10 tips when teaching English as a foreign language to children. Most EFL teachers abroad will at some point in their career teach children. The English education market catered to young learners as a billion-dollar business, and many countries hire teachers to fill this need. What you can do to brace yourself besides taking our 50-hour specialized TEFL course and teaching English to young learners is to take the following 10 tips to heart. Don't think it's a piece of cake. Teaching numbers and colors seems like the easiest job in the world, right? Wrong. The truth is, teaching children demands a great deal of energy and creativity. Kids are always on the go and will keep you on your toes. These classes can be exhausting but also extremely rewarding. Involve your students in hands-on activities. Kids learn incredibly well by absorbing ideas and concepts actively. This means getting your students out of their chairs, moving around the classroom, singing, dancing or even outside exploring the world around them. Different props and materials will also go a long way so you better stock up on dice, colored paper, crayons, blocks, and all kinds of props you can use in the classroom. Have them actually touch fake fruit and vegetables when teaching those vocabulary words, and you'll be surprised how attentive they will be, and how well those words will stick in their heads. Don't talk for long periods. The worst thing you can probably do is the complete opposite from the point above. When you spend too much time talking about vocabulary, grammar or even just instructions for a task, the energy level of the classroom quickly drops and your young students will lose interest. Keep your explanations brief and move on to the actual activity quickly. If a planned activity doesn't work, move on. Always keep a few extra activities up your sleeve just in case. Children learn through personal interactions. Communicating and interacting is key in a classroom full of young learners. Talk to each child individually and plan activities that involve group or pair work to make the kids interact with each other. Review, review, review. While adult students often understand new information after the teachers explain it once, young learners really need constant reviews. It's a good idea to do a short review session at the beginning of each class to get the material really stuck into your students' heads and store it in the long-term memory. Cater to multiple intelligences. Another great way to keep things fun and interesting is to plan your lessons according to different learning styles and multiple intelligences. These include visual, spatial, logical, mathematical, bodily, kinesthetic, musical, rhythmic, interpersonal, interpersonal, naturalist, and spiritual. You can accomplish this, for example, by teaching an ESL element with a song, such as Hickory Dickory Doc when teaching how to tell the time. Another example would be to use the game of Simon Says to teach body parts or to use maps for teaching places around town. Encourage self-correction. Self-correction or self-regulation is an integral part of learning and something every teacher should encourage. The questions how am I doing? And am I doing this right? Should be asked in an open and non-judgemental environment. This not only allows for barrier-free learning but also creates a safe learning environment, where your students can thrive. Praise, praise, praise. It might feel strange at first, but you really need to praise your young students constantly. Whenever they say something correctly or show positive behavior, you should praise them and throw a good job out there. Rewarding your students for positive behavior is also a big part of successful classroom management. For example, you could create sticker boards and give out stickers, as encouragement when your student is doing a good job. When the sticker board is full, they will get a reward. Be prepared to deal with parents. Last but not least, you will have to deal with parents when teaching young students. Sometimes, language schools abroad have a separate local teacher for this due to possible language barriers, but every teacher of children needs to communicate with parents to some degree. This could be informing them about the goals for the next semester, the children's learning goals, such as the syllabus for the school year, and most important, the child's individual progress. Use learned information in different contexts. Using new grammar or vocabulary in a variety of contexts really helps in making your students understand the correct usage, and the more context the better. It also helps to use real-life context by talking about them and their lives. Are you ready to teach English abroad? These 10 tips will really help you when teaching English as a foreign language to children.


Hello, everybody. I know I've talked to a lot of you today already, but I get to say it from the stage now. Yeah, so I'm gonna spend about 25 minutes today talking a little bit about SigStore in the context of Python packaging, and specifically some of the next steps that lead to people who are both in the SigStore and the Python packaging communities are planning on doing for broader adoption in Python. So without further ado, yeah, my name is William. I am a senior security engineer at a company called Trail of Bits. Some of you may know us, for those of you who don't, we're a mid-sized cybersecurity company. In my mind, I think this is a small one, but now we're actually kind of big. We do a whole bunch of different things, but the things that I'm involved with are primarily open-source work in the package management, compilers, applied photography space. So generally things that companies don't have sort of specialized in-house talent for, they bring us in to help build out those tools and contribute back to the open-source community. And we do all kinds of things in the program analysis research space, too. And of course, this is my call to say, we're also hiring, so please join us if you are interested. We're pretty easy to find on mine. Yeah, so just to sort of set an agenda for today, I'm gonna sort of do, because this is a SigStore crowd and not a Python direct crowd, I'm gonna do a quick overview of the history of Python packaging and what it looks like and why it is the way it is. Alternatively, it's subtle. My package index is almost sold enough to drink. We'll then go through some of the pre-existing security practices in the Python packaging ecosystem and see how SigStore will replace nearly all of them, probably not all of them. We'll see where SigStore is currently being used, how you can use it in its current context, and then where we intend for it to be used. So sort of the next steps, as the title says, including things like the integration between SigStore and Tuff, within PyPI, within PIP, within your CI, and for sort of more complex verification policies. But before I do any of that, I wanted to sort of establish like a tone thing. So I think I can speak to everybody in this room when I say that we all care about both software and supply chain security and that ultimately we don't get to do those things unless we care a lot about adoption. And the hard truth is that in order to drive adoption, you have to convince engineers. And engineers, most of them at least, the ones who aren't specifically tasked with it, do not care about those things unless they directly relate to their job duties. And it's actually not their job too. Their job is to achieve the things that they're told to do. So it is therefore our job to make security as easy and as frictionless as possible so that it gets out of their way so they can do their job. And sort of everything keeps moving. If we don't do this, they will not use what we give them. They will also resent us for it. And they will misuse whatever we give them.  We're given their way. And this applies, of course, doubly for open source because a lot of us are doing open source and we're paid for it. But for every one of us, there's people who aren't doing it for free because they believe in it. So we need to stay out of their way and make their lives better, not worse. Yeah, so as part of that, I want to do a brief history. So actually, before I do this, who in this room is programmed in Python? Okay, pretty much everybody. How many of you use pet? Pretty much everybody programs in Python, cool. Okay, so you probably know a lot of this already but I'll go through it pretty fast so that we're all on the same page. Yeah, so the reason I bring this up is because Python is one of the biggest programming communities in the world. It's one of the oldest for sort of like a modern programming language. And as a result of that, there's a lot of embedded history, packaging state that fundamentally cannot be changed. If you change these things, you're anger engineers and like we just said, if you're anger the engineers, they don't do anything. So way back in 2000, this thing called Distutils was added to Python 1.6.1. That's a version of Python that's sold that it's before the version that took us forever to deprecate. We're still using Distutils, as far as I can tell. Most of you probably have some piece of code in your code base that instead of using setup tools is using Distutils. So it's still there. This thing that we added drinking era ago. The year after that, we standardized the very first version of what's called the Python Packaging Metadata. This is still used. We have newer versions, but Python's tools will happily consume metadata 1.0. Shortly after that, the first central packaging index was established. And the word index there was really key because for a very long time, PyPI was not a file store. It was an index. And what that means is that it didn't, there were no distributions on PyPI. There was a link to a URL, that pointed to another server and you would navigate as a human being to that server and maybe there would be a file there that you could download. So this should tell you something about like how Python's packaging was originally organized and distributed. There was no automated way to do any of this. You as the application developer would go around the internet sort of like picking cherries from various websites, hoping they were online at the right time. And then install them manually. And then after that, the thing that we now call PyPI was established that was still just this bare index. No file hosting, just references to other servers. With that came metadata 1.1, which enhanced the metadata just a little bit, adds things like dependencies. You're after that, easy install. Some of you have possibly used this. This is like the predecessor to PIP. Easy install also comes with eggs, which are the predecessor to wheels. Both of these are more or less long gone. I think you can still use easy install with the latest versions of Python. Which again, should tell you something. I mean, this is not, you shouldn't be using it, but you can. And effort is put into supporting it. Moving on a few years, we get to 1.2. And then critically in 2008, we get PIP, which by the show of hands just earlier, many of you and the majority of you have used. And again, it should say something that, 14 years ago, the tool that you are all using today was created. So that was like sort of the prehistory of Python packaging. I would say the modern era roughly begins around 2012. So in 2012, we get PEP 427, which standardizes what we call wheels, which are like the modern package distribution format for Python packages. They augment, they don't fully replace source distributions, but they allow things like binary distributions. This, I'll talk a little bit more about what this enables, but basically it'll enable a lot of the things that we now can do with six store and with other tools. A few years later, we get the current PIPI repository API. So the thing that PIP actually uses when you do PIP install, before that, it was completely unstandardized. It would just sort of like hope and pray that the URL you hit resembled a PIPI index. So seven years ago, the thing that we all assumed just worked was actually standardized. Two years after that, we get metadata 