So today I want to give you some tips for parenting your children throughout the spectrum when we think children, we think children. I'm talking about from here to here. So let's talk about those things. If you say it, you own it. If you say it, you own it. I remember talking to a police officer. Yes, I've been a barber for a long time, but most people don't know and I don't lead with this. I was a psychotherapist for 22 years, master's level. I was a clinician and I left that world about 15 years ago. And I remember talking to a cop that I had as a client and I said, do you ever use your gun?  And he says, I've never had to pull it in my entire career. He said something I learned in Academy many years ago was that once you pull the trigger, once the bullet leaves the chamber, you can't call that bullet back. I'll never forget that. That reminds me of our words. They're like that bullet.  You can't call it back. So you have to own everything you say.  There's nothing unmanly, unmasculine about admitting you were wrong. Actually, I would say that is one of the qualities of men, of a true man and a true masculine man is to admit where he's at fault. I'm not talking about apologies that you see in the media today publicly. I'm talking about private apologies in your home to your family. One of my favorite mentors is John Paul DeGioria, the founder of Paul Mitchell Systems, one of the largest hair product companies in the world, salons, beauty schools, etc. And he has a management style where he says, catch people doing something right. If you want to get a job with Paul Mitchell Systems, you can't. You know why? Because no one leaves. They retire, but nobody leaves. The retention rate is amazing. If you want to hear a great speech, go to Stanford University's business school. John Paul DeGioria speaking. It's about a 60 minute speech. It's the best business speech I've ever heard in my life. And he says, catch them doing something right. Our radar is on for catching people doing things wrong.  We naturally are wired for that.  I like that. When they come out of the room after they dressed themselves. Wow, you look really good. That's good for them to hear. Catch them doing something right. Get that into habit. Break the habit of only criticizing. And many of us, I heard Charles Stanley talk many years ago. He said, inside of us is, you know, we have George and then we have little George. And that little boy that's inside of every single person, every one of you can still hear the critical parent, the critical teacher. And we hang on to those voices our entire life. You can't do anything about your past, but you can do something through your children.  You want to live forever? Teach your children properly. That's how you can live forever. Praise in public reprimand in private. I didn't come from that kind of family. Praise your kids in public reprimand them in private. We used to joke around in my family, everything was reprimand in public. I mean, I got swatted in public. I got put down in public. I won't do that to my children. My children are 22, 20 and 16. Well, actually 16. And I never did that because of what happened to me. There's something you don't like about how you were parented. What a great opportunity to turn that around and do something different. Praise in public reprimand in private. The enemy of execution is complexity. Keep parenting simple. It's better to have one simple project than 10 where no one retains anything. Keep it simple with your parenting. Children remember your projects more than anything else. Think about that. Of all ages, I'm talking the spectrum. CNI, I learned this in management training. When I was a hospital administrator. We heard of CQI, continuous quality improvement. TQM, total quality management. Well, what's hot now.


For more videos on people's struggles, please subscribe to our YouTube channel. So all over the world, hunger levels are rising. Yet in some parts of the world, they are dramatically declining. One of these countries is Nicaragua. And Nicaragua has achieved this through food sovereignty. Food sovereignty is a radical practice which gives people access to healthy affordable food. Not only a healthy affordable food, but food that is culturally appropriate. This food sovereign model reprioritizes a harmonious relationship with the earth. It's not just about exploiting the land, but about making sure that we regenerate the land as well. When we talk about food sovereignty, we have to talk about land redistribution. And this is kind of the key to the whole project, particularly in places like Nicaragua. It's a revolutionary demand in essence because it redistributes the land to the most oppressed in society to make sure that they have access to grow their own food and continual access to healthy food. So by redistributing land, you're actually completely restructuring all of society and moving much of the country's production away from corporations in the hands of local producers. So you could say that food sovereignty is inherently an anti-capitalist, anti-imperialist demand. It can in fact form the cornerstone for many revolutions and has done in Nicaragua. From 79, agricultural reforms have really been at the heart of the Sandinista movement. Of course, we had the 16 years of neoliberal governance between 1990 and 2006. But in 2007, when the Sandinista came back to power, they actually enshrined food sovereignty into law in Nicaragua. So this meant that it wasn't just a sort of cultural practice amongst indigenous people and amongst the working class, but now it's actually being supported by the government from the top. And this is what makes it very different to many other food sovereign models in the world, because the government is actually subsidizing many of the rural farmers and small landholders in Nicaragua. So here in the context of Nicaragua, within this long-term struggle for the construction of popular sovereignty, which also includes the construction of food sovereignty, there's been a lot of emphasis, especially in recent years, to what we call here massify or basically implement agroecology. Agroecology being understood as one of the key pillars to be able to achieve food sovereignty. Agroecology is considered as a model of agriculture that is basically the opposite to the model of agriculture that was promoted through the Green Revolution. So through the Green Revolution, a type of agriculture that basically replaced a lot of technologies and use of chemicals that were used in war. So the Green Revolution technologies, the heavy use of chemicals, monoculture, et cetera, is something that of course Nicaragua has not been immune to. However, there's been a lot of efforts both here as a product of the San Luis Revolution, the current San Luis government, as well as our popular organizations. There's been a lot of efforts to implement agroecology. At the national level, there's a legal framework for agroecology. So there's a law 765 specifically on agroecology that was passed with the current government in 2011, which follows up on the very important food and nutritional security and sovereignty law that was passed in 2009. And paired with that are dozens and dozens of social programs that are promoted to promote this different kind of agriculture and agriculture that importantly is not based on things like monoculture being dependent on chemical inputs, fertilized, et cetera, but is really based on peasants having land, which Nicaragua they do, thanks to the grain reform, which is a product of the San Luis Revolution, but also being more autonomous in the model of food production, rescuing and sexual and traditional knowledge and pairing that with new ideas, new technologies that might come out of allies in academia or within the organizations. And it's also very much paired with other kinds of methodologies that are contrary to or not used in the dominant capitalist system. So for example, the importance of centralizing peasant knowledge. So within agroecology, there's a big emphasis on put on a methodology that's called the peasant to peasant methodology, which is basically a methodology of sharing knowledge that exists currently exists on farms by peasant farmers, both men and women, but highlighting the important role that women play in agriculture and sharing that horizontally in communities and over time spreading that throughout the territories. Another really important thing that's currently taking place right now within agroecology here in Nicaragua is the is in the area of training. So both the government as well as popular organizations like the ATC have very, very active training programs. The government has a number of training programs in the countryside that are completely free for anyone that wants to participate that makes certain kinds of that makes education available to the working class and the present class that is very much inaccessible in a lot of places in the world, but it's here is very accessible and their agroecological models of food production are being promoted and implemented and also very importantly, popular organizations like the ATC along with the organizations other organizations like Livia Campesina also have their own training programs. When it comes to feeding the people, the only real solution is food sovereignty because the US has been weaponizing food to then start populations and cause further descents as we've seen now in Cuba and this is where Cuban crisis really stems from is the 60-year-long US blockade which start the people and then cause these shortages in supermarkets and markets around Cuba. So I think this is what's been so successful for Nicaragua and why even in spite of the sanctions against it, it's never struggled to meet the basic demands of people which are food, water, housing, sanitation. The Nicaraguan Sandinista government since 2007 has put those at the core of its ideology, not luxuries and not safe profits but the people.


