This video is going to talk about how to translate applications into algebra and then be able to simplify the expression you make. Our first example, find the perimeter of the Lincoln Memorial Reflecting Pool in Washington, D.C. The reflecting pool is approximately 2,029 feet long and 167 feet wide. Well, one of the first things we need to know here is what are we trying to find? What is perimeter? That's the formula 2L plus 2W. L in our case is how long it is, and that's 2,029. W in our case is how wide it is, so that's 167. Now we just really have to plug and check. We want to find the perimeter, and it's 2 times the length, 2,029. Plus 2 times the width, 167. And I'm going to use my calculator over here. So 2, exactly like I see it, parentheses 2,029. Close my parentheses, plus, and then again a parentheses, oops, my fault. So we can just arrow back over here this way and say 2. And then parentheses, 167, close the parentheses, and enter. And that says that that is equal to 4,392, and this would be, perimeter would be feet. It was in feet up here, so that means that's what our perimeter is going to be. Second example, in a rectangle, the width is four less than twice the length. If L represents a length, write an expression that represents the width of the rectangle. So we want to know width is equal to what? And they tell us here that the width is, so that usually means equal, and then they're going to tell us what it is. It's four less than twice the length. And if you remember from translating, when you see that then we have to switch them. So the four is going to be on this side, and twice the length is going to be this side. So twice the length is actually going to be first. So that's 2 times the length, and it says up here that L represents length, so that's 2L. Less than means minus, and then four less than that would be minus 4. 2L minus 4 is what width is equal to. They didn't give us anything else, so we're done with that one. They didn't give us numbers to plug in. We just needed the expression. All right, at Los Angeles Valley College, in-state resident tuition and fees for academic year 2010 and 11, were calculated for this expression, 26C plus 42, where C is the number of units taken per semester. So it says if Ian took 15 units in spring 2011, what was his tuition and fees? That's what this is. So we have 26, actually this 15, we have to decide what it means. So C is the number of units taken, and they just told us that Ian took 15 units. So C is going to be equal to 15. So when we rewrite this problem, we have 26 times 15, the number of units, plus 42. And again, I'm just going to go right over here to my calculator. 26, parentheses, one, five, close the parentheses. Exactly like I see it. I don't really have to have those parentheses, but it doesn't hurt. And that's equal to 432. And what was his tuition and fees? That means it's in dollars, so this would be 432 dollars. All right, now we've got an interesting looking thing. Expression P times quantity one plus R to the T represents the amount of money in account when P dollars is invested at an annual interest rate of R, and the notice says in decimal form for T years. So find the amount of money that will be in the account at two years if 3200 dollars is invested at 4% annual interest rate. So we've got a P in our equation, and we've got an R in our equation, our expression, and we've got a T. So what do we know? 3200 is invested, so that's our P. P is the amount of money. And our rate is going to be 4%, so it says 4%, but it told us that it had to be in decimal form. So remember you move the decimal two places, one, two, and it becomes 0.04. And then the T is time, and that would be two years. So plugging in what we know then, 3200 times, and then we have 1 plus 0.04, that's a plus 0.04, to the T2. And I, again, I'm just going to come right over here to my calculator and let it do all the work. 3200, parentheses, 1 plus 0.04, close the parentheses, and then remember, exponents is carat, and then 2, and press Enter. And we see that that's 3, 4, 6, 1.12. And what did we find? Find the amount of money. So it is an amount of money after two years. Two years. One final problem. The height of a baseball hit upward with an initial velocity of 95 feet per second from an initial height of 4.5 feet is represented by this.  Where T is the number of seconds after the ball has been hit. So what is the height of the ball after 4 seconds? Well, look at our variable, it's T. And we want to know after 4 seconds, so we're going to let that be 4. So negative 16 times 4, and then that's squared, plus 95 again times 4, and then plus 4.5. And again, just go right to your calculator. Most people would anyway. It's not really cheating if we had to pay for it. So care at 2 plus 95 times 4, I'm just going to do multiplication and parentheses, plus 4.5 and enter. And we find out that it is 128.5. Okay, again, what did we find? What is the height? That's what they're asking us for. And height is in feet per second. The velocity was feet per second. And the initial height was 4.5 feet. So we can easily say that it is 128.5 feet after 4 seconds, or at 4 seconds actually would be a better word. At 4 seconds, it's 128.5 feet in the air.


