Test test. All right, I want to thank everyone for coming. We're starting off the Open Sousa Summit today. And we'll be in here the entire day with various different talks. And I'd like to start off the summit with Harry Schoen. And he'll be talking about, OK. Oh, I don't know. This button would be. And if you have any questions, please come and talk with me. And if you registered on events.opensousa.org, come please see me later, all right? OK, I can't control this other. This is not for my notebook. This is the site or whatever. So this is my presentation. I did want to post up the abstract again. So my name is Harry Schoen. I'm from Intel Corporation. I'm part of what used to be the UFI team, or the team that actually built and constructed UFI back in the since early days of itanium. And this session talks about, really, network boot, how we do network boot in UFI. So we'll talk about this in detail. Switch back to the presentation here. So this talk is sort of our push to talk to the open source community on using the network stack that we've put inside of the firmware that should show up in most of the PCs, both server and consumer systems that you have these days. We had the code out there for quite a while, so we would like to evangelize and get out into the public or the open source community to get off of the old PXC boot or network boot constructs that have been around since the early PC days and move over to our network stack that we've made available on TienaCore and has been available there for a very long time, but trying to get the open source community to come out and actually use this. So there's a variety of reasons why you may want to use this particular network stack from the pre-boot space, and we'll cover that in the talk here. So as part of our agenda here, we want to go over the current state of how we network boot from pre-boot space or from firmware space today. What are the limitations with that legacy model? Talk about the more modernized UFI network boot, how that works, the basic stack network stack that appears in the source code and then the spec, and then some use cases of why you may want to use this. There's some both security and functional aspects of why you might want to use this, and then a call to action. That's the reason why I'm here is to try and get the open source community to come out and actually utilize this network stack in the deployment of your Linux distros and server software, whatever particular OS or backup software you're trying to write. So my role in this typically is to evangelize with the open source community and try and get people to both educate and use the UFI, ABI interfaces, and actual products. So reaching out to the developer community to get them to pay attention to what we put in the UFI specification on UFI.org and to also get you guys to actually working on real open source projects and code to actually utilize what we put up on TN Accord.org in the EDK2 project. So we'll first go over a list of the current state of the art, what's in shipping out there today, what you find in the typical server, there's server systems and your typical client consumer systems that are out there on the market today and then move on to the stuff we put into UFI. So this is sort of a history lesson. The current state of what the industry uses today is something that was invented at Intel underneath the Wired for Management specification. So originally PXC boot was designed by IAL, part of our architecture group, to put another network connection into a server or enterprise class system that would give you a backend connection into the system so that if you booted to that connection in the system and a private network that you'd be able to deploy the OS, bring a bare metal system up from nothing, nothing on the storage, nothing in the system to having an OS or whatever firmware or software you wanted to deploy that system with. So in the early days, there's typically a NIC card Intel makes NICs, right? You would put that, plug that into the system or lay it down on the LAM and be able to boot to your private network connection in your enterprise, your data center or in a private network to deploy the system. So the Wired for Management spec was released down the early 90s to the manufacturers, OEMs in the PC industry and people have been making these 16-bit undie option ROM NIC cards for years. You still see that today on a lot of the NIC cards that are out there for X86 and hard PC and other architectures. So it's been around for a very long time and all the infrastructure that you see today uses this to boot. A lot of the cloud computing still has deployment software that uses this legacy PXC. What we call legacy PXC is 16-bit option ROM code that your PC runs. On your typical PC, you may have a special key in your BIOS F8 or F10 or something like that. So if the physical user presses that key while you're booting and through the BIOS then you come up and launch that option ROM that was dispatched during post and then start that network stack and boot to that. So your local BBS or your BIOS setup will say there'll be a network boot option which boots PXC in the system. Now that requires some infrastructure put in place and this is a typical setup you'd have on your little private network. There'd be a DHCP server that you have to configure specifically for PXC boot. It has to advertise where the PXC server is on the network and also advertise the architecture type of the network boot image that you're going to post whether it's i32, x64, itanium or arm64, whatever it is that needs to be in the DHCP packets to notify the target boot device when it asks for IP address what is available out there if you're going to PXC boot. There's also the PXC boot server which you need to deploy.  So up in the right hand corner this is taken out of the wired for management spec. These are the exact steps between the DHCP server as a client when it says go run the option ROM and go do a PXC boot from your BIOS post.  So step one is you go out to the DHCP server and say go get me an IP address. And then there's an act that comes back and says, okay, here's your IP address.  If you do, please give me, acknowledge that and then tell me where that server is on the network, the IP address, and then also advertise what available architecture option ROMs are available on that system.   So typically if you're installing an OS like OpenSUSE or some Linux distribution or Windows, WinP or something like that, this is the sequence you would go through to actually run the deployment software, the install software setup program to go off and install the OS on the system. So after the bottom of the page there, once you load the MVP or the installation software, the OS, then the kernel runs, the local OS drivers take over the system and then you're running Linux or the deployment software, whatever that package is, and the BIOS is really not doing any of the actual work of pulling anything off of the network. So once you hand control or off to YAST or Anaconda or whatever your favorite installation program is, we're not, the BIOS is really not in the loop. The OS native drivers and kernel have taken over and are providing all the network services to do the rest of the installation, pulling over the necessary files to install the OS. So there's something called also IPXC, if you talk about enterprise servers, a lot of people run IPXC where you take the option, the IPXC option, put that on the NIC card or include that in your system as a plugin card or flash it into the BIOS on the system and that has an additional scripting language which then allows you on a more complicated network to go find various deployment servers and go off and hunt down the deployment software that you wanna actually deploy onto your blade or particular system.  So that's sort of the state of the art. This is how most systems work today. Remember in the 90s, this is designed long before virus scanners were invented and people worried about rogue things running on your particular network. So when we talk about a network boot environment, zero trust environment, we're talking about booting in an environment that is not necessarily friendly. We've separated the networks. Typically there's internal networks or VPNs. There's not the, you're not sitting on the open internet or sitting on a hostile network that may have access points or Wi-Fi or things like that where you may not have physical control over all of the elements that are on your network. So there's some basic limitations with the current PXC model today. We'll first talk about one, does it scale to large networks? If I have 1000 servers or 10,000 servers in a network and I initiate, they all turn on and they all do their PXC boot all simultaneously. If you look at the underlying, we use ARP and UDP packets due to all of this exchange information between the DHCP server and the PXC server, you'll find that on most networks that you have thousands of servers each individually asking for that exchange we just talked about, you'll bring the network to its knees very quickly. On a, you only typically get 60% of the bandwidth on a one gig or 100 meg connection, right? So you figure out the size of the network boot file that you're pulling in Linux, Grub 2 is only one meg or whatever, but when you start looking at the actual deployment file that you need to deploy, if it's 160 meg or in Windows case, it could be several gigabytes or whatever it is, pulling over that initial network file over your network, when you have thousands or tens of thousands of systems doing that, you'll find that you won't be able to sustain that bandwidth, basically. So you have an underlying scaling problem in a large network that the typical switches and routers are not designed for scaling out large amounts of UDP and ARP traffic. So we found in practice, we found most people have to bring the packet size down to the 802 out of three packet size to get it through all the switches and routers in a more complicated network. So that's typically what 15, 30, 384 bytes or whatever it is. So now you have to hack and knack individual packets that are about 1.5K across an entire network, transferring with TFTP, anywhere from a one meg to 160 meg file. So this is not very usable in a large environment. So I don't hear about large data centers using this to scale out and on an individual network, boot tens of thousands of servers, right? We hear about people switching the packet size to 32K to get rid of all the acts and acts. There's something called FAS learning tree that the Switch Cisco, ACADLIS, all the switch routers implement, which gives you the fastest path through the network and they typically do not route UDP and RRP packets efficiently using that FAS learning tree method on the first boot. Typically it takes several boots for the routers and switches to implement that and figure out where your client system is in the network. So there's a lot of limitations. The networks were not designed for UDP. They're more designed for web traffic, TCPIP and that's sort of part of the network stack. If you're in a corporate network or in a network where there are hostile elements on the open to the public or in your network where you don't know necessarily, IT doesn't have control over every system that plugs into the network or the Wi-Fi, you have to modify the DHCP server to do that initial transfer of advertising where the PXC servers are at and doing the load balancing of which clients end up responding to the PXC queries. So typically what happens is the PXC clients advertise to the DHCP server that they're there on the network and whichever one's closest and responds first to the client wins. So you don't deterministically get to choose as to which PXC server will respond to the request from that undie option ROM or that initial PXC boot from the BIOS, it's just whoever answers first. So on a network that is not balanced or tuned, that could be a severe problem. You also have a security issue in that anybody can create a PXC server and there's nothing that will stop you from booting to that rogue PXC server on a network. Even put it over Wi-Fi if you wanted to, right? So there's a lot of inherent security issues that were never anticipated. The original, as I mentioned before, the original wire for management sec was designed for a private network that you would add to a server or a client system and that network would be separate from the main network that you would normally create or use in your infrastructure enterprise. So there's a lot of issues with the legacy model and it was designed in a day that was not cognizant of security, it wasn't a concern at that point, at that time when it was designed and the PXC services and that sort of thing were done with very small images that didn't necessarily scale to large numbers of systems. So these are some really basic scaling and security limitations that we were looking at when we started inventing or creating the UFI network stack. So just keep these in mind when we start talking about the next thing. Well, here's the zero trust network statement. So some of the marketing people are evangelists who are talking about, you know, we have all these secure teams now revealing all of the firmware code as a standard process that we have within Intel and a lot of our customers. So they pulled this quote out from CSO online saying you can't make that assumption that when you boot PXC on a network that you plug into these days that this is not an environment you should necessarily trust implicitly. Just let any PXC server take over your system and be like walking outside in the street and say, hey, you wanna help me set up my network and OS installation on my systems? I mean, just walking out the door and asking the first person that comes along that responds to you is probably not the smartest thing security wise to go do. So now we wanna add some additional trust anchors and find a security model or a network stack that allows us to apply some sort of security to the system that we're doing to the modern systems that we're producing today. Okay, so starting from UFI we took a look at that network stack and early in the 2010 or eight days went through and decided that, you know, maybe it'd be a better idea. And when we look at the OS network stack to adopt a stack that's similar to what the internet uses today, the TCPIP stack that you see that's been around for a very long time. So in the specification, we created a UFI networking model. There's a whole section of the spec dedicated to that. The first thing we did was you duplicated PXC boot. So we do the same thing as we do in legacy on the wire except that we do it with UFI drivers and use the UFI driver model and API interfaces instead of the legacy BIOS. And then we also added from the very beginning of UFI we added secure boot out something we implemented. There's something called NECC phase that allows you to boot the firmware securely. There's choke points within UFI that you can go through and check the images and make sure they're signed before you hand off control blindly to something you're executing in the pre-boot space. And then we ported in addition to duplicating PXC, we also ported HTTP or HTTPS to our network stack. We've added that since UFI really 2.5 or a little bit before that. So you can do a secure connection out to the network over URL, adding DNS services. So taking a look at the new network stacks that were added starting from UFI 231. So in 231 we added the UFI PXC boot duplicating off on the wire what is done in legacy PXC except now through UFI. So on the left hand side, you can see the original IPv4, that's what all the legacy PXC does today. The basic stack that we use, I'm sorry, this is the new network stack that was released with 231 that duplicates