In today's video, we are going to talk about some interesting facts and myths about the toybob cat. The toybob cat is often referred to as one of the smallest of all cat breeds, no bigger than a three-six-month-old kitten of a normally developed domestic cat, with a short strong, and muscular body, short bob tail consisting of several king vertebras. It is worth mentioning that the breed is not a miniaturized version of an established breed of cat. The toybob is a naturally small bob-tailed cat that originated in Russia and existing there for over three decades. The toybob can be found in all colors, and have either a short or semi-long coat. The toybob short hair is more common at this time as not all professional cat associations have yet approved the toybob long hair. 1. Toybob Cat's History The toybob cat was first documented in the Rostov region of Russia in 1983 when Ms. Elena Kraya Senechenko adopted a stray seal-point cat from outside her home. By her accounts, this cat looked very much like a traditional Siamese cat, except for its kink shortened tail. It later bred to another bob-tailed seal-point domestic short hair female, and in 1988, the breeding of these two cats produced an unusually small bob-tailed kitten, named Kusy, which became one of the foundation cats for the breed Kraya Senechenko called Skiyv Tydon. By the late 1990s, the toybob became scarce, and a breeder from the Ural region of Russia, Alexis Abramshuk of Seshavet Cattery had begun to broaden the breed's limited gene pool by adding domestic cats. When Seshavet discontinued their toybob breeding program, local Ural breeder, Natalia Fedyeva of Little Angel Cattery, acquired from Abramshuk, a small male gaverla, elsewhere, two females, all three from the Skiyv Tydon line and began her restoration of the breed. Fedyeva had observed that cats of very similar phenotype to the toybob were spotted living locally around barns and streets in that region. Some of these native cats were also of small size with kink tails or kink bob tails but seen in colors and patterns other than seal-point. Fedyeva, along with other local breeders, continued to expand the toybob cats initially small genetic pool by adding those found domestic cats as well as other similarly phenotyped breeds. Fedyeva began to refer to her cats as scythe toybob to differentiate them from the Skiyv Tydon and exhibited them in the World Cat Federation in their unrecognized breed category. In the past 30 years of the breed's development, the toybob has gone through much rope untangling to get it under one general breed name finally. The breed has been known under several different names and is a significant component of its history. It was in 1994 when the toybob breed name was suggested by Russian feline book author and WCF Judge Drive, Olga Mironova to be given to all the cats in development. The breed expanded internationally when in 2004, toybob's were imported to the United States by a Burmese cat breeder, and four years later the toybob entered experimental status within the International Cat Association. In 2014, the majority of Tika registered toybob breeders under the direction of Dr. Anna Gramova, DVM began to work in close cooperation, focusing on advancing the breed's recognition. A year later the international toybob cat club was formed, with a dedication to promote the breed worldwide, mentor new breeders and unify the toybob standards across all cat fancy associations. Due to the ITCC's efforts, the cat is now advanced within Tika and it is quickly gaining popularity across the world. Today, the toybob has achieved full championship status in its native Russia, WCF, Cat Fanciers Federation, and the American Cat Fanciers Association. The toybob, as well became the Cat Fanciers Association's 45th recognized breed when it was registered in their miscellaneous class. Currently, the toybob is quickly expanding worldwide, and there are toybob breeding programs all over its native Russia, throughout the United States, throughout Europe, Israel, and Japan. Hello. This video is sponsored by Beemix Pets. Are you looking for high quality cat collars at an affordable cost? Check out BeemixPets.com. Use coupon code Kittenlife to get 20% off. 2. Toybob Cat's Genetic Background The toybob cat's most unusual feature is its kinked bob tail, and just like other known kinked bob tail breeds, the tail does not affect its agility or health. At the time the breed was registered with Tika, little to no genetic research had been done on the breed to learn more about the unique genes behind the toybob cat's anomalous small size, bob tail appearance. Leading to much speculation as to it having possible relations to other known bob tail breeds. In 2016, the ITCC under the new direction of current president, Mrs. Margo Hill decided to perform preliminary testing with the geneticist and renowned feline expert Dr. Leslie A. Lyons to find any connection to other bob tail breeds. Results demonstrating the toybob has its own tail mutation unrelated to any bob tail breed like Japanese bob tail, Corillian bob tail nor Max. 3. Toybob Cat's Personality Feline traits notwithstanding, the toybob has all of the qualities one looks for in a companion cat. Toybob's thrive when they are with their people. The toybob is best described as the small cat with a big loving heart. The toybob is intelligent, good-natured, affectionate, and social, making it easily get along with other friendly animals. They will be content to quietly follow you around and then sit in your lap for petting whenever you give it a chance. In general, the toybob is a happy cat who gets along with everyone and is a playful, cuddly companion. Toybob's are very loving and devoted to their family, but they can have a natural shyness around new people. It's not unusual for them to be a little shy with strangers for the first few minutes until they warm up to them. The toybob's smaller size and gentle demeanor make them also great company for children, although supervised playtime is recommended for homes with very young children who might accidentally injure them. Toybob's are also seen to have very protective personalities, applying it either to their human family members or other pets at home. They often rush in to split up fights or if someone needs help. Overall loving, charming, and playful, the toybob can be quite addictive. People who love the cat can't imagine life without one, and many can't imagine life without two or three. Their diminutive size makes a toybob great in an apartment setting. Toybob's long for companionship, so it is not recommended to have only one if left home alone for extended periods. 4. Toybob Cats Health and Care Toybob overall health is rather robust due to the harsh environment from where the breed originated. Also, the continued use of native Russian domestic cats in the breed development maintains excellent genetic diversity and good health. The breed has no known health or genetic problems and is known to be long-lived even past 15 years. Although a petite cat, the toybob might surprise some as it carries a nice sturdy weight to it for its overall small body. The short coat of the toybob short hair is plush but easy to care for, brush it once or twice a week to maintain its coat beautiful. Toybob long hair has a semi-long coat, and does not mat or tangle and is easy to groom. As with the short hair, comb its coat once or twice a week to keep it in optimal condition. Both varieties are low shed, but the coat does change seasonally. Caring for a toybob is relatively easy. The toybob does not require any special diet, and as with most cat breeds, high quality cat food is essential for a happy and healthy cat. The coat of the short hair version is plush but simple to care for by brushing it once or twice a week. The long hair version of the toybob has a semi-long coat that does not mat or tangle and is easy to groom. As with the short hair, combing once or twice a week will keep a toybob in optimal condition. Both varieties are low shed, but the coat does change seasonally. Toybob kittens are normally ready for their new homes at around 12-16 weeks of age. It is important to choose a breeder who is careful to socialize their kittens as infants and throughout their developing first months in order to ensure a well-adjusted kitten and adult. If you enjoyed this video, kindly press the like button. Also don't forget to subscribe with notifications on, so that you don't miss out on videos like this. Thank you for watching.


All right then, we have a really packed day. It's one of my bad habits is I try and squeeze in as much as I can in this one day because it's a pretty big community these days and there's lots of things going on. So I'm gonna get started right away. For those of you who don't know me, don't worry by the end of the day you will and you will have volunteered for something. My name is Diane Mueller. I'm the community manager for OpenShift and the director of community development at Red Hat for OpenShift. You can find me online as Python DJ which gives away my loves and OpenShift Commons. And so today we have a hashtag for the events. If you're taking pictures or sending anything out there to the universe it is OC Gathering Austin. And we also for all of those of you who are out there in Facebook land are attempting to live stream this. So everything here will be on the Facebook slash OpenShift page and you can find it from our landing page for this event as well. So welcome to everybody who's watching from Facebook land. We're really thrilled to be doing that. And all of the recordings will also for each of the sessions will be broken up separately and put up on the OpenShift Commons landing page so you can watch those later or on Facebook as larger groups. So today you're gonna hear a lot about OpenShift in action. We have a number of folks who have OpenShift deployments who are coming to give case studies or beyond panels from lots of different sectors. So we're really pleased and grateful that everyone has volunteered their time and come here. So it's been a wonderful year for OpenShift. A lot of growth and we've done a lot of work in the upstreams as well. We have a number of people from different parts of the Kubernetes community that will be on the upstream this panel. We have folks coming from Google and from Amazon and from Microsoft talking about their clouds and what we're doing with OpenShift on their clouds and what they're doing in their clouds with Kubernetes as well. So there's a lot of cool stuff. At the end of the day we have a wonderful panel plan for you on machine learning that's been pretty exciting to organize. So lots of you have heard about us at Red Hat. Our favorite catchphrase these days is all about digital transformation and we talk about it in terms of applications and platforms and processes. But I would have that there's also another transformation that's coming and it's in the way that we organize our open source communities. And we have done a lot of work with OpenShift over the past couple of years as we've pivoted to embrace the Kubernetes community and doing a lot of collaboration with the upstream projects. And really what we're trying to do as a community is reach out to you, the folks who have OpenShift in production, the people who are contributing code to OpenShift origin, the people in the upstream projects, all of our partners who are building services that run on top of OpenShift with OpenShift applications who help us with storage, all kinds of things around security. We're really trying to drive our collaboration to be much more in the open and to make sure that we get the benefits of this open source revolution that's been going on. And what you'll see from our point of view in Red Hat OpenShift land is that it feels a lot like we're pulling a lot from a lot of other projects and we push them out into