She ends up talking to a bunch of guys that you're feeling jealous and you try to maybe for like a half hour She's talking to that guy then half hour She's talking to another guy and they look pretty cool and everything you she's not coming to you And you're thinking man I brought up this thing and it's not happening and you're feeling off now You can pretend like it didn't matter and that would be the stronger option The strong man would say wouldn't even notice you think it's cute that she's trying to do something Or he wouldn't even be thinking about her he'd be thinking about having a good time doing something else But it's too bad. You're not that strong yet, right?  You're not going that well you go you try to look cool going your friends not working that well the whole time You're just is nagging at it's bugging you there She's talking to these guys and it's bothering you at the end of that hour.  I've been here the whole time right you thinking but what are you gonna say you just say whatever you've been thinking in terms of this Your psychological archaeology because you should sit there and think wow, so this is what it feels like This is what it feels like to be jealous to be insecure And why am I feeling jealous and insecure and you just chart that out You might even need to pull out your iPhone and write it all down Because it's gonna go why why why? You know and let's say that she comes over and you I'll just give an example of a case Right she comes over and says hey, where have you been you can just tell her you could pretend like oh, hey Let's get a drink.   I don't know what you did to me. I can't stop thinking about you I know I've only known you for one date like you know It's only a second date so I shouldn't be feeling this way But I just got to say you did something to me and I it it got to me a little bit You know you won this one. Oh man. It sucks I shouldn't feel this way because that's the truth, right? You know you shouldn't feel that way, but you do you just have to say it I know I should be stronger, but I'm not right and I you know even um, even when I was working today Ended up just I was doing my work, but then this I this image of you came up in my mind No, I can't think about her. I gotta be strong. I gotta be independent.   I know I should be stronger like when you're working out I know I should be lifting a certain weight eventually. That's my goal. You have a goal, but you're not there yet so you just say it and You know what will happen is she gets addicted to the vulnerability And you end up creating drama for her that becomes very addictive like oh my god, you know really she's gonna think really you care That much about me and here I'm like struggling like no, I don't want to but I do but no I don't want you but I do Now you can see that this could actually become a technique if you're a really good actor You could use it and you know some people have and it's also always just keep in mind It's always most powerful when it's honest and it's also best for your happiness If you're just expressing yourself honestly, you're not hiding anything just put it all out there and it takes a lot of strength Emotional strength to do this It takes a certain level of maturity already to do that But the stronger you get emotionally the more powerful honesty will be for you as an expression The more powerful the more strong the stronger emotionally emotionally you be you become the more powerful honesty will be for you So the step here is to simply As you're doing this, why am I feeling this and why you're gonna be coming up Against your vulnerabilities your insecurities your weaknesses.  You'd haven't met your goals yet, but if you hide it, you're not gonna work at it You've got to just put it out up front. For example, let's say Your plan is to lose 20 kilograms in two months Which is actually quite a lot so 20 kilograms in two months and as you get to the six week mark You're making good progress. You're feeling good.    I backslided I backslid now I'm at 15 notice that objectively speaking you're the same weight as you were in the sixth week But in the sixth week you felt great But now the ninth week you feel like shit Why because it's not about the objective measure, right? It's not about the how good you are objectively speaking It's about progress and trajectory. Do you see an upward trend? Are you getting better and better every day? That's what's important. So if you're not you can be comfortable and content with where you are now as long as you're Getting better and better.  You know, that's what you're gonna ask me, right? If you're making good progress, maybe you haven't fixed it all yet.  Put it out there. Say, you know when you said that now that little jab against me I'm still pretty sensitive about my weight.  What do you do?  Yes, I live in my mom's trailer. Yes I'd you know, I got jumped by you dude. Yes Yes, all of this shit happened, you know, but I know something about you, you know I mean put that out there, but he was just honest when you have brutal honesty Nobody can hurt you because you have nothing to hide If you have nothing to hide you're indestructible So this is how to use honesty to make yourself stronger. That's the inner That's the inner this is the outer of what to how to express it the thought processes You're going through and how to be cool with yourself Even if you're not your ideal self yet, which is probably never gonna happen because if you're progressing in life It never ends your life would hopefully you'll be progressing all the way to the end So what matters is the progress what matters is the journey not their goal And the stronger you get emotionally the more powerful honesty will be for you All right, I want to thank you for listening so attentively Carpe diem sees a day and make your life All right guys David TN. That was awesome Questions we got That was unreal, thank you. Thank you I Guess my insecurity. I know it's gonna be specific, but it's It's hard. It's my disability So would it still be the same? With the reframing and can you tell me vaguely? That's cerebral palsy Right, okay. Yeah, so your disability I haven't worked with anyone with specifically that disability, but I've worked with people who have other physical disabilities medical Disabilities and one of my my good friends is now used to be a fitness trainer Now we can't train because of a certain genetic thing. So It I can I understand Partly understand where you're coming from and what you need what I would say is let's go back to the inner because that's the most important


Check it, check it, check it, this is Unique Hust, it's your boy ECO and I'm here man on Boss Talk 101 man, it's A man. We got special guests in the house today, I got California in here, I got Texas in here man, I got my boy Charleston White here, I got my guy Autola Marv in here, I got my guy Melvin Farman in here man, how you guys doing man? Good, good. Man, good to have you man and I know you know the thing I always talk about man is the youth. We've had different situations where like I said Mob James was down, what was that about three months ago? Like in June. In June, yeah, it was in June and it pretty much permeated the waves of the internet. It was Mob James and Charleston White and when everybody seen it, it was a kid's function wasn't it? No, no, he came down here four kids function. Yeah, that's what I was thinking. But we had the podcast the night before. Yeah, I seen that. So yeah, we had the podcast, so we got into it on the podcast at Thursday night, yeah that Thursday night. So the kids was there Friday, Saturday, Sunday, so yeah. Yeah. So and I know having conversations about it now, hindsight, talking to them, I always would say it really was more about the kids, you know what I mean? That's what this whole thing, that's what everything is about. Well, on the surface it seemed like that, but it really wasn't. Okay. Yeah, it really wasn't about the kids.  Okay. And made public. So it wasn't it wasn't about the kids. Yeah, yeah, yeah. But that was supposed to be what it was about. But it ended up not being about the kids is what you're saying. Oh, yeah, yeah. No, I wouldn't. Yeah. So and I always and you know me, I go right on back to structure, you know, far as when you I mean, because of where we're at today in society, is it far as gangs go and far as the way that the culture is. Do we want to see change with the youth? Do we want to see children and everybody else detour those things and try to do things in a different way? Well, yeah, when you say do you want to see change? And just like I interjected to you earlier, a lot of them start off thinking about they want to do change.  No, nigga, you're doing it for yourself. You're trying to get be seen. You change from what your intention was. You get on front of camera. You get to boast and about stuff that you really didn't do.  You didn't make up this. And so now you just like rappers just hearing stuff. So when it ends up, it don't be about the kids, because it was about the kids. It was about the kids. We wouldn't be in the situations we are with our little. Fragile egos. That's right. If we thought it was a bigger order, it couldn't nothing that could be said to me if I had another intent. But they say before destruction is the ego, you know. And so we start playing on who I am and what I did.  Yeah, yeah. Well, the thing I look at is when I look at like I like I told you when we was in L.A. Well, I alluded to the fact of a lot of people, a lot of kids in the culture in the South after they seen colors or whatever are me being in East Texas, Shreveport was right there. So you was influenced by a lot of those guys moving down there. Is what we this is how we ended up, you know, even knowing about games. Period. You know, we was influenced by movies and stuff like that. But we never really that was not a thing, not mine down here. But at the end of the day, a lot of times you see people portraying that.  Is this something where we should be saying, hey, man, this ain't the way we should be going with it. Far as gangs. Well, I guess we all say that, you know, we all can say this shouldn't be the way it was. But then again, the portrayal is so prolific that what you're saying is money or the other. So I mean, it's a it's a hard job. Lot couldn't get one. So if you can get one, you didn't done God's world. You know what I'm saying? You didn't done the work, but to think you can save everybody. Can't nobody save everybody? You know, so you have to keep on not talking to talk, but walk to walk. Show it every day. Being I'm in I'm in my hood every day. Yeah, I'm in my park every day as a grown man. I'm I'm not. I told him more of I'm not. Oh, gee, more of them are Mr. Kinsey, I earned that. You feel what I'm saying? I'm not your playmate. I'm not. But I'm trying to just show like damn, bro. You know, we got to I can't tell you to pick up your pants, because if I'm just worried about your pants, if I ain't trying to get your head there, well, you're wearing how you wearing it. You feel what I'm saying? So we have to get a concept together as a unit. Who we trying to really say?  It happens even now today, you know. California gangbanging outside of California is a is a is a is a different animal. Correct. California and Chicago is its own animals. One's a lion. One's a bear or anything outside of those lines. It's not it ain't concrete. Outside of California, you can you can go be granddaddy.  