What's up everybody jason from jazby's case breaks calm. We just sold out 2019-20 panini Contenders optic team all two box break pick your teams number 11 So here you go Team all this should remember we're giving away $500 and break credit if you buy two or more teams guys So how to get entered to win that? By two or more teams you buy two teams you get one entry by four teams You get two entries by three teams or sorry six teams you get three entries etc. If you only buy one team you will not be entered to win But if you do get entered a chance to win top five names will get a hundred bucks in break credit at the end of the break So here are the customer names. We'll alphabetize them And then we'll give out some break credit at the end of it. So good luck. Let's do the two box break first There you go That's right Karen. I remember that whoa Look at this car Jesus. It's like got stuck to something That's not good Geez that is not good at all I'm gonna penny sleeve it just so you guys can Help me to maybe potentially give a replacement, right? Geez I'm not happy there uniformity here Damian Lillard and we got a Ruby hot you more base Brandon Ingram and then we got Andrew Wiggins and Devontis to bonus already next to our next box Oh Nice John Moran's lottery ticket and Bruno Fernando That's John Moran, so I didn't even print this out that I did Summon with that one nice To Marta with Junior the Andre Aten You have Jamal Murray and Jared Culver rookie T was also so many it looks like as well Then we're not that's going to Michael You Yeah, man people are really But really Get mad at their scratches on those so but you can always wrist laps which doesn't cost too much All right, they go guys that was a break Now there you go You know, I wonder I wonder how mosaics and actually do now with all this prism out I wonder if the mosaic stuff will drop. All right, you guys so let's see how many customers have two or more teams So here you go Mendoza. There you go. George has to Michael Oliver you have one two three four so you get two entries Ramon with two that's one entry Raymond with one two three four Two entries Robert and Nick's Yeah, well number three only had the Only had the Cowboys left number two had the Cowboys and the Patriots Which somebody about the Cowboys right at the same time as somebody bought the Cowboys and number three It's just more the Patriots are the ones that were kind of keeping number two to pop off So I'm in as one two three four five six seven eight Yeah, the Patriots the Cowboys actually saw it exactly at the same time, but it was one of the Patriots All right, so there you go. That should be 15 I Think mosaic will hold up well, but I'm just meeting in terms of prices because Prisms the hot one. I honestly think mosaic probably leapfrogged a couple products I love select and I love the optic, but I loved I feel like I love mosaic more this year than both of those products Or at least more than optic for me. I love select with their other variations, but Roll the dice and four to one five times Top five get a hundred bucks. I Honestly think though that mosaic jumped over optic for me, but select is still there select is awesome That's where I can get my zebras and stuff Now select is tough to beat I'd still keep select right behind prism But optic is the one that might have dropped But but the thing is that the raider rookies are so iconic. So people will still always want to collect those It's a five times top five get a hundred bucks each one two three four and Five all righty.


Hi, I'm Zor. Welcome to user education. We continue developing the theory of definite integrals, and the first application I started with, to basically to introduce definite integrals, was the area under the curve of the function. Now, so the previous lecture was purely theoretical, and let me just remind you that, we have defined the concept of area under the curve. This is the curve, this is the function f of x, this is a, this is b. We have decided to divide the segment a, b into small intervals, and build rectangle which has the base, the corresponding interval and the height, some value within this particular set of values within this interval. It can be maximum, it can be minimum, it can be everything in the middle, it can be left border or right border of this, of this interval, doesn't really matter, because as number of these intervals goes to infinity, while the width of the largest goes to zero, the limit will exist and will be always the same, and that limit will be by definition the area under the curve. So today, I would like to basically present two concrete cases of calculation, what exactly this area under curve is, if we will follow the algorithm, if we will follow the process of dividing our segment into pieces and then increasing the number of intervals. Okay, so by the way, as far as the formula is concerned, I will put this formula here. So that's f of c i times delta x i, i from one to n, where c i belongs to x i minus one x i, and delta x i is x i minus x i minus one. So delta x i is basically the width of the i's interval. x i is here, x i minus one, and this is x i. So this particular interval is x i, where a is x zero and b is x n, right? So c is any point within this particular interval can be left, right, maximum, minimum, middle point, whatever it is. Doesn't really matter, we have proven in the previous lecture that the limit of this expression, as long as delta x i are going to zero, well, the largest among them goes to zero. The limit will exist and that would be the area under the curve and the examples which we will consider are two actual examples. So let me start with the first one. So the first example is, function is 10x on interval from zero to four. Okay, so it looks like this. This is four, this is 10x, which means this is 40, right? This is zero. Now this is area under the curve. So this is our function. This is interval from zero to four, the segment. Now, obviously from geometry we know that if this is four and this is 40, then the area of this triangle, which is actually an area under the curve, would be four times 40 divided by two, which is 80. So let's just keep in mind this, and this is obviously the right way of doing this, except that that's not the one which I would like to introduce you to. I would like to use this formula and come up with the same number, if possible. I hope I will be able to. Okay, so let's just remember this result and what we will do is we will do exactly what our process is telling us. So we will divide into n pieces. Well, let's divide first into two pieces. So this is x is zero, this is x2, and the middle one is x1. So this is one interval, this is another interval. So we will build two intervals on our segment. Now, let's take, let's say, a left point on each interval. So the left point here is zero, so the rectangle will have zero height. And so it will be zero times the length of the interval is two, right? And this is the rectangle, so that's basically equal to zero. The second rectangle would be here, and as I said, I'm adjusting by the left boundary. So if this is two, this is 20. So the height of this rectangle is 20. So it will be two times 20 is equal to 40. And the total will be 40. So some of this rectangle which has zero height and this rectangle would be 40. Well, it's obviously less than the area which we are talking about. Okay, now let's do it more finely divided segment. Let's divide it into four pieces. So this is one, this is two, this is three. So this would be x1, x2, and this is x3. And this is x4. So we have four different intervals. And let's do exactly the same. Build a rectangle based on each interval with the left value as the height. So again, the first will be zero. The second would be, okay, this is 10 obviously and this is 30. So the first will be zero. The second would be 10 times 2. Next it would be 20 times 2. And next would be 30 times 2. Equals 2, 10, 20, 30, 20. No, sorry, not by 2, by 1. Let's see something is wrong. 2 was the previous. Now I have only one. The width of each interval is 1. So that's what, 60. So it was 41. My next is 60. Should we continue? Well, let's just go through one more iteration. So we have divisions by one half. This is one and one half. This is two and one half. This is three and one half. Now, so this height, this height would be five. Now this would be 15. This would be 25. And this would be 35. So what we have is zero times half, which is zero. Then five times half, 2.5, 2.5. 10 times half is five. 15 is 7.5. 20 times half is 10. 25, 12.5. 30, 15. And 35 is 17.5, right? That's my last rectangle. 1, 2, 3, 4, 5, 6, 7, 8. 8 rectangles. This is two rectangles. This is four rectangles. And this is eight rectangles. So what is the sum? This and this is 20. And another 20 is 40. And another is 60. And 10 is 70. So you see, our first iteration was 40, then 60, then 70. And you remember, the whole area is equal to 80 from the geometry, right? So it looks like we are actually moving to the right direction. Okay, so now it's time to do it precisely. So let's consider that we have divided this into n pieces, n equal pieces, right? So my xi is equal to what? So we divide four into n pieces, which means my xi would be equal to i times four divided by n, right? So the length from zero to xi, this is coordinates, right? So xi minus xi minus one is four divided by n. So that's my delta xi. Now, f of xi is equal to this times 10, right? Function is 10 times x. So this would be 40i divided by n. So now I have to summarize function value, 40 times i divided by n, times four divided by n from i from one to n, right? So this is my height of the rectangle. This is my widths of the rectangle. So it's equal to 160 divided by n square i from one to n. Well, we all know what is the sum of i's. It's one plus two plus three, et cetera, plus n. Very easy to count. I do remember that the formula is this. n times n plus one divided by two equals 280 n plus one divided by n, right? And what's the limit as n goes to infinity? Well, this is obviously goes to one. So the limit is 80. And that's exactly what we had to really obtain, if you remember, right? From geometrical considerations. So it looks like it works fine. So this particular process. And now I have divided into n equal parts. Basically, it's not really necessary because as I was saying in the previous lecture, the theorem was proven that it doesn't really matter how I divide into n pieces as long as with n increasing to infinity, my largest segment goes to zero. So it doesn't really matter. I chose the easiest way, right? When all intervals are equal to each other. Now then the height of the rectangles, I have chosen by left boundary. I could have chosen by the right boundary. It will probably be exactly the same. Should I demonstrate it? Well, it's very easy, actually, I think. Because then, I think in this case it would be i plus one. And it would not really change the limit. Okay, I'm not going to do it, but basically it's kind of obvious. Okay, next example. So the first one we have proven that we are going to the right number using this particular process. Now let's consider a slightly more complicated example because now I will have, as a function, I will have y equals to one minus x square on interval from minus one to one. Now, x square is, as you know, parabola. Minus x square would be inverted parabola. And plus one, I have to raise it by one above the x-axis, right? So it would be something like this, from minus one to one. That x is equal to minus one or one, y is equal to zero, right? So this is basically my segment. And this is the area which I would like to basically calculate the area of. All right, just to make things a little