origin which then feeds into our enterprise offering into OpenShift dedicated and OpenShift online. But really the heart of everything is out there on GitHub. Everything you need to run OpenShift is in the origin repo on GitHub. It's out there in the open. And really what we're pushing today and what we're really trying to get you to understand is this new model for collaboration. That it's not just from a community manager's point of view about trying to coerce you all into contributing code to origin. We want you to contribute code to everything. We want you to use everything. All the tools that our partners are bringing to bear for the applications you're running, all of the underpinnings that the hosts are using, and we want your feedback. So today it's really important that you realize that it's coming from all directions from underneath infrastructure, from on top on the services, and we're pulling all of those things into a conversation, which we feel that OpenShift today and Kubernetes over the next couple of days at KubeCon is really the linchpin for those conversations. So really, I want to talk a little bit about what Commons is, and I've talked about it in terms of being a new community model because it embraces not just the code contribution people, the engineers, but the users, the service providers, the hosts, all of the upstream project leads, and what we really feel, and I really feel strongly is that what we are is a communication channel, trying to hook you all up to each other and introduce each of you to each other and to start those conversations going because what we're really trying to do is not just promote OpenShift, which we know you all love because you've tripled in size the audience since the first time we had our first gathering in Seattle, but to really to promote the peer-to-peer interactions within these conversations here and virtually as well. So doing that, we have set up, and if you're not on the Slack channel yet, is Jason in the room? No, is Jay Dobie? I think he might be outside doing this. A gentleman who's the only red-hatter wearing a Docker t-shirt. He is our Slack admin for the day. If you're not on the OpenShift Commons Slack channel yet, find him on one of the breaks and get in to the Slack channel today, we'll just put you in. One tenant we have of the OpenShift Commons is we're not anonymous. Some of you may have seen some of my rants online in places, but I think one of the things that really promotes the peer-to-peer interactions is self-identifying, so that people know who your corporate masters are, what your agendas are, none of that's hidden, it's all out in the open, so I do ask that you join using your actual corporate email addresses and name yourselves so that people can find you. It makes it really nice and easy to do it. We also have been doing a lot of OpenShift Commons briefings. We just did our 110th one. I feel like a TV channel some days. We just did one on TensorFlow with Subin, and that's been a real hot topic for us, but if you have a topic that you wanna hear about, that you don't hear about today, come and find me, especially if you can do the presentation, I love to hear new topics. We have some special interest groups. If you go to commons.openshift.org and scroll halfway down the page, you'll see a whole slew of them, and we're launching the machine learning one here at the end of the day too. We always will take your code contributions. Please make a pull request, log an issue, go on Stack Overflow, answer a question, and there's lots of mailing lists that we can get you involved in, so find me over the next day. I'll be here through all of KubeCon as well. I'm easy to find. That said, this is amazing, and I'm really grateful that all of you came today. There have been, there's such a huge uptick right now in interest in OpenShift and Kubernetes, in what we're doing with containers, and the OCI work we're doing, the work that's going on in CNCF. That I'm just internally grateful for the level of interest in this, and hopefully we can scale, and I can clone myself a few times, but we've had lots of people, just in the last 60 days, over 20 new organizations joined the OpenShift Commons, and so welcome to all of you, a lot of you are in the room, and this is your first time. It's also quite global. We are everywhere. Anytime I turn around, anytime I wanna go on a travel or a vacation, there's always somebody I can knock on their door and ask to go for a coffee or something, and I'm hoping that you will all do the same thing too, and reach out to your peers. There are now 315 organizations. There's a number of folks in the OpenShift Commons who are not allowed to be public, so there's a few of you in the room, though a few of them are gonna be outing themselves on the Gov On OpenShift panel today, so that'll be fun, and we try and accommodate everybody, depending on their privacy stuff, in the Commons as well, so it's really about participation, and if you need help getting it through your legal, we'll work on that as well. But really the future for us is really about collaboration. Collaboration in the upstream, you all know that Red Hat has been a big contributor to Kubernetes, pushing a lot of the functionality that we built out for OpenShift V2, and functions and features and things that we grew and loved with V2, and moved into V3, but also have contributed back into Kubernetes, and there's a lot of, it's not just about Red Hat, there's some Huawei folks in the room, there's a lot of customers that have been pushing stuff in, and there's a lot of new projects. The CNCF is doing a lot of great work. They'll be live all the rest of the week tooting their horns, but we should toot it for them as well. When I took this snapshot last year, there were like only I think five projects that were under their wings now, and now every time I turn around there's a new project. So there's a lot of contributions from a lot of other companies. It's not just about Red Hat, but we're happy to be there. Yeah, I did do a count. There are 45 member organizations in the room. There's a lot of you who are members, and there are a lot of you who aren't. So if you'd like to join, please reach out to me and find me today, and I'll get you all hooked up. But really the interesting thing is, as a community manager, traditionally my job is trying to rope you into giving contributions. And when I gave up that goal, like when I gave up trying to beg you all to give, contribute code to origin and to the features that we were trying to drive into it, and started embracing the greater ecosystem as being community, it really did an interesting thing. It ended up driving us from about five to 10 organizations contributing to OpenShore Shift Origin into over 70. So this new model is actually working really nicely for us. And it's pull request, it's issues, it's feedback. Everything has been very helpful, and so please keep it up. It's a very active group, and Bittersia is one of our dashboards, the Stack Analytics, all of this stuff is public. And we're continuing to add new developers all the time to the Origin project, as well as lend our expertise and resources to the other projects under the CNCF and outside of it at OCI and on other projects. We're really amazed at the amount of collaboration that's going on in the open source world these days, and we're really happy to be part of it. So it's not just about OpenShift, it's about all of the things that we use with OpenShift, all of the services that you folks are providing. This is really what the future looks like. The future is all about continuous collaboration. We use CI, CD all the time in our processes for software development, but I would say that the virtualization of our social networks and the access to everything that we have is really helping us push the envelope in scaling ourselves as resources, though maybe not me enough, but we'll try and keep those channels open and keep those things doing so that you're all part of this wonderful universe that is OpenShift as well as all the upstream projects. So that brings us to today. It really is about your participation, about you meeting the people next to you, scrambling it up at lunchtime, looking for different topics to talk about, seeking out your peers, and giving us your feedback. One of the tenants of the case studies and the panels that are being presented here today is we're asking for your feedback. We have product managers and engineers from the Red Hat team and from the community that are here in the room that are listening for what is the new feature you want in OpenShift, what is the next thing you wanna see in Kubernetes or in Creo or in one of the other projects. So feel free to grumble if you have to, but we will put you to work. So we've had a couple of shifts in the agenda. So the piece of paper that everybody got handed out has only one thing. We've moved the Kubernetes 1.8 down a little bit so the agenda will go slightly off base to accommodate another event that's happening here today, the Kubernetes contributor summit is happening in parallel, which makes it more amazing that all of you are here because I know a number of you and a number of the folks at the Kubernetes contributor summit wanted to be here too. So thank you for your time here. So Aperna will come on after the digital, the Telus Digital folks. And I love that the Telus Digital folks are here because I'm Canadian and they are my Canadian telco. So I'm thrilled, so I can complain to them about my service, which is actually pretty excellent. But it's gonna be a nice, wonderful day. Yeah, they're over there. It is, I have a good story for you about Telus. They're awesome. And the afternoon is packed too. So the one thing we didn't do, we didn't put a break in the morning. So if you need a bio break, politely stand up and go out and grab a coffee. There's an espresso machine out there that NetApps, I believe it's NetApps it's sponsored. So we're really grateful for that because we need that caffeine. But in the afternoon, there will be a break and we have a cookie break that I think it's aquasic is doing the cookie break in the afternoon. So there will be a break, we will let you coalesce there. And then the evening, there will be a reception with beer and fun things like that. And then afterwards, Diane will collapse. I wanna thank all of our sponsors. This is the first time we've done sponsoring for this community event and everybody really did step up. We're really a grateful to all of you. When you're in the lunchroom and you're in the reception area, please visit them. They're doing some great work. All of them have been doing OpenShift Commons briefings. They're all, a couple of them are brand new to the community. And we really hope that you'll support them and ask them good questions and give them your feedback on their offerings. So lunch, again, is gonna be in the room right behind me. It's really about you networking. So I'm gonna ask you to really try and reach out and meet somebody that you didn't come here with. You don't have to go home with them. Just meet somebody, that's all. And then we're gonna start the beer and the networking event. And it's gonna be hosted by the, most of the OpenShift team will be here with you so you can pepper them with questions as well. So let's get started. This is the wrong hashtag. It should be OC gathering Austin as opposed to 2017. I'm gonna bring Chris right up here and get him started here. I'm gonna reiterate the Wi-Fi passcode one more time in case you didn't hear it because more of you are in the room now. It's the Hilton meeting is the Wi-Fi and the password is OpenShift 2017. And for your Facebook people, I'm sorry, that's not gonna work for you in your homes. But please do give us your questions and talk to us on Facebook and share it out because we're happy to have you all with us.


