Good morning We're going to start a little earlier since I have some cool demo For you guys. I've presented this in blackhead, but I think I will change a little bit style to deafcon style Before I started I want to have a quick survey. How many people here? for the job reason or for careless reason that at least they have for Hack one website and again the data from back end Can you raise your wall pretty good cool? so my name is fan and Today I'm going to present our next generation web application vulnerability scanner with deep injection high performance and low false alarm So everybody knows right web application security big problem So we are good just going to skip most of the database in backhand interesting enough Oracle SQL server db2 and the mysql I think took 90% of the shares More than that. So this is about a pentas to a first time revealed and It's not a so blind secret injection tool. I will show you a bit later fully automated powerful and with the bunch of pentast policy for different database Here's a quick glance of how these two looks like but I will show you a flash demo very soon. So In the left side, you can see it's the web URL then It has the Oracle detected in the back end automatically the secret injection type Tables belongs to these web user Collins and even the contents right side is the fundamental report In short, this is a cross database support Pentas to with a hundred thousand lines of C++ code high performance Very flexible extendable pentas framework, which I'll describe later Very low false alarm because if you already gain all the data Do you think it's still false alarm? and It's fully automated so We all know that through the five firewall is just not enough With this case and there's so many things from a database that you can gain So before I continue, I would like to present the first part of the flash demo for you So here we have a movie rental program Pretty cool web application. It's not a Netflix by the way. Okay. It just looks like so there is a movie You can you can go to the movie to call the science movie, but unfortunately is also a sign of the secret injection so You can just paste to the matrix tool and then right-click scan now you can see that it detect the back end is the Oracle and The secret injection type the instance name and they use the name who connect to the back end database So you will see that most of the time is right-click left-click style So now you right-click and then get a table content Sorry, get a table count. How many tables belongs to this user? So that's a I will come to the slides later Matrix has a very complex Sequence to do all the pen test from beginning to the very deep. So now we get the table count is 11 Now if you right-click again, the Manage different now you can get the table names So all the table name you can just select a few or select everything So here and try to gain a table name in the back end. So there are different ways to gain a table names They dictionary you can also brute force. You can also error-based. So Several ways that you can count in So here's the vulnerabilities that is already reported in back end so that later on we can export to the CSV or whatever so The get table name face it will it will gain the information With only like about 10 seconds so With all that iteration we get is a address table name So this is only one way. We will show you another way which is brute force Think about it how many times you design your tables like a user username profile member order, right? So this is just a common sense if you want to so now we already get to the table name Another table name is the member So now we come to the auditing panel, which is you can choose. There's a many policies We has been building to audit of the The back end database So since we already know the database type for example right now, we have default password checking and also the password Complexity checking all the parameter configurations like dictionary accessibility and the user privileges This is an important piece, right? And also the SQL area. What's the raw SQL in in the back end? All these is done through the web interface Now I reverse select and then I try to gain all the hash and the name From the back end database Since the Oracle is a hashed right the password, but that's okay. The matrix has a building Password crack for the Oracle, which is extremely fast. You can see that my password is pretty good The q a z w s x, but the matrix is even better. So it's cracked on the fly The password is cracked on the fly. So also you can see that There is default password in there as well So we will come back to this later. So here we have the cross-site scripting Functionality and also your own defined abilities So also you can have get a proxy list so that all your traffic can be Distributed isn't it will look like from all over the world. So It's pretty neat to have here's And then here's the hijack hijacking feature and here's another cool thing Okay, so We'll come back to the slides come back to normal. Okay So what's the essential fact it's based basically first Parameter defense is just not enough right with the web based on and the database securities database are all different Different vulnerabilities different design, but there are many things in common which I will describe later and database has to maintain a lot of information in the back end and the coolest the database and The cool it is and the more information need to gain for example or 10g the flashback is a good example If it want to game get back to the previous data, it has to think about it from design Right it has to maintain the sequel that is used before so think if you can get that sequel That's useful for you right through the web web applications use a context another example Finally Harden a database is not so easy at least it's much difficult than just talking right So here's the pentast sequence that it will take first just like normal scanner will do it will detect If it is sequel injectable, but that is far less than enough right then second Just as end map will send tens of packets to detect the OS types right based on TTL window size Matrix will send tens of different requests detail determine What's the database type in back end and what's the versions and then it will get the current database properties such as what web user has connect to the database and What's the incidence name or stuff? versions and Then you you can get the basic pretty much whole database dictionary. That's the One thing but also like I said there's other ways to gain and then you can start dancing because you can do advanced Injection and advanced auditing because you already know the context. I Will have to skip some of the slides because I have very limited time 36 slides, but you pretty much it's very detailed here Database in common things rows and the privileges for different database and the special spots there's always interesting part extended procedures and And either can even use the two guests for example just the utl TCP even that I can use to guess the SA password. It's a lot of things that you cannot even Maybe it's a bit beyond your imagine and weak password port stuff So here's the mind manager function on the graph. So You can either Configure your browser to point to the port which matrix will listen so matrix will monitor the session and the traffic Automatically and then detect if the URL you are browsing is Sorry, it reminds me more demos so it will Automatically detect the web URL If it's far vulnerable, but of course you can always just directly targeting the web URL and then Gain all the forbidden information then you can gain the database dictionary blind injection search the interesting tables and Then even do the brute force you can also audit many things authentication authorization You can also do the penetration test for specific spots Like a privilege as creation and all the kinds of stuff Here's a snapshot. You probably already saw it. So you are a type database name user name task Get everything field name field count or fields. You can search for specific spots like a password user so for auditing stuff you can Check the password check the configuration weakness and the versions is Oracle This pretty old the one I was using was a better 10 G so Get the user use use password and hashes and OS commands. So here's an example here that you already got the Based on the hash you'll get it's cracked on the fly because based on the username and the hash it's the it's a You already can do a rainbow style crack Pentastyle if you do the So the just browsing the browser and using magic matrix as proxy Then you can hijack the sessions in between so it can even hijack the SSL So I would I will mention that a little bit later but It can be much easier for example Here the other pentast is just it's again right-click style So here you can get all the extended procedures. You can run OS command and Doing whatever you want on pretty much so authentication currently user privileges password check system user views and As I mentioned that the C system and DBS and peep password can be Pre-generated right because you already know the username so based on diction you you can generate the hash already and For all 10 G. There's a pretty huge leak Which is that the DBS and MP password can be get through a simple query. So the reason is that it's not hashed it's encrypted and more importantly The for 10 G the default installation will put see system and the DBS and P share the same password So once you know the DBS and P password, you will know the season system. Think about it Database configuration any parameters many parameters auditing and For different database for different Context and the policies Configurations so an important feature about the matrix is that it's extremely extendable so that if there's a vulnerability released for example There's no need to Change the code or 99% of the time No need to change the code just add a conversion file and then it will automatically add to your pentast policies so Ross