Session I have a quick show of hands before we start We are all of us came to this hacker event Whom of you decided to install some software updates before you decide to come here So I see quite some event So now keep your hand raised if you could do this for all the stuff you you brought here Still still some hands same same thing at home No, no, so do any of you own devices which are not able you are not able to update I have some in my pocket even so so we have a bit of a problem Which which really? Fits the next speaker well Let me update you on on on Reo, who's our next speaker? Reo is a privacy advocate. He works as a policy analyst He works for bits of freedom the leading Dutch digital civil rights society as a policy advisor He's also the co-founder of freedom Inc. Where he fights for your fundamental rights But tonight he will talk about talk to you about patching our approach to software updates So please give a warm hand to Reo's anger Well, thanks for having me I'm Reo Zenger and I work for bits of freedom a digital civil rights organization in the Netherlands as you've just been told It feels special to be here as bits of freedom has been resurrected from a winter sleep Eight years ago at an earlier incarnation of this event Eight busy years by the way, you may have heard from us in our fights against the introduction of a Power to heck for the Dutch police NSA-styled dragnet surveillance provision for the intelligence services and making sure that our government opposes the weakening of encryption None of which I will be discussing During this talk by the way And if you've been following bits of freedom for some time You have noticed that we have a brand new website and a new logo and of course that comes with the obligatory new t-shirts That's a hint anyways In this talk I will list a number of updates We need to apply to our updates or more accurately update the process of deploying security updates Traditionally we are focused primarily at delivering a product and not Not the aftercare If we think about updates, we think about rolling out new features and not about fixing the vulnerabilities in existing features And that usually comes as an as an afterthought And whenever we look at the process of deploying security updates, we mostly do that rather narrow-minded We have a look at the part of the process where we can directly influence rather than looking at the Total at the entirety of the process And we tend to fix the issues for ourselves, but we'll get to look at the other stakeholders relevant to the process But works for me is I think just not good enough It's not good enough if we want to have a reliable process where we can deploy security updates If you have fixed your part in the process, but further down the chain There are still some issues the process of updating is far from optimized You may provide security updates quickly, but if the user doesn't trust those updates your updates will not be installed And your product remains a vulnerable So here we have 12 updates fixing some of the common issues surrounding the process of deploying security updates But first I'll start with a few words on the need of a reliable process where security updates are made available and deployed Swiftly upon becoming aware of some of some vulnerability I'll keep that brief as all of you in this room are fully aware of all the risks that come with Fundabilities in fact much of what is happening right now has been foretold by many of you After the short introduction, I'll discuss the 12 top most important updates to the process of patching vulnerabilities Of course, it's easy to describe the vulnerabilities, but it's much harder to actually fix them So in the last part of this talk, I will highlight the roles and responsibilities. We have we all have in this process And to be honest, I would be surprised or maybe even disappointed If I would tell you something completely new But only rarely I hear someone piecing all of this together and as already mentioned That is urgently needed because the process of deploying security updates is as strong as its weakest link Many of today's technologies are said to be disruptive and in most cases what is meant Is that these new technologies can turn a market quickly and completely upside down? But digital attacks of this year have shown that technology can easily disrupt our entire society For example, the one a crime malware forced hospitals to close down even though the malware was aimed at holding data ransom for money Anyone who has doubts about the potential impact of such disruption only has to look at not petia attack When the disruption had been only a little bit longer than our supermarkets would have been unable to stock at least for some of the products and such disruption doesn't have to be directly aimed at society It can be a political weapon as well or a weapon of let's say a drugs cartel abusing the chaos of the container terminals in the port of Rotterdam We have been come utterly dependent on our digital infrastructure Oddly enough we behave differently While swiftly resolving vulnerabilities in this digital infrastructure, it is tremendously Sorry, while swiftly Resolving vulnerabilities in this digital infrastructure is tremendously important The deployment of security updates seems to be something of the lowest priority As an example one of the vulnerabilities that was abused by both one a cry and not petia Was a vulnerability that was kept secret by the NSA apparently for years But even when the patch was available many sites wouldn't or couldn't install that update right away We should do better and here are some ideas In the Netherlands the government has a long history of failed IT projects and a legislation that is passed often Doesn't meet the needs for a secure digital infrastructure However, there are exceptions and the National Cyber Security Center is one of them They are acting like a computer emergency response team to governmental institutions on a national level. They do really good work Anyway, the NCSC organizes a yearly conference. It's named the one conference This year they had 11 year old Ruben Paul on stage The boy was playing around with his teddy bear and hacked the poor thing via its bluetooth connection Of course this talk has seen a lot of headlines in all the large media because everyone admires an 11 year old hacking his teddy bear But there was much less attention for the fact that a random toy can be hacked without years of training And this tells that this is that this is telling for the way we deal with security of the things connected to the internet All it takes is an inquisitive mind Another thing that seems to have been missed by all of the media the fact that someone has found the vulnerability doesn't Suddenly and by magic make it secure The manufacturer still needs to be able to push an update to the teddy bear That is possible, but only if the manufacturer visits all of the homes of the kids with this plush toy There's no way of installing a patched version of the software running inside the bear using some other means than physical interaction And that obviously is not realistic. The device may be smart, but the manufacturer is definitely not So there should be a process in the first place to update The only solution that remains is to throw out and replace the device when a vulnerability is discovered And that's not a very sustainable solution A more sustainable solution would be that it becomes not done to sell Products that are connected but cannot properly update it as a consumer. You should not you should expect nothing less And of course, it is it may be cheaper for a manufacturer to not to provide updates and Not to provide a mechanism for updating, but that should become a liability Of course, it's easy to blame companies running older and sometimes even end-of-life versions of windows For not having upgraded to a more recent version of the operating system The same holds true for my friend's dad who still is using a computer with windows xp And despite all the warnings and interrupting his workflow many times. He still hasn't upgraded He rejected the idea when even when there was a new version of windows made available for free Nor could today's user friendliness of ubuntu change his mind For my friend's dad an upgrade is much more than just upgrade to a newer version of the software It's also adapting to a new look new icons new functionality and getting rid of old habits So how do you encourage someone like my friends dad to take such a big step? How many warnings? Is he allowed to just ignore? And what about industrial environments for a large factory with many dependencies things may not be that simple Upgrading the operating system on one component of the robot may entail a costly replacement of all the robots Maybe there should be something