2.1, which I believe is the current metadata standard unless they just released a new one, which I believe they were working on. In 2018, the modern PIPI backend was deployed. Before this, it was a code base that was sort of grown up organically from the 2003 code base. This is the one that is currently in use, and I'm a big fan of it. And finally, like more recent history, PEP 458. A lot of people in this room are very familiar with PEP 458. A lot of you worked on it. This is the signed repository metadata PEP. It's specifically tailored around Tuff. It was accepted, there were some efforts to implement it. They're still ongoing. The work that went there directly inspired a lot of this six-door work and is going to be used in conjunction with that. And then, sort of moving on, as of 2021, still nearly 99% of the top packages are distributed as wheels, but six of them still aren't. So 15 years after, no, 10 years after, it's still, there's a minority, but a very large number of downloads that are not using a modern distribution format. And then also PEP has a new dependency resolver. And then finally, we're here. So, you know, it's been going on for a long time and all of this has been moving to sort of like a glacial but accelerating pace in order to maintain this compatibility with this massive body of code that cannot be moved forward without a great deal of pain. Yeah, so on the sidecar of all of that, there's this that question of package security. We, historically, or not we, Python Packet Injects was one of the earliest ever made. Security was sort of like a non-thought, wasn't something that anybody was even thinking about. So these things, these three properties of authority and integrity and authenticity were just not concerns originally. You know, just a rehash for everybody here. You know, authority is users or identities can only publish packages if they control integrity. You know, you get the thing that you asked for. And authenticity is, it is what it says it is. So that's, it's not just unmodified, but it was actually created by the entity that had the right to create it. Yeah, none of these things was a priority and we'll see sort of how Python provided them originally. So this is actually the best one. Authority was something that was pretty much baked into, PyPI from the beginning, because you had these user accounts that could upload earlier, first metadata, but then actual distributions for packages.  Historically, the only way to off to PyPI was username and passwords, which led to a really common practice when CI became more common, if people were just dumping their passwords into GitHub and GitLab and et cetera, CIs. And then usually not getting leaked, but sometimes getting leaked. So that was pretty bad. In 2019, we developed two factor off on PyPI to discourage that. And I think since then, the uptake has been pretty good. So I would say here, the status quo, it was pretty good for PyPI. We're not, people are still using username and passwords, that's normal, but we're roughly on power better than most major packaging ecosystems. We're using modern two factor, it's TOTP and web often. Nothing crazy. Yeah, on the integrity side, like I said, PyPI was historically an HTTP index. You referenced files that were stored on HTTP or even HTTP hosts. That means of course, no transport integrity. TLS was not a thing. It was a thing, but it was not a common thing in 2001. These things were just sort of like trusted blindly over the network. At some point, I don't actually know when HTTPS was added to PyPI, providing transport integrity, but of course that requires you to trust the host. So full hosting of, well, it doesn't even require you to trust the host. You still have this transport integrity to PyPI, but then you go out to the HTTP host and you download it from there. So your individual hosts are still not providing it necessarily. Putting everything on PyPI fixed that. And then finally in 2016, we added hash checking mode to PIP. So you could actually pre-declare your hashes for your files ahead of time. PIP would fetch them, check the hashes and if they didn't mash, and if not all your files were hashed, it would fail. So that provides strong integrity. It's not great because now you have this terrible UX of hashes everywhere, but it's better than nothing. And then wheel distributions improve this also a little bit by adding profile hashes in this metadata record file. So here the status quo is, it's close to other package managers, but it's kind of hard to use. It's not really as easy to use as like package managers in like the Node.js or Rust ecosystems where this is all done by default for you in the packaging metadata file. You have to do it yourself, which is kind of annoying. I mean yeah, and here's an example of what that sort of hash looks like inside of the record file. You could see it's, you would never interact with this directly, but it's just there. Yeah. And then we get to authenticity, which is sort of the key thing in the sync store ecosystem. I think PyPI's historical approach to authenticity could be characterized as like maybe. You can do it if you want. So optionally for years, I don't even know when this began, PyPI has optionally supported PGP signatures on distributions. So when you uploaded a distribution, you could also upload a distribution name.asc for the signature file. PyPI would accept it, render it alongside, and then someone could optionally download them and verify it. Why do you trust that signature? That's not a rhetorical question. Why do you trust that signature? Anybody can sign for a package, anybody can upload it. PyPI's maintainers can just put their own signature there. You have to have some kind of web of trust or their trusted setup. Loading of trust doesn't really work anymore since the whole spamming thing in 2019. Yeah, so that really wasn't ideal. It turns out that pretty much nobody used it. So you can still upload PGP signatures to PyPI, but they're not in the UI anymore because they're functional useless. Stranger, this is like a weird vestige of Python history. I don't think anybody else knows about this. We also have optional support for Joe's style and PKCS7 style signatures. As far as I can tell, there's only one package ever that's been uploaded to PyPI that uses these. So people don't even know this exists. I found this out while doing research for these slides. Same problem with PGP, why would you use this? And also PIP, I think someone created an issue on the PIP issue tracker and they were like, how did you find this out? Close, we won't ever support this. So verification of these is purely optional, I'll put this back. You could use these at your own risk, I guess. So yeah, the status quo here is that authenticity in the Python packaging's ecosystem is the sigil at best and impractical at best. So yeah, that brings us to Sigstore. That's why we're all here, right? So what does Sigstore do for Python packaging? How does it improve all three of these properties? So I think the way that I think about it at least is the biggest thing that Sigstore does for Python packaging is it fundamentally solves all of the UX problems that happen with code signing, while simultaneously preserving the best properties of code signing. So the problem, like we said, with PGP and these PCS7 or Joe's signatures is key management. You have to hold on to this long-term, very sensitive key which if you lose or disclose by accident you have to rotate and then you have to have some kind of rotations, you know. It gets very complicated very fast. You know, you as a, packaging no longer have to do that with Sigstore. You as a verifier, as a consumer, no longer have to perform key ring maintenance. You no longer have to prune invalid or expired keys.  Sigstore will choose the right ciphers for you. Sigstore, sort of on the same topic, is in agile. You know, 30 years ago we thought cryptographic agility was a really good thing. Turns out we were really wrong about that. Inagility is sort of the name of the game. Now you really want the crypto system or the scheme to pick the best ciphers for you and Sigstore does that. Sigstore does not let you pick RSA 256. It does not let you pick CAST 5. It does not let you pick Blowfish, I don't know. And then finally, Sigstore signatures are rooted to a public identity. I think increasingly on the internet, we see people think in terms of identities instead of in terms of like a PGP signature. People think in terms of like their GitHub handle or the email metadata that's attached to the package. And so bringing the cryptographic promises closer to that model of what a package's owner is, I think has tangible UX benefits, it helps. It brings basically, it connects the theory of package integrity with factual practice and how people think about their packages. So that's good in my mind. And then sort of as a nice side effect, like I said, I mean, authority and integrity themselves aren't that bad right now in PyPI, but Sigstore will transitively strengthen these properties because once you get authenticity, you also get integrity transitively. You have strong integrity via cryptographic signatures. You get authority by having this, oh, sorry, this is a separate kind of authority that we're getting. So we're planning on making PyPI its own OpenID Connect identity provider. And so eventually you'll be able to have like a username separator. I think we settled on the explanation point as a separator for non-email identities. Can't remember. PyPI identifier, you'll be able to use that as a sign identity for Sigstore artifacts. I mean, like I said, integrity you get transitively through strong authenticity. Yeah, so that brings us to where we are currently. So currently, you've heard people reference, mention it throughout the other slides. We have this reference Python implementation, Sigstore Python, one of the cool things. I think this is actually, I forgot to update this, but as of yesterday, it's signed for the latest 3.11 release of CPython. So this is not related to Python packaging at all. It's completely its own thing, but I think it's really cool that they're using it to sign CPython itself. And then also we have this straightforward CLI that it really is that simple. You just pip install it and then sign and verify the two sub-commands. This does not yet solve the issue of that six point list. We need more UX work there. We need to think about how best to expose that. But for the time being, this is what we have and it is simple to get started with. We also have ambient credential support. This is something that we stole from Cosign. We have support for things like GitHub Actions, Google Cloud Build, et cetera. We will detect if you're in that environment and we will pull the OpenID Connect credential from that environment so that you don't even have to think about signing. It'll just do it automatically. I think that's pretty cool. And we actually use that in this GitHub Actions, Sigstore Python package. We automatically sign using GitHub's OpenID Connect and Sigstore Dogfoods is internally on our CI every day. And then finally, because via this package we can automatically publish signing artifacts to GitHub releases. And here are some screenshots showing that. So this is like the latest release. You see each distribution has a sig and a cert. Yeah, so that brings us to where we want to be. So right now, we can sign and verify things with Sigstore Python. We want those signing artifacts to actually be published to the index that Python package users use, which is of course PyPI. They have to be published alongside distributions. And then eventually, once they're on there, they need to be cross-checked via inclusion in a tougher repository per PEP 458. So to support this, PyPI has to undergo some changes. Right now, PyPI will reject any file that does not end with a few supported suffixes for distributions and for PGP signatures. So we needed to support.sig.cert or alternatively, once Sigstore bundles are fully standardized, whatever, I believe that Sigstore was a suffix that was chosen, that would become the supported suffix that we'll have PyPI accept. And then with any luck, PEP 