As part of my commitment to OpenStreetMap-NextGen migration, I undertook a comprehensive security review of the existing OpenStreetMap website. I followed the principles of coordinated vulnerability disclosure, working directly with the maintainers to responsibly report my findings. Today, I’m making the details of this process public and verifying the status of the fixes.

Disclosure Timeline

• 2023-11-04 - Contacted Ruby security maintainers & disclosed the timeline publicly
• 2023-11-08 - Maintainers acknowledged the report
• 2023-12-04 - Reported additional vulnerabilities with a 3-month deadline
• 2023-12-06 - Maintainers acknowledged the additional report
• 2024-03-02 - Publicize vulnerability details
• 2024-03-15 - Publicize vulnerability details

---

1. Plain-Text Authentication Token Storage

Authorization tokens (oauth, session, user tokens) are stored in plain text. Read access to the database allows full impersonation of any user.

Status as of 2024-03-15: Partially vulnerable (oauth still depends on plain text storage)

NextGen Codebase Status: Fixed (all authorization tokens and credentials are hashed or encrypted for secure storage)

2. Insecure Email Reply Address Tokenization

The tokens used to ensure the authenticity of email replies are too short (24-bit), making them susceptible to brute-force attacks. An attacker could potentially guess the token and impersonate a legitimate user in email conversations. This vulnerability is especially dangerous if the attacker already has access to a conversation’s metadata (allowing for complete security bypass).

Status as of 2024-03-15: Fixed (now with 48-bit security)

NextGen Codebase Status: Fixed (128 or 256-bit security; undecided)

3. Unbounded GPX Extraction Denial of Service

… See full entry

Apparently, OSM in Vietnam is in a very poor condition. And one of the reasons would be the absence of several nature reserve areas, even compared to the two neighboring Indochinese brothers, Laos and Cambodia. Despite the fact that the Department of Forestry has published a document stating that there are 34 national parks and 56 nature reserves, until now (15 March) only half of them have been mapped to OSM.

Here’s the list:

National parks

• VQG Ba Bể/Ba Be NP
• VQG Ba Vì/Ba Vì NP
• VQG Bạch Mã/Bạch Mã NP
• VQG Bái Tử Long/Bái Tử Long NP
• VQG Bến En/Bến En NP
• VQG Bidoup - Núi Bà/Bidoup - Núi Bà NP
• VQG Bù Gia Mập/Bù Gia Mập NP
• VQG Cát Bà/Cát Bà NP
• VQG Cát Tiên/Cát Tiên NP
• VQG Chư Mom Ray/Chư Mom Ray NP
• VQG Chư Yang Sin/Chư Yang Sin NP
• VQG Côn Đảo/Côn Đảo NP
• VQG Cúc Phương/Cúc Phương NP
• VQG Du Già - Cao nguyên đá Đồng Văn/Du Già - Đồng Văn Karst Plateau NP
• VQG Hoàng Liên/Hoàng Liên NP
• VQG Kon Ka Kinh/Kon Ka Kinh NP
• VQG Lò Gò - Xa Mát/Lò Gò - Xa Mát NP
• VQG Mũi Cà Mau/Mũi Cà Mau NP
• VQG Núi Chúa/Núi Chúa NP
• VQG Phja Oắc - Phja Đén/Phja Oắc - Phja Đén NP
• VQG Phong Nha - Kẻ Bàng/Phong Nha - Kẻ Bàng NP
• VQG Phú Quốc/Phú Quốc NP
• VQG Phước Bình/Phước Bình NP
• VQG Pù Mát/Pù Mát NP
• VQG Sông Thanh/Sông Thanh NP
• VQG Tà Đùng/Tà Đùng NP
• VQG Tam Đảo/Tam Đảo NP
• VQG Tràm Chim/Tràm Chim NP
• VQG U Minh Hạ/U Minh Hạ NP
• VQG U Minh Thượng/U Minh Thượng NP
• VQG Vũ Quang/Vũ Quang NP
• VQG Xuân Sơn/Xuân Sơn NP
• VQG Xuân Thủy/Xuân Thủy NP
• VQG Yok Đôn/Yok Đôn NP

Nature reserves

Nature reserves with official “Nature Reserve” title

Official “Nature Reserve” title refers to the fact that these areas have their own management board (ban quản lý) and is usually a division of the provincial departments of agriculture and rural development (Sở Nông nghiệp và Phát triển Nông thôn). These includes:

… See full entry

How to map in Openstreetmap with the ID Editor.