bit simpler, let me, instead of considering from minus one to one, let's consider only from zero to one, and then I will double the result because the parabola is symmetrical. There is absolutely nothing wrong with going all the way from minus one to one and in the description of this lecture and the notes on the Unisor.com, I do consider from minus one to one. It's just a little bit easier for me to do it here from zero to one. So let me just do it from zero to one. So I don't really have to worry about negative numbers and stuff like this. Let me just consider this. How is this part? Okay, so again, let's do exactly the same thing. We will divide this particular area into n equal parts. So my xi is equal to one over n, right? So this is one and divided by n parts. So that's my xi's. Now x, well, I'm sorry, it's i divided by n. It's delta xi, which is equal to xi minus xi minus i, which is one over n. Okay, now my f of xi. So let's talk about the left boundary of each or right boundary or whatever. Delta xi, this definitely belongs to interval, i's interval, right? It's equal to one minus xi square, right? Which is one minus i square divided by n square. Now if I sum f of xi times delta xi, what I will get? I will get one minus i square divided by n square times one n equals to sigma one n minus sigma i square divided by n cube, right? If I open these parenthesis, it will be one n's and minus i square divided by n square times n, which is n cube. Now this is from one to n, so this is equal to n times one n's, which is one minus sigma i square divided by n cube. Okay, so it's one minus one over n cube. It's a constant so far of i square of one to n equals to... Now I happen to remember, well not remember, I wrote it down, the formula for sum of the i square. You can prove it by induction or there are different ways to do it, let's not waste our time, I'll just use it as it is, n cube. So sum of i square is equal to n times n plus one times two n plus one divided by six, which is equal to... Well, obviously if you will factor out two, you will have n, n plus something and again n plus something, well in this case it's n plus one half. And this is n cube, so one minus two over six and here I will have n cube n times n plus one times n plus one half, correct? And obviously this thing goes to one as n goes to infinity because this is polynomial, this is n cube, this is n cube. So if you divide n cube by n cube is one and everything else would be n square and n etc. Which dividing by n cube will give you n in the denominator and it will go to zero. So the whole thing is equal one minus two six or one minus one third, which is two-third and the whole area if you will add this half it will be four-third. So that's basically the answer to this problem. Again, if you do not remember this formula, just try to prove it by induction if you want to. It's very, very easy to prove that the sum of squares from one to n is equal to this. By induction it's just really in no time at all. So these are two examples of how to approach the area under curve using the classical definition of what actual area is. Now, do people do exactly what I have just done? Absolutely not. They are calculating the area under the curve in a completely different way. And to demonstrate you how exactly it can be done, which I will do in the next lecture, that's exactly how I will introduce the definitive integral. So the definitive integral is actually an answer how to easier calculate something like area under the curve using our apparatus which we have already known, which is derivative and indefinite integral, which is sometimes called antiderivative because it's a reverse operation. But that would be the subject of the next lecture. Meanwhile, what I might actually suggest you as an exercise if you really are up to this, I have just used the value on the right side of the interval of xi. Try to use it on the left side, function of xi minus 1. And see if you will get exactly the same result.  It would be really interesting to see if you will get the same. I mean, you must get the same because I have proven the theorem in the previous lecture that you have the same thing. But it's just always nice to basically make sure that everything is going. Alright, so that's it for today. Thank you very much and good luck.


In some sense, and that's why I like it, you know, in what sense it is even. I think it's really unfortunate that people use porn as a source of sex education, as a performer. It's pure fantasy. What we're really talking about is an idea of agency. A, I know we keep looking backwards, but we've all moved on from Freud and even from some of his descendants, hopefully. And B, when we are talking about sex, all of the acts, whether this oral sex, anal sex, group sex, all of those things have existed since antiquity. So we're not suddenly coming to liberation. We are returning to the idea that humans own their bodies that can choose what to do with them with each other. Because fundamentally, the idea of sexual liberation was really us breaking away from Victorian era norms and beyond that constructed a false cage of respectability for women to sit in, for the most part. And then said, oh, well, you know, we liked hiding our dirt, but now we want it to be public again, but also we're uncomfortable with breaking away from these norms. The largest amount of porn produced in the Victorian era included all of the acts that Freud said were deserving and unnecessary. Perhaps he was just approved, but the rest of us can make a choice every day in every way for what we want to do because sexual agency is what matters. Not the false construct of liberation or repression. I can't repress Olivia, I think. Well, you can't repress me. Well, I have to say something really important because you keep saying, oh my goodness, I'm going back, we've grown up, we've grown up. I think they were so much wiser, two and a half thousand years. I disagree. What they said was that pleasure, pleasure, including sexual pleasure was practically the opposite of genuine happiness. And I think happiness is what we're losing now. We don't know how to be happy.  It's not. It's what we do. No, it's about even making a garden or bringing up a family or singing or making a picture. It's about it's about playing a piano really well. In fact, real happiness involves a lot of unhappiness because you struggle. It's doing what we human beings do best. No, that's survival. That's not nothing to do with happiness or any other emotion. Survival is sad. Survival is sad. But let's go for civilization. Let's go for this. Olivia, humans absolutely can choose what makes them happy on an individual and a structural level without it necessarily being tied to sex or lack thereof of sex. You may or may not approve of the fact that some people both enjoy sex and gardens. But that really has nothing to do with anyone else. This is Harmony. Harmony is motionless from the neck down. She's just a doll from the neck down. From the head up she has some animatronics so she can move her face. She can smile, turn her head slightly and blink. And she speaks. She has an artificial intelligence personality. That's interesting. It's a standalone personality so you don't have to have her and the personality integrated into the doll. You can carry it around with you on your phone or your tablet and have conversations with her. But it's essentially just quite a sophisticated chatbot. So sex robots have been in the headlines for a while, but then that's the only one that's gone out there. So what's all the fuss been about? Well, this one on the left, this true companion, that's what they say it's going to look like on the top left. This is what it actually looked like when it was unveiled at a trade show. There is a big difference. This one is particularly interesting because this has been on the headlines for years and yet no one's ever seen one other than that model. Now the guy who makes them says that he's got thousands of orders, but we've never seen anyone admit that they've got one. And in that kind of community you'd usually hear someone talk about it. So I'm a little skeptical about whether or not this exists. Don't think it really does. In the top right, sorry, is an engineer called Sergei Santos who has invented a sex robot called Samantha. Samantha's been on the news because it was reported a few months ago that she was mauled, was the word that was used at a trade show. And there were lots of headlines about this sex robot has been attacked, sexually assaulted, raped at a trade show. I thought this sounded a bit weird, so I dug into that story and then I talked to Sergei as well. And essentially what happened was he put the robot on display at a trade show and said to people, yeah, of course, go ahead, have a touch. It's a delicate object. And so people did. They went and they touched and groped.  And of course it did get damaged, but not to the extent that the newspaper has made it out to be. Samantha's an interesting robot. He built her. Sergei's not interested in what the doll looks like. He's interested in the mechanics and the AI behind it.  He inserted sensors and pressure points so that you could touch, squeeze. That's her squeezing the arm. And she would respond. And he was quite interested in trying to work up a consensual relationship in that you had to approach her in certain ways in order for her to respond. So if you went straight for the breasts, for example, there wouldn't be much reaction. You had to start by stroking and touching arms and things like that. So it was quite an interesting concept. And then we have Harmony, that I just showed you pictures of, the real doll version. And if I can play this video, please. This is Harmony. I think we're going to hear her voice here, unfortunately. But you'll see some of the facial movements. And it's actually fairly subtle. I mean, she's not going to pass for human at all. But it's a pretty subtle thing. She also has a really soft Scottish accent, which is really, really strange when you're in the middle of a hot call at California Sunshine looking at these things. So Harmony was released alongside another model called Solana recently. And they're also, within the past two weeks, a male version has been featured from real doll on the cover of New York Magazine. So the interesting thing is, why are they all in this form? What is this about this hypersexualized female form of the sex dolls? Because I think that's really quite unimaginative. And it doesn't really reflect the way robotics in general is going. And it comes with a whole host of problems, ethical issues, legal issues, all sorts of things that I think we can avoid by doing a very simple thing. I think that we're all probably on this panel agreed that the sort of technology that people are afraid of, something that fully mimics a human woman, Allah, the cult classic Cherry 2000, is not only a long way off, it's not in many, many generations, lifetimes from ours, what computing would have to be able to do. So we can kind of take that idea and set it aside. Because we do have robots that turn back flips and we have robots that when it chess, these are not the same robots and also their intelligence is not generalizable. My washing machine cannot also cook my rice. It can't take what it's learned about by washing and apply that to another problem, which is great news.  