equal auditing an Important thing from the web interface you may very very interesting. What is the sequel running back end? Right, so to gain the sequels to give you much more abilities to gain the things okay, I Always like to use Taiji to describe the two modes of the matrix Once the in mode basically passive right very silent and quiet But they detect everything for you if it's acting as a proxy mode because you are just browsing right and then Suddenly there's a reporting back end and young mode basically you already see from the fresh demo it's direct targeting the web and hard multisreading Proxy mode as long as you browse point to it. It's all I do everything, but here's a very cool SSL man in the middle. I At least on top of my head. I don't know there's any tool that do that does anybody knows To do the hijacking for HTTPS the reason is that it's supposed to secure the channel, right? But here matrix did a special with which is that it's a special matrix in the middle So then it will Assemble the HTTP traffic. It will listen in a local port 127 and the assembled HTTP traffic to the HTTPS Representing and send it to remotely and then get it and disassemble it from that way it can audit all the sessions all the parameters in between so you can hijack it in mode here's in more example Automatically detect. Okay, oh Number secret injection type young mode. I already described Get post and also you can use proxy to targeting the stuff Advanced features like privilege escalation for example 9i DBMS med data Pretty much you can make use of the The some secret injection in the procedures to gain more privileges 10g DBMS advisor and Even the more the sequel stuff If it's installed then it will give you much more power to do the special Pan test and there's many things such as html DB xml DB and the report servers This is a specific things, but it's also very interesting So keep adding the policy like I said to gain more and more It's very important because you always want to keep the pace you don't want to have something that last year or two years ago and That's that's not so useful, right? That's needed but not so useful there's also you can audit the some Network related or some evil procedures using the outband secret injection Pan test the capability plug-in I already mentioned but again, this is very one of the key you can add the policies on the fly so Similar tools, I don't know if it's so similar, but I'll put it here evasion techniques So these are interesting part, right? If right most of ideas like we'll detect okay one equals to one or some of the patterns But it's a iteration last year in blackhead. I presented the Defense techniques about secret injection. So it's quite hard. It's quite hard. I mean to think about it There's so many variations. I want to get to there. There's also some interesting Evasion for example, you can use some decks a function equals to something right looks totally different So that way to catch that pattern is really difficult You can also lower down your thread So it will look and also distribute by proxies so that it will looks like a more normal Defense techniques before the installation and configuration is usually lame dictionary protection least privileges always bear in mind for application especially for different applications and Do a regularly pen testing and the continuous monitoring so Before I come to the next demo I would to thank you for everyone for listening and I Have to mention my partner Xiaorong. He did a really fantastic job. He's really cool but Sorry, he couldn't come join me and special thanks to Alexander for great comments and The one of the big reason I'm here, which is I want to get your feedback I won't get your comments so that Make it a better and a better if you have any Suggestions or comments Then to send to the info DB app security calm So we will come to the next the demo. We have two minutes. I think oh I have ten. Oh Cool Sure Thanks fine. I Should not make so hard if I know I have ten so Here's another web application JSP books selling the book right security book looks like so You know right click this time is a MS sequel number sequel injection and The database name is in the web user name is SA okay The vulnerability level is of course higher So again here you already have 23 tables in back end not bad so Can get the table name And get a few here the advanced one you can basically search the table name Sometimes if that has like a 200 tables, you just want to search some of the specific points So it's getting easier Now you have quite a few tables and the customer info Looks interesting right customer info. That's always the I mean from my point of view, but I'm sure you're the same so Now you get a field account then you can get all the fields again, it's a right click style and Cumulator there's a the end there was always command execution That's probably one of the few place that you need to use the keyboard To type because you need to run OS commands To as you wish so now you have a few interesting fields name password So customer ID login name so we can just gain a few just for demo purpose So again, I have to emphasize all these through is through the web application Interface there's no need any more information about it so Here is coming for another come to another fun part It will get all the content from the tables Welcome to the matrix The speed is quite fast. This is in real speed because the engine is optimized Right so Now we can come to another fun part, which is the panel chasing So now you have all the contacts right what database it is in back end. What's the web user connected? What's the vulnerabilities of the web application? Now you can look at the like what's the DS name? Okay, I don't know why they have my name in yet, so You can also Another thing is that you can also look at how many evil procedures is available So that's another thing because you first want to see how many things you can do in hand Right, then you can do more things so you can see that from the beginning to the end It's always step-by-step but helping each other to get deeper and deeper for all the injection. So Okay, we have Read error log get protocol stuff, okay, you can always get more things because It's just a it will give you from the number of things that you can you can choose Okay, so In new error logs That's not bad, right? Now you have OS command type see boot dot init file So The run OS command for you and then tell you everything so I will let the demo go on and Thank you very much for listening and I'm taking questions. Thank you Thank you, Mike. Yes, sir. Yes Say again. Sorry. Yeah Yeah, good question. There's a project safe So no matter where you are you if you save for a project next time if you restart It will already in the state in there Good question Yeah, so for middleware basically right now The current version is we'll try to inject as much as possible So it will depends on how middleware process the parameters this etc. And also We we are planning to add in more like specific middleware like from basically in in in the policies for it Yeah, any other questions. Yes, sir Specifically I did not but my friend did once. Yeah, thank you. No, I'm not kidding because we already have Okay, yeah, trust me. Okay, because We already have the beta tester, which is a very big company so they can test their own applications through the pen test. So I'm so busy with this So I won't have time to hack stuff. Yeah, so Yes, sir Yeah, we'll have beta test plan like slowly going. Yeah, so you can send emails to the question. Yeah Yes, oh you mean for the SSL hijacking Okay, so basically What it do is that actually I have SSL flash later on I can show you but basically what it do is that Because these two is in your machine, right? So in 127, so it's your trusted man So it's like a trusted man in the middle. So then you through the HTTP for example browsing the local Just like your local port that Matrix world we're listening. So for example, if you want the HTTPS www.abc.com Then something then the machine need knows that this traffic in this port is talking to that HTTPS then it will assemble all your You are from your point of view from browser still Looking at the remote website, right browsing, but actually in the middle it will assemble all the HTTPS traffic for you and then Monitoring the sessions if it has the vulnerabilities or the primary the vulnerabilities inside So that's basically how it works, but I can show you Flash later on. Yeah Yeah, it's traceable. So if you if you turn on Hijack that option, then it will stop there and then you can change something and Primate and then click send it will send it. So Any questions more questions? All right. Thank you very much for listening and yeah, send me email if you have any comments


Hello and welcome to the session. My name is Mansi and I am going to help you with the following question. The question says, find the equation of the circle with center 0,2 and radius 2. So let us start with the solution to this question. First of all we see that equation of the circle with center at a point say hk and radius r is given by x minus h the whole square plus y minus k the whole square is equal to r square. Now it is given to us that center is 0,2 that means hk is 0,2 and radius r is equal to 2. So applying this formula here using hk and r as 0,2 and 2 respectively we have equation for circle is given by x minus 0 the whole square plus y minus 2 the whole square is equal to 2 square. This implies x square plus y square plus 4 minus 4 y is equal to 4. Here we have applied the formula a minus b the whole square is equal to a square plus b square minus 2 a b. This further implies that plus 4 gets cancelled with plus 4 and we are left with x square plus y square minus 4 y is equal to 0. So the question is that the required equation of the circle with center 0,2 and radius 2 is x square plus y square minus 4 y equal to 0. So this is our answer to the question. I hope that you understood the question and enjoyed the session. Have a good day.