694, which is the upload API 2.0, I think is what they're calling it, we'll enable this by having us attach all this to the metadata blob on the upload instead of having it be a separate file. So that'll simplify things nicely. Yeah, and then once it's on PyPI, it actually becomes really easy to deliver this to users. PEP can simply just download it with the distribution if it's available. However, this again will require a little bit more work because the simple index is frozen. So PEP 503 has to be superseded by PEP 691, which is a new index standard for the API. And once PEP begins to consume that new index, then we'll be able to deliver these files to users. Yeah, and that brings me to sort of the next thing, which is that server-side isn't enough. So it's one thing to have these siting artifacts on PyPI and at PyPI, I do a little bit of verification with them. We also want end users, people who are doing PIP install X or PIP install dash R requirements at TXT to be able to verify these materials themselves. They shouldn't be dependent on us to do it. So there's a couple of challenges there. One is that PIP is the universal Python package installer, which means that it runs everywhere, which in turn means that it can't have any sort of native dependencies, which six-door Python is full of because it uses OpenSSL and some Rust builds under the hood. So we have to think a little bit about how we're gonna do that. So that's on the roadmap to think about. But the key thing here is, and this goes back to what I was saying earlier about, staying out of engineers' ways, users should not have to be aware that anything has changed whatsoever about their process. This is a personal goal of mine is PIP install requests should not look any different unless something fails, unless an integrity or authenticity violation has occurred. If it does change, users will reject it based on the history of Python packaging and previous failures to use signing materials in Python packaging. And then finally, the bigger picture is that six-door needs to fit into the larger sign-in and high assurance constellation for all packaging ecosystems. We really want our efforts here to be a sort of litmus test for things like NPM, for cargo, sorry, for crates, for, you name it, Maven. We want them to be able to take from our mistakes from the things that we succeed on and do even better. So, what we need to get there. So it's, you know, there's sort of two big classes of things that I identify as things we need. One is sort of like general UX thought that needs to go more into six-door. It's one thing to verify signatures and it's entirely another thing to trust identities. People, many of you have spoken about this during your talks. Six-door is conceptually much, much better than blind verification, but its use needs to be practically better than that. It needs to be much more than just six-door verify than these materials. And you'd actually have some way of communicating to users concisely that they should trust this identity. They should trust this OIDC issuer. They should trust these particular OIDs that are on this cert, right? If you don't do that, they're going to fall back to either trusting everything, which is bad or doing nothing and going back to the status quo. There are some thoughts I have there about how we can make this better or how we can achieve this. Specifically, PIPI and the packages themselves have tons of metadata in them that we could use for cross-checking. And so this we could potentially use to avoid bugging users, basically, with verification information. We can just sort of glean it from the information they already give us and do things like, you know, the package maintainer email that's on PIPI. Can we cross-check that against the email identity in Six-door? The repository URL that's in the package metadata. Can we cross-check that against packages that are published using OIDC or via GitHub, via API token exchange? And then longer term, we want users to be able to configure machine readable verification policies so they can say, I trust these three maintainers, at least two of whom have to sign for the package, you know, that kind of complex policy needs to be consumable and committable somewhere public so that you can verify the policy does not change except for when you expect it to change. And our thought there is that it will fit in nicely with Tuff. And then the other big sort of fork there is threat modeling, you know, we all know Six-door is conceptually pretty complex. The core of it is simple, but as you begin to think about what verification means, what signing actually means, you quickly splinter out into different edge cases where, you know, you trust the email identity, but you don't trust the IDP. You trust the IDP, but maybe it goes down sometimes.  It's part of what we're building. But a user shouldn't have to know any of that. A user should just be able to say, I trust it because X, Y, and Z, these are the properties I want to get out of it. And if I violate one of those, I know what happens. They shouldn't have to understand these RFCs that build up, that Six-door built on top of it. They shouldn't have to understand X509, V3, or the actual CT scheme to understand what they're getting out of it. And of course, they also shouldn't have to understand PKI or these ephemeral keys that we use or for keyless signing or any of that sort of thing to benefit from Six-door. So thank you, that's all I have. And please ask me questions.


Welcome to another edition of HeyDT. HeyDT is a series of videos I do where I respond to viewer questions and comments. These viewer questions and comments they typically come from comments on the videos that I post on Odyssey and on YouTube. Sometimes these questions and comments come through social media such as Mastodon, Reddit, sometimes through email and the very first question I want to respond to is, HeyDT, you say you don't care if people use free software or proprietary software that everyone makes their own choices in this regard but you talk about the free software philosophy all the time on your videos. How does that make sense? And I can kind of see why this is confusing to some people because I talk about the benefits of free and open source software versus proprietary closed-source software all the time on my videos. And the reason is because that's a choice I've made and I want people to know that there are benefits. Like it's very clear benefits why you would use free software versus proprietary software. You know there's certain differences there's tangible differences between free software and proprietary software and I want people to know the differences in those two different areas and I want people to actually know that freedom of source software actually exists because many people have never heard about it right. It's a topic that most standard computer users you know people that are not nerds just your average desktop computer user for example has never heard the free software philosophy and I want to tell people about it right. I just want to provide some information. I want to shed some light on a topic that most people have have no knowledge of at all that way people can make better informed decisions.  I don't care about that at all. I'm just gonna keep using all the proprietary software that I like because honestly I just I don't care about the free software movement. Okay that's your decision. I respect that. I have no problems with that. I don't take it personally. I hope you don't take personally you know the software decisions that I make or any decision I make in life we all make our own decisions on what we do with our own lives. One of the things when you're making any decisions in life so many times there's actually a right decision and a wrong decision a good decision evil decision everything is kind of black and white for the most part so many decisions they either benefit you or they harm you in some way and you know when you're making these decisions if you're better informed on the topic at hand you're much more likely to make the better decision for you personally and when you really think about this idea of making decisions in in the light or in the dark right. I imagine you are totally ignorant to the whole idea of free software versus proprietary software and maybe you make the right decision in my eyes where you're you're using a lot of free software because just by accident you don't know anything about free versus proprietary software you all you know is software you don't know free versus proprietary but you just happen to be using free software you've never heard the message is that a good thing well in my mind no that's not a good thing you made I guess the right decision is as far as the one I would have made but you're not aware that that was the right decision you're totally ignorant you're totally blind to the fact that you even made a decision because really you didn't make a decision it was all happenstance it was all accident that you even arrived at the decision you did and conversely if you're making a wrong decision but you're in the light you're educated on the topic you you know about free software versus proprietary but maybe you make the wrong decision in my eyes where you're you know I just use proprietary software well at least you're educated on the topic right you made an informed decision and maybe you know enough that one day you'll actually realize hey you know what that decision that I made that might have been the wrong decision and you can correct it having more information is always better and that's all I'm trying to do with the message of freedom of source software versus proprietary software I just want people to be aware that that choice that freedom is out there and I want people to be able to make a decision for themselves based on that knowledge moving on to the next question hey DT do you have a video showing how to best set up a window manager so that it doesn't automatically shut off the monitors after 10 minutes I've been searching far and wide for an explanation that works but nothing seems to work on startup I mean I know how to do it manually okay well I mean that's what I was going to suggest if you know how to do it manually you use the X set command if you're using X or window manager which 99% of the window managers out there using X 11 right so you would for example to turn off DP MS which is the display power management system you would X set minus DP MS and that turns it off if you wanted to turn it on X set plus DP MS would turn it back on if you want to turn off your screensaver X set S off so screensaver off right if you want to set a specific amount of time for the inactivity to kick in you can do X set S and something like 3600 space 3600 those are seconds so in an hour then the inactivity would kick in and your screen would would go blank now in your message you mentioned you know how to do it manually so you probably know some of the commands that I just told you about so if you know the commands then if you're using a window manager a window manager is going to have a config file somewhere in that config file there's probably a section for auto starting programs just add those commands those commands to turn off DP MS and to turn off the screensaver add that to your window manager config and then you never have to enter those manually every time you log into that window manager those commands automatically run and you're set and the next question comes from the video I recently did on whip tail whip tail is kind of like dialogue you know dialogue boxes kind of like incurses a dialogue boxes that you can use with your bash scripting and this person writes hey DT why don't you use print off for ensuring the right amount of spaces that for loop you used is actually ridiculous and he's right so one of the things with my scripting videos my programming videos I never really spent a lot of time trying to write the best code the most optimized code especially on my videos sometimes I like to do things kind of hacky kind of janky and the way I was adding those spaces to the to the whip tail boxes I knew that it was ridiculous I knew there