Thanks, everyone. Thanks for coming to the first Music Tech Meetup. Thanks for making this happen. I've been wanting to do this for the longest time, but this is really fun because this is something that I really enjoy doing and it's been a passion and hobby and I'm even more excited that Jerry was here as someone who sort of taught me all those DSP basics a few years ago and I sort of learned a lot of the stuff along the way. So today I want to talk about something that I've been playing with for the last couple of years. It's something called Web Audio. So a little bit more on the questions that Jerry asked earlier. How many here have worked or played with web technologies? JavaScript, HTML. All right, cool. So this is very easy to sell to you guys because we just saw sort of how things are done in the C++ world and I'm gonna give you a sneak peek at how things can work in the web world which, you know, by the nature of how it is it's slightly, slightly simpler. So this is my talk, Web Audio. I should change that. It's not emerging anymore. It's kind of out there already. It's kind of standard, but I should really because really everybody knows that, you know, all this is about making random noises and I'm just having fun. So a quick thing about me, I work with audio technologies. I used to work a lot more with the media side of things. I don't work with that anymore. I also host a podcast about local sort of development, like deaf committee engineers and this interviewing really interesting people in Singapore and I also make a ton of trouble at local meetups. I host a couple called, one called Papers We Love where we take academic papers and share and explain them to each other so that you all get to learn. But that's enough about me. What I want to talk about is Web Audio and what is Web Audio? Why Web Audio matters and why it's something that people who are interested in audio technologies should at least know about or at least play with it a little bit and a very quick overview of how you can use Web Audio. So starting with what? This is the problem with, you know, I thought it was mine. Really good ringtone design by Google there. So what is Web Audio? Web Audio is a browser API. So this stuff works in your web browser. So your Firefox, your Chrome, your whatever browser you use, this stuff works inside that. So it's all done inside a browser. If you've heard of the term HTML5, so this is one of the, HTML5 is more like a family of APIs, a bunch of things you can do with HTML5. You can do Canvas and VR and all these things. One of the things you can do with HTML5 is Web Audio. So it lets you generate, synthesize, manipulate, create sounds in a browser. So a little bit of history of how sort of this came about. If anybody's been playing with Web technologies for many years, you might find some of this, you know, sort of, you might remember some of these things. Back in a long time ago, there was something called BG Sound Internet Explorer. This was like background sound, you know.  That's what they used. It was a tag in HTML called BGSound that you could, you know, put it in, put a, put a MIDI file and it would just play that. No, this was, this was created by Microsoft. Man, let's keep probably stolen it as always. Then there was the time of Flash. I'm sure you guys remember Flash Audio. This was, you know, this was really like where things were and you put them in using these object and embed tags, right? I'm going to show you a Flash. Unfortunately, my browser blocks it nowadays because, you know, Flash is not cool anymore. But yeah, this is a Flash audio file and now you know why they block it, right? It's, it's anyway, it's not really something that a lot of browsers like to support these days. And then there was sort of something that came along, which is more of a standard, which is more something that was accepted by the W3C consortium and all the browsers were sort of behind it. And it was called the audio tag. So this works across all browsers.  And it works. Let's me change things quite easily anyway. So then Mozilla came up with something called the Audio Data API. So this was something that they were trying to do because they felt the audio tag wasn't good enough to be able to manipulate things. You could change the volume. You could change how fast and slow you change the speed of how fast and slow you play the sound. But you couldn't change things like filtering. You couldn't filter things, couldn't really do much. So Firefox came up with the Audio Data API that gave you sort of kind of like what Jerry was showing, very low level signal processing kind of access to the audio file. And so you could, you know, explain the samples, change things around. That was really fun except no other browser actually liked it. So they were like, this is too low level. You couldn't, you can't do things. You're going to have to make everybody sort of a lower level programmer to be able to use this. And it was against the ethos of the web which preferred to give people more higher level API so they could use things around. So finally everybody got together. W3C blessed this and the Web Audio API was born. So this is sort of finally certified mid-last year. So that was finally when the API was considered like it's acceptable and most of the major browser supported. So the main philosophy behind the API is it allows you to do mixing, processing and filtering very similar to what we saw Jerry show earlier within your browser. So you can think of it as doing something like this and this and this, you know, you just need the sound, right? You can use a boing. So all of these things could be done just within your browser. And surprisingly, all browsers today support it. I should change the IE logo. It's not IE anymore. It's Edge. IE doesn't support it still, but the new Microsoft browser Edge actually supports it pretty well. A quick aside, so all of these web standards are published as a spec and you can go read them. Actually, it's on GitHub. It's an open website. You can go read it. You can figure out how, what is the standard spec for all these things. This is how you can write the code. All this stuff is documented really, really well and explained. This is what people like Microsoft or Firefox, Chrome teams would use to implement internally how they work. And the cool thing is that entire process of creating this is also completely open. So if you're ever curious of how that works, you can actually go follow it. And it's really fun to see people sort of, you know, arguing about different algorithms and how things should work and, you know, whether they should, what kind of features they should expose in the API. And just for those people who play with the web, and you're not sure how well it's supported, except for IE. We don't talk about IE anyway. It's pretty, pretty well supported. It's supported in quite a few versions of Chrome and Firefox. Edge supports it since the first beta, I think. It's also supported on the mobile browsers. So you can actually do all this stuff that I'm showing on the mobile browser. No change of code. It just works. Node.js. So Node.js is not technically JavaScript. In the sense that it's not in the browser. Or, okay, I should put it that way. Web Audio is a browser API, not a JavaScript API. So it's supported in the browser, not in the language. So there are some modules that people are trying to implement it in Node.js, but it's not the same because there's a significant amount, as you'll see, the significant amount of really high-level APIs that this provides, which would be a sizable work to implement in Node.js. So what can you do with Web Audio? You can make musical instruments, you can make games, you can make immersive interactive experiences, you can do communication and recording, and you can make digital audio workstation like production and software. So I'll give some examples of some of these as we go along, but first I want to talk about why do you want to do this in the web. And I think that's three really, really cool things that the web as a platform provides you to do, to write your audio applications on a web platform. And the first thing is distribution. And the fact that it's cross-platform. I mean, you can write it once and literally run it everywhere. Also, the super cool ability of being able to share your application by just giving a URL, right? This was an app, I hope it works, that was made by one of my mentors and a professor at NUS, and it's just a synthesis engine that makes all sorts of weird sounds. But the cool thing that I want to show, it's probably a bit hard to show, is I can make sounds with this. So let's play this. It's going to work. No, it's on. It might be broken. Let me try again. No. Okay. Anyway, it doesn't matter. The other demo should work. The point I wanted to show you was, look at this URL, right? It actually has things like, this is a model called Rexter. The red value is this, the badness value is this, and the gain is this. I could send this to someone else, and you'll hear the exact same sound that I was hearing. The ability to share this kind of sort of real, really specific things, just by using a URL, and everybody knows how to click a URL, is something that is kind of hard to do in other platforms. Because of the entire URL baseness of the web. Collaboration. So the other cool thing about being online is, well, you're online. You're connected to other people. So you can connect with other people. There's a bunch of things that you can do where you can collaborate. So BandLab, which is what Jerry was talking about, has a feature where you can collaborate with other musicians. And you can play your instrument. They can play their instrument, and you can sort of jam together. The lag is a little bit of lag, but it's not something that you can't work around by coming up with different ways of sort of, you record first, and you post to someone else, and they can come and record. But there are different ways to go around it, but the point is it's so simple because you are automatically connected to everybody else, and it's stuff like web sockets. This is super simple to just collaborate and work with each other. And I also feel that web being a platform that's inherently so visual, there's a DOM, there's Canvas, there is WebGL, all these things make it so easy to add some kind of interaction or some kind of visuals to your audio. Without really spending a lot of work or learning a whole new graphical framework, stuff exists. There's a bunch of libraries, just put it in and it works. So for a demo for that, this is this super old thing that we made at one of the companies to work for. So you can see that just being able to add interactions and sounds and visuals and all to work together is really simple. You don't really have to do much work because all these pieces already exist on the web. So that's sort of why I think it's a really cool platform to experiment, to play with, to make your apps and to do something super fun. So let's get onto a little bit more technical side. Let's look at how you can actually write some code in web audio and how it actually would work.  