Hello my friend and friends. The other day on this CSS subreddit I saw this question come up where someone was asking why a child element with a height as a percentage wasn't working when the min height of the parent was set to 100 vh and this got me thinking about all the times I've seen this question come up from people asking me in my dms to on my discord server and just in general it's something that I seem to be answering all the time so I thought why not talk about it in a video since it seems to be so common and then also going forward I don't have to re-explain myself I can just link to this video so it's a little bit selfish but hopefully it helps you out as well so let's dive into this and we're gonna do that by diving into this little demo that I've made right here I have where we have this very sad height as a percentage that is sad because he's not working and so for this one let's let's move on over to here and you can see I well I have my section it has a hero class and then I have my h1 and then let's go over to here and I have a min height of 75 vh and then I have a height of 50 percent that's clearly not working and I'm doing this on an h1 this can be a div or a section or whatever it doesn't matter really what it is it just matters that this is a direct child and it's not working now let's take this and go to height 75 and all of a sudden it does work well why does that work but this doesn't work that's really frustrating right and min height is definitely the safer option if you're going to set a height on something usually I recommend min height but then of course this this sort of breaks and that can be you know why is this happening so the reason this is happening is let's figure out why this is working if I do a height of 75 vh well this height is 50 percent of this number that makes sense right what if I take this off though what if we don't have a height well and you know what let's come in here let's actually take off this dark blue just so we don't even see that and you can see that my hero area is right here and it's it's it has a height to it well let's come in here and actually take this h1 out and there's no content well now there's actually my hero is still there but there's no height to it because there's no content inside of it and let's just come here and grab a couple of paragraphs that I can copy there and paste into here and now we have more height and that's happening because the height of an element is defined by default by the content that's inside of it and that also can be changed based on the screen size which is usually why we want a min height right so if I open my dev tools here in responsive mode uh and just in case you don't know the responsive mode in chrome is this little guy right here and it's pretty easy it's very similar in firefox um as well and as you know as the content has less horizontal space we need more vertical space and everything just adjusts and that's really good and that's one of the reasons we often don't want a height of 75 because if I do a height of 75 at one point I can end up getting overflow so that we fix that by saying a min height and then we know that it's going to work at all the different screen sizes where even as we get to these smaller screen sizes we can see that it's not overflowing my hero is just growing in space but that's the reason that min height is actually a problem we need this height has to be defined and that's the reason everything jumped there when I did the height is just because this is now 50 but this number here is working if this has a set height if the browser knows how big this is then this can work if I do not have a height on something then this h1 is part of what's defining the height of this element but if this is defining the height of this element but this element is then defining this one because this is a percentage that creates a loop right so this is defining the height of this which is defining the height of this which is defining the height of this and it would crash your browser so instead you know browsers are smart and they don't want to crash whenever there's a little bit of bad code so in this case what's happening is the browser is going well 50% of an undefined number is nothing so I'm not going to actually do anything with this because right now I have an undefined height if I have a defined height it can work because this will never change it's always 75 vh the browser can calculate that if I have a min height of 75 vh though that can change right we saw that when I shrunk this down at one point that teal background is growing and shrinking so we have a defined height sometimes which isn't good enough for the height to work here so we cannot have a min height and then a height defined in a percentage there is one exception to this and it's if you bring grid into it but it gets kind of weird and it just introduces a lot of potential for overflow um and it would actually sort of muck things up if I tried doing it right now because with grid this 50% would be based on the cell that it's inside of and no longer based on the parent so if it's the only element anyway it gets kind of weird and I've seen a lot of problems using that as a potential solution to fix this so I'm not even really going to get into it right now but the main thing is if I know this is 75 vh you know we can just do that divide by two so it's what 37.5 vh I can do that math myself so if that's the case and you really need that now of course this isn't a height now maybe you'd even want that to also be a min height just to prevent any issues from coming up so if you have a set number here you could just set a min height on that element or a height on that element taking sort of the percentage that you'd want to take that's sort of the simple fix and in general a lot of the time I feel like we don't really need heights anyway but this is just like if you really need to have it um you could do it that way or if you wanted to you set it all up with custom properties and this could be a calc that's this divided by two I find that's just over complicating things for the most part though but if you really really really need to do it maybe this is the best solution um though I'm not in love with it and I'd probably just try not to have a height defined on whatever it is I'm putting in there and I just use some padding and let things do what they need to do and another thing that I often see people doing actually that's related I guess a little bit with height is with widths and where people are declaring widths like width 100 percent or width 100 vw when it's actually more problematic than a good thing and you know it's just best often there also not to declare a width unless you really need to have one for a very specific reason and if you'd like to know why that is I have a very short video that might be of interest to you that you can see right here and with that I would like to thank my enablers of awesome who are web on demand Andrew Michael Simon Tim and Johnny as well as all my other patrons for their monthly support and of course until next time don't forget to make your corner of the internet just a little bit more awesome


My name is Kyle Brown. I'm an engineer at Singlestore. And today I'm going to talk to you about package transparency and WebAssembly registries. To do a brief overview of the talk structure, we're going to begin by explaining what WebAssembly, commonly abbreviated as WASM, even is. Then we're going to step back and ask the question, what is a package registry, and what's kind of package registry that WebAssembly needs? I want to propose a simple, if maybe somewhat surprising answer. Then we're going to talk about applying some ideas from certificate transparency to package registries, talk about package transparency itself, this term created by combining the two, and WARG, a protocol implementing it, and wrap up by showing how the properties of package transparency help us mitigate different kinds of attacks. So jumping in to WebAssembly, what is WebAssembly? Well, the simplest way that we can really explain it is that WebAssembly is a platform agnostic compile target. Or in other words, it's something that you compile programs to. You could write it by hand, but you're not likely to write a lot of by hand for the same reason you don't write a lot of machine code by hand. It's not very ergonomic, and it's very low level. Instead, at the moment, you're likely to create WebAssembly by compiling well-supported languages like Rust and C++ to WASM. And these got support earlier than a lot of other languages because they do their own memory management. They're very low level. You don't have to bring along an interpreter. They're the simpler side of the problem of building WebAssembly modules. With that said, work is in progress for a variety of other languages. And we are working on solving the interpreter problem.  For a little bit of history, WASM was a web technology. It was created in the web. That's why it's called WebAssembly, after all. And it became a W3C standard in 2019. Even before then, back to 2017, it was supported in all the major browsers. So it's been out there for a few years now. Despite being a web technology, being something that came from the web is supported in the browsers. It isn't just a web technology. It's not just for the web. It has these other, these valuable properties that were created for the web that everybody else kinda wants to, believe it or not. The portability that it needed to run in all the major browsers on a wide variety of systems is useful no matter where you're trying to deploy your applications. Portability's great. It needed to be fast to run in the web. We expect, for example, out of a web page, really low latencies, them to load quickly. Really, we should hope expect that more. And so as a result, WASM has a really low startup latency. In fact, you can actually start compiling WASM before you've even finished downloading it all using streaming compilation. It's gonna do code generation validation sequentially. It's also capable of near native performance. Think within about 20 to 30% of native. So there's a wide variety of applications that are capable of running in this kind of environment that maybe you wouldn't wanna run in, per se, JavaScript. On the security side, to run the browser, it needed to, you know, it couldn't have ambient authority to the entire user's permissions, right? These needed to be sandboxed in some way. And so WASM does that by being capability safe, which you can just think of as, you know, web assembly modules can only do the things they've been given permission to do.  