You can kill niggas in your 30s. And when you get 45, you can go to community college. And and and and and you can go to your son's football game in Mansfield. You can go to his game in West Dallas. Niggas in California don't have that luxury. So when I moved to California, I saw niggas can't retire out the game. Well, these niggas, 60 years old, 50 years old, they still at the park. Well, they had to park through election homing. It ain't it's not that they can't get out the game. If some people are so stuck, I did time. I got out of prison. I went to college. I had a whole life been out of prison. Twenty six years, but that's that's the observation I made. That's my qualitative study, right? That's what I went to California to study. I didn't I didn't go to party. I didn't go to get high. I went to study and I walked the streets every day. So I went where everybody told me not to go. So I know what I was looking at. I know what I was looking at. Them niggas stuck. It ain't a lot of opportunities afforded to them as it is out here. So a lot of this is the land of opportunity out here. This is a felony friendly environment. You can get a job at Lockheed Martin and make missiles for the military with a felony out here. They ain't got that luxury in California. The trucking industry don't boom in California like it does here. The all fields, they don't get to work in the plants. They don't get to twit cars. They ain't out there on the on the dock. So I saw that on me. I saw that. So I got involved through community, seeing this guy, working with this guy. So I was taking notes. I saw that it ain't no black unity nowhere in California. I saw that a preacher can't even speak out against this stuff. So I saw that that's a different animal.  Let me say about that. How me and Charleston met and he can correct me if I'm wrong. Through the Internet, the proper use. He see me and he came to St. Andrew's Park. Straw hat cowboy boots and overalls. And he said, Melvin, I watch you on the Internet. I come to meet you and to learn this culture. And it wasn't like I'm got gave him the key. He learned from just hanging with me. Yeah. He got to go to see Nipsey Hustlefumero. He got to go to L.A. Gangs Unite. One time he called me. He was on what, Imperial in Vermont, almost for the gig kill. And I had a member in the Denver Lanes neighborhood. And I had to tell him how to get up out of there and teach him. So I was mentoring him. And the first thing he said out his mouth, he said, Melvin. There is no retirement for you. Wow. He recognized that because you still got bullets flying. And, you know, these parks are in L.A. on the West Side. I'm speaking on the West Side. You always say. And then also at that time, everybody embraced this man. So I don't know how we at this position now. Yeah. But everybody, he got to meet everybody. Everybody. Everybody, so we embraced him through you, through not only me, because he knew he. Copachino, yeah, Michael, Mike, Ray, Anna. I migrated. I migrated out. So the people that I was in California with, they didn't have no gang affiliation. These was good working people, and they didn't want me as St. Andrews Park. They was terrified that I was with Melvin, right? Because they know California. They know that at any given time, man, kids was dying at St. Andrew's Park. So I was going up there when people were still getting shot at, right? But I'm there to learn. Nigga, I'm on a journey. Wow. You see what I'm saying? So, man, I'm Ubering. Girl, I'm getting dropped off and sometimes he ain't there. Wow. You see what I'm saying? So sometimes I'm Ubering back and it's late. I got left to the 60s neighborhood. Didn't nobody know me. I'm here and Nigga say, say, "'Cause who was on me there? "'Cause, oh, that's Skull, pardon me." Man, where Skull at? But he knew who he left me with. I don't know. Wow. But I trust him because he's been kind of father figure, uncle like to me while I'm in California. Nigga, I don't know nobody. But I'm entrenched in street culture.   Nigga's where I'm from and killed and died for. And I'm on Hoover Street. I get to walk down Hoover Street. I get to go to Grape Street. I get to go to all these different places that niggas from my city will never go to. So, nigga, I got to come back here and teach these niggas.      That's California game. So what I did, I always sat California over here. I never, cause they the originals and the founders. So I never spoke on them. Nigga, I learned that from him. Everything past them is emulating and imitating. They really faking. Yeah, yeah.   I'm getting big on the internet. California niggas hearing this language, me talk to these local crips. Wow.  Nigga, he ain't played on our songs down here. So I'm watching my city, Dallas, Fort Worth, throw this celebration for this nipsy guy. And nigga, we got niggas do what he do here.  So may everything say, hey man, I'm going to the funeral, you wanna go?  So when I met the funeral, they smoking weed.     No, man, this is a dead body. But because I'm with the rolling 60s, I get to sit counter to the family. So I'm looking at all these motherfuckers smoke weed, include myself. Smoking weed in this motherfuckers, we don't do this down south. Weed are for nipsy. I started listening to them people speak of earmests. The mother, the father, the girlfriend, the little boy. The little boy said, last night, earmests came to me in a dream. It blew me away. I put the weed out. Wow. No, man. And when we walked by, I'm looking at the family. They mourning earmests. We bullshitting for nipsy. Wow.  So I get left in the 60s neighborhood. Nigga, this is a melee. Can't nobody get through. The Uber can't get through. Nothing. I'm there until like 10, 11, 12 o'clock at night.  And I can't say this, but Skull left a bag. Say, Skull, Skull, tell me get the bag.  They got that bag and took it to Skull. But I'm still there with the 60s. So this big old nigga right here up, can barely walk, ankles bad, knees bad. Look mean in the motherfucker. Say, say, big homie, you think you can give me a ride to the house? Big sight. He ain't said two words in all day long. Yeah, I get your ride. Where you at? So I tell him where I'm at. That's a danger zone. So as we riding home, Skull tell me, I remember when Nip was about 11 years old, he came up to me and said, Big homie, can I ask you something? And he said, yeah, why you gang bang? He said, this was the 11 year old, 12 year old kid ask him. That ain't Nip. That's Eremus. Just an inquisitive kid. I got that from the funeral. He was very inquisitive. So he telling my gang bang, cause I was born to say, Big homie, when I grew up, I'm gonna take care of the hood. That was Eremus that had that desire. Nip didn't do that. Nip was a gang bang and rolling 60 that a killer, eight trade gangster, Crip that a shooter hoover. So I don't honor the characters. Same with monster Cody. I read the book, monster Cody as a kid. Nigga, that's where I got my gang knowledge from. That book, Miss Pumple, a juvenile worker, gave me that book. Nigga sat in isolation and read that book. Nigga, when I came out, I became the leader. Cause them niggas didn't have the knowledge.  So when I grew up, I started learning that he changed his name to Shakua. Cody Scott and monster Cody ain't the same people, but they go worship monster. Wow.  Whoever Buntry is, what do his mama call him? What do his kids call him?  Can't stand before God, nigga. So I assassinate the characters because he who controls images controls mind.  Wow. Nipsey wasn't in heaven that little boy said. He said, Irmins. So I don't speak on Irmins. I don't speak on Cody. But nigga, whatever them names is that hip hop gave us, nigga, I assassinate them because our kids worship their motherfuckers. This is a generation of idol worshipers, nigga. So I assassinate the idols.  So that's why I say any motherfucking thing. And I've heard you say that. Yeah, yeah, I say any motherfucking thing, huh? Yeah, yeah, I say any motherfucking thing. The internet is something. Yeah, I'm a shock jock. Yeah, yeah, I'm a shock jock. Nigga ain't got no business listening to me, no way. And I'm willing to die.  Wow. So when you think about the character versus the individual, far as the way the mother brings this child to her image when she's dealing with it, do you, I mean, do you guys see the difference or do y'all feel like it's the same? First, let me start by saying this.   I represent LA at this crypt ship.  Don't no nigga disrespect Nipsey Hussle, monster Cody, Turkey, Raymond Washington nigga. It's tried by 12 or carried by six anywhere, anytime. They characters to me, man. Well, I ain't talking about who nobody else opinion. I don't, I don't, I don't disrespect them though. No, no, no, no. I don't disrespect them skull. You said this in front of me and I don't disrespect it. No, no, no, no. And I just said, I was a shock jock. So nigga, at any given time, my nigga, if I feel the need to speak on something, it ain't a man alive that can muzzle this mouth.   Let's see how you're like. Yeah, you're lying to me. Hold on, hold on, hold on, hold on, hold on. That's why I talk so boldly. Hold on, hold on, hold on, hold on, hold on, hold on. Hold up, hold up. No, that's why I talk so boldly. I forget it. But see, no, man, that's why I talk so boldly.   That ain't what we're here for you. I ain't arguing. I'm not, cause I'm not doing no motherfucking talking on me butting. No, man, no, man, listen nigga, I ain't talking. I ain't got to justify my words. I ain't got to justify my words.  I ain't got to justify my words. No, no, no, no, no, check this out. I ain't got to justify my words. I ain't got to justify my words to nobody, my nigga. I don't say it without a say it. So whatever consequences that come with what I don't say it, I'm willing to accept whatever consequences we accept. I'm willing to accept whatever consequences. We in, bro, this is my platform. And I come in low, but I didn't interrupt. Nobody, and I'm gonna finish. But I come in low. But listen, but listen, but we heard talking about what our things, I done said. No, I'm not talking about none of that. I'm talking about. Well, y'all can talk without me then. No, no, no, no, no, no, no, no, no, no, no, no. I don't talk about it. No, I didn't like it. Bro, I done drove too far away. No, no, no, we ain't talking, we can't talk about it. No, I ain't got to justify motherfucking thing what I done said, my nigga, I done said it. And now, no, I don't, I ain't got to do it, bro. I done drove too far from this motherfucking thing.  Hey, well, we here. Well, y'all talk. We here. Y'all going to talk without me. California is here, nigga, that's what we meant. We got to do better, man. No, we ain't doing better because this how this game goes. When he talked, we didn't say a word. He can't lead in the conversation. You can't have it one-sided.  That's the pinto, it's that.  But we got to do better, man. No, no, no, you still, it ain't that. See, but I'm saying a platform.  Okay, but I agree with him, that's what I know. I agree with what he said about a character. Am I right? Yeah, you agree with it. I agree with what he said about a character, man. The character I agree. But don't stand up in front of us. Yeah, it can't go like that.  I ain't tripping. But let me, let me, let's clear it up, man, for a while. Because we can't leave it like that. It ain't going to be clear, bro. It ain't no, no, no, no, no. We're not here when you sit and think you can talk. I ain't cared about the character, he's right. But when you talk about dead, dead. But we never got to do that. No, no, no, no, no, no, no, no, no, no, no, no, no, no. That's why I brought you up. But you said, hold up, hold up, hold up. That's why I wanted to talk to brother before we got on the air. Right. And explain to him my view. I saw his, but okay, but I'm just saying, when it came to what he's saying, it's certain things, I agree with him what he's saying about, who in the heck, about the. Yeah, y'all, we shouldn't, we couldn't do it like that. Yeah, but I'm saying.