Hey, good morning. So yeah, I'm going to talk about standing desks. Because in the past three months, I've switched from a regular desk to a standing desk, and I really like it. I built it from scratch for myself, and I ended up building two more for two of my friends.  I live in San Francisco, and I work at Engine Yard. A lot of my coworkers already use standing desks. And they told me part of the reason they like it is in the afternoon when you get kind of tired or after lunch, they felt like it helped them stay more alert and more focused. So that's the initial reason I kind of got interested. I gave it a try, and I just worked from a standing pairing station for a few days, and I really liked it. I liked it so much that I wanted to make my own. And so that's what I went about doing. So I'm no stranger to crafts and the DIY scene. Usually that means I'm doing things like sewing dresses or making pop-up cards. But since I took up making desks, things have taken a much more industrial turn. So really the hardware store has replaced the fabric store as my source for materials and inspiration. Just to give you a little background of where I'm coming from, I had never made any furniture before. Maybe just some IKEA construction. I also live in San Francisco. So that means I don't have a garage, I don't have a car. I don't really have tools. I had a small toolbox. And even with all these kind of constraints, I was able to make these desks. Before I get into desk design and stuff, I wanted to talk a little bit about why standing desks are so popular, because it seems like there's a lot of articles right now and a lot of people are switching. I guess as developers, we spend a lot of time on our computer. And for me and a lot of people I know, that means we're sitting in the same position for a long time. Because when you get really sucked into something, you don't get up and take breaks as much as you know you really ought to. And I know that this much sitting is bad. Like, I can feel it at the end of a day or end of a week. If you spend a lot of time in the same position, your body just does not feel good. So I knew I wanted to switch. But I also kind of wanted to know some of maybe the reasons behind why sitting was bad for you. I'm not a doctor, and I don't know what's best for your body. I mean, for everyone, I think it's kind of different. But there has been a lot of studies about the effects of a sedentary lifestyle. They say, like, the conclusion of which is really that too much sitting is bad for your health and changes your metabolism. And it kind of change how at risk you are for diseases. And even in the long term, it shortens your life expectancy. So all these things were super bad. And I think the most surprising research was about people who were active, like maybe before and after work. Like, I would bike to work. I do yoga sometimes. And but because I'm spending such a significant part of the day just sitting, I would still be susceptible to the same risks. So the major takeaway from those studies was really that your body needs to move. And the muscles in it need to move often throughout the day. Not like this, but like just like moving position and then going for walks. And I think standing desk really encouraged that kind of movement because when you're standing, it's so much easier to shift positions, take breaks, walk around. And you don't feel like you're just kind of melting in your chair chair. And if you're thinking of making the switch, I think it's kind of a try it before you buy it sort of deal. You could just use a friend standing desk or a tall countertop. Or like this, you could kind of like elevate the surface of your existing desk. And just kind of use boxes or books to elevate the keyboard and the monitor. And it's important that you have the right posture. This diagram is from a company called Tinkering Monkey. They make a custom standing desk. That's pretty awesome. And it kind of shows you your elbow needs to be bent at like a 90 degree angle so that your wrist is flat. And then you need to stand about two feet away so your face is two feet from your monitor and your eyes should be at the top of the monitor screen. It's important that like you are comfortable throughout the day. So it should never be uncomfortable. And it helps to get one of these like gel foot pads. They have it at like kitchen supply stores and online. This is like $40 on Amazon. And it just kind of makes it more comfortable on your feet. I like to be barefoot, but I mean you can wear shoes too. And keep in mind, you're not gonna stand all day too.  You could take little breaks. So even when people start, sometimes it might just be a half hour standing, then they switch to a stool. So it's good to have a stool right by your work station to take a break and get off your feet. Even people who stand all day are standing 80% of the day. Like they're not, it's not like a long haul. So when I started doing some research, I wanted to see what kind of desks were out there, what kind of designs I could take a look at.  So these ones I thought were really pretty. There's these kind of desks that are wall mounted. It didn't really work for my particular situation because I wanted something in the office that I can move around. But I think for some homes and maybe some workplaces, this could be a really elegant solution. If you mounted like a monitor up high, like on the wall right behind it, you could obviously make it at any height. It looks really nice. This one is from Urban Case and it's $1,500. Solid walnut, obviously really pretty, but really expensive. And then my friend showed me this desk from Ikea, similar sort of idea. It's a drop leaf table that you could use as a desk. And the price is only $50, but you could obviously see a huge difference in kind of the style and the quality. This is the Tinkering Monkey Desk. I think it looks awesome because it looks really rugged and really strong and part of the strength is coming from the X in the bottom of the legs. The problem with a lot of standing tall desks is that you have these really long legs and then it's really top heavy. So it's prone to getting kind of wobbly. And by bracing the legs with this X or with the wires in the back, it's gonna create a lot more strength and keep it really rigid. The Tinkering Monkey Desks are custom built to height and they start at $750. So this is a desk probably most people are familiar with, the geek desk. It's one of the electronics switches. It elevates, it goes down, which is pretty rad. I mean, anyone could use it and they could customize it to their height. And they could use their regular chair obviously when they're sitting. I think the thing I don't like about it is that it looks kind of like office furniture. Like it's not really my jam. But for other people, like I think it's a cool desk and you could customize it by just getting the legs and putting your own desktop on it and then you could kind of make it look a little bit different. Also, they're pretty expensive. I think they're like $750 to $1000 depending on the size. This is like my holy grail of desks. It's from the Netherlands. I don't even know how to pronounce the design company's name, so I just wrote it. I thought it was really pretty because it had such a long, expansive surface and it had those legs that kind of bow out in the A shape. And I like that there's two layers of the desktop. So there's a cubby in between so your desktop won't get cluttered. You could stash some stuff, but it doesn't look bulky. It was really awesome, but when I did like a little price conversion, it was like $2,800. So I use this as inspiration for one of the desks I make when I first decided to make a desk for myself. And this is the other like pinnacle of standing desks from Italy, the Stilvall C2 Maximus. I don't even know how much it costs. It doesn't even say on their website. You're supposed to contact them.  Like it's like probably really crazy, but really beautiful and really finely articulated little wood movements and stuff like that. So as you can see, like there's this trade-off. Like you could get a really beautiful awesome desk if you're like totally balling, but if you want something that's, you know, more affordable, they kind of don't look that awesome. And so I think one of the reasons I really like doing stuff yourself is you're gonna control the budget, the materials, the quality and kind of like what look you're going for. So when I was looking for inspiration when I wanted to make desks myself, I didn't even limit myself to the standing desk because you could look at regular desks. I just think how could they be taller? You know, like, so I looked at blogs like Core 77, Apartment Therapy, furniture store called Design Within Reach. And just to look at some good looking desk and think about like, oh, if this desk was a standing desk, it would just need to be elevated and you could put a brace on the legs to keep it from wobbling. And then you look at, I looked at tables like this and I was like, this is so beautiful. And it's because it's a really solid piece of wood. It's really just has a heaviness and richness because it's like such a solid surface. Another thing to keep in mind when you're doing it, making your own, is that sometimes the desk top and the desk legs are cutting from totally different sources. So you might need to paint something or make sure that it's gonna kind of jive and match. So it looks like when you have dark wood, it looks good with color or dark accents. But when you have a light wood, it looked good with white or silver accents. So the first desk I made, I called it the Ikea hack. There is a website called Ikea Hackers. People share kind of unique things they did with their Ikea furniture. And yeah, people are pretty creative. It looks pretty rad. So I wanted this one to be affordable, something that'd be easy to assemble because it would be from Ikea and kind of accessible to everyone. And in my mind, I'm still thinking of this $3,000 desk and wondering how Ikea could translate into this. So I looked on Ikea Hackers and there's a lot of standing desks in there, but a lot of them were not the look I was going for. Like I wanted something kind of light and airy and I didn't want it to be bulky. And I think a lot of things had just multiple tiers and kind of looked kind of stacked up together in little Frankenstein. So I really didn't really find a desk that really suited what I was looking for. So when I was at Ikea, I found these legs called Galant. They're just A-frame desk legs and they're adjustable. So the height it could reach was 35 inches. And I'm pretty tall, my elbow height was like 45 inches. So I would need 10 more inches of desktop to kind of make up