… See full entry

presentation of the Mapeaia Belém project to the Brazilian Openstreetmap community

we present the Mapeia Belém project to the Brazilian openstreetmap community, which is an initiative of UMBRAOSM União dos Mapeadores Brasileiros do Openstreetmap and partners such as Meninas da GEO, Capitulos Youthmappers and other groups and in addition to the Brazilian Openstreetmap community and aims to update data in city ​​of Belém for the Major Events that the city will host in 2024 and 2025 such as FOSS4G and COP 30.

… See full entry

The key “name” is one of the 10 most frequently used characteristics of objects - according to Taginfo 100 million times. It is probably also the tag with the most errors. A random sample in my neighbourhood showed an error rate of 8.4% (N=1092). Possible reasons:

1. lack of knowledge
2. misunderstanding
3. tag missing

The proposal relates to point 2, possible misunderstandings regarding the meaning of the “name” tag.

Current Wiki structure

The main article names lists 14 different keys of the proper name, differentiates them from each other and from non-proper names and gives many examples. The article is quite extensive with 29k characters.

Of the 14 keys, 5 keys do not have their own wiki page: int_name, loc_name, nat_name, reg_name and nickname.

The article on the key name is similar to the main article names, only somewhat shorter. It is still quite extensive with 18k characters. All other articles are short.

Issues Main article “names”

Readability.

The text is very extensive and therefore requires perseverance. However, it deals with all aspects of name keys in detail and consistently. Many examples illustrate the basic idea.

Issues key:name

Readability, redundancy, clarity.

The text for the key name is very long at 18k characters, the essentials are lost in the sea of words. Much of it is a repetition of information that is already available elsewhere:

• The “values” section is almost completely contained in the main article.
• The “Variants” table is already completely contained in the main article.
• The table of language subkeys covers more than 3 screen pages and is also fully covered on the “Multilingual names” page.
• The sections “Road names” and “Additional data” are also already included in the main article. Only the sentence with “strapline” is supplementary.

In addition to the high redundancy, the text is also blurred. The core - the proper name - is not mentioned at all. The explanations lead to problematic statements.

… See full entry

Did you hear?

We plan to bring StreetComplete to iOS!

For all that have been eagerly awaiting this to happen, there is more good news, however!

Prototype Fund

… See full entry

The OpenStreetMap Foundation had quite recently launched a worldwide membership campaign with the objective of growing and diversifying OSMF membership in regions where there are very low or no OSMF members. And I am proud to say that I was/am part of this campaign. I should say that it is also my very first time volunteering for the OpenStreetMap Foundation and the experience has been & continues to be very enriching to say the least. In late January, I had responded to a call for volunteers & campaigners to help grow OSMF membership on Slack & since then, I’ve been part of a very diverse, talented & committed group of campaigners & volunteers.

On the first few virtual meet-ups via Google meet, I had promptly signed up for the visual comms/mapmakers role as I believed I could use whatever little designing skills & experiences I had to aid in creating & designing comms material for the campaign. In doing so, I had been thrown into a mix of incredible volunteers from around the world. Our work as visual comms/mapmakers volunteers had revolved around creating posters, pubmats, infographics, maps, etc. and these materials feature a lot about the OpenStreetMap Foundation, testimonials, how to join, membership types, why join, etc. However, generating these materials wasn’t an easy feat as the process often involved planning, a lot of discussions, facilitating, reviewing, and amending the materials as per suggestions/recommendations from the OSMF Board.

I believe that this volunteering opportunity has helped me grow in ways I wouldn’t have imagined because in the short period of only two months, I have learnt a lot about community, having being part of a group with shared or common interest but also acknowledging the different ideas, strengths & capabilities that each one of us had & brought to the table allowed us to effectively work together to bring about the outputs we were tasked to deliver.

… See full entry

A recent discussion on the osm-gb IRC channel was about how to map chapels within crematorium buildings.

I thought it was worth summarising some of that discussion. These notes pertain to crematoria in England and Wales. I have attended a funeral at that in Geneva, but that was twenty years ago.

