- galaxy-announce - lists.galaxyproject.org

GCCBOSC 2018 Abstract Submission & Early Registration are Open
by Dave Clements 20 Feb '18

20 Feb '18

Hello all, We are pleased to announce that abstract submission and early registration for GCCBOSC2018 <https://gccbosc2018.sched.com/> are now open. - Submit an abstract <https://easychair.org/conferences/?conf=gccbosc2018> (oral presentation abstracts due March 16) - Register <https://gccbosc2018.eventbrite.com/> - Book conference housing <https://gccbosc2018housing.eventbrite.com/> GCCBOSC 2018 <https://gccbosc2018.sched.com/> will be held 25-30 June in Portland, Oregon, United States. This brings the 2018 Galaxy Community Conference and the Bioinformatics Open Source Conference together into a unified week-long event. If you work in open source life science or data-intensive biomedical research, then there is no better place than GCCBOSC 2018 to present your work and to learn from others. Events GCCBOSC <https://gccbosc2018.sched.com/> starts with two days of training <https://gccbosc2018.sched.com/overview/type/C.x+Training+-+All> with a wide range of topics nominated and selected by our communities. Training is followed by a two day meeting, with joint and parallel tracks, featuring oral presentations, posters, demos, lightning talks, birds-of-a-feather and invited keynotes <https://galaxyproject.org/events/gccbosc2018/keynotes/>from Fernando Pérez <https://galaxyproject.org/events/gccbosc2018/keynotes/#bosc-gcc-joint-keyno…> of the Berkeley Institute for Data Science <https://bids.berkeley.edu/> and Project Jupyter <http://jupyter.org/>, and Tracy K. Teal <https://galaxyproject.org/events/gccbosc2018/keynotes/#bosc-2018-keynote-tr…> of The Carpentries. The week finishes with *CollaborationFest <https://galaxyproject.org/events/gccbosc2018/collaboration/> Core* and *Encore*, two or four days of collaborative work on code, documentation, training and challenging data analysis problems. Abstract Submission BOSC and GCC are now accepting abstracts <https://easychair.org/conferences/?conf=gccbosc2018> for oral presentations, posters, demos, and lightning talks. We are using EasyChair <https://easychair.org/> for submissions. If you don't already have an account, you'll need to create one. *The deadline for oral presentations is rapidly approaching (March 16) so plan to submit your abstracts soon.* Registration Register now <https://gccbosc2018.eventbrite.com/> to take full advantage of early registration discounts <https://galaxyproject.org/events/gccbosc2018/register/> for students/post-docs (75% off full price), non-profits (67%) and industry (50%). Early registration rates for students and post-docs average $66 / day. Conference Housing Official conference housing <https://gccbosc2018housing.eventbrite.com/> for GCCBOSC 2018 is in Reed residence halls. Rooms are within easy walking distance of all conference venues. Room prices per night drop the longer the stay. If you prefer to stay elsewhere, Reed College has a list of recommended hotels <https://www.reed.edu/accommodations.html>, many offering a discount for those attending events at Reed. Travel Fellowships Both OBF and the Galaxy Community Fund Board are offering fellowships to attend GCCBOSC 2018: - OBF Travel Fellowships <https://github.com/OBF/obf-docs/blob/master/Travel_fellowships.md>, deadline is April 15. - GCC2018 Fellowships <https://galaxyproject.org/news/2018-02-20-gcc-fellowships/>, first deadline is March 16. See you in Portland! The GCCBOSC 2018 Organizers <https://galaxyproject.org/events/gccbosc2018/organizers> -- https://galaxyproject.org/ https://usegalaxy.org/

1 0

Galaxy News: GCCBOSC Training Topic Voting closes Wednesday!
by Dave Clements 30 Jan '18

30 Jan '18

1 0

GCCBOSC 2018 Training Topic Voting is now open
by Dave Clements 22 Jan '18

22 Jan '18

Hello all, Voting is now open <http://bit.ly/gccbosc2018-vote> on what training topics <https://galaxyproject.org/events/gccbosc2018/training/> will be offered at GCCBOSC 2018 <https://gccbosc2018.sched.com/>. Your vote <http://bit.ly/gccbosc2018-vote> will determine the topics that are offered, which topics should be offered more than once, and which ones should not be scheduled at the same time. Your vote matters. *Topic voting closes January 31.* The Training schedule, including instructors, will be published before early registration opens. GCCBOSC2018 <https://gccbosc2018.sched.com/> will be held 25-30 June in Portland, Oregon, United States. It will feature two days of training: the second of which is multi-track and will feature content for both the BOSC and Galaxy communities. Workshops will be hands-on and participants will be strongly encouraged to bring a laptop and follow along. If you work in data-intensive biomedical research, there is no better place than GCCBOSC 2018 to present your work and to learn from others. Thanks, and see you in Portland! The GCCBOSC 2018 Organizers <https://galaxyproject.org/events/gccbosc2018/organizers> -- https://galaxyproject.org/ https://usegalaxy.org/