for that gap. And I went around the TV unit area and I realized that without the little legs, this could be a desk with a cubby. And this one called Black was only $50 and 10 inches tall and it was perfect. So I brought my haul back to the office. It was very easy to assemble because it just used the little Ikea key. And I set it together and this is what it looked like. It wasn't too bad. The trickiest part was really attaching this TV unit to the legs. And it was tricky because if anyone has maybe been a college student before, you know that Ikea furniture is not like really solid or made to last. Like you couldn't just put a wood screw in it and expect something to stay and be sturdy. Like it would just pull right out because inside the Ikea wood is just kind of particle board and dust and glue and black holes. So I centered the legs and I decided to put a bolt all the way through from that bottom surface all the way through the legs. So I marked the holes and I used a drill and as soon as you get through that like fake veneer surface, it just falls right through because there's like nothing in there but this weird sawdust that clogs your drill. I used these really big washers. I wanted to maximize the surface area where it's touching the desk so that it wouldn't like cause the hole to get all crazy. And you can see the washers inside. And this is what it looks like at work. For how easy it was to put together, I was really happy with it. And I like that it's adjustable so that if someone else wanted to use it, we could just twist the legs to make it a different height and lower it. The second desk I made was for my friend Robin. So she wanted a standing desk but we're going to Europe next week and we didn't wanna spend any money on anything but our vacation. So her challenge was that she wanted a desk and she wanted it to be free. So I knew this was gonna be a real test on my resources especially because I knew I wanted to get it done so I could show people how to source for like a free desk. But we ended up resulting to Craigslist or like started using Craigslist for a couple of the pieces. So this is actually the almost frequent. It ended up costing about $30. The basis was this tabletop. It was a broken table that was on the sidewalk. It was free. It had one leg, the surface was kind of gross. So we decided to use it as a tabletop. It's about one inch thick of like solid wood top and then it has that lip around it that's kind of like a faux thickness. It's not really that tall, it's one inch. And we measured her elbows to be at 43 inches. So we needed 42 inches legs. And for free, I started looking at all sorts of crazy things and thinking like what could be a leg? Like what could we make a leg? And she had this good idea to look on Craigslist and do a furniture search for 42. We found a lot of crazy 42 inch things. But what we finally decided would be usable was these pair of bookcases. They're just these short bookcases. We were able to get them for $25. And they would work as legs. We'd put one on each side and they'd be stable because they're already box shaped. And then we could use the shelves to store all the things that are in our existing desk. I really like having a wood surface. I think it looks just kind of rich and nice. But the desk wasn't for me. It was for Robin. She hates it. Like she totally didn't want it. She wanted to paint it this kind of bright blue color. So I had to concede to her wishes since it's for her and her office. The paint she got was from Kelly Moore. Kelly Moore has an oopsies section. Like it's $3 gallons of paint. And it's because they tried to mix a color and it didn't match whatever the customer was looking for. So it was really inexpensive. We painted the back of the bookcases too to match because it was just particle board. Then we sprayed it with a sealant and brought the pieces to our office and assembled it just using some wood screws. She also was thinking about keeping clutter minimized and having places for everything. So she painted these little hooks and we bolted them to the side so she had a purse and a jacket hook. And then we went to a store called Daiso. Daiso's really awesome. It's a Japanese like $1.50 store. Has a lot of desk organization accessories. So we got these trays that could kind of help keep her stuff all organized. And she was worried about the top surface getting maybe marred from water marks and stuff. So she got this beverage tray there was $1.50. So here's what her workstation looked like on her end. And here's what it looked like from the office. For $30, she was really happy and it went with the look she had at her work. And it doesn't yet have a stool in this picture or the gel mat because she got that the next day. She just brought a stool from her kitchen and she went to a kitchen supply store where you could get gel mat for by the foot. And it was only $12 for like four feet. Okay, this desk is my favorite. So obviously I got a little bit more confident in like my desk making skills at this point and decided I wanted to do something that was really cool and really custom. This one's for my coworker Andrew. He sent me some links of what he liked. And it was this kind of steel pipe construction of a frame and reclaimed wood as the top. And there's a couple of companies that are doing desks like this. These are from Etsy and you know, they range from like 600 to thousands of dollars. So here's the initial design thing that I had in mind. And it was just gonna be a tall desk with an H shape to brace the legs. It's all using a one inch galvanized steel and we're using T joints to connect it. At the top of each of the legs, there's a circular like steel disc called a flange and that would be used to bolt the tabletop to it. At the end, I thought we could have adjustable feet but that was hard to do. So I just used regular end caps. The budget was like $300. And my coworker Val took me off to this countertop. It's also from Ikea, but it's nothing like the Ikea furniture for that TV unit. Like in their kitchen remodeling section, you could actually get really solid pieces of countertop. It's an inch and a half thick. It was about $130 and it was really long like 73 inches long. You could see that it's much stronger than that. Like I would never try this on the other Ikea furniture. And the hardest part was it's unfinished. So you need to sand it, you need to stain it, you need to seal it. So the sanding bit was probably the most like physically demanding. We started with 180 grit and then went to 220 so to make it really, really smooth. And I tried out lots of different stains. Like I did, got four little samples and on the back end, I just did little strips so you could see what it does to the wood. I went with this one called Early American on the Oak because it looked a lot, it was very close to the oak's color. And I think that like, if you're gonna stain wood, you don't wanna try and turn it into something it's not. Like it's good to kind of like let the natural color shine through. So this is two coats. Well, this is me applying two coats of Early American. After that I used the lowest gloss polyurethane finish that they have. It's called a satin finish. Another tricky bit was getting the right lengths of pipe. So we did that diagram, we checked what happens when you put two pipes in a T-joint and what kind of height were you need because it needed to be also 45 inches tall. And we went to Lowe's to get pipe cut. And you can get pipe, like steel pipe cut at Home Depot, Lowe's or any plumbing store. And it's not very expensive, it thinks like $5 per cut. And you don't need to cut all the pieces because you can get pre-cut pieces for like the shorter lengths. So we got these four cuts and I thought that I would go there and say like, hi, I need 32 inch things, four of them. They would disappear, they'd come back and say like here are your lengths. But that's not how it is. You're in the aisle and you tell them what you want and they pull this machine from out the aisle. Like it was tucked in there. And then with no goggles, no gloves. And people just shopping, they cut it like right there and it's like cutting oil is spewing and little shavings, it's pretty intense. And so I brought them back, they were kind of greasy. I think because of that cutting oil or like pipes just have this kind of grindiness to them. So I had to take off all the stickers and use imitation TSP to get rid of the grease and create kind of a tacky surface. And I wanted to tack because I was gonna paint these legs after that was assembled. Screening them together was not too hard. You just like make sure they're really tight and wear gloves because all the edges where they did all the like cuts and stuff have little sharp bits. We tested this for strength as well. It was very strong. And then I painted it white with a primer that's especially made for galvanized steel aluminum. So after it was dry, oh also, since I didn't have a garage, I used the rooftop at my office as like my after hours garage. So a lot of the things were just on a tarp on this deck. Here's what it looked like after I painted it, just a matte black, just using regular paint because it was already primed. And then I brought the pieces into the office and I assembled it by attaching the desktop to the flanges using a wood screw. You just drill a guide hole first. I'm really happy with how it turned out. It's my favorite desk and it feels really, really strong, really stable. And I like that it's big enough to be used as a paring station or like me and my coworker Andrew could stand next to each other because we're kind of the same height. One more detail I wanted to do make is that monitor stamp because you need the monitor to be elevated and usually people just use textbooks or reams of paper and it doesn't look as awesome as the desk. So I went to the hardware store again and we got some eight inch blocks cut of nine by four inch pine. I mean these two blocks I think ended up being $6 with the cutting fee. I sanded them a lot and then I used some of the leftover wood stain and I stained them kind of a similar color. And here's what it looked like when it was done. I really like it because I think it kind of matches that kind of lo-fi like non-tech look of the desk. So I hope that I gave you some ideas and some inspiration so that you can kind of go forth and make your own desk. And if you do, it would be awesome if you sent me pictures or links. I compile the list of bookmarks to all the desks that I mentioned here on my KIP list. So just a list of bookmarks and I wrote actually three blog posts for the desks I made. I'm gonna probably tweet those or post them to that KIP list today after my talk. Okay, that's it. Thanks so much.