So we're gonna start the presentation now. So thank you everybody for coming to our talk. Today we're gonna be talking to you about a case study on how designers can shape better documentation. So we call the study re-imagining Knative. So a little bit about who we are. My name's Zainab and I am currently a UX design researcher at OCAD University from Toronto, Canada. I'm also one of the design leads for the new Knative UX working groups. This is a fairly new group. We began in September and we've done a lot of exciting projects that we're excited to talk to you guys about today. I also have a background in human-computer interactions and I've been involved in design education at OCAD for the past two years. All right, hello everyone. I'm Marianna Mejia. I'm also a UX researcher at the same lab Zainab is at at OCAD University. I'm the other design lead at the UX working group and I'm finishing my final semester in the industrial design program at OCAD. And some of my interests include accessible design, human-computer interaction and authoring tool design. So before we get into the guts of our presentation, we wanted to give you a roadmap and give you an idea of the questions that you should have answered by the end of these slides. So the three main questions are what, why and how.  Next we're gonna give you an overview of what UX design is. Since I'm assuming most of you do not have a design background and we're gonna be covering some buzzword topics like for example, how to make something more intuitive or user-friendly. We're also gonna be covering why. So why might you want to explore UX strategies for your own projects and why you might wanna think about involving designers in your open-source tools? Lastly, we want you to consider how. So how can you actually implement these UX strategies in your own projects? So an example we're gonna show you is card sorting. And lastly, how can you actually go about finding designers for your open-source projects? Right, so first getting into what is Knative. Knative is an automation layer that you can use with Kubernetes to deploy native Kubernetes services. So it has three components. The first component is functions. So this is a simple programming model that allows you to easily create and deploy your own event-driven functions. We also have, sorry, we also have serving which allows you to deploy and run containers. And lastly we have eventing which enables different events to trigger container-based services. So three primitives or components. And so why might you want to use Knative? So the benefit of using Knative is that it allows you to automate things. So there's less of a need. So if you were to use Kubernetes by itself, you'd have to set up the complex infrastructure. And by using Knative, you as a developer can focus more on your own code. It also has less resource consumption. So Knative is able to start and stop instances automatically as needed. And lastly, there is auto-scaling. So you only pay for the compute time that you need so it is gonna be cheaper. Okay, so we've covered the tool that we're talking about today. And now we want to talk about why open source has a need for user-centered design. So in many cases, the developers are not the only users of the tools. And while in the past, the groups of the developers and the users were the same group. But as software has developed and software has taken over many industries, as you guys know, the end users of open source are not only experts. And we want to be considering this gap here. The users that are not ex... Oh, there's no cursor. There's this circle on the left, the bigger circle, which shows that not all developers are users. Okay, so now we're gonna give an overview of what UX design is. So our goal as designers is to both understand and improve the experience between a user and a product or service. So the big question you wanna answer is how can we make the entire experience more intuitive or user-friendly? And I also wanna point out that UX design is an umbrella term that covers a variety of topics. So a lot of people might hear UX design and think it's only about the interface, but it's actually much deeper than that. We also do things like how people navigate a tool, how you can structure and organize your information. We consider things like accessibility of tools, and we also do things like user research and user testing to ensure that all the features are actually what people want. Okay, so going back to this word that I keep using and that you've probably heard before, so what makes something intuitive? There's a typo on the slide, sorry about that. So how can we actually design our tools to be more intuitive or user-friendly? There's basically two aspects to this. The first aspect is leveraging a user's prior knowledge. So I'll give an example of a command line interface. So for example, you have a user and they use a command line interface where the components are in a specific order. And say you have a new product and the components of the command are in a different order, the user is not gonna be very happy because this goes against their prior knowledge. So you want to be designing tools in a way that is familiar to what the user has used before and you want to follow certain conventions that are common. And so in order to figure out what's common, you have to kind of know who the user is and what their experience is, right? So that's where the user research part comes in. And the second part is considering human instinct or common sense. So an example of this in visual design is where if you have an important piece of information like the title, you should be using a larger font or using a contrasting text as the eye will intuitively be drawn to this and perceive this as the most important piece of information. And like I mentioned, these design decisions often need to be researched and need to be tested to ensure that your product is actually following these two principles. Okay, so now we're gonna get into what the design process is. So the design process has five stages and the first stage is to empathize with the user. So you wanna start off with a broad understanding of the user's needs. So while you can hypothesize what the user's needs might be, you don't really know unless you go out and ask people. So this is where you're doing things like observations and surveys. The second stage is to define the problem. So once you've collected all your data and information, you can now begin to narrow down and define the problem space. And once you've figured out what the precise problem is, then you can begin to ideate solutions. So sometimes we as engineers tend to jump to the ideate step, but we wanna make sure we're really putting emphasis on the first two steps, which are more of induction. So in the ideate phase actually, in our Knative Working Group, we end up working a lot with a technical team to come up with potential solutions to the problems we've identified. And after you've come up with potential solutions, you can begin to prototype solutions. And this is where you might start using tools like Figma to design a potential solution, and then you can start getting into developer handoff. And once you've done all that, you can start testing things. So you can show people what you've made and get some user feedback on that. And that is stage five. Okay, so a bit of an overview of how designers can help open source. Basically, we want our tools to be benefiting as many people as possible. So I have this diagram here showing the positive feedback loop of why UX design is important. So first, if you have more emphasis on design, you're gonna end up with tools that are easier to access. Tools that are easier to access result in more people using your tools. And the more users you have, the more likely you are to have more contributors. So it just is a cycle that we wanna keep continuing, right? And here are some more ways that designers have been beneficial and K-native. So now more of our decisions are user-driven, which means that the new features and tools that we add follow, or hopefully, are following user demand. So the features that we develop are actually gonna be used by people. Next, by having better information design, we're able to have more efficient onboarding for both contributors and new users. So an example of information design is our documentation restructuring, which Mariana will be going over in a second. And lastly, we wanna focus on things like product improvement for existing products. So for example, for our command line interface, we were looking at ways to make it more intuitive or user-friendly using the principles I described previously. So here's where we are analyzing and improving our existing products. Okay, so hopefully by now, you are thinking about how you might be able to involve designers in your own products, but there are still a couple challenges. So while developers may be aware that better design could be beneficial, they may not always know the specific strategies that are helpful for their own projects, and they may not always know which ones to implement and how to implement them. And lastly, there are a lot of terms that they may not be able to articulate to designers. So we hope that during the rest of this presentation, we're able to address some of these concerns. All right, so that brings us to our specific case study that we're talking about today, which is have you ever been stuck in documentation health? Let's say you're trying to look for a specific feature within pages and pages and documentation, and you can't seem to find it. Or maybe you yourself are a maintainer of a specific open source project, and you develop the feature and they tell you, okay, now put it in the documentation, and you're like, okay, but where does that fit? This exercise is kind of meant to help you figure those kinds of questions out. So we'll start by contextualizing a bit here. This is the candidate of website, specifically under the eventing page, and we were approached by maintainers from the eventing working group at Knative to kind of examine this substructure that's towards the left, and see if there were any usability issues or UX improvements that we could make to it. This is just highlighting the submenu that I was referring to. Okay, so this is actually a difficulty with information architecture. Over here, you can see towards the left column, there's like the unexpanded version of the submenu, and then to the right, there's the expanded version. There's a lot of categories underneath this and a lot to go through. And so we want to figure out how to structure this information. So what is information architecture? It's kind of like a subdiscipline within