Recently, the Linux world was shocked by this exploit that was found in XZ. XZ is this compression utility that's kind of a standard on Linux and really all Unix-like operating systems, really all operating systems, period. And you know, people wanted to know my thoughts on it. You know, I really don't comment on like the latest news events, especially security news. That's not the kind of stuff I like covering on my channel. Plenty of people have already covered that and to be honest, it's kind of old news. You know, this kind of breaking news, after a couple of days, it's already patched and you know, nobody really is interested in learning the details of the exploit anymore. So I'm not going to talk about XZ in those terms. What I wanted to talk about, since people did want to know my thoughts, is let's have a little bit of a conversation about how this exploit and exploits like it really highlight just how wonderful the Linux community is, the free and open source software community is. And in some cases, how vulnerable we are. Now to me, what I found most fascinating about the XZ exploit was it really highlighted that the people that are trying to add this malicious code into our free and open source software, many times it's not an individual. It's not just one guy that's got an X to grind or you know, he's trying to put a crypto miner on your system or something like that. This was a really interesting attack because it was a very coordinated attack by a group of individuals that really spent some time to infiltrate this GitHub, this project for XZ on their GitHub. What they did is they all joined gradually and then they started submitting patches and submitting code to the project. Very complicated code that the maintainer, the lead dev, he didn't understand a lot of the code and it was a lot of headache, a lot of work for him to dive into because he was already overworked like many devs in free and open source software, right? It's a whole lot of work for not a lot of pay and basically what this group did, they submitted all this code and they got this guy frustrated. They burned him out and then once he realized he was burnt out, they basically asked him to turn over the reins for the project. Hey, if you can't maintain this, if you're not up to the task, hey, just give us the keys to the project and you get out. And it kind of almost seems like this group has to have some kind of money behind it, right? This is too good of an attack to be, you know, just a couple of teenagers in their garage or something. I think this could have been the work of organized crime. It could have been the work of a terrorist organization. It could have been the work of some nefarious corporations somewhere around the world. It could even be the work of a nation, right? Some nation around the world could have wanted this exploit and XZ so they could have, you know, hacked all these machines that are running open SSH and system D because it wasn't really just an XZ export. You had to have XZ. You also had to have SSH enabled. You also had to have system D. And naturally what they were really targeting was the tens of millions, hundreds of millions of Linux servers around the world. It was going to end up on those countless millions of Debian servers and Red Hat servers, Ubuntu LTS servers. Ubuntu was just about a couple of weeks there away from releasing the next version of Ubuntu LTS and Ubuntu LTS server and the XZ exploit, this group was really wanting this exploit to find its way in the next Ubuntu that's about to drop. They also wanted it in the next Fedora, which is about to drop. And what's crazy, it was really through sheer luck that a developer working for Microsoft found this backdoor, this malicious code. He wasn't really looking for it. He's not into security himself. He wasn't auditing the code. That's not his job. He just found something weird going on with the code. He was working with Microsoft Postgres and eventually something weird was going on with the latest version of XZ and he started investigating it further and thankfully he did because many people wouldn't even investigate the problem. They'd find something weird and hey, whatever, but this guy took the time to investigate it further, document it, let people know about it and again it was kind of lucky that this thing got caught. This thing could have very easily slipped through and then the next major versions of Ubuntu, Fedora and Debian would all have this built in backdoor. For those of you that hadn't been following the news, I will say very few Linux distributions were actually affected by this. It's already been patched anyways. You really don't have to worry about it if you've updated your system, but there were very, very few systems that would have ever had this version of XZ, this exploited version of XZ on the system. One thing unless you were running a rolling release distribution, you didn't have to worry about it, right? So really you're talking about distributions like Arch, but even Arch really wasn't affected by this. They sort of were. That version of XZ did end up on Arch but because it exploited XZ also using OpenSSH and SystemD and required some other libraries. Arch for whatever reason didn't link SystemD to a certain library that needed to actually exploit that backdoor, right? So Arch was kind of affected but not really. You were never really going to have that backdoor in Arch. Also NixOS, I think the latest version of XZ didn't make its way into the Nix repositories but because Nix is kind of weird, I don't think that exploit would have worked on Nix either. So that's a little bit of the backstory about the exploit, how it was discovered luckily and you know, it's already been fixed. I'm not going to go into greater detail on the exploit itself as far as the code and what it was possibly going to do to these systems that would have been affected. But I do want to highlight some things that we need to be concerned about with free and open source software. For one thing, burnout. Burnout is a real thing and many free and open source software developers are burnout. Thousands of hours working on a project, donating their time, freely donating their time in many cases, not earning a dime working on this software and it's a lot of work, right? It's a lot of pressure especially once the project becomes big, once it becomes a standard piece of software like the XZ Utils, right? It's very easy for the lead maintainer of a project like that to get burnout. These hackers, this group, they knew this guy was burnout. I don't think it was an accident that they picked this particular project with this particular developer who they could already see was overworked. He was frustrated and then they added a whole bunch of extra work. I don't think that was just happenstance. I think they targeted him for that reason. They knew he was burnout and then they tried to burn him out more and then once he got frustrated, then they tried to turn the tables on him. Well, hey, man, if you're just not up to the test, you need to go, you know, this is something we're probably going to see more of as Linux grows in popularity. We're going to see these groups target open source projects based on these developers in many cases that are just overworked and underpaid. And because of that, these lead maintainers of these open source projects, they themselves are in many cases the exploit, the back door, right? That's how these groups are going to get in. In my opinion, this story is more of a human story than a tech story or a code story, right? It's more about a human being's emotional state, you know, and people preying on that rather than people hacking the code or, you know, like in the movies, you know, finding some kind of back door in the code, right? This was much more of the human being being the back door. Now, many people want to use this story to highlight the reason why proprietary closed source software is more secure than free and open source software. There's actually people on the Internet. I've seen these people making that claim, right? Especially the people that live in the proprietary software world, right? They want to, you know, stick it to free and open source software. Hey, all of you open source guys that are always saying that open source software is more secure than closed source software. Look at this, F.U. Right. And is there any validity to their argument? Is closed source software as secure as open source software? No, absolutely not. Right. We all know that free and open source software is more secure. It just is because of the nature of it, the community aspect of it. More people work on it. More eyeballs are actually looking at the code where in proprietary closed source software, nobody's looking at the code. At least the only people that can look at the code are the people that work for that company, that proprietor of that software. So does this exploit prove that open source is not as secure as what we thought? No, in my opinion, I think this exploit proves that free and open source software is vastly superior to proprietary software. I mean, think about it. The reason that we were lucky enough to catch this thing is because someone could look at the code. This developer that was working for Microsoft of all companies, right? He was actually able to look at the code. He was able to inspect this thing. And you couldn't do that if this was proprietary software. And if this was a piece of proprietary software, this was a proprietary compression tool, right? Then you wouldn't be allowed to look at the code.  And he would have known something funny was going on on his computer, but he really couldn't have investigated the problem. So in my opinion, this is a victory for the free and open source model. And I think the fact that these things get patched so quickly in Linux, right, every time we get one of these major exploits, it is patched before the news story is even out before the articles about it are written before people are making YouTube videos and audio podcasts about this exploit. It is already patched every single time because it's free and open source software. And because nobody has to wait, you know, there's thousands of people out there that, you know, are part of the free and open source community. And as soon as this stuff crops up, they work to immediately patch that piece of software to patch all the distributions that were affected by this. Like as soon as this happened, you know, teams at Ubuntu and Red Hat and Debian and Arch, they're already on it. They're already on it. It's it's patched again before most people ever knew this was a real thing. This story was already done. And that really is also a victory for free and open source software. The fact that we're able to patch our exploits so quickly to the point that really no one is very rarely affected by these things because these things get patched before the exploits really have a chance to really make their way into the Linux ecosystem, especially the broader Linux ecosystem, where typically these things, like in this case, they exploit the rolling release distributions first and then they work their way into stable release distributions, particularly those that are very heavily focused on the server market. Right. They never got to that point. And this is something that a substantial majority of the Linux community doesn't like to admit, but we need to admit it. There is a very real use case for the rolling release model, especially on desktop Linux, because without those of us like me and like many of you guys watching this video that choose to run rolling release distributions, especially on our desktops. Right. If we weren't that way, if we weren't the guinea pigs that are testing out this latest and greatest software that gets pushed to us before it gets pushed to things like Debian stable, Ubuntu, LTS, Red Hat. If we weren't the guinea pigs, then this malicious software oftentimes wouldn't get found nearly as early and it would make its way into those tens of millions, hundreds of millions of Linux servers out there. And then we would really be facing a serious problem. I've seen way too many people in the Linux community and chat rooms, subreddits, forums, whatever it happens to be, you know, Linux related communities that this debate comes up all the time between stable release distributions and rolling release distributions. You know, should I run which and you know what? At the end