} - - - - - {{- $stylesheet := resources.Get "css/style.css" | resources.ExecuteAsTemplate "style.css" . }} - - diff --git a/themes/conspiracy/layouts/partials/header.html b/themes/conspiracy/layouts/partials/header.html deleted file mode 100644 index 0b9ea44..0000000 --- a/themes/conspiracy/layouts/partials/header.html +++ /dev/null @@ -1,23 +0,0 @@ - diff --git a/themes/conspiracy/layouts/single.html b/themes/conspiracy/layouts/single.html new file mode 100644 index 0000000..c7135f8 --- /dev/null +++ b/themes/conspiracy/layouts/single.html @@ -0,0 +1,23 @@ +{{- define "main" }} + {{- if not .IsHome | and .Title }} +
+

{{ .Title }}

+ {{- partial "breadcrumbs.html" . }} + {{- if .Params.Date }} {{ .Date.Format "2006-01-02" }}{{- end }} +
+ {{- end }} + {{- if .Params.noindex }} +
+ {{- else }} +
+ {{- end }} + {{- if .Params.external_links }} + + {{- end }} + {{ .Content }} +
+{{- end }} -- cgit