1 0

January Galactic News
by Dave Clements 05 Jan '18

05 Jan '18

1 0

GCCBOSC 2018 Training Topic Nominations are Open!
by Dave Clements 14 Dec '17

14 Dec '17

Hello all, This email in 5 words: *Nominate a training topic now <http://bit.ly/gccbosc2018-tr-nom>!* Or, the longer version: The joint 2018 Galaxy Community and Bioinformatics Open Source Conferences <https://gccbosc2018.sched.com/> start with training and *the training topics are determined by you*. Please take a few minutes to consider what you would like to learn (or teach) at GCCBOSC2018. Any topic(s) of interest to these communities can be *nominated <http://bit.ly/gccbosc2018-tr-nom>.* GCCBOSC2018 <https://gccbosc2018.sched.com/> will be held 25-30 June in Portland, Oregon, United States, and will feature two days of training - the second of which is multi-track and will feature content for both the BOSC and Galaxy communities. Nominations can cover a wide range of topics. For example: - How to use open source software using just a web browser (e.g., Intro to Using Galaxy) - How to use software packages (The Newbie's Guide to BioRuby) - Advanced applications of software (Genome Assembly with Galaxy, or Proteomics with BioPython) - Software installation and configuration (Tool Wrapping for Galaxy, or Using CloudLaunch) - Open source community (Building a Curation Community using Apollo, or Training using the Galaxy Training Network) *These are only examples.* If you are looking for ideas, see topics nominated for GCC2017 <https://docs.google.com/document/d/1jyCndVqfXx-HsyFJ4hjaK075vDbPM1kE58qO2lJ…> , GCC2016 <http://bit.ly/gcc2016noms>, GCC2015 <http://bit.ly/gcc2015vote>, and the Galaxy Events page <https://galaxyproject.org/events/>, which lists what training the community is offering outside of GCCs. *Training is not limited to Galaxy-related topics. Don't be afraid to think inside the BOSC!* Basically, if you think our communities will be interested in a topic, then please nominate it <http://bit.ly/gccbosc2018-tr-nom>! Nominated topics will be published <https://galaxyproject.org/events/gccbosc2018/training/> as they come in. *Topic Nominations close January 7*. Topics will be compiled into a uniform list by the GCCBOSC2018 organizers, and then voted on by the community starting one week later. Looking forward to seeing you in Portland! Dave Clements, on behalf of the GCCBOSC 2018 Organizers -- https://galaxyproject.org/ https://usegalaxy.org/

1 0

December 2017 News of the Galaxy
by Dave Clements 07 Dec '17

07 Dec '17

1 0

GX-2017-0005: Unauthorized data libraries access
by Martin Čech 15 Nov '17

15 Nov '17

*DESCRIPTION* A medium severity security vulnerability in Galaxy data libraries has been discovered. This vulnerability allows anyone able to access Galaxy's API to add to their history any data library dataset that they know an id of. This vulnerability has been assigned the disclosure ID GX-2017-0005. *AFFECTED VERSIONS* This vulnerability affects all versions of Galaxy released since at least 2011. *IMPACT* Given the ids of library datasets are presented encoded it is not easy to exploit this vulnerability in a targeted manner. However all Galaxy objects are enumerated incrementally so there are means to generate and/or guess valid ids of existing library datasets and read them. *SOLUTION* Per our security policies[1], we have created fixes for versions of Galaxy starting with 16.07. These have been committed to the corresponding `release_YY.MM` (and `dev`) branches in the Galaxy GitHub repository. Releases prior to 16.07 will remain vulnerable and should be updated to a supported release as soon as possible. *INSTRUCTIONS* The fixes are available on the `release_16.07` through `release_17.09` and `dev` branches in the Galaxy GitHub repository[2]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. Martin (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/

1 0

Release of Galaxy 17.09
by Martin Čech 02 Nov '17

02 Nov '17

Dear Galaxy Fans, The release* of Galaxy **17.09* is out. Thanks to the #usegalaxy committers and you, our community! *Full *release * notes: * https://docs.galaxyproject.org/en/master/releases/17.09_announce.html Highlights: *Singularity - *Tool execution using the HPC-friendly container technology Singularity is now supported. Custom containers can be specified by the Galaxy admin on a per job destination basis or standardized containers corresponding to Conda requirements can be built or downloaded automatically using the mulled toolkit built into Galaxy (just like is possible for Docker). For more information checkout presentation at http://jmchilton.github.io/writing/gcc2017slides/biocontainers.html from the 2017 Galaxy Community Conference. *Download entire collection - *Downloading whole colections is now possible from the history interface. Thanks to @mvdbeek. *Switch tool versions in workflows - *You can now select exactly what version of tool you want to use when building workflows.Thanks to @mvdbeek. *Thanks for using Galaxy!* *http://galaxyproject.org <http://galaxyproject.org>*