as a rule that a computer running an outdated operating system may no longer be connected to a network Let alone the internet or maybe the computer should no longer be able to boot after its operating system has expired Um, I don't know how we should solve it, but this needs to be needs to be different, of course It's it's I think also a difficult dilemma for the software manufacturer Um at a certain point software should be allowed to become end of life And you really cannot expect the manufacturer to provide software updates for eternity So no security updates, uh without considering the upgrades as well Just looking at the process of updating does not resolve all the issues surrounding security Uh vulnerabilities If we truly want to make a difference there, we also need to look at the process of upgrading How to make sure that the company's robots or the computer of my friends dad is running a recent version of some operating system If the barrier for upgrading is too high Um, there is no point in making so there's no reason that making a point about lacking deployment of security updates I think is futile And here's another obvious point one of the reasons the hospitals in the united kingdom were affected by the WannaCry ransomware Was that people are exceedingly cautious cautious about making changes to a software of systems where we have a high level of dependency And that's of course understandable Um, if the software isn't thought out well enough, uh, there's such an update could make the system crash And you don't want to have that happen in a hospital a police station or at the air traffic control Therefore such institutions test updates thoroughly before installing them And that requires a thorough investment in capacity and time Probably it's much more efficient to collect a number of updates and do the testing in a single run But it also adds to the time it takes before a security update is actually deployed So security updates shouldn't break a thing that has to change it It uh, security updates should be install should be installable quickly, especially if the potential consequences of a vulnerability are large That means the manufacturers should minimize the risk that the patch breaks something For example by making the patch as small as possible and the patch should therefore only do that patch the vulnerability It also means that manufacturers should inform users well about the nature of an update The potential consequences of applying the patch and possibly even assist where the software is used in devices upon which lives depend In a professional environment, that means a manufacturer may need to take a more active role than he is used to up until today It also means that the users should be explained in a meaningful way that a particular what a particular update actually contains This one from Spotify is an example of how it should not be done Basically, it repeats We are always making changes and improvements to Spotify and repeats it as a mantra every change is just that Meaningless change logs should be something of the past One of the more prominent victims of the not patch attack has been the logistics giant maersk You know them of the containers in the port of Rotterdam At least two of its container terminals in Rotterdam were seriously hit The cargo could not be unloaded ships had to be diverted and trucks could not pick up or deliver containers The damage is estimated to be in the hundreds of millions of euros and nearly a month later maersk was still struggling with the fallout Internal documents of the company reveal that the company has been warned many times about its lacking security over the course of several years Apparently, there was no network segmentation. No firewalls. No monitoring and no virus scanners in place The response of the management in 2016 We will not fix these vulnerabilities as updating and reorganizing means downtime Lazy and stupid, of course I'd say it's better to have a short and scheduled interruption than an unexpected and longer disruption at maersk, of course, is not an isolated example So sometimes process related problems are the cause of a slow installation of updates Some companies are required to have the entire infrastructure to be re-certified before they may take it into production again If such organization has to go through the entire certification process every time they install a new update It is no surprise that the company chooses to collect all those updates in a single run The result longer periods of vulnerabilities What also happens an organization depends on an external company for administration of their computer systems And if they don't have time right away The organization has to wait for them as well So an update should update of this process should not Be just talking about the updates, but also about the process around it. It should update all of the related procedures So it it means that the process of applying those patches should also be structured differently Something else. How much did your mobile phone cost? The answer that most of us will give probably is a few hundred euros Sometimes even up to a thousand For most of us the data on a mobile phone is fairly is a fairly complete reflection of one's lives It includes your holiday pictures your most intimate chats your internet banking and a continuous record of your whereabouts Therefore, I'd say it's not unreasonable to expect that the manufacturer of your phone Um to support it for to to expect the manufacturer of your phone to support it for at least a couple of years Maybe four, maybe six especially if you include secondhand use And if a vulnerability with impact on security of your data comes to light during the time It's reasonable to expect to receive an update to resolve that vulnerability The reality is different Some mobile phones were already unsupported on the data phone was sold as new And it's not just me who is worried about this. The Dutch consumer organization Consumentabond has started a court case against Samsung It has asked the court to order Samsung To provide all of its smartphones in the Netherlands for a period of four years after their placement on the market Or and or two years after the time of the sale by Samsung or through a retail channel with updates that repair these Foundabilities in the software In my opinion those two years are still very short, but it's better that it's definitely better than the current situation So security is something that is an ongoing Concern or there should be an ongoing concern I strongly believe that the manufacturers should provide security updates for as long as the reasonable lifetime of a product That can't be too much to ask, right? And this is the easy part the support for just a couple of years But once we have connected everything to the internet, we are talking about a lifespan for Of a decade for some of the devices that are available All the cars and fridges should also receive those updates It will be fairly dumb if a car could no longer be driven safely just because the manufacturer does not want to provide the necessary support In a case of a mechanical malfunction your local garage your local garage may be able to help out or you can hack your car yourself But because the source code of the software the car is running on is a company secret that is becoming increasingly difficult And from the viewpoint of environmental sustainability It is also a complete disaster to have to replace a car after 10 years just because security updates will no longer be provided And here's another complication that remains unanswered for now What to do if the manufacturer has meanwhile gone bankrupt? I don't know actually I know one thing for sure if I myself need to check regularly for security updates. I'm vulnerable most of the time This becomes less of an issue if my connected devices look for a new updates on their own and then notify me if there's a new one If there's a new update available However, of course often this notification is shown at moments. I don't have the time to deal with it So the apps on my phone, however They are almost always up to date. It happens automatically and I hardly notice it Once every few days I check what has changed and I'm convinced that for the vast majority of users and devices this works perfectly Especially if the security updates are just that security updates So I think that normally automatic installation of security updates that should be the default um And of course when someone suggests to introduce or to enable automatic updates There's always someone saying that you don't want to out that you don't want automated changes to a running system And indeed there is of course a risk of a crash when a running system is updated behind the scenes My response is twofold Firstly the solution should not should then not be