In this talk, DIY Diabetics and a Million Bolses, we are three panelists that are going to discuss a common topic related to insulin pump hacking and its global impact. Hi, I'm Dina Troxios. I'm working for the Federal Office for Information Security in Germany. And my work mainly focuses on medical device cyber security on all cyber security related health on project management standardization and a lot of comedy work. I'm Julian. I'm a security analyst and researcher at E&W Research in Germany. And I perform cyber security assessments of medical devices, medical environments, and I'm having a deep dive into medical communication standards. And hey, I'm Mike Ruschanen. I'm the director of medical security at Harbor Labs. I perform cyber security assessments of medical devices for a number of manufacturers and a number of different medical devices. And I focus on software, medical firmware, and device communication protocols, especially cryptography. So for our agenda today, our panel will introduce medical device cyber security practices and projects are in Germany and the US. We'll provide a background for insulin pump technology and we'll define a formal threat model for insulin pumps. Here we will demonstrate an insulin pump attack and describe the response remediation effort. And then we'll discuss how this impacts the DIY diabetics community, something that if you have not heard of before, you will during this talk. Lastly, we'll conclude with some remarks from the team. So to kick us off first, we'll have Dina covering the global medical device cyber security. Thank you. So let me introduce you to the German federal landscape to demonstrate our duties and responsibilities in terms of health and IT security or cyber security. The schematic drawing intends to show a very simplified version of the complete German federal government. In Germany, you see below the gray field, we have various ministries. The two important ones are for now folded out. On the left, you see the federal ministry of the interior building and community. And on the right, you see the Ministry of Health. My employer, the federal office for information security is the authority under the ministry of the interior on the left. We are the German cyber security authority and fulfill comparable tasks like DHS and CISA. We fulfill all our legal obligations. We have our own cert. We are experienced in coordinated vulnerability disclosures and in projects. Our legal mandate allows us to assess basically any IT device. In terms of medical devices, we have no direct legal mandate yet, except the fact that we can be included in the risk assessment of medical devices in terms of IT security by the federal office, by the Federal Institute for Drugs and Medical Devices, the Bayfarm. This authority carries out all regulation with regards to medical devices. The Bayfarm is comparable to FDA. They deal with safety and vigilance issues. Whenever any incident is reported in medical devices, the Bayfarm gets active and uses its established processes. We are working closely together with Bayfarm and our health ministry, and for sure our authority in all terms of medical device cyber security. So the Federal Office for Information Security, the BSI, which stands for Bundesamt für Sicherheit in Informationstechnik, it's a German abbreviation, is a thought leader in cyber security. We were already founded in 1991 and we enormously expanded within the last year, and today we have more than 1,300 employees in total, mostly IT specialists and natural scientists. The federal government in Germany realizes and still sees the need to have a functional national cyber security authority. So we are covering all fields of work with respect to cyber security from A to Z, from autonomous vehicles over medical devices to the Zoom app. We are cooperating with national, EU, international authorities and stakeholders, and our budget is invested in various cyber security projects, and I'm really keen to give you some more insights during this talk. So our overall mission is to cover all issues related to cyber security and to make the world more secure. We believe we can and we do care about it. As a BSI employee, the following statement is somehow implanted into my brain, and I know that every IT system is potentially vulnerable at any given time point. We know that it is not a matter of getting hacked, it will happen anyway and everywhere at one point, but for us it's essential to keep in mind that it's important to be prepared and to know how to deal with vulnerabilities in a coordinated and responsible manner. In order to fill some of our legal obligations and to increase the awareness towards cyber security, we regularly publish technical guidelines and recommendations. In the field of medical device cyber security, we publish a recommendation about cyber security requirements for network connected medical devices in 2018. This is available in German and English and it is defining best security practices. This publication is in accordance with national and EU-wide regulation requirements and cyber security is seen as a continuous process throughout the product lifecycle. Apart from this, this document can assist in terms of risk analysis. So my cyber security requirements to go for you. When we look at cyber security and discovered vulnerabilities in medical devices, we definitely have to consider and have to discriminate between the modes of action. There is a huge difference between the medical operation and the technical maintenance mode, for example in terms of privileges and authentication. My cyber security to go message for you is that the required security updates and measures must not have a negative impact on safety. And not every vulnerability has an impact on patient safety, but it is possible. Now I'm talking about our project Money Meets. So when I joined the BSI in 2018, there was a lot of rumor and discussion about medical devices, not only in press, especially about pacemakers and insulin pumps and potential or possible patient harm. So I asked myself what can be done and what has been done so far. And the idea of a medical device hacking project came into my mind. I made use of our budget, entertained myself with paperwork and tendered the project Money Meets, which stands for manipulation of medical devices. The project started in 2019 and will end in December this year. The project aims to assess the current cyber security state of medical devices and it aims to bring cyber security researchers like Mike and Julian, manufacturers and authorities like me to a table. I chose five different device categories, namely ventilators, patient monitors, ICTs and their environment, infusion pumps, and last but not least, insulin pumps. Out of each category, we aim to assess two devices, so in total 10 devices within the scope. To further restrict our market research, I asked for additional requirements when picking the devices. These are the following. First, the devices had to be no longer than five years on the German market. Second, and should be highly connected, having as many interfaces as possible for an appropriate attack surface. So after picking the respective devices, we tried to get in contact with the top manufacturers found in our market research, explained our intention to pen test the respective devices and ideally ended up with a signed testing contract. With this, the manufacturers provided us with the respective medical devices and lab environments. And in return, they received exclusive knowledge about their security state and the devices. After the security assessment, the manufacturers are provided with a detailed report about all findings and a subsequent coordinated vulnerability process is initiated. All findings are published as soon as the vulnerabilities are fixed. We recommend to use ICS-MAs and closely collaborate with CISA and we recommend to assign CVEs. The project aims to increase transparency and awareness. Additionally, the trust for communication and cooperation among all stakeholders, which is seen as one of the highest goods in our whole process and inspired by a classical coordinated vulnerability disclosure. We believe that the project results aimed to be published in December will allow for cybersecurity statements, as well as addressing certain questions and problems. Basically, everyone is facing in the field of smart medical devices. This project that I'm leading is the basis for the security research on a smart insulin pump that will be shown by Julian our technical project lead. When we will demonstrate these findings. Please be aware that I make use of my legal mandate to inform about important security updates. My intention is to improve cybersecurity without finger pointing at anyone or anything. I want people to get a feeling or better to say a six sense of cybersecurity sense for vulnerabilities. I think that's really helpful to understand BSI and serve your goal and your project and your aims. From the US side, we have FDA cybersecurity guidance that's in place. In particular, we have guidance for medical devices before they can be marketed. They have to have this pre market evaluation. The strictness of controls that are a part of this evaluation are determined by the risk to patient safety. Medical devices are classified in three bins. In terms of risk, this is the lowest to highest, three being the highest. With respect to cybersecurity analysis, my team focuses on class two and class three. These devices have network interfaces to communicate with other end points. They are communication patient data and furthermore, they are actuating which might be to deliver a medicine. Depending on the classification of the device, the pre market process, there's two specific processes that are taken. If it's a class two, you would submit a 510K pre market notification. If it's a class three, you would submit a PMA or pre market approval. Both of these submissions have cybersecurity requirements. I've actually worked with a number of clients to create these submissions and sort of as the rigor in the submission, some of the steps, if I could elucidate them quickly by team and the manufacturers look to specify all the cybersecurity threat models, understanding what threats are to their systems, laying bare and plain the architecture and data flow, enumerating harm and non harm risk to patient safety, and then identifying and implementing and analyzing any potential mitigations of the system can possibly implement to reduce the risks and vulnerabilities in the systems overall. And what's nice, the really nice takeaway here is that the FDA does have post market management recommendations. They exist now. I think that we could definitely learn from BSI approach, especially since we're in the recommendation phase. I'm not a regulator and just a security person, but I think this is a really great conversation to have. And that's where I see the crossover. So for today, that all that said, our major focus is going to be on insulin pumps. And so for for hacking and some of the community efforts and regulatory efforts, we will specifically focus on this type of medical device. As I started, I'm going to provide a brief background for insulin pump devices in general, and also provide a threat model so that way we can start thinking with our security hats. So, to best describe this Bob's going to help me out. So Bob has type one diabetes. And Bob uses an open loop insulin delivery system to manage this condition. So it's open loop in that Bob is the person actually presses the button. The system is comprised of continuous glucose monitor typically CGM. That's the acronym for that insulin pump and smartphone. So what's unique and interesting here is that we have a communication interface that's wireless between the insulin pump and the smartphone so they pair and that's over BLE. In terms of data flow, the common architecture is that logs can be sent from the insulin pop to the phone. Demands can be sent from the phone to the insulin. Now, in terms of getting into the exact particulars of the insulin pump composition as I think it will help understand Julian's part later when he talks about hacking insulin pumps. So we have to understand that it is an embedded system at the end of the day. So this is it looks, it's a very common architecture that computer security professionals are familiar with. The system on chip design, typically is arm based. It has a Bluetooth radio. The idea of the Bluetooth radio is such that we compare two separate devices speaking the same protocol. It's typically uses low energy because the pump itself is worn on the patient, we can't just connect it to a wall so we don't have, I don't know 240 volts keep it powered. And so it's, you know, that's what motivates our selection of the communication protocol. So we're comparing connections are supported. So we have legacy connections or secure connections. Hopefully most of our manufacturers are leaning towards secure connections. Furthermore, there is no it's bare metal, no operating system. So there's a you typically might have a bootloader but the rest of it is just instructions such that the pump can actually and also receive data and send data. So connecting into the other components are understanding what the other assets are the system of course we have our patient. There's a catheter that connects to the patient that delivers the insulin. And then of interest from security perspective we have the smartphone and the pump and as I've just said that connections over BLE. So let's start thinking about this in the terms of cybersecurity. Let's think