the PXC boot services you see on the wire from a typical PXC server. So the only thing we had to change was in the DHCP, the advertisement, we had to add some new IANA architecture types for the SQL image to be UFI A32 and X64 and ITNEM versus the legacy architecture images. So you know the MVP coming over is a UFI image versus a legacy executable, an I32 or an X64 executable. So these network drivers were all included in the initial network package on TNL Core and implemented in most of the system biases today. So your typical Linux distribution or Windows distribution would use this UFI, consume this UFI PXC network stack to install the OS or do a PXC boot from a server, PXC server somewhere. So one of the things we did add in the initial implementation in 231 was IPv6. So we created a parallel stack. So in addition to the native Undy driver, the Nick Undy driver that is ported over to UFI that produces the MMP stack, we added an IPv6 stack. And then I had that taken to UNL, University of New Hampshire and then run through the full IPv6 certification tests at IOL. So then we would have both an IPv4 and an IPv6 network stack. And depending on what you chose in your BDS and your particular UFI BIOS, you could pick which stack or which option in the boot option list you wanted to, which network stack you wanted to boot through. The reason why we added IPv6 was the server vendors and a lot of the data centers and enterprise clients came back and said, you know, we're moving our internal networks to IPv6. We've run out of IPv4 addresses. When we talked to the storage guys, people making large sands and you know, fabric channel storage and that sort of thing. They said we have thousands of LUNs on the network. Each has its own World Wide ID. We've run out of IPv4 addresses in the data center if every single drive has its own IP address, right? So in a large data center with, you know, tens of thousands of drives, you can't have IPv4 simply just not large enough to handle all the possible boot targets out there. So they asked us to put IPv6 in there so that we could address all of the storage that would be out in the typical data center. So that was to address the concerns we had with the data center. So that was the first implementation of UFI migrating it over to the existing PXC model that exists in all of the deployment software back in the day. You know, this is the stack and typically you can get this today in most server systems.  In addition to PXC, we also added iSCSI at the request of the enterprise server people because typically those sands that are out there typically have a World Wide ID LUN and the storage is sitting in racks separate from the compute blade or nodes. So they wanted away for us to name, you know, the actual LUN in storage device, World Wide ID of an iSCSI or you know, physical LAN storage device out in the data center somewhere and put that through legacy PXC. So this was the sort of answer at that time back in the early 2.3 days when UFI was first adopted by Windows and Microsoft and then the Linux distros as well. This is the first instantiation that we implemented in the firmware stack and got this into most of the servers out there. So typically for client systems, you don't have iSCSI, you don't have, you know, network boot is not typically a normal mode of booting on a system. So there's really more of the enterprise server devices, servers that went out there and implemented this particular piece of the stack. So from here, you can see in the red dotted line area, the chunks of UFI, DXC drivers, what we call them in the network package that you'd have to implement and port over to your particular BIOS. All of these pieces are standard, you know, they don't need to change from system to system. The only component you would need to change is getting for your particular hardware, the undidriver for your particular NIC card that you're applying on booting off of, basically. So this sort of eliminated, you know, major reports that you'd have to typically do on different platforms and all you had to do is go find a NIC card or the NIC manufacturer that would post their undidriver basically for UFI to be able to be X64 format and have that included in your system BIOS in your server. So this sort of standardized, a lot of the stack eliminated, a lot of the work importing just by having this going to find your local NIC vendor and getting your undidriver included in your network stack in your particular firmware for your system and you have your full stack that enables you to boot UFI, PXC, or iSCSI on your system. So moving to the models that we used, like I said before, a lot of the UFI PXC boot and iPIXC boot was using IPv4 or IPv6. That was the main migration in that period of time. We still have all those same limitations we just talked about before. A lot of the limitations with the scaling and the scaling and the security issues were not solved. This is just getting people to move over to UFI first. The only added security feature we had at this time was UFI secure boot where we would go off and when we got the MVP image off the PXC server we would check to see if it was signed and if you had secure boot turned on and you had the cert for your particular in your system in your DB we would check the image, the MVP image from the PXC server and make sure that it was signed and match the key that's in the DB for UFI secure boot. So if you had the, typically it was the Microsoft key or the UFI CA key for the shim that signed for your particular Linux distro we would check that image and we would not hand off control to the MVP unless we saw that signature on the MVP file that was handed off from the PXC server.  So it didn't establish a chain of trusts with it whose PXC server you're booting from but at least the image that you're executing off of the PXC server you would check to see whether it was signed or not and from a trusted source that you wanted the system to execute. In UFI 2.5 we started moving forward with some more concerns about scaling and using a more modern network stack and getting away from using PXC servers. We'd like, there was a request saying well why can't you boot off of a web server? A standard URL so I don't have to alter the DHCP services at the front end of the network. Most IT departments won't let you change or alter the DHCP server they have to keep track of all the PXC servers in the network and deciding whether they wanna allow PXC servers to boot network images on your particular network. With the growth of all the networks in the system in the Wi-Fi I mean it's very difficult to control who's on your network so that's not really a good thing. So moving over from PXC to a standard web server booting off HDP, a URL or an IP address would be a little bit safer that I can then from the user boot options pick the specific URL and transfer and control of where the MVP was coming from off the network and allow you to boot off a specific file off of a known web server that you trust or that's hard encoded into the BIOS if it's for servicing. So the newer network stack we looked at the OS driver stack and started pulling over the pieces that we needed to implement basically TCP IP. So if we look on the right hand side over there we still have the standard DHCP and services that we typically use to get an IP address off a network, off a DHCP server but now all we care about is just getting a normal IP address. So you can do your standard static or dynamic DHCP acquisition of IP address and then from there implement DNS, the underlying TCP and HDP stack you needed to be able to talk to a web server on the network. So we spend a bit of time getting that working. Initially it was HDP without the S, without the field cert. We'll talk about that a little bit later. So at a minimum we wanted to be able to boot off of a specific URL or a web server somewhere on the network. You don't need to alter the DHCP server advertising where the HDP servers are on the network. You can do that if you want to. We have provisions to duplicate the PXE services of model but you could also just boot off a straight HDP or URL server if you did not want to ask the DHCP server where the HDP server is in the network. So that requires on the left hand side some of the basic HDP driver stack and we put that into the TNOCore.org on the DK2 project and in the UFI 2.5 timeframe, 2010, 2011 timeframe, we've been advertising that we can do this in the network. So we once again re-realized some of the basic drivers that were originally in the network stack. We used the same UFI on-D driver, particular to your NIC, that's hard coded to your NIC. Then we have the same SMP and MMP driver stack, the bottom that shared code that we reuse again in our network stack. So this allows us to re-utilize without having to go back and have everybody rewrite all of their firmware code for their NICs to reuse as much of the network stack as we could from PXE and continue just adding the upper layers of the stack needed for HDP boot in the system BIOS and not have to go back and to every card vendor on the planet and have them rewrite their network stack code for their NIC. So this re-utilizes the existing code, we don't need to go back and once they've moved over to UFI, they can just add the new code for the TCPIP and HDP and you would be good to go to boot off of HDP. So the different, you know, environments we're looking at obviously were the data center and the corporate enterprise server environment and then you're also your home network. So for consumers and people out there, we want it some way of reaching the end user out sitting on the open internet for them to be able to update the firmware on your system or be able to boot off of some cloud storage or some sort of network storage on your network to be able to deploy an OS, repurpose the system or whatever. So we wanted a more flexible pre-boot from our environment network stack to allow you to get at the machine and be able to boot off the network in a more modern network environment that doesn't have requirements in the DHCP server and PXE servers on the network, having web servers on your network is very common. Your switches and routers are scaled and designed for steering TCPIP traffic and hosting web servers everywhere on the network. That's not something that's particularly difficult to do and scale to a very large number of systems on your network.  The DNS servers can be combined together in your network with your DHCP server but there's nothing special that you have that you wouldn't already have there for a typical network today. So the DHCP server is still going to hand out the IP address. You have a choice in your deployment servers whether you wanna advertise in UFI, HTPS or HTTP servers with a particular MVP architecture type of X64 or I32 whatever the host MVP images you wanna host you can put that up in the DHCP server or you can put that on the HTTP server if you already know the file name and the type architecture type you're trying to boot to you wouldn't need the DHCP server for that. The thing we also add was obviously a DNS so that instead of typing in a hard coded IP address whether it's V6 or V4 you can just type in a URL name and the DNS services that we've added to the network stack would allow you just to type in a www.OEM.com or whatever URL you wanna put for wherever you wanna host your MVP files on your system, on your network. And then from UFI you just name the NIC MAC address or the specific NIC you're trying to boot off of and then URL and then you can just download your MVP file off a standard web server and then transfer control to it. So this is essentially the model that we want people to move to. It uses a more modern network topology uses standard network services that are out there does not require large alterations of your networking topology in order to support booting the N system off the network. So booting off of HTTPS requires a cert basically a TLS cert that needs to be installed on the host UFI system. That's something that in this spec we talk about how the format of the cert and where to put it in the stack but we don't talk about the actual implementation and the specifications. So a lot of enterprise servers put the cert behind the BMC for example or someplace on an enterprise server that's safe that they can get out of the band and that's one of the security issues that the security people are very worried about. Cert management and deployment of the cert for TLS is something of great concern. So when I came to the Linux foundation and asked them did they wanna host some certs? They told me well we're working with something called the Let's Encrypt project. We'd like to do our own signing of certs for TLS. They have the exact same problem up in the browsers for Firefox and other browsers, right? Utilizing that infrastructure for managing the certs would be something good that something once again the community really needs to work on providing a way to get at certs from the pre-boot space and then vetting of course of the open web and that sort of thing as to how that gets updated securely basically. So that's not part of UFI obviously. It's part of managing the open web and that sort of thing. So going to the community and asking them how the form certs get distributed and how they get formatted and where to put them and where you get them from. That's something that is obviously not solved by the BIOS engineers or the firmware people. So that's something that we, from a security standpoint we'd like to see the community step up and own that portion of the infrastructure out on the open network, right? Some of the advantages of using HGPS boot versus the PXE boot is of course we use a DNS description of where the server is and finding the file, the UFI file that we're trying to boot off of. We can use this on any typical normal network without altering the topology since most networks support TCPIP and HTTP and HGPS. We can use both IPv4 and v6 and then you're not worrying about where the PXE server is which subnet it's on. You don't need to worry about load balancing or placing the PXE server on the same subnet as the target system that you're going on. You can cross multiple subnets and routers and switches. You don't have the problems of locating, co-locating a PXE server to where the target system is trying to boot. We have some basic minimal security for UFI secure boot. So for the MVP image, we're gonna check the image, the signed image before we transfer control to it. And then once you get HGPS, we can also vet that we're actually booting to the URL, to the actual website that you're trying to get to once we include the ESSERT in the system and in the network stack. So if you combine this with a RAM disk as well, UFI has a RAM disk as well as I believe Linux has a RAM disk as well, right? You can then not just copy over the MVP file but the entire install image, everything you find in the ISO image over onto the RAM disk and then run it from this RAM disk and do the full install process. So this sort of gives you what we think the ingredients you need to be able to deploy an OS on a bare mental system that doesn't have anything on it, just the ability to boot off of the network stack and from P-boot space. So some use cases of what we think you would wanna use HGPS for and people have come to us for was when the most obvious one is installing the OS image or just booting off of the OS if you have no local storage on your server in the data center. So like I just mentioned before, you can install from an ISO image you've copied up onto the web server and then move it to the RAM disk and install from there. Or as in the case of OpenSUSE, your installer can unrecognize and support HGPS directly and install directly from the OS MVP image. We also have had certain organizations within the government and other places, security people that have asked for former updates. So we've seen cases today where you see your typical IP camera and other devices on the network that need firmware updates, whether it's your system BIOS, the BMC, there's virtually everything and inside the system today has firmware on it. Your SSD storage devices, your NVMe cards, your NIT card itself has an undie driver may need to be updated to the correct EFI image that you need or architecture type. There's lots and lots of things inside the system. So EFI invented something called firmware capsule update where we've been working with the community on getting the capsule images standardized so it can be deployed from either Windows Update or something called LVFS. Richard Hughes' FWB.org site. So we would like to be able to deploy these firmware images out to the end target systems directly through ideally this network, safe network stack, and then update the firmware system without worrying about whether or not the VOS can boot or not. You don't need to be in a state that's completely functional in order to update your firmware.  