And additionally, they have sandboxing. Each WASM's linear memory is independent from any other ones and a web assembly module can't call out and access a linear memory that it hasn't been given. And so for all these different reasons, you could sort of imagine why people would wanna use web assembly outside the browser. The company I work for, Single Store, uses web assembly for database extensibility. We let, you know, customers compile their code to web assembly and run it in process in the database as a user defined function. Companies like Cosmonic are using it to create distributed application systems. Fastly is using it for edge computing. Fermin is using it for service run times and platforms. Shopify is using it for plugins and extensibility. And Microsoft, in addition to the Blazor project which is about running web assembly in the browser .NET style, also supports running WASM modules in its Azure Kubernetes service. All six of these companies and many others are part of the Byte Code Alliance, a non-profit foundation working on implementations of these open standards to help mature and advance the ecosystem. And the sort of web assembly that we're all creating that's gonna run outside the browser needs to be composed, shared, and deployed in a bunch of different environments. And to do that, we really need a package registry. We really need somewhere to publish your WASMs and to pull them down. That's something that you can interact with at build time as you're compiling and also maybe at deploy time. And when we're creating this registry, we really want it to be as secure as web assembly itself. If web assembly has these really nice isolated properties and capability safety but you deploy it insecurely, then you sort of lose all the advantages. You wouldn't want to secure a vault with a Cheeto, per se. So stepping back, we said that web assembly needs a package registry. What is a package registry? What's this thing that web assembly needs at a more sort of abstract level? The main role of package registry sort of in the kind of package registry we're talking about, because there's diverse kinds of registries out there. Really, its main job is to delegate names. Like, you're now the owner of LeftPad. I've given you permission over LeftPad to package owners who then use that permission to publish releases that are versioned of those packages. So put a different way. A registry is really just an index. It's a mapping from the name and version of a package to what's there, to the digest of the package contents.  So fundamentally, this kind of registry that's this mapping of names and versions to contents has to own the meditative packages. It has to be the sort of authoritative place where that info lives. You can establish the mapping between things and their contents. But fundamentally, it doesn't actually have to be the thing that does the content storing. Well, you can actually store the content in a self-hosted location that's with the registry. You could also defer to a CDN using existing OCI registry or any sort of third-party content mirror to deliver the content. And since you already know what hash you're expecting, you can validate that you got the right thing no matter where you chose to try to get it from. And so now, in building a secure registry for WebAssembly that is an index that solves the problem that we need to solve, we can't always have any ideas about applying certificate transparency concepts to package registries. So the rough analogy, and bear with me a little bit, is that with certificate transparency, people are able to detect when CAs miss issue certificates, right? Whether it's accidentally or maliciously, you can tell that something was done incorrectly, that something was done wrong. And with registries, it wouldn't be kind of nice if clients could detect when registries accept invalid package updates. So for example, if somebody else tries to publish an update to your package, a new release, but they're not the actual owners of that package. They're not the ones who are supposed to be controlling that name. So package transparency does this. It applies some tools and ideas from certificate transparency to package registries to give us these properties. Package transparency, as defined by Landmark who coined the term in our project, is publishing cryptographically verifiable commitments to the state of a package registry, and bear with me on this part, to allow auditing of the actions of package authors and the registry itself over time. That's been a mouthful, we're gonna break into three parts. The first of which is publicly available registry state. Everybody needs to be able to download and access the fundamental data of the registry. And we need the registry to make cryptographically verifiable commitments to that state and that data. That then allows us to audit it, both in various different ways. So this definition came up with what we're trying to do, and we've created a protocol that is an implementation of these ideas. Warg, it stands for WebAssembly Registry, sort of is the idea, is this implementation of package transparency. And it implements these three different steps we're just talking about and we're gonna try to burn through explaining them. The first part of it needs to have publicly available state. People need to be able to download information about what the registry knew about it at different points in time. And it does that by representing every package as an append-only log of signed records. They all begin with an initial record, and that record says who the original owner of that package is. And if a registry accepts this record, that means that it's saying that you now own this new package. Every subsequent record contains the hash of the one before it. That's what that right-to-left arrow is, and can do things that affect the state of the package, like creating releases, but also granting the permission to do releases and to manage authorization. Now that Bob sort of has been given the ability to do a release, he subsequently can do that. He can append records to the log and submit them to the registry. And when they're accepted, these releases now exist and they're part of the state of this package. Since it's an append-only log, you might think, well, I can't get rid of those releases somehow. I can't delete records from it. It's immutable, it's append-only. So the answer to how you would delete something is that you mark it as a yanked, right? There's a second kind of record that you can append to this that says, pretend that didn't exist. If you've still got it, you still know the hash, that's fine, but for most clients in discoverability and things, treat that as having been deleted.  And that then is the publicly available state of the registry, the records that make up the logs for each package. Now we need to make cryptographically verifiable commitments to these data. And we're gonna start by somehow making the registry commit to what's happened in the past, like which records are part of its accepted history and in what order they happened. And we do this by taking a data structure from certificate transparency that maybe some of you would be familiar with called a verifiable log that's based on that of a Merkle tree. And so it's sort of the abstract data type of a verifiable log. What do we get out of it? Is that a verifiable log provides a total ordering, describes the state of any given point with a unique checkpoint, and we can verify if a record is in the log by comparing the record and the checkpoint. That's what we're gonna get out of it. And here's how we're gonna do it. There's a sequence of records and unlike the other kind of log we had here, they don't have the hash of the previous one. They're all independent records and they all have their own independent hash that we can compute. And if we wanna know what the representative checkpoint is for this whole log, we can hash together these leaves of a tree to form branches and then the root of that tree in a particular way. And as we add more records to this log, what we find is that the root hash that represents it changes. And sometimes that root hash is a subtree of the future but sometimes it's not. And it has to do with whether or not the length is even a power of two, but we'll show later on that that's not an issue, that's just part of how it works. And so since every single leaf contributed to the value at the top, we can show that a given value is in the root by reconstructing the root from the leaf. And we do that simply by hashing together values with their siblings to get higher and higher nodes in the tree until we get to the top. And if that matches what we were expecting, we've shown it's been included. There's also something called consistency proof. You're gonna want to generally know that this log of the state of the registry only fast forwards, that the history doesn't get changed. And you do that by showing that the new state is consistent with the old state, right? That only six and seven have been added and changed. And you do that essentially just by showing that all the stuff that used to be in the log is included. We don't need an inclusion proof for zero through five individually, we just need inclusion proofs that show that their parent branches are and that you can recompute root six from them. So what does the registry claim has happened? And the answer to that is the sequence of values that are in its verifiable log. And each of these records has both the record itself hash and the name of the package hashed into it. So you can tell that this is, A zero was put into A, right? It's been appended to the package A. But one thing clients can't efficiently do here is tell what the most up-to-date, the latest record is in each of these logs. They have to walk the entire verifiable log backwards and in the worst case, that's walking everything that ever happened if your package has not been updated in forever. So that's just entirely intractable to clients. So we need something that helps us solve this problem. And that tool is another thing from transparency called a verifiable map. And where the other thing was a log, this thing's a map. It's sort of that straightforward really. It's a key value mapping. It's also described by unique hash. We can also check that things are included