about the threat model right. So, first, when we're thinking insulin pumps, we have to understand what the patient harm and non harms are. A patient harm is that the pump delivers too much insulin or maybe not enough insulin. And this could be detrimental to the overall health of the patient. And that's considered a patient's harm safety risk. Non harm would be the pump insulin pump leaks some private information about the user to an unauthorized user say maybe it's this passive ease dropper that's listening on the Bluetooth communication. And that would be considered a non harm risk to the patient. But what security researchers do when we're looking at medical devices is that we always apply a threat model approach to understanding what all of the risks are to, you know, the particular device. And so what I'm using or what I'll detail here is something called Microsoft stride, and it's a way to categorize risks, and I've applied it to the general insulin pump case. So first we have spoofing, which is to impersonate a system and a smartphone to a or excuse me, and an insulin pump case, the attacker can masquerade as a valid smartphone that would be a spoofing based attack that we would want to consider. We also have tampering which is modifying data or code. And this particular case and attacker man in the middle is the pump to smartphone communication. And so we have impudiation claiming to not have performed in action. And so imagine the scenario where an attacker has successfully meant middle communication between smartphone and insulin pump, and they're able to say inject commands. Well the pump is unaware because these are unauthorized unauthenticated commands that they can't distinguish between if it was valid or not. And so the, if the pump even has a log it's not going to say well this definitely came from Mike's phone, because it has no notion of the sense. And in stride we have information disclosure. This is exposing information to unauthorized users. So in this particular case we can imagine an attacker that use drops on pump to smartphone communication. They're not looking to inject commands simply see what information they can see going across the wire. Next we have denial of service which is to deny or degrade access I would say this is a bane of cyber security professionals. This is really hard to protect against expected if it's directed. And then the insulin pump case this is where the attacker overruns the pump with requests, which would deny the valid or authenticated user from using the pump as it's intended. Lastly we have elevation privileges, which is to gain access to unauthorized capabilities. And so when we're thinking about this in terms of insulin pump, we would like to consider an attacker that gains access to the smartphone app, maybe by exploiting a smartphone OS vulnerability, and thus gaining unauthorized access to our insulin pump application, that application interface, and then directly impacting the pump operation itself. So just to be completely encompassing another step that my team at Harper Labs really likes to take, we have our threat model, but we also have an attacker model. And the idea here is to understand the attackers goals and capabilities this is where this is where security gets real. Because we want to, we want manufacturers and the community to understand well what is the, what is the absolute goal of attacking an insulin pump for example. And patient harm, if that is really the focus it's you know when we whenever we're looking at medical device, we're trying to find vulnerabilities that could actually impact the patient and their safety. Now, also, an attacker could be say just this arbitrary software execution like malware, mirai botnet would be a great example that's just trying to pivot into the network. And then securing our medical devices that are essentially network endpoints, we may allow a pivot into the network, and then any other unexpected behavior that might come of that which could still impact patient safety. Of course we have to consider things like the position of the attacker in the system, are they an insider manufacturer that knows all the glory details, are they simply just a personally outside with a high gain antenna and some equipment. And I wanted to point out to you in terms of capabilities and since this is BLE, we're looking at maybe 300 us dollars in terms of the le hacking equipment. And I'll summarize quickly because that visuals are the best way to depict this, there are a number of attack surfaces that exist and our general insulin pump model. We have our physical interface being able to connect to serial or press buttons. We have our wireless interface which is you know communication that's happening over Bluetooth, which Julian will talk in depth about as the attack surface that he focused on. And he also focus a bit on the app interface so what can the application tell you what can you learn from it, you know this is another attack surface that an attacker could leverage to compromise and excuse me, an insulin pump. And so with that, I'll turn it over to Julian to talk about insulin pump hacking. Thanks. In the following minutes, I will explain the communication protocol of the Donna and I be care RS insulin pump which is sold by the Korean manufacturer soil developments as well as vulnerabilities we identified. I want to state that the presentation of the vulnerabilities shall not be understood as finger pointing towards the manufacturer but may shed light on these problems more manufacturers are facing with building interconnected interconnected medical devices. The manufacturer intends patients to use the pump as a central component of an open loop system in combination with the respective mobile applications. With these mobile app safety critical functionality of the pumps such as such as manual administration of boluses or changing the basal rates or profiles is possible. Besides, patients are creating less restrictive ways in controlling the three or P devices as for example that we are not waiting initiative demonstrated in the past by building close to systems on their own. We will come back to this later in the talk I think, and further the Donna beer. Diabica RS insulin pump is supported by publicly aware that looping apps such as Android APS. The security assessment of medical devices is highly specialized and is dependent on the devices medical use case present interfaces users and their backgrounds using use technologies but also assumptions for example to its environment. In scope of the test was the proprietary communication protocol between the insulin pump and its mobile applications, which was built on top of blue to flow energy and so the blue to flow energy capabilities were just used to implement some application layer protocol. In a special the assessment focused on the used and implemented cryptography, as well as on the authentication and pairing process between the pump and its mobile apps. The testing methodology was a black box test without source code inside, and we were voluntarily provided with two insulin pumps by the manufacturers and downloaded the mobile applications from the app store and the Google Play Store. I will first demonstrate the normal communication flow we observed between the pump and its mobile applications. We will start with the application layer pairing process. The first by it demonstrates whether the message is a request with zero one or a response with zero two. We will talk about the names of the keys that are used on the following slides so don't hesitate to to identify all the keys and understand a usage so we will come to this. In similar figures with presented different encryption layers with different colors. So yellow colors dates that this information is transmitted in plain blue color shows that the message it's need to be encrypted using the device key and red color showing that user interaction as as needed, as well as green color indicates that messages need to be encrypted using free keys. Every communication starts with the mobile app sending a zero one zero zero message. To the pump together with zero number. The pump indicates that the series matching and afterwards the parent is requested. The pump immediately answers the request and shows a pairing prompt on its display, which needs to be confirmed manually by pressing a key on the pump. A photo of this is pairing prompt can be seen here. By using a user confirmation confirming the pairing, the pump sends the parent key to the mobile application, which then they use the key to encrypt messages after requesting a session key with these three keys higher privileged requests such as for now the three keys may be a bit confusing. I believe that it comes way more clear when seeing the post pairing communication flow. The next time the pump and the app are communicating no user interaction is needed as the app only needs to send the parent key to show that both entities are already already paired. After requesting a new session key high privileged requests can be sent. Here we see the three keys again. The device keys used to encode all messages, the parent key and the session key are used to authenticate the session, which is showing green. An interesting find words that the communicating party does not need to be paired to extract the pin. This is shown in the next slide. The pin is not directly transmitted but can be calculated with the information transmitted. We omitted the respective formula not to give some more insights on the protocol because we do not want to have you building exploits for this. This enables attackers to extract the lock key pin and every Dana RS pump in the attacker's range, Bluetooth range, is possible to be read out. The next finding we want to elicit data about is about weekly generated encryption keys. The device keys derived from the pump serial number does not contain any randomizing element and will never change. The serial number can be obtained from Bluetooth energy advertisements. The session key can be calculated from the pumps lock pin as well as configured time. We saw the respective requests on the previous slide with the pin disclosure. Having these three occurrences of doubtful calculations of secrets we further investigated all the other keys and recognized that also the parent key is not random. This key is calculated on the pump so we have no ability to reverse this calculation. Though we wrote a script that requested pairing multiple times a second and saw that the key will be returned, that the same key will be returned in a second. Therefore, we tried multiple combinations of calculations and finally found the formula to calculate the pairing key being derived from the pump's time during pairing. So it's fixed as the key is calculated from the time of the pairing. As a result, any secret of the data arrest system is generated insecurely. In addition to the lock pin disclosure and active verification of the pump's identity is present. Therefore, attackers can spoof both communication partners and therefore get in the middle position. How realistic this is with Bluetooth energy is up to you because I want to present a more easy attack later. Another example is the missing replay protection. High checking the Bluetooth flow energy session, attackers may replace sniffed messages. But still the most easy way to issue trusted commands is to capture a single communication flow between the pump and an app. We will get into this on the next slide. As we already have seen, the whole authentication mechanism relies on encryption using multiple keys. This pairing key is the only key that is needed to issue higher privileged commands as the session key can be requested by anyone and as the device key is known to everyone without even connecting to the pump. When having a look at the authentication flow, the pairing key is transmitted being encrypted with the device key as marked in the red box. This encryption is completely deterministic and everyone sniffing the communication is able to extract this key. We will not show what encryption works in detail. The weak pins are low hanging fruit and only pose a risk for attackers with physical access to the pump as our threat model already showed that Mike presented. The communication of the vulnerabilities in the communication protocol empowers attackers to high check the pump and use all functionalities that are offered via Bluetooth flow energy. To exploit this, an attacker needs to be in proximity to the pump sniffing a single communication between the insulin pump and the paired mobile application. This attack can be performed automatically in productive environments and we want to demonstrate this. The manufacturer prepared an update for the pump fixing the vulnerabilities, but let us first have the demo. Now I'd like to present you the attack of in a short video demonstrating the criticality of the automated attack. A few words I needed to explain the video. In the following video, an attacker captures messages between an insulin pump and mobile app and extracts the key from this communication. The hijacks and terminates the session between the pump and its paired app creates a new session impersonating the app using the parent key and administers multiple insulin boluses. I was just clicking on a pump to reactivate the display so there's no need to have this interaction at this point. The patient may notice the administration and is able to cancel the single administration on the pump. But as you can see in the following, more boluses are following. I filled the whole tubing system with blue inks so you can