And then in the case where maybe your system has crashed, the OS doesn't work anymore or I've been attacked by some malware or firmware. The system's been taken out. It's now compromised. I just wanna wipe the OS in the current state of the system and install the OS and restore from cloud storage and restore the backup to a state of the system before the malware attacked or infected the system. I'd like to be able to do that from a network boot basically. So if you've been backing up your software or your system as you should have, having a network boot function that's HTTPS compliant and capable will then give the ability to put the whole system back the way it was before it died or crashed. So there's an entire NIST document that talks about recommendations on typically for enterprise and government systems, the implementations of all this firmware security and network stack and things you should go do. So the NIST document is something that I highly recommend taking a look at. If you're looking at all the requirements necessary for system recovery and cloud recovery and storage and that sort of thing. The other thing for systems in the data center and blaze and things like that, they would just wanna boot off HTTPS and their network and not have any local storage on the blade systems, keep the blade or compute nodes separate from the storage nodes for thin clients, your typical Chromebook type environments. You don't wanna have necessarily local storage or whatever you want to be able to boot off of a network location to update or install the OS. It's another use for HTTPS that we see some people would like to use the stack for. So these are just the first couple of cases that were brought to us or that we've seen utilized today that people are working on. So we'd like to extend these traditional PXE network boot cases to these new cases that we have been asked of us and the reason why we put this network stack in UFI to begin with. So if you wanna play today, give some credit to where credit's due. So we have Gary Lin from the CZ community. We have Gary Lin and Joey Lee and some people in Taipei that have been implementing, watching all of this and have implemented in OpenSUSE A42.3 and SLS15 Leap. They've implemented the full HTTPS capability. So right off of the installation, I assume as you can install directly. And that's a little demo that I have here, utilizing in the latest releases that they're able to boot off of HTTPS and install OpenSUSE A or SUSE A SLS15 onto your system. So these guys have been watching us very closely and have been first to go implement this and stick this in an external distribution. We'd like to see the next level of the community above them, the deployment software people for like SUSE Assault Manager or whatever, also get off of PXE and legacy PXE and use HTTP or HTTPS to do their deployments. So this is something you can do today. If you can get a hold of a UFI system that supports the newer network stack, you'll be able to try this out. I have a system here sitting on the table and a video that I've taken that will allow you to, in this demo, actually boot off of a physical device that has HTTPS fully implemented from TNACOR. And then Gary and Joey have done the work of implementing it up in OVMF. So if you can't get a hold of some hardware that boots HTTPS, typical like, I think there's like an HP Pro Alliance server that boots HTTPS today. If you can't get a hold of something like that or this Miniboard Max board, there's an OVMF environment. You simply download onto your build system and try everything out inside the OVMF environment off of EDK2. So if you wanna do some real work and play, we highly encourage you to contact us or just try this out, download it and try it out inside the virtual environment. Play with that. If you're trying to get some tools and deployment tools working. When there's some basic getting started guide here and how to go implement the OVMF environment or download EDK2 and build the stack if you really are interested in pulling the stack down and trying it out for yourself with the source code. I'm packing up for a second here. So there's some other information here on where the source code is for, or excuse me, guides on how to boot HTTPS and HTTPS and Wikis that we've put up on the EDK2 TNR course site and there's some GitHub. We're transferring a lot of the tutorials and educational materials to the Wiki site, to the Wiki GitHub, GitBooks format. And then there's some URLs here on where to go get the source code for OVMF to do the virtual environment, build and test out as well as the Midamor Max project which is an open source hardware board that we use to implement EDK2 and test out the code on a real platform. Something that's open source hardware that you can get and try out yourself. And then I named also the HP ProLiant series Gen10 servers which have HTTPS built into them. They're shipping today. So you can, if you're in the enterprise and you have one of those servers, you can actually test out the stack and try it for yourself. There might be other Dell and Lenovo servers that have this as well. I'm not surprised and didn't do a full survey of all the firmware that's out and all the servers but you can ask them if they've implemented this network stack or not in the system. So I have a little demo here just to prove to you that this is not all vaporware. So I'm gonna go off and I have this up here but you can't see what's going on up here. Actually I can, let's see if this works. Plug them in, I'll plug the video into the Midamor Max system here which I've booted up already. So on my notebook over here, I have a HTTP server that I've set up with instructions from one of the URLs up there from Gary Lin and Joey Lee and I'm on the Midamor Max target system that's gonna boot over the network. There's a tiny Netgear switch here, a one gig switch and just the Midamor Max and then my notebook host server that's hosting Celest 15 as a host URL server using Apache 2 and a DHCP server as well. So I'm showing you here the Midamor Max system is booted up to what we call the BDS, so the boot manager and what I'm gonna do is select the boot options that are set up in this BDS. So I've installed already on the storage device, there's an SSD storage device, OpenSUSE, just to prove that to me myself that has the drivers to be able to boot OpenSUSE.  There's two NIC connections on this particular board so you would have two NIC addresses and then you remember there's PXC IPv4, PXC IPv6 UFI and then HDP. So I have at least six combinations I can boot from and that's what all these combinations are here. I can pick which stack I'm booting off of that's in the firmware. So this is UFI PXC V4, V6 requires a PXC server and then from the first network connection there's an HDP V4. So I would have three boot options depending which stack I'm trying to use. V4 and V6, sorry, so there's four options for the first NIC and then there's another four options here for the second NIC connection. The same thing, PXC V4, V6, HDP, V6 and HDP V4. So on this particular server, this little notebook over here I've implemented a web server that is doing HDP or it's IPv6. So I'm gonna select that boot option and boot off of the URL. So in my BDS in the far right hand corner here you can see I've, I'm gonna let the DHCP server pick the URL that we're booting off of, whatever it decides to. There's a second boot option called UFI HDP and this names the specific IP address of the HDP web server. I could have typed in a URL, I should have typed in the URL instead of the direct static IP address of the HDP server but in this particular entry I had entered in the IP address. That's a V4 address on there as well. So we'll go back and boot off of the HDP V6 and let the DHCP server name the URL. So it's bootx64.efi, that's the name of the installation software from the Seles 15 DVD or ISO image. So right now it's just gotten the IP address, the V6 address off of the notebook of the DHCP server and then it's handed the bootx64.efi image file off of the web server, it's grub and that runs. I don't have secure boot on in the system, it's booting without checking the image but typically you would wanna do that, turn that on and put the cert for the shim that's in the system and then once grub two starts running then it's network stack, it's kernel loads and network stack loads and then we go off and start booting to the OS and so as usual it's never working on the actual time that you show it in front of a large number of people. So just for your case, grub is running so as far as the OS or the UFI is concerned we've already handed control off to the UFI image on the network server, what it does after that I'm, you know, that's really what Gary and the Suze people have done so we'll try this once again. Actually we'll try the, I don't think I've started the V4 server so it's only V6. I've forgotten if there's a timeout built into the grub two loader so I don't know if I'm supposed to be pressing with space or return automatically or if it does that itself. Yeah, so this time it worked fine. I think there's a timeout inside the grub config file and I was talking and I didn't press the space bar or something so. So now it's already transferred control to the RAM it's copied over all these files from the ISO image on from the web server onto the thing now you're watching the this is the standard install program from Suze Elite 15 that's running and UFI is not in the picture anymore it's loaded the network drivers and we're using the Sless 15 network stack to come up and we've transferred control UFI is not in the picture anymore so it's now going through the install process I'm not sure you wanna stare at an OS installation this is all yas and all those things running on the system. So it's typical the setup of how I got this working is through the boot maintenance manager when you're adding boot options you can go through and select using the BIOS setup to go through and boot off of the SD device here so I won't go through that right now it's implementation dependent upon my particular version of UFI on the system I'm just gonna go back and finish up on the slides here which time do I have left down to the last 10 minutes or 12 minutes here so the call to action here of why I'm up here talking to the community is you'd like you to stop using legacy PXC if possible for a variety of trust security reasons I just mentioned if you really wanna just boot off of something a PXC server on the network the first one that comes in answers to you that's probably not the smartest thing you should be doing even if you have IPXC there are trust models a little bit different they have for HTTPS they have a fixed location on the network that it drags the cert over and that's we kind of security people have a cow when they hear that we'd like you to take a look at our HTTPS boot implementations try out some of the stuff that's out in the marketplace today, the product servers or you'll get the middle board max or just pull down over your math and build it yourself and work on the deployment tools to actually go off and stop using legacy PXC and try and move over to HTTPS as your deployment method if possible and pay attention to some of the security aspects of where you're booting to you don't necessarily trust the network that you're booting from we don't have dedicated backend networks for deployment and for these things typically today so we want you to do that and then really the open SUSE documentation help out with documenting this for end users as well as how to guys and that sort of thing and utilizing your particular distribution and getting the open source community lies to your stack and educate them on how to use your deployment tools once you migrate over so I did want to open up to oh, there's one other slide here besides these references to these locations our community, the UFI community gets together once a year in the US to a plug fest we're holding one next month in April up in Bellevue Washington at the embassy suites so there'll be a bunch of lunch sessions educating the industry where the state of the art of UFI is the latest advances we're doing at lunchtime and then testing you can actually go and see all the vendors will bring their systems there and you can go off and try out UFI and various OEM systems the OS vendors might be there as well Microsoft is definitely there we're down the street from them and then try out in the test room suites we hold a plug fest we go in and try out your software or hardware and really UFI systems so until we'll typically bring our latest systems there in the closed rooms for you to try out and then the OEMs typically also have client and server systems for you to try out so we highly encourage the community to come out and visit us and meet the people who are actually building and constructing the former and the specifications with the industry we also cover ACPI we've absorbed that spec so there's some ACPI people there if you want to talk to them as well so I think I have maybe a few minutes here if there's any questions there's a microphone up here if anybody has any questions Hi, my use case is a contract manufacturer who's gonna do the initial install of our new hardware that is a very untrusted environment in some sense we're running ARM processors we don't have Grubb one question is is there a hard dependency on Grubb you showed the Mino board does that actually have one of those undeed drivers I'm just wondering for an ARM platform how practical it might be to implement some of this stuff and also just a quick question would you advise in a situation like that to host the images inside the contract manufacturer or host them in our own infrastructure and pull them down via HTVPS? Okay so first of all for ARM I would contact the Lenaro community so a lot of the people in the Lenaro community are in the middle of porting to UFI right now so you'd have to talk to them about getting an undie image as well as the ARM, well they ship ARM images with Suze and open Suze right so but as far as getting an MVP if it's not Grubb too whatever they're using for ARM you know having the installation program that you would use you'd have to talk to the Lenaro community about that along with the Suze community as to whether they support ARM I'm pretty sure they do but you know whether they include an MVP image for installation using HTTP boot versus I'm sure there's a PXE boot image but whether there's an HTTP I'm not sure that that's been ported so you'd have to contact them that's something at the PlugFest and the Lenaro Connect events that you can get the latest on what they're doing and then