of the day, run what you want. But I see too many people tell others that they shouldn't run a rolling release or that rolling release is unstable. It's unsaved, yada, yada, yada. You know what? Don't do that. We should be encouraging more people to run rolling release distributions if they want to, if they want to test out new software and experience some breakage, you're right, rolling release has breakage, right? But we need people to test software. We need beta testers, right? So don't discourage people that want to run things like Arch Linux or Gen 2 or Debian CID or whatever it happens to be. Tumbleweed, you know, other rolling release distributions because we need those people testing the software that eventually makes its way into this might be controversial, but much more important Linux distributions. And let's be fair, the much more important ones are those big enterprise server distributions because those things run the world. And if any of these exploits ever make their way onto those machines, then that's a big deal. I've also seen some Windows fanboys and Mac OS fanboys come out recently as far as, hey, you Linux guys always talked about the proprietary operating systems like Windows and Mac. They got built in spyware, built in key loggers, built in backdoors. And look at Linux, you know, we just found a backdoor in Linux. So, you know, how do you know that Linux isn't riddled with backdoors? Well, I don't know. It might be. How do you know Microsoft Windows is not riddled with backdoors? You can't even audit the code of Windows. You can't look at the code because it's proprietary closed source code. At least I can go investigate all of the code with my Linux distribution. I can look at every single line of code if I want to. And it had the knowledge, but here's the thing. I don't have to do that individually. There are millions of other people around the world that are also looking at that code. Who's looking at the code for Microsoft Windows? Unless you're a very privileged person that works for Microsoft. You can't look at the code. You have no idea about what backdoors are built into Microsoft. The same thing with Apple and Mac OS and iOS and Google with Chrome OS. You have no idea what those operating systems are doing to you. So, you know, it's very disingenuous when you ask a Linux user, hey, are there any backdoors left in Linux? Is there anything you don't know about? Well, there's probably some stuff we don't know about. But here's the thing. We have the chance to find it. We have that possibility. You don't. And as much as I appreciate some of the work that Microsoft has been doing with freedom of source software. And as a matter of fact, this story and the developer that discovered the XZ bug, right, he was actually working for Microsoft on a Microsoft project at the time. And yeah, but still Microsoft, especially with its proprietary software in particular, its proprietary operating system like Windows. Do I trust it? No, we can be ninety nine point nine percent. Sure, that Microsoft Windows has built in spyware, built in keyloggers, built in backdoors that can be exploited not just by Microsoft, but also by other bad actors. And I think this XZ story, what also we should focus on is the fact that the project was hosted on GitHub, which is also owned by Microsoft. It's also a proprietary piece of software GitHub is. And, you know, if anybody wants to go investigate this group of hackers that infiltrated the the XZ project and look through their history and really investigate deeply the GitHub history for these people and try to investigate it in a serious way. Well, who can do that? Well, the only people that can do that are the people that own GitHub. It's Microsoft. They're the only people that can really deep dive into that. Do you trust Microsoft to do a good job with investigating that? Well, honestly, Microsoft is a trillion dollar corporation and they take security seriously, but wouldn't it be better if that was a situation where the community could investigate it? And basically what I'm trying to say is, you know, I left GitHub as soon as Microsoft bought it actually left GitHub a couple of weeks before it was announced Microsoft bought it. But the rumors were already out there that Microsoft planned on purchasing GitHub. So a couple of weeks before the purchase was final, I moved to GitLab because GitLab is free and open source software. And I think this issue, you know, these kinds of issues are going to keep cropping up these serious exploits on some of these projects on GitHub. And wouldn't it be nice if, you know, you were hosting your project on GitLab, which is decentralized free and open source software? I don't know. This is I don't know if that really solves the problem. I don't even know if that's going to move the needle, but I'm going to talk about it just because I know it's going to be a little bit controversial, but I think more of us in the free and open source software community really need to start pushing GitLab much more so than we've been doing. One last thing I want to mention is one of the biggest complaints with free and open source software and links is choice and variety and all the forks of things. There's just too much software. Too many people are working on different things. And, you know, this exploit proves why not having enough choices or having one de facto standard, right? Because honestly, XZ is a standard SSH open SSH is a standard system. D is a standard. And this exploit, you know, prayed on that that pretty much all these Linux boxes are going to have all of this stuff installed. Even system D, even though there are non-system D distributions out there, they're not that many, right, especially in the server world where, you know, Debian and Ubuntu and Red Hat are king. It's all system D all the time. And as far as system D goes, I like system D as an internet system. I have no problem with it. But I don't mind there being choices out there. I don't think that people forking software. You know, I always think more choice is better. And I always rail against people that say that Linux should have standards. There should be a standard, this and a standard that we should all agree on this standard, whatever. No, because the minute you standardize the minute this sort of thing happens. In closing, I will say that I think this XZ exploit was a good thing. I think it's a positive thing as far as it's going to get the free and open source software community to start focusing on some things that they need to focus on a little more. I also think it's a positive in that it highlights to everybody why free and open source software is vastly superior to proprietary software because this exploit, this kind of exploit could have very well happened in Microsoft Windows or Mac OS. The only difference is you'd never know about it. Peace, guys.


ship our 1000 here monkey what we're doing we're going geocaching today all right we're going to get it yeah we're going to get a couple geocaches and they're not far so we're gonna get try to get three maybe four so okay all right so stick with us I didn't bring my body worn camera because team forgot so let's go cashing okay guys where the first stop is real windy so hopefully my camera will do all right we're at the boat ramp hear that airboat this place is packed so it's a good thing we didn't go boating today well I noticed my tags on boot expired so anyway we're 51 feet away so I'll get you out here in a gotta love them Chevy V8s okay guys again sorry for a wind but you can see it's saying we're 31 feet away but monkey has already found it so got your mic on yeah so I was looking at this sign and there's a hook right here and I bypassed it looked around a little bit more but this is supposed to be high that was the clothes so here we go there you go right there let's bring it over here on the table okay yes there's a hook there yeah of course but I thought maybe it was hooked to the to the sign I thought was holding the sign down that's what I thought so I'll let you open it up okay that was good one okay so that's it I'm gonna sign in and did you bring a spacecoast geocaching store that's pretty cool yeah you didn't bring a pen no I have to go get one you have one yeah and I just broke it oh no oh no all right now okay so I'm what damn it I'm gonna sign a sin yeah and then I'm gonna log us in that we found it and then we'll go to the next one which is our pots preserve one of our camping areas cool so monkeys afraid to get out of this spot because this guy she almost wiped these out when we pulled in pretty cool but I told her she's he won't get that I'm like just back straight out okay guys we are at pots preserve the only issue I'm having with this one is no service I got offline maps on here but I didn't put anything on the map so anyway it is supposed to be right in this area so I can't it won't even open to let me know any clues or anything like that so and there's the one we just did and it didn't it didn't reset yet where there should be a smiley face there where we found it so somewhere right in this area here now there's another one right over here which is going to be back in there so I don't know we may just start looking around here we'll see okay guys so what we did we ran up the road three quarters of a mile so I could get service and I had found a spot here we was here a minute ago like I said we didn't have service so and this is what I was telling her where I thought it was because there's a little path here and this is trying not to get stomped or something so it's a micro so it should be right in here so I'm gonna try to find this and then I'll kick you back on hey guys did fall there's a string tied on to it okay guys she bear found it it did fall it was supposed to be in the stump I guess and it had a string on it he found it right here look at that look it up like see the string branch I think yeah it's attached right there you see the paper foot I'll be back with it we got it okay here it is and there's the little deal there it is our second one our second one very good that was a hard one really I don't know if I would have found that on my own okay I'm gonna last found 314 so wow and this is a new paper yeah okay I'm gonna sign us in I doubt if I can log us in yet but we just have to remember these three and I'll log them in once we get service so hang tight guys it's number two okay guys so we're gonna go one tenth of a mile on the new trail so we're gonna head back in here this will be our third one see I can trail so seems to be kind of working so we're gonna keep walking straight ahead toward this thing I'll kick it back on when we're close probably an animal there's a couple up in there those two probably still good yeah we'll pick them up on the way out yeah there's one up there this used to be Citrus farm back in here yeah yeah we'll pick these two up on the way out okay 97 feet should be in this area somewhere you want to hunt now I'm gonna let you hunt this one it's a mini no oh it's a big one yeah okay guys so we're close we are now hunting slow your camera down so I'm looking and it's not a mini it's a bigger one yeah yeah I don't know but you keep walking up on me what the hell you got it on you no I don't already showed him before I told you start looking wow what's your snake then really no man go ahead and get it there's no snake down there don't now get it mama you're gonna get bit there it is yeah we're here in the shade okay so here we go pad in here it looks like a little bit wet there's a pen in here hope you guys can see all this and bird stuff about the birds very cool oh they're all the same so they must have this bird here it's a scrub or something I was reading about scrub J yeah scrub J and these are what's your your likes cards there's a subway card no one and a little sketchy thing yeah but the ruler and what is this if you found this container by accident great you are welcome to join us oh cool so it just tells you to put it back and it's called geocaching that's nice and we got a little smiley face it's uh yeah yeah yo yo yeah and a whistle for bears yeah yeah and like a stone marble kind of thing it's nice and smooths and there's some little I don't know what that is little pin yeah pin oh I think it has Florida thing on there or something it's hard to tell it's kind of got croted on it you see it yeah I see it and we got some business cards here as one and two and we got a quarter and that's it