in it. Those are sort of the fundamental things we want out of it. And unlike the other one where we had this sequence of records that built up a Merkle tree, we actually have sort of a Radix tree. And if some of you are familiar with Radix trees, you'll know that at each branch, you decide which child to go to based on part of the key, right? And so if we want to insert zero, zero, one into this tree, we go left then left then right so that we've walked in the tree to the correct position that corresponds to that key. Now in reality, this tree actually has a height that is directly equal to the number of bits in the hash. So it's quite large, but on screen, we can fit three levels, so that's what we do. And we've inserted X here, and what that means is that the hash that represents this leaf is the hash of X. We'll get to that later. And if we insert more things in the tree, we'll see it fills out that more things are present and that this tree is fundamentally sparse. It's not a full tree, it's a tree with only some values present. And we'll finally insert Z here at one, one, one. You can sort of see how this is working. And like the other one, we build the hash of the root incrementally from the bottom-ups that every leaf and key, every key and value in the leaf contributes to the root value. So we hash, in this case, all the leaves to get their value with a unique prefix. Then we can hash branches like the one, one branch over there and show that it combines the two values of its children. But we also have these branches out here that only have one sub-child, right? Only one sub-tree to the left or right. And in that case, we prevent collision attacks by modifying the prefix so there's a bit that indicates essentially which sub-tree is not present. In the top, both sub-trees are present, so it's the normal case of one, one. And together in that way, we've hashed up the information about a key value mapping. And just like in the same one, we can do an inclusion proof. We can check that one, one, zero was mapped to Y in this root. We can verify that in log-in hashes by simply reconstructing the root using those same hashes we were using before that constructed the root originally. So how do clients know what the latest record is? We have a verifiable map that associates every log ID, which is the hash of its name, with the most recent value in that log. In that way, people can verifiably say that was the latest thing the registry knew at that point in time. That's as far as I have to read up to. And these two-day structures get combined together into a single checkpoint, which sort of includes the hash of both, the hash of both, and a signature by the registry. And that is the state that we're committing to for the registry. And you note that this uniquely identifies the state of every package at one point in time. So if you ask the question, what was the latest version of foo for some checkpoint that has a single immutable answer throughout all of the future? And you can actually granularly update to new checkpoints and verify that everything stays sane as you do so. So it's quite a nice property. So our third part, if you remember, we had three parts. We had publicly available registry state. We just finished making cryptographic commitments to it. Now we need to audit it. And we audit it, well, from a few different people, but the first person that audits it is the clients. Clients are fundamentally resource constrained. Most clients don't have supercomputers running just because they want to download a package. That's sort of an insane view of it. Even small devices should be able to be clients. And they only really care about some things.  That'd be absurd. So what you only want to do is verify the relevant package state in that that package state is committed by the registry. That the registry is committed to that information. So you don't care about a slice. And you also want to know, of course, that the commitments are valid and correct. So at the beginning, a client knows nothing. Complete clean slate. And what they'll do is they'll download the logs for the packages they care about. In this case, it's all the packages in our fake registry, but you can imagine that there's many, many packages they don't care about. Then they're going to verify the package logs. And they're going to sort of sequentially process each one using that sort of logic we talked about earlier where if I grant someone a key, then they can do something. If I don't, then they can't. And releases have to, you can't release two things of the same version. There's rules that you sequentially validate on. For all the packages you care about. And in this case, we're processing this log that actually fails because for some reason this guy named Charlie is trying to publish a release, but he never got permission. So this log is going to fail validation. We can detect for sure that this was not supposed to happen. We'll continue in the success case where the logs are fine and show you what would happen next. But you could already have bailed at this point if you detected that. So the next thing you get is the checkpoints. In this case, sort of the word log and the word map represent that root hash of each structure for compactness. And you notice we don't have any of the other information about the log or map. We don't have any of the things that make them up. We don't need them yet. Until now, because now what we're going to do is actually download just enough information for those data structures, just the Merkle audit paths, the little sibling and uncle nodes required to verify exactly what we need very sparsely. And we can show here that the registry is committed to these things being the latest and that these things are part of its history. Clients will sort of also validate the signature on the checkpoint and say that this was actually committed to, claimed by the actual registry, not some random third party that made up a registry checkpoint. Now, oh yeah. In addition, one thing they can also do is if they already had a checkpoint, then for the log at least, they can ensure very quickly that it's a fast forward, that all the log records they previously knew about are still part of the registry. The one thing that they can't really do is verify that the log and map agree with each other, right? They can't easily check that there isn't some record in the log that's not represented in the map. That's newer than what they know about. So, who are clients going to call? Monitors, not mythbusters. But so the monitors are able to do this. They're long running processes. They only care about valid and cryptographic information in a stream, and so monitors are able to process all the checkpoints that ever were and make sure that they all agree with each other internally and across time. And so that's what the clients can't do. And because clients can talk to as many or as few monitors as they want, you can add security by simply standing up more monitors and sort of create a web of trust. Right, so revisiting our three parts of package transparency, we needed publicly available registry state that we got with a collection of package logs. We needed a cryptographically verifiable commitments that we got using signed log and map checkpoints. We needed auditing of package authors in the registry and we do that using a client and monitor sort of system. Once again, a kin to stick with transparency. So, we've done all of this. How does it hold up against attacks? Well, let's imagine that the registry gives you package data. You download package data, but it gives you a modified record in the past. How are you gonna know that they modified record in the past? The answer is that two things are gonna immediately stop being true. They'll stop validating correctly. The hash linkage from A2 backwards A1 will no longer work because A2 didn't contain the hash of this modified record. It contained the hash of actual A1, which is not what you have here. And additionally, the log inclusion proof here won't succeed because that checkpoint did not include this provably. What if a registry tries to hide something from you? Right, what if it tries to say, no, this thing didn't exist. Don't worry, there's not a security patch. You're fine, that version wasn't yanked. If it does that, then the linkage here from the map is gonna fail, right? The inclusion proof that says, no, A1 is the newest thing as of my checkpoint will fail because it wasn't, and it already committed to the fact that it wasn't. Now, you'll note, we already talked a little bit about the consistency of the log and map here, so the idea is that if the registry had created a map and log that didn't agree, where it did say A1 was the latest thing in the map, but it still already knew about A1 and its log, then the monitor's job is to catch that. At this point, those two things have already been proven to be consistent. And so then that's how you know that you're not getting indefinitely frozen, for example. So, to summarize sort of the broad points of the talk, Wasm is a promising way to make portable and secure software. Package registries, or at least the kind that we need, are really indexes of content that map name and version to what's actually there. Package transparency is this combination of stratific transparency and package concepts, and it helps us provide some really interesting defenses against different kinds of attacks. With that all said, I'd like to give a special thanks to a few people who helped review and advise this talk, like Land Martin and Luke Wagner, and thank some other contributors to the Warrick project like Bailey Hayes and Peter Hewn. Finally, my company, Single Store, for supporting Warrick by enabling me to work on this project, and that's all. So, Warrick itself is really about managing namespaces, and saying that this name is owned by these people, and this version is authoritatively that version that was claimed to be. If you want to claim something, the thing that you're probably interested in, and I think a lot of people want and are currently doing, and we really are interested as well, you wanna verify that the author of that content is someone in particular, and you'll actually do that inside the content in our case, because WebAssembly, for example, has an emerging proposal to actually include signatures in the Wasm Blob itself, and that component can contain a section with signatures in it, and a registry as a matter of policy could even require