Again, obviously I have problems with this as a former sex worker. When you think about, sorry, my cultural touchstones for things like this are Star Trek The Next Generation, we had Mr. Data, who could physically mate, he looked humanoid, he could physically mate with a lot of different species, but he really couldn't give you pillow talk. And if it's just the act of getting somebody to reach orgasm that constituted what sex work is and what sex is, I would not have been that effective an escort because it would just be people turning up. They want the chat, they want the human interaction. When you look at things like they're absolutely horrible but the review boards for escorts, the most cutting thing that a client can say about an escort is that she was robotic.  So it's only ever going to be a minority of people, the love doll people who want a flashlight that talks to them. But if what we're talking about is just reaching orgasm in a way, women have been bridging this gap with Hitachi's imagination for years, but that does very much depend on our own imagination being involved. And really to kind of assume otherwise is to assume that the work of sex while it's a very basic need, it's actually one of the most complex relationships. It's the most complex thing we do. So when people are saying, oh great, we'll have sex robots and we could put the sex industry out of business, it's kind of assuming that what I did as an escort is no more complicated than what Alexa does when you ask her to refill your birdseed order. So overall, you know, sex workers are not, and sex in general is not, to kind of misuse the Rodney Brooks phrase, we are not fast cheap and out of control.  In some sense, and that's why I like it, it's, you know, in what sense it is evil. It's not this Buddhist smile, I love you all and so on.  You meet with friends, you have a good job, maybe here and there, a one night stand, life is okay. Then you fall passionately with love.  And it's precisely the position of I love you. You take a particular human being, no, and basically. The commercialization, the ownership of our sexuality by big business, if you like. It's not new perhaps, perhaps throughout history, you know, sex is sex cells, but the degree to which how we respond to sex is entirely public controlled and commercially controlled seems to me to indicate the death of sex because so much of sex itself, the act, the feelings depend on a certain level of autonomy, choice, but also intimacy. We have the right to keep our sexual cells away from the prying eyes of those who want to make money out of us from social media, from these very dangerous new things that are happening of putting images on social media without consent when they are particularly used by men against women. So what I would really like for us to think about is to what extent intimacy and personal power and choice that we all, or many of us have sexual desire is now entirely stolen from us. And I find that very problematic. I have a young daughter, I have, you know, when I talk to my students that I teach at university and the number of them, and this is really important because I'm of the generation of the 60s and 70s where sexual liberation and the pill supposedly freed us. But what it actually did is what Germaine Greer later came to understand that it made prisoners of us because for men there was no cost, they could just eat, eat meaning have as much sex as they wanted and expected it and demanded it. And we were not cool unless you delivered it. That is even a thousand times worse now. Young women do not feel they have the right to refuse it. They do not feel they have the choice. I have spoken to so many young women who have told me that they do things they don't want to do sexually because that's what's expected culturally. So I think we're in a bad place. You know, I think I'm on this panel to represent not just a male perspective maybe, but also a previous generation, a generation that did not grew up with porn. I mean, we found it, but we had a work to find it, right? You had a work to find it. Real to reals and magazines and things like that. It wasn't just available at a click of a button. It wasn't just everywhere. And of course, no dating apps. So I've never used one. I have no idea how they work. I guess through my kids. But you know, you actually had, as you said, Miriam to muster up the courage to go and ask a girl out. And for all of us, teen years, at least for most of us, teen years are difficult. And doing that was difficult and hard. You know, I'm tempted to say it's easier now that you have apps and you can do it digitally, but I don't really know. I suspect it's always hard, courtship and relationships and finding somebody and figuring out who's right and who's wrong and the fear of being rejected and the building up the confidence. All of that is probably just as difficult today as it was back then and will probably be that in the future. So I don't know to what extent, with regard to dating apps, it's really had an impact. You know, we always, no matter what the issue is, we've always blamed technology. Again, I'm dating myself, but people used to complain bitterly about kids who were growing up watching television all the time and how awful that was making them asocial and undatable and they never left the house and never asked anybody for a date.  So blaming technology is always an easy out and I suspect it's probably not true. I mean, with regard to porn, I think the two aspects of porn, there is a certain fantasy, but there's also an element of education, again, coming from maybe a generation where we didn't know much about sex, certainly not kind of the kind of sex that today you can get access to at a fingertip. And there's a sense in which that was not very good.  And I think pornography at least exposes us to the variety and teaches us about what's possible and maybe we'll try some of those poses and it turns out that nah, they don't work, but of course there was always, I remember buying it, what was it, the Kamasutra book, right? I mean, that has many of those poses and they don't work, you know, maybe they work, but they're not very pleasurable. So there's always been a desire to figure this out and to increase pleasure and find what works and what doesn't. And I think that kind of exploration is a good thing. People should go out then and try and discover and figure out for themselves. But there is also downside to porn, I think, when you confuse fantasy with reality or when you use the fantasy to replace reality and you replace masturbation and pornography to replace actual relationship and actual intimacy and actual sex or even the one I extended and I'm not, you know, I don't want to come out as I'm against one. My previous comment was about that's all you do or you do that all the time, right? You know, once in a while, yeah, I'm sure it's a lot of fun. But if you don't want to go out there, you don't want to try, you don't want to actually engage because you're getting some simulated replacement through pornography and through masturbation. If it replaces intimacy, and if it replaces dating and relationship and ultimately we haven't talked about love, if it replaces love, I don't know what a fulfilled life is if it doesn't have relationship and love and sex. I think people are missing out to the extent that they are replacing with some fake fantasy. Again, there are opportunities out there and it's to learn about those things and it can be obsessive and again, it can replace the real thing and that's a tragedy if it happens. I think it's up to each individual person's preference. I think if someone wants to be totally asexual and live as a monk in the mountains and that is what makes them happy, they should go and do that. I personally, sorry you're on, I love a good anonymous romp in the hay. I gotta say there's something particularly fun and exciting about that and I don't think it has to be necessarily a lack of intimacy if it's someone you don't know there can be something especially beautiful about that kind of connection where it's very fleeting but very intense. I think people should really try to get in tune with what they want and what makes them happy and I think people, some people aren't starting to do more of that. I do think that there can be a lot of online discourse though that can get really toxic where people will shame someone for having different preferences than them and there's this sense of righteousness from people who have different preferences.  I think it's really unfortunate that people use porn as a source of sex education as a performer. It's pure fantasy, we're shooting these scenes and it's often two hours for a short five minute clip so there's a lot that's cut out that you don't see. I think this country really needs proper sex education and not just about the pure mechanics of it but about pleasure. I do think that other people from diverse viewpoints making more porn would be great too. So much of it is kind of the same stuff and I get what certain people are into but I think there could stand to be more diversity in porn. I do think as well that dating apps have really made it difficult for people to date in the way that they used to. I'm a big fan of dating your friends and people that you've known for a long time but I think people can get very anxious about that now and I think meeting people off of dating apps is very easy to construct a fantasy about them or for them to portray themselves however they want to be and eventually you realize, oh my goodness, maybe this is not... I didn't know what I was getting into whereas when you date within your friend group obviously there's a potential for more drama but you also kind of know what you're getting at the end of the day. You're like, all right, I've seen this person date five different people before. I kind of know how their relationships went, how they ended, what the conflicts were and so I think in a lot of ways it's a much more natural way to date. On the issue of porn, I wanted to ask you is it your sense, I'm really interested to hear what the rest of the one hour and 55 minutes are cut out, what are we not seeing and what should we be seeing that maybe might help people have a more realistic perception of sex rather than the five minutes as you say that are cut down from that that perhaps has a kind of false representation of what's really going on but is it the watching porn and particularly the fact that people are watching porn younger and younger and having access to more and more extreme forms of porn obviously there's a gamut of taste but there's also the kind of pornography that I think just even 10 years ago you would have had to go really niche to finds that's now much more easily accessible to younger people. Is that leading in your view to a kind of is that affecting people's sense of what sex is and their desire to engage in it?  This is a very interesting question because I think I experienced it from both ends both with my experience escorting and seeing clients and with my experience as a performer we'll be doing crazy positions in porn that this is less something that happens in my videos but my friends who do very mainstream porn it's like they'll be like getting their leg up over there and they'll like spend like 10 minutes getting into the perfect position wiggling around it's so uncomfortable and they're like, oh right, we'll shoot, let's roll and then they shoot like 10 minutes of that and they're like, okay cut and then like let's do this, it's so unsexy in this way being on one of those sets I mean it is kind of fun of course taught to watch people having sex but it's way less sexy than you might think but when I would have clients sometimes where I would just be like, oh my god this guy watches so much porn and just thinks that's how sex should be and has never really had like actually good sex and it would be such a tragic thing where they'd be sort of like, you could tell they have this checklist where they're like, alright we gotta do I don't know how explicit I'm allowed to get in here missionary, then cowgirl, then like I'll finish in doggy style and like all this stuff like oh I wanna check all these boxes and get all these little moments and it was just like you're not really like in the moment when you're doing that you're not like actually genuinely connecting with the other person and I think that is something that people who use porn as a sex education tool and are not actually connecting with themselves and their bodies tend to get into