your other question about should you host the MVP image internally, locally in your facility, intranet, in your cloud? So with the stack I mean it's a question of security as to which environment you would trust a lot of people there's a certain fruit vendor that we know right in Cupertino that you hold the key down and it goes out to the URL and then it checks your Apple ID and says hey are you a legal customer for this unit and they do it over the open web so that's one model. Another model is if you have blank systems you don't have that security business model in place already that yeah you'd want to do that behind a closed intranet and not have that out there. Some other BIOS vendors and OEM vendors have a hard-coded URL. They're still using the TFTP and PXC stack to go to a location on the open internet to drag down an MVP image to reflash your firmware system so it depends what you're trying to do and you need to look at the security aspects as to what kind of environment you trust and how much security you have in your system to decide whether you should allow control to be transferred in that environment so you can talk to me afterwards I mean I can understand your use case better in that one. I'm going to hand the microphone. I had a question about, sorry, where can we find the slides for this? I actually work on a tool that does PXC TFTP boot installations called stacking. So I assume ScaleX is going to post the slides up to oh okay I mailed them to you but I'll post them on the event and then they should appear in the ScaleX website then. Okay, yeah, thank you. One more question after this and then we're going to have to come up. I'll be around here or just outside if you want to talk to me afterwards, so. So when you did the demo, it looked like you had a lot of stuff already set up on the board. How much manual configuration in the UIFI configuration interface do you have to do to get this up and running? So what I didn't have time for was to step through. We have in the reference BDS so the reference boot manager in EDK2, there are some menus you can go through so you do have to just add the boot entry. So once you have the stack already implemented in there, there'll be a selection of typing in the URL basically. So all I had to do to set up that boot option was to go into the boot maintenance menu and type in for the URL, basically the IP address for that particular Mac device. And that was all the setup I had to do inside of the, the user setup I had to do inside of the, that particular implementation I made at word max. It's not really quite plug and play. You can't buy 500 brand new servers and provisioning using this. So in the server world, there's something called Redfish and so what's not standardized in UFI today is a standard way to deploy configurations. So they're working on that with the DMTF. If you're interested in going I think at the OCP summit or in the DMTF organizations under Redfish you should take a look at that. So if you wanted to deploy on mass numbers of servers both in-band and out-of-band, these network configurations, among other configurations, not just the network configuration but the rest of the BIOS setup, you need to talk to the, you know, the Redfish organizations and that current work that's going on right now as we speak. Okay, last question. I have two questions. So first question, is there a published resource somewhere or is there interest in building a published resource on UEFI 2.5 compliance among manufacturers? So basically my concern is building a product around UEFI 2.5. So we have so many servers supported. One of the things we have in the UFI side is something called SCTs. So you can run the self-certification test to see are the API interfaces in stack is your system capable, right? Because yes, you're right. Walking up to a system and unless you boot to the shell and you're very familiar with UFI drivers and which driver stacks are available, you don't know what's it capable of. So running the SCTs is one way of checking which API interfaces are available in any given system. I also recommend there's a pointer to FWTS. So the existence of the API does not mean they actually are implemented working. FWTS is another, from Ubuntu is another test suite that everybody uses for UEFI and ACPI. I'd have to check with Alex Wayne whether they are up to 2.5 or 2.6 or not. I haven't asked them in the launch pad to implement the FWTSS for HTTPS, something we would want them to obviously go do. And then there's something called Love. Intel has, on 0.1.org has the Linux UFI validation tests.  So there are a number of places you can go to go test your UFI system to see what it's capable of. Okay, great, thanks. Last question, are there resources on leveraging TPM as the backing feature for validation? So what I didn't, as a call out, one of the things that we were working on was where to store the TLS certs and for the system, right? So that's something that's not well spelled out today. We just talked about the format and you should have this capability, but as far as implementation details as to where to safely secure the store of the certs in a system. We do have, on the website, we do implement TCG. This session was not talking about measured boot which is more than secure boot, right? I didn't talk about TXT or BIOS boot guard or any of those things. You can talk to me afterwards. That's a whole one or two hour session in itself. So I think they're gonna want us to move. Thanks. Thanks. All right, thank you. Thanks a lot. Either slide deck or website. Then you can just put the link in and everyone sees your talk and then I can also get that. Testing, test. Am I on? You can hear me? Do you want to hear me? That's the real question. Yeah, thanks. Is it time? Oh good, yeah, it's time. My name is Craig Gardner and I'm speaking for the first time here at scale, but I've been giving this particular presentation or variations of this presentation for 20 years. And oh my, I've gotta turn my clicker on. There we go. I subtitled it this time after one of my favorite poems, one of my favorite poets, Robert Frost. And the woods are lovely, dark and deep, but I have promises to keep and miles to go before I sleep. I'm a software engineer by background professionally, but I'm also an instructor at a university. And I spend a lot of time teaching computer science at the university. And I also spend some of my free time trying to get into the elementary and secondary schools to talk about this kind of a topic. I've adapted this particular presentation for you lot. Usually when I'm giving this kind of presentation, it's to students, it's to educators, it's to people who are less familiar with open source. We're at scale and you know all there is to know about open source. I'm not going to teach you very much about open source in particular, but I would like to take a moment to talk to you about some of the challenges that we have in the industry that revolve around this thing, this concept, this ideal, this movement that we all feel very strongly about. As I mentioned, I have a lot of engineering background, but as I teach at the university, I teach computer science classes, particularly in terms of software engineering, but I'm also currently teaching a class about technology and ethics, which is strangely related to this particular topic that we're talking about today. Likewise, I create training materials for a variety of different SUSE-oriented products, which I won't get into today. The real challenge that we have that I would like to talk about is, is that we have a very large demand for people contributing to the growing set of open source projects. Now you all know the power and importance of open source projects. It runs the internet, right? Open source is a movement that is providing new solutions in new ways, in new sectors, through a variety of different means, through a slowly growing number of people. The challenge is that we don't have as many people entering the realm of the writing of source code that is open source, to solve the solutions in an open source mechanism. As a matter of fact, our friend, Greg Crow Hartman, who works at the Linux Foundation, was speaking at Core OS Fest not too long ago, it's now three years ago, but he made a very insightful observation that I would echo in that it's hard to find people to hire in these fields, people to hire to work in these projects, because everybody's already been hired. And so we need to invest in the growth of people adopting these paradigms and in adopting these methodologies and do so in a way that we can grow the field of people who will continue to contribute and at a pace that the demand is demanding. I've titled this looking for rock stars and ninjas in all the wrong places. There have been lots of interesting news articles and even academic studies about what's going into this myth of rock stars and ninjas in our industry. Now make no mistake, my friends, really there are quite a few of our friends that we would consider to be rock stars and ninjas. And maybe there are some of you in this room that maybe you're contrite and maybe you're humbling, you wouldn't call yourself that, but you may be a ninja or rock star. But the recruiters in the industry are putting out these job descriptions for people to join the software world and giving those job descriptions titles like ninjas and rock stars. And they're failing to attract the people that they are coaxing that they're trying to entice. Now why is this? Two reasons. Number one, no one has any idea what a ninja or a rock star job is. And number two, the people who may be able to do the work that the recruiters are trying to entice are humble enough or maybe even dumb enough to think that they don't have those skills where they may really have the skills that a company wants. So we're failing to match these things up. We need to get away from this whole concept of ninjas and rock stars as cool as it is and as appealing as it sounds. We're not doing ourselves any favors when we are trying to hire ninjas and rock stars. We seem to think that this world of open source can only be filled by ninjas and rock stars. And I'm hoping that I can convince you that that's not the case. So as we talk today, I'll talk a little bit about open source that you already know. I will talk about where you and I can make the biggest impact. And I'm gonna start by saying that the schools is a good place but I'm not gonna end there. I wanna talk to you folks about how you can make a difference in or out of a classroom. We'll talk a little bit about how we use open source to bring people into open source.  And you've probably seen this kind of chart before I shamelessly ripped this off from Wikipedia, right? Why do we use open source? We don't need to talk about that here today but when I'm talking to educators, when I'm talking to students, when I'm talking to people outside of our realm of influence who need those ninjas and rock stars, I have to explain to them the value of open source and there are many and some of them are obvious, some of them are less obvious but they're the kinds of things that you already identify with. The point I would wish to make as we move on from that is that in our schools and in our institutions of learning, we recognize that we have lots of jobs that are available and a growing number of jobs that will become available that we need to fill with those people that can program. And so in our institutions, we teach programming and that's a very common thing. Now I'm going to show you a little bit later that it's not as common as it needs to be but that is something that we've all taken part in. We've all gone to classes. We've all perhaps even gotten some related degree in a university to where we've learned how to program and we sit in front of an instructor and the instructor teaches us this is an algorithm, this is a procedure, this is recursion, this is a subroutine, these are all these different things that we come to appreciate in terms of programming. That's a very common thing and it's very worthwhile but teaching open source is a foreign concept in our institutions of learning. We'll talk a little bit about that here in a moment and I would assert that if we were to apply open source principles and if we would use open source in our education that we could make a bigger difference in preparing people to fill those roles in the industry. Now you're thinking to yourself and rightly so, what does Google care about whether the, where people learning about programming are doing so in an open source way or not? I just need programmers, we'll get to that. Not too long ago, the GNU revolution start that kind of was the opening of the door of the free software and the open source movement and you have these values that were established by Richard Stallman that you're all very familiar with. Let me provide some variations on this foundation for Richard Stallman and this is Craig's alterations of the free software movement. We need with open source an opportunity to have more freedom to move from project to project. Have you sensed that? Have you been in organizations where project A has been good but then it kind of dies and is less important and now there's project B and you need to figure out how you're going to staff project B? With open source methodologies, with an open source mentality, with open source values we have a greater ability to move from project to project. We have greater agility and greater flexibility to move. Number two, the freedom to grow and adapt our own talents according to our own needs. I would assert that open source facilitates that. It's even at the heart of what that is. Number three, we need open source to be able to redistribute ideas. The ideas that come out of project A to proliferate into project B and all the way down to project Z. And the freedom to improve ourselves not only for the good of the projects that we're working on or the good of the industry that we're trying to improve but the problems that we're trying to solve but the freedom to improve ourselves. And this leads towards an open source mentality. That gives us greater freedom. Now in our schools, I'm not trying to bad mouth the schools. I'm not trying to make any particular school or school system look bad. But I want you to think about what schools do, particularly in the context of technology, right? They're trying to tell their students that we're preparing you for the real world. And what's the real world all about? Well, it's a lot of things. But at the end of the day, we're trying to put food in your mouth and a roof over your head and support yourself and your family, whether that's just for hardcore day-to-day needs or for the toys that you wanna buy and participate in extracurricular activities, right? You're trying to tell these students that they're getting ready to make money later on. And they don't understand how free software leads to paying jobs.  Number three here is that most schools just don't understand what open source is and what open source does and that it has this broad outreach of business applicability. And it requires that schools need to be more adaptable and more open and to change their old paradigms, right? But schools don't have time, right? Schools have so many distractions. Schools have so many different things that they're trying to juggle. And it's hard for them to be flexible and adaptable. I'm simply saying I can understand why it's hard for them to understand the value that open source can bring. The standard approach to schools in terms of technology is broken. And again, I'm not trying to poke holes. I'm not trying to offend. I'm simply trying to say that if these schools are going to succeed in preparing this next generation of open source geniuses, ninjas and rock stars, they need help. They need help understanding what open source can do for them because they're tied to their tried and true academics.  