UX design where you're trying to present information to the user in a way that's understandable, easy to find, and that makes sense on like an intuitive level, and it categorizes and presents relevant information. So for this issue that we have presented, what specific UX research strategies are there? So there's a couple of research strategies within UX design, some of which you may have heard of or done yourself. There's things like surveys and interviews, but there's also more specific ones like co-design where you're designing with your end users or you're doing digital ethnography, which comes out of anthropology and it can be thought of as like noting people's behaviors, say on like online forums, for example. You can also do things like diary studies where you ask a user to maybe interact with your design and write down their own notes on how they feel during the interaction and analyze that. But luckily there is a specific UX research strategy that is meant for information architecture. This is called card sorting and it really helps you understand a mental model of how your users understand the information on your website or your specific project. So it helps you answer questions like how do people categorize different pieces of information? What pieces of information are related in their minds? What's more important, what's least important? Things of the sort. So this is just a very quick example on how to apply card sorting just to like kind of onboard you to the idea. Let's say you're a designer at Microsoft Teams. The Teams interface has not been invented. You know that you want something like time since beginning of the meeting, a leave button, a mute toggle button and maybe a video toggle button. But that's really all you know. So you can write all of these down into sticky notes or cards and give them to end users and see how they categorize things. So you might get a result like they might group together the mute toggle button and the video toggle button and they might place an emphasis on the leave button and less of an emphasis on the time since beginning of the meeting. And they might even tell you something like you're missing a chat feature. So you actually, once you analyze those results, you actually get something that ends up looking like the navigation bar on the Teams interface. So you might find that people place more emphasis on the leave button so you make it red, bold, easy to find. Less of an emphasis on the time since beginning of the meeting. So you put it off to the left in less bold lettering and then you put together the camera toggle and the mute toggle because they're conceptually related. So that's how you might translate that into a graphical user interface. So going back to our original issue of confusing documentation, how did we even get here? So as you might already know, you might develop a feature within the open source project and not know where to put it. So this is a common issue that also happens in Knative where people maybe categorize things in a way where most people wouldn't think to find them. And the end result is that it's hard for contributors to find the specific feature. It's hard for end users and it's hard for maintainers to kind of keep up with the whole documentation and its structure. So we were looking at the following questions. What subtle changes can we make to this left side menu so that it's more navigable? We also had some more specific questions surrounding two topics of developer topics and administrator topics, which are kind of like sandwiched in the middle here. We wanted to find out whether or not people actually use them to understand and like find the specific thing they're looking for within the Knative documentation. And we also wanted to find what other main categories do people use, like what should be up here and what could we do without? So actually at the last KubeCon, the wonderful people at Knative that volunteered to be at the booth conducted this study and yeah, we had a total of 25 participants. This is a bit of what some of the boards looked like. It's just like a poster board with sticky notes and the information found on the left submenu kind of like abstracted out of the interface. And over here, we have like a funny thing that I like to call the corner of shame, which is pointed out at the bottom right hand corner. It's just like a little corner where people can put sticky notes but they don't think are relevant. And I'll get into a bit more of why that's useful. So how do you analyze card sorting? We did more of a quantitative approach to the card sorting data. So we were trying to look at frequency of like what were like, let's say, the frequency of administrator topics and how much it was used to categorize other groups and what topics were frequently grouped together. This is just a bit of what the analysis looked like in the images. Okay, so back to our original questions. Do people really use a distinction between administrator and developer topics? In our specific use case, the answer was yes. It was actually the two top used categories that people use to make sense of what was in the left submenu followed by observability and resources and were there any categories that people could do without? The answer is yes, they actually erased something called, it's a bit nested, but it's called the sugar controller. And that's interesting because we hypothesized it was due to a lack of information. Like people don't necessarily know what a sugar controller is. Therefore they didn't know how to categorize it and therefore they put it in the corner of shame. Then we had some emerging questions. We had other emerging questions besides this one, but maybe this one was the most important. Were there specific pieces of information that people categorized under administrator or developer topics? And the answer was there was no, I guess, significant overlap between the different boards and how people categorized them, but there were somewhat consistent broad themes. So under administrator topics, you could find things like collecting, observing, configuring. Meanwhile, under developer topics, you could find things like troubleshooting. And what were the final results for? Like what changes we made to the actual interface? So to make a long story short, we renamed some topics. We moved to other topics around. So for example, we moved up the resources and the developer topics and administrator topics because we found those were relevant. We made some visual changes. And because of the sugar controller, we thought to add frequently asked questions in order to fill in that kind of educational gap that we found. So where else could you use card sorting? Is it only okay for documentation? And the answer is no. It's really good for anything that has information in it, which is, I would dare to say all interfaces. So you can use it for the navigation bar on your website. You can use it to figure out the graphical user interface of your project. You can even use it to structure a command line to understand what structure for the command lines and what order makes most sense to people. And really any other information architecture issues. So hopefully you're interested in conducting your own card sorting exercise. And how do you do that? So this is a bit biased towards how we did it. There's actually many different types of card sorting exercises, which I won't bore you with today, but I would be happy to talk about it some other time. But yeah, you just have to get the supplies. You can do this digitally with platforms that kind of imitate whiteboard layouts or sticky notes. This includes things like Miro, Mural, and Fig Jam, if you guys have ever used those platforms. But for in-person exercises, you just need the poster board and the sticky notes.  And this is actually a very important part. When you're placing those sticky notes on the board, be sure to randomly put them there.  You don't wanna indicate how you think it should go. And as an option, you can add blank sticky notes so that if people think there's a conceptual gap missing, for example, that chat feature that we were talking about in Microsoft Teams, you know what you're missing in your interface. I would also highly encourage, if you can, ask questions as to why they think it's missing. And then as an option, you can add the corner of shame. It also provides some very useful information as to what people think is extra information or maybe they don't know what it is. Again, it's very interesting pieces of data. And then obviously you contact participants. It can be a bit tricky to source participants sometimes, but yeah, once you do, be sure to follow ethical guidelines, gain their consent, things of the sort. And I would also highly recommend getting a video if you can of the participant sorting out the cards so that you can kind of see their rationale. Like what decisions did they go back on? What did they have trouble placing? That can tell you a lot of things. And lastly, analyze. It's kind of easier said than done and you can do it in a variety of ways. But yeah, look at what hierarchies exist. What do people place as categories the most? What patterns are there in the data? And be sure to be responsible with the data collected and if you're sharing findings, please anonymize the findings unless you have explicit consent to not do so. And then try to analyze those results. This is where having a designer really helps. Try to translate those results from the card sorting into whatever interface that you're making. So you can place like highly relevant things as more visually important. So maybe add some more contrast, make it bolder. For less relevant pieces of information, you can minimize them, push them off to the side. Things of the sort. Consider adding new information where people thought it was missing. And then lastly, share the findings. Obviously it's open source so it's always great to share with the broader community and get some feedback from subject matter experts in your specific project and implement it. Okay, so now we're gonna be covering some of the challenges that we faced during this card sorting exercise. So the first challenge was to figure out how to actually find creative users to interview. So our solution was to do it at KubeCon cause a lot of people come here. So this was at the last KubeCon and although we did get 25 participants, we're thinking that in the future it might be good to also have a digital version of this so that people that are international or people that aren't present at KubeCon physically could also be able to participate. So that's one way that we can actually improve our sample size. And one of the other issues that we had was that