Well, that was a wonderful, wonderful introduction, and I can't be more thrilled to be here with you today. As mentioned, I'm with MediaMonks. We are one of the biggest and most awarded digital media agencies around the world, and we have a number of different specialisms that are, oh, none of my media seems to be working, so this is going to be fun. Things flash, we've got lots of pictures, but we'll have to imagine that. So we've got offices all around the world, some 10,000 people in 56 offices around the world, including Mumbai and Delhi. And as mentioned, my specialism is in new technology, that landscape, and specifically, Web3 and Metaverse, but increasingly, everybody wants to hear about AI, so we add that too. And it's funny because a year after year, it feels like we have so much pressure to respond to market demand because of the technology. The technology is driving what we're doing very quickly every day. And is it any way to make these animations work because this is not supposed to be time, it's supposed to be very flashy. Anyway, I'd like to give you a sense of kind of what we do and how we produce it. Anyway, happy to send you a PDF at another time. So the idea is that we've been overwhelmed year after year with new technology. It feels like every year there's something new. In 2019, it was the crypto craze and the prices of Bitcoin shot up. 2020, everyone was online playing games, Animal Crossing, Roblox, Fortnite. In 2021, Mark Zuckerberg announced that he was making a Metaverse company, and nobody even understood what that meant. And then of course, 2022, NFTs, Web3, and now AI. It's a lot. And I am an emerging tech specialist. I've been doing this for 20 years, and I've never, ever seen the markets move as quickly as they are today. And so what I'd like to do is do a little bit of level setting and share with you the big picture of what's happening because it's not about one particular stream or another. It's not Metaverse versus Web3 versus AI. I wanted to raise up and to get the big picture and really give some perspective to what we're doing as marketers to cut through the jargon and the hype and really focus in on what's important with respect to how we can be successful in this new media landscape. So I want to talk about what I call the great convergence, how all of these new technologies are coming together, the value of culture, and specifically how we as marketers can take advantage of this historic moment and drive the change as opposed to letting technology and its demands and the demand of the popular imagination drive what we're doing. But first I want to start off with a little story, and that's about Erwan. It was a story that was first written by Samuel Butler over 100 years ago. And he imagined a young man who scaled the heights of a small island, very similar to New Zealand. And so he scales his high mountains and he finds a small group of people. And this colony of people had completely banned machines. Why, he wondered. Well, it turns out the Erwanians believed that machines would develop sentience and they would take over the world. This was over 100 years ago, as I said in 1852, before that was even a possibility. And at that time, in the United Kingdom, the mill workers were on strike because they feared that machines would take over their jobs. And today, near my house in Los Angeles, the writers, the actors, all of Hollywood's on strike for similar reasons. And so technology is powerful. It's changing how we work, how we relate with customers, and importantly, how we relate to one another with important consequences for everyone in this room. You may have noticed that Erwan is an anagram for nowhere. But today I really wanna focus on where we are today. This tremendous, powerful set of tools that we have at our disposal and how we can leverage them to take advantage for our companies. So first, again, many of you will be familiar with some of these concepts, but the metaverse, the metaverse is a set of persistent online worlds where you can work, play, meet, socialize, trade and sell objects. The difference is that it's in 3D, which is how we experience the world and which is why it is so powerful as a future computing platform. So the metaverse is platforms.  It's also games and experiences like Fortnite, like Roblox, and it can be on the mobile. But again, these are 3D worlds and the evolution of these 3D worlds and the way that people are interacting on them is radically different from any of the platforms that have preceded them. Now my father used to work at IBM. Some of you may be familiar, it's an old school company. At the time it was the Google of its day and at that time, the internet first emerged and he was a specialist in internet networking technology. As I've kind of inherited the spatial computing space. And he says that at that time, he would explain to people the richness of this information highway where you could go online and you could download absolutely anything. He said it was like having the New York Public Library in the back of your house. The New York Public Library you might know is that big building in Manhattan with the two lions on both sides where they filmed Ghostbusters. If any of you remember that film. But he said it was like having that but they never imagined the commercial arm. They never imagined that one day you could buy books off of this internet. They never imagined the advent of Amazon or even Uber. So you see with web three, we're very much at those early stages where you can buy, sell, trade assets, digital assets online. And yet we haven't quite conquered it yet. We're still in the very beginning stages. But effectively it's the blockchain based payment system that allows us that commercial part of the metaverse. Now last year we've heard a lot about NFTs and crypto and people were absolutely over it by now. If you say these words in any form, including LinkedIn, you're gonna get kind of canceled. People are gonna think, wait, you haven't figured it out. That's not a good thing. But now we just call it something different. It's called digital goods, digital assets, digital collectibles, all those things are okay. And web three is still a yes, because it's really again just talking about the commercial part of the metaverse. And I wanna talk to you about some examples of how you as marketers can take advantage of this new opportunity to monetize the metaverse and web three. Now for example, you can widen customer base, improve engagement and dramatically increase revenues. And I'll show you a couple of ideas how that's been done. Take example Nike, third quarter of last year they made approximately $185 million in sales. Why? Through selling digital goods. And I can assure you as one of the world's biggest and most successful digital media agencies, these don't cost that much to produce. And that with AI it's going to be even less. To have this twirling sneaker, digital sneaker, we produce it once. They can then produce it in infitesimal variations and I'd be happy to share with you some work that we've done for Nike and Adidas at any time. But the idea is that they sold some $90 million by Q3. So assuming it's like Q4 probably 200 million, so $100 million of digital goods without having any overhead, without having retail sales people, without transportation, any of that. They just go to the website and click it on. But even better than that is their customers were able to then take those assets and sell them again. And Nike still made $100 million. Now I don't know about you, but I would love to be the sales person who then goes to the boss and says, yeah, I just made 200 million bucks just selling digital goods. So digital goods have real value. And importantly also you have provenance. So that for those of you who are working B2C, one of the beautiful things about having digital goods is that you can then trace those because they're blockchain based. So all along the supply chain, you're able to understand where things come from, where they are now and who's got them. So that's a really, really exciting opportunity for marketers. A third space for the Web3 opportunity is in tokens. Now you can probably already read that Starbucks sold over 2,000 tokens at $100 each without giving away a single thing. That's a tremendous thing. That's a revolution in marketing. You're effectively saying this is an IOU for something and we're not even having to tell you what it is yet. But that's what's happening. When you have such a fervently excited customer base, this is the kind of relationship that you can establish with them. But be prepared to provide value over time. This has got to be a sustainable strategy. And one of the biggest failures that we saw last year with the NFTs is, and I'll show you in a minute, that not everyone provided the value that the customers were expecting. So, but you've to craft the strategy carefully and you can come up with very wonderful results. Again, imagine something really flashy here. That brings us to AI. Now, AI is a very powerful thing. According to Sunder Pichai, he himself said that this is probably one of the most exciting moments in history as much as the creation of, or the discovery of fire or electricity. And this is coming from the CEO of Google. I think that's saying a lot. But with generative AI, we're able to generate algorithms that can create content, any thing from scripts, movies, books. Anything you can imagine, prototypes for brands, they can do it in an instant. And that's incredibly powerful. And I should say that I am one of the first authors, the first author of a major book from a publishing house to have used AI as a book jacket. And it's so exciting to see all of the things that come to life. It doesn't mean that we don't still require human involvement, but it means that we're able to create assets at scale faster than ever before. And that means we're faster to market. And so that has powerful implications, particularly for global businesses. So when we talk about all these things, they actually come together. And they're growing significantly. By 2030, the metaverse is expected to be a $13 trillion business. And AI is now on schedule to deliver $14 trillion in market value. And so, again, flashy graphics here, but the metaverse for enterprise. I wanted to show off a little bit of all the powerful tools that we have to create incredible models. But it's been the motor behind enterprise. And we're able to drive results for B to C companies, because that's where we've really been seeing it, automotive, aeronautics, defense, design, architecture, engineering. That's where the metaverse is being evolved. Because a lot of people are saying, I don't see it yet. Where is it? None of my kids have a VR headset. I don't know anybody who's using the metaverse. But actually, it's around us every day. We're using AI already in chatbots and customer serving. We're using VR. We're using AR for QR codes for restaurants. We're using them for face filters. We're using them for all sorts of things. And it's only slowly becoming part of the public consciousness. But now we're seeing companies gain significant value from the design prototype and an evolution of product