So you have some source, some kind of an audio file or some kind of something that generates audio that's connected to something else. And usually the last thing that's connected to is often called a destination and that's like the loudspeaker where the audio comes out. So you can have a sound file that's connected to some kind of a filter that's connected to the output destination that goes out the loudspeaker. So that's how you sort of build up the entire chain as it's called or routing graph. Unfortunately you don't do this using any kind of a visual programming language. This is JavaScript, you kind of write code and you can say take this, connect it to this, take this, connect it to this and that connect it to the output. So I'll go through the code a little bit but this is a simple way. You could have a much more complex graph and start getting more interesting sounds out of it. So you can have all sorts of weird configurations with different kinds of filters and different kinds of effects. The API is pure JavaScript, nothing special. So if you're used to writing JavaScript or if you're used to writing any C-style language, it's very, very simple. One of the simplest languages I think to pick up. And the cool thing is everybody has a development platform built in. Every browser can run this. So you just open up your browser, open the developer tools, copy paste this and you should just make some sounds. Can you show me? Sure. Okay, let's try. So this is, I'm making an audio context. I'm making an oscillator and a filter. Sorry, for those who can't see this, the code is broken. Can you see this now? All right, so I made an oscillator, I made a filter. I'm going to connect the two together. It's going to probably sound really bad because it's going to sound like a, you know, five less slides of code. But again, the interesting thing to realize is while you get this super nice, super clean, very simple JavaScript API, the actual implementation, it's kind of hard to see. This is from the source code of Chrome browser. So you can, Chrome is open source, you can actually go look inside. It's actually C++. This is very similar to what Jared did. I'm pretty sure if I go dig in, I'll find a place which is exactly like what he was doing. There's not much difference to how some of the sound is actually generated. It's just you have this high level API that makes life simpler for you. So like you're talking about earlier, it's all about routing and connecting these nodes together. So what kind of nodes does web audio provide by default? Provides a bunch of types of nodes. So the first type, I like to call them as sources. So it's things like oscillator, these generate audio of some kind, right? So it's an oscillator, it generates a sine tone, like what we just heard. So I was using an oscillator. There's an audio buffer source, as it's called, it's a very heavy name, but basically this means an audio file. So I can take an audio file loaded into this and I just place back the audio file.  Or it could be even a smaller part of sound, doesn't matter. Take an audio file, put into this and you just place back.  This is used to take audio from a video tag. So let's say you have a video tag and you wanna take the output of the video tag and change the voice of the person to Darth Vader or something. You could do all that using this. So you can get in the audio from something else and sort of process it.  So these are sort of the ways to generate audio. I'm sorry, this was not to send out. This was to get in audio from some third party. So these are all inputs. Like this is how you get sound, see how you create sound. Then you effect it. So you can change, you can have a gain node which changes the volume of the sound. A by quad filter, which is what Jerry was showing earlier. So it's a filter. You can do low pass, high pass, all this stuff. That stuff can add a delay if you wanna add some sort of echo kind of to your audio, to your song. You can have, you can do some analysis. You can pan in stereo. So you can do left, right panning. You can do a 3D panning. So it's what we were talking about earlier with this spatial stuff with VR. So there's already a pre-implemented node that does all the head related transfer function stuff. Although it's kind of weak because it assumes a single head related transfer functions. Normally head related transfer functions are personalized. But this kind of assumes a single one. But still does quite a decent job of doing 3D audio. A convulver node that you do all sorts of really interesting reverberation processing. There's a wave shaper and a dynamics compressor for doing distortion. So you really get a lot of free pre-built effects. And this stuff sort of is all optimized and pre-implemented in super fast code in C++ for you in your browser. So you don't really have to reinvent any of these things. And of course, finally, now you have gotten the audio, you have processed it, you've got to push it out somewhere. So the most common one is destination, which is your loudspeaker. There's something called offline destination that lets you sort of run something and record it to a buffer and then either save it as a file or use it again as something else. It's called a pre-render. And then media stream audio destination, this is like something that you're doing peer-to-peer communications or anywhere. You want to send audio to someone else on another computer or other machine. You can use this to do that. The way you connect nodes is using something called the dot connect method. So here you see make a new context, you take a buffer, and you connect the buffer to the destination. So you have a buffer that's going to get to destination. So if I play this, this is basically going to take in whatever audio file that I passed to this buffer. It's going to play it out. So this is the kind of big idea that you can see that is how connections work. You just take something, you connect it to the output, and then you play it, and stuff just plays out. Of course, that was a very simple graph. You can have much more complicated graph. And if you look at this specific application, which is a vocoder, this is like one-tenth of all the node connections there are. So there's like hundreds of nodes being made and created and connected and removed at the same time in a more complex application. Does Chrome have a kind of automatic graph generation? I'll get to that. No, it doesn't. Firefox does, but yeah. Let me talk about a couple of other things. I think we missed out. Yeah, so there's something called parameters. So you saw that we had something called a Bipod filter, or filters and effects and gain along these things. But how do you change things, right? How do you change the game? You want to make the audio softer at this part, louder at that part. You want to change the filter from this frequency. So every of these nodes expose something called parameters that you can change. So you can see in filter, there is something called filter of frequency and it has a property called that value that you can set. So now the filter is going to start filtering off at 400 hertz. You can set the Q value of the gain. The oscillator also has frequency. The gain has a gain. The buffer has a playback rate.  So you're able to basically use that to control and change your audio as you go. To stuff like making envelopes and making padding and all these things can become quite straightforward just changing these values. So I'll show you a couple of examples. One is something called parameter automation. So it lets you automatically change these parameters. You don't want to keep changing them manually. So here is something that's very commonly used in music, very low level music production called amplitude modulation. You'll hear it. It's probably going to be really loud. So I apologize if it is. It's really, I'm so sorry. I'll try to figure out how to... Actually, you know what? I'm going to change my audio to my internal speakers. So it's not going to be so loud, but if you guys can't hear it at the back, please come and sit in front of the wall of space in front. And here at the back. So you can... So what this is doing is it has two oscillators and one oscillator is modulating the other oscillator. And you can change its values using... How much longer is it going to be? I have some... No, it's fine. It's all right. It's also not very complicated sounds. It's just going to be this kind of stuff. So you can do these kind of things and have graphs where one node modulates another node and can do all sorts of automation. All this is pre-built again. So you don't have to sit and change a lot of these small things. You can even connect nodes to parameters. So this is a bit more complicated stuff. So you can have an oscillator changing the frequency of another oscillator. So that's going to sound more like a frequency modulation as it's called. This sounds really weird. And like, Yossi, what's the point in all of these things? But, you know... And this is something that I... When I was making this presentation, why everything's so low level? Where do I get to make my Rick Astley songs, right? Why is everything so... So, you know, like Jerry talked about stuff in C++ where you're changing, you know, individual samples and multiplying them. And I'm talking about connecting nodes. But where, you know, how do I make music? Where is my songwriting? Whereas... So I think if anybody has ever done any coding, you remember that the first thing you did was this, right? You did print out Hello World. And then you saw Hello World. And this is again very, very different than stuff like what PayPal does or stuff like, you know, what your DAWs do or all applications started off at some point here. And this is sort of the basics. Similarly, if you ever wrote any visual code, you start it off by drawing a black square. This is the standard thing you do.  And then you sort of build up from there. So similarly with Web Audio, you get all these really low level basic handles on things. They're much higher than sort of, I would say, like what you do in, you know, more like C++ kind of stuff. But still they're low enough that you don't really see the direct application of that to, you know, your next music project. But that's where stuff like libraries come in, right? Because people have sort of taken these things, bundled them up, made some really, really cool things that you can just drop in place and start using it. So I'm going to talk about a few libraries that are super cool. It's something called Tone.js. Very widely used Web Audio library for doing basic sort of musical stuff.  This library does it for you and you don't have to deal with any of this note connection stuff. It's a very simple API and it's very well maintained. So you can look at that. This is something that I made in one of the previous plays I used to work. This is more for interactive things. So if you want to have something where you're looking at the alien moving around and as you move around it changes the sound, this stuff, this would help you, that has a lot of functionality to let you do that very quickly. There's something called Babylon.js if you want to make games. Babylon.js is great for using sort of adding sounds to games. So it does things like, or whenever there's a collision, play this audio file. So all these sort of things where you need them in a specific way, all these frameworks and all these libraries that already exist, help you do that in that specific way. There's a list of, this is kind of a plug. There's a list that I maintain of all super cool libraries and frameworks and just awesome apps on Web Audio that you can just go and look and if you find something new you can just add a new one in. It's open source. So you can just play with it.  