to disable those updates But to improve those updates the manufacturer should be able to say We have so much confidence that our product still works after an update that we do not even have to ask you Um, if it gives you any shit then, um, they will come to resolve it Secondly there may be exceptions in specific cases Some people in this room may have to deal with a threat model that requires you to take a different approach Therefore automatic updates should be the default but at the same time you the user should be able to opt out And yes, there are still some unresolved issues. What if the security updates requires a reboot or interrupts the user's process? We need to find some clever solutions around that But as a general rule automatic installation of security updates are good. I think So what is it what most users will do if their browser interrupts their workflow with a pop-up Window that urges the user to install an update to prevent losing files And would that decision be any different if the user sees the message right after hearing about a worldwide attack with ransomware? There's a good chance. I guess there's a good chance that the user will click the install button But there's an equally good chance that the user is not installing a security update But malware the user just wanted to prevent from being installed The point is in many cases the checks on that then this the open update are not done well enough And then you get the question. Is the offered update actually coming from the manufacturer or is it from someone else? So we need to ensure that the deployment of security That the security update is installed and not just the malware Systems should be designed in such a way that the user only installs the security updates from a trusted source And I think that for a large part this can be done Um, this can be enforced technically by signing and verifying the update encrypting the payload and the use of certificate pinning and other other means like that Of course, this means that the manufacturer needs to make an even bigger effort in protecting its own infrastructure This has been perfectly illustrated by the not petia attack Both the initial attack pushing the backdoor as well as the push of the malware were done by using the host's regular update Check And obviously There shall be no exceptions for our governments to abuse the security update process seems quite trivial trivial If you want to place a backdoor in say whatsapp Suppose law enforcement Wants to read the whatsapp messages of a specific user They are unable to read the chats in transit due to the end-to-end encryption So suppose law enforcement doesn't have access to that device Then law enforcement might enforce As we might force whatsapp to push an update to a specific user that disables the encryption of all messages to and from that specific that one user Or they can covertly add an additional Key to encrypt all the messages to that will make the chat comprehensible even when intercepted in transit And of course the first time that will be very very effective and maybe the police can use this to prevent a couple of murders But what this also prevents is that into What it also prevents internet users installing security updates Users will no longer automatically install security updates if they can't trust those updates They need to be sure that governments are not abusing the security update process for their own gain So we need to make sure that the trust of users in security updates is maximized Our governments must make courageous statements Speaking against abusing the process of security updates for offensive measures That will be hard but not impossible I think Take for example the Dutch government that last year published a statement in which it said that it finds the weakening of encryption undesirable That should be the same for using security updates for offensive attacks And while talking about governments, here's another one security updates and zero days That doesn't work together Manufacturers must be made aware of every vulnerability found especially if such a vulnerability potentially has an impact on the digital security Of the general public and with this audience This doesn't need any more explanation But governments should not keep vulnerabilities as a secret governments should not participate in the market for unknown vulnerabilities And they should renounce the purchase of devices that exploit those zero days Here's something else Apple's announcement of the new version of their mobile operating system Garned quite some attention because of its facelift of the so-called lock screen and notification center A new design new settings That's nice for those who want to have these new things But anyone who is happy with the current functionality may decide not to install the update Although the choice is understandable it is not without undesirable consequences Because if you do not install this update, you are sooner or later also deprived of any security update that builds upon this unwanted update So I think security updates They should be separated from the feature updates So manufacturers should distinguish between security updates and other updates Users should be able to install security updates that resolve vulnerabilities without being forced to accept changes in functionality That's something that is done by Ubuntu quite well There you can choose to have your computer only install security updates while ignoring all non essentials Or to put it more strongly Every hurdle that hinders the installation of an update of a security update should be removed where possible That means that the availability of a security update may not should not depend on the contractual agreements between the manufacturer and the user Or that the user may be forced to pay for an update that resolves the vulnerability And the same holds true for other changes in for example a smartphone An update that comes with changes in a setting or permissions Or change in permissions that an app requires will also prevent the quick adaption of that security update So these are 12 changes. I think the 12 fixes for issues with the current process of deploying security updates And it's of course very easy to identify them but deploying that is a lot more difficult So how to deploy these updates? A good thing is none of these changes require a complete overhaul of the architecture or the principles on which we work It does however require a change of attitude and habit And because of the interests of the stakeholders aren't aligned. This will be a big challenge. Nevertheless It seems obvious to look at the manufacturers for of heart and software for help After all, they are the ones that develop and maintain most of these systems that we want to update when necessary However investing in the update process is not something the show shareholders will cheer on It costs money and yields very little especially in the short term So I'm afraid that manufacturers are not going to deliver the solution Of course companies benefit From users that have a great trust and digital infrastructure they use But the benefits are of increased trust are not directly visible or easy to monetize It has to come from the entire industry So you can be of course the only company that produces a secure connected teddy bear Which then comes with a higher retail price and will make which will make it more difficult to sell But if the rest of the industry is not following you trust will not grow And as we all know it is not realistic to think that an entire industry will suddenly start to show corporate social responsibility No, we shouldn't expect much from manufacturers and that means that the government has a role to play here The government the common interests are simply too large to just let the bad outcome happen We should force manufacturers with laws and regulations, unfortunately And even though I have a preference for small scale rules This is something that needs to be done on an international level The Netherlands for example depends far too much on foreign manufacturers for our systems Moreover, even if you would have a very secure product in the Netherlands If the rest of the world attacks us we're still doomed So ideally we therefore regulated this at a global level and that may be a little bit too far fetched and taking too long So this has to be put on the Brussels again agenda soon Compared to safety belts and cars mandatory because the society because of the societal Damage and deaths that we would suffer otherwise And the good thing is the safety belts also allowed us to drive even faster with great without great risk Such rules should enforce a few things Manufacturers should be forced to use secure protocols standards and default settings Security researchers who discover a vulnerability in a responsible