design using this. So GM, for example, was able to save $100 million by doing all the prototypes and the testing simulations in virtual reality before. And they also brought the prototypes three times faster to market, so significant business results. Again, here we had a simulation running that would show you how we were able to use simulations that will simultaneously show you the impact of infrastructure decisions on companies, as cities rather. And so from policy makers could click on these simulations and see what the difference in climate would be if you planted 10,000 trees or look at infrastructure projects and run simulations for emergency services. We've also seen big data analytics. This is a project we did for IBM for different scenarios from medicine, telehealth, as well as machinery and equipment. We're able to transform marketing pipelines. This is some work we did with Mondele, as in Google, where we took the cookie, which if you look at the surface of the Oreo cookie, it's actually quite evolved. And we had to create multiple iterations for markets around the world, because they actually produce different flavors every quarter. And all of these require new packaging, new design, everything. And we were able to bring to market 70% return on investment by the efficiencies that we created. So when we talk about Web 3, we talk about Metaverse. We talk about AI. None of these happen singularly. All of these things, acting together in concert, this is the great convergence. This is an historic moment. And so I believe it was a gentleman from Aditya, Mr. Rai who mentioned before, the illusion of innovation. And I really like that, the illusion of transformation because it's not limited anymore to digital transformation. It's much bigger. We are now all of us in this room creating history as we speak. This is an historic moment when it comes to technology and the transformation of digital technology. What we're looking at today is no longer digital transformation, but the transformation of digital. This is very, very powerful stuff. We are now in the virtual age with important implications on how we do business, not only B2B with our customers and our suppliers, but also with our constituents, our consumers. This is a radical cultural shift as much as it is technological shift. And so as far as I'm concerned, the biggest challenge today is not so much mastering 3D technologies. The biggest challenge over the next decade is really how to be relevant by authentically connecting with communities in 3D spaces. In a reciprocal relationship that connects with their values. So what we need to do is focus less on the what, the shiny technology and think more about the who and the where communities that live there, the platforms, the values that they share. Relevance, that's what we're after. So how do we do that? For me, the answer is culture, but why? Because online in these new communities, consumers are increasingly looking to these spaces to find a place of community, of identity, of belonging. And that can't come from product innovation alone. That has to come from a sense of culture and that we have to, through our decisions and our actions, define what that is. That is up to brands. That's up to all of you here in this audience. And so today, I also want to just focus a little bit on what that consumer behavior and their relationship with brands looks like going forward. And how to authentically communicate, whether it's in concerts on the web or doing whatever it is that you do in the real world, how can you translate that online so that whoever loves you in the real world is going to follow you to these new platforms, is going to engage in the content that you create there. Because just because you build it doesn't mean they're going to come. And then there's this. Now some of you may not be familiar with this, but Charmin is a toilet paper brand in the United States and they came up last year with an NFT. Now I understand the gold rushes out there and I understand the desire to capitalize on it. And it makes a lot of sense. And for them, they meant this as a bit of fun, kind of tongue-in-cheek. But I'm going to refer to our friend Captain Obvious when I say that not every brand needs to be online. You don't need to follow the herd. You don't need to create an NFT or digital asset or digital collectible. Again, think about what you do in the real life and authentically translate that onto these new platforms in a way that's relevant, sustainable and meaningful to your end group. Because at the end it's all about authenticity. In these virtual worlds, again flashy design, it's really cool. People expect to interact with your brand in new ways. And the people who are really going to do that are the ones who know it best and those are virtual natives. They're gaming. Gaming is a $385 billion industry and here in India it's a $5 billion industry with huge upside potential. Why? Because you have 442 million gamers in this country and by the way this is the second largest gaming cohort in the world. And the ones who are leading it are the virtual natives and that's the subject of my book. Digital Natives is a term that was first initiated in 1998. Mark Zuckerberg was probably a freshman in college before social media as we know it was even born and since then a lot has changed. We're no longer surf in cyberspace on the information highway. So why are we still using the term digital natives? Today we've got virtual natives. Kids who learn to type before they go to school, why? Because their parents probably met on a dating app. They were given phones instead of keys or rattles to play with, they were given phones. And so when they first arrived at school they already know how to type before they can write. These kids are virtual natives and they learned to swipe before they could even speak. So for them their reality online is as real as their reality offline. And in my book we came up with 10 things that characterized the way this generation thinks very differently. And by the way the age group I'm talking about is what they call the alphas. It's between five and five, 15 roughly. And it's going to dramatically change the future of education, work, play, and culture itself. I'm gonna run through these really quickly but if at any time you wanna have a call with me we can talk through what this means for you and your business, I'd be happy to do that but I'm just gonna be the top line for the sake of time. First is that virtual is the new digital. We've established that already I think. Reality is relative. For them the reality of their experience online is as real as here in this room. Because online I can have face-to-face conversations too. Online we can be friends and we can meet up as you would in real life. Identity is fluid because they're exploring their identity online in different characters, different costumes, and different scenarios. And that is important implications for how we relate with them in platforms and other spaces. Radical acceptance. People are more diverse young people than ever before. They're open to so much about the world and so therefore there's a different openness in how they want to be treated and the kind of messages that we deliver. Charisma is critical. Meaning that they're both susceptible to it but also because they're online all the time it's really important that they wanna hear that authenticity that voice back from the brands too. They want you to be as charismatic and personable as they are. Apprentice to experts. This is really important implications for the future of work because especially here where you have mobile telephony and a lot of people will be starting up businesses or trying to respond to businesses well outside their domain. Very ambitious people. They're gonna bring their own workflows and their experience as early experts because that's what they're doing on TikTok. They're using that as a platform to build their brand and their expertise. So it's gonna be harder to employ them, harder to retain them. Autonomous agents. Effectively the same thing. They have their brand and they're going to bring it to you and they're gonna expect you to listen to them a lot more than traditionally we do today. They're not hierarchical. They're not waiting their turn. Finally, image-alpha-bet devices and as a dependent appendage can create, consume, listen, we know that they use their phones for everything and therefore that's going to change the way their expectations of the workflows that you've created within your own company and how they expect to work with you and with your brand online. So if you have antiquated systems, interfaces, anything, they don't have patience for that and you stand a high risk of losing future customers. So these habits, this outlook is changing the way our expectations of brands and of society itself with very important implications. And in fact, Neil Postman who's a famous observer of online behaviors that all technological change is a trade-off. And for virtual natives, this young cohort in particular, they are forming new communities with clear cultural values and they're expecting us to cater to them, not vice versa. So with this cohort, they're expecting, in exchange for their data, they're expecting content and rewards at scale. So again, if you're going to create digital assets and collectibles, really be prepared for the longterm. What does that strategy look like? In India in particular, you have a tremendous opportunity as the world's second largest generation of virtual natives. How do you tap into this very, very rich source of new business and who are also going to help co-create your brand? Well, they're tech-to-savvy, they're entrepreneurial and they are many people and they're gonna have access to digital tools in a way that we've never before. In the same way that my father imagined, a static library, we have no idea of what this new marketplace will bring, but we are the architects. And so I talked about the great convergence of these new technologies, how Web3 Metaverse and AI all come together and how this is an historic moment for each one of you to put your own imprimatur on your brands and your brand's future. How this can be a tremendously valuable endeavor for you as a company to think about how to leverage Web3 assets or even start to track your supply chain more closely. How to tap in to the rich data and analytics that we can get through customer interactions on these new platforms. We talked too about the key successful innovation being culturally driven, that if you want to have this longstanding relationship with your customers online, you have to engage with them differently. And finally, the virtual natives as a core demographic for the future. And so again, cutting through the jargon and the hype, the big picture is effectively, what are we going to do? We're going to have to be more culturally relevant to engage with this new cohort. To authentically communicate them with them across 3D spaces in a reciprocal relationship. We talk about the cookie, we have to think much bigger than that. Because we need to connect with their values. So the great convergence is really about how technology is converged after all. It's really about how technology is being adopted and transformed by culture and driven by this new cohort of virtual natives. So are you ready to reinvent? I'm super excited to hear what you do, how you take this moment and forge the path of your company's future and your fortunes. And I hope very much that you will stay in touch, let me know. And if I can help you with your progress in any way, please let me know. I'd be delighted to hear from you. Thank you so much for your time today. Thank you.