Firefox has this thing called the Web Audio Inspector. If you use Firefox, it's download something called the Firefox Developer Edition and this comes in. So you take any Web Audio webpage and just open your Inspector and say there's a tab called Web Audio and it just shows you the graph of what you have already coded. So if you have written some code and you want to check whether that works, this thing helps you do that quite easily. There's another cool thing. This is a website. It's called Kenopy. And I think I have this running so I'll try to see if it works. So this is some code that somebody wrote that does something similar to what I did earlier. Just make some sound. Now we'll see if this is probably not going to kill everybody's ears. Yeah, it's just a simple wave. But then this also has this thing where it shows you the graph. So you can write your code at the bottom and it shows you what is the code that you what is the graph that you generated based on the code. It also shows you what is the audio that's coming out of it. So it's super handy for debugging and playing with this stuff. There's something called Recorder.js which lets you plug in Web Audio to another browser feature which lets you record stuff from a microphone. So this lets you do stuff like speech recording or you want to change the voice of someone. So Recorder.js is a really nice library for doing that. And for the last bit I'm going to show you a few wacky, cool, crazy things that people have built with Web Audio. And the first of course you have to start with the Asset Machine because, just because. Okay, I'm going to turn off the big audio for this because otherwise it's just going to annoy everyone. All right, let's play. Can you guys hear it? Yeah, this would have been nice with the loudspeaker but it's fine. The links are there. I'll share the link to the talk. You can go listen to it. And you can, this is just all done for you and it's just all completely synthesized in the browser. The next one is very different. This was an art project by some people who who had access to this large repository of bird sounds from all over the world. So they built this app. So unfortunately, a part of it is broken. What it's supposed to do is supposed to find my location and make, so it shouldn't say Paris it should say Singapore. But that bit is broken. But it makes a soundscape from these recordings from all these different sounds. And I think this might, this might be fine. Yes. Yeah, it's supposed to be like what person? Am I right? This is another favorite one.  It's trying to see what it sounds like. So this is some HTML that I found somewhere and it's trying to synthesize it. Actually, this is the HTML of my slide show. So this is very metal. My slide show is playing itself. It's weird. Oh, I can change. I can change all these things. It's kind of cheap because they're using some kind of a scale and then you're mapping around it. So it's always going to sound musical regardless of what you do because you're mapping it onto a musical scale. But yeah, I think it's just based on text. You're taking some text and doing some hacking something. What about the HTML text? No, I think it's just text based. You can give it any code. It doesn't have to be HTML. You can give it C code, Swift code, whatever. You can just give it a bunch of text. I know, just generate something. It is. It's awesome. It's fun. This is the best thing about it.  That is, of course, game of life. But this probably might sound better with the loudspeakers. Let's try that. This last one is something that I built as a demo for showing off some stuff. And this is a couple of strong synthesis algorithms. So this is a famous algorithm for synthesizing string instruments. So there's a JavaScript version of it that somebody wrote for Web Audio. So use that. And sort of, it's supposed to work with, actually, I have one of these guys. It's supposed to work with another version of a Chaos. Sorry, this is a Korg Nanopad. It's supposed to use the plots. So that's why you see these circles. They're supposed to represent plots. Unfortunately, I don't have that version. I have a pad version. So I can't map it straight up. But if you have one of the plots, it works. You just plug it in. And it should just detect it and work automatically. But you can definitely talk OSC over Web sockets or anything. Because it doesn't matter at that level. But with MIDI, there's this new sort of related standard to Web Audio called WebMiddy that lets you connect MIDI devices, physical hardware MIDI devices to a browser and communicate with them. So that's how this should work. I'll try to find another application later, maybe, and we can try to see if this works. But I'll trade this one first. So this is, again, completely synthesized. So it's a bunch of mathematical equations that generate this sound. And you get to change some things. So you can change things like, oh, this is, so I change this. Some parts, at some of these parameters, it doesn't get a bit wacky. But it works out. The cool thing here is that you can totally see, without my really crappy playing skills, this could be an instrument. You could totally play with this and you could even perform with this. So from a performance perspective, from a ability to create music perspective, it works.  But these are the kind of things you could do with Web Audio. So that's all I have. And I would now say, go make some noise. Can I suggest another thing, Sarah? With Web Audio, there's this Doppler effect from such a game, PlayMid, online. Yes. Do you remember the name of that? Daniel Raff with WD. How do you say? Daniel Raff with WD. And Doppler? Doppler, Doppler. At least that's a super cool application. Yeah, this is really weird. This is totally not meant to be a musical application, but it was super cool. So it's supposed to let you detect hand movement by emitting some audio from your laptop and then seeing the reflection of that in the microphone.  So it's supposed to... Let's see if it works. I don't know. I remember he had like a... Yeah, you have to click that. Yeah. Oh. Yeah, I need to use my loudspeaker, right? It doesn't work, it fits. It decreases a little bit because it's heavy, but we're still out here. So we can see the 20 kilohertz that no one hears on the right. Right. And you can see the Doppler effect on the right and the left of the Zoom version. And then... So if you could try just to go forward. I'm sorry. Forward. That's it? Yeah. Just go forward in the way. I don't know where my... I don't know where my... Oh, that's probably where it is. Yeah. Go, go, go, go. Go straight. I don't know where my loudspeaker is. It's probably here. It's here. Yeah. Yeah, yeah. Okay. So you can do it nicely, you can see the gap. Oh. You've got the right effect on the left and the rest. And you can play like there I mean... Is there one here? Yeah. So if she can't do it... Oh yeah. Okay. I better stop this. Can I stop? Can you give it to the voice? It doesn't work yet. Maybe this is better with... Total virtuoso. Okay.  Anyway. You want to play with any of the stuff that I mentioned or the links to any of that. You can go to my website. This slide should be already there. And you can go through it and just look at any of the links and play with any of the things. If you have any more questions about Web Audio you can ask me now or if we don't have time now we can ask me anytime later or you can tweet at me or whatever. I really love Web Audio and in general all things audio. So always willing to have a chat about anything cool that you want to try to do or you're playing with. Thanks. Any questions? Just want to add that download link for all the stuff I showed is in the comment section. What was it? Again? The... Do you remember that? It's... It's not with us anymore. No, no, no. It's... Comments or... I don't... I don't really... Oh yeah, there you go. I got it. Yeah, it was fun. All right. If there's... Yeah, questions. Questions otherwise we can... If anybody wants to make any announcements or talk about anything that they're doing. So all the stuff that you and Jay talked about how does it tie into something like what Bambura does that trying to identify a piece of genres in music and trying to find out what someone's going to like and what someone's going to like? It's similar in certain scenarios. So one of the things I very briefly covered was this analysis part of Web Audio. So there's a... There's a... It's a very... So the whole part of Web Audio, it's real time, right? Like the entire idea is this is for making sound. But a lot of the analysis stuff that you can do in Web Audio or you can do with just simple code, you can sort of expand to do much higher level and analysis of what kind of music it is, what kind of genre it is. Because you can run these algorithms that look at entire songs and say, okay, this song is in this scale or look at these hundred songs and sort of get a vague idea of what genre they're in or you can do stuff like machine learning. It's similar concept where you actually open up an audio file, look at individual samples, sort of process them together, do some mathematics on them, find some sort of descriptors of them. So you can do things like Fourier transforms and spec... Find spectrums, find substrums and all these mathematical operations to get analytic metrics on them and then feed them to machine learning is probably what I'm guessing what Pandora does to guess what a genre of a song is. So I think it's a step...  Sir, roughly speaking on machine learning context you say you use these kind of algorithms to generate the independent variables and you absorb the dependent variable from somewhere else and try it out. So there's already like this tons of research that's being done in this... They generally call it data mining for audio so they generally try to find some useful data from a bunch of audio files either with using tags, meta tags or by doing audio analysis and then sort of feed that into machine learning kind of stuff. And there's a graph in the beginning where you show the browsers. Yes. Like, so the implementations are different in that there were boxes that were green and boxes that were red but like there are still differences between the objectives but in a different way. Yes, so the way the web stuff works actually is W3C which is the governing body that just creates the spec of our web in general creates a spec. So it says you should have... If you want to be compliant with Web Audio API you should have audio buffer source nodes and you should be able to do this. Exactly how they do it is different per browser. There are some really, really tiny differences with respect to how you code things but most of the time it shouldn't bother you. So it is much... It's apparently... So this is the only spec that I've actually followed. Apparently, spec work in browser is super like aggressive and flame wars. There's like tons of fights everywhere. And like this is most of the stuff I'm not going to do this.  