manner should be able to report it without fear of repercussions And companies should be forced to Should be forced to provide security updates quickly and adequately The new rules should also ensure that companies are liable for the social damage They call societal damage. They cause if they are sloppy about the security of their products And of course not only rules, but also strict enforcement And if the rules are violated But the government should also consider its own policies It cannot be the case that the government participates in the market for zero days Or that it hijacks the process for installing security updates to create a backdoor And last but not least we need to convince the internet user to ask hard questions It helps if the users are aware of the risks So if they are aware of the risks They need to think about the risks of what happens to their most intimate photos created on a device that has many Vulnerabilities and no security updates available And i'm afraid that we will need to have some more of these disruptions before users truly understand the potential risks But even then awareness amongst users will not solve all Of these issues You cannot expect the average joe to to correctly consider all security aspects of a device Which is not a reason why it's time for the government to step in So the takeaway we need users Of any kind to trust security updates to get there We need to look at the entire process not just at some isolated components In this talk, i've mentioned quite a few of those components And i'm very happy to hear if i missed one or two But i'm convinced we need to update the process to the entire process of deploying security updates It will be a challenge that we cannot do without And that's where i want to leave it Question everything, please. Thank you So please if you have a question line up on the front or the back You suggest that the government should Should regulate This behavior that you are in favor of But let's say that in europe this would happen We all know how many devices come from china and they will not be subjected to anything because people buy them and get delivered Get them delivered without any interference of any government any i think Yes, how do you look on that? So i'm not sure whether Regulation will solve all of the issues. I I I guess there still will always be Insecure devices of course, but i do think that That we can regulate For the especially for the more impactful for the more important Devices we can regulate this You can have We also have for other systems. You also have some Regulation that requires to Have devices meet Some standards if the device even if it's made in china doesn't meet those standards It is not allowed on the european or the dutch market And i think we can do something similar with this as well It will not solve every issue because of course you still can buy and connect Insecure devices From abroad, but i do think that for especially for the more important Devices we can regulate this Please go ahead ireo first of all Thanks so much for the work bits of freedom has been doing in the netherlands and for Proponing digital rights in the netherlands. That's awesome. Thank you Um, i'm a bit surprised that you're proponing regulation here so much Because regulation is slow and if we look at the practices of regulation recently by the dutch government And european government. I cannot say i'm a big fan. No Then next to that A regulation is always a little bit too late So aren't we going to regulate and say that uh, what are the best practices today? They might end up in regulation in five years at with at which time those regulations are going to be outdated So we're going to say that you're going to use all standards that are then already practically insecure So shouldn't we actually be using standards bodies for that or How would you approach that problem? So that's a good question and i'm not in favor of even more rules just like you so Yeah, i do understand the question I do think so i think that in Um The regulation is some kind of a last straw. We are holding on to because Um, i'm not i don't believe that this will be fixed by Those companies Producing those devices themselves And the reason for that is something which i already mentioned is that i think that they It costs them too much to make it really secure Um, so they don't have an incentive to make it secure and that will um, that will not change unless there's some external force Forcing them to do that And of course there are There are many ways so regulation would be one standard bodies would would be another one Um, i'm not sure whether if it if it if there will be standards then Companies will still apply those standards. So I think that There needs to be some external force in order to have those companies make secure products It's not something which I like but I I don't see this happen otherwise because companies will not do that themselves. I'm afraid I I fully agree. Can I ask a follow-up question? Or am I the first first? Sorry, just interrupt you again And that's one more thing you also mentioned the the role of our governments in the netherlands and in in europe Um, I also think it's very very important to look at their role themselves because they Also play an important role in how we Secure our digital infrastructure. So for example, the dutch government recently said the government wants to Have the dutch police to be able to hack into a computer via the internet. Of course thank you, of Of course, they need to have a vulnerability for that So you could say the dutch government has an incentive to keep those vulnerabilities secret so My my plea will be for additional regulation But my plea will be also to have governments doing the good things and not introducing Legislation that would that is an incentive to keep those fundamental vulnerabilities secret To have him ask another question. Sure. So in the back Uh, you you had a follow-up question, right? Uh, yeah, so, uh, uh, the question is At what if we start regulating this for instance in the netherlands We've seen proposal regulation on security of iot coming out last week in the u.s. Ron Wyden Came up with this idea that iot devices should be updateable Should not have hard-coded Passwords in the firmware which all sounded very reasonable. So If we have different regulations in different countries, then we end up with a regulatory mass in which we end up in further Breaking up of fragmenting the internet. That's that's a serious problem So if you would like to think about regulating at what level Would you propose and do it and would you say? That the un has a role in that or would you then rather put it to the standards bodies because we've seen that in the general assembly security council or even worse in the itu The favor is more towards the china russia block than towards people more in favor of So I think it will be for companies it will be very convenient if There were the same rules just about everywhere But unfortunately, I'm afraid that if we want to do this globally it will take too long to build those rules That there's a process that will take Tens of years that's way too long so That's why I was saying that I believe that this should be done on a lower level So probably like in on a european level for a starter and maybe the europeans can Have a conversation with the u.s. And we can seem to align those regulations, but I think it's way too important to To have to have those companies produce secure devices Then to have then to make sure that everywhere in the world we have the same rules because that would take too long So that's my preference would be as on a higher level, but not too high that it takes too long Yeah, the gentleman in front Hi So you talked about liability of The people who create the software What are your thoughts on the on the liability of the people who write open source or my preferred term free software which often comes with sort of the The text that you can't assume that it does anything basically Use it at your own peril. Would that be okay? Is there an exemption? What are your thoughts? Well, at least there's one very huge Difference between the closed and open source software. So with the open source software, of course, I don't have to explain it I think Someone is able to look at the code. Someone is able to hack the code to change it And to make it make its own adjustments. So I would say that the liability Obligations would be should be higher on the closed source software And lower on the open source software. I'm not sure So I'm I'm not sure whether Liability should be totally gone with open source software because I think that Even with open source software, you may have some responsibility But I do think because it's open source, it's of course, it's different. Sure Any other questions from the room? Don't be shy And if not, let's give a warm round of applause Yeah, just wanted to add so if people are shy, we'll be talking on a much smaller scale In the 10th next to this one It's called the exploded teepee and it's just right next door. So please be welcome to join the radio there And let's give him a warm hand for his talk. Thank you