Can someone grab the door over there? Here comes everybody all at once. All right, thanks for coming. My name is Brian Fox. I'm co-founder and CTO at Sonatype. A little bit of my background, years and years and years ago, I was one of the core committers on Apache Maven, the build system. I was AM on the project management committee. I was the chair for a long time. And for those of you that don't know, Sonatype has always been the company that runs what the world knows as Maven Central. So where the world gets their open source Java, that's been us for like 20 years. And so in the early days, we were very much focused on helping large companies manage their builds and their dependencies and understand what's going on and sort of optimize that through training and consulting around Maven. And somewhere along that journey around 2009, 2010, we started to see companies asking us, how do I do a better job of managing the dependencies that my developers are using? In those early days, it was very much focused on licensing. Everybody was afraid of the GPL and the AGPL. But we could see through some of the early vulnerabilities that the world has long since forgotten that people weren't following good practices in terms of updating their dependencies. That the most popular version of Bouncy Castle, a crypto library, was the one with the level 10 of vulnerability years after it was released.  That problem has not been solved, or we wouldn't be here talking about it. But we saw this back in 2009, 2010, and started trying to figure out how can we help the world sort of figure this out and move along. And so a large part of what I've been focused on in that time is helping organizations at the end of all of the stuff that we just talked about, this great talk about Git Bomb and all these things talking about the Providence. From my perspective, we're still in a world where the end user consumers still don't have supply chain practices that enable them to do anything when the inevitable vulnerability, like Log 4j, happens. And so that's where I want to spend a bit of my time talking about. Because from that long perspective, I've seen us move through three or four phases. And I think the world is still very much stuck focusing on solving the problem in phase one when the attackers are actually moved several steps ahead of that. So just context, these are the downloads from Maven Central. No evidence that Java is dying off anytime soon. We're on track for somewhere over 600 billion downloads from Maven Central these days. JavaScript looks the same. If you look at the chart for Docker, really any of the repositories out there, they all have this great hockey stick curve that show that the world is just consuming more and more open source, more of it pre-built binaries. So in the context of that last talk, trust, well, they're just consuming them. And so we better hope that we're trusting them. The supply of these things continues to explode. Newer versions, newer projects, projects onboarding onto Maven Central, always huge numbers. So the world is building and building and building more and open source, just like Eric's talk on the keynote today, we were successful and this is the result of it. The demand is exploding. Again, these are just different numbers on those same things that you can see across all these different ecosystems. So point is, lots of open source. The reality is, their supply chains are everywhere in this process. And importantly, the supply chains obviously are not a software problem to start with. And so this was Edwards Deming, probably everybody here, hopefully you've heard this, it's been beaten to death. But I'm gonna repeat it anyway, that Deming helped the Japanese auto industry rebuild after World War II, right? And go on to produce some of the most efficient, cheapest to produce reliable vehicles that we've all known to grow and love. And he did this by focusing on several of these key areas. Choosing better parts from better suppliers, using only the highest quality parts, don't pass them downstream. And importantly, continuously track the location of every part, right? So we all come to expect this from our physical goods. And as engineers, we always seem to like to reinvent the wheel. But we've been looking at this for a long time and realized, you know what, we're not the first industry with a supply chain problem. And they've solved it. But I like to talk about a couple of different examples here that have happened because I think it contextualizes what is happening in software and kind of how ridiculous that would be in the real world. So this here, this is the Chevy Cobalt. And I think it was around 2014, there was a problem with the ignition switches. And the engineers, somewhere along the line, found this problem with the ignition switch. The problem was if you had a heavy key chain hanging from it, it would cut off power and people would lose power steering and brakes. And ultimately some people unfortunately died as a result of this. But what was interesting about this when you dig into the details is they made a classic configuration management problem. They found the bug, they fixed it and they didn't rev the part number of the ignition switch. So when people started the crash and they started doing the investigation, it delayed the ability for them to figure out what actually was the problem because they're taking these parts off and they're testing them and they test out fine. You know, the classic works for me on my machine, right? And so ultimately they figured that out but then because they didn't bump that version number, they had to literally recall all the cars because they had no way of actually knowing which cars had the original rev of it and then the not revved version later, right? So in the world of physical goods, a mistake that used to happen a lot in software has very big impact, right? So that's something that we should all be familiar with. The counter example to this is the 787. When they first launched this, there was three or four instances of a plane catching fire, fortunately, at the gate. They very quickly figured it out because they had great management processes. They understood quickly that all three or four batteries that caught on fire came from the same manufacturer, the same lot, they found the other ones, they pulled it out. We all forgot that this happened, right? This was not a max, 737 max type of situation but this happened and it was scary at the beginning but because they had good practices, the results were very different than what happened with the cobalt situation. And then a few years ago, here in the US, we had, I think it was about three years in a row, we had E. coli outbreaks with lettuce, right? And the last one, the last big one, happened, it was a similar problem to the cobalt by the time people were getting sick and they were doing the investigation, the growing season had moved from Yuma to California and so they couldn't figure it out for a very long time. So what did we do? As a result, we literally threw out all the lettuce in like all of North America, right? So that's an economic disaster, it's an ecologic disaster, all of it completely preventable if we just did a better job of actually labeling the origin of the parts and after three years of this, this industry finally did that. I don't know that in all cases, they label it from the farm but they at least label it with a region of origin so now we can choose which parts to throw out, right? So these are important supply chain concepts that we as consumers expect of our physical goods, we expect that of the planes that brought us most of us here at the food that we're eating. But if you think about your own software practices, they're probably not as good as that, right? That's why we're all here, we're talking about that. So in terms of thinking about how the supply chain attacks have evolved over the last 10 to 12 years from my perspective, the first one was really exploiting existing vulnerabilities and a lot of the talk that's been going on here and trying to do a better job of improving the software and the vulnerability disclosure is very much focused on this and that's a necessary thing to do. I'm gonna breeze through these a little bit but the first big one from our perspective was this early struts one in 2013. This happened at the same time that Anonymous was doing a lot of their stuff and a lot of banks were taken down by this particular vulnerability. They didn't make a big public statement about it, they didn't get hauled in front of Congress, but it happened. It was so widespread that the FBI issued field alerts to say that, hey, you need to go talk to your banks because they're probably being attacked by this. It was point and click in a Chinese hacking toolkit, it was pretty much as bad as it could be. And so the world didn't pay attention to this but a lot of our clients did and they started to get their religion around, hey, we need a better job, we need to do a better job of understanding what's in our software and actually doing some management around it. The following year was Heartbleed and Shell Shock, again, vulnerabilities that were latent in this open source for a very long period of time that finally everybody realized was starting to be exploited. And then of course there was the Equifax example out of a slide on that because everybody's tired of looking at it but the point being all of these things existed in the software, as far as I know all of these ended up in a pretty good zero day responsible disclosure and yet people still got attacked, right? The Equifax attacks largely happened days after Apache fixed and released the updated versions of it because the customer that Equifax in that case didn't upgrade all of their servers. Same thing with these vulnerabilities here. And frankly, the log for jail talk about was basically that same class of problem from my perspective kind of old and boring. Some of these attacks have real social harm. In 2015, there was the Commons Collections one. This is a popular library in Java. It's pretty, it's like log for J. It can be assumed to exist on the class path of basically every Java application. If it's not in your application, it's almost certainly in your web application server. This didn't have quite the impact of log for J because it was a little bit harder to exploit. It was a deserialization type of attack. But this is Hollywood Presbyterian Hospital. They were ransomware for over a week and it was traced back to this vulnerability which by the way had been disclosed at DEF CON and patched almost a year before this attack happened. So again, open source in this case doing a great job of responding to the vulnerabilities fixing it but the end users are not updating and then bad things happen. And so we used to say you can't put a name on people that died. There wasn't something in the news about this but statistically it's provable that this almost certainly killed somebody because there are statistics that show if you have a heart attack in New York City or Boston on marathon day, your mortality is significantly altered simply because the ambulances have to route around the marathon route. Now imagine what happens when a major hospital in a major metropolitan has taken offline for a week. Tests that have delayed surgeries that don't happen. All people that might have to be transferred. So people almost certainly were affected by this. There was an attack more recently, I think it was Mercy Hospital in the UK where they did actually have somebody's name in the headlines that said this person had to be shipped from this hospital that was ransomware to this other one and they died because of it. So these bugs and the lack of people updating have already had huge impact to certain people. We always say people don't act until people die. That's unfortunately already been happening and yet from my perspective, too many companies are still not doing the right thing. Then of course there's log for Jay, log for Shell. This one was sort of like the combination of that early struts vulnerability that was super easy and affected you basically if you had it in your class path and combined with the widespread nature of common's collections that it can be assumed to be in almost every Java application was as bad as it could get. These were statistics that we started publishing on our website from the Maven central downloads and you can see in the early days over here, a lot of people upgraded pretty quickly but we never got really past that 60% point which wasn't super surprising in the early days but what is really disappointing is six, seven months later, we've basically flatlined. So about 40% of the world as of today are still downloading vulnerable versions of log for Jay. So there can be only one answer to that. They're not doing it on purpose. It's because they don't know what's in their software. They don't have an organizational