see this that in real life, this would have been insulin. And as you can see, the patient is trying to cancel all the administrations one after another, but just another administrations will follow this until the ethical stops. Wow, Julian, thank you for the stunning video. I'm always impressed when I see it. So when we now draw a conclusion from what we just heard, we can state that most of the vulnerabilities found our design defects. The manufacturer collaborated at all time with RC prepared and provided an update as Julian already said, and that was rolled out in April 2020. So the whole process was accompanied by an FSN which was published on our regulatory's website and example of this from a UK regulatory authority in English is shown on the right. Although we found vulnerabilities that are affecting the communication between the pump and the app. The device could still be operated when disabling Bluetooth functionality as a temporary fix. As mentioned in the FSN, the device can be securely operated when the airplane mode is enabled thereby preventing its functionality. Moreover, the device has several safety features already implemented preventing from misuse. In summary, the pump could be used when the airplane mode was enabled to prevent potential risk when we discovered these vulnerabilities. But I guess you're not only interested in the disclosure itself, but in the timeline. So as stated before, we aim to live cyber security and act accordingly. In our opinion, coordinated vulnerability disclosure process is desired whenever findings are reported. We use usually 90 days and give an extension upon a justified reason. Julian, me and our team colleagues managed and coordinated the whole disclosure process. We believe that it's essential to identify vulnerabilities and medical devices in an ethical way to strengthen cyber security, consumer protection and patient safety. Thereby, we all maintain a basis of trust to allow for mutual exchange and efficient communication. As mentioned before, I have no intention to blame anyone here. As a project team, we believe that ethical publishing of vulnerabilities is possible. They have an increasing transparency and the willingness to update devices in time. However, it has to be ensured at all time that the publication does not pose serious harm to patients. In our case, shorter measures and workarounds exist and existed and an innovative device was not withdrawn from the market. I believe that security and safety are not contradicting each other and that secure connected devices are pioneering. Awesome work guys, especially like to see the ink on the napkin. Every time I see it so amazing. But then to follow it up with the process of, you know, patient safety being paramount, not pulling the device but working directly with the manufacturer and having a great story about it is all the more compelling for the work that we do. So I commend the team for great, great effort there, great work, great job. With that, I'm going to segue the remainder of the talk into the impact of hacking on DIY diabetic community. Now, the way that we've tied this together because Julian and Dina had disclosed as an anecdote to me, their process with Dana RS the pump and then the remediation effort. And that remediation effort had caused some issues with Android APS compatibility. So let's let me define that first Android APS is just open source application that's used to create an artificial pancreas system. That's where the APS acronym comes from. And in our an APS system just delivers insulin injections on the patient's behalf so it's completely automated. It's also called a closed loop system in case anyone's interested. Now there's an entire open source and DIY diabetic community that was well invested into creating these artificial pancreas systems. And they were integrating and working so the manufacturers Dana RS actually worked with Android APS. So there was that nice sort of community overlap. And of course, if it went when the hack happened and there's some remediation processes and steps. This caused a disconnect with the community, because there needs to be a rework right there needs to be manufacturing community sitting down to understand well how could these two things still continue to work together. And so I have some thoughts about this, I'm going to put them forward for everyone watching our panel to also formulate their own opinions and hopefully come up with some stuff in the Q&A. Before I do that, I just want to make a public service announcement. Everyone in this panel supports DIY diabetics community, their hard work, their dedication, and just advancing the technology. I mean, wow, these artificial systems like regulatory barriers had really caused this to not be a thing and I think the DIY community just pushed so hard to make it happen so that's great. To give everyone else that's listening an idea. I've crib some some data from the open APS website. And as of May of 2020, there's at least almost 12,000 people reporting to use these DIY systems. And these are just people that actually report that they're using the system it doesn't cover people are not reporting for example. And if we take a look at the, the graph that have also crib from open APS, we see that there's this nice reduction in a one C's, which if you're a diabetic, your target a one C, you'd want it to be closer to six is indicative of just better overall health outcomes. Now, I pivot to the next point. The current DIY community has leveraged vulnerabilities, quite frankly, of medical or insulin pump devices to be able to construct their solutions. Simply to say, they've used insulin pumps that have open and known vulnerabilities that have been well known, such that they could use that system and bootstrap on some applications, and some back in servers and communication protocol to make their systems function. So this is worrying from a cyber security or professionals perspective because its foundation is built on antiquated hardware, that's no longer supported by the manufacturer outdated firmware insecure reverse engineered device communications. And in some cases even requires hardware adapters or shims so another device to be able to send and receive communication.  I haven't seen any anywhere in the community yet where someone went through the steps of providing say stride and understanding all the risks. And let me also put a caption on that. I have talked to the community before and a one of the colleagues or people in the community said well, we do understand the risks, and that's fine. But at the same time, I want to just kind of elevate that so that way we can understand okay. There are security risks, what's the best way forward. And I think the best way forward is definitely to work with manufacturers like the manufacturer of the data RS, and not to continue to rely on these insecure foundations and antiquated systems. So as I alluded to this is not late breaking news. The IOI community knows about these issues, and we can actually see it pretty easily so if you go to open APS's website and you pull their architecture diagram. Well, this is more of a data flow but you pull this particular diagram. The first thing we know, which I have denoted in the red that rectangle is that the models of metronic devices that they require are old hardware that's no longer metronic no longer supports the 512 515 and 522 models. Furthermore, if you have their newer equivalents, you actually have to rely on outdated firmware, because what happens metronic patch the vulnerabilities that allowed the device communication to happen unauthenticated in the first place. And therefore you can only have the older version of the software and the device to be able to integrate it into this this open solution. So as it's sort of a sad point there's also look on craigslist to find medical devices which always kind of makes me worried eBay and Craig list medical devices. But I'll leave that there. I'm cybersecurity person not a medical person so I have no advice for that. Kind of furthering the point on you might if you're not well aware of the metronic devices that I enumerated. I have a full advisory on these particular devices. And as you can see, you know this this was released what 2019 but it covers a large number of metronic pumps, of which open APS uses some of those devices to implement their system. So, another I wanted to take an additional step it's one thing to look at the architecture and the data that's already available. I wanted to understand the community but I also wanted to understand the source code was open and available. So I wanted to run a stack analysis against the source code to kind of understand what vulnerabilities may exist there. Now, you know, as a side, and it's still the security people. Yes, I, we all understand that stack analysis tools give false positives and false negatives. This really comes down to the security professional taking the time to follow up and understand if those are actual weaknesses and vulnerabilities. That being said, I was able to quickly use sonar cube, which is freely available to have a community edition scan the open APS source code that's also available and open on GitHub, and to be able to identify some security hotspots. And in particular, there are a number of high vulnerabilities with respect to command injection, because there's a large number of Python and shell scripts that take inputs from the command line. And these things are not being adequately validated or verified so there's no input sanitization. These scripts and code are executed as a root user. If you an attacker was to take advantage of this vulnerability this weakness, they could achieve root access on the devices that make up the open APS system. So to understand that a little bit better. Open APS just happens to be one of the systems that involves one of those shims or adapters that I talked about. In particular, they're using a Raspberry Pi. Now the Raspberry Pi is this nice single board computer, but it has a lot of different interfaces it has a wireless interface and Bluetooth so that it can communicate over the network to makes a great adapter to make an open APS type of system work. But it comes with additional properties that you know shouldn't really exist here as a full Linux operating system, which comes with all the complexities of managing the security of an operating system. For example, firewall configuration, or managing access and server service level accesses to files and data. And it requires remote access or root remote access just to function. And so this is usually the security 101 things that we'll talk about and say well you should never allow route remote access, and it just so happens is the system, you know, you need to leverage it to make it function. And to wrap up all of what I was saying about the DIY community and you know hacking and efforts from Julian's team, etc. Is that what's nice is that DIY started it, and they had these solutions and they were using pumps and whatever they could to meet their ends and that's fantastic they really pushed the envelope. They were using manufacturing involvement, where they want to be able to expose secure interfaces to help leverage this communication to do it in a way that's going to mitigate say remote attacks or ease dropping men in the middle, etc. And I think that I would like for there to be a larger conversation with regulators policymakers manufacturers and of course the community. It's not happening because you know I can't be well aware of all the conversations, but you know they're they're just very straightforward foundational issues with the stuff in the past. And I'm really hopeful that going forward there's just a better answer and a better solution. All right, with that, I will leave some concluding remarks to Dina for the many med release. Thank you very much. So here comes a small teaser about our money made release because the insulin pump is actually not the only product that was assessed during the scope of the project. So our project results will be published in German and English in December 2020. And I hope you're all waiting for this. So our final report will include the findings presented here. And as I said those from the remaining devices, but not on a technically deep level. Because we want to allow basically everyone to read and understand our project results. All manufacturers have to review or can review their respective sections prior to our publication and decide whether to be named. In the final report we will demonstrate how we cooperated with different manufacturers and dealt with individual vulnerabilities and that is closure. And this report will provide and probably inspire you with our lessons learned. And the overall intention as I already said is to improve cybersecurity without finger pointing at anyone or anything. We want people to get a feeling for vulnerabilities and to ideally have a sustainable effect on the cybersecurity of medical devices with our project. We are willing to do more research in that field. Thank you. Yeah, and I'll conclude just some future research. You know, the entire team are panels interested in contributing to security as a software development lifecycle best practices to the DIY community. Also just understanding threat modeling those devices in the DIY community as well and pursuing additional medical device research. So you need not be just diabetes technology as Dina pointed out, but just holistically all medical devices, especially ones that are connected or network connected. And with that, we would like to take some questions.