Repositories. So here, this is a sandbox repository I created for for tasting our checks plugin. And so the next, I think we should take a look at the class architecture. So it's here. And so first, we have to subscribe the event from GitHub. So here, this subscriber is provided the green one is is provided by the GitHub plugin. And we just to extend this subscriber this class. And then we can, you know, kind of subscribe the event from GitHub. And so, so the next thing we have to do besides subscribe the event from GitHub, we have to listen to the Jenkins jobs. So here, we have this job listener, extend the crew listener and also the wrong listeners. So we can do different jobs, different take different actions like create a check wrong when when the wrong listener triggers the on start, and we can, you know, like complete the check wrong. And when the job job is incomplete. So and the extension point that provided now is this check wrong result. And this kind is an is an abstract class. So I defined some method like the get name, get output and get annotations. So if other plugins implemented this class, I can use this method to get the the informations from from from those customers. So I think I'll start my demo. So that would be clear. Okay, so this is a subscriber. And here we have the applicable method. So it decide whether this, whether this subscriber is is applicable for the current project. And the events we have to provide the GitHub events, you want to subscribe here, we subscribe the installation repository event, and the check wrong and checks, which is here is installation repository event. And you see the payload here is added. It's because I instilled I instilled the app on my on my repository just now, you can see the the the repository is sandbox. And this this this ID is the installation ID, we have to use this to authenticate design, and then repository in order to, you know, in order to use the API is to access API. So here I'm going to deliver this pale. So here. So here we can receive this event, the install in installation repository event. And the app we update update the installation is basically we map the installation ID to we map the repository name to the installation, installation ID, because later when we are handling the Jenkins jobs, we only know the repository name of the of the job, we don't know the installation ID. So we have to so I built I made a map here. So if so, so I show you the check run I made yesterday. And here is is it is it. And so can you see it? Can you see it? So the the name is default Jenkins run. This is because I have, I've provided default check run and the name, the name is default Jenkins run. So you can see here shows the default Jenkins run. But I haven't provided other things like output, or any annotations. So there's nothing here. So if we trigger the build again, some problems with my docker. Oh, I don't know what's the problem with, with my Jenkins instance here now. But I think we can still keep going up here. Because he has trigger the breakpoint. So here is initialize. So when initializing the job, we just, you know, create a new check run. And here we can, you know, like retrieve the source user SCM API. And here we retrieve the head of the of the current revision. So if the head is a progress, we can get the repository for a name. And you can see the full name is just accurate is a repository in my account. And the headshot. Okay, this takes a little longer. Oh, yes, because, yeah, yes, because I didn't open my local network. I can't do it now because my school network doesn't allow me to do that. So if I open that, I will be drop off the meeting. So I just show you, I just keep. So the headshot is, you will give you the headshot of the current revision, which is now, and now the this, this progress. And it should be one AC eight. And if we keep going there is installation ID, we can retrieve the installation ID from, from the, from the map we created earlier. So next we get the token, it's this token allow us to access a GitHub API. And then we use that. And here is how we retrieve from informations from the consumers. We, you know, just iterating all the consumers here, that by invoking the all method, and we create a check around here. So, so we check around. Okay. So here this method, currently, currently, I just use a patch client to create a check around. And here I, this is a, here is a payload. This are some headers. And in the headers, we have to bear the token. Here is a, is a body. So the name is a source, get name. And it's just like the default default check around source I provided here. You know, like return the default. Chicks. So here's a headshot. And we set its status into Q. And here we send this way, send this post to GitHub. And you will create a new check around on GitHub. And so the next thing, next thing, when the job has started, almost the same, except here, we just because, because back, back there, we have added all the created check arounds and to the attached to all the sources to our, our Jenkins run. So here I add actions. So later when the on started is triggered, almost everything is almost the same, except here, we just instead of creating new check arounds, we just, you know, get actions from the run. And then we update this check arounds we created earlier. So here, here also. Also, I just, I just simply set the status to in progress. And here is the states started at and this, and this time for this, for this job. Also, I send this, send this payload to GitHub, it will update the check arounds. So the next thing is incomplete. Also, like the on start, also like on start here, is just will be complete. So, you know, when we, so here we almost the same, like the updating the check around, we here complete the check around. And also some payloads, just a conclusion is success. And the status is completed, completed at. So here we send this payload to GitHub, it will eventually become like this. Oh, the same city created started 32 minutes, seconds ago. So this is this check rise were created just now. So, okay. So that's basically it. Yeah, that's the how the prototype currently works. Okay, thank you. It's really nice. Thanks. It's really good. So currently, the biggest, the biggest problem you can see here is that, you know, instead of we provide this statically, we have to retrieve the names, the status, and also when completing the job, we have to get the conclusion from the consumers. And we have to receive all these things. And we have to retrieve the, the, the, the informations from consumers about this, the output, you know, like title, summaries, tags and patience for, for lines of a code. And the above things we can provide because the name, when the users, when the consumers are defined their extension, they extend the extension point that to, you know, implement the return name. And so name is, is in our control. So the headshot also. And all the, all the, the things we may don't need to retrieve them from the consumers, just the, the below parts, this, this annotations object, the start line, the end line. So, annotation novel messages. So that's it. Okay.  I don't think it's a group. I don't think it's a great idea for us to just store the installation ideas in a map and relying on a web hook event. Yes. Yes, that's, that's not very clear because maybe you, if you use that map, you have to, you know, persist that map informations because the next time when you restart the Jenkins instance, you won't expect to have to send you the repository installation event again. Yeah. So this just looks it up. Yes. Basically. Okay. So this is used to generate an installation token. Line 106 is where it looks up the tokens. It looks up the installation. Looks up. So it curious. Yeah. So I don't so using this. I have this method doesn't mean that we don't need to, you know, store those installation ideas and I can just directly use this, use this method to create a token and to allow me to authenticate as an installation. Basically. Yeah. Not all the way. Basically. So this is a credential. So you call the get password method on the credential and internally the get password call will return this. And it will also handle caching for you as well. So if you scroll down to line 137. So what 137 is just down the bottom of your screen at the moment. Yeah. So basically calling the get password will handle it for you when you retrieve the credential. Still I'm not. So this, this, this method is just works as like