was better ways but I was doing it in a hurry but a lot of times these scripts I don't spend much time on I write them rather quickly I have a real-world problem I want to solve and I just write a script and the script works there's nothing wrong with it could the code be improved yes and I leave it like that because it sparks conversation in the comment section of the video and obviously that's good for the video that's good for the channel that conversation but it's also good for the general community and a lot of times what ends up happening is on these scripting videos these programming videos that I sometimes do is the comments section has so much fantastic information you know because people are posting all of these solutions for these problems they're doing these rewrites the refactoring the code for me in the comments section you know and it's it's really in a lot of ways the comment section on some of these scripting videos I do is better than the video that I made as far the information in the video I made is good information but you'll find 10 times the amount of information in the comment section from that conversation that gets sparked sometimes by me doing some of these you know less than ideal situations like that for loop that ridiculous for loop I was using in that case of the script I won't say that necessarily I troll you guys sometimes doing that stuff because it wasn't a troll job I mean I legitimately wrote the for loop thinking it would work but after I wrote it like I immediately after I wrote it I know this is kind of janky this is hacky but I was like should I rewrite this I was like no I'm gonna leave it in the video because I knew again that you guys would help me out and it was really good now as far as the whip till boxes as far as the script itself that I eventually implemented whip till into it doesn't use that ridiculous for loop but I've implemented a much better way of achieving those spaces but again for video purposes sometimes I like to spark that conversation by doing things that I know people are gonna you know correct me on moving on to the next question hey dt can you do this for alacrity and what he was specifically asking is can he add things like neo-fetch the power line effect is for silent like bash power line I think I was using in this video it's an older video that this comment came from the shell color scripts because in that older video I think I was using either the ST terminal or maybe you are xvt and of course this person that commented he's using the alacrity terminal which is what I'm using now I've been using alacrity for the last two years is was all this work in alacrity yeah so one of the things and I get these kinds of questions about a lot of terminal stuff that I do is there a difference between all of these terminals alacrity and ST and your xvt and whatever the GNOME terminal the XFCE terminal console with a K you know what's the difference yeah I see you you've got all these fancy effects you know the shell color scripts and the random whiz bang effects and power line effects and now I'm using the Starship prompt and they all work in every terminal for the most part everything you see in my terminal would work in whatever terminal emulator you use because all terminal emulators are essentially the same thing all they do is display text it is a text-based interface that's all they do they display text and they all do that now some of them do it a little better than others like if you're using weird characters weird Unicode characters weird glyphs you know drawing boxes and things like that certain mathematical symbols some terminal emulators are really bad at supporting some of those strange Unicode characters oddly enough you are xvt is terrible and displaying a lot of those weird Unicode glyphs X term also has some issues it's it's not as bad as you are xvt but it's pretty bad as T actually is really good at displaying Unicode and alacrity is amazing as far as there's very little I've come across that alacrity didn't display correctly as far as a text-based environment moving on hey dt can you review free DOS you know I have this is the first time I think anybody's ever asked me about free DOS because I don't think that many people have a use case for it and the reason I've never reviewed it probably will never review it I don't have a use case for free DOS I can't think of any reason why anyone would use free DOS the only legitimate use case for that operating system that I can think of would be if you want to run some legacy DOS games and by legacy I mean we're talking about 40 year old games right legacy DOS only games so that's really yeah I I don't know what what I would do with that operating so I don't know what you would do with that operating system like I really I kind of I get sometimes get these comments I sometimes wish you guys when you ask me hey would you try out this particular operating system or this piece of software and this text editor whatever sometimes if you ask me these questions I tell me what you want out of this I want why are you interested in free DOS I'd like to know what you think you could get out of it because that might help me understand what we're even talking about here and the next question comes from a recent video I did about getting poly bar working inside X-mone ad and in my poly bar config for X-mone ad poly bar doesn't work right with X-mone ad it's just there's a bug there's some issues with it the way it displays workspaces it displays workspaces all out of order jumbled up it on different monitors it'll have different orders for all the workspaces it's a mess and he writes hey DT do you have pen workspaces in the poly bar config set to false that may fix it I don't have that set to false in my config and the reason is setting it to false makes it a worse situation than what it actually is so if I set the poly bar config and to pin workspaces set to false what it does is now I it displays all the workspaces on all the monitors but each set of workspaces on all three of my monitors are out of order so I've got all nine workspaces on poly bar but on each monitor they're displayed in a different order that's confusing that's extremely confusing like I can't work with that especially people using my configs they're not gonna know like what each workspace is set to a number right super one super two super three but if they're all jumbled up out of order you don't know the number you'd have to hit the key to actually switch to that workspace that's an issue so I actually set pin workspaces to true and that's a little weird but at least you don't get confused as far as what workspace you're on and what order they're in because now what it does is the monitors the monitor that has focus shows all the workspaces in the correct order now the monitors that don't have focus they only show one workspace and that's the workspace that they're currently on and that's okay like it's not the way X-Mone Ed and X-Mobar it's not not the way I'm used to it but it works it's not again it's not ideal but it works but setting pin workspaces to false actually breaks things in a much more serious way and this is a known issue with X-Mone Ed with poly bar and the X-Mone Ed guys are actually trying to fix it I think they've actually already patched it in fact but the patch is for the next major version of X-Mone Ed which who knows when that will be released a few months from now maybe a year from now I know when the last major version of X-Mone Ed got released 0.17 it was released well over a year ago but it didn't appear in Arch Linux until just a few months back like we waited I think like nine or ten months after the official release of X-Mone Ed 0.17 before it actually hit the arch repos and that's probably what's going to happen with the you know 0.18 or whatever the next major version is it's probably going to be released and then for whatever reason Arch really lags behind especially on half school stuff it may be a year a year and a half before the patch version that actually makes X-Mone Ed work correctly with poly bar finally hits the repos moving on to the next question hey DT I and installed Arch Linux and on top of it I installed DTOS by default my machine now has Nuvo drivers but I need CUDA to mine crypto so I needed to install the Nvidia drivers but then as expected things didn't go well it's always a pain in the took us to install graphics card drivers can you make a video on how to remove Nuvo drivers and install the Nvidia drivers so I'm not going to make a video about it necessarily but I will tell you exactly what to do right now because on every machine I've ever had they had an Nvidia card on Arch Linux on any Arch Linux base distribution all you need to do is install the Nvidia package so if you're using the regular Linux kernel then install Nvidia the package Nvidia and reboot the machine and it should automatically default to using the proprietary Nvidia driver rather than the Nuvo driver that's all you need to do if you're using the LTS kernel so if you installed Linux dash LTS for the kernel you need to install a Nvidia dash LTS driver so the regular Nvidia driver doesn't work with the LTS kernel and vice versa so make sure if you're on the LTS kernel do Nvidia dash LTS for the driver there's also a Nvidia dash utils package that you probably want to install and you mentioned CUDA CUDA is a separate package I believe in the Arch repos I believe it's in the standard repos just as CUDA and really once you install the right driver just reboot the machine you didn't give me a lot of information you said you installed the Nvidia drivers but then things didn't go well but then you didn't tell me what didn't go well like did you reboot and get a black screen because that will happen if you didn't install the right Nvidia driver for example if you were using the LTS kernel but you didn't install the LTS Nvidia driver you'll reboot and get a black screen not a problem drop to a TTY install the right Nvidia driver Nvidia LTS in this case reboot everything should work the next question it's actually really a comment hey DT I'm just letting you know that I will never use a window manager because I'm very happy with GNOME this however will not deter me from watching your awesome videos cheers and that was a video I did about configuring open box and well thank you for watching the videos I appreciate the kind words saying they're awesome videos and I understand hey if GNOME is working for you and you love the GNOME desktop environment keep using it as I stated earlier in the video we all make our own choices as far as the software we use and if GNOME is working for you keep rocking it and the final question is one I've gotten a lot and I do need to address this in some detail so let's get into it hey DT what makes you stick with DTOS being a build script to be run on an existing arch installation as opposed to an actual full Linux distribution with a Calamari installer but one of the things when I initially made this post installation script for DTOS I had a couple of reasons why I didn't want to build a proper ISO and use the Calamari installer the first one is I didn't want DTOS to actually be recognized as a real Linux distribution I didn't want to be responsible for an actual Linux distribution because if I'm if it's a real Linux distribution then every single problem on that distribution if you install DTOS the distribution right any issue you have you're going to come to me with it I don't have time I don't have time with it right so that was originally the reason I can't be the lead dev or the lead maintainer of a Linux distribution I have got too much other stuff on my plate right I make videos about Linux that's my job that's what I enjoy and that's what you guys enjoy I'm assuming that's why you guys watch my content do you want me to shut down my youtube channel and just maintain a Linux distribution I don't think most of you would want that and I know I wouldn't want that so that was one of the two main reasons why I wrote DTOS the way I did is being a post installation script rather than just building a proper ISO the second reason I did it is I actually think and this