And I'm an old guy too, right? You can see I'm kind of a gray beard kind of person, right? They're closed systems, typically. They're not open to new ideas. They're not open to, they're very rigid, formed, tried and true kinds of things that are tied to paradigms that are related to the individual being tested, the individual being given an A to an F or an E, right? You either know the stuff or you kind of know the stuff or you don't know the stuff and there's no collaborative involvement in their learning of this stuff. Do you know how to write the algorithm or don't you? An open source isn't like that. An open source threatens that, but they can get along. I'll tell you in a moment about that. We use the tools, methods and hardware that come from the vendors. Now please do not misunderstand me. Microsoft does a great job of donating their wealth to schools and in the process, they give a lot of hardware and software with the intent that the students are going to become Windows users, aren't they? Right? That's good. I'm not saying that's wrong, but Microsoft is buying mind share in the schools and making it harder for the open community to work its way in. That's a difficult thing for schools to negotiate. I'm not trying to say Microsoft is bad in this. I'm grateful that Microsoft tries to, and I'm speaking on Microsoft as an example. I'm not saying that that's the only situation here, but they have a vested interest in making sure that they have future purchasers of Microsoft technology, right? We get it, we understand it. That's part of their business. This ends up being a broken approach because in an individual environment, you're not really approximating what the world is all about. I understand that a student needs to prove that he or she can read at a certain level, can perform algebra, and can create some subroutine in C or Python or C++, C-sharp-sharp, C-sharp-sharp, what do you call that? C-sharp, right? We understand the individual attributes of learning, but schools are tied too much to that, and they don't understand that collaboration needs to be part of the education because collaboration is life. Everything that we do in this life is a team effort, and especially in our industries, and especially in software. And they also get kind of tied down into just writing software for writing software's sake. Instead of realizing that and making good use of, there's a lot of code that's already been written, and that part of the real world is reusing code that already exists. Yeah, I understand, you gotta figure out how to write recursion. You gotta be able to show that you can write recursion, but they need to have a collaborative environment wherein they can learn how to work as a team. And those educators are thinking, I can't do that if they're borrowing somebody's code. I can't give Johnny an A or a C based on his borrowing Mary's material. That's a tough thing to have to overcome. Now, we understand all of these benefits of institutions using open source, of all companies using open source, schools are no less the case, right? Typically lower cost and using open source, all these different things, freedom from vendor locking. Yeah, that's all great and cool. But let's think then about where you're trying to get these students to go, where you're trying to get them hired, where you're trying to get them involved, and where they're going to be winding up to solve some of the world's most challenging problems. 77% of software companies, we'll talk about non-software companies here in a moment, but this is information from a variety of different sources, largely from this one down here at the bottom, but 77% of software companies foster open source. So why don't the schools teach about open source? If 70% of the software companies are needing to hire people that know something about open source. This is up from 50% just four years ago. 73% of software companies have a formal open source strategy. Well, then why should the students be learning about open source? Beyond that, 78% of tech companies, and of course that's kind of a squishy definition right there, have some reliance on open source. Moreover, there has been, and it depends on who you ask, and so I don't put in numbers on this particular datum here, but monumental increase in the use of open source even in non-software oriented companies. Mining, materials management, medicines, medical, mom and pop, all these industries are using more and more technology and what's behind that technology? Open source technologies, okay? We recognize this, right? But our schools are challenged with this and we need to be working with these schools to help them understand. That's why I've got miles to go before I sleep. I'm trying to spread this message that it's not just a school problem, it's a general problem that we need to help solve. 87%, this is from Linux Foundation, the 2018 Linux Jobs Report, 87% of hiring managers are having a hard time recruiting enough open source talent. That's a huge space to fill and Greg Crow Hartman says, we can't hire them because they're already hired, we need to fill the pipeline with people who understand this. Now Microsoft is doing a great job. Right back in 2015, they have launched a stance and approach that embraces open source and I applaud them and let me tell you, I know I have many friends who work at Microsoft and they're moving there and this is a great thing and they're going the right direction and Apple is too, right? A little bit, but if you open up your iPhone or your iPad and you look at the license information and you'll see the hundreds of open source licenses of projects that they're incorporating in their projects, they buy it, they understand it, they're a little less outspoken about it but they're moving there, they're using it, they take full advantage of open source and these are the big industries that every junior high school student knows a lot about. Our future needs in the outlook that takes place from the Bureau of Labor Statistics is that 71% of new STEM jobs are in relation to computing, yet only 8% of STEM graduates are in computing. They're usually in some other math or engineering organization. The imbalance is obvious, right? Only one in four secondary schools teaches programming. That's tough, that's a problem. And one of the reasons that they're not teaching programming is because they can't get teachers who know how to teach programming. And I don't blame them because every year it's different. It's hard to stay current and up to date as an educator about teaching programming. And just because you've got the one great lady who took a class to teach that particular programming class that year, she's likely not gonna teach it again a year later. It's a tough place. Now there are lots of schools that are working to remedy these kinds of things. You've got Harvard that has fully embraced this open mentality, including all of their MOOCs, right? You've got all of the material that they're putting out and they're massively online education efforts. This is great. RIT does this. Oregon State is huge on this. San Diego State is embracing this. Yeah, good. What about CIT? Does anybody know if CIT here next door, are they an open source? Nobody knows. Good, thank you very much. Yeah, but great. Thank you for sharing that. There are even some high schools that are trying to do this. There's this one of my favorites. I'm from Utah and there was a school that failed called Wasatch Institute. It failed for financial reasons, not because of its attempts to get open source mentality into its students, but they tried it and Penn Manor in Pennsylvania, let me tell you, they're killing this. They're doing the right stuff. They have understood what the future is, but we don't have enough of this. A few examples, we need more. All right, you probably know this as well, right? Open source is the new CV, the new resume. I have been a hiring manager. I've hired scores of employees in my day and I'll tell you how I hire people. I like seeing their resume, but the ones I end up hiring are the ones that I can see what they've done. I see what code they've contributed. GitHub, these guys sitting right outside here, gosh, they're smart. And all of those people that I go to find out what they really can do as a potential employee, it's because I can see what they've done on GitHub. We can, as this changes, we need to make sure that the students understand this and that they're putting what it is that they're learning out on GitHub.  I don't even know if I'm authorized to tell you about it.  At the university where I teach, they recently rescinded the diplomas of students that had graduated from the university because the department found out that they had posted their code on GitHub. That's a travesty. Now I know why they're doing that, right? What they're saying is the students are giving away information about the courses and the answers to the tests that are gonna be taking place at the university and that that's a violation of their contractual obligations with the university. I understand that, but students need to be allowed to put what it is that they're writing out there for their own benefit, for the benefit of their peers and for the benefit of anybody who might stumble on it and say, holy cow, look what this person has done. This is going to be instrumental in solving the next great problem. We need to be more open about this stuff and this approach helps employers to know who the smart ones are, who's gonna really be able to solve the problems at my place of employment. All right, so turning people into programmers is one thing, but turning programmers, turning students or newbies into contributors is hard, right? Getting programmers to contribute is hard because they might not know where their interests lie. They have to figure out, well, where do I fit? And then not after they figure out what they get interested in, then they have to get inserted into the project and depending on the project, that might be a big hurdle, right? And we're all grateful that Lienus has taken a class on interpersonal relationships. But before that, trying to contribute to the Linux kernel was a Herculean effort. It was reserved only for ninjas and rock stars. They're getting better. I'll tell you, Greg Crow Hartman has done a lot to help Lienus figure out what it's like. All right, so I've got a little metaphor of hurdling, right? Hurdling is typically, you know, running, the running part of hurdling is a generally easy thing to do, right? You just kind of control, fall forward in a fast way. And you get to the part where you have to jump over something and that might not be very easy, right? All of a sudden you have to kind of leap and you have to leap at a certain height and you have to leap with a certain amount of timing and, you know, if you miss, it hurts. This is a lot like trying to contribute upstream, right? And I've got a few examples here. This guy didn't make it. This happens to be in my backyard. This is at Brigham Young University. This is the Steeple Chase event and BYU typically generates some really good Steeple Chase competitors but this guy didn't make it, right? That hurts and this guy obviously that hurts, right? That's the same thing as with contributing to an open source project, right? Programming is pretty natural, right? I learned how to do this in school or from that book that I read but contributing upstream doesn't come quite as naturally and it sometimes can be hard and trust me, when you fail, it hurts. Somebody flames you, somebody makes it sure that you're not interested in contributing anymore. We gotta change that. That's on us. So where can we make the biggest impact? Some of it's in the schools, right? Students in China and Thailand start programming in grade three. Do I think that's the answer to the United States? No, no, I mean, there's some good and some bad, right? There's pros and cons to this, I get it but I'm trying to tell you with this students in China at grade three outperform United States seniors in high school on standardized computing tests. We gotta do something about that and I'm not saying we gotta start US students at grade three but we gotta do better about this. 88% of global businesses can't fill positions. We gotta do something to fix that and there's a huge pipeline and it's fairly well-defined, right? If we can get people started earlier, they have a better chance of succeeding. It's harder to train people as I'm not saying it's impossible. You can teach an old dog do tricks but generally speaking, the earlier people start the more they latch on to those kinds of things and so let's get this kind of thing going at a young age, a younger age and get students interested in the open source projects that exist. Well, let's think then for a minute though the schools aren't necessarily interested in open source, they need the money to do the educating so they're gonna follow the money and the schools that can't get the money from government they get it from industry or they go without and we had a great talk. Thank you, Dr. Richards, Sam Coleman, thank you. How did I forget your name so grotesquely? I don't know, great talk yesterday about his secondary education approach to handling this kind of stuff, right? We gotta get the industry to understand this, right? If 88% of the jobs are going unfilled and 73% of the industries need open source talent then let's get these schools to understand it. Let's get the industries to push back and get them to be supporting open source but I recognize that we have a limited control over this. Maybe we've got more, maybe there's somebody here that is Tim Apples, he's called Tim Apple now, right? President Trump calls him Tim Apple, isn't that great? Yeah, Tim Cook, somebody, Tim Cook's right hand man is probably sitting in this room and he's gonna go back and say, yeah, that Craig Gardner, he says, we need to change our song, do it, right? I'm not very hopeful that we're gonna have a huge influence on industry to change their tune but I'm not giving up home. If we did control the classrooms, right? I teach this stuff at the university and I want other schools to do this. Oregon State does this and San Diego State's starting to do this, right? We're doing better at this but we've got to get more university environments and secondary environments to use open source in their curriculum, pick a project, have the students pick something that they can contribute to during the semester. Lots of variety from easy to hard that can match your student's skill set in a real life environment. Okay, we have to put the fundamentals first, right? We gotta teach them that, oh, this is syntax and this is structure and this is classes, right? We understand, we gotta start with basic but as you're moving along, get them to where they're actually contributing not to some arbitrary contrived coding example. Pick a project that matches your interests and that matches your skill set. Have your class assignments modeled after what's going on in the open source. Now that takes time and energy from the instructor but some of us are willing to do that. Recognize and reward collaboration. Yes, you need to be able to say, okay, you understand what an algorithm is, I'll give you an A on that assignment. But get to where you are having the students working together because that's what the real world does. Takes effort, takes time, takes patience but good instructors can and will do this. And the last thing is don't punish failure. I hate giving students C's and D's and E's. Failure needs to change. We've got to start teaching these people that failure is simply an element of success. It's part of the process of success.  