One of the difficulties is that most visits to a crematorium are likely to be to attend a funeral service. This is not conducive to any kind of sophisticated micromanaging, but does allow a decent amount of basic observation. In addition I’m not aware of well-developed tagging standards for various features, as may become apparent by looking at some of my examples

In general

… See full entry

Hello Community,

Recently, I embarked on a quest to explore second-hand stores and made an intriguing discovery—not only about the variety of hidden treasures but also about the limitations of the existing data in OpenStreetMap.

At the beginning of my search i obviously used OSM to look for second hand shops. I used https://openstreetbrowser.org/ and created a custom category with the code

query: 13: nwr[shop=second_hand]

and discovered that there are just few second-hand stores mapped in my area. I was sure that this is not possible and so i searched the internet to create my own list while cross-referencing various websites, blogs and platforms.

To optimize my exploration, I looked to create an efficient route—the classic Traveling Salesman Problem. There are various tools and APIs that can be utilized for this purpose. After some deliberation, I opted for Routexl, which best suited my needs as its possible to use it for free if you don’t have more than 20 points.

Armed with the list and the route, I got out with my bicycle on two separate days to visit most of the second-hand stores and map them. But my journey didn’t end there. I checked again with the OpenStreetBrowser and and shared it the first time within a local community. The community then showed me another second-hand store specializing in computers—an aspect I had not previously considered, as my focus was on clothing stores.

Now there are two already mapped stores where its not clear if they are still in operation. More research and exploration is required to keep everything recent.

It was interesting to discover how these store did not get mapped previously or did not get any attention even after they got added to OSM. It was a nice experience to find something that might be needed locally.

Lets fill the map with new discoveries!

Open street mapping training was started at. 09:00, it was located at Kacyiru in Gift house where headquarter of OpenStreetMap Rwanda located. it was started by Jeannette as coordinator of Eco mappers, she starts with welcoming all newcomers (the trainee of the day) with good greeting and asked them to feel at home. as continuing she asked Jack to explain for us what OpenStreetMapping mean? what Eco mapper do? he told us where Eco mapper comes from, their vision and missions etc. jeanette continue as the newcomer to present itself and then she shows us her team one by one in his/her name and what he/she responsible for in Eco mappers group. continuing with receiving speakers, our special guest etc. also, we taking tea break together, then we follow another speaker. as we continuing to be celebrating women day, we play game together, and then we start to study how can we contribute to mapping process, Liliane helper us and another ecomappers member then we start to map, where the first mapper of the day mapped 170 buildings, he is a boy, finally, we took photos and sharing food together.

Hello my name is Lucas Shepard Brewer and I go to Jesuit Highschool. I loved mapping in turkey today!!! I do mapping everyday!!!! WHEN I SLEEO WHEN I EAT WHEN I RUN EVERYWHERE!!!!

In 2 March 2024, various OSM contributors and community members/leaders gathered together for the Local Chapters and Communities Congress! It was my pleasure to share a short update about HOT where I work as an Online Community Engagement Lead.

My slide presentation is here. Recordings are now uploaded in Youtube :)

Just a point to make that I shared about the HOT and its community, and not the HOT as an org. HOT Annual reports are available here.

How to get involved in HOT?

There are three general ways to get involved with HOT:

1. mapping in your own time,
2. participate in a HOT Working Group/s, and
3. contribute to tech.

So how do we engage with the community / contributors at HOT?

Since lots of different community members and leaders were there in the Congress, I took the opportunity to share and highlight how we foster a collaborative and inclusive space in HOT and channels

… See full entry

After FOSDEM I was hooked again to contributing to OSM. I started slowly by using StreetComplete and did more than 700 suggestions and edits for a months. Now I am looking into using the editor to be able to add missing spots, especially pubs and toilets.

If there any any other Englis speaking enthusiasts in Prague, I am always open for doing a map walk combined with a pub visit.

Found by Harrison Grossman and Caitlyn Faulkner

Yesterday morning, our OSM community in Metro Manila, conducted an AlayData event for the quarter. We gathered to celebrate Open Data Day, focusing on open geopsatial data from OpenStreetMap, and give ourselves opportunities to socialize and get to know other contributors, sharing stories and experiences, and a chance for hands-on learning with new tools.