has been something I've talked about in the past on camera but I really think we have too many Linux distributions out there many of them do the same thing many of them don't necessarily have to build their own high so's so many Linux distributions out there could do exactly what I'm doing with DTOS hey just run this post installation script that adds some repositories to your pacman.com and then you know run the a package install list right where it installs a bunch of packages from now the DTOS core repository that's on your system you reboot the machine voila you've got DTOS right most Linux distributions could do this most arch Linux based distributions could do exactly what I do with that DTOS script without needing to build an ISO and fool with the Calamari's installer and and to be honest I think it would make sense for people to do that I know kind of why they don't it would cause headaches honestly the way I do DTOS being a post installation script rather than its own ISO it actually causes me a lot more headaches doing it that way than it does if I would just build an ISO because now I'm responsible for DTOS how it runs when you install it on top of arch Linux for example or manjaro or arco or endeavor the hundred other arch Linux based distributions that are all doing their own unique things you know that's very hard to write a a post installation script like DTOS that will work on all 100 of those arch Linux based distributions very difficult where if I didn't do that if I just built my own ISO I wouldn't have to fool with any of that but I'm going to keep DTOS as a post installation script because I do think I do wish more distributions just did things this way because I could envision a world where instead of everybody just building their own isos you just add your own repo right you just add a repo and there you go you've got your new distro and I think that's a smarter way to go and I see I see other people coming around to that idea as well because at least scripts I see a lot of them especially on arch Linux there's so many arch Linux installation scripts out there that try to automate the process for installing arch especially you know before arch had its little easy installer now what is it the arch dash install ultimately is is there a right way or a wrong way to do this I mean doing the post installation script or just building an ISO there's pros and cons to each and that's for me there's pros and cons to each now for you the end user I really don't think there's really not a lot of pros and cons for you because you're going to end up with the same thing I mean yeah with DTOS you don't have a Calamari's installer right you don't download an ISO and just run through the Calamari's installer okay just download Manjaro right it's the same thing download Manjaro run through their Calamari's installer and when you're done you know get clone DTOS and then run the DTOS script and you know just let that run for about 10 minutes reboot you got DTOS so for the end user it really doesn't add any pain points to you for me the pros and cons kind of outweigh each other I mean I could do it either way I've chosen this way for now and it's working now before I go I need to think a few special people I need to think the producers of this episode I need to think Gabe James Maxim Matt Mehmet Mitchell Paul Royal West Armor Dragon Bash Potato Chuck Commander Angry George Lee Methos Nate Erion Paul P's Archimdoural Polytech Realities Realist Red Prophet Roland tools Devler and Willie these guys they're my highest tiered patrons over on Patreon without these guys this hey DT episode would not have been possible the show is also brought to you by each and every one of these fine ladies and gentlemen all these names you're seeing on the screen right now these are all my supporters over on Patreon because I don't have any corporate sponsors sponsored by you guys the community if you like my work want to see more videos about Linux and free and open source software subscribe to distro tube over on Patreon peace


Well, let's get started. You'll be talking about trademarks and open-source projects today. For those of you who don't know me in the room or are viewing online, I'm Daniel Scales. I'm Chief Brand Counsel for the Linux Foundation. I've been working for the Linux Foundation since the spring, but I've been working with the Linux Foundation for about 11 years on their trademarks. Before I joined the Linux Foundation earlier this year, I led the trademark practice at Chote Hall & Stewart in Boston, and before that I worked in-house at a company called Avid Technology, which makes the Pro Tools and Media Composer software products, which some of you may use. When I was at Avid, I worked on their trademarks. I also worked on technology licensing, open-source counseling, and technology standards. So I've been working in open-source and trademarks forever, and now I work for the Linux Foundation exclusively. So before we get started, I want to cover a couple of housekeeping items. First, I'm a trademark lawyer. I am not your trademark lawyer, so I just want to make sure that everybody is clear about that. Today's presentation is not legal advice. It's informational in nature. If you have questions about these things, I encourage you to seek out a qualified trademark lawyer and discuss it with them. And this presentation does not necessarily represent the views of the Linux Foundation or any of the projects that we host. Okay, so what are we going to cover today? We're going to cover some really important trademark basics. And I want to start there, because I've had a number of recent conversations where I think folks were missing the mark, pun intended. I think there's a lot of confusion or just lack of experience with trademarks where they confuse it with other things. And so I want to make sure we're all starting from the same foundation about what a trademark is and what it can do for a project. Once we cover the basics, then I want to talk more specifically about open-source projects and how they can benefit from showing their trademarks some love. And then we'll finish up with some specific details on the process and things to do that once we all agree that we love our trademarks for our projects. How do we actually go about protecting them? All right, so I said we were going to start with basics. What is a trademark? I don't think we can get more basic than that. So as a lawyer, when I know what's the definition of something, I go to the statue. A trademark protects any word, name, symbol, or device. Also throw in color, smell. It's really anything that is used to identify and distinguish a specific good or a service from the goods or services of others. It really can be anything. I threw color in there. I threw in smells. The United States tends to be a leader in this area. We call it alternative trademarks. But you think about the color brown for UPS. I think that's been recognized for quite some time as a trademark of the UPS company, that specific color. Other countries are getting there, but the U.S. I think is really receptive to acknowledging the reality of how consumers perceive things. And I think that's an important concept when we're talking about trademarks. Everything is through the lens of what is the relevant consumer seeing? How are they seeing this out in the marketplace? That's always where you need to start when you're talking about any trademark issue is what is the relevant consumer seeing. Another thing to note about what is a trademark? It's a valuable intellectual property right? Yes. It's also a consumer protection statute. It serves a really important consumer protection function. When you walk into a store, you grab a bottle of Coca-Cola off the shelf, you want to be able to trust that it has that Coca-Cola label on there, what the contents are, and that it came from the company in Atlanta, Georgia. And that's the trademark doing that work. It's a market efficiency protection, if you will. The long and short of it, what's a trademark in layman's speak? It's the brand. We're talking about brands here, source identifiers. And source, not in the sense of source code, which is obviously where I think a lot of people at an open source conference where their brain goes, where did the good come from? Who is providing the service? That type of source. One feature of trademarks, they never expire. Well, they don't have to expire. Let's put it that way. You'll notice I put an asterisk. There's a couple of requirements, but unlike other intellectual property rights, which have a defined expiration to them, trademarks can last forever if you nurture them and you love them. So they have to continue to be used as a trademark out in commerce. And if you have registered trademark rights, those registrations have certain requirements to maintain them. Typically, it's every 10 years, and it varies country to country, you have to pay a renewal fee, and you may have to provide additional evidence that you are, in fact, still using the mark as a trademark. Now you'll note there, I said it varies country to country. Like most IP rights, there are country-specific rights. So if you have a US trademark registration, doesn't necessarily mean you have any protection in Canada or Europe or Africa or anywhere. Every country has their own trademark laws. There is harmonization across those laws, not complete harmonization. But it is something that you need to take steps in each country, which you're interested in having protection, to obtain that protection. And then finally, alright, so how do I know something's a trademark? I mean, one, I think we're all consumers. So from the trademark perspective compared to other IP rights, that part's kind of easy. We've been conditioned since a very young age to kind of know what a brand is and what a trademark is. But you'll also see brand owners use trademark notice. So either the TM symbol or the R with a circle. And they are separate things, and I do want to spend a minute talking about this. The TM symbol doesn't really have a legal effect of any sort. It is the trademark owner saying, world, I believe that this term or this logo or this design is my trademark. And I'm going to tell you that because I'm putting a TM symbol next to it. So I think there's significant value there, but the actual legal effect of it is pretty minimal. Contrast that against the R with a circle, which is the registered trademark symbol. And that is specifically called out in the US Trademark Act, the Lanham Act, for use solely with registered trademarks. There are specific benefits for using the R with a circle in a litigation context, which is getting a bit far ahead from what we're talking about today. But I think it's important to note that if you're starting a project and naming it, don't use the R with a circle, unless you do actually have a registered trademark. I think another benefit of the trademark notice is that people just tend to like it. It's a little bit of a kind of a badge of honor, if you will. All right. So we talked a little bit about what trademarks are, but I think it's valuable to contrast them against the other three kinds of intellectual property rights because I see people in my conversations confusing them quite a bit and that can lead to challenges. So first, let's compare a trademark right to a patent right. So patent protects certain inventions for a limited term, roughly 20 years, which can be adjusted depending on a number of factors, which we're going to not get into. But a patent, it covers an invention, it covers certain types of ideas that meet the requirements for patent protection. And then the trade that is made is that the government says, we're going to give you this monopoly power for your invention for this limited term. But you have to tell us all about your invention and how it works and how we can do it. So when the patent expires, society benefits from it. That's the trade-off, the enablement requirement. When you see, so how do you know if something is covered by a patent? There, I think it's harder, you don't necessarily know that it's a new invention or that they've sought out and obtained patent protection. So the device or the product or the documentation will have a, it's a pretty simple patent notice, like the one here, US patent number 4656917, which happens to be the notice for Eddie Van Halen's patent that he obtained for a device for raising his guitar during a live performance, which I thought was kind of cool. All right. At an open source conference, let's talk about copyright. So again, copyright and trademark two different kinds of intellectual property rights. Copyright protects works of authorship or expression for a limited term. Generally, life of the author plus 70 years or 95 years from first publication. The copyright act is a little bit like the tax act in that it is way over complicated. So there's tons of variation on the duration of copyright. There's tons of special interest protection as a result of lobbying by various groups over the years. It's a really complicated act, but for our purposes, I just want to make sure we're distinguishing it from what trademarks are. So copyright protects the expression of ideas. Patents protect the ideas themselves if they meet the requirements for a patentable invention. Copyrights protect expression. So most of the act protects creative expression, works of art, sculptures, architecture, drawings, paintings, musical works, motion pictures. But even when it is protecting those things, it's only the particular expression that it is protecting, not the idea itself. So everybody here could be doing a portrait of me right now. Please don't do that.  