the volunteers that were running the study and also the participants did not have a prior example of how this type of study is run. So it would have been good to inform the volunteers about guiding questions or tell them to write down more notes as the study was being done. And this leads us to the third issue which was a lack of context in analyzing. So me and Mariana were analyzing the study results from the photos. But unfortunately, because it was already anonymized we did not have a way to ask any follow-up questions to get a further understanding of people's rationale. So like we mentioned in the future it would be good to either have people taking notes or having some kind of video or audio recording of the actual process of sorting and having people ask questions as the study was being conducted. Okay, and here are some of the general challenges we're trying to figure out in our UX working group at Knative. So in terms of onboarding new design contributors there is like challenges in like technical knowledge gaps. So we found that having synchronous meeting has really, synchronous meetings has really helped us especially like in the cloud development space there are a lot of technical concepts. So having a lot of communication between developers and designers has been really helpful. The second major challenge that we're still trying to figure out is in terms of tracking non-code contributions on GitHub. So this is a pretty major challenge and we're still figuring out the procedure for this. Something that we've been doing so far is that whenever there is like a new design issue so we'll open an issue on GitHub and then the designer once they've come up with their design will open a pull request and within that pull request we'll either have a PNG image of the design or a link to a Figma file and then people can approve that pull request when that design change has been approved. So that's what we're doing currently but we're still like exploring other ways to do all this. And lastly we are still doing some exploration about potential design tools to use. So like I mentioned Figma it's a pretty common tool in the design space but unfortunately it does have a paid license so we're trying to figure out ways to give our open source contributors access to tools that are free so that they don't have to pay money to do open source contribution. Okay, so you also might be wondering why designers would even wanna participate in your open source projects.  The first reason is that designers really enjoy seeing their changes implemented in an actual deployed product and it's something really great that they can add to their design portfolio. A lot of people are also interested in improving their technical knowledge so that's another benefit. And lastly they may actually wanna help make software tools more accessible and this way more people get to have a say in the features and improvements for the tools. And lastly open source is an amazing community and we've had a really good experience with it so far. Okay, so hopefully by this point you're like, oh wow I wanna start my own UX research team and my own project. So here are some ways that you can go about doing that. The first is that you could find a organization with an existing designer demographic to partner with so you could find a school or a research lab or even a local community meetup group and you can start talking to designers there. The next step is something that we are hoping to look into ourselves is to start hosting more design events. So for example, you could have a designathon and get different people from the design community aware of the problems in open source and get them involved. And yeah, from our experience we definitely recommend having regular synchronous meetings, especially for the purpose of developing a shared vocabulary and learning what tools each group is using. And yeah, so if you do end up onboarding some designers you might need to give them some guidance on how to navigate GitHub. And here are some of our ongoing and future projects in our working group. So the one that a lot of people are very excited about is our mascot, okay, thanks, is our mascot. So this is our mascot Quack, which we had the pleasure to redesign recently. So that's him. And yeah, besides that, we also have been doing some website redesign. So the version on the left is the old version and the version on the right is a new proposed version that we're still implementing and deploying. And besides that, we're also working on a mobile version of the Knative website. And we're also hopefully gonna be developing or starting development on a Graphic User Interface for Knative pretty soon. And lastly, we have a contributor experience and retention rate study that we are currently doing as well. Okay, so I wanna give a huge thank you to our team. So both our team at OCAD from the Perceptual Artifacts Lab and also everybody from Knative who's helped us with all of our projects and also these lovely people.  So if you have ever used Knative or have any ideas for new features, we would love to hear from you. So Quack, the Knative Doug invites you to participate in our UX study. The link is here. So I'll come back to the slide in just a second. I just wanted to go to the next slide. So and lastly, I wanna invite you guys to get in touch with us. So you can connect with us either on LinkedIn or via email. And I'm also gonna be at the Knative booth after this presentation. So we'd love to talk to you about getting designers involved in your own projects as well. Okay, and these are our sources. So yeah, thank you. Any questions or comments? Hello, yeah, okay. Thank you for the talk. It was very nice. I was just wondering when you ask people at the booth to hold these kind of car sorting exercises, you say to educate them about guided, not using guided questions. Can you give examples of what good questions would be? Oh, yes, that's a great question. So a good example might be like, oh, don't you think these two should be categorized together or maybe like almost like incriminating questions? Like it also has to do with tone. Oh, really? Like do you think those two should go together? Like that kind of thing might make users, or participants second-guess themselves, and then maybe bias towards changing their answers. So be careful. Also, I wanna make sure, so were you asking about biased questions or questions to help with research, like useful questions? Yeah, okay. So Mariana gave an example of a biased approach to asking questions, and maybe you wanna ask kind of open-ended questions. So maybe if you have two categories that the group together is like, oh, what do these two categories have in common? Or where have you seen these two categories before? So just kind of like approaching it with curiosity and keeping it open-ended. And yet what you don't wanna do is like, don't you think that this one should be over there? Like you don't wanna ask those kinds of questions. Oh yeah, does that answer your question? Yeah, okay, great. All right, thank you. Did you have a chance to measure the impact of your changes in the menu? That is a great question. We definitely wanna look at like a user test maybe to see how effective, like that's the last step in the design process. We haven't gotten around to that portion, but absolutely we do want to do that. So the answer is no, not yet. And something that we might actually be doing is that for people that we are asking to participate in this study, depending on who signs up, we might ask people to like take a look at the new documentation and comment on whether it's more or less helpful than the old one. So that's the one way that we might approach the testing part of the design process. Do you have any comments on using, for example, some kind of AI into the documentation for users? If maybe I'm not certain I'm not like looking for a specific word or something, just like have an overall question about this documentation. And sometimes the search engine is not the best way sometimes to search for things that I'm not certain how to ask. And maybe I've seen some other places where you just like ask the AI bot and the AI bot looks around the documentation and give you an answer. Yeah, we haven't looked into any like chat bot style features for any, I mean, as far as we know for like specific to documentation, question chat bot stuff, but that could be if there's enough interest that could be a potential future project. Do you have any thoughts on this? Yeah, I think that's actually a great suggestion and definitely something we could look into, but it didn't necessarily come up during the study. I guess because we were asking like on a very specific part of the documentation and like card sorting, maybe during an interview it would have come up, but yeah, absolutely. I could see a lot of benefit in that. I think probably something that is more of a short term goal would be to have like a search bar features a good search of certain words in the documentation as a whole. So we could implement that. Yeah, thank you for the great presentation. So for your example for K-Native, the menu was already there and categories were already there, but let's say we're starting from scratch. What would be your idea of defining categories or how many categories should we even have in the menu? Yeah, any thoughts on that? Yeah, that's a great question. Okay, so there's a couple of things or Zaydem, do you want to tackle the- You need to go first. Okay, yeah, so this is maybe where the different types of card sorting could be helpful and also some like old cognitive science studies suggest for example, seven pieces of information so you could maybe try to aim for seven high level categories. Seven, I think it's like plus two or minus two. And you can start off with that and you could do a type of card sorting which is a lot more open. So for example, you provide the users with the seven categories that you're thinking of and then you ask them to fill it out for you. That one can be a bit trickier and maybe demands more time than this kind of card sorting, but yeah, that may be helpful. I think also for that situation, your users would have to be more familiar with the domain as well. Like maybe they've used other tools or they have like expertise. So you could definitely, I'd probably start with like more of like a, if you're like a non-technical person doing kind of like an open-ended discussion-based interview, be like, oh, like what kinds of information do you typically put in documentation? And then like once you have like a conversation, you could pick out keywords from that conversation as well. And that could go on to your cards as well. Thank you guys so much.