Among the things that our community learned from a “getting to know you” survey we did last quarter, is the high interest in other aspects of the OSM movement: like field mapping, photo-mapping, and getting familiar with other tools available from the OSM ecoysystem, and to more casual opportunities to contribute other than arm-chair mapping.

The volunteer group was sub-divided into three teams of their choice:

• Galúgad - folks also on foot, using FieldPapers, for a no-tech mapping approach. In Filipino, “Galúgad” means travelling to explore, or search for something.
• Tahák - folks on foot, using StreetComplete_EE (SCEE). “Tahák” in Filipino means to pass through a new or unusual path.
• Padyák - folks on HPVs (in our case, just bikes), to collect ground-level photos, to support or augment map editing. “Padyák” in Filipino means to stomp, and by extension, to pedal or push with your foot.

Initial results

Here’s the latest heatmap of recent edits made in the area:

… See full entry

I have created a web-based tool to easily and intuitively obtain the access token needed to make most requests to the OpenStreetMap api.

It is hosted courtesy of Interactive Maps.

The tool walks you through the process of obtaining such a token. It is useful for those writing server-side software that communicates with the api.

I created this tool because there is no other simpler way to authorise server applications. Current ways require running code locally.

It is available here: https://tools.interactivemaps.xyz/token

In case you might have not yet noticed, my current project on OSM is to cover the entire remainder of Vancouver Island with woodland data. I started with my home area of the Comox Valley and am radiating out from there in all directions, eventually finishing up with the area around Cape Scott. Every patch of forest I find in aerial imagery, no matter how expansive, even if the trees are small, will be added.

---

✔ YouthMappers UFRJ receives the Women’s Participation Award!

✔ YouthMappers UFRJ recebe o Women’s Participation Award!

✔ Our participation in the Open Data Day YouthMappers at UFBA 2024

✔ Nossa participação no Open Data Day 2024 do YouthMappers at UFBA

✔ Web map do mapeamento colaborativo para redução de riscos e desastes (RRD)

✔ Web map of colaborative mapping for the Disaster Risk Reduction (DRR)

✔ Mapear POI no OpenStreetMap e exibir dinamicamente com uMap

✔ Mapping POI in OpenStreetMap and displaying dynamically with uMap

✔ Resultados do GIS DAY 2023!

✔ V Olimpíada Brasileira de Cartografia incluiu o OpenStreetMap como parte de sua etapa prática

✔ V Brazilian Cartographic Olympiad included OpenStreetMap as part of its practical stage

✔ Geocodificação com OpenStreetMap

✔ Mapeamento humanitário e OpenStreetMap

✔ Nossa participação no State of the Map Brasil 2023

✔ Atualização dos dados populacionais dos municípios brasileiros no OpenStreetMap

✽✽ Women’s participation is recognized

---

Leia em Português

The international project YouthMappers awarded the YouthMappers UFRJ Chapter (Rio de Janeiro, Brazil) for promoting women’s participation in its activities and organization, corresponding to more than 50% of its membership.

The YouthMappers UFRJ Chapter is an initiative of open collaborative mapping, that results of a partnership between the Virtual Institute for Sustainable Development - IVIDES.org and the Laboratory of Cartography - GeoCart-UFRJ, chaired by Dr. Raquel Dezidério Souto.

On this International Women’s Day, we dedicate this award to all girls and women, hoping that they can achieve their goals!

… See full entry

---

Our participation in the Open Data Day YouthMappers at UFBA 2024

Nossa participação no Open Data Day 2024 do YouthMappers at UFBA

Web map do mapeamento colaborativo para redução de riscos e desastes (RRD)

Web map of colaborative mapping for the Disaster Risk Reduction (DRR)

Mapear POI no OpenStreetMap e exibir dinamicamente com uMap

Mapping POI in OpenStreetMap and displaying dynamically with uMap

Resultados do GIS DAY 2023!

V Olimpíada Brasileira de Cartografia incluiu o OpenStreetMap como parte de sua etapa prática

V Brazilian Cartographic Olympiad included OpenStreetMap as part of its practical stage

Geocodificação com OpenStreetMap

Mapeamento humanitário e OpenStreetMap

Nossa participação no State of the Map Brasil 2023

Atualização dos dados populacionais dos municípios brasileiros no OpenStreetMap