that your component has that section. Because that's sort of a separate question, once again, is like, this was actually made by Microsoft, Google, Fubar, whatever, is one question that it is actually the rightful version 1.0 of Fubar is a separate question. But you can trace back, right? Because the signatures in the log all are contiguous, right, and they sort of authorize subsequent signatures. So that's how you can know that the people you originally gave it to, gave it to people who originally gave it to whatever. And this is not that different from, in fact, this is much more verifiable than like NPM, for instance. If you wanna know the people that you gave permission to be left-pad on NPM, are actually the same people today, you currently here have way more than you ever had before. And if you want this thing about author verification, once again, that is just an aspect of content signature. That's a separate question that's handled separately. How do I know what the key of this registry is? So one thing in the current design, and this is something I didn't talk about in the talk because it's sort of a detail, there's actually not just logs for every package. There's actually also an extra log that's the operator's own log, where they can track their own key rotation. And that's actually, since it's part of this committed state, you can also actually track and verify changes to that key as well. And it has a bit of a strange circularity, but it's one that works out, we think. Yes. So the way we currently envisage monitors working is that monitors are gonna subscribe to a stream of registry data from the registries that they monitor, and they're gonna process it. And then clients actually, like the actual API client, you'll set, you'll pick your registry that you're using, and you'll actually pick a list of monitors that you trust. And when you do that then, whenever you pull down data, you're actually gonna ask that monitor, hey, do you know about and is this checkpoint safe? And so it's not that monitors tell clients things, clients ask monitors things. And so it goes in that direction. And we expect monitors to be able to process quickly enough that you can do this sort of nearly or essentially synchronously with the install process. And that monitors actually has another thing, are one of the defenses against indefinite freezes, because what a monitor can do is tell you, you say, hey, I just installed this checkpoint, right? This checkpoint, blah, blah, blah. You can say, whoa, that's like three months out of date, buddy, somebody is holding things back from you. But yeah, it goes from client to monitor is the direction of the interaction. All right, so because of the separation of namespace and content, we fully expect people will bring their own storage and to some extent their own registry systems. But when they wanna be part of the namespacing that we're creating for WebAssembly packages, when you say like, this is so-and-so's registry, so package name version is whatever, that they will probably choose to run that on top of their existing systems. And that we actually, the use cases for registries are really varied, because we start to see some general purpose good registries, at least some of them, potentially one run by the Byte Code Alliance, but maybe not, we'll see. We'll see, the registries are very expensive is the thing.  My company may run a registry at some point of database extensions. You also potentially have deployment registries inside your company that are the only place that you go to download things, that mirror content from other places. A lot of companies might run their own monitor, because monitors, once again, we expect to be relatively cheap, and as a result, you can have your own and then use another registry, but know that you're always monitoring it. So to see a bunch of different registries run on top of whatever people wanna run them on top of. Yes, at the moment, all of the actions that are taken on a package are doable only by the people who've been granted those permissions directly in the log itself, in log authorization. There is another tool actually as well that sort of adds on to that, where registries can unilaterally reject anything, actually. This is actually just a fundamental property of all of these systems. Anyway, you can always ignore or HTTP request you get, and more fundamentally here, you're able to just not include something in your log, so it didn't happen. And so one thing that we expect is that registries will use this in actually a good way for just policy. So one thing you can do is you can simply say, yeah, I'm not gonna allow you to release that thing that has no vulnerabilities. You as a registry operator can choose as a matter of policy that you only allow things that are signed, have no vulnerabilities, et cetera. And that's the thing that different registries will choose different answers to. One other thing that's sort of an interesting idea that we're currently thinking about is that a registry can actually, as a matter of policy, reject new package creation that doesn't give the registry operator some permission in the log. You can say, I'm only gonna let you have the name foobar if you give me the permission to yank stuff. And so it's all still in log, but in combination with this idea of operator policy through rejection, you can actually achieve some of these like higher level policy ideas about like giving yourself the ability to yank things. We're not entirely sure that there's some trade-offs there, especially around the size of these logs and the size of these data structures. So we're not sure. At the very least, this will give you a strongly identifiable way of talking about packages so that you can build tools like that on top of or interoperate with existing tools, which is maybe the best way for this to work. Yes? Yeah, how do you recover from like compromise of these keys? That's sort of a big question. One of the answers once again goes back to this idea about like initial package creation policy where you could say actually in order to, as a registry in order to create a package in my place, you have to give me the ability to actually reassign key permissions. And that's really scary sounding. The only thing that helps that sound a little less scary is that you can tell when they do it, right? So you can actually say like, I'm not actually gonna, I'm gonna, the log is fine, log is fine.  It's gonna halt the next poll or whatever. So that's sort of the best answer we have at the moment is that, you know, but it's some combination of operator policy, the direct ability to rotate keys, and there's the transparency of all this that you do have the ingredients to make an answer to this question. There's also potentially an ability to make a special kind of record that operators can always do that like takes over a package. And that would obviously be very like, you know, you wouldn't download past that point without a, so it's a reset of your trust in the package authors obviously. And you'd wanna know why they did it. But that has some interesting complexity actually because answering the question what operator keys were allowed to do that at some point in time requires you to correlate the operator log and the package log. So it's sort of like weird to have this special operator record type that has permissions that come from outside the package log. So at the moment it's all in log, you'd have to have built in when you created it the ability to do that, to recover, which is a little scary sounding. So existing registries may have a hard time using this. Maybe they won't, I'm not entirely sure because you have to go back and like rewrite your history as one of these histories and I don't know how tractable that is for most of them. But to some extent what we're saying here isn't really very walls and specific. The only thing that you really have to do with Warg to run some other type of content is to add a new content type and describe how you digest it, how you create your content digest for that type. And once you've done that, everything else is just a matter of policy, right? So no, you could use Warg for something else. It's not very WebAssembly specific but we came to it from the direction of WebAssembly and solving the needs that WebAssembly has for federated verifiable namespaces. But if everybody else also needs that there, welcome to come take a look. We're happy to work with anybody. Yes. Not at the moment. Warg is currently written in Rust but it's a protocol. It can be implemented in any different place. It has HTTP APIs, it has some protobuf that describes the layout of these records in the log, some abstract semantics for how these hashes are created but largely you could create in any language and we expect at some point that we will actually compile our Rust to WebAssembly and there's some really fun bootstrapping things that you get to do there actually. And another thing that has a lot of people excited about having sort of trying to be really thoughtful about supply chain security in WebAssembly is that you could have like the ultimate version of a build pack where you have like a WASI component that actually takes you from source code to actual artifact in very verifiable ways. Deterministically even because WASM can be run in a deterministic mode. So there's some exciting opportunities there for maybe something similar. To leverage compiling things to WASM is really how I got in that tangent. And yeah, and additionally if we can compile the core logic of the registry to WASM and you can run WASM in a lot of places it becomes a lot easier to interact with these things. There's some complex cryptographic things being used and we didn't rewrite SHA by any means, right? But there's still some the use, the security design, the use of those things is still complicated to do it correctly. And so the more people can leverage one shared open source and of course all of this is open source, maybe I didn't say that, but clearly this is all open source, the registry's out there, bytecode alliance, github.com slash bytecode alliance slash registry, warg.io if you want the short version of getting around to our stuff. And yeah, and if we can share an implementation of these things that compiles to WebAssembly and runs quickly, like why not use a singular or like at least a limited number of clients that we've audited really well. So I think it's about to be lunch. So I think we'll call it there. Thanks.