guys that's pretty cool I gotta lift up because it hurts my back in my neck from 2000 yeah yeah okay guys I'm gonna sign us in and we're gonna head back to the truck okay guys we're at place for 197 feet sand it's right over there but we're gonna walk around here and go check this out and I'll show you some footage of this place might be a good fishing spot all right so this one's called Barclays rest stop and it says whether you bring a picnic lunch a fishing pole or just want to come and rest a bit bring a pen and sign the log while you're here we used to walk here every day until we lost our best four-legged friend who we've decided who we've dedicated this cash to so this place as a destination is very special to us we've included special token for first to find in fuzzy bear three was the first to find and the hint excuse me is think three Florida style okay so let's navigate so we are 54 feet away should be right over here so that's proper property where that thing is I'm adding so it's got to be pretty close here all right guys I'll keep you back on here in a second they were getting closer oh I just got pinged okay so monkey said she's thinking three trees there's a group of three trees here this is a micro sorry for the wind it's a roof no it just came on shore it's from a boat yeah or right in the 30 it pings you once you get 20 feet close to it see there's three palm trees right here which is Florida style looks like one or two palm trees yeah one oak one gone gotta be home hey guys I'm gonna keep looking okay guys so we're gonna go ahead and go we didn't find it here we've been here what about an hour yeah it's supposed to take less than an hour to find we can't find it anywhere so I don't know I don't know if it's been moved or I don't know what but it's micro so I don't know guys so I'm not going to mark it as did not find because I want to come back here and look for it again another day so anyway guys thanks for watching appreciate it we found three of the four we set out to find so we'll see you guys in the next one shea berry myth man legend gone for now bye bye guys take care


As Graham said this is just a taster and I'm not going to go into a lot of detail but obviously you're very welcome to ask me later about some of the details. I also want to acknowledge a couple of colleagues of mine, Jen Roberts at Strathclyde and Oliver Escobar with me in Edinburgh. I want to go back and give you some background to this which is important context to understand why citizens do it and where do they come from and what are they trying to do. The origins really come from Robert Dahl's work, some of you may know him, political scientist in America who wrote a number of papers, but he posited this idea saying suppose an advanced democratic country, disbate what that is, were to create a mini-opopolus consisting of perhaps a thousand citizens randomly selected out of the entire Demos. Its task would be to deliberate for a year perhaps on an issue and then to announce its choices. I perhaps should have prefaced this by saying are you all happy with the democratic systems that you live within and you may understand the backdrop to this is suggesting that perhaps we need to think about different ways we run democratic societies and so this is what's led to a lot of this rethinking in political science about what the options might be. He goes on to say a mini-popolus could exist at any level of government, national, state or local. It could be attended by an advisory committee of scholars and specialists and by an administrative staff and it could hold hearings, commission research and engage in debate and discussion. I see the institution of the mini-popolus not as a substitute for legislative bodies but as a complement. Now that final point is a point which is debated quite a lot and you may have heard in the UK for example people have suggested that the House of Lords rather than electing a House of Lords which just produces the same kind of people as you've got in the Commons are actually chosen at random from the general population but I will perhaps come back to that later. So what is this about? This was very much inspired by the Athenian concept of democracy and I should straight away say of course that didn't include women, it didn't include slaves so it was quite a limited but it was the male free population in Athens at the time who were elected by lot to take the place of a governing body for a limited period. So at any point you would be used as an adult to being a governor and to be governed and you could be a governor more than once. So that's an assembly of citizens, demographically representative of the relevant population, brought together to learn, to deliberate on a topic in order to inform public opinion and decision making. So what he was doing was basically blending social science approaches with democratic principles. I don't know if you're familiar with it but there's been quite a growth of work certainly in politics in this field of what we call deliberative democracy particularly over the last 20 years. So what is deliberative democracy? Well it's based on this premise that collective decisions should be made through reasoned public discussion rather than by the sum of individual private preferences rather than people going to vote, not telling anybody what they're doing, it's a very personal thing, you may not have thought about who you're voting for or why you're voting if you do vote at all and there's not necessarily any information that's been penetrating people's minds about how they should vote. In other words the argument here is that this decision making should be talk centric rather than vote centric and you probably recognise the Habermasian idea of the ideal speech episode, flag or event. So the goal is to improve the legitimacy of democracy by making democratic institutions systematically responsive to reasons rather than just reactions, not just the weight of numbers or the power of interests. So what is deliberation? Well as Mansbridge, Jane Mansbridge has argued, communication that induces reflection on preferences values and interests in a non-coversive fashion. That is there's no force except that of the better argument. Obviously to achieve that is that ideal state is where the difficulty arises and the question is how can we achieve that. So the aim of this deliberation is to generate reasonable, well informed opinions in which participants are willing to revise their preferences in light of discussion, new information and claims made by their fellow citizens. Although consensus need not be the ultimate aim and participants expected to pursue their interests, an overarching interest in the legitimacy of outcomes, that means not affecting other people unfairly, ideally characterises deliberation. But it's unlikely to be achieved naturally so we have to create it artificially and this is what brings in the idea of the mini-populus or what we now call mini-publics. So what is a mini-public? It's basically a public conversation. But it's a deliberative forum where citizens are selected randomly and that's really important to reflect the diversity of the public that are affected by the issue, your stakeholders if you like, and convened for a period of time sufficient for participants to form considered opinions and judgments. And there are many, many types, which I will just briefly go over in a minute, and they can range from groups of just 12 people, it's probably about as small as you will see, up to maybe 500. That could be bigger. And these are the kind of examples, citizens' views, which I'm going to proceed to talk about, consensus conferences, planning cells, a liberative polls, citizens' assemblies and others. So what are the key features of this ideal process? I've just selected what I think are the main features here. So in selecting people you select them randomly or quasi-randomly. I say quasi-randomly because sometimes if you think about it realistically, if you're selecting 12 people and you're trying to reflect the diversity of the population, random selection is probably not going to achieve it. If you've got 500 you've got a much better chance. So we have to think about perhaps stratifying it, but even then to get the real diversity you may have to be a bit more selective in ensuring that the diversity of the population is there. Again, small numbers make it more difficult. You have to lower the barriers of participation, otherwise there should be no obvious reason, if possible, that people don't say, I can't, I'd like to but I can't. So providing some money to pay for their time, recognising people's time valuable, childcare costs transport to the events if it's somewhere they have to travel to and so on. This I think is one of the key elements, facilitation. In the words, to get that ideal situation working, everyone has to feel as though they have a great chance of giving their views. And sometimes they say, I can't express myself, I don't have the education, the confidence and so on, so they have to be encouraged, helped to express their views and prevent certain people dominating the discussion. We know that goes on in many groups. And so developing that, what we call dialogic communication. A learning phase when participants perhaps might call on experts, witnesses who will give not necessarily an unbiased view, in fact usually a biased view, a particular partisan view maybe about what the issues are. But being there questioned by those citizens, so they really understand the arguments and think about whether they would support them. And then a deliberative phase, this is where the participants having been informed gathered the evidence together, then start to say what they think in the light of that evidence and defend it. It's very much a public position, it's not to say, well I think this, I'm not going to tell you what I think, but you have to defend your positions. Again that needs good facilitation to enable people to do that. And then the decision making phase, reason conclusions or recommendations after considering all these judgments. Not necessarily a consensus, although sometimes it will lead to a consensus. And I'm not proposing to go through all these, but I just thought I'd highlight them, the main types of many publics we tend to think about. Citizens' Dury tends to be the smallest, often the shortest in length, maybe only two or three days but could be longer. And the task is to learn, to deliberate and try and seek some agreement. Not necessarily over the issue, should we support this or not, but I've done some research, which I'll mention briefly, where we're looking for the principles by which government should make a decision. So they don't have to agree or disagree necessarily, but how should it be done that would be acceptable to the public. The output then could be a collective set of recommendations or consensus possibly, but not necessarily. And these costs just take us notional, this is what we've estimated from looking at various studies that have been done. So we're thinking that for a Citizens' Dury somewhere around the £20,000-£30,000 mark. So they're not cheap. So Citizens' Dury, let me be more specific now. They were first established in the early 70s in the United States and now used pretty much across the world. The length of say between two and maybe six, seven days, that cost, usually between a minimum of 12 and maybe 25 at the top end of Citizens, selected to be demographically diverse, not necessarily representative, although we're aiming for representative as if possible. And they're learning, proposing recommendations and those recommendations could feed into decision making. Now, sometimes you can set up the conditions whereby if you like legislators or whoever could be committed to it, but that's very rare because they say it's such a small group. How can you represent the public? But it might be interesting for people to learn from it. It's usually used in situations where there's a controversial issue or a very complex issue. So this will be a situation where there might be competing vested interests, very high stakes in the outcome. It has a broad impact on various types of community or it might be more to do with scientific uncertainty. And it's been used in all these situations. And what we're trying to do is reduce the barriers to participation. So access should be open. It should really be available to people to participate. So recruitment has to