just when i thought i understood positives and negative electric potentials i looked at the textbook definition and my goodness it had such big big words like work done by external force unit positive charge infinity to that point without accelerating and i was like oh my god what what is this this is this looks so different than what i understand but in this video we'll figure out exactly how we calculate electric potential using work done and by the end of the video this statement would have made a lot a lot more sense to you so let's quickly start with something that we've already seen before in gravity if i say a potential at a point a with respect to its some reference is 11 joules per kilogram it means if i were to keep a kilogram of rock let's say at that point it would have 11 joules of more potential energy compared to how much it would have at this reference point over here it's the ground the same thing applies here when i say potential at point a with respect to infinity is negative 300 negative 300 joules per coulomb it basically means if i were to keep a coulomb of charge over there a coulomb of charge let's say at that point it would have 300 joules of potential energy less compared to when this is at infinity and we've talked more about this in our previous videos on introduction to electric potentials and potential differences so you need a refresher feel free to go back and check those out but the goal of this video is to figure out how to calculate these values how did we know this was positive 11 for example and how did we know this was negative 300 how did we know it was negative so how do you calculate these potentials all right so to do that we can go back to our definition one more time so potential at any point potential at any point a with respect to some reference is basically how much potential energy that charge has at point a with respect to reference which in our case is infinity so compared to the reference per charge because we are doing it for one coulomb so i have to divide this per charge and so all i have to do is figure out the potential energy difference if i can do that i can calculate the potential so that brings us to the next question how do we calculate potential energies hmm well i like to go back to my gravity how do i calculate potential energy when it comes to gravity i used to remember the formula mgh it was very famous but i don't want to do that i want to use concept basics fundamentals so how would i calculate or what does it mean that my potential energy of one kilogram is 11 joules what it what does it mean going back to basics it basically means that that 11 joules of energy is stored up and if i were to let go of this stone as it comes from here to the reference point which is the ground it loses all that 11 joules and it gains kinetic energy so it gains 11 joules of kinetic energy again per kilogram because we're defining it for one kilogram so what i can say is ah if i want to calculate potential energy at any point just let go of that and see how much kinetic energy it gains when it reaches that reference point whatever kinetic energy it gained that number itself should be potential energy because that must have been stored up does that make sense so let's write this down because we'll do it step by step slowly so what i can say now is this number should equal how much kinetic energy was gained or i'm just gonna write gain as it moved from a to reference point as it moved from a to reference point per charge so before we continue let's just hold over here and see if you can use this definition to think about to realize when we have potential when the potential will be positive or negative so when you go from your point your preferred point to the reference point if you gain kinetic energy it'll be positive and that's why we got over here positive number and it went from here to here it gained kinetic energy but what if this number becomes negative then the potential would be negative the example for that would be in over here if the reference point was above now think about it now when the rock is going from here to here first of all it doesn't automatically go you might ask how can gravity how in gravity rock would go from here to here how would it go up well you imagine you don't you didn't drop it but imagine you threw it up that's the that's the trick you imagine it's being thrown up now when it goes up it slows down it loses kinetic energy and so this is negative and therefore potential over here would be negative with respect to this point does that make sense pause the video and think about it okay does it make sense to you oh yeah let's follow the chain of thought as it goes up kinetic energy is reducing means meaning potential energy is increasing therefore this point has more potential compared to this and so this point has less potential compared to this and so that means this will be negative potential so makes sense right same thing happens over here now can you pause and convince yourself why over here will get a negative number pause and try all right if i were to let go does it go to the reference point infinity automatically no it gets attracted so i throw it away just like over here and when i do what happens to its kinetic energy it reduces because it's of the attraction it reduces and if kinetic energy is reducing you get a negative number here that means the potential is negative and see if it makes sense follow the chain of thought if the kinetic energy is reducing that means potential energy is increasing so at infinity you would have maximum potential energy and so the potential energy over here would be less compared to that of infinity giving you a negative sign okay but what now we can dig one step deeper and ask hey but how do you calculate this how do we calculate how much energy how much kinetic energy is gained or how much kinetic energy is lost how do you calculate that and for that we use our work energy theorem something that we may have learned a long time ago work energy theorem states work done equals gain in kinetic energy so what i could write over here the gain in the kinetic energy would be same as the work done by which force the force of gravity here are the force of electricity so i'll just write force of electricity work done by the electric force in moving it from point a to the reference point and again per charge and again let's come back over here and see if it makes sense so if i want to calculate how much potential energy i have over here i need to figure out how much kinetic energy is gained or lost as it goes from here to here but to do that i have to calculate how much work gravity does in moving it from here to here and how do you calculate the work done by gravity or how do you calculate work done by any force you calculate it as the force multiplied by the displacement so all you do is figure out how much the force of gravity would be so maybe the force of gravity is downwards multiply that by the displacement how much the displacement would be and that number would tell you how much kinetic energy is gained and that number would tell you how much potential you would have the same thing would apply here as well if you want to calculate how much potential you have at this point figure out how much work is done by the electric force in this case the electric force is downwards but you move it all the way to infinity so you have to move it in the opposite direction so this is the electric force and in doing that figure out how much work is done now you might say hey but infinite distance means is it infinite work no because remember over here things get a little little complicated because as you go away the force itself starts changing and so you can't just multiply force and displacement you have to integrate it and something don't worry we'll not do this in this video we'll do it in a future video but you get the point and notice over here work done by electric force is negative as you go from here to here and we already knew that because it's negative we're going to get a negative potential now actually we're pretty much done because we now found a way to figure out potentials all we have to do is calculate work done by the electric force and moving it from that point to infinity per charge and we're done but sometimes you will also have external forces acting on you and so there's another way to define electric potential in terms of work done by the external force let me just introduce that because your textbooks tend to do that it's not necessary you don't have to do it I don't usually use that at all but let me do that anyways let me just define it anyways so that things are clear let me just get rid of this all right imagine that when we are moving this rock from here to here imagine we're not just dropping it let's say we are holding it in our hand and we are slowly moving it down slowly and steadily without any acceleration we are moving it down then my external force the force that I am putting on the rock would be upwards would be upwards let me write the external force with this color okay this would be the direction of my external for this would be my external force so it makes sense because if it was not upwards it would just it would just fall down very quickly I want to move it slowly without any acceleration then see what would happen then my force would exactly equal the gravitational force but it'll be exactly negative and so the work that I did would be exactly negative of the work done by gravity so I can also see and the same thing would apply here okay even here what I could do is instead of instead of throwing it and just allowing it to go slowly what I could do is I could put an external force in the opposite direction exactly equal to the electric force this is the external force and slowly without any acceleration move it from here to infinity and in doing so the work that I did would be exactly opposite of the work that electric field did and so now I could also say that this is also equal to the negative of the work done by the external force in moving it from point A to the reference point so it makes sense per charge per charge what is that okay per charge all right but there's a caveat there's a small detail I have to move this without any acceleration so conditions apply no acceleration because if I accelerate let me show you if I accelerate then my force will not be equal to the electric force then my work done will not be equal to the work done by the electric force then this this will not hold true so only if I do it without acceleration the two forces will be equal and opposite and my work done would be exactly equal to the negative but in number exactly equal to the electric so I can also use this definition so I can also say potential at a point I can also say it is the work done is a negative of the work done by the external force in moving it from that point to infinity without accelerating finally what your textbooks do is they say look I don't want to define in terms of negative so how do I get rid of the negative