Well, this was a little bit unexpected. So obviously with Gamescom going on there's been some news coming out and not a lot of prevalent things for Nintendo per se, just a lot of little mini announcements of indie games and I might even start a video series soon once per week where I talk about new games announced for the Nintendo Switch this week. It's just something that I've been thinking about and it would also give me a chance to showcase some indie titles since most weeks indie games are what are announced and we obviously don't get copyrighted strikes for throwing for showing off indie games but Tabata one of the main people behind Final Fantasy 15 did a Twitch livestream and announced Final Fantasy 15 Pocket Edition which doesn't look anything like Final Fantasy 15 at all maybe it has the same story maybe some of the same monsters and people I don't know but it's it's a version of Final Fantasy 15 for mobile phones and once that was all done they were asked if they have any other announcements for Final Fantasy 15 and this is what they followed up with. I mean you asked the question of what other things that we got planned in the future we can't give you any complete solid details right at the moment but for our policy wise we very much do want to move out and do as much as we can with the game with the franchise so there's another certain console out there people may be thinking of sounds a little bit like you guys your name twitch I think we'll just leave it there. I mean there was there was a console which sounded a bit like Twitch. I mean everyone on the Final Fantasy 15 they love this specific console the sounds a lot like Twitch so you may want to think maybe about something about that in the future. Yeah they have a version of the game coming to a console that sounds like Twitch. Obviously they're talking about the Nintendo switch it's a pseudo confirmation that Final Fantasy 15 is coming to Nintendo switch at some point I don't know if it's coming this year I don't know if it's coming next year but it would mark the like the first time when what when was the last mainline Final Fantasy game even on a Nintendo platform I mean even on Nintendo console I mean they had crystal chronicles back on the GameCube but I mean it wasn't really as far back as the Super Nintendo days like like Final Fantasy 3 or Final Fantasy 4 5 6 oh man this is a long time ago and here we are at Final Fantasy 15 and it sounds like it's definitely coming to switch again I know it's a late port of a previously released video game and I understand the frustration some switch owners might have with the treatment of late ports but you need to get I'd rather get the latest Final Fantasy because that gives me hope for Final Fantasy 16 or any other Final Fantasy entities they release in the future it's kind of like Skyrim coming out if it does well it gives hope for future Bethesda games to come to Nintendo platforms and you know the same would be true for Rockstar let's say Rockstar release Grand Theft Auto 5 at some point if it does well that gives hope for future Rockstar games so that's kind of what I view this as is I'd rather have Final Fantasy 15 on the switch than not and late port or not it doesn't change the fact that Final Fantasy 15 is a pretty decent game I have only played a very little bit of it but I liked what I played it's probably the first Final Fantasy since Final Fantasy 12 that I actually liked and yes I know a lot of people don't like Fantasy 12 and I'm in some weird stratosphere in terms of my love for Final Fantasy 12 but yeah I am happy that Final Fantasy 15 appears to be coming to switch and I'm hoping that it does well does well enough for them to continue to support the system in the future me we're talking about Square Enix they have a lot of IPs and properties I would love to see them start bringing all their best games to switch and again this is just another feather in the switches hat that they are really starting to get the attention of third parties especially in Japan and hopefully they start to get more attention out West and EA and Bethesda and Rockstar and all the other various third-party Western Studios start to see a market for their games on switch because I truly think the market is there I really do anyways that's about all I have to say on this subject I know this is kind of a short video but until Final Fantasy 15 is in my hands I don't really have much more to say or until we know there's a release date or something or other either way I found this is a really interesting way to announce it almost as if Tabata wasn't supposed to announce the game but he did anyways because he just wanted to maybe Nintendo wanted to announce it in their own unique Nintendo way through Nintendo Direct I I don't know I assume I'm assuming the Final Fantasy 15 is going to be the full version of the game not them the pocket edition because there's no reason that the Switch has to get the pocket edition it could support the full version anyways folks I am Nathaniel Ruffles from Nintendo Prime if you like this video you know what to do and if you dislike the video hit that dislike button subscribe for more and hey folks I'll catch you in the next one


Namaskar, I'm Professor Devade Purkayastha from the Indian Institute of Technology, Bombay. Welcome to my course, Business Fundamental for Entrepreneurs, Part 1, Internal Operations. Today's module is about finance and accounting. But before I get into the course module itself, let's look at the discussion flow for the overall course. In the first week, I shared an overview of what's a business and what's company, what a company structures. And then I talked about the big picture of a company, vision, mission, goals, strategy, culture, etc. And then we went a little bit deeper into the company and talked about how companies innovate and create new products. And how do they launch and mass manufacture with the right quality those new products that they've innovated. Today we're going to another very important internal aspect of a company, which is how companies keep track of their finances. And going forward, as you can see on the screen, we'll talk about a couple of other aspects like leadership, managing human resources, and ESG. Coming to today's module, as always, there are six topics. There will be two reflection points where I'd encourage you to take a few minutes, reflect on what you have learned, and apply it yourselves based on some of the questions I will share. So six topics, two reflection points, and one online assignment. So let's start with what is the essence of accounting and finance. But before I get into more complicated concepts, let's start with a very, very simple example of what is accounting. Let's take the example of a cup of tea. Let's say I make a very good cup of tea, and I've invented this new cup of tea. That was my invention. And I've launched it in the market. So where does the finance part come in? Now let's say I sell one cup of tea at 100 rupees. Then 100 rupees is my sales or revenue. Now let's say to make that one cup of tea at 100 rupees, I buy milk, sugar, and tea for 80 rupees. So my cost is 80 rupees. My profit is 100 rupees sales minus 80 rupees cost, which is 20 rupees. So I've talked about sales, cost, profit. Now imagine if the milk, the tea, and the sugar cost not 80 rupees, but 120 rupees. Then I've sold for 100, but my cost is 120. So I have lost 20 rupees. So 100 rupees sales, 80 rupee costs, 20 rupee profits, or 120 rupee costs, 20 rupee loss. This is the first concept of accounting and a financial statement called the income statement. It's also called the profit and loss statement. Now let's look at one other aspect. Let's say I have bought 80 rupees of milk and sugar and tea in the morning and through the day I have sold 100 rupees. So I've made a profit, but the person who bought that cup of tea said, I will pay you after two days. So I've spent 80 rupees, that's my cost. I have sold the cup of tea at 100 rupees, I've made a profit of 20 rupees, but I've run out of cash because the person, my customer, is paying me after 20 days, after two days. So I'm what is called broke, or if a company goes broke, it's called a bankrupt company. And this is the concept of cash flow. I may make a profit, but if I don't have cash on hand, I'll go bankrupt. In this case, next day I cannot buy another 80 rupee