I'm not going to do what they did and all this kind of stuff. Thankfully, Web Audio is like some of the nicest things that everybody sort of works together, agrees. Most implementations are not trying to... Like most browsers are not trying to fight each other. They're trying to work together. In fact, many times it's share code. So it works really well across browsers. So I've rarely had problems with browsers not doing things that they're supposed to. Yeah? Magenta, was it? Magenta? Yeah. Magenta is a project magenta, I think. Yeah, they're trying to get their machine learning stuff to analyze and learn about audio and music. Analyze this popular song with 150 songs and create some new interesting music. I think it can work. I think it will work. The interesting thing though would be to define what is... I'm guessing if you use popular songs, it probably could work. But musical things is such a subjective thing. It's going to be really hard to get something that many people like. So I'm not sure if it could work. I'm pretty sure somebody has tried this. I'm pretty sure somebody has tried this. They have to, because they Google released the machine learned images, right? Yeah. So it's just really not that bad. You have known about it? No, they've tried it a couple of times. But in this particular genre, this is marketing more than just... I don't know. It's... Once you get into this world, you start seeing how varied the term music can be. And it's amazing. I would be very surprised to think and predict that with registered backers. Yeah. Reason being that if you look at... If you listen to all the songs from a given band, many of them sound exactly the same, right? You listen to the cars. Almost all their songs sound the same. But then we have like two minutes. Why are those hits? It's so much more than marketing and so many other things that are involved. If you're saying that if you analyze all this and then make a song, and the question is whether it will be a hit, I think it's probably not going to be a hit. If you create a song that has the talent, it will be likable. Yeah. Possibly. Maybe with some reasonable degree of accuracy. Yeah. But that's probably the best you could aim for, I'm guessing, I'm not sure. Maybe you can invite a next marketer and get him to share the formula. Yeah. That could be. Well, maybe like try to get his formula in a code in the library. Open source it. Solid in it. All music will be open sourced. I know. Anybody has any announcements or any projects or anything that you want to share that you want to... It's not something I do, but I'm... She has something in front of me. Do you need a website or something? Can you go into no paper? She's looking for no paper. It's not something I did, but I think it's pretty cool that it might be funny for some reason. Is this? No. Yeah, can you open one of the spectrum we see there? This one? Yeah, maybe the second is simple. So that's enough. You can visualize with your smartphone. It's free. You can visualize the spectrum and you just place it. Nice. And the idea is super simple. It's just a kind of piano partition if you think about it. Each of the lines is like if you were playing a note on your piano. So you could create it with a web-board. You would have just a few oscillators. Every time... So maybe if you take a slice and you say, I need to generate a tune at this and this and this and so on. Maybe some of you can do it. I would love the music. How do you create this though? Is there a... It's a normal spectrum. No, but it's... So basically you have... I looked at the specifications. There's eight octaves, so 12 semitones per octave, 96 oscillators. So you can't generate from an audio file, right? You just generate it from an oscillator and your web-board. No, no, but how do you create that? Oh yeah, you can create that. So everything is on the website? Okay, this one place that are you? Yeah, exactly. That sounds like a very weird website. I'm going to try this. If something weird happens, it's all Cedric's fault. Yeah, no, I played with it on Linux. I think it was on some Mac, but let me handle it. Cool. It's probably not that hard to do. But look, there's iOS and Android in it. Yeah. Yeah, I think it's easy to do on web-board, you know. Yeah, it should be quite straightforward. So you just take the picture, you just take a slice and generate the sound at each of the frequencies that you have. That's pretty cool, so you can even put it back down. And if you put it down, you can also disform the thing. Oh, nice. You can see the weird chips. So it doesn't care about that. It just takes a slice. Okay, so this is what it is. Yeah, yeah, yeah. Oh. So many. Do you want to do it? Yeah. Let's do it. Let's do it. All right. Well, it involves some, yeah. We need some image recognition. You need some image people. Yeah. I know you can find them. Where we can find them. Let's do it. Anybody else? Any projects, any ideas, any things that you want to share? Also, any feedbacks for SUP, for what the meetup was? Please, I'm just saying it in behalf of you, but please let it know. So we can change the format and, you know, it's too deep, too shallow. What do you want to talk about? What do you want to hear about? I think it's nice to have an open community where we can all figure out what we are all interested in together and have people share about it. And if anybody wants to share something, I guess, for the next meetup, let SUP know as well. Yeah. So we have it every month. So. Come on, friend. I think it's a good one. Come on, friend. Anyway, if you want to try this, we're going to try the meetup thing that Navi was talking about. So one of the things that is really difficult for meetup managers is to find speakers every month. And like those of you who don't know me, I also run the iOS meetup in Singapore. And I've been running it for the last four or five years, I think. So if no speaker kind of comes up, I was the one who was speaking all the time. And it's not kind of really scalable, but I learned a lot of things while speaking. And I love, you know, it gives me visibility in the community as well. But I can't really do that for music tech because I don't have the right kind of skill set for music tech in general. But those of you who are interested to share in next meetup, just feel free to come up. It's kind of a really nice place to kind of know who are the people in the music tech in Singapore and what you guys are really doing. And I think there is another event that is happening this week at Google on Thursday, if I'm not wrong. So it is by like the band lab setting something. You know the URLs? I have shared it on Facebook page. So yeah, just go and check it out if you're free on. Share your search for your Facebook page? Or was it? I sent you a message. Oh, did I? Oh, did you? Okay. But yeah, the way it is going to work is I'm planning to have it on the third Monday of every month. So unless, you know, it's a holiday. If it is a holiday, we'll have it the week after. Oh, yeah, this one. Yeah, yeah, yeah. So it's like sound lab one, not really a band lab. So it's more of an album launch. I'll put this on the meetup.com page as well. So if you guys can just check it out. Okay. Yeah. Yeah. I'll show some things. So this is short. Yeah. Hey, this way. Okay. I have a last thing. Maybe you would like it. This one is a shameless, like... You okay with your mic? Yeah. I should be able... So it's basically, I used to be a DJ. So I like scratching finals. And I also now I'm an electronic engineer. So I've been trying to make them put together. So I basically made a little Arduino system. Arduino is a tiny microcontroller, tiny electronic circuit that you can program with C or C++. And I made something that allows you to scratch using just a microcontroller and a half mouse. Basically. So that was in a... In a residency in a fab lab. Sorry, I should have an account. What? You don't have an account? I do, I don't have an account. Just not luck. Basically we were kind of challenged to recycle most of what we used. The artist plays with this kind of boxes that you can see all over. And he makes big sculptures. Some of them are... You don't even see that it's using this kind of wood. Like this one, whatever. But this one, I didn't prepare anything. I just play whatever. So this one is a rotating object. It's kind of an ancestor of cinema. So you have mirrors and little sculptures. And when you make it rotate fast, it looks like it's animated. It's called praxisoscope. And we sonified it. So we called it praxisono... Whatever. I don't even remember. Praxisonoscope. Yeah, this one. Praxisonoscope. So basically we used inside of the mouse. There's like the old school mouse with the balls. The ball is connected to some kind of system that we can see here. And it's rotating with little teeth. And there's an optical sensor that can count the tooth when they are rotating. So you know in which direction you go because there's actually two sensors. And it's quadrature encoding, whatever. So we reconstructed this little disc with teeth inside. And we just laser kept a much bigger one in paper. Placed it on wood to make it a bit more solid. And we placed it underneath a wheel of bicycle. So this is the sensor that we extracted from the mouse. It's just a hot core cutting. So we can see it from the inside. So it's looking like that and the teeth are counted like that. And that's how we did the mirror thing. And so this is the first kind of working test. There is this library called Mozi, like a mosquito. A Mozi ZZi eye for Arduino that allows you to generate sound. It's quite simple if you are familiar with C and audio processing. All the code is also available here if you're interested. Basically, we get the data from the sensor in an Arduino. And the data that is measured, I'll graph it here. And I just apply a very simple smooth filter. So the dirty data here is the original measurement from the sensor. And then I just smooth it. And I use this sensor measurement, which is basically the rotation speed. I use this to control the speed and the direction of playback of a sound. When the speed is constant, you have something flagged and this is the direction. That's it. So if you're interested in hacking some kind of things like that, everything is on GitHub. It's documented here. Oh, just come and talk to me. Very interesting. It was very fun and what do you say about your experience with RPR? It's a Linux machine. So it's as good as any other Linux machine. But is it slow or no? It's fine. This is something I remember a long time ago when I first started doing audio stuff, people would ask me, do you work with hardware? Do you do crazy new sound processing cards these days with things that we have in our pocket? You can do really, really fast audio processing without using much processor power. So you don't really need much power to do most of the audio processing. If you're doing some really crazy stuff, yes. You will need a little bit of beefier computer. But most of the time it's fine. Any other announcements, guys? I started a company last year designing noise-canceling headphones. I would love some input from some audio file or something like that. So you're the talk? Yeah, you're the talk. Talk on how cancelation works. Okay. Not today. Like a longer one? Yeah. Like basics of cancellation again? Yeah. And then? Yeah. That's fine. You have one talk. Yeah, so the other thing about talks is only that I've learned while organizing meetups is if you want to learn about something, volunteer to give a talk about that topic. And guaranteed in a month you would have forced yourself to learn about yourself. If you're interested in something, you want to learn, you want to try out something, it can be really simple, so it doesn't have to be really complicated. Don't worry, just come up, volunteer to give a talk, and by the end of the month you'll be pretty good. Thanks, guys. Thanks for coming. This is the end of the meetup, but feel free to hang out and talk to each other. Thank you.