And that's fine from a copyright perspective, right? But it's the way that you draw the glasses. It's the way that you choose to represent certain things in the portrait. That's the expression and that's protected by copyright. Now, bringing it back to why we're here, software is protected by copyright. So the source code itself. So you write a thousand lines of code just by writing it and fixing it in a medium, so saving it in a computer file. It's protected by copyright. You don't have to register that copyright in order to have protection. You may register copyright and get some pretty meaningful additional benefits, namely you can't sue anyone in federal court without a copyright registration. But you don't have to register it in order to obtain copyright protection under the act. So how do you know something is copyrighted? I mean, pretty much if it's a written work, if it's any type of work of art, you can safely assume that some part of it is protected by copyright. There are exceptions to it. But people will often use notice as well. So this presentation is copyright 2021, the Linux Foundation. One specific note there, you can use the C symbol or the word copyright. I think it's pretty well established in open source that we use the full word copyright. Because I think when people are scanning code looking for license provisions, they're looking for that full word copyright. So I think it's pretty common for projects to use the full word when they're adding their own copyright notice. All right, just a little bit of time on the last type of IP, compare trademark rights to trade secrets. Trade secrets are something that's valuable because it is a secret and is subject to reasonable efforts to keep it a secret. So how do you know if something is a trade secret? Well, by its nature, you probably don't know about it. If they're doing it right, you're not even going to know that it's there. That's trade secret protection. Or somebody may share their trade secret with you, but it's under the terms of a non-disclosure agreement that's very specific about the secret being shared. Or it's marked confidential, and you've agreed to keep it a secret. Or something is there, but it's blacked out, and they're not sharing that particular nugget with you. So that's trade secrets. All right, so those are the four types of intellectual property rights. I also want to compare trademarks to a couple other things, which again come from a lot of conversations that I have. So they're not, I don't want to say they're confused, but they're kind of blended together when people are talking about trademarks. And I always like to be precise when we're talking about things. So take domain name registrations, for example. Kind of makes sense that people often, when they're talking about one, they're really talking about the other. Because domain name registrations often include a trademark of a company. It makes sense. It's your brand that you're putting out there. You want brand.com. That makes a lot of sense. And there is a lot of overlap there, but it doesn't necessarily mean that the domain name is a trademark or vice versa.  Your trademark is your domain name. But otherwise, you know, there's overlap there, but they're not one and the same. And I think it's important to be clear about that. Similar concepts with social media account identifiers, you know, whatever your Twitter handle is, may have a trademark in it. But it doesn't necessarily mean that your Twitter handle is a trademark. It's something to keep in mind. I do want to spend a little bit of time on this last one, no trade names. Because again, I've had a lot of conversations about this recently. They can be the same. So my employer, the Linux Foundation, that's the name of the legal entity who employs me. It is also one of our most prominent trademarks, the Linux Foundation. So they can be the same. But they're serving different things. You register your trade name in the United States with a state secretary of state's office so that you can conduct business in that state. You can open a bank account. It's the legal name of the entity. Just because something is a legal name of an entity doesn't necessarily mean there are trademark issues there. There can be. But again, remember what I talked about at the beginning, everything comes back to what is the relevant consumer, whoever that may be, how are they seeing it? And so if they're never seeing the legal name of the entity and they have a different brand, then the legal name really doesn't, there isn't much of a trademark analysis to be done there. Now, it's the legal name of the company. It's kind of hard to be a public-facing organization without your legal name being out there in some capacity. So usually at some point there has to be a trademark discussion if it's similar to somebody else's trademark. But you're doing a trademark analysis there. It's not just the fact that it's the legal name of the company. Okay. So we all know we don't patent a trademark. Hopefully we've established that. That's a phrase that I've heard on more than one occasion. What is it, right? So I said it earlier. It's a source identifier. It's the thing that represents the goodwill of the organization. It's a symbol that people recognize and they have come to associate that with the offering of certain goods and services, a certain quality level, certain features, functions, attributes, who's involved, whatever the good and service is, who are the people behind it? Do I trust them? Do I like the work that they do? Things like that. It's a mechanism to communicate those things out in the marketplace. But I think more specifically in the open source world, it's the central rallying point for open source software projects. So we'll take a minute here. So we have a project. They come together. They write a lot of code. It does something. We put it out there under an open source license. Anybody can take the code. They now have the right to use, modify, distribute, probably that code. The thing that brings things back together and serves as that rallying point for the community to come together, to serve as a beacon, to attract people, say, we're doing this thing. You should come try our code. That's the trademark doing that work, right? It's not, yes, the code is obviously crucially important. But once you have licensed the code, you can go and do what you want. It's really the bringing together that I think the good will that's symbolized by the trademark, that's this rallying point that I'm talking about. So open source licenses typically are pretty clear on this, right? So you can go to our project if they licensed their code under Apache. The Apache license says write in the license. This license does not grant permission to use the trademark service marks or product names of the license or. So it grants you a license to use the code, modify it, distribute it, copy it. But you can't use the project name. That's outside the scope of the license. And the Apache license is very clear about that. Now, the Apache license I think is interesting because it has a specific carve out at the name which kind of recognizes a fair use of another party's trademark. Which is, well, I need to, if I take the code and make some modifications, okay, I can put it out there, but I want to be able to tell people that it's XYZ projects code and I've made some modifications to it. And the Apache license says, okay, that's all right. You can make that descriptive fair use of that if you need to refer back so people can understand what it is that they're getting. And that's a different situation than somebody branding it as using the XYZ project name for their own distribution. We're going to talk about that a bit later. Some other licenses, quickly, the Eclipse license, similar effect, they take a slightly different approach. They don't specifically talk about trademarks in the Eclipse license, but the license grants, there's two of them. One is a copyright grant and one is a patent grant. Both of them, they're back to back in section two of the Eclipse license. And there's a concept in IP licensing that if a right is not expressly granted, it's reserved to the owner, it's not an applied license. So here they expressly grant a copyright license, they expressly grant a patent license, but there's no mention of trademarks. And then CC by four, another very popular license these days, especially for documentation and data, is very clear that the rights that it's granting under copyright to whatever it is, does not include any trademark rights. So trademarks, it makes it efficient for people to find your project and then to get involved or to use the code, contribute back to it. But I think a key component of that is that assumes that they're looking for you in the first place. And I think that's the goodwill of the trademark that's out there. That's the work that an open source project's trademark is doing for it. It's the gathering point, the rallying point, an efficient communication of, oh, it's Kubernetes. I know what that means. That's the goodwill associated with the trademark. And so goodwill is valuable and you want to protect that. And trademark rights are the rights that help you protect yourself and carve out your own territory in the software landscape. So how does it do that? So if you do have a trademark registration, it's public notice that you have these trademark rights. You're using this mark in connection with certain types of goods and services. The world is on notice. Trademark offices worldwide maintain databases of this information. You can go on the USPTO database right now and run all sorts of searches to find this information. And furthermore, trademark offices will reject future trademark applications for something that might be confusingly similar to your trademark. So it's helping kind of keep a perimeter around the goodwill represented by your trademark by preventing others from registering similar, confusingly similar trademarks. And let me actually pause there because it's a phrase that I use all the time, but it's a crucially important point. The standard for trademark infringement is not that somebody is using an identical mark to sell identical goods and services. That would clearly be trademark infringement. But the standard is lower than that. It's confusingly similar. So, and again, from the perspective of a relevant consumer, if I see a mark out in the marketplace and it's reasonable for me to think that it's associated in some way or a next generation product from an existing trademark, then that's confusingly similar. So it's a lot of times I'll hear people say like, oh, well, it's a different mark. We