the, like this line of code here. So basically it works like this. Okay. Yeah. Exactly. Okay. So we still have had to, you know, have some way to know the installation ID. No, you just need the app ID and the, and the organization. Oh, you made, so you made a query to look up the installation ID. Yeah. Okay. That's cool. So I think this answers these questions about, I think you have asked a question like this right here. This is one of my questions was exactly this thing. Because if you do it in a map dynamically and think it's just down, you don't see any. Yes. So it's better to query for it. Yeah. Yes. You saw the problem. Yeah. The map is a problem I want to discuss today. So yeah. So I think if you just change it to use the GitHub branch source API for this, then you shouldn't have this problem at all. It should just be handled for you. And we can always adjust the plugin to make to, if we do need to expose more of this API we can. If you need an API for getting the token. But for now, this is just handling getting you that the, this, the bearer token that you need to pass the API. That's cool. That's cool. So I think. So do you have still other questions about my prototype? Or we can keep going over our agenda. Yeah. One thing I was wondering. So currently, from the perspective of the warnings plugin, I'm just interested at the end of the build. So if the build finished, I think it's okay for my plugin to report the results somewhere. Yes. Actually, I don't really care about the progress during a build. Yes. So, so basically you are on the warnings next generation plugin has, you know, get its reports during the, during the publishing stage, I guess, right? So, so it's, it's definitely before, before the uncompleted, you know, before the uncompleted event triggered. So, so basically what the consumers like the warnings next plugin, next generation plugin has to do is, because I have earlier attached the, attached the actions to the run, right? And the run and the action bears a check run source. So, so what you need to do is to update the, the, the, the fails in the source. So here this is the source, the source I provided here, the extends, they implement an extension point. So here, this is, you know, we need, we need more discussing here because we have so many parameters that we want to retrieve from the consumers. Maybe we should not, you know, implement this in the class. Maybe we should use some, you know, like X mail or, or some other things, but currently I use this as a class. No. So if you, if you implement, get external ID and get started at and get started. And this method of the world invoked when the, when the job is incomplete and I can retrieve the, so I can retrieve the, the, the information, the parameters from the consumers. So does it answer the question? Yeah. I think we need to talk about this a little bit in more detail about this is not nothing we need to do today. Okay. So the big question is that we have so many, we have so many parameters. So I'm not sure whether represents name as objects as classes is, is the right way to do. So class is fine. I wouldn't, I wouldn't add everything yet. It's just at the important ones. And then, and then people can come asking for what they want or. So the next thing is pipelines work. I'm not very familiar with the pipeline. So I find some resources from the Jenkins developer guide. And I think so from what I've known now, the pipeline, we just need to, you know, like, I implemented some builders and the pipeline will like magically, you know, compatible for plugins. Is that I think in this pipeline. I think I have a, I have a post about making the plugin pipeline campaign. I think you have a link in the get a channel. Make sure pipeline. It could be in the how to how to guides down the bottom.  Here is what this is all about the pipelines I know from this post. So, so what I'm thinking is that maybe we should, you know, like, like, those parts, these parts, we may, maybe we can, you know, implement them as builders or publishers. Then this may be a mix and make this pipeline compatible. Are you thinking about adding a step which allows people to report custom checks? Yes. Yes. The goal is like you are lacking your. I think your post about the current users only can, you know, like, update the information in status form like they can, they can create, create the runs about the code, like they can use the reports from the warnings next generation plugins or coverage plugins and they can report them to the GitHub. That's because maybe they can, maybe they can, you know, they can't access this information in the pipeline script. That's that's one of my questions. So, does this necessary to you to make our, you know, make our plugin pipeline compatible and or maybe make same configurable by the users? That's also my problem. Actually, I think so that we need to make this happen in the beginnings. So I think the first thing is to have an API for plugins. And if there is still some time, we can think about it to create a generic step that can report some texts or some notifications. But I think the main focus should be on support for plugins. Okay. And I think this could be added later on to have some generic thing. Yeah, I think this is in the night and the nice to have stuff like it'd be great to do. So we'll put off this things. So another thing is also the general API. Yeah, I got some code stuff from 3ds proposal. And he defined some general API, some code steps. I'm also thinking about the general API. So here is the idea from the. So actually, I think this, this, this method actually, you know, like describe what our plugins have done, like publish a report to GitHub, like subscriber trigger events, like possible report from the customers. But I'm not sure whether we can this, you know, this general API really works. Yeah, I'm not too first in the Jenkins extension points and creating the APIs for other plugins to use. So when I first think about the general API is that when I saw because now we know for GitHub we use a GitHub branch source API. So maybe we, maybe we, maybe we can use the GitHub branch source API for the GitHub and Bitbuck, Bitbuckate source branch source for Bitbuckate. So this is the first thought when I saw the general API. And I don't know whether that's feasible. We could possibly, we could possibly publish our API separately to the implementation as well. Because the GitHub checks plugin is probably, it's going to have to depend on GitHub branch source and a long list of other plugins probably. We possibly might want to have our API plugins separate. Okay. So now I understand the question. Yeah. Actually, I'm not sure. I have also implemented a plugin with, which is requiring Git and I created an API plugin to make it yeah, extensible. For instance, use subversion. But I think this is something we can look at it afterwards. So first, just create an implementation that works. And then we can see if we can extend it in an API. Yeah. Just publish it to the experimental update center. Well, first because I mean it works and then we can publish it to experimental. So then we can enter it. Okay. And one thing that I'm not really sure about it is the number of Git API plugins we have. So we have a Git branch source API. Yes. And what is the GitHub API? So I'm not sure. I think you have listed them here, right? Yeah. Yeah. That's very confusing. The first one that GitHub API plugin is confused me at first. So that's a typical API plugin in Jenkins for an external library. It just wraps GitHub API and provides it so there's only one copy running and we don't get class-class conflicts from different plugins running different versions. And this is called the URL for GitHub for us. Yeah. So it handles all the GitHub API calls, all the authentication and most of the caching, although GitHub branch source is doing some of it as well. Here. So this is the page, the home page for the GitHub API. Oh, okay. Just low level API. Okay. Yes. And the GitHub branch source is everything we need. It's the main. Yeah. The main plugin we need to depend on. Yes. We have to retrieve the source. The SM have by using the SM API. Even if I, so I'm not really familiar with the GitHub branch source API. I'm just using the Git in Jenkins. So if I just want to use a git and GitHub, is this the GitHub plugin or is this something differently again? There is another one called GitHub plugin. What is this plugin doing? GitHub API. There is a GitHub plugin. Yeah. The GitHub plugin wants to get confusing. It's, yeah. Yeah. Okay. Maybe I should look afterwards. How this plugin. I can have French. Okay. Yeah. Branch source API is kind of, you know, Oh, okay. Document here. Here is that. Yeah. That's the user guide. That one. Yes. This is like the here. You can see that you created a GitHub organization project.  