And move from there instead of saying, sorry, you didn't cut it, you suck. What good comes out of that? All right, it might motivate this few number of people but it doesn't, it just doesn't, that's not human nature to have someone tell you you're a failure and try and pull success out of that. So start with programming but solve real problems with real software and give them a grade based on how well they progressed, right? Demonstrate that failure is part of success. As far as Nietzsche was concerned, I don't buy a whole lot of what else Nietzsche said but he was pretty good when he said that which does not kill me makes me stronger. Yeah, that's decent, right? So let's move on then beyond the classroom, outside of the classroom, how do we get into here? Yeah, we're going to have some involvement in classrooms, we're gonna have our kids, we're gonna have our neighbors, we're gonna have our grandkids, we may even be teachers, right? We may have some involvement in the classroom but how are we in our jobs, in our spare time, going to make the biggest difference? Outside of the classroom, we have to be the recruiters. Let me tell you something, I know I'm gonna offend somebody when I say this but recruiters in the tech world are not very good at their job, right? They just don't know what we know, what it takes to hire someone in the industry. Now there are exceptions to this obviously but generally speaking, recruiters know how to gather resumes and search for keywords and try to line them up but we are the recruiters. Let's make the industry a place where people want to come and contribute and be part of, right? We need to be inclusive. Instead of the flamores, instead of telling people, yeah, where did you learn to program? That is the worst example, there's no way I'm accepting your contribution. We're driving people away. We need to be more inclusive. Hey, that was pretty good. Now let me tell you, there are a few things that are missing from this contribution that you're trying to make here and let me try and help you understand what it is that needs to happen for us to be able to accept this contribution. We need to be inclusive in our communities. We need to encourage and not discourage. We need to make sure that we follow our own rules and make sure that our code is maintainable and good, right? It doesn't have to be perfect, we get it. We're coding against deadlines and we're not all rock star programmers but we need to make sure that our code is maintainable. We need to write our code like the one who's going to come after us is a homicidal maniac who knows where I live. Be kind in how we code stuff and not say, well, whoever comes behind that's their job to figure out what crap I put together. We need to hold ourselves to high standards and we need to live by them. Do we have standards? Sometimes we do, sometimes we don't. Okay. Parting shots here. I didn't do this, this came from a Google search and I put the references, the links to all of the images that I've used in here either on the pages themselves or in an epilogue here at the end of the slides. But we would love to have ninjas. We love to have rock stars in our organizations. And we may run across a few. And you may even be one. But most day to day accomplishments are of that middle of the road, good enough variety by your staff programmers who are ordinary mortal humans. And so we need to invest in mortals and make sure that they feel like they have a place to go and that they're welcome and feel that they have the means whereby they can get better. And feel like that they are contributing to solutions and not part of some vast set of problems for which we ostracize them. And as we invest in those mortals that are doing the day in and day out grind of solving some of the world's most challenging problems in technology, if we tell them they're doing a good job and we encourage them and we make them feel included and we certainly correct them and make them feel like, yeah, you can do a little better. Let me help you to do that. As we invest in that way, we will probably have a better payoff in the long term and even in the midterm than going out and trying to hire the ninjas and rock stars. And the simple truth is in the right environment with the right encouragement, we may even grow a few of those ninjas and rock stars in our own organization if we do it right. My call to you is to find someone, whether it's a young person or some sort of newbie to the industry and become a mentor. Now I'm being simplistic here in talking about code.org. That is certainly not the only place, right? And we all have our problems with scratch. But whoever it is and whatever their skill level, whatever that he or she may be willing to do, find that person and teach that person not just how to program and code, but inspire that person to contribute to be part of something cool, to become part of a community of software engineers, to find some open source project that interests him or her and to start figuring out what it takes to contribute. Now this might not even necessarily be code, right? There are lots of ways to contribute to these communities. Graphics, project management, processes, a variety of different things that are part of the overall engineering strategy. And then lastly, I would say to the extent that you're able, you're already spending a lot of your free time coding, aren't you, right? Your coders for your jobs, some of you, not everybody, right? But you're involved in this in technology to some way, shape, or form in your day to day job.  As part of the free time that you spend, find an opportunity to vest yourself in a school. Now it might not be a big thing, right? It might not be donating 72 Dell latitudes to the school so that they can have a better lab, right? You might not have the means to do that. But go find that high school teacher. Go find that junior high school administrator and say, I'm in the business. And let me tell you about open source. And not only am I just gonna try and indoctrinate you in open source, but let me come once a month and donate some of my time with your students to help them understand what open source is and where it's going and why it matters and how it will matter to the open source environment but how it will help those students to become better at what they do. Whether they end up being full time programmers at IBM or at Microsoft or at Apple, you don't know. But they'll start to understand the ideals and the values of open source. And they'll start to understand that life is a team sport. And they'll start to understand how to collaborate. And they'll start to recognize, hey, somebody cares about me and someone is vested in me and someone's encouraging me. That's what open source is about. This means something. I think the world ahead of me is worth working toward. I'm gonna do better. I'm gonna do better. I'm gonna get better grades. I'm gonna get involved better. You'd be surprised what kind of influence you can have in the schools. Now, if you've got the 72 servers that you wanna donate, yeah, do that too, please, that's great. The schools need that. But the real love that we have to share comes from our sharing our time. And you may not care about those snot-faced students today, but if you spend a little time with them, and start helping them to understand what this is and where this is going, you'll start to see that, yeah, this is that future rockstar. This is that future ninja that's gonna make a difference. So I leave that with you, hoping that what it is that I've said today is meaningful and helpful, and I would love to hear what questions or criticism or difficulties that you have. Anyone? Doug's got the mic.  Questions? I help a lot in the schools. Thank you! But I'm a little concerned about one thing. So what I help with a lot is the robotics programs that are huge in the schools these days, and it's got a lot of kids interested in STEM, but what I see is very little to no open source component of that. It's all proprietary software, it's all run on Windows, and little microcontrollers, but there's no open source component. Have you experienced that, or know any way around that? I'm sympathetic. Now the Lego folks, what's the name of their C compiler that they use? Next C? Well... And NXC, right? Yeah, NXC, that's pretty good, but it's not open source, right? But it's general enough that what they're learning in NXC can be meaningful, but I don't know, they're not using NXC to program it, what are they using, it's that other language? So the organization that runs the biggest one that I know of is called VEX. Yeah, yeah, yeah. And I mean, it ticks a lot of the boxes for the kids, the collaboration part, the STEM part, but the open source, there's not even close to that. It's a very close source and proprietary, and I'm kind of disappointed with that, and I don't really know how to get around that. Because they have this huge, it's almost like how everybody uses Facebook, and it's like you got to hold network type thing going on where there's a ton of people involved and to try to make something separate from that that is open source is a big uphill climb, right? Because you're working against this network effect, right? Where you got a ton of people involved already. And my only answer to that, I don't have an answer to that, right? If those companies that are coming along starts to see the Microsofts and the Googles, Google's a double-edged sword there as well, right? They love open source to a certain extent, and then they hate it, right? And they're writing all of their own proprietary stuff. It's a balance, but Apple and Microsoft and IBM, right? IBM buys Red Hat, they're committed to open source. Some of the other companies will start to take notice, but that's not enough, right? We need to speak up, and contacting the manufacturer, contacting the producer would be very instrumental. It might be a drip in the bucket, but if we get enough drips, we can do it. We've got a response to that, is that correct? Yeah, thank you, thank you. And I knew that unofficially, so have someone bolster my knowledge of that is very helpful, thank you. This is a little bit more of a comment than anything else, but along with the terms of turning programmers into contributors and the Your Challenge slide, Google has this thing called Google Summer Code for university students and Google Code in for high school students for open source organizations to contribute and have students contribute to their projects in a meaningful way. And they use GitHub, they do pull requests, they do things from design to project management to whatever. And it helps out the organization, also helps get students interested in open source. So I would definitely recommend that if you are a member of an open source organization, please try to get your organization involved in this. And if you know young students, get them involved in it as well. Google Summer of Code is awesome, and I'm so happy for that. And I do, I encourage my university students to get involved in Google Summer of Code. There's also Outreachee, which I also give props to, right? There are a few approaches to this that pay money for students to work on open source projects during the summer. Great, thank you for that comment. Next. Hi, I'm from Long Beach City College and I'm part of the Cyber Security Club and the Woman Information and Technology Club. We are trying to do more open source projects for high schoolers and middle schools, but I wanted to know how to get more started in other projects. So thank you for the dexters. So I just wanted to know if there was any other places to go get information or Google. We'll talk with you about that here outside the doors. We're glad to help you with that. All right, thank you. Swing the mic back over to him. Dr. Coleman's got. Raspberry Pi. And so one of the things that I'm involved with is the Raspberry Pi Foundation. And they provide teacher training at no cost, but you have to kinda apply.  Also, we have Raspberry Pi Jams and I'm also a member of the Raspberry Pi Club in the Riverside. And we work in collaboration with this place called Volcademy, which is a maker space. So we have Pi Jams. And so me and some of the other grayberries, we actually bring Raspberry Pi projects there and we get middle schoolers, elementary school kids, high school students interested in these different projects. So I've done that and collaborated with Harvey Mudd University to do some of the same things at schools like in Upland and the Alto. So if you're interested in that type of thing, get in contact with either your local Linux users group and your community, because there might be somebody who's a Raspberry Pi guy or gal. Or if you guys have questions along those lines, give me a call, because sometimes I'll bring projects to different schools and I'll show kids, this is how you make this, this is how you make that. I mean, there's lots of options out there. You just have to reach out to people in your community, but I would always start with the Linux users groups in your neighborhood, so to speak. And those pies are cheap, right? I mean, if you want to make a big difference with a small amount of money, not every middle school or high school has a teacher who would welcome a gift of five pies, but there are plenty that would just die to have that kind of a donation to help spur the interest and curiosity in the students beyond a Facebook consumer perspective into the creative contributor realm, which we really need to have. Next question. So in this education process of trying to expose people to open source, do you think that this is the right time in the process to kind of let the people know about kind of misleading open source pitfalls? You know, like, oh, great, everyone's using Linux, but we're all using Google Docs. Like, or is that like down the line too much? Or what do you think? What do I think? I think that you have to be a realist, right? Google Docs has changed the substrate wherein we write and that we collaborate. We certainly hold some resentment for the fact that they're not willing to keep that as an open source environment, but it is a collaborative world that they're trying to promote and I think that they should be applauded. And then every now and then we just kind of dig a little bit and say, come on, open source or not. Yeah, good question. And certainly worthy of criticism. Hi, I'm volunteering once a week every Friday. Thank you. Each programming to second grade kids. And I've been doing this for the last three years. But what I notice is after they move on to third grade, they don't receive any more training or teaching. So I wonder if somebody have an idea what's the next step, what should I do? This is in LUSD, it's a second grade kids in a somebody. So I can't give you specifics about the Los Angeles School District, right? And there are thousands of them, at least throughout California there are thousands of them in my experience with school districts in a variety of different settings. The pressure from outside helps, but what ends up helping more is to find someone inside the school district to champion it, right? So if this lower grade educator is buying into this but it's not getting upstream enough, give that lower grade educator some tools and some help and some insights so that he or she can start pressing saying, hey, the middle school needs something like this. I'd be glad to help organize it and implement it there at the middle school or at the high school level, right? You've got to get some of that rallying within. The pressure from outside is always a double-edged sword. Going to the school board, going to the school board meetings and clamoring, oh, we got to have this. Usually makes the school board dig their heels in and say, you don't understand my