bill of materials as we call it to understand that this is still happening. And some people were asking me before I gave this talk earlier they said, was log for Shell just a bunch to do about nothing? We didn't see anybody getting attacked. My answer to that was, well, everybody learned in the wake of Equifax and Struts not to raise their hand and say we got attacked because we didn't update over this dependency. So we're not hearing about it. It doesn't mean it didn't happen but there was a report that came out. I think this was sometime in March, March 8th that indicated that there were some APTs that were actually leveraging this. So this stuff is happening even if we're not hearing it in the news. You can be guaranteed that people are being affected by this. And so if we think about why is this happening? To think about the economics of this for a moment these statistics the first time I saw them were shocking and I felt like I kind of already understood how bad the problem was. In 2016 the illicit drug trade as an economy was estimated to be worth $435 billion. Now this is what, six years ago? Cyber crime was already a bigger industry back then. $450 billion. And if you think about how much time and energy is spent on the war on drugs and the opioid crisis and all of that as a society that we spend talking about this problem as compared to until the very recent past cyber crime that's a bit shocking. It seems like we're sort of focused on the wrong problem. And actually they've been projecting and it followed this track that this cyber crime was costing us as a society last year $6 trillion. If that were an economy it would be the third largest economy in the world after the US and China. And so projecting forward a little bit I'm not sure I believe that it levels off but they're projecting by 2025 it'll be 10 and a half trillion dollars. Now one way to think about this is this is the funding that is aligned against all of us here trying to do the good thing. This is the VC investment because this is the money driving the bad actors to find every single chink in our armor. That's a big adversary. So phase two I've called creating opportunities. So remember phase one existing bugs just boring bugs that were there people figured out how to do bad things they were disclosed and the bad actors were quickly trying to leverage the gap between the world understanding and customers upgrading. Phase two started around 2017 there was this report that came out that talked about how 14% of the things in the NPM repository were published by people who had password as their password or had checked their password into GitHub. And it was kind of a big thing they revoked all the tokens and all that stuff but for me this was kind of interesting because I had never seen this called out so blatantly that the publishers had such poor diligence around their own security. And so we started talking about that but what's interesting is just a few weeks later we saw two different attacks one on NPM one on Python that were starting to do the typosquadding. And this wasn't particularly surprising but what was really interesting from my perspective at that time both of these things were focused on exfiltrating the password tokens for the publishers. They weren't about trying to get into the software and then do something upstream they were going after all of us the open source maintainers. That was the first time I had ever seen that and I had that moment like you see something anybody else see this? This is kind of crazy. And so then for years we were talking about this I started tracking it because it seemed like that was the time when the attackers finally started to pay attention to the supply chain from my point of view and there were a whole bunch of follow on incidents where it seemed to me like they were sharing best practices and iterating and getting better and better and better at actually finding different exploits in the supply chain. And so at the end I'll show a link where you can go and read more about these but the evolution of those attacks over the following couple of years was really interesting from my perspective to watch that unfold in real time. The reason why this happens just like any other engineers they seek the most efficient path there's a lot of money behind it but they wanna be as cheap and easy as they can. This was a study that looked at the combined reach of the 100 most influential maintainers on the NPM repository and inversely how tightly integrated the top five NPM packages were in terms of other things. So you have a massive consolidation of risk in a small number of contributors. If you could steal one of those contributors tokens you can get to about half of the things in the repository at that time. That's pretty scary. And if you can slip something into one of those top five projects you can get yourself hundreds of thousands, millions of downloads almost immediately. So this is why they're starting to move up into the supply chain because it becomes a force multiplier for them. The next phase is the phase that we're really in and I don't see enough people really focusing on this. The attacks are focused on the developers and the development infrastructure itself. Right, so everybody's thinking about what happened with Log4J and their vulnerabilities and they're getting in there and they're attacking the applications or things like Equifax, they went into struts and they stole the data. But most of the newer attacks are actually looking more like what happened with CodeCov and even SolarWinds where they're trying to focus and get into that development infrastructure because it has the keys to so much of the kingdom. So this was one of the first ones that we were tracking. Back in 2018, somebody mined a whole bunch of Bitcoin. It's probably still worth more than that even after the crash. This was a long time ago. But that was one of those first targets where they found an Unpatched Jenkins server through one of these things and they started attacking it and using that somebody else was paying that cloud build to send a bunch of Bitcoin into their wallet. But last year, this one was sort of interesting. It was a similar situation but what happened here was the attackers actually used the development infrastructure to move sideways inside the organization and were able to breach a bunch of camera feeds. Camera feeds at hospitals, police stations, daycares, and a Tesla plant. So this just kind of shows people that development and the development infrastructure can be a significant way into the rest of the organization especially if you think about the production systems and these kinds of things. Development infrastructure probably somewhere has the secrets that are needed to get onto your cloud. So that makes it a super juicy target. The CodeCov incident, a similar one. This unfortunately went downstream to their users, CodeCov was a tool that helped people assess the coverage of their unit tests. The attackers figured out vulnerability in that container which then made all of their users open to supply chain attacks directly in their infrastructure. And I lost track of all of the different types of things that came out of the side of this. But it was pretty significant. And so there's again a number of these incidents where these things are focused not on trying to steal personal data, they're focused on trying to steal your credentials and your passwords. Some cases they're printing money and in many cases they're leaving back doors. In fact, early last year there was a white hat who released what he called the dependency confusion attack. So in some of the systems if you don't have something like a repository manager to control where your developers are getting their dependencies from. People figured out that if you knew that a company was using a project called Foo internally and you went to NPM and you put Foo with a high version number up there those build systems would fetch that version from the public repo. And so he did it as a proof of concept but almost immediately from our perspective we were tracking this. We saw tons of copycat attacks. Everybody else was after the bug bounty right away. But what I told my team and what I was really worried about is somewhere in that noise are gonna be the attackers. Every time this comes out you don't have enough time. Everybody looks at it and that's a great idea but it's all pile on. And so within the first 72 hours there were 300 copycats. Most of them of the same prototype code looking for the bug bounties. Within about a week we had seen the number of suspicious things that we were tracking and our system go up 7,000% all of them as a result of this. This was just a week. It took a few more weeks actually before we really started to see the malicious ones show up. I was surprised. They were a little bit slower than I thought. But they did start to show up and then this continued on and we kinda stopped tracking the number after a while. But the attackers were using the prototype code to do the same thing. Attacking companies, dropping these things in, stealing command lines and all these kinds of things. And so it follows the same pattern that we saw like in the Equifax that once this becomes known, in that Equifax case was a vulnerability in struts, in this one it was a new and novel type of way to insert malicious code into the supply chain. You don't have much time to be able to respond. And so in one of the reports we published last year we showed this number a couple years ago. We had seen 216 within that first timeframe from 2017 to 2019. The following year it exploded 430% up to 1100 and then last year it was another 650% increase. So this is the new norm. This is what's happening. None of this has anything to do with a lot of the stuff that the world is talking about right now in terms of like how do you make open source more secure? This has everything to do with the fact that the consumers are not paying attention to what their developers are using and allowing themselves their supply chain to be wide open to attacks. And so when this started happening and I started talking about it, some of our customers were asking, well, what do you do about it? How do you prevent these things? Because as soon as they hit the repository where they're malicious, they're designed to cause harm. You have zero time to respond. It's not like even the struts thing where they had three days. You've got nothing.  And so we actually started building some systems. We took a page from the credit card companies trying to build models around the repositories, understanding what's normal for a project, when they release, who does the releases, what type of dependency changes are normal for big projects. We fed that to some ML AI tools to help us identify these things. And at first I thought we were basically building an asteroid hunting tool. Like one that I wouldn't know when we missed something because it was gonna be so rare. But actually, as soon as we turned it on, we started to flood our own security team with valid findings. And so as of last month, we've identified 87,000 packages in the last year that were actively malicious. Over 15,000 of those, we've had to submit to repositories to get taken down. Not all of these were at that level. There were just too many for us to flood NPM and PyPy and some of the other repositories with. But the number is astronomical, right? So when we see places talking about, well, we found 200 zero days or something like that, like that's phase one, we're in phase three. This is what's happening in the world right now. And again, all of the things that we're talking about within the OpenSSF and trying to fund and make people do a better job, making the open source better and safer, that has to happen. That's obvious. But from my perspective, if the customers don't get a better job, do a better job of actually managing their open source, a lot of it is for nothing. Because no matter how hard we try, the software's written by humans, there's always gonna be vulnerabilities. It's like the auto manufacturer is saying, my suppliers got good enough at making good parts. I don't have to track the parts in my cars anymore. Like we know that's ridiculous. There's always gonna be mistakes. And so, I'm trying to make sure that the end users are focused on this part of the problem as well because it's something they can do now. All of these other things in terms of trying to produce better S-bomb standards and educate the open source developers, that's going to take time and it needs to happen. But if we leave those customers thinking that they can just sit back and wait, they're leaving themselves open to massive vulnerabilities in the meantime. So, I'm gonna jump ahead a little bit here. This was one of the surveys we did. We had been doing this annual survey. This year will be the eighth year. And this tracks, by the way, with some of the data the Linux Foundation released today. 