be considered. Access to location might be day of the week that you meet and remunerate people for their time. So this is probably the easiest way to think about it conceptually. We have an information phase. So what is this process about? And usually people don't know anything about it, not expected to provide people with information so they can learn about it and also enable them to meet witnesses, experts and interrogate them. That's where the idea of a jury comes in. But they have a very specific question. It's a bit like saying to research students, what's your research question? No, that's too broad. Make it very specific so it can be answered in the time you've got. And we have to do the same in this situation. And then there may well be a reflection phase which might be away from the meeting. Where people think about it, perhaps seek more information, have questions answered which weren't answered in the first stage. And then the final stage is the deliberation phase where they work together sharing the perspectives, defending arguments and coming up with some collective recommendations. So who should be selected? And I've already mentioned this really but we usually work on the idea of a stratified random sample where possible. But the main thing is to ensure representation of all relevant groups. You want diversity in your group and you might well divide them into subgroups of interest based on gender, age group. And this is quite important. You don't want everyone to come in who've all got the same view on it, the issue you're talking about. Because what you get is an echo chamber effect. And that just reinforces people's views. Doesn't get them thinking about it and challenging it and critically looking at what they're thinking. So you need to have somehow a way of teasing people apart and saying which side are you on without perhaps giving too much away in the early stage. So you get diversity and challenge. And then you select the cases within each stratum by simple random sampling and combine them into your sample. So this is conventional statistical approach to stratified random sampling. So just to summarise then what are some of the advantages and disadvantages. The advantages I think we can argue is quite a high level of inclusion. Because you're giving voice to the people who wouldn't normally be heard. It's not just your usual suspects. I'm not sure I like that term but we hear it said a lot. They may not be well informed, may not be articulate, may not be well educated, may not be very motivated. But they are part of the public and they have a right to a voice. And we should hear that voice. But it may take some teasing out through good facilitation. And it's a method which doesn't just say what do you think for your own interests. But you've got to defend it from a citizen's perspective. So you may say oh I don't want that road built past my house because my house value will go down. Well that's very personal, very selfish in a way but it might be valid to you as an individual. But what's the benefit to the community or to other citizens of not having that road built. Well it might protect the environment. So you can think about other arguments which could be used which would be much more collective in its focus. You can also create this long period of engagement. Not just the event when you ask people to talk about it. But they might become more engaged to citizens generally. In fact the common feedback is oh I never knew that politics could be so much fun. I meet all these people and I really want to get involved in things. Now you might say that's not a good thing or it is a good thing. I tend to argue that it's a good thing. And it enables members of public to make informed decisions on quite complex issues. So that you don't have decision making dominated by experts. Who perhaps don't know your own values and the values of your community. And it also gives you this insight which I think from research point of view is fascinating. How do citizens think about these kind of issues? And it may not actually have thought much beforehand. But there's chance here that it will have done. There are some disadvantages. They don't necessarily represent the opinions of all the public. We're talking about a small group. And that scalability issue is clearly a problem with citizens' juries. It can be quite expensive. So you need a good research grant if you're going to run this kind of thing. I don't know if it's necessarily a negative. It's a qualitative research method. And some people say yeah but we need to know how many people would say this. It doesn't always lend itself to that kind of more statistical outcome. I don't think that's necessarily a problem personally. And possibly the bigger criticism is how do you make sure these recommendations get into policy. So I'm just going to show you in a minute some examples of how that might work. So the critical issues at the micro level is it's crucial to lower those barriers to participation. In selecting the participants they should be as statistically represented as possible. That's more possible with a large mini-public, say a consensus conference. If it's a very small one like a citizens' jury probably more focusing on demographic diversity. And you want this demographic and discursive or attitudinal representation. You don't want everyone thinking the same before they start. Design choices, clearly important issues. Who sets the agenda? What's this question they've got to answer? Who selects the witnesses and the contributors? Who oversees the whole process and so on? These issues are very much usually decided by what might be called a stewarding group. Who represent the different interests around that issue. And they've all got to be happy with the process, the question and how those witnesses and contributors are selected. Internal conclusion, so yes you might get people to attend but will they speak? Will they actually give their real views? And that's where facilitation is really key to enable people to have the confidence and ability to give their views. At the macro level, there is this issue. Does it fit within the institutions that we have? Typically not, but we're seeing governments, in my own case in Scottish government, they're now saying this is a really interesting method. We should learn from this. We're trying to deal with some very complex issues like realistic medicines, the current one which is on the agenda. How can we understand that from a public point of view? Making deliberative democracy viable requires overcoming this problem of scale. I think we understand that. So this offers what we might call an alternative, a division of democratic labour. But can citizens' juries function as trusted proxies? And we still don't know the answers to these questions. There's a lot of work going on, John Gastel in America's doing a lot of work on it as well. So many publics challenge the traditional views and roles of mainstream media, politicians, experts and advocates, and might require new mindsets and practices from them. Maybe we're asking too much, but it clearly is going to be a different way of doing politics. I won't have time to give you any much detail now, but if you're interested, there is a website called Partysopedia.net. It's like Wikipedia, and you can put in examples. And there are examples around the world of various citizens' juries, citizens' assemblies, various mini-publics with evaluations of them. One of the nice things is some of my undergraduate students have now written case studies which are now being uploaded to it. So it does engage people. I'm just going to give you two examples just to show you what is being done. This is a well known one in Oregon. It's called the Citizens' Initiative Review, and how it works is basically before voting, they develop a kind of resistance jury for each measure on the ballot paper. And they get a panel of 20 randomly selected and demographically diverse voters, assemble them, and then they have several days to hear from experts, witnesses and so on, campaigns for and against the measure, and also from policy experts. And then they draft a citizen's statement, as it's called, and then that's sent to all the voters. Just to say, this is what a group like you think. You don't have to take any notice of it. You could say it's rubbish. It's up to you.  You do a private vote, but you've got some information from an informed group who've had a chance to deliberate. One which I've been more involved in with colleagues, Jen Robertson, Oliver Escobar, we were looking at onshore wind farms in Scotland, and we had these two aims to understand how deliberative processes can be used to engage citizens on complex public issues and to learn about citizens' views on shore wind farms before and after the process, before learning and deliberating and after, and how that was changing through the process. And if you want to look at the report, it's on that website, a very detailed report. NCRM, we're going to share the slides after a week, I understand. And you might be interested, Graham, again involved in getting me into this. We produced a short video of mixing methods, which I'm very keen on, so we put together citizens' juries and surveys into one approach.


Okay, hey, all right, we got a good crowd going on good. That's great. Thank you everyone for sticking around this late in the day. Let's meet part of the Design Summit. I want to talk to you today about creating custom disk image builder or Dib for short elements. And we're gonna talk a little bit about Dib. But first, who the heck is this guy? You know me from OpenStack. I've been working in the community since 2012, previously at AT&T, now currently at Cisco, where I do a bunch of stuff. And this is me from Atlanta. So let's talk about disk image builder. What? First of all, like I said, disk image builder is an OpenStack project for creating images. Not pictures, we're talking about disk images for guest operating systems. The whole project is broken up into a series of elements that can be pieced together to do lots of interesting things. The real beauty of disk image builder is that it's scriptable, it's repeatable, it's automated, and it's really, really awesome. So why do we want to do customized disk images? Obviously, not everybody wants to use the generic vendor-supplied images. You might have to do things like specifying your own NTP servers or security protocols, or you may want to standardize or access across all various distributions, instead of logging in as Ubuntu or logging in as Fedora for different distributions. So I took a survey a few months ago of the OpenStack operators community, and the responses were awesome, a whopping 93% of the respondents in the ops community customized disk images. 