problems, buddy. But if you get somebody inside that can own it, you can go a lot farther with that. Dr. Coleman's got to know the thought about that. Out of the pressure, get the parents fired up because parents want the best for their kids. Thank you. All right, and I think we've got to cut it off. Okay, thanks for coming. I really appreciate your attention, your attendance and enjoy the conference, thanks. Hello, hello, hello, hello, hello, perfect, perfect. And Doug, do you have any slide, the thing to pass the slides or? No, we'll just go from here. Looks good. Should we get going, Michelle? She would start. It's 12, right? Good morning, everybody. Thank you for coming. How many of you guys are from the healthcare industry? Good, good. So today we're going to talk about Libre software and free software and the GNU Health specifically for the public health sector. I mean, of course we can deploy these in private institutions, but the idea is building large health network in a country or a region. About GNU Health, it's pretty much a social project. That's the main idea of the project, is to deliver health and education with free software. And it has very cool technology behind it, but we cannot forget about the social project part because there are many cool technology projects around that don't take in consideration the social part. So who's behind GNU Health? It's GNU Solidario, this is an NGO. This is a group picked from a new health cone in Gran Canaria last year. And again, the main idea here is to deliver health and education with free software. And GNU Health is one of the projects that we do. It is an official GNU package. And one of the main focuses we have is it must be, all the components must be Libre software. Because at the moment that we find one that is no free software, the whole chain goes down the drain, right? And we just had to actually, a month ago, have to change MongoDB for Postgres on the health information system because they changed the license and there were a lot of issues with MongoDB and the license change. So, but lack enough, we have another DBs that work very well in that scenario too. So we were able to move to Postgres too on the health information system. So GNU Health is an ecosystem. It deals with different areas of work. We always start with the person in the community. Domiciliary units, health institutions and so on. Then we go to the traditional patient-doctor relationship. We also take care of the hospital management, stock management, finances, pharmacies, hospitalizations and so on. And at the end we want to make sense of all the data that we've been collecting through all these transactional systems and bring that data to the health authorities so they can improve the health promotion and disease prevention campaigns, among other things. This slide shows a bit the main components or the main projects within the GNU Health umbrella. So the first one is the hospital information management system. We also have a project that deals with GNU Health embedded. The same functionality that we have on the, here's we have it also on the Raspberry PI and also for LIMS, Laboratory Information Systems. We have the Federation, which will be part of, we'll be talking today. Working progress is the mobile application and we also deals with bioinformatics, all these molecular basis of disease. Very quickly, these are some snapshots of different functionality that you will find on this ecosystem, okay? So from the very transactional system that you have running hospital and health centers around the globe to reporting, to imaging, lab cameras and so on, agendas, calendaring. And now let me talk specifically about dealing with large implementation. One of the issues that we have today and we'll talk about it now, it's that most systems in the health arena are silos, meaning they work in a way that they don't share data between each other. So we try to do something that deals with distributed networks of autonomous nodes. That means every single node is independent and you decide what type of information you want to share with the Federation itself. So in case of there is a network outage, nothing really happens because you still are independent. You will be able to run your health institution without the network. And this is done through these three components. So on the left side, you have the nodes which can be a hospital, it can be a person with their application, it can be a research institution or a laboratory or whatever. Then you have a message and authentication server and finally you have a health information system that also deals with patient and person master data. The way that we deal with information on the health information system is a bit different than the way that we deal in a transactional system. It's semi-structured, okay? It's data that is good to make sense out of it. It's not a transactional system per se. We have already that on the limbs and we already have that on the hospital management system. Now we want something that it's easy to be read by humans and by machine and it's also easy to share among the different nodes within the Federation. So I came with this concept of the book of life and the book of life, it's made of many pages within the person and here you have different categories and pages. So you have pages that represent a medical context or an event, demographic, biographical and social and within those you have categories. So on medical you have health condition, genetics, encounters and so on and the social, again this is a social project, we talk about all the socioeconomic determinants of health and disease. Whenever you do something on the transactional system, whether it's your lab information system or whether it's your hospital information system, immediately it will create or update one of these pages of life. So you don't have to be doing double job. The main information collected on the transactional system, it will create this page of life which then will go to the Federation and be shared. Of course, provided that you give authorization for that specific model to be shared on the Federation. It's a very simple way of dealing with complexity because you need something that when it's in this health information system, it can be easily grabbed from different heterogeneous systems. So we deal with this transdisciplinary approach to health. Now we have many people, doctors, nurses, psychologists, social workers, persons, patients, community members, feeding the Federation and feeding this health information system. And if we don't do that, we are dealing with a reductionist system. We would be more on a system of disease instead of a system of health. And we need to have a holistic picture of who we have in front, not just the medical records. Medical records, it's the consequence of something that we have been doing wrong to have somebody sick most of the time. So let me put you an example dealing with genetics and the molecular basis of disease, and in this case cancer. What you're seeing here are different natural variants of the BRCA1 gene. BRCA1 gene, it's involved in breast cancer. And here we have about 70 different natural variants or in different positions, you have amino acids that change and that will make it a conformational change within that protein, making it not functional and making that person more susceptible to have cancer. Now, what we can do with the Health Federation, it's contextualize all that information because you see, it's easy when we know what are the clinical implication of specific natural variant. Then, you know, if we have that list, we know, well, this is white v9 or this is pathologic and then we can do something about it. But what happens is most of the times we have natural variants of unknown clinical significance and that's where the problem comes. You know, you send somebody, it's genotype and it comes a mutation on that specific gene, but hey, we don't know whether that variants, it's pathological or not. And one way to tackle this is having a federated network and multiple information coming from diverse nodes across the country or even across the world will be able to say or make a correlation between genotype and phenotype and knowing, hey, now we can find a direct link on this specific mutation that we didn't know before whether it was pathologic or not. And the New Health Federation is a great tool to deal with this type of things. Big data, a lot of information coming from different, and not only the molecular basis. You know, there is a lot of stuff into the epigenetics and you know, the lifestyle and nutrition and other things that we should take into account in order to have this global idea on a specific mutation. This mutation will be contextualized to this person. So now if you see this slide, not only we have the gene, we have the locus, we have the protein code, we can go and see the OMEAM information, we have the family history, but we also have the lifestyle of the person, okay? So putting all this together will provide good information and be able to tackle that specific mutation within the context of that person. So now, as you see here, we are going to be able to deal with each of these nodes, each of these participant people or health institutions or research institutions or social workers put the information contextualized to this person. We also need a way for not only new health, but other applications to be able to retrieve and feed the new health federation. That's why we provide Thalamus, which is a flask RESTful API that allows you to send information and retrieve information and update information, no matter which system you have on the other side of the federation. And this is what I was talking before. You know, most health systems today are silos. You log information in. And that information has no value whatsoever. In many places, I don't know, we are here in the States, I think it doesn't differ much from Europe. If you go today to Health Center A, because you had a knee issue, and tomorrow you go to Health Center B, you will have to provide again all the information because Health Center A doesn't talk to Health Center B. They are silos. And I know this not only as a person because I'm also a health professional, I'm a physician, and if somebody from Barcelona comes to the Canary Islands, I have to start from zero her or his health history. You know, private institutions don't talk to public institutions and vice versa. And the New Health Federation will actually break these silos. So right down here, that's the Canary Islands. When I will ask to do this, I say, hey guys, make sure that we are still here because we're far away from Spain in every single sense of the world. So why don't we do this? Why don't we have a public health system? First of all, with free software. You know, free software foundation Europe came with this beautiful saying that public money, public code, you know, not only for education, but also for health. Now, not only benefits on being able to read the code and empower the health institutions to make that program their own, but also there is a lot of savings in licenses that can actually go to benefit the public health system. Also, as a physician in the public health systems, you have pretty much seven minutes per patient. If I already have the history of the person, I'm saving a lot of time and I can put that time to actually improve the encounter and the care of the person that I have in front. You know, we are also becoming oversophisticated and we are getting rid of the human factor and that's something that we really have to face and improve in the healthcare arena. So now with this proposal, now with this model, no matter where you go within Spain, the information will be updated automatically and now if you go from health center A to health center B, your information will be fresh and not obsolete as it happens in the other place, in the other cases. Most cases, by the way. So this is what we propose to our government officials to of course move away from private software on healthcare and public administration in general and we already have a solution. It's just a matter of having the will of moving away from proprietary software. And if we do it at national level, why not we can do it worldwide? If I'm here now in the States and I break my knee, God forbid it, I will have a game to give all my clinical records to the US health professional that sees me. Now if we have this in place and we have a unique ID per person in the whole world which is perfectly technical achievable, that wouldn't happen. The doctor will just ask for my ID or get my card and all my clinical information would be there, provided that I give permission of course for her or him to read it. You know it might look a bit utopian but this is something that it can be perfectly done. I think that the unique person identifier it's something we really need to do worldwide. Now why choosing open SUSE or why do we work with open SUSE on this federated model? Well first of all, the guys from GNU Health and GNU Solidario are also part of GNU's open SUSE community. They are already the packages, both on Leap and Tumbleweed and it's well documented and well supported. So as I said, you can stall GNU Health on Tumbleweed which is the rolling release version that's the one that I usually have and then for production you move to Leap which will give you more stability and for large implementations you can actually switch that Leap implementation to SUSE Linux Enterprise and that will provide professional support. Again, I get a lot of calls from people that installed GNU Health in hospitals and this is not a war processor. This involves a lot of things from performance to security to privacy and we're dealing with people here. This is serious, this is something that you should have a technical department that knows about databases, operating system, security, encryption to make sure that that implementation runs smoothly because we do the best we can to provide something that is kind of easy to install but if you don't have concepts on databases, you shouldn't be installing GNU Health as somebody that knows how to run databases, how to make backups, how to know that that information, if something happens, you have standby databases, you have replications and so on. If you have those people, then perfect, otherwise ask for the people that knows to install you GNU Health and running. GNU Solidario does not provide implementations because we are an NGO, we are focused on dealing with the community and of course the development of the software. We work hard with local people. We have Dr. Roof here from Jamaica. They have their own team, the Ministry of Health. That what makes a project sustainable. You cannot go there, make the implementations and leave because that will not work unless you have capacity building locally. And also OpenSUSE has been showing commitment to the GNU Health project, not only by providing support and packages but also being sponsors and donating, the raspies are being donated by OpenSUSE. I'm going to Haiti now and they already have these raspy computers that will be placed in a local hospital on the GNU Health implementation. So we are very grateful to the OpenSUSE community for all the commitment shown continued for the last years. And that's why we are actually here. They invited us to give a talk on GNU Health and OpenSUSE. We also have, talking about OpenSUSE, we have this federation community hub that allows the community to actually login into this public server and play around with the hospital information system, play around with the laboratory information system, play around with the federation and so on. Not only developers but also health practitioners and research institutions. This server starts itself every night