worth of raw material, milk tea and sugar to make my tea and sell it for 100 because I don't have money. So I talked about the concept of an income statement or a profit and loss statement and I talked about the concept of a cash flow and how you can go broke even if you're making profits. Let's talk about a third dimension. Let's say I have brought 80 rupees worth of milk sugar and tea from a grocery shop, but because I don't have money in the morning, I have taken it on credit, so I've taken a loan. So if you look at the morning, what do I have? I have got 80 rupee worth of raw material and I've got a loan of 80 rupee to the grocery store. So I've got an asset, which is my raw material, but I also got a liability, which is the loan that I've taken from the grocery store. This is the concept of a balance sheet. So remember, there are three important concepts. The profit and loss or income statement, the cash flow and the balance sheet. All this is with a cup of tea. Now let's say I do very well and I keep expanding and expanding and I grow. Keeping track of one cup of tea is very easy. I can keep it mentally. But let's say after one year, I'm selling 10,000 cups of tea every day. I also have 10 flavors of tea. So I've got 10 types of tea and I'm selling 10,000 cups of tea. I also sell coffee and other 10 kinds of coffee and 10,000 cups. I also sell biscuits and some other kind of food. So suddenly it's much more complicated. I've got many products, many cups, lots of milk because for my tea, maybe I have to buy milk, sugar, tea in big bags, lots of money. I may also have to have flavors for the tea, coffee powder. For the biscuits, I have to buy some raw material, flour, etc. Suddenly it's become a complicated business. Now let's assume that I have now opened a store, a tea store or a tea restaurant. Now my asset is no longer just raw material, tea, sugar, milk, coffee powder, etc. I now have an asset, which is the chairs and tables in my restaurant. I may have invested in buying that restaurant. So I've got an asset which is like a room, like a restaurant. So I've got assets. I may have taken loans to buy those chairs and tables and the room itself. So suddenly I've become much more complicated as a business and that's one store. Now let's say I keep growing and I keep growing, like Starbucks or Chios or one of those big chains and I have 10,000 stores. So suddenly I have hundreds of products to sell, hundreds of raw material to buy, hundreds of assets to manage. So it's become complicated. And then I hire people and then I have to pay them salaries. I may have 100 people, 1,000 people. So suddenly this is what a business, a big business can look like. And those of you who are starting your own business will have to learn because otherwise if you don't learn finance, A, like a simple chaiwala with selling one cup of tea, I may not make profit. B, I may make profit, but run out of cash. C, I may have a lot of assets, but also have a lot of liabilities. And I may not be able to pay back. Again, I go broke. So if you are starting your own business, you have to understand the concepts of accounting and finance. So that was a preamble to the lecture itself because it can get very complicated and since this is a fundamental course, I'll not get deep down into the details of accounting and finance, but try and give you an overview. So let's get into the actual lectures. So what is accounting? By now you'd have probably understood that accounting is essentially the process of collecting, measuring, processing, storing and sharing financial and other related data. Financial data, sales data, cost data, assets, liabilities, overheads, etc. So that's accounting in its simplest form. Now, to account for that, for one cup of tea, the example that I gave, I can do it in my mind. But if you are doing 10,000 transactions every day or 100,000 transactions every day, you need to have a process. And therefore, you need documentation. In the early days, the documents were written notebooks. You could write it down and you could have your accounts in a notebook or a kata in India. As you grow and as computers came in, you could computerize it and you could automate it. And then financial software came in and you could use those software. So the first task is to record all those transactions. But then you have got hundreds and thousands of transactions. So they have to be summarized into simpler statements. And those are called financial statements. And then I'll talk about all of that in a minute. And why is it important? A, for the owners to keep track of the business, but also for the investors or the banks who lend you money to understand what is the actual value of the company? Is the company making profit or loss? Is it running out of cash or has enough cash? How strong is the balance sheet? So all of that is accounting. So let's look at the accounting process. The first step and the simple step is to record and collect all the source documents. And I'll talk about source documents in a minute. And the source document, believe me, for even a medium-sized company can be full of rooms, that source documents. And I'll talk about types of documents. It could fill up cabinets and rooms, sometimes warehouses, because there's so much of source document. Even if you today scan it and store it electronically. But then all of these have to be recorded either in a document form or in a software. So we've got different steps of documentation called journals, ledgers. And once you've done all of that, you have to start summarizing them into some standard formats. Because nobody else can read 1,000 or 10,000 or 100,000 or a million transactions. You have to be summarizing it. And there you get into trial balances and financial statements. I will do a case study later, but before the case study. Let's look at what the source documents are. So let's look at the source documents. As I said, the source documents can be many, but at a basic, every source documents will have some basic information, like which day was the transaction. What is the total money involved in the transaction? A description of the transaction. And someone who has authorized it. So what are the typical documents? It could be a check, which I've issued. It could be an invoice. It could be a receipt. It could be a credit memo. It could be a deposit slip in a bank, a purchase order for something, an employee time card because you have to pay hourly wages maybe. So these are all source documents. All of you will be using source documents because if you're employees and you're claiming reimbursement, you'll probably have a travel bill or a food bill which will give to the company for claiming reimbursement.  If you're paying a credit card bill, you're probably writing a check. So that gets into personal finance. So think that your same kind of documents that you have in a personal finance, personal life, companies also have that except in larger numbers. And then the source documents have to be gathered and all those thousands of pieces of paper have to be written down. What is called an accounting journal, which could actually be a journal like a notebook for a small business. Or it could be a computer software nowadays for a big company. Now think about when I was making the tea. I could just run a list in a notebook of everything. Bought milk, 20 rupees, bought sugar, 30 rupees, bought tea leaves, 40 rupees. Sold one cup of tea, 100 rupees revenue, plus, minus, and it's a long list. And that was how it was done hundreds of years back. And but the modern way of doing it, and the usual of doing it is what is called double entry bookkeeping methodology. Double entry, without getting into too much details. And those of you are interested in finance and want to do a chartered accountancy or a cost accountancy or want to do an MBA in finance or do a commerce course. We'll know much more about it. But for generally, a double entry bookkeeping essentially is all about classifying the transactions into debit or credit. And that's why it looks like that. And on the left side, you'll have your debit entries. On the right side, you'll have a credit entries. And it's called a T account. And all of you probably have seen it. And you're probably using it because your bank account, those of you who have opened bank accounts, were probably used to it, except you probably not thought