Here we're going to start our day. We're here at Orilla, Ontario. In Orilla, Ontario. Just got the brain fired up. She's idling there, ready to go. Did the pre-trip. Did the pre-trip on my truck, too. We're all ready to go. We're in my new hat, and I took the cardboard out this time. That was embarrassing a little bit last week. I go through the editing, editing the footage, and I'm like, what is in my hat? I go in, get my hat, look in there. I left the cardboard in there all day. Didn't even realize it. Just like yesterday on my hat, I left the sticker underneath there. I don't know why I do this. What do I not look at the hat before I put it on my head? That's dangerous. I could be putting bad hats on my head saying bad messages or something. Anyways, I'm tired and I just had breakfast. I got a good sleep. I'm happy with it. So, let's go deliver our freight. We have two deliveries today, and then we go to Guelph, Ontario, where we're going to add a little bit more onto the trailer, and then we're headed towards Newfoundland. But we got stops in Ontario, Quebec, and Nova Scotia on the way. Oh yeah, after this Jeep, after this Jeep. Nope, now those guys are coming around there. Okay, nobody wants to wait for the truck. I understand. I understand. It's a suggestion. They'll tell you it's just a suggestion for most people. It is law. Like I'm not actually serious. It is the law, but it's not really one that's enforced that heavily. Unfortunately, Ontario spends most of their tax dollars into harassing truckers. They give us a hard time, which is good, whatever. They want to make sure that we have safe trucks to operate, right? I understand. Not complaining about that aspect of it.  A lot of the time. Not all of them. But especially around the Toronto area, it's very common to see the average speed of the four-wheeler to be around 130 to 140, which is about 80 miles now. Down traffic. He was going super slow, probably like 75-80 in the fast lane, right? And so when I finally got up beside him, he has both hands off the steering wheel, texting and driving, and I'm in a truck so I can see down and in. He's looking straight down at his lap with no hands on the wheel. I see this very off, and this isn't anything special. The reason I'm telling you about this one is it's kind of funny. I pulled up beside him, and I sat there for maybe five, ten seconds, looking over. If he would stop, he wouldn't stop. So what I did was I laid on the air horn, right beside him. We dropped his phone, grabbed the steering wheel, and they're staring straight at him with a stern base. No laughing. I laughed about it afterwards. I was shaking my head a little bit. You know what I'm doing? That disapproval, shake of the head. You know what he did? He gives me the finger, picks his phone up off the floor while he's driving from under his feet and goes right back at it. Takes his hands off the wheel and is texting with two hands, driving with his knee, right beside me. He just flips me off like it said. He had no hands on the wheel. He wasn't even one hand at texting it. He was giving her two fingers, like writing a book. It couldn't wait five, ten minutes? Now I can see this out of the corner of my eye. I'm not even looking at him. That's how obvious these people are about it. This person's good. He's got the passenger texting for him, or her. Nice to meet you, W. Here comes a nice Sierra beside us here on the left. He's good. Here comes a sailorado texting and driving with two hands. No hands on the wheel and that pickup on the left right there. He's not even driving his truck. He's not even steering it. Two hands on his phone. Now the whole point of that there wasn't to rat people out or to point at them and say, hey, you're doing it wrong. Oh yeah, it was actually to say, hey, you're doing it wrong. But we all make mistakes. You know, none of us are perfect. We're all guilty of something. Oh, that truck up there is cutting. Ah, that was close. Why do you need to cut people off, driver? You're supposed to be professional. Anyways, the whole point of that segment there was just to show you how common it is for people to text while they're driving. And it's funny how quickly those phones disappear as soon as you see a Mark's police vehicle. We are at the fifth wheel truck stop here. I just did a live periscope with everybody. If you guys would like to be included in those live periscopes, you're all welcome. You go to download the periscope app and you can hang out with me in real time. Right now we're going to go through the blue beacon truck wash here, get the truck wash, get the engine washed off and yeah, we'll take it from there. Have you guys seen this periscope app yet? Periscope? This is where I live chat with you guys. So far, I've got 162 followers and 20,000 hearts. It's sort of connected to Twitter, I think. I think anyone can use it called Periscope. You saw how it was spelled there, right? Let me get this periscope and a whole pile of people on here. This takes vlogging sort of to a new level. It's not really vlogging, it's like a live hangout where I can live stream to you guys right on your phone or on your computer and the first several people into the chat, if you're fast enough, gets to actually chat with me. You can type little messages and I can respond to you. We can do question and answer and stuff like that. And it's sort of like a live thing that we can do. So I've been doing it a few times today or they just trying it out and I think I really like it and I'm going to do more of it. So if you guys want a little sneak peek maybe at where I'm at or I just want to see me in live time I guess, me and the dogs. If you have this periscope app, you can easily find it in the app store. I have it on Android here. So it works just fine and it's free. It's free to use. Yeah. And you just look for me. See my, my name is Trucker Josh 456 just above the 20,000 there. You type that into there. You'll see this profile picture. And we maybe bump that up past 162 a little bit.  A lot of other YouTubers are doing it right now. So I figured I'd give it a shot and see how it goes. It's a, it's another new little way to connect with you guys in real time. So pretty cool. So I am in Guelph, Ontario right now waiting for my load. I got to wait till tomorrow morning for my load. So I'm just sitting around getting some videos uploaded there and whatnot. And I'm going to get this video done, put together, uploaded, and then I can sit back and maybe relax, have an evening to watch some TV or something. That's what I'm looking forward to. So I just got off the phone with all of you guys who were on Periscope with me. I did a live Periscope show thing. I don't know if the show is really a hangout or a talk and you can type messages and stuff. And it was fun. It was fun. We're on there for an hour. I didn't realize I was talking for an hour and you guys actually stayed and watched me for an hour. Wow, you got anything better to do with yours? So thanks for everyone who showed up hung out there. That was fun. I'm going to do more of those. I don't know how much data that uses yet though. So I got to do some experimentation and see how much people texted me in my vlog. See how much data it actually uses to Periscope you. Maybe it'll be a thing I only do at home. It'd be a little treat for when I'm at home because then I can use the Wi-Fi, right? We'll see. This phone is out of control. And now that's the Periscope app logo. You saw it in the last clip. Super duper guys. So short vlog today. Hope you liked it. If you did, hit the thumbs up if you haven't already. Follow me on Periscope. If you guys are into that kind of idea, you guys don't have to but if you're into it, you want to hang out and be involved in the live chats and stuff like real time. It's Periscope and you just look up Trucker Josh 456. All one word. No spaces. You can find me, add me. And whenever I go live, your phone will go tiling or something like that. And it'll tell you that, hey, Trucker Josh is online. You want to go hang out with him. And if you have time and if you want to, you can get in on the conversation. Only the first several people can comment. So if it says broadcast to full, that just means you're too late. You were too slow getting in. Sorry. Got to be quicker next time. But I'm going to try doing that. Like I said, I'm going to do some experimenting with the data. See how much data it actually takes to broadcast to you guys. I might have to use wifi. We'll see. Thanks for joining me today, guys. I'll see you tomorrow. Don't forget down below in the description. Like me on Facebook. Like me on Twitter. Follow me on Twitter. Like whatever it's called. Fail. I'm just going to leave that in there for you guys because I'm tired and I want to edit this out. Like and follow down below. Links. I'll see you tomorrow after 4 a.m. Right here.


at least have some start on the direction there that, you know, we'll be able to take a look at that now. Okay. Also, the community needs to improve its global and regional outreach and provide more resources to those global and regional areas. You know, a lot of what we do is focused in North America and Europe, and we really need to focus a lot more on reaching out to other areas. There was also feedback that the DA should set higher standards for Drupal events, specifically non-Drupal con events. People feel that some of the smaller events don't really live up to the standard that the Drupal name should have. Community matters should escalate to groups, not individuals. I think there are some incidents that have happened recently that were resolved by, you know, what people seem, what seemed like individuals, and people thought that those should have been escalated more to a group and should not have culminated in being decided by an individual. We need better community onboarding and documentation. I think this also goes to the, you know, documenting governance. Like, people come into the Drupal community and there isn't really one place to go to find out, you know, sort of how does the mechanism of, you know, the people of Drupal, like, how does this work? Who are the people? What is, you know, here's the CWG, here's the DA, here's how everything works and how it all works together and who's who and what's what? And, oh. Technical and community, right? And we should engage with other communities to discover their governance best policies. You know, there's a lot of other communities that are not so dissimilar to us out there and they're surely working on the same thing. So it would be of us to go and talk to them and see what they're doing and what works and what doesn't. So what has happened so far? So Drees has stepped down as the Drupal Association Board Chair and we've hired Adam Goodman. Drupal Association has hired a community liaison, Rachel Lawson. The Drupal Association has created a new code of conduct for DrupalCon that is enforced by staff. Representatives of different groups in existing governance met at the DA Board Retreat. Before DrupalCon to discuss the challenges and to discuss challenges and opportunities, I believe that was on Sunday. Drees has developed and published and alpha released the principles and values for Drupal on Drupal.org and he talked about that on Tuesday morning. And he published a blog post. Oh, and he published a blog post. I haven't seen that yet. Drees will be holding a governance round table on Thursday. I know several of us will be attending that. Next steps. Does anyone else wanna take this? So we are really, the key messaging here is we are actually trying to figure out what the next steps are. I think we hopefully would like feedback to hear if we were successful in soliciting feedback from the community. I'd love to hear that as part of the discussion, part of this, but the community at large really needs to review these values and principles that Drees did to help steer some of these next steps. We want to know about that or iterate on those, provide feedback directly on those. One of the key next steps that we've identified is we have to find a more streamlined and continuous routine way to get feedback from the community. This needs to keep going. And someone needs to listen and process that and make sure the community is heard. This is really, I think the key part of what the next steps in the governance process is moving forward. And one example of a possible next step could be creating a dedicated community governance group to provide that, which still needs to be defined if that happens. I want to stress though that this is led by us collectively. Major work in progress. And I hope everyone in this room finds an opportunity to participate and help us all work through this. I think that's how these things become successful. Now's the fun part. We wanted to use the rest of the time to actually hold a retrospective, a true retrospective, where all of you get the chance to share thoughts and feedback that we are going to capture. And it could be on anything. If you would like, I would especially love to know if you felt that the Slack meetings that were held were good, any other feedback about other things that have occurred, governance related, anything that you would like to see happen, or anything at all. So the floor is yours. Here's a microphone. Please, please come up. Don't be shy. Hey, Mark. Hey, Adam. So in terms of retrospective, like feedback on how this process has gone, I feel like a lot of the feedback that has been given during the governance process has been extraordinarily watered down. For example, we had 13 discussions in Slack. I would say a third to a half of the participants in there were people who were regularly involved in the diversity inclusion work group. We had lots and lots and lots of discussions about how any governance and values should be centered around the importance of creating an inclusive space that is there for centering around, making sure that Drupal has a strong diversity of people from marginalized groups. That was like at the heart of the discussion. When the report was written up, the words diversity and inclusion were literally not even used in a pretty long report of like what the points were in the discussion. It wasn't even mentioned. And that was extraordinarily frustrating to see that happen. And it's just been frustrating that, I mean, that's not, you said it's a recent thing, but it's like not six to nine, it was last summer that we had these discussions. And so it's felt like that happened. And then it got really quiet after that. And then there was another, you know, more governance things, like we gave a bunch of feedback and it's just frustrating that there hasn't been more progress on those things that we've discussed. Finally, there's a value statement from Drees. But again, like it has very little mention of diversity and inclusion given the prominence of that in the discussion about things. And so, I don't know. I guess I just, I'd like to see, I mean, there's certain things that are only gonna happen at a certain pace. This comes from the top down. And I guess I hope that Drees puts attention on this going forward because it's hard for things to happen when there isn't another power base outside of that. So anyways, that's my thought so far. So I wanna completely agree with you, even as someone who is on this volunteer team, I was kind of brought in to look at the principal's document about two weeks before it was released. And I did notice that we do have a principal in there that says we treat everyone with dignity and respect. And within the description of that, there was something that was alluding to diversity and inclusion. And I was really frustrated and I was like, this should be a little bit more explicit. And I tried to push for it and I don't think that it quite happened. And I'm constantly told like, this document has to address a lot of needs.  