It's, you know, it's our, our CI server looks like for now. Yeah. But can I use your plugin without the GitHub branch source plugin? Or is it intended? So, I don't use the GitHub branch source API plugin. So that, that's what I was just mentioning about possibly going to separate out an API plugin that doesn't depend on anything get up related. And then the, then our plugin just handles that extension points. Just so that all the other plugins don't have to depend on GitHub that want to contribute here. Yeah. The biggest problem for if, if our plugin depend on the key plugin, instead of the branch source plugin, the biggest problem is that we, we may not able to, you know, like retrieve the name, the name of the GitHub repository from the SM API implemented by the Git plugin. So, so, so that's something. So we can do this step. These two steps we can, we can do it. We can retrieve the source. We can retrieve the head. Okay. Okay. So the GitHub plugin, the GitHub plugin is that we depend on because we have to subscribe the GitHub event. So we just use a little part of it. The green, the green class is provided by the GitHub plugin. And we just extended this and we can subscribe to the GitHub event. Maybe that would be a good idea in your design document to have the actually plugins also here that we are required to use. So yes, from which plugin. It would be a little helpful for me because I'm not familiar with the GitHub plugin. Yep. Also for other developers. Yeah. Okay. So, any other things to discuss for? So that's possibly about my, the things I want to discuss for today. So. And one thing I'm not sure about was the, the action that you are creating. Is it just so you can find again your intermediate results? What? Sorry. You are ready to spring an action in the end of your design document. I think. Can you go to. Yeah. And this action is just to store. Intermediate results or how. Or what are you? Why are you required to use it? Yes. It's just, I need to attach the actions to the wrong. So, and carry the check on results to the, to the wrong side. I create this action and this action is actually a wrong action. So this is like the, it's like the warnings next generation. I think you have the result action and result. Yes. But I'm showing something in Jenkins, but the actions are just here to show something in Jenkins. And you don't show. I think, I think about this a little bit because. If we don't need the, the. If we don't need to store the installation ID here. And maybe we can get rid of this result action. So. That's, that's why I'm currently using it. The installation ID and to attach it to the wrong. Okay. I understand. Okay. So. I see other questions. Okay. About the status API and the, the, the checks API. Yeah. It's also very confusing. I'm not sure. Okay. No, no, no, no. So you can see here. And we have two, you know, like two checks. The first, the, the, this one, the continuous integration. This one is, is, is in the status API. It just leaves one message. This comment was good. So if you go into the details. If you go into the notion of the Jenkins instance. So you can hear this notion of the instance. But if you see the detail of the checks. And you have got to the checks. Yeah. That's a difference. Yes. But my question was, is it configurable? So, or is, do we now get both actions or both results? Yeah, we get both the results. We should be able to suppress the other one. Okay. So there's a, there's a way to, there's a plugin that turns it off. So we should be able to do the same thing that plugin does. And disable it once we're stable enough. The status API is a status is created by the branch source. Yeah. I guess. Yeah. So, so, so any other questions? So this, I just, I just posted the plugin that does it into the get a channel. So there's a, so very easy to implement once we want to. Yeah. Okay. Just say no. Okay. Well, assuming we can add a trait automatically. It's easy enough for the user to add it, but it should, should be doable. Otherwise we can update the plugin if we need to. Okay. So, so I guess that's all for our today's meeting. Thank you. Thank you. It was helpful to understand everything. Okay. I think the, the, the, the, in the next meeting we'll have to talk more about the, the, the API design. The milestones and some things like that. Yeah. It's a good idea. Okay.


Cells are microscopic in size, but some, amazingly, can be over four feet long. These are the motor neurons, the longest cells of the body. As their name implies, motor neurons are in charge of movement. The long motor neurons extend from the brain, all the way down through the spinal cord, and then through another set of motor neurons to muscles throughout the body. When we want to reach for a cup of tea, our brains activate a very complex, specific combination of motor neurons that transmit a signal. The signal travels down the motor neuron from the brain through the spinal cord, through another motor neuron down the arm, and triggers the muscle contraction, which allows our hands to reach for the tea. Even simple movements like these require enormous processing power and coordination in the brain. If motor neurons are not functioning properly, our foot might move instead of our hands, or we may not be able to move at all. Loss of motor neurons causes paralysis, resulting in difficulty speaking, swallowing, and eventually breathing, leading to respiratory failure and ultimately death. This is the cause of a rare, devastating disease called ALS, for amyotrophic lateral sclerosis, which has an average survival of two to five years. ALS gained recognition in the United States when baseball legend Lou Gehrig developed the disease and died of ALS two years later. There is currently no cure for ALS and limited treatments to slow or mitigate the symptoms. With funding from the California Institute for Regenerative Medicine, CIRM, California's stem cell scientists are working determinately to make an impact. So far, we know that ALS is caused by the degeneration and eventual death of motor neurons throughout the body. In 5 to 10 percent of cases, ALS runs in families and is caused by genetic mutations. In 90 to 95 percent of cases, ALS occurs sporadically. After many years of research, scientists have discovered that degeneration of motor neurons in ALS may be caused by a malfunction in surrounding cells called astrocytes. Astrocytes are present in the brain and spinal cord where they support the motor neurons by providing nutrients and maintaining a healthy environment for them to reside. You can think of the astrocytes as the motor neuron's personal assistant. While the motor neuron is hard at work, the astrocytes feed the motor neuron, remove waste, and provide a healthy environment. In the case of ALS, astrocytes can malfunction, which causes the motor neurons to degenerate and eventually die. Now that we have several strong hypotheses for why motor neurons die in ALS, we can devise two theoretical options for treating ALS. One, replace the dying motor neurons, or two, replace the surrounding cells that provide the optimal environment for motor neurons. Because motor neurons are so long and complex, we can't transplant them into the body. Instead, scientists are using stem cells to find ways to prevent the motor neurons from dying by replacing damaged astrocytes. One group of scientists led by Clive Sensen, PhD, who is director of Cedar Sinai's Board of Governors Regenerative Medicine Institute, is attempting this approach, using astrocyte precursor cells. While astrocytes may provide great support on their own, Sensen has further modified the cells to secrete a powerful growth factor called GDNF, which has been shown in laboratory animals to protect motor neurons. The idea behind Cedar Sinai's approach is to introduce these modified neural precursor stem cells into the spinal cord where they would act as Trojan horses to introduce the protective growth factor GDNF at the site of motor neuron injury. Once implanted, the scientists think these modified cells would migrate to the site of injury where they would turn into astrocytes and produce high amounts of GDNF to protect, support, and maybe even heal the damaged and dying motor neurons. A phase one slash two A clinical trial to test this approach is currently underway at Cedar Sinai. Other groups, including one led by Dr. Goldstein at UC San Diego, are also attempting to introduce neuronal stem cells to replace damaged astrocytes. As scientists and patient advocates build on the progress that Proposition 71 funding has enabled, we must keep the momentum going, understanding that there is still much work to be done. We must remember that human trials will celebrate successes, but barriers will surface along with complications and challenges, so patience and understanding of the scientific discovery process are essential.