about it like this. So if you look at a typical bank account, you'll probably get a bank account statement like this. There'll be a date, there'll be a transaction, list, and there'll be a debit or a credit amount. If you get money in, it could be a salary, it could be a dividend, it could be an interest. If money comes to your account, it's a credit entry into your account. If you spend money through UPI or credit card or through a check, it's a debit to your account. So all of you are using T accounts, debit credit in your personal lives. Companies use the same, except the volumes are much larger. So what has happened is source documents, individual transaction, be it your in your own life salary coming in or an interest coming in, or you are paying a restaurant or buying a ticket. Those are all getting summarized into this statement, a T account statement. So now when you have all of these, in your personal life also, you may want to make some analysis. In your personal life, you may want to say, okay, my income is so much through salary or my business or whatever. I'm getting 100 rupees a salary, how much am I really spending? If you are spending 80 rupees and your salary is 100 rupees, you're saving 20 rupees, and that's your income statement. But if you're spending 120 rupees and your salary is 100 rupees, you're probably taking a debt, a credit card debt, or a debt from a shop, or a debt as a loan. And you don't have a savings then, you have a liability. So in your personal life also, I would encourage all of you to understand the basics of financial statement. Right at the beginning, I gave you an example of a one cup of tea. And I explained to you the concept of a balance sheet, an income statement, and a cash flow. And I'd encourage you to keep an account in your own lives of a balance sheet. How many assets do you have? How much are they worth? And do you have a loan against it? If you buy a house, you have an asset. But if you've taken a loan against it, you have a liability. If you bought a car, you've got an asset. But if you've taken a loan, you've got a liability. So that becomes a personal balance sheet. Companies have the same, except companies may want to own a factory, machinery, a restaurant, a airplane, a ship for the business. And they have liabilities. Owners would have put in their equity. Banks would have given them some loans. Investors would have given them some money against equity. So they also prepare balance sheet. They also keep track of the profit and loss. And I'll do a case study, so become clear on how large companies do that. And cash flows, just like as you don't want to go broke, that you've got your salary of 100 rupees in the first of the month. But by 20th of the month, all that 100 rupees is gone, and you don't have cash. You're broke, then you take a loan. Companies also very carefully monitor their cash flows. So that's the accounting world very simply put. Let's look at a case study. It's a mini case study of a very large company, or a very good company, a very famous company, a very respected company called Larson and Tubera, many of you have heard about it. Some of you may be working in that company. And what I'm using here is a typical investor presentation, which you yourself can see if you go to the website and the link that is there at the below. Because the company, Larson and Tubera or any other company, will present this to their investors. So it's called an investor presentation. So let's look at, are they using what I've talked about in the last few minutes? So let's look at this slide, which is actually the profit and loss and income statement. I talked about in the context of selling one cup of tea, the sales and the cost, and therefore the profits. You can see exactly the same thing being presented by a very large, respected company such as L&T to their investors, except the numbers are huge. So if you look at the top, it says rupees billion. And then if you look at the column in blue on the right side, which says FY23, you will see, if you read the numbers correctly, the sales is 1,83,000 crores. I'll repeat that slowly, 1,83,000 crores or 1,833.4 billion rupees. That's the sales. And if you look at the percentage var, which means percentage variance, which means percentage change, it's 17% growth versus previous year, where they sold 1,56,000 crores. And then you have got other parameters. But without getting into much detail, now let's look at the cost. And then you start looking at cost items such as MCO expense. So if you look right at the bottom, you'll see MCO is manufacturing, construction, and operating expenses. But it's an expense. Just like if I make a cup of tea, I have an expense on milk, sugar, and tea. L&T also has expenses, so this is MCO expense. Then they've got financial charge, OPEX. And you can see at the bottom, it relates to their financial service business and leasing. And they've got staff cost because they're hiring people. And they've got sales and administration cost. So if you deduct all the cost, they have got what is called the first level of profit. And without getting into too much of details, it's called earnings before interest, tax, depreciation, amortization, which is the first level of profits. And you'll see that they have made 207 billion rupees of profit, or 20,000 crores of first level of profit, which is a beta. So I gave you the example so far of a very simple case of one cup of tea. And here is a giant company reporting its sales to these investors. And then there are more details on the same profit parameters. Without again getting too much of details, you'll find that the beta, which is the first level of profits, is about 20,000 crores. And they have got certain other costs. And then if you look right at the bottom, you get into the reported profit after tax because you have to pay tax to the government of 104 billion. That's about 10,000 crores. So if you look at it in totality, they have sold right on the top in the blue colored column, 1833.4 billion rupees. That's the revenue or sales. And if you look at the bottom, the reported profit after every cost, including taxes, is 10,000 crores or 104.7 billion. Concept is the same. This is called the income statement or the profit and loss statement. Now when I talked of the cup of tea, I gave a very simple example of I've got a stock of milk, sugar, and tea, but I've taken a loan from the grocery store. And that's my balance sheet. I've got an asset, I've got a liability. Now look at how a well-giant company can have a rich balance sheet, a complicated balance sheet. But again, remember that it's a summary. It looks very simple. But underneath it is probably lacks or millions of individual transaction. So if you look at the balance sheet, you will find right on the top sources of funds, which in the example of a cup of tea is a loan that I took from the grocery shop. So that was my source of fund, the loan that I took from the grocery shop for my milk, sugar, and tea. Here for this company, L&T, the sources of funds are from equity, which means from their owners and reserves, which means money that they have collected themselves in the business. And there are other sources of funds without getting into details. So the sources of funds, if you look at it, is 2188 billion rupees. That's about 2,188,000 crores of rupees. Where is all this money now being used? Remember in the concept of one cup of tea, I took a loan from a grocery store and my asset is milk, sugar, and tea. But for this large company, the assets, if you look at it, fixed asset. Fixed asset is factories, plants, machinery. Fixed because you can't move them around. Land, office.  