50% as of last year, we're saying they used some process. This was pretty good because eight years ago when we tracked it, it was in like the teens. It was like 15%. So 15 to 50 feels good. Until you think about it this way. What if those industries, only 50% of them tracked their parts and only 30% of them had any mechanism to do a recall? Would we feel like that is a good situation? I don't think we would. So we shouldn't celebrate. We're making progress, but we still have so much further to go. So what I like to leave people with, you have a supply chain, even if you don't manage it, you'd be surprised how many companies I talk to who are just completely in the dark about this.  And the attackers are exploiting that whether you're doing anything about it or not. And this self-evaluation is one that I've always used. The world went through this on, what was it, December 9th with Vlog4j. If I told you about a new vulnerability, do you even know if you're using this exact component? So much of the world had no idea they were using the vulnerable versions of Vlog4j. In fact, as I showed you, 40% of them clearly still don't because they're still downloading it today. Do you know which applications it's in? Can you track that remediation and how long is it gonna take you to ship and deploy an update? Because in these cases, the attackers are moving on you instantly. And worse, how would you avoid the next malicious release? So when you have zero time to respond. And this is one that's really interesting, especially in the world of COVID where so many developers have moved home. So many of those developers are now lacking the perimeter defense that they at least had in the office, right? I'm talking about the firewalls and these other types of things. The blocking of data exfiltration that might have been detected if these back doors were dropped on their systems in the office. Are they covered as sufficiently at home? Some big companies, probably yes.  And so what I'm seeing from the patterns that are happening with developers very much looks like the 1990s. You remember when browsers were inherently vulnerable and just going to a bad website got you hacked? Well, what did those attackers rely on? They relied on the fact that somebody went to the website said, oh crap, that's not the website I thought I was at and they hit back and they went to the real one and never bothered to check or think that they got attacked. Well, this is exactly what's happening with developers right now when they pull down one of these typosquadded components. The components aren't even trying to build. They're not trying to masquerade as the valid component. Literally all they're doing is dropping a back door or exfiltrating keys or whatever and they're doing it in seconds. And so the developer grabs a component, they run their build, it fails, I go whoops, got the wrong one, I fix it, I move on with life, I check it in.  So it's interesting when you look at these because these patterns repeat over and over, it's just a technology move. So what we saw in user behavior in a browser is what we're seeing in the user behavior of developers and dependencies right now. And so lastly I like to remind application security teams when you think about Deming principles, right? Deming and traditional application supply chain practices are focused on the end product, they're focused on the cars, making the cars better. You should and need to have good practices about doing that stuff. That's kind of table stakes but merely doing a good job of that is not protecting your factory. So what do I mean by that? If your application security teams are only paying attention to what is about to be shipped into production or shipped to your customers, you completely missed the entire phase three war that's happening right now. You will not see the back doors that were dropped on your developer machines. You won't see those types of upstream attacks. And then this was one piece of data that we found that was really interesting a couple years ago, I still like to show it. We talked to hundreds of customers, hundreds of people that filled out the survey and we kind of classified them into teams that were focused on security at all costs. This is the hardest hardcore, that's what they focus on. You've got people who are focused on just ship it really fast, that's the thing we care about. Security will be an afterthought. And then there are people who had it fully integrated and we kind of looked at what that was. And I think the world would pretty much not be surprised if I stood here and said, you know what? In order to do all of these things to be really good, you need to be able to pay attention to security and you're gonna take a hit on your performance. Like paying attention to security is going to be slower than the people who only care about going fast. That seems logical, right? Except the data shows that that's not true. That the highest performers were in fact the ones who cared about being agile, iterative and cared about managing their supply chain. It seems counterintuitive until you stop and think, just because they don't care about their supply chain doesn't mean that at some point they're not gonna have to stop and go back and fix one of these vulnerabilities that they didn't plan for. So that unplanned work, rework, is actually costing them performance. So the irony here is the way to go fast is actually to manage the supply chain. Not to just try to go fast. And I think that's a pretty interesting outcome from this.  And so lastly, I'll leave you with this link here. You can get access to all of the historical stuff that I showed, all of the details. We're compiling and looking at the results right now for the eighth year. It'll come out in a couple of months. But all of those charts, detailed writeups of everything I showed is available there. So that's the talk. Anybody have comments or questions? We have some time left. No, no. I try not to get too jaded or too down on this because we are making progress. The fact that we're here at a conference called the Supply Chain Con, it indicates that we've come a long way.  When we first started doing, trying to solve this, we did what we did when we built the company which was open source first. That's how we made Maven successful, it's how we made Nexus repo successful. We built free tools that showed developers the licenses and the vulnerabilities of the components they were using. Nobody used them. So I went out and started talking to people. I talked to other open source developers who should have known better and they told me this like a direct quote because I never forget it. I don't have to worry about the security of my open source components because I have a firewall and I have a security team. All I have to worry about is the AGPL. So in 2011, that was the general state of understanding of what we're talking about here. So again, now we're at Supply Chain Con which means we're getting in the right direction. So there's progress, but there's still so much to go as evidenced by the fact that Log4J still downloaded 40% of the time, the wrong versions. Yeah. So I get this question every time. The question is why are those things still available? And for the first time in a long time with Log4J when this was happening in the moment, I think, Jonathan, you probably hit me on Slack a couple times. We actually talked to the Apache Maven, the Apache Log4J PMC and some of the other leaders at Apache. One of the fundamental principles of Maven is that the repository is immutable. We don't change these things. Once they're in there, you can't remove them unless it's a copyright or if it was actually malicious, we'd take it down. But it's intended to be immutable and so that's the norm. But if there was ever a case to take it down, it was a Log4J. So we got together and we started talking. And what we felt like at the time, now again, seven months later, this is a little bit of a different story. We haven't talked to them lately, but we don't wanna be in the position of playing God and deciding for the world which books to burn and which one's not. And in the moment of what was happening, we saw many companies who actually were doing a good job of triaging it, the companies that were doing a good job probably were focusing their available resources. Again, this was just before Christmas on patching the most vulnerable applications. If we unilaterally decided to just take down every other version of Log4J, by definition, we broke every other part of their portfolio. And so we like quite literally would pull the brain surgeons out of surgery to put some band-aids on knees, right? So it sounds simple to just remove these things, but because of the way the ecosystem works, you're effectively breaking every other single build kind of permanently until somebody takes an action. Now again, in Log4J, because it was so bad, we stopped and asked the team the question, should we do this? We're not gonna do this unless the Log4J PMC is on board with doing it. And there wasn't agreement even within the team that they would do that because it sort of masquerades the problem in some sense. People would just find the download from a previous build, jam it in, and now they have no way of knowing. So it's not so simple as it seems. And I wish there was a better answer to that other than putting the onus back on the end user to actually pay attention to what's going on in there. If we just break this one build for Log4J, where does it end? Do we start breaking it on level five vulnerabilities? Is it level six? Is it level seven? There's no great answer. So that's why. Go ahead. So will it have the same effect as the financial regulations of Sorbet and Oxley? I think we might get there. There was the FTC quote that was mentioned either yesterday or earlier this morning that basically said, we're paying attention companies. If we find that you've been attacked because of this, we will consider that to be negligence. You can't claim to not have known that something like Log4J was vulnerable and not doing something about it was negligent. I think we're moving in that direction, especially if the industry doesn't get their act together. The executive order was a move in that direction. It was interesting, there was a proposed bill in front of Congress in 2013 that had basically the same words. The executive order didn't come out of nowhere. They regurgitated a bill that failed to get moved to the floor in 2013. So we could have been seven, eight, nine years ahead even in the regulation moving on that. But I think we'll probably get in that situation at some point. Yeah. Have we thought about what, sorry? At Sonatype, we have. With some of our products, the repository manager, customers are proxying because it's giving them better efficiency and more control. Some of that's the reason we created that early detection stuff I talked about, the credit card fraud protection like algorithms is working in conjunction with that. So what happens is as soon as the repository, the artifact gets released saying to NPM, our systems look at the data and it basically real time can make a decision. Just like when you swipe your credit card somewhere the systems are saying is this really you? Is it normal for Brian to go to Best Buy and buy a TV in San Francisco when he lives in New Hampshire? No, it's not. So our systems are doing that and it works in conjunction with what we call the firewall product that basically stops that any downloads at the customer sites until our security team can confirm or deny that. So it allows them to basically defer any consumption of that. And it's been pretty effective, like I said. Keeping track of 87,000 malicious things in the last 12 months, nobody would ever be able to do that by hand. So that was how we ultimately were able to respond to help protect that because it's the only way. Again, if the developer downloads this thing and in the NPM install script it drops a backdoor. It's too late at that point. How do you stop it? You stop it from getting onto the machine. So that's why working with the repository manager to basically firewall that off is a good way to do that. Okay, we're out of time. So thanks everybody for coming. Hopefully you learned something.


In 2022, there will be 10 key public health challenges that must be addressed. These include the continued threat of COVID-19, insufficient human resources for health, lack of adequate financial support for health systems, conflicts and humanitarian crises, mental health, poverty, climate change, the health of children, reproductive health issues, and the infodemic. These challenges require urgent action and increased investment from governments, civil society organizations, and private sector partners. By focusing on these 10 priority areas, we can make significant progress towards achieving the UN's Sustainable Development Goals.