And so I feel like so many things are being attempted to do all at once in this one document. And maybe this wasn't one of the priorities, which is really, really sad and unfortunate. And I and you and other people in this room that agree with us should definitely push this alpha and say, this needs to be more explicit. And coming for me, like just one specific thing, like it says we do not support intolerance of any kind. I would love for it to say, we do not support Islamophobia of any kind in any format. Because that for me is like a word that then I can point to and say, someone did something to me specifically Islamophobic. It's in the government, you can't do this here. And for me, that's one thing that makes me feel safe here. And if that's not there and it's so lukewarm and watered down, like how do I feel safe then? And that's something I'm gonna push the alpha on. Unfortunately we couldn't get it in the first draft of it, but I'm glad that we're able to have this conversation and sort of point it out. And I'm glad that it's now collaborative and it's not someone working in a vacuum on this document anymore. So totally agree with you and feel like everyone in this room who agrees with us collectively has to push for that, for that to happen because these volunteers can't make that happen on their own. And if each one of us says, hey, that says nothing about diversity and inclusion, I support that, I need that there.  And then someone at the top will be like, oh, that is a priority for the community. Maybe it was on the last on our list or something, which it probably isn't, but it's possible it wasn't at the top. And I just wanted to speak to what you said about, this took so long. We were frustrated to you. We've been constantly asking for updates and really not hearing anything back. And we didn't even know that Teresa was just working on this alone in a vacuum. I think we had thought it was going to be a much more collaborative process since we'd brought all of this to him and we didn't know that he had just drafted it. Like Fatima said, a few people got invited to work on it and we just found out like, oh, there's going to be a values and principles statement. And we went back and looked at all of the suggestions we had and a lot of them really didn't make it in there. And that was pretty frustrating to us in addition to the very long wait with no, we were just like, where did all this work go that we did? And it was kind of frustrating. So we're hoping that, going forward that we can, like we said, we're hoping to have like a person who is dedicated to like being the information, the person who gets information back and forth as well as making this much more collaborative. I wanted to say one small thing too. I did read your comment on the blog post from our findings when we aggregated the takeaways, they were recorded at the end of each meeting procedurally and we literally copied and pasted most of what content was there. I think that we did ask for feedback on Slack at the end if the takeaways were not representative of what the feedback we were hearing. We probably needed to be more explicit about that because it is something that I think a lot of us are, we care about. So I think we made a mistake with that. But I hope we move forward with that as a priority. Yeah, so a couple points. I mean, I think to that one about, about D&I not being explicitly represented in the takeaways, I think it's almost kind of a situation where D&I was sort of this theme that was woven throughout most of the conversation but it rarely came up at its own distinct point. And yeah, I mean just by the way, we captured the feedback that wasn't reflected. That's not an excuse. No, not at all. That's a, it's a, it's a. If we could improve that, I would love to hear that. This is a, this is something to better next time. Yeah. Let's just say it was a mistake. You know, so, you know, as far as the values go, I agree that, you know, that there's a lot of improvement that can be made. I think, you know, Dries did spend, I know that he did spend a lot of time working on these. And I, you know, he followed his own process, which, you know, is not necessarily the process that maybe was the, was the one that was best for getting community feedback in this situation. But regardless, we are at the point now where, yes, we all need to be weighing in and providing feedback. There are open issues specifically regarding the, the language around diversity and inclusion, which I was looking at last night and, and I agree is, is, is messy and unclear right now. I know personally, just speaking as a person, that Dries cares deeply about diversity and inclusion, that he, it is a priority for him. And I think where he struggled was with how to best articulate it. And, but we can all help him with that, and we all need to. So the issues are open and, you know, let's go in and provide him with as much help as we can. Hi, Sally. I don't feel like he's very accessible to most of us to do that. And I know he's very busy, but like how, I mean, like we can tell George stuff and George released it to Dries, but it was only like in that document he released with the principles where it was like something we could have, I don't know, a day and a half where we actually got to interact with him directly. Right, so this is a significant problem because he's not accessible to us and we were the ones doing this. Right. Right. This is the number one thing that. I mean, he's not even here, so I like, I don't even know what we're gonna achieve like with this. So when I found out about the principles document, I sent an email and I was like see seeing everyone who had done work on this and I was like, we're about to go and have a community conversation about what we did and we have no idea what you're working on. No idea what's happened. Can we get an update? And then all of a sudden we get an update with like, oh, there's like this invite only thing on Sunday with the DA board and then there's a thing on Thursday, it's a round table. We're also releasing the principles document and it was so late in the game that for me it was very frustrating because it was like, hey, I did work. I asked community members to give me feedback. I took valuable contributions and time from community members and then I didn't follow up and that makes me look like a terrible person but it's not really my fault either because the person who's supposed to follow up with me didn't follow up. So there was like a total lack of communication across the board. I don't think that we've solved that yet and I think it would be a good idea to get that, to get a solution for that in place so that this doesn't keep happening because as Adam said, like this should be a continuous process and how do we keep it continuous and how do we keep our leadership talking to us when they assign us to do this kind of work. That is incredibly good feedback and is precisely where we are right now. Thank you. Do you have more? Well, I mean, how should I show the camera? Please. Yeah, I don't know. This is a six-pix camera. This is being recorded. Yeah, this is being recorded. I can, do you want me to? Will that make people more? Yeah, it should be done, I think. I unplugged. Okay. I was told that the wire needed to be plugged into the machine for it to be recording. Okay. Recording, do you know what I'm saying? I just come down and figure out why it's not recording. We'll talk to the master. Let's go. Do it, do it. Do not talk to the master. Do you know what I'm saying? The security camera, okay. You're taking the fall for this one. You can just stop. I didn't make a comment on the answer. So I do take issue with just one thing that the bottom of the set, but the idea of we're.


Item number SCP-1583 Object Class Keter Special Containment Procedures All instances of SCP-1583 are to be held in individual pressurized containment units, located within Joint Containment Area 8. Each chamber is to be separated by a distance of 0.5 km, and no instance of SCP-1583 should be brought closer than this distance. All chambers are fitted with hydraulic pistons preventing the SCP-1583 instances' lids from opening. All instances of SCP-1583 must be held down with at least 14 MPA of pressure at all times. In the event that a containment breach event occurs within the area, the pressure being placed upon the contained SCP-1583 instances must increase by 60% for each confirmed breach. The Global Occult Coalition Group of Interests will report any movement or activity from the containment areas they administrate to contain SCP-1583 instances. If the possibility arises to seize an instance from one of these locations, it should be acted upon immediately. Currently, the Foundation and GOC have contained 61 instances of SCP-1583. The area around former Site-57 is to be bombarded by intense heat in order to prevent the spread of SCP-1583 entities. A facility built around it has been staffed by Foundation personnel, who are to communicate with GOC personnel on means of destroying the SCP-1583 entity. Description SCP-1583 designates a collection of metallic barrels designed for use in supplying fallout shelters. The exteriors contain the information originally printed on them, in addition to this notice. Departments from Department of Defense This device can be used in your shelter or other places of refuge to protect yourselves and your families from the horror of nuclear warfare. Simply enter your family into the shelter of choice and open your container. Safety will follow. You will be protected and comforted with your family bit by bit, held safely until every other seeker of comfort is too. When we come out, rebuilding a burned world together, blood and stone, flesh to wood, sweat and concrete, build in your image. When opened, instances of SCP-1583 will release thin, white thread-like organisms which will bind together in order to form a large appendage. SCP-1583 will attempt to seize living subjects and bring them within its mass. Following this, the thread-like portions of its mass will disassemble the subject's body. Outer epidermis will be destroyed within 14 seconds of contact, followed by muscles and utter tissue. The subject's skeletal structure will slowly dissolve over a period of 2-3 hours. There is no observed limit to the quantity of this mass SCP-1583 is capable of releasing, but containment breaches in ██, reaching almost 600 meters above the instance. The organism is capable of opening SCP-1583 on its own, if there is nothing preventing it from exiting on the other side. These entities are possible to destroy through application of extreme heat, but if additional instances of SCP-1583 breach containment, or if containment by other organizations fails, the energy required to neutralize SCP-1583 entities increases. In addition, the mass and speed of emergence has increased over time, currently being at 200 kilograms of matter every 15 seconds. Four instances of SCP-1583 have been destroyed by the Foundation since initial containment. If an instance of SCP-1583 is opened, the pressure exerted by the organism within all other SCP-1583 instances will increase by 60%, requiring additional pressure to prevent containment breaches. This new increase in force will be permanent, and no way of reducing or removing it has been found. The destruction of emergent SCP-1583 entities has been found to have no effect on the new forces produced by other instances of SCP-1583. SCP-1583 was recovered on September 19, 1989, after an SCP-1583 entity breached from an instance stored within the ██████████████████████████ campus. Foundation agents were able to destroy the emergent entities, and contain 20 instances of SCP-1583. During this time, SCP-1583 was classified as Euclid and contained within Site-57. However, approximately six months into containment, an uncontained instance was apparently breached, causing the destruction of Site-57. SCP-1583 reclassified as Keeter. On November 15, 1999, Foundation assets were able to confirm that the GOC possessed instances of SCP-1583. The GOC is believed to have breached one instance in a 1990 destruction attempt, which caused the initial Foundation reclassification. GOC personnel were contacted, and the current joint containment procedures were negotiated. Addendum Following the destruction of Site-57, Foundation and GOC research personnel were able to observe SCP-1583 entities interacting with one another and the area around them. Following the destruction, buildings and other structures were reconstructed from the entity's mass. Several buildings which have been torn down or destroyed in the past 50 years were remade, such as the original barracks, greenhouse, and recreation areas. In addition, portions of the area covered by SCP-1583 entities were constructed to appear from the towns of ██████ and ████████████. Three percent of all research personnel formerly stationed within Site-57 originated from these areas. Humanoid entities have also manifested bearing resemblance to these subjects. They display limited memory of their past lives, generally having idealistic or incorrect memories of the subject's past. In addition, entities may not match any individual's subject, but a mixture of several whom were known to be friends or family members. These entities retained SCP-1583's properties and should not be approached by Foundation personnel.