7% use stock generic vendor-supplied images. So the drill down was what is being done inside customized disk images? We see here, internal infrastructure requirements by far and away is the most popular reason for customized disk images. Things like name servers, internal domain, internal NTP. I know this is all stuff that can be gleaned from DHCP, but it's not always there all the time. So that's internal requirements is number one reason. Package needs, performance tuning, and the smaller ones there is file system layouts and users and permissions. So that's kind of the reason why you would want to have a customized disk image. So let's back up real quick and talk about real quick what Disk Image Builder is. It's a way to just create Ubuntu, Debian, Fedora, CentOS, REL, and OpenSUSE images initially for bare metal use. And there's an element for creating virtual machine images for use in glance, and that does things like set up the partition in the file and modifies the bootloader. You can see there's an example you can throw in various architectures. And the way you call it, the Disk Image Create, you just name the elements. In my instance here, I would be creating a 64-bit Ubuntu, but 14.04 virtual machine disk image for using glance. So one of the questions I get asked a lot is there's a lot of customizations we want to do for our disk images. How do we go about creating disk images? What are all the tools? So in Paris, I briefly talked about the variety of tools that there are available. And I think most of them come down to four major groups and Dib, Packer, VM Builder, and Box Grinder. Now, the beauty of Dib being an open-stack project is it's got that really fast, really cycle, really fast feedback loop. Bugs get reported. We are, with the exception of the week of the summit, we're getting at least one commit in master every week as per GitHub. So we are a very active project. Packer is hosted on GitHub. It's pretty active, but Mitchell is busy with a lot of other stuff, so he's not merging all those pull requests all the time. VM Builder, I checked, it's still active, but it's kind of hard to compare Launchpad and GitHub activity, so I don't know. Packer's actually slowing down a bit. Since October of 2014, there hasn't been very much activity. And unfortunately, Box Grinder is dead, long-lived Box Grinder. One of the best reasons why Disk Image Builder is my choice of a creation tool is it doesn't rely on underlying virtualization technology. Packer is a VM that imitates a kickstart or a dead bootstrap, and VM Builder is the same thing. It spins up a VM, it's great if you're on bare metal, but if you're already virtualized, you have this nested virtualization problem and now you're taking 20, 30 minutes to build a single Disk Image. So Dib, it works completely in a charrute environment along with this Box Grinder. Now with Dib, I can make all of the major Linux distributions, and there's rumor of Windows being able to work. Packer does have an advantage that NEOS can be installed because it just imitates the user action, so if it has an installer, you can imitate it, somebody type in it on the keyboard. And Box Grinder obviously only worked on Fedora and RH-based. Obviously one of the cool things is anybody can work pretty much, if you know Bash and if you know Python, then you can come work for Dib. You don't have to learn Go or whatnot. And as I pointed out, the installation method is a modification paradigm where we take the existing vendor-supplied disk images as the source, we expand it out, we blow it up, and then we charute into the environment to do the element modifications inside instead of running through an installer. So how do we work with, now I know how to do Disk Image Builder, but how do I make my own element? Where would I put my secret sauce? So obviously the first thing you want to do is keep your configuration stored in some kind of config management system so you don't have a single point of failure if your laptop dies. You want to use a proditious use of environment variables because Disk Image Builder is highly tunable. You can just run the same command and just tweak a couple of environment variables and now you're making Fedora 19 instead of 21. So it's very cool. You create your own elements that they're stored and get and you just pipe them on to the list of commands that you're passing the Disk Image Create. So for example, I have an element called mukow. I think mukow is cool. You set an environment variable called elements path that includes where your thing is located. Just like you would export path, export elements path and now you can just tack on your custom elements to the end of the command list and you'll get your thing. Let's see what comprises an element. It's a really intuitive to look at once you start kind of looking into it. There's, you can have a bin if you have any scripts that your element references and there's a really slick order of operations that happens. It's really self-explanatory. It's really well documented. Some of the stuff happens before a charoute. The majority of the exercises happens inside of a charoute and then it exits charoute to do any finalizations and clean up items. So pre-install, install, those happen inside a charoute environment. The root.d, that happens before the charoute happens. That's where you download the image from the upstream. Sorry, can't hear myself. So, sounds good. It's a really fast process. It's prone to parallelization. I can do, in my environment, I can do all the major Linux distributions and current version and previous version. All the images can be built in about six minutes flat. So it's really cool when you parallelize it. So we're gonna go ahead and do a little bit of a demo. All right. So, okay. So here's a demo I recorded earlier. Here I go doing disk image create. I'm gonna do a 64 bit. I'm gonna do a Fedora and it's a QCount 2 image and I'm gonna make, I call out my first element, Fedora and I wanna do a VM for a virtual machine. Right away it goes out, checks the upstream, the vendor supplied image. It realizes, hey, it hasn't changed and it starts going through its list of dependencies. It starts installing them packages, modifying the boot loader. It's actually updating the boot loader. It's going through the base element which is something they all have in common. Then it's going and just going through the red hat common stuff. So all of the Fedora images, CentOS and Enterprise Linux ones are all gonna get the same kind of base level of packages installed.  So it's always gonna get the same set of updates whenever, so you never accidentally forget to apply patches or whatnot. It goes through, it actually takes about two minutes. Let's go ahead and skip, oh, there it goes. There goes the cleanup process. I don't install the, I didn't install the language set so it's got no need to remove it.  Here is at the end, it's going ahead and converting it to running the SE Linux, there it goes. Converting to QCOW 2 and that's basically the end of creating an image. So the demo that I have set up is, obviously you're here to see a custom demo of some kind of image customization. So what I've done right now is just taken the generic upstream Fedora guest image and run dib on it to kind of do the slicing and dicing of the original image. So updated some stuff, updated packages, upgraded the bootloader, reconfigured it, run some of the base element stuff and it's pretty much done. But what I wanted to show you is customization. So we've gone ahead and created a file called fedora.QCOW 2. Now let's go ahead and look inside there. So there it is, the file fedora.QCOW 2.   And this doesn't take very long either.  So people log on, they know what's going on. So the default image doesn't come with a MOTD set. So I have this demo element and check it out. All I do here is in the post install, in the post install section, I'm going to run a script that modifies MOTD. Real simple, I'm going to get today's date and I'm going to echo out this image was created with this image builder on this date. So I'm going to go ahead and set the environment variable elements path to whatever it was before and then just append my present working directory because that's how I work. Sorry, I typed slow. Okay, so now I have an element named demo in the path. So I run again disk image create, same command I ran before. Let's do the same architecture AMD64. Now you notice I made a typo. So I append demo.  So let me fix that real quick. Okay, so there it goes. Now one of the beautiful things about disk image builder is that it employs a heavy amount of caching. So the first time you run it, you're at the mercy of your pipe to download the initial seed image from Fedora or Sentos or Ubuntu and all the packages. But it builds a cache, so the second time, the third time you just iterate so much faster. The first time you run an image, it may take you 20 minutes. The second time you're going to do it in like two and a half minutes. Not only does disk image builder cache the root disk image files, it also maintains an apt cache and a yum cache. So all these packages are already on my VM. They're just being, you know, hey, same thing, no need to download, it saves on your bandwidth, it's really slick. So let's go ahead and kind of skip forward to the end a little bit. Okay, we're doing the SE Linux context there. Let's skip forward a little bit. Okay, we're doing the KUKA2 conversion. And I understand, I don't have to do this, but I didn't want to fill up my VM with more than I had to. So it's converting to KUKA2 and as soon as that's done, let's go ahead and go inside the image and see if that demo element gets applied.  Okay, it's done. So let's go back into guest fish. Let's boot up the image. Not a KUKA2 image. If I convert it to raw, I can just mount it. That's MOTD and this image was created with disk image builder on yesterday. So that was like the hello world of disk image elements. It's really easy to do. You can do it in any language that you like. So if I can find my cursor again, I don't know if that shows up very well. Okay, so pretty much anything that you can write in shell or Python or Ruby can be implemented into disk image builder. So again, I'll show you the elements file here. It's just a simple shell script and gets executed because I called it at the end of the command and simple as that. You can even do more complicated things like some of the things that we have internally. One of my desires was to have, I want to have every different version of Linux use the same user. Because I think it's ridiculous that some disks you log in as Fedora, sometimes you log in as Ubuntu. So what I did is in the post install, I just go in and have this little Python script that modifies cloud.cfg and makes the default user be cloud user. So now anybody who uses our Cisco images for our product offering has a consistent kind of access entry. So that's one less thing for other automation that they don't have to worry about. It's gonna be cloud user for all your Linux systems and hopefully your Windows can do this as well. And that was Python, right? Yeah, yeah, that's Python. That's super simple, scriptable, automatable, repeatable disk image creation. Disk image builder, check it out, download it from, install it with PIP or check it out from GitHub. You can do it in Vagrant, you can do it on, I think you can do it on OSX even. As long as you have the necessary, if you have Brew installed, you can probably do it. So, disk image builder, it's awesome. Check it out, start creating images. And I'll take any questions if anybody has them. Okay, so the post install stage happens inside a Cherute environment. So you're gonna use relative paths for, so if you're gonna modify MOTD, for example, you would say slash Etsy slash MOTD because you're inside a Cherute environment. Does that kinda answer your question? So you would have that as part of a package install and that is actually, for example, if we were to look at a package installation, you just specify a YAML file with the things that you want that don't come in the generic vendor-supplied images. So you would just say like, and now you have go, but I don't want go. John, I do do testing. I do very, very generic unit tests, again, assertion tests. So I have, you can see right above the line, I set some repositories, I do some IPv6 stuff, I set the time zone, et cetera, et cetera. So when I run this thing, I just wrote a test script. Now, I'm converting this to run in GuestFS, but when I wrote it initially, it's running on Ubuntu, and Ubuntu has this really nice kernel module for NBD. So what I do is just mount up a QCAD 2 image in NBD and then Cherute into the image and then just run a series of assertion tests. Like, is UTC, did UTC actually get set? Yes, some of the packages, did Krani actually get installed? Yes, did we actually change the user? Did this, the binutils package actually get installed? So that's the assertion test that I have in there to kind of test the image. Now, when I convert this, kind of real generic primitive tests to do GuestFS, that'll actually test the bootability of the image as well, and that allowed me to be more, like the semantic guys were saying, had a higher probability of success when I launched an image. Well, in this example, the tests are being run on the build server. Ah, that's awesome. That's even easier in the back. Oh, well, dependencies. So one of the things that you don't see here is, this is under the hood, everything's gonna call, but if you look at your element, for example, for Fedora you just, you set all of the things that are required by it. So things like Red Hat Common, YAM, that way you don't have to kind of pony along all the things. So in my custom element, I wanna bring in, for example, I wanna modify the order in which data sources are fed to cloud in it, so I bring that in as a dependency. I also wanna bring in the package mapper and the installer. So once you have what your image is gonna be, then all the things that you wanna add onto that can be put into the element dependencies file. It's a great question. Let me show you real quick. So