added an S to the end. It's like, that's probably not enough to differentiate it from an existing trademark, right? So trademark rights can stop others from passing off their work as the projects or as endorsed by or affiliated with the project. They alluded to this earlier. This is really two separate concepts, but somewhat related. In one sense, it can just be a bad actor. So they've taken the code. Whether they've changed it or not, they're offering it out by themselves under the exact same trademark, counterfeit goods in a kind of a traditional consumer product scenario. It can help protect against that. But it also can help protect against downstream users of your project's code who are built a service on top of the project's code or have added things and are offering something slightly different. And then they may want to market themselves. And from the relevant consumer's perspective, it's not clear that is this the project? Are they affiliated with the project? Has the project endorsed them? Like what's going on here? And that's inefficient for the marketplace. And trademarks help you prevent that type of activity. Another thing that trademarks can do for an open source project, protect against confusingly similar account names. And I'm thinking specifically about social media and GitHub, right? So if one of the things we're hoping to accomplish with our trademark is that people will recognize it and they want to come look for us, well, I don't want them going on to GitHub, looking for my project. And there's 43 other repositories with the same name because then people can't find us. Now the good news is, oh, I'm going to get to that later about the GitHub policy. Because the first thing we have to talk about before we get to the social media and GitHub policies is that registrations, you can't have common law protection for trademarks in the United States, but it is valuable to have a trademark registration. That said, it's kind of an odd time for trademarks. A massive, massive increase in the number of filings in the United States and really everywhere. The USPTO published a study earlier this summer that their applications are up 63% over last year. And so this is just continuing on a trend of more applications each year. But the explosive growth is kind of overwhelming them right now, to be honest. It used to be that a new trademark application would be reviewed within two months. Now we're looking at six, seven, eight months, which is having a real impact on brand owners. And that's a link to the study there, if you want to have a look at it. Why else is it an odd time? I mean, it really started early days of the internet and search engines where let's say you ran a restaurant in Idaho, it's a very successful restaurant, and you marketed your services locally and then the internet started. And it's like, okay, well, people want to find me on the internet. I'm going to have a web page or maybe not, but all of a sudden there's a restaurant with the same name in Croatia. And it's coming up as the top two hits when people are searching. And it starts to get confusing for people. So that was 15, 20 years ago. The last five years, now we have the same type of thing, but just happening all the time on these online platforms. So I put up the example of hashtag delta. So delta faucets wants to do some marketing on Twitter. They're going to put out a bunch of pictures of their new line of faucets and they tag it with hashtag delta. Great. So then I want to find information on what the current restrictions are on delta flights.  That's not what I was looking for. And then in the last couple of months, I'm trying to find that same information and instead I'm getting research reports on the delta variant of COVID. And so you see how things are just colliding with each other at rapid speed now on these online platforms. And so it is a challenge. It's a problem. I wouldn't necessarily say that any of that is trademark infringement, but it's a challenge of getting information out there. So, you know, trademark registrations have always been valuable. You know, we were talking about earlier, you get to use the R with the circle, which a lot of brand owners really like. Like I said, you know, it's that badge of honor. It's a trademark registration.   And that can be very expensive to even get to the point of what the other person is doing. And that added cost can be cost prohibitive to people from enforcing their trademark rights. There's a lot of other rights that trademark registrations get you. There's a link up there to an international trademark association fact sheet, which has a lot of information. But I don't want to get bogged down on that. What I do want to talk about is the last five years or so, you know, my thinking as a trademark lawyer has really changed in that when I first started practicing, I would tell my clients, some clients, yeah, you know, you don't have much money right now, you know, spending money on a trademark registration, you really don't have to. You're only in the US. You can rely on common law rights. It's a great feature of US trademark law. You know, don't bother.  And, you know, the reason is, you know, these last two points and they go hand in hand is there are really useful enforcement mechanisms outside of courts, right, filing somebody, filing a claim in federal court for trademark infringement. It's pretty much a six-figure proposition and perhaps more. And, you know, most open source projects are simply not going to go there because of the cost associated with that. But there's other tools that are available that are low cost, but you need a trademark registration to avail yourself. And for that reason alone, and also looking at the volume of filings and worried about how crowded the trademark register is getting, you know, these days I really think I would err on the side of trying to get a registration versus not trying to get a registration. So this is what I was referring to earlier when I stopped myself. So, you know, Twitter, you have people bumping into each other all the time. Google AdWords, you know, competitors are using each other's trademarks to generate, you know, for search engine optimization, GitHub, all of a sudden you've got 40 repositories with your project's trademark in it. All of these private companies have trademark infringement policies that are really useful. But you need a trademark registration. Now, for Twitter, you actually do need a trademark registration. You can't even submit your objection to them without a registration number. The other policies you can, but my experience has been if you don't have a registration, it's really got to be a clear cut slam dunk case of trademark infringement for them to take action on it. Because it's a private company, they're not going to decide for themselves whether you have trademark enforceable trademark rights or not. They're going to say, look, you know, I'm sorry, this is unfortunate, but you're really going to need to go to a court to sort this out. So getting a trademark registration allows you to use these things, which even if you're using a lawyer to file complaints under these policies, it's not much work at all to get those complaints filed. And they're generally really responsive. We've had a lot of success with them. Okay. So you're starting a project or you have started a project. You know what a trademark is now. And you know that registration is important. You just need a trademark. You need a name, you know, something to call it and so that people can find you. So just a couple of things to consider on that front. First, you want to make sure that it can actually function as a trademark. In trademark land, we have this thing that we call the spectrum of protectability or spectrum of distinctiveness. And on one end, you have generic terms. So Apple, the word Apple for apples, right? It's what it is. It's the noun for the thing. Those can never function as trademarks. Everybody has to have the ability to use that word to describe the thing because that's what it is. A step up from that are descriptive terms. So let's say, you know, red brand apples, probably not going to work. Because most, you know, apples are usually either red or green. And so it describes the product or the service or it describes a feature of the product or service. And consumers' brains immediately would make that connection. Courts are going to say, no, that term that you're using, that's not an enforceable trademark. It's descriptive. And others have to be able to say that their apples are red, too, because they are. But then you do have descriptive marks that can hop over a little dotted line here, and they acquire distinctiveness. So these are descriptive marks. But through just sheer effort, using it for a long time, doing a lot of advertising, people have come to associate the term with a unique source of that glitter service. So it now has secondary meaning. So yes, the words themselves are descriptive, but now it functions as a trademark. So a good example of this is American Airlines. I mean, at this day and age, like nobody thinks twice about it, but take a step back, American Airlines. It is completely descriptive of what they do. It's a U.S.-based company providing airline services. But they've been around for a really long time, and they have done millions and millions and millions of dollars of advertising. So when I say American Airlines to everybody in this room, you know it's a specific company that I'm talking about. That's a trademark. It's a source identifier. So that mark has acquired distinctiveness over time. Then we get into a category of trademarks that are inherently distinctive. They're protectable from day one. And on the lower end of that are suggestive terms. One that I saw on a list recently of suggestive terms that I never really thought about, but then when I saw it, it became obvious, Netflix. Netflix. Movies that back in the day, you would order online and they'd know you're the DVD, but now it's the streaming service. But you got to connect a few dots there. It's not directly descriptive of the services that they're offering, but you kind of see what they're talking about. So that's a suggestive trademark. I think suggestive marks are a great place to be, particularly for an open source project, because it communicates a little bit about what the project is actually doing and the type of software that it's producing, but it's not in that descriptive, unprotectable area. So that's a good place to kind of aim for if you're an open source project. From there, we get into arbitrary and fanciful marks. So arbitrary is a word or a term that really has nothing to do with the offerings of the company that's using it as a trademark. The classic example is Apple for Apple computers. You can kind of tell a story about how Apple's Isaac Newton intelligence or whatnot, but it's a long story to kind of make the connection, and so it's viewed as pretty much an arbitrary connection.  Kodak is a classic example of a fanciful trademark. Now arbitrary and fanciful are, it's great because especially fanciful, like when nobody else has the right to use your fanciful mark is you just came up with it. So it's very protectable. The downside is nobody's going to have any idea what it is unless you do other marketing to help build awareness around what that fanciful term is. And that can be okay. It's a balance. So that's other things to consider when you're choosing a trademark. And I think open source, I think all brand owners can struggle with this, but open source projects in particular because they usually don't have huge budgets for advertising or other things to help communicate what their project is doing. So they try to jam all of their marketing effort into the name of the project. And you usually end up with a pretty descriptive name when you try to do that. So I would just encourage folks to try to avoid that. And that's why I was saying like suggestive marks are a good place to look because you communicate a little something about what the project is doing. But you know, people have to make a connection.  