sign and the way to get rid of negative sign is actually quite simple see if you do when you are moving things down if you're doing a negative work then when you move things in the opposite direction you will do positive work right so instead of moving it from a to r you move it from r to a and then the negative sign will go so let me just write that down we can also say this is equal to work done by the external force in moving it from r to a per charge and I know it's a little crowded so excuse me for that these two are the same things and let's see what this means this means if I start with gravity because it makes sense it says if you want to calculate potential at any point a find out how much work is done by an external force in moving it from ground to that point per kilogram does that make sense yeah if I want to find out how much potential over here is take a kilogram move it from the reference point to that point a and whatever work you did that will be stored as potential that makes sense right the same thing applies in the charges as well and that's why your textbooks define it as potential at any point with respect to infinity they don't mention that but that's always with respect to infinity equals the work done by the external force in moving a coulomb of charge from infinity to that point without any acceleration and now I know there is a lot of things introduced so it's going to take some practice to get used to it but we now have so many different ways of calculating potentials my favorite is just doing this this is my literally my favorite this is the easiest I don't have to worry about external forces but yeah you can use these definitions as well


Hey guys, so here I have the He-In mid, the Hayate-Atsu Soft, and the Aqua Control Plus. The He-In was actually an artisan shooting guy, but I wore it down to coding. So I paid around 50 bucks for both the artisans, and I paid 30 for the Aqua Control Plus in the square size. I know that they're expensive, but trust me, it's worth it. I recommend ordering from X-ray pad and the artisan website, because it's the cheapest stare, and the most reliable. As you can see, the Aqua Control Plus is way bigger than both the He-In and Atsu combined, and that's just because I have them in medium. Alright, now let's try them with my Def Outer V2 Pro on core pads. The Atsu is definitely the smoothest, then the He-In, then the Aqua. The Atsu feels so smooth, and it kinda feels like a cloud. It has the same stopping power as my old muddy $5 mousepad, and yet it's still way faster. Very impressive for a pad with no coding. All of these pads also don't have a coding, which is great, because they were last few years guaranteed. The Atsu also has a zigzag design, and you can see it in some lighting conditions. I'm not sure if it helps with the friction, but it definitely makes it really comfortable. I would say it's the most comfortable out of all three. Maybe that's because it's the only 4mm pad in Dipnis, but the Atsu is still the most consistent. It has a really good balance between speed and control, while maximizing comfort. This makes it the perfect pad for tracking. I feel like I was pointing so precisely at every frame in-game. Next, let's talk about the He-In. I have this in pink because it used to be a sitting card. The He-In is definitely way more rougher because of the texture of the pad. I also got the mid-virgin, so it's a little bit thinner, which would also make it rougher. It's definitely faster than the Atsu, but not too fast, so it has some control. It was really easy to move and aim, and took me zero effort. Although it isn't as precise as the Atsu, it's still a really fun pad to use. My only problem I have with this is that the X and Y difference on the mid I have is slightly noticeable. It doesn't impact my game, but it could still take some time to get adjusted to it. I know it supports this favorite pad, and it's really good for Fortnite and fast paced games, but I prefer the Atsu because I play Valorant more. I know that the Xero is also a great option for the average cloth pad user. Anyways, both of these pads are the best of the best when it comes to durability with the stitching and the rubber base. The stitching is below the pad, so when your mouse pad goes off the pad, you don't feel like there's a bump in the stitching. The rubber base is also really sticky, and really high quality as well. I don't know how to make that. Just add some water under it, and it's going to stick like crazy. Now let's talk about the Aqua Control Plus. Right off the bat, it feels really similar to the Heian, but a bit slower. It's rough, but has the speed of the Atsu. For some reason, it feels more inconsistent, like some parts are slower than others. Maybe it's just because it's my pad, but I think it's because of the rubber base. Some parts of the base are more worn out than others, but on the artisans, the rubber base is all even. That just shows how high quality the artisan pads are. Still at $30 for a pad, it still has really good stopping power and really decent speed. And it's way more worth it than my $5 Amazon mouse pad. It's faster, yet has more stopping power. It's not as comfortable as the others, and it can get rougher. Finally, the packaging is different. The artisan mouse pads ship flat, so when it arrives, you won't need to deal with it curling up when you're playing. The Aqua Control Plus ships curled up, but after a week, it went totally flat. So in conclusion, should you pay double the price for an artisan? Well, I think that the Aqua is still a great pad if you don't care about the stitching. It still has the fundamental things like good stopping power and speed. If you're willing to pay more for the comfort and consistency, go for it.


Allah SWT says in the Qur'an say, oh my servants who have transgressed against their own souls asrafu ala anfusihim who have utterly corrupted themselves, la taqnatume rahmatillah, never ever despair of the mercy of Allah SWT. It is impermissible. It is haram, just as haram as drinking wine, eating pork and fornication. It is haram to despair of the mercy of Allah SWT, to be in a state of qunud of Allah SWT. La taqnatume, this la in Arabic is qalla annahiya, the prohibitive la. You are not allowed to despair of the mercy of Allah SWT. Allah forgives all sins. He is the forgiving and He is the merciful.


Um, all right. So based on that we'd love to turn it over to folks in the audience So my question or also kind of comments to g about the programs that nova in particular is doing Where I come from western new york our community college Does a lot of uh influence in high schools with college credit courses And they have a two plus two program which transfers almost anywhere and The partnership with the SUNY system in new york is incredible as well Do you think increasing those programs is Going to help be more adaptive to different students And is that something we should take into our higher Take into account in our higher education policy going forward I think you know, I bring up virginia and you know, there are myriad of the other examples like for example, california The uc system Just announced that they're going to be taking more community college graduates as part of their incoming classes I think when you We need to provide students and families with different options Especially options that are cheaper than they have today The reality is is that you can go to northern virginia community college and graduate and then transfer to uv and transfer to uva And it's significantly lower cost than you would if you just did four years at uva And I think you know cost is becoming a driver and you know, I think policy makers Should take that into consideration and really be pushing, you know institutions to have that conversation about how do we open pathways? you know, this is like how does a student at you know at And at aims community college, which is in really, colorado Do they have a relationship with you know, colorado university of boulder, you know, or csu I'm sure they have one at csu because they're right across the road but You know, we We want to help Like I mentioned we want to meet students where they are and help them progress through And I do think ultimately of the day if we really do want to strive to get individuals to Place where they have an advanced degree We should give them afford them that opportunity whether or not they stop at an associate's degree or if they continue on to a baccalaureate degree And I think making sure that the door doesn't Shut at the bachelor's degree path So I think there are lots of innovative programs and a big push to start your education In a community college And pursue your associate's degree and if you want to to transfer those credits and have them be fully articulated to Usually public four-year school locally and a lot of these partnerships work that way The problem is is that even though it is affordable for two years to attend the public two-year school You'll save some money that way the door could still be shut even if you wanted to transfer to a public four-year school afterwards and even if that's your intention because um A lot of times the aid is still not going to meet the difference when you enter even as an in-state student on a public Public four-year campus. Um, so we know that the Pell Grant covers tuition at most community colleges Is that right just tuition not all those other things? So I want to point that out But not the total cost of attendance not the total cost of attendance Which we know is actually very very important to success because you are one carburetor away from Having problems staying in school however That Pell Grant isn't even going to cover You know most of the cost of just tuition alone at a four-year college Public college and university and so I think that's where I start to get a bit worried about like the pathways are great that we're creating I think community colleges are a great place to start Or stop if you want just the associates degree But for those students who do want to go on and get the bachelor's degree We have to make sure that there is funding to continue that path that isn't just going to be reliant on a debt financed Model predominantly, which is what it feels like the system is turning into if you want that bachelor's degree I think we also have to be aware. I mean have a big support of community colleges But we have to be aware of the reality that rather than just the theory Of starting at a community college to save money in transferring because Many many students say they want to transfer to get their bachelor's degree when they start a community college Far too few actually do that unless we can create the same kind of culture of success and completion At a community college that we've created at the four-year residential campuses It's a mistake to tell people to go to a community college if they can get into a four-year We should tell them, you know, you're better off if you start there because it's more likely you're going to graduate That's what we've