Good afternoon, everybody. And since we've been recorded, good time of the day to all the online viewers. My name is Andre. And today I'm presenting with my teammate Greg. We are a part of the JPC security team. And we both work for Google. Definitely a bunch of really nice presentations today before hours. So it's tough to speak, especially. Definitely, I think the presentations with dinosaurs was really, really amazing. So today it's just an opportunity for us to present the latest progress to you, to the JPC community. And definitely thank you all for submitting GitHub issues and a separate shout out for reporting vulnerabilities. It's really important for us. And this is how we progress. Also today I noticed that security itself, I think it was mentioned in pretty much all the decks with different flavors. So it's definitely a very important topic nowadays. Also very excited that there are even international participants in the conference. And before we start, just a few words about the format. So again, since we are presenting together, we have two sections. We will try to split it like 10 minutes. Since we are a little bit late, I see people are still coming and leave like five minutes for questions at the end or both of us. Simultaneously, like Kevin and Abishek mentioned, we are around during the day, so feel free to reach out to us when we are in the lobby. We'll be happy to chat with you and answer any questions you might have. OK, so today we'll be talking about advanced functionality of JPC security. What's new there? So first of all, about the ideology of the team. What we are trying to achieve, what our design principles are. First one is secure by default. And second is advanced configuration and extensibility. So again, if I try to piggyback a dinosaur presentation, the first one is just buying a bag of dinosaurs. So you grab something out of the box and you want to play with it. You want to test it. You want to check if things are working as expected. And it should have some meaningful default features. That's what we mean by secure by default. Talking about advanced configuration, while I was checking different issues on GitHub and questions on JPCIO, there are all different use cases where JPC is used. And one really caught my attention. A person was asking about JPC running on GoPro camera. So definitely we cannot cover all the potential use cases like that. But the idea is that we provide flexibility for advanced users to implement the functionality they needed. So we're still adding features to Advanced API, which is experimental across languages. And really experimental here means it is already quite stable, but we still want to add a few more features before officially stabilizing it. And the latest features we're going to discuss today. They're like audit logging and the CRL. Once we add all the features and the Advanced API stabilizes, we make it public and stable. And again, definitely we are welcoming all the community feedback if you have some features in your mind. And our current interfaces do not allow to implement that. Please reach out to us. Please raise issues on GitHub. We definitely cannot promise that we'll be able to work on all of that. Like it was mentioned before, there's always competition for resources. So upvoting also makes no sense. It helps us to understand that, yes, this feature, this request is needed by community. So talking about audit logging, why we are doing that. A few words about modern security environment. And again, environment is designing things. First of all, if you're listening to the speaker who was from VMware talking about zero trust security and zero trust architecture, then you are familiar with this stuff. But anyway, I'll just do some kind of refresher. So zero trust architecture is a term by NIST. There is a publication. You can easily Google that. So literally the idea is that it's a set of cybersecurity paradigms that smooth defenses from natural based, from static based things to focus on users and resources. So access to resources is determined by dynamic policies and not by protected perimeter and stuff like that. The other idea there is trust is never granted implicitly. And we must be continually evaluating what the authenticated user is trying to access. Do. In, again, in a lot of decks today, it was two features were mentioned, MTLS and OWZ, talking about AAA. So what exactly AAA is, it's authentication authorization and accounting. Literally it's who is making the request. If that person is a workload is allowed to do this kind of action. And the last A is tracking. So even if it's a successful event and that person is allowed to do things, we still want to check this thing. So audit logging is the third A. So right now, after the 157 release, JRPC has all the AAAs. And this is a really nice feature because now we are covering all the A's. Talking about use cases for audit logging, again, it's up to you what features you need. But we can think about the following potential use cases. For example, if you already have a policy and dynamically it was changed, it's a very good idea if audit team requires that to list some traits. Literally. So for example, you have a policy with few roles and another policy became active with different set of roles by enabling audit logging. You can leave a trace in a different standard outlogger or other parts of the system. And it can be presented to audit team that, hey, definitely a new policy is active right now. Simultaneously, there might be admin users to execute the privilege requests. I didn't know for example, imagine the situation when a person works for a booking system and they can cancel the bookings. It is an action, but leaving such trace, it is also very helpful. Outside of action, imagine the situation when you have a policy and everything is going fine, but you started to see a lot of denials. Definitely, it's a sign that something might be wrong and it might be, again, a notification for further investigation. And another potential use case kind of enforcement of use it or lose it type of things.  You keep monitoring the policy and you realize that, hey, the following paths, the following roles were not active for the last month or three months or whatever you might have in your work. That's, again, another sign that it's a potentially good idea to revelate such roles and policies. Quick refresher about JRPC authorization. Again, here we are talking about Proxeles. So this engine is built-in in JRPC. Built-in engine, definitely very fast. What you currently see on the screen, it's a kind of dummy file because real format is JSON or XDS, and I omitted some of the things for simplicity, but here we are talking about dummy book service. So it's read information about books and built-in information. And this file, actually, it protects built-in action. You need here a special role, special speed ID, just to be able to execute this delete action. Talking about audit logging, high-level design overview. So first of all, it's extension for authorization policy. It's a new section under the same file. It happens. It's getting executed after authorization decision is already made. And JRPC team, we provide some out-of-the-box loggers. Right now, there is a standard out-logger implemented and already available. So it's a very simple one. What it does, it prints the login statements, which I cover later, to standard output. There are more examples of that under testing section, so I encourage you to take a look. It shows you how to implement things and how to register the things and definitely how to test them. If you want to do that, again, as a power user, you can implement pretty much every logic and definitely beware. Because, for example, if you implement this interface and you start getting authorization decisions, nothing can stop you from starting storing this data in remote databases. We, as JRPC team, we do not have any control. And imagine the performance in that situation. You got JRPC server, very performant. And simultaneously during the flow, you try to store information in external remote database. Even pink might be like a second or whatsoever. So definitely it's a very powerful mechanism and just be careful with that. What metadata you got, let me just go to the next slide. So what you see here is metadata available for you. What is available is definitely full method name. Again, here I'm covering our dummy bookstore service. Also have a principle, so who made the request. Policy name, it might be, for example, a file. Here we have my bookstore file. Match to rule, so which exact rule the request matched and authorization decision. So, for example, in this scenario, it is false because a user, a regular user, cannot delete a book. Now, the last slide, how to do a very simple hello world, how to enable the things. Again, I'm just amitting a good chance of a policy file, but you see at the end there is a new section named audit logging options. And under that, we have audit condition on deny. The thing to keep in mind that deny here is actually outcome. So it's outcome based. Both allow rules and both deny rules, they can produce denial, for example. And the last few lines about the audit logger, you see there is a name, standard out logger. It's, again, pre-built logger, which is available. And definitely it's already registered. So if you just add these few lines of codes, you can, again, run some requests. And this is a simple outcome you might see. Again, there is another JSON wrapper around that, but the metadata, this is a good sample of metadata you are going to see. Again, this is a built-in logger. If you would like to implement something on your own, this would be very, very similar. And again, I encourage you to take a look at the testing examples. And you will even see how it's possible to combine multiple loggers in one. Thank you, Greg. Everybody, my name's Gregory. And I'm here to just talk a little bit about what we've been doing with the certificate revocation lists. So to kind of discuss CRLs, first we have to all get on the same page about public key infrastructure or PKI. This is a very deep topic, and I'm just going to really scratch the surface. But I just want to make sure we all are kind of on the same page. So to use an example that a lot of us probably do every day, you go to your favorite website on your browser, google.com. And then Google will present you a certificate. And your browser knows how to take that certificate and verify that this google.com is actually truly the google.com that you want to connect to, and not somebody spoofing that information. That certificate comes from somebody called the certificate authority that they're responsible for issuing certificates.  