so no matter what you put there, don't worry if you break it in a couple of hours, we'll be up again with some demo data. It's just more to get a feeling of what is GNU Health ecosystem about. And finally, let me just glimpse about real implementation projects. We go from small clinics in the rainforest in Africa and in this case, this is Cameroon, where they have small hospitals that cover specific area in the rainforest to very large implementations. AIMS is the largest hospital in Asia. It takes over one million evaluations per year and they adopted it a year ago and it's been done by them. They have a huge IT staff department and they are autonomous and that's what we need. We cannot be behind, I mean, in the case of Africa, sorry for saying Africa, in the case of Cameroon, yes, because these guys don't have an IT department so that's part of our role to provide them support. But these guys have huge IT, they have over 50 people just working on the IT department so they install it, I just went there for a week to give an overview and a bit of training and from there they took the task. We work with the World Health Organization in different projects. This is a Bafia district hospital but we also adopt many of WHO coding, ICD-10 for example, immunizations, pediatric growth charts and so on. And that was one of the training sessions that we gave to the guys of Western Africa from WHO. Jamaica, that's one of the pioneers projects. I think we started back in 2013, Dr. Roof, yeah. It's now six years that they've been using GNU Health and again, local team, they decided to build their own team to deal with the project itself or otherwise it won't work. I mean, these are huge public health projects that first of all, you have to be from Jamaica to understand the context and deal with your people and what they need and so on. And second, we don't have the resources GNU Solidario to be able to provide to every single implementation. Red Cross, this is Mexico with over 300,000 evaluations a year, Laos Public Health also. This is two implementations, one at Mahosot which is the largest hospital and all are in the CMR for rehab. And finally, we have this alliance that deals with academic institutions that want to collaborate with our project. And within this context, we have people from the University of Montreal for example, they go now, remember this project that we were talking in Camero? They are taking over it and people from Argentina will actually go to pick up and collaborate with them. And that's wonderful because that's what we need. We need to have a large community that tackles the challenges in different areas of the world. And I always thought that academia is probably the best way of finding people that is enthusiastic and that they have the time and the resources to actually do these type of jobs. So just naming Mr. Stolman, this was the very, very first project that we did as GNU Solidario and this is over 10 years now, 13 years actually, started in Argentina, Santiago State and the school. These kids are now full grown ladies and gentlemen and it's great, it's great to see that that seed that we put someday there, it actually is making sense today. And that makes me very proud of this little but beautiful project that we have. And I'm also very proud and happy to be able to share it with you guys today. And hopefully some of you will join us on the quest of making sure that health remains a non-negotiable human right. Thank you very much. Thank you. Questions? Anybody? So the interconnect probably uses HL7 with messages? There is a project, we didn't go through every single sub-project but there is an HL7 messaging server that connects with GNU Health in specific areas. For example, the lab and the encounters, it's not all of them, but HL7 Fire is the one that we are actually implementing. Yeah, HL7 Fire. Yeah. Oh, sorry. Is there a small guide to setting up a new health for a small clinic in the United States? We don't have specific localization projects. We have the documentation on Wikibooks, but we don't have yet a guide for localizing new health on specific countries. We have members. Actually, the guy that is doing the HL7 Fire is from the United States and he knows well all the specifics. States is hard. There are a lot of things that you must comply in order to have it, but he knows well all the requirements and we can actually put you guys in contact with Chris. I'm sorry, can you repeat his name? Chris, Chris Simonman. He's also working on Daikon, not only on HL7, but also on Daikon and he's also becoming a doctor very soon, so he pretty much has everything. Oops, sorry. I came in a little bit late, sorry, but just real quick on some of the obvious questions I think are for use in the US, for HIPAA compliance, quote unquote, for the EU, for GDPR compliance. Is there encryption built in and in? How far along is that? And my wife works for a large health system here in the US and they're using proprietary software, it drives me crazy, costs, and he did mention some of the orgs using it, and I'm sorry if I missed it, are there healthier orgs in the US? You mentioned the Red Cross, but it gets elsewhere in the US and using it or trying it out and you mentioned how widespread is it? You're proposing it in Spain, if you're saying, right? It's not, and how far along is that proposal being considered, thank you. Well, thanks for the question. Health is, it's pretty much a framework, okay? So we provide the framework to be able to deploy into a health institution or into a network of health institutions. We provide encryption, we provide digital signatures, we have the packages to connect with the GNU PG libraries and all that is already there and it has a very fine-grained way of dealing with security and access control, but again, I'm not the right person. I just don't know well what are all the requirements.  It's, I know some cooperative and this is coming for a couple of years ago. We're using GNU Health within the United States. Now, when you move to the public health arena or whatever, I just don't know, we have some specific modules for example, for Argentina and other countries. Whenever you go to a country, say Jamaica, Laos, Argentina, Spain or whatever, you do need to have your own localization in terms of reporting, in terms of security, in terms of privacy, but that goes more into that specific context and having somebody to actually adapt GNU Health for that country. Yeah. Any other questions? I'm a physician as well and I've dealt with several EHRs here and yes, unfortunately, they're all proprietary for the most part except for the Veterans Administration, Vista. That's an open-source project that's been around since 95, I believe. Wondering if you've ever reached out to them to try to interface with them. That might be a good place to start. Yeah. Yeah, we know Vista and it's been doing very well in the States. From the technical point of view, they are completely different projects. The type of databases that Vista uses, it made it a bit hard to actually interconnect. Now with this HL7 and also the Federation RESTful APIs, it's easy to send messages across heterogeneous systems. To be honest, yeah, I kind of checked it a while ago but it was a completely different infrastructure from the technological point of view that we use Python and Postgres SQL and they use maps and other type of databases that it kind of make it incompatible. Now with again, with the RESTful APIs, it makes things easier. Yeah, Michele. Yeah, thanks, Luis. Just a couple of things. So as you mentioned, we have done some implementation in Jamaica. The security aspect, somebody had a concern about that. What we find will work best is first defining the security and privacy requirements and use that as part of what's required to build out the system. We're still in a transition mode, as you know, working with the government and various other agencies. The other thing though is the Federation, I find it very exciting. The use of HL7 fire and so on. But if we look at it even on a national scale, say a country like Jamaica, 23 public hospitals, about 11 or 15 or so private hospitals, everybody will be using their own software in the private sector. Public sector is on the one authority, the Ministry of Health, so we all have to use the same thing. So just interesting how to handle the data standards, et cetera, to arrive at that Federation, coming from different nodes and how that might work out. Right, so in terms of privacy and security, that's a great comment and that's what I was saying before. We shouldn't rush to implement the software because this type of software requires a lot of design in terms of human resources. Who can do what? What can do each health professional? What can do the patient? And you do that before actually implementing the software. You do that on paper. And once you have that on paper, it's easy to map it into software. Otherwise, you are compromising the security and the privacy of the data that you have in your health implementation. But people usually tend to rush and just install it and then the problem is they have to go all the way back and do a rollback and waste a lot of time. So yes, designing is key, not only for security but also in terms of scalability, what type of software, what type of infrastructure am I going to put? So we can actually scale for the next five years or whatever. The message is there is, we have designed on each of the resource and endpoints the type of message that you will send on each method. So if I send a put, if I make a put or if I make a patch request, you need to know what are the specifications on that message, how it will go. And that's how the federation works. Now, if you use the HL7 fire server, then that's the coding specification is already there. There are pros and cons always, you know, if the way we do it is if you, it provides you maximum flexibility. So the people that is making the mobile application for Gino Health knows, okay, if I want this node to be part of the federation, how am I going to send the message of a new encounter or a new domiciliary unit or whatever I want to do with it or a lab test, you know? But it's clearly documented on Talamus. So it's just a matter of going there and say, okay, this is the way I need to send the message. It's JSON based, by the way, all the messages that we send and receive. And we love that standard. It's very nice and quite universal too. But it's documented on Talamus. Any other question, please? And notice the previous slide mentioned the lab information system. Do you guys have a lab information system or are you interfacing to an external lab? We have, I don't know what I have in the slide here. No, I don't think so. We do have a LIMS. It's actually called Occhiolino, okay? And it's a lab information system. Actually in Ghana they are using it today, specifically as a lab information system, okay? So it interfaces with the hardware, with the analyzers instead. But all the processes within the lab are already there, okay? So sample and everything is already there and you can print out the results. So it's a LIMS by itself, yes. Independent, yeah. Any other questions? Thank you. Yeah, thank you. Thank you guys. Test, test, test, okay. Is the microphone working? Yes? Yeah. Okay, thank you. Okay, maybe better now. Okay, no, I know where to place it, thanks. I'll be showing some code snippets so if you don't have good eyes like me then I would recommend sitting in the front. No, don't need to, thanks. Okay, so it's 1 p.m. Let's start. Welcome to my talk about buffer overflows and mitigations. First let's start with the obligatory who am I slide. My name is Johannes Sigitz. I'm a security engineer at SUSE and I'm based in Nuremberg, Germany. It's my first time in LA and finally I see some sun because I made my wife jealous by telling her, hey, I fly to LA and then it's raining all the time which was kind of annoying. Okay, my main daily task code review and product pen testing and that's the reason why I'm interested in those mitigations because they make my life easier or harder depending on which site I'm currently at. I joined SUSE in April, 2014. That was a great time to join SUSE because that was the exact day Heartbleed broke. So joining a security team was really the perfect timing there, no panic at all. Okay, this is the outline what we are covering today. We will talk about buffer overflows and how to protect against them. We will talk about stack canaries, fortify source, ASLR and no execute memory. These are all used by SUSE products. There are other protecting mechanisms that we are using and of course these are also used by other distributions. This talk will require some C and assembly background. I will explain most on the fly. If you space out at a certain point of the talk, don't worry, we will cover those four areas and you will be able to resume, hopefully, at least my hope. And please stop me if I'm going too fast with the examples. We will probably need almost all of this hour. So if it's going too fast, please tell me so. We will have to keep going a little bit faster than usual because usually I do this talk in one and a half hours. This is also of course just a short overview so you're not going to be elite hackers after listening to that, but that is usually the case. If you go to a talk, you are never experts after hearing about a topic for one hour. And I will also try to keep it at least a little bit interactive. That depends on how much time we have and it also depends on you. So if I ask questions and no one answers, I will stop with that. So if you don't want me asking questions, then just stay quiet. Okay, so we are talking here about stack-based buffer overflows. There are other kinds of buffer overflows. The stack is a certain memory region in a process that is used to handle data. This is usually a problem in languages where you manage your own memory, so especially C. If you have a language like Java or Python where memory is managed by the runtime, then this is usually not a problem. And if it's a problem, then it's a bug in the runtime or virtual machine can be fixed in this one component and then everyone is safe. On the other hand with C, we will probably never run out of buffer overflows because managing memory is hard. So this is a really simple example here. We have a small program. It has a statically sized buffer of 20 characters, so usually 20 bytes. And then we copy the first argument given to this program into this buffer without any size check. So this will work until we give it more than 20 characters on the command line and then it will start crashing. So this is really the basic principle of what we will see here. So the general mechanism is that you have a given buffer size and you put too much data into this given buffer. Usually the problem is that you are just missing a size check. So if you think about the example that I just showed, there was no check at all for the size. So whatever size the argument is, it will just copy it in there. Sometimes you have a check, but it's either faulty or it can be circumvented. And circumvention usually it involves some form of integer overflow. So you might have a multiplication in the check. The multiplication might overflow. You don't check what you think you're checking and the attacker can still use the buffer overflow. So why is this a problem? I mean, you could think, well, we will flow some data, why do I care? This is a problem because in our architectures we mix data of our applications and control information about execution on the stack. So here's a really simple example. We have two functions. We have a function A, we have a function B and function A calls into function B. And so this data structure called the stack currently holds the local variables of function A.