my build script, for example, real easy, real easy. There's this environment variable called the release. First I set it to precise. Actually, by default it's set to trusty for the Ubuntu element, so it's gonna make a 14.04. Then I set it to precise, and then it's gonna make a 12.04. So then I, for example, it's not always code words. Fedora 20 is the default version of the Fedora element, but if I set the release of 21, it's gonna make the next version of it. And not all of the elements use the release for the version. Actually, not all of them do. Like, so Fedora, if you set the release to 21, it'll make a Fedora 21 image. But the Ubuntu elements are pretty slick because you actually use the code name. So, Dib release equals precise. Dib release equals whatever trust, what's after trusty, quantal. Okay, so you're saying if I'm working in Red Hat 6, for example, it has a different version of, one of the things that you do is you can look for the environment variable being set in your script. So you say if Dib release equals rel6, for example, then you do this custom Python 2.6 stuff that you have to do. Otherwise, you exit cleanly and continue on. So this is all like, everything is pretty much driven by the absence or presence of an environment variable that is named after the element that you're using is one method that I do because I do two versions of each distribution. Yes, Dib architecture is also an environment variable that you can query. So, disk image builder, actually that's a good question, Segway, disk image builder supports I386, AMD64, ARM and PowerPC, I think that's all of them. And this is all queried in the shell scripts by the value of the environment variable. So for example, I call it like the bindutils package. In Ubuntu it's called DNSutils, in Red Hat it's called bindutils. So this is just a real simple YAML file that just kind of maps the family and it also applies the same for service mapping. So if you wanna do any like check config kind of scripts in your post install, you just use a generic name and map the service. This is, it's Apache 2 in Ubuntu and it's HDPD in Red Hat. Can you say that again? Oh yeah, well if you have like a local source, it's kind of, this part isn't clearly documented but a lot of the times you can just kind of point to an internal URL like you have here, I have this internal IP address and like that's the name of the file, I override the. So if I was just to run the Red Hat, make a Red Hat image thing, then it would ask me to have my RHN credentials so I could log into RHN and download the file. So I set that environment variable for where the local file lives and that really reduces your dependency on externals if you have things like Red Hat for example where you have to log in and download it. How big does your cache typically get? Excellent question. So I've done a couple of demos here. Actually let's just, so for having done a couple of Ubuntu 14.04 and Fedora 20, my cache is 1.1 gig and that's including the upstream image and the apt-end slash yum caches. So if you have a disposable environment, so like if you're doing this as part of like a CI system and you have a disposable environment, are there mechanisms that you can make that retrieval a little bit faster, is that just pointing to all internal URLs for these? Natively I don't think there is a native cache primer. Can that be a file or like a repository? Okay. Otherwise your Jenkins host has to never remove its home directory. Okay, so last month I noticed that we had Red Hat 6, Red Hat 7, you know Fedora that does 1920 and 21 but we only had CentOS 7. So I said, well, why can't we make CentOS 6? So we just go and make, I copied the CentOS 7 element and changed a couple of bits, did a little bit of tweaking for the dependencies from the differences between Python 2.7 to Python 2.6 and with the help of the community, now we can make CentOS 6 images as well. It's, you know, it was really easy. We just make a new directory in the elements path. So this one right there, that didn't exist last month and I wrote that. Basically I just copied this one and just did a couple of bits of changing and the community approved it and now we have a new image. Oh, I forgot to mention OpenSUSE is also supported. I did run into huge dependency problems specifically around Python version. So I ended up having to import a whole lot of the Red Hat common sections, break them out and put them locally into the CentOS 6 directory, really, just to make for the differences in Python 2.6. That's one of the things that, because I've done a couple of different elements both internally and publicly, I thought it'd be kind of cool and maybe next week I would write some kind of initialization thing where you can just kind of like, you do like a vagrant in it and it creates the vagrant file for you. I think it'd be pretty cool to do a dib in it kind of thing and it creates the directory structure for a new element. That doesn't exist yet, but I honestly think that would be pretty easy to do and pretty helpful to get other people who just started in making their own elements. Good question. Well, if nobody else has any questions and I really appreciate the crowd I have today, I'm actually surprised. I thought I'd have like four or five people at this hour. So thank you very much and check out the project online. Talk to this guy as well, he's one of the major contributors and oh, oh, Greg, Greg Haynes from HP also. The project is actually mainly driven by HP, Red Hat and Cisco.


You want to destroy Hezbollah? Israel could do it in weeks if it was willing to inflict the casualties on the enemy that such a victory would necessitate. Israel is not willing to inflict those casualties because it doesn't have the more fiber, the more backbone to do it. Neither does America. That's why it can't win. That's why we didn't win in Iraq. That's why we're not winning in Syria. That's why we're going to hightail out of the Middle East without tail between our legs and only embolden further emboldened.  There's a lull right now because ISIS was defeated and because al-Qaeda is on its back legs in Afghanistan, but that won't last as we retreat, as we won't win, as we refuse to win. They will come back. They will keep coming back. They will keep killing us until we have a president who actually has the courage, actually has the strategy to win. What you need right now is a strategy. What you need right now is foreign policy. What you need right now is generals who know how to win wars. This administration has none of those. No conception of foreign policy. No strategy for dealing with the Middle East. Zero. Negative. I mean, day by day it changes. No strategy. No will to win. No concept of what winning looks like. And I fear no qualified generals to actually execute it. Few generals that were part of this administration, none of whom I particularly liked, but have all left because they couldn't handle the kind of random pragmatism that this administration's foreign policy embodies. So no, what we need is a strategy for the Middle East. What we need is a way to defeat our enemies. What we need is not to run away with a tail between our legs, but to re-energize our commitment. Not to bring democracy to the Middle East. I don't care about democracy to the Middle East. Not to make these countries prosperous or western or whatever anything. A strategy. Strategy to win. To destroy our enemies. That's it. Strategy is not central planning. And war is not economics. All right. I've had enough of that topic. Let's see. We've got a bunch of super chat questions, and then I've got a few economic points I want to make. Okay. What do you think of John Bolton's secretary of state? Well, he's not anymore. He was never secretary of state. He was the national security advisor, but he has resigned. He's one of the many adults who have resigned from this administration. In shame, I think, whoever being involved. Is there anything you dislike about his farm policy? Yes, there's a number of things I dislike about John Bolton's farm policy, although generally I agree with much of it. Bolton is, let's see, way too nationalistic. He is a, he, he, he, he believed that Snowden should be tried for treason. I don't believe that. So he believes that it's okay to listen in on Americans, to get vast quantities of data on Americans in order to make us safer. He's willing to give up way too much liberty in order to so supposedly give us safety. I think that's a huge mistake. I also don't think Bolton, I mean, maybe in private, he would say this, but I don't know that Bolton is quite willing to be as tough as I think one needs to be in, in the Middle East in order to win. Now he knows the threat, he understands the threat, and he's often written good stuff about the threats in the Middle East. Other than Bolton, you know, I don't know Bolton's position on other countries, but I'll give you another example about Trump in farm policy. So the complaint is we have troops all over the world. Last I look, we had troops in 120 different countries. Why do we have those troops in 120 different countries? Why hasn't Trump done anything about that? Why have those troops not been brought home? They're troops in 120 different countries. We had special forces dying in middle of Africa. We have special forces in Kenya and Uganda. We have special forces all over Asia. If you really committed to an America first strategy, if you really committed to bring the troops home, start with all those 120 countries. Start with all those places where we don't have organized, organized groups and governments who seek to do harm to Americans. Don't start with the Middle East. Start with Africa. Start with Asia. Start with lots of different places. So, you know, John Bolton was about as good of a national security advisor that I think you could get in the world in which we live. Again, I don't know. I don't know much about him beyond the Middle East. I've met him a few times. After 9-11, I thought he was one of the better people and, you know, people call him a warmonger. And that's fine. But, you know, sometimes you have to go to war. Sometimes war is necessary. And the idea that war is never necessary. The war is never required is just false.  Now, you could argue about whether which war was necessary when. But the fact is the United States was attacked over and over and over again where the embassies abroad or right here in the U.S. over and over again over the since 1979. And until, until you actually do something about it, until you actually winning to punish those responsible, that will continue. And the only job of the U.S. government, the only job of the U.S. government is to protect the individual rights, the property, the lives of Americans. And if the lives of Americans are threatened by a foreign power, by foreign organizations, then the one job, the one job that the U.S. government has is to go overseas and destroy them. That's it. We can argue about how you do it. We can argue about strategy and how to do it. That's what needs to be done. And to the extent that John Bolton understood that after 9-11. Now, again, I'm not endorsing everything he stood for. There's certain things I strongly disagree with him. But again, one of the better people on this issue and more realistic than most. I don't think John Bolton bought into the whole bring democracy to Middle East. And if he did, I clearly disagree with him on that.  You come home. What we need today, what I called a new intellectual would be any man or woman who is willing to think, meaning any man or woman who knows that man's life must be guided by reason, by the intellect, not by feelings, wishes, wins or mystic revelations. Any man or woman who values his life and who does not want to give in to today's cult of despair, cynicism and impotence and does not intend to give up the world to the dark ages and to the role of the collectivist broads. Using the super chat and I noticed yesterday when I appealed for support for the show, many of you step forward and actually supported the show for the first time. So I'll do it again. Maybe we'll get some more today. If you like what you're hearing, if you appreciate what I'm doing, then I appreciate your support. Those of you who don't yet support the show, please take this opportunity, go to Iranbrookshow.com, slash support or go to subscribestart.com, Iranbrookshow and make a kind of a monthly contribution to keep this going. I'm not showing the next