So that certificate authority can also issue certificate revocation lists saying, hey, I did issue this certificate, but now you don't want to use it anymore, it's not good. Variety of reasons may be a private key leak. It's just a good thing to be able to do. And RSC 5280 defines the X509 standard for certificates and certificate revocation lists if you really want to dive deep into that standard for internet BKI. Thinking more about GRPC, it's not like a human on a browser connecting to a website, but more service to services. A lot of times wanting to do mutual authentication with each other. And in this case, your organization, whoever you're running GRPC for, probably has a team that's in charge of and is your certificate authority. They're creating certificates, certificate revocation lists, distributing them all over your fleet. And often, they're kind of on the disk of the servers that maybe your microservices are running on. So that's what CRLs are. So hopefully you understand why we want to be able to support them in GRPC. So the current support is very tightly coupled to OpenSSL. And it's not the best. So it uses this function called X509 lookapaster. And this sets a very specific requirement on a directory and how the files in that directory are formatted to be able to read CRLs. So that means that now your PKI has to be dependent on something that GRPC is doing, which we don't like. We don't want to force you to do something with your PKI. And there's zero flexibility for you to do other things. Another issue with it, because it's kind of based in OpenSSL, languages like GRPC Go that implement their own stack, they don't use OpenSSL, we've had to re-implement this behavior. And that just leads to tiny inconsistencies in security. And that's also just kind of annoying for everybody that's trying to use it. And this is kind of what it looks like. I hope that y'all can read that highlight. You just create your channel credentials options, and you can set a CRL directory. And then as you pass these channel credentials through to your channel, you create the channel, you make connections. And during the handshake, it will use the credentials in this directory. So what we're trying to do better is follow the design principles that Andre talked about. We want to make a CRL provider interface that is flexible and over-rideable and is easy to use, but also has the flexibility for you if you want different behaviors. It's also really nice. We already have credentials and credential providers, so it's a really nice semantic consistency in the API. If you see credential providers and you're implementing something with that, you probably also want to implement something with CRL providers. And on the third point that Andre talked about, we're trying to provide these kind of batteries included good default implementations that we hope will cover many use cases that are very common. So for example, there we have things like static, which is give us a CRL string and we'll make sure we use it. And then periodic reloading of directories. So it's very common to be distributing these things as a server runs and being able to have your GRPC server not have to restart to read in new CRL files that get distributed to your machine is definitely a pro. You don't want to have to restart your server whenever you distribute new credentials and CRLs. So I decided to use some pseudo-ish go code for this example. But this is what you can expect it to look like. It's not currently in the code base yet, but it should be quite soon. But it's very simple.  So on the back end of this interface, you can implement whatever you want to store and get CRLs and then just return them through this interface. And then it kind of cascades through the options the same way that the other option did, where you have your options. And then you'll set this provider. And now when this server goes to do a handshake and verify a certificate during a handshake, it'll go ask this provider, give me a CRL so that I can verify the certificate. So that's pretty much all I have on certificate revocation. And we're back for Q&A session. If you have any questions for any of this topic, we'll be happy to answer. Cool. Any questions, anyone? So the autosy policies that you have shown are specifically on the SPIFI. The autosy policy that you have shown, the principles are specifically on the SPIFI IDs, which are from the certificates as you. Is there a reason why we did not use regular username password? So regular users with username password types of authentication cannot go through the autosy policies? So that's a, oh, OK, thank you for the question. So it's a slightly different idea in general, because on the policy side, the user or the workload is already authenticated. So it actually doesn't really know the SPIFI or how exactly it will obtain the username password or anything like that. It just enables for you to create a set of rules. And you just know exactly your infrastructure, how user or workload is authenticated. Hi. I have a question on audit logging. So in the audit logs, we have a full method name, right? But what if our allow or deny decision based on, or can it be based on the internals of the RPC message? So it's, for example, if only some subset of books we can delete or not, like by book ID or some book category. So something that is not in the full method name. Yeah, that's a good question. So it is not about audit logging itself, but it's about how authorization engine itself works. So right now, as far as I remember, there are very different types of matchers. And yes, it is quite powerful. For example, you even can rely on different headers and so on and so on. So definitely encourage you to check the JFC for authorization engine itself. It is also open source and released. And you can find all the different details and mechanisms there. And again, since audit logger is an extension, it just takes the decision itself. Wonderful. Oh, one more question. Well, the CRL provider, I would like to ask, how often is the provider pulled? Because getting the CRL could be a time consuming procedure. So if it's pulled for every incoming request, does that mean there are some cash and mechanism required on the provider implementation, something like that? Right. So every time you're doing a handshake and you want to verify certificates, you're going to want to get CRL. So the idea is that, yeah, you'd have it stored in memory definitely on the provider. So when this function gets called, it can just return something very, very quickly in memory. Because it's kind of on the critical path of making a connection. It's during the handshake. So you would not want to make a network call out to fetch a CRL every time you called this. You'd want to have something that loaded it asynchronously and return it from memory. Yeah, so just to clarify, what you mean is that part of responsibility is for the CRL provider. It's not in service. Right. OK, thank you.


Going on everybody. This is dynasty five box case break number 17 Two random players each in this dynasty case remember any cut autographs and all other cards not listed We'll go to this spot whoever gets that spot right there so we're gonna roll the dice go seven times on both lists and I did have a little break credit giveaway at the end of this break if We filled it up tonight, which we did so I'll do that at the end So 84 got it So once again seven times two Three four Five six seventh and final time Seven times we got Mary Lou down to Brian people's And I'm not gonna name all 84 names of course once I do the players, but I will go through it kind of slowly After I go through it once one To there's a combo in there too a couple combos, maybe To make it even 84 Seven times Seven Wow, look at that Mike trout on the top down to low Rizzo All right, so I'm gonna go through it one time and then I'll alphabetize it by everyone's name and go very Very slower, I can't share it in the chat anymore because I guess Google took that option away, so Shame on Google. So there's Aaron Pettit. There's Brian people's There is Dan G There is Daniel P. There's Darren There's David E. There's David s There's Dustin C. There's Jason Sorry There's Jason had the card to keep him highlighted. That's actually John's so there you go Jason Altuve down to Martinez John Carlos Stallone key boom down to Acunia with the cut autograph spot in there as well Could be a monster Kevin Mary Lou Matt Stone Matthew V Richard s Riley C Ron L Rory TJ Leonard TJ poyer will burn and Zach So we're gonna pause the video see if there's any trading live in the chat kind of late here But we'll see if not we'll pause it come back in a split second if you're watching on recording All right, no trades no really chatter for any trade. So good luck everybody We got a full sealed case here of dynasty baseball only five hits so kind of a Risky break, but I appreciate everyone giving it a shot if you do get a hit probably be very pleased I think all cards number to ten or less So this is a nice one and at the end of the break since we did fill it up tonight I'm gonna randomize $100 to all 42 names and we'll see who Who wins a hundred bucks at the end Just since we filled it up tonight Wow southern Hills awarded the 2030 PJ championship breaking news Ten years from now. We'll be saying remember Breaking dynasty we heard that news Any guesses B any guesses did Rex say earlier a Bryce Harper? Seven of ten Bryce Harper I Think he called the one-on-one though. You should have just said Bryce Harper Rex I would have maybe given you some bright credit Bryce Harper is Richard s very nice seven of ten But maybe I'll do a little guessing game the last box Ten my nice seven is three even Whoa, sorry Everyone I saw it I Was paying attention to the chat five of five Pudge Yvonne Rodriguez nice patch in there Little Pudge action who got Yvonne Rodriguez Dustin Kali got that one three of five Walker Bueller look at that patch. Is that from the 1958 Dodger Stadium patch? Wow Walker Ranger Bueller Dustin Kali also got that one Sick patch in there. All right final box So there you go a little guessing game in the chat for this box right here not this box, but that box Can't guess the same player someone else has guessed and you only get one guess So that's for ten dollars All right Fourth box and that'll be for this box. We're guessing not this one nine of ten Louis Severino For the Yankees Little Severino Who Got that that's the Schwerber and Louis Severino dual combo spot match stone Nice one Matt. All right guessing window closed Joe was the last one guess Chris Hale He's wears batting gloves confirmed So it looks like he's a batter It's four or five He's holding a bat K e s Keston Hiora nice patch in there from a helmet or something Four or five rookie patch number to five auto. I thought it was Ken Griffey for a minute, too But Keston is also a pretty nice one Nice out rookie patch auto That's for Dan G Nice one Dan Gets the Keston so there you go. That was the break. Thanks everybody for getting in We are randomizing $100 in break credit since we sold this out tonight. That was my little promo So we're gonna take all 42 names and name on top is gonna win $100 Thanks everybody. I know that was kind of a hit or miss break, but congrats all the winners eight times name on top gets it after eight three four five six Seven eighth and final time Aaron Pettit. There you go. Don't think I called your name. So there you go Aaron low hundred dollar break credit heading your way. Thanks buddy. Appreciate it. Congrats all the winners