So, you know, people are happy when they see your trademark, things like that. All right, so you've picked a hopefully inherently distinctive mark that you're happy with and you're ready to go. Challenges, there's a lot of other really creative and smart people out in the world who may have picked a confusingly similar mark and are using it already.   So, you know, you or your trademark lawyer is going to look in the USPTO database to see if there's any confusingly similar marks. Open source projects tend to be international in their activities. So you want to look internationally, right, because searching in the PTO database isn't going to tell you if there's a registered trademarking candidate, that's going to be a problem for you. WIPO, the World International World Intellectual Property Organization, has a new product that is actually quite nice, their global brand database. It's a good user interface. It covers international registrations, which they manage. But it also picks up searches in another like 40 jurisdictions, which is a really nice quick place to look to see if other people have trademark registrations. But then you also want to do the practical research, right? Just do a Google search, right? So if the first thing comes up that is, you know, a software product in the same space, like that's something you need to know about and you're going to be kicking yourself if you could have found that in a two-second Google search. You also be surprised sometimes at the search results that you get for a term that you're considering as a trademark that may have nothing to do with software, but you want to perhaps sit back and ask your question, oh, when people are trying to find me, this is going to be the second result in their search and is that really where we want to go? So kind of a practical consideration. And then are the desired account names available? So if you're launching an open source project, you're going to need, you know, you're going to have to get yourself a GitHub account. You're probably going on Twitter handle, Instagram, Facebook, whatever you're going to use, see if your desired name is available on those platforms and go ahead and register them. You don't have to wait for trademark registration to register those accounts. And then if it turns out you don't want them, then you can just, you know, cancel those registrations to free them up for somebody else. Okay. So we know what a trademark is. We decided registration is important. We picked an inherently distinctive mark. Nobody else is using it. We're going to file an application. So you talk to your trademark lawyer, and I would suggest having your trademark lawyer file. You can do it yourself or use a self-help service. But I got to say, when I was in private practice, I made a lot of money fixing those mistakes where people try to do it themselves or had a self-help service. So your trademark lawyer says, great, filling out the application on the USPTO database right now. Who's the owner? Who's the owner? Right? It's the project, probably, is the owner of the trademark. But what does that mean? Right? Is it the core group of maintainers? Is there two of them? Is there seven of them? Are there 23 of them? Is it one individual? Is it a company, a legal entity that they've set up to host the project and handle legal affairs for the project? Is it a foundation that provides these services for open source projects? It can be any of the above, but it should just be, we asked Bob to do the trademark work. He's going to put his name as the owner. A lot, when we're talking about open source, the upsides of open source is the velocity at which open source can do things. You create code, get it out there, make bug fixes. This is a moment to press pause and the core group at the beginning of the project should have a conversation. Who's going to own this trademark? If it's going to be the core group of maintainers, do you want to set up an entity, perhaps, to be the legal owner of the trademarks? At the beginning, is it going to really matter that much? Not really, but then the project grows and it gets successful. And then when you're one, two, three years down the line, this issue becomes really important and sorting it out then rather than at the beginning up front can be a big problem. It can be a big problem in lots of situations where it's definitely a big problem is where there's misalignment, where the identified owner of the trademark registration and reality of who's controlling the use of the mark, who's, if you're granting licenses to use your trademark, who's granting it. If those things don't align with one another, then you're risking the validity of the trademark rights overall because what's a trademark? It's a source identifier. So if it's identifying in reality one source but the legal owner is a different one and there's no real connection there, you may lose, everybody may lose the trademark rights because it's not identifying a single source. So that's my pitch on having that. It can be an awkward discussion but have it, have it up front. Thank you. Questions? Yes. Yeah, I mean that's a, so the question about confusingly similar marks in a specific instance of, you know, we have get and we have get hub. I mean, I will say there's a lot of history there and it's like I probably don't know enough about the details to kind of offer a perspective. But again, when you're evaluating whether something is confusing to the relevant consumer, I think you can have situations where those relevant consumers have kind of just learned, right? That get is technology and get hub is the company. Whether that was intended or not, it's kind of where we are and that can be okay. So I'd say every situation is kind of different but, you know, again, everything is from the perspective of the relevant consumer and here, the relevant consumer, you know, software developers who are pretty smart about this stuff. So that's another factor to that. Yes. Here, if you're kind of your own set-round governance in general, there's parents that you're still about. You know, the trademark has to be part of a bigger governance structure or it is maybe some sort of governance. What's your palpation about? Yeah, so I mean, I think I do think trademarks are kind of fundamentally, sorry, back into the question for those who didn't hear was about how trademarks fit into the overall governance conversation and it's been a lot of that in recent years. I do think that trademarks are fundamentally a part of that and a big reason why I say that is, you know, what I was saying before is that if they're not part of that initial discussion, it really does jeopardize the validity of the project mark down the road. And so I think you can go in lots of different directions but pick one and make sure that everyone is on board with who's going to own the trademark. How are we going to allow our downstream users to use it? How is that decision going to be made? I think that's a governance question. I think those are important parts of early governance questions. Yes. Get back. Yeah, so the question was about specifications and how do you go about protecting those?  I do think trademark is a tool that you should be using.  You know, I was talking with some of the other night and I don't know if it's a perfect analogy, but you know, think about like Montessori schools, right? Well, Montessori, it's a methodology of philosophy of teaching, right? But Montessori is a trademark. And so, again, if a school identifies itself as a Montessori trademark as the relevant consumer, you know, a parent of a kid, that should mean certain things to me. And the same thing, if somebody is saying that they meet the specification or, you know, they're, you know, you know, however your specification works, like that should mean something specific. And so what, you know, combination of having a specific trademark for it, licensing that out, if people meet the requirements, those various, you're right, it is a little specific and quite complex. But I think you're heading down the right path the way you're thinking about it.  I think trademarks might be, you know, and perhaps a trademark licensing program might be the next step for your project to consider. Yeah. And I think last question. What is the typical cost for, I mean, I know it's going to vary a lot. Yeah. What is the typical cost? Stay in the US. Yeah. No, that's a great question. And actually expand by the US because I think it's an important point. It's funny when I tell people numbers, I get one of two reactions. One is it's either, oh, that's really expensive. Or if they've done a lot of patent prosecution, they're like, oh, that's nothing. So, you know, the official fees, it's, again, everything with the US government, it depends. Let's call it $275 or $325 per class of goods and services. So if it's just software, that's one class.  But once the application is in, then the USPTO is going to look at it. And they may go back and say, no, you have to fix these things. And so there's additional work once it's filed that you want to budget in as well. But let's say, you know, one that sales through soup to nuts, $3, $4,000 should get you there with a good trademark lawyer. But that's for a US application. And we talked about how trademark rights are jurisdiction specific. So let's say you have a name, a logo, a tagline, and you file in the US. But then you have, you know, contributors in eight other countries. And you want to register in, you know, those countries as well, because you think you're fairly active there. So then you take those numbers times three marks times eight countries, it can get pretty expensive pretty quickly. And so a good trademark lawyer would be able to help you kind of parse like, all right, this is the budget I have, like what's the best use of that money? But yeah, you know, compared to patents, it's, you know, divided by, you know, in half or a factor of 10. It's a lot cheaper than patent filing. But it's still real money. All right. Well, thank you. Thank you, everyone. Hope you enjoyed the session and enjoy the rest of Open Source Summit.


What come to nursing school explain in this video on the Allen test which checks the patency of the arteries that feed the hand at the wrist and the Allen test is usually used for drawing arterial blood gases because we want to make sure that the artery where we're actually going to draw that blood from is Patent and doesn't have any kind of problems because if we cause additional problems that might Eventually cause some problems with the blood flow to the patient's hand So the Allen test will help us determine if the artery is patent and most Commonly we will use the radio artery for that test, but we can also use the opposite the ulnar artery So let's take a look at that So for the Allen test, we are going to compress both the patient's radial and Ulnar arteries which then will basically Cause a little bit of ischemia or lack of blood flow in the hand Which you will see by the changing of the color of the hand and then I let go of the radio or the ulnar side first And see how fast the color returns back to the patient's hands and that lets me know that their artery is patent and Ready to go for a arterial blood gas test Typically we use the radio artery. So that's what we are going to demonstrate here today So first I find the radio artery and then I find the ulnar artery and I use Good pressure to constrict them both and pay attention to the patient's hand It's going to turn a little bit pale because by the compressing the arteries limiting the blood flow that allows The blood to flow into the patient's hand So now that the hand turns kind of pale and I keep my pressure on the ulnar artery But let go of the radial artery and watch what happens to the hand in terms of color So my hind is still on the ulnar artery So right now most of the blood supply is coming from the radial artery meaning that the artery is patent There is no obstruction no problems with that and I would be okay to use that for an arterial stick or an arterial line Thanks for watching nursing school explained Please also check out the other videos about my skill different skills in my skills playlist. Thanks for watching