really got to address. Otherwise, we're sending people through an open door where there's not an open door on the other side They go in there. They use up their eligibility. They take on debt and they don't move on and we just got to be Honest about that Yeah, and I will give letty who's the osa shout out because she's in the audience again for her work from the Campaign for college opportunity. They did a big report out of california that showed exactly what you were saying that transfer students That started at a community college Only four percent had transferred within two years a quarter had transferred within four years And only 38 percent had ended up transferring to a four-year school within six years Despite their intention at the beginning of doing so so because they really Can you hear me? My name is katie seen. I'm from the association of american universities And my question is about cost. So as you said Costs of higher ed is much higher. Um now than it was for a baby boomer What are the fact? Well, did the survey get at this question of what is the public's perception of factors that contribute to the cost? Um, and then if not, do you all have views on what those factors are and policies that can Help make college more affordable We did not in the survey And we know that there are a lot of cost drivers on the public side Primarily its state disinvestment and sometimes states have their hands Tied dependent. I mean we've seen a lot under a lot of republican legislatures A lot of movement towards being Cutting taxes and then never being able ever again in colorado is a good example of this being able to ever raise tax revenue And I think like kansas, you know extrapolated out in 10 more years is going to be a complete disaster Because they just are moving to like no tax revenue And you're actually seeing a republican legislature in kansas pushing back And saying we actually do actually as it turns out need revenue in order to make the state work And so I think on the public side when I talk about how the public four-year Institutions have gotten really expensive and the the Pell Grant hasn't kept pace I mean we've seen increases faster than the rate of inflation Across the board, but especially in that public four-year sector I think what's interesting is that we've also had some data that came out of new america that showed that a lot of four-year institutions Raised their tuition rates above and beyond The decreases from state support. So there's a question of Almost what ruth said with some of these in the previous panel. Where are you? What's going on with the money? Like where's this money going? What are you spending it on? Why like like we understand the state disinvestment thing But why did tuition go up? More than that is the question. What are we getting? So I think there's a lot of scrutiny There's also I mean things that people don't talk about when they talk about the rising cost of college Are things even just like technology The human personnel infrastructure in place Support services Those are all going to drive so on the private side Those are also going to be the things that are driving cost up. I mean even things like electricity Oil all of those things that we if that are not like sexy ways to have a conversation about like what's going on with higher education funding But relate to the cost of college, but on the public side it is primarily that state disinvestment That we're seeing the higher tuition rates That is part of it, but the other parts are that as Institutions take on more low-income students. They know they need to provide more institutional aid So they come up with a model of high tuition high aid It really hasn't resulted in more low-income students getting to those institutions But when I've talked on a for on private Not for profit campuses and students ask me Why college is so expensive? I mean the fact of the matter is they want it to be they want things That cost money and it impacts low-income students But if you ask an average upper middle class family, where the kid's going to go to college It's not the college across the street In fact, they go on college tours and the kids visit lots of campuses and the things that stand out Are things that don't really impact their education But impact their experience and they want that experience And so those are costs then they get distributed across all students and it really makes The elite schools and even the state public flagships much more unaffordable For low-income students, but we have done that to ourselves Yeah When it's an interesting question that you ask that because it's like if you take a I know a number of like the flagship institutions will note that for example when we've had state disinvestment They've done a couple things they've raising tuition They've increased the the share of students coming from out of states They've increased their share of students coming from overseas as part to bolster up students Who are not receiving a subsidy from uh for state tuition? So what does that happen when you're when your institution becomes let's say 80 percent Californians coloradans to 60 percent 50 percent That also then drives tuition up more because your state legislators are going to give you less money because you're serving less students from your state And so uh, you see that one for an example with the uc system You see announced that they were going to take on more community college transfers They're going to take less more that we're going to take less fewer students excuse me From uh, you know from out of state otherwise Because this is something that legislators really do also need to push back on it's like we'll give you additional resources to serve more state students Uh, and I think that is a broader conversation that state legislators should have because like Ultimately at the end of the day institutions are entrepreneurial. They're gonna have to meet a but make a budget They have thousands of individuals that work on campus. They have uh, and you can't make your you can't balance a budget When you're getting pennies on the dollar and you know, you have to find resources elsewhere Let me just I misspoke when I say institutions are Competing for students. They're competing for the full pay students. That's who they really want especially the non-residents and University of colorado at boulder is a good example fewer than half of their freshman class are actually colorado. They've gotten uh Latitude from the legislature to accept up to 50 percent of their incoming class can be non-residents And then they recently got approved from the legislature to not count international students as non-residents So when you add in the the mess or the us non-resident and the international, you know Where they're taking in 60 percent from outside of colorado But you're saying we have to do that legislature because you haven't given us the money and we need it And so that's why CU has things like a buffalo shaped swimming pool. I'm not sure That's helping You know low income people get a better education, but or it's attracting somebody or increasing access One more question very quickly. So we'll go right here Thank you, um, this whole notion of re I call it resegregation On the college scene this thing about um A lot of white students from wealthy families are going to the elite schools Then you had the black folk and hispanic folk relegated to community colleges Or one of your schools and the question is how do we solve this situation? This resegregation One minute One minute Uh, you know, so I just had a paper come out last week that looked at the parent plus loan program in specific and The borrowing rates of white families for that loan versus black families and what income levels they're coming from And it's cleared that The parent plus program which was really designed to help send dependent students who are sort of upper middle class to college And therefore predominantly white is being utilized in a different way than black families In that a lot of black families are spending that have you know, zero expected family contributions Our low income are borrowing significant amounts of not only student loan debt, but parent loan debt We also know that there's a lot of data coming out That show that the outcomes of black Student loan borrowers of federal loans are not good even when you get a bachelor's degree So one in four still are going to default on their loans And so a lot of that is the institutions those students are attending but also they're entering into A labor environment that's discriminatory right and the types of institutions that they're able to even attend in the first place We're going to look very different than the access to institutions that white and wealthy or individuals have um, and so All this to say is I'm not So I think like the moving towards this debt financed model to having the only Most affordable option be only the two-year option is really the wrong direction for an increasingly diversifying student body We even have seen data as of last week that show that latino students are are which we already knew But we had data not approved that latinos are a growing share of undergraduates We have to make sure that we have an affordable and high quality by holding institutions accountable pathway for these students Um, and it needs to be funded more through subsidy Either directly to the student or directly through the institution instead of a debt financed model Which actually is just going to sort of carry over the problems that we're having in this segregated higher education system Where there are families that are more reliant on debt are entering Um, a labor market that looks very that whose outcomes look very different depending on the color of your skin Um, and then they're expected to pay this debt back Um, and that they have to go to higher education because um, they're gonna see return on investment I don't want the conversation coming out of this to be don't go to higher education My fear is that we're moving in that direction. Well, maybe we shouldn't be making loans Or maybe not everyone should be going to college Um, but that's just going to make the problem even worse It's just the solution looks differently and it looks more targeted. I think um, than what we're currently doing The elite institutions would say what are you talking about? We are more diverse We have both rich white students and rich black students, but they're not really Diverse in the way we would like them to be in tamarot an article in which you emphasize using federal dollars To both reward and penalize institutions that aren't Doing their fair share. So if there's a lead institutions, that's not Say a state flagship that's not serving truly a diverse population. You can withhold federal dollars and You know, that's what institutions listen to So with that, I think We're two minutes over Everybody's time. I know lunch is imminent for most of us. So, um, I want to give a round of applause. Thank you very much Thank you Any other completing remarks, so