1 0

November News: Blog, pubs, PAG, servers, tools, ...
by Dave Clements 31 Oct '17

31 Oct '17

Hello all, The November 2017 Galaxy News <https://galaxyproject.org/galaxy-updates/2017-11/> is out! - The Galactic Blog takes off <https://galaxyproject.org/galaxy-updates/2017-11/#the-galactic-blog> - Publications <https://galaxyproject.org/galaxy-updates/2017-11/#publications>: - The Galaxy Pub library surpasses 5,000 publications - 110 new pubs added in October, including 5 highlighted pubs - Upcoming events <https://galaxyproject.org/galaxy-updates/2017-11/#events> (9 this month) - Galaxy (and GMOD) at PAG XXVI <https://galaxyproject.org/galaxy-updates/2017-11/#galaxy-and-gmod-at-plant-…> - *PAG Early registration ends today.* - Public Galaxy Server News - 33 pubs in October <https://galaxyproject.org/galaxy-updates/2017-11/#public-servers-in-october…> using, referencing or about public Galaxy servers - Citations section <https://galaxyproject.org/galaxy-updates/2017-11/#citation-sections-added-t…> added to public server list - New public server: BF2I-MAP <https://galaxyproject.org/galaxy-updates/2017-11/#bf2i-map> - And the Language Analysis Portal <https://galaxyproject.org/galaxy-updates/2017-11/#almost-a-public-server-la…> too - ToolShed contributions <https://galaxyproject.org/galaxy-updates/2017-11/#toolshed-contributions> - New releases <https://galaxyproject.org/galaxy-updates/2017-11/#releases> of StarForge and sequence_utils. And Other news <https://galaxyproject.org/galaxy-updates/2017-11/#other-news> too. See the full newsletter <https://galaxyproject.org/galaxy-updates/2017-11/>. Dave C and the Galaxy Team -- https://galaxyproject.org/ https://usegalaxy.org/

1 0

GX-2017-0003: Unauthorized filesystem access via data source tools
by Nate Coraor 23 Oct '17

23 Oct '17

*DESCRIPTION* A medium severity security vulnerability in tools utilizing the Galaxy data source protocol was recently discovered by Dan Blankenberg. This vulnerability allows anyone able to run an external data source tool to add to their history any file that is readable by the user running Galaxy jobs on the host where the job runs. This is due to the Python urllib library's ability to operate on `file://` URLs and a failure to check for such URLs in the tool. This vulnerability has been assigned the disclosure ID GX-2017-0003. *AFFECTED VERSIONS* This vulnerability affects all known versions of Galaxy. *IMPACT* Many such "external data source" tools are provided with the Galaxy distribution and are enabled by default (most tools under the "Get Data" section of the tool panel), meaning that its exploitability is fairly high, as only one such tool needs to be enabled to be vulnerable, including any custom data source tools (any tool that uses `tools/data_source/data_source.py`). What files will be readable depends entirely upon what the job's user has access to read on the host(s) where jobs run. *SOLUTION* Per our security policies[1], we have created fixes for all affected versions of Galaxy. These have been committed to the corresponding `release_YY.MM` (and `dev`) branches in the Galaxy GitHub repository. Releases prior to 16.07 will remain vulnerable and should be updated to a supported release as soon as possible. Eric Rasche recently undertook a hardening of the Galaxy code base against common security mishaps.[2] This included changing most uses of `urllib` to `requests`, which does not operate on `file://` URLs. Although no exploits were identified at that time, we felt this work was of great enough importance to production Galaxy servers that we backported it to releases from 16.07 forward. Because of this, and the GX-2017-0001 and GX-2017-0002 vulnerabilities, administrators are strongly encouraged to update immediately, even if they do not believe their servers are vulnerable. *INSTRUCTIONS* The fixes are available on the `release_16.07` through `release_17.09` and `dev` branches in the Galaxy GitHub repository[3]. You can simply `git pull` or use your normal update procedure to get the changes. For the changes to take effect, *YOU MUST RESTART ALL GALAXY SERVER PROCESSES*. --nate (on behalf of the Galaxy Committers) [1] https://github.com/galaxyproject/galaxy/blob/dev/SECURITY_POLICY.md [2] https://github.com/galaxyproject/galaxy/pull/4604 [3] https://github.com/galaxyproject/galaxy/

1 0