That's their assets. And then there is other kinds of assets, which together then give a application of fund. And again, it says 2188 billion rupees. And you'll see that the source of funds matches the application of funds. Why is that? Think about the one cup of tea. I got a loan from the grocery store of 80 rupees and I bought milk, sugar, and tea of 80 rupees. So 80 rupees of assets, 80 rupees of liability matching. And the same thing here is matching, even for a large company. So the concept is the same. The scale is different. And then there are other ratios. So I talked about the profit and loss or income. I talked about balance sheet. And the third thing, remember, I talked about was cash flow. I talked about you may have made a profit, but if your customer doesn't pay you, you'll go broke. You'll not be able to continue your business because you don't have money to buy your raw material. Same concept here for L&T. And you'll see that they're saying, what are the operating profits? If you look at FY23, operating profit on the right side, you'll see 225.2 billion rupees. That's 22,500 crores of operating profits. And then they're figuring out where they have collected money or spent cash. And if they spend more money than they've collected, then they are negative on cash flow. But in this case, if you go all the way down and without getting into all the different ways, okay? You'll see that the net decrease or increase in cash and bank balance is 28.9, which means that we have got extra cash in 2023 fiscal year of 28.9 billion rupees, which is about 2,800 crores. So they're cash positive. So these are the three key concepts that I talked in the example of one cup of tea. And then I've shown you a mini-case study of a large company presenting to its investor. So here's the first reflection point. In your journal, write down and think about a company that you'd like to join or you're working for. Go to the website and look on the internet. For the annual report, which looks like the case study that I showed you. So find that. Try to look at a summary version because some of the annual reports can be hundreds of pages. So look for a summary version. And see if you can identify their profit and loss, what was the sales and what are the costs and did they make money, did they make profits? Try and find out about the balance sheet. How much assets do they have and how much loans and liabilities do they have? Try and find out whether they are cash positive or cash negative. They'll all be there in the annual report. You just have to look for them and study any financial ratios, which I'll talk about later that you can find. Start getting used to looking at annual reports. Those of you who continue to do a chartered accountancy, cost accountancy, MBA finance, commerce, BBA, et cetera, finance-related course, this will be your job.  Even in your personal lives, all of you need to understand this basic concept of profit and loss, cash flow, balance sheet in your own lives, except in your life, a profit and loss will be the income which could be a salary income or interest income, dividend income, and the loss means how much are you spending? Your income statement, the person. So to encourage you to reflect and do this exercise.


I've been furious for most of the week watching what's happening to Christine, Blasey Ford versus Brett Kavanaugh and we need to talk about this mental health subject. What's up everybody? This is Chris from the Rewire Soul where we talk about the problem but focus on the solution and if you're new to my channel, my channel is all about mental health. Something I try to do is decrease the stigma, increase awareness and oh my god, am I trying to increase awareness now. One of the reasons that I'm making this video is because so many people do not understand mental illness, they don't understand neuroscience and it's absolutely mind-boggling but anyways if you're into that kind of stuff make sure you're subscribed and ring that notification bell but anyways like this is blowing my mind like I unfortunately or fortunately depending on how you look at it I know so many women who have been the victims of trauma okay um and and watching this thing I've seen my friends posting about it and stuff and how it's like bringing up memories and things like that and watching what's happening to Christine Blasey Ford is absolutely disgusting like okay those of you who've been following my channel like I am a big neuroscience nerd. I love neuroscience, I love learning how the brain works and like the fact that you have people making decisions and questioning this woman who have absolutely no understanding how the human brain works is mind-blowing. It is mind-blowing like okay so first let's talk about the gaslighting that's happening so gaslighting for those of you who don't know what it is gaslighting is when you make somebody question their own sanity okay a lot of narcissists will do this to uh their significant others or people around them and like seeing what's happening to Christine Blasey Ford like oh my god and all these news reports and saying like well maybe it was somebody else maybe she doesn't remember maybe she's just this and it's like are you kidding me because then on the same side on the same side of that argument you see people saying well why didn't she come forward sooner why didn't you wait this long like hello hi do you not understand why women don't come forward because they're about to face this kind of scrutiny saying oh well maybe you don't remember it correctly maybe this didn't really happen and it's insane you know what thinking about this I remember watching um the comments and one of my 13 reasons why videos right and people were upset with the main character because she didn't get for help after she was sexually assaulted but she did go for help and the same thing happened when she went to see the high school counselor he questioned her memory he questioned whether or not she remembered properly and did this really happen or was it consensual like it's crazy this is why so many sexual assault victims are not coming forward and this isn't just in the Christina Blasey Ford case I know countless women who have tried to speak up about these things and then it gets questioned like oh maybe it didn't happen I know these are serious allegations and I'm not a fool to think that nobody in the history of mankind has ever lied about something like this but oh my god like when it comes down to the memory and how the brain works like I might include a clip right here of Christina Blasey Ford uh Ford talking about how the brain actually works like she dropped the mic so hard on these fools like how can you really trust your memory and she laid it down perfectly you are very clear about the attack that it was Brett Kavanaugh that covered your mouth to prevent you from screaming how are you so sure that it was he the same way that I'm sure that I'm talking to you right now it's just basic memory functions also just the level of norepinephrine and epinephrine in the brain that sort of as you know encodes that neurotransmitter encodes memories into the hippocampus and so the trauma related experience then is kind of locked there whereas other details kind of drift so let's talk about the brain science of this stuff real quick trauma burns in your memory like a brand okay because your brain the strongest part of your brain is the limbic system the limbic system is responsible for fight fight freeze it's also responsible for your memories okay traumatic events get burned in your memory because your brain wants to protect you from that happening again so when a traumatic event happened what happens is your brain locks that into the memory but your brain is very efficient okay so it locks in the main things okay typically sensory this is why when people get triggered it give me sights sounds smells tastes all sorts of things like certain smells can trigger somebody based on something that was in the room the time of this happening this is why when you see war veterans who struggle with PTSD loud noises might trigger them because even though they don't have to witness a horrendous act happening in front of them the noise might happen because the brain is saying yo this crazy thing might be happening again so you need to get on the defense and you need to save your life so Christine Blasey Ford explained this because she's actually a doctor and understands this stuff and how it burns into the memory of the hippocampus so that's why she remembers those particular details and like she mentions and talks about is what so many other women struggle with is that it is it hurt her relationships as she went to college and later on in life and her and her husband went to couples counseling and that's again where this came up but it just blows my mind that that people would think that people would think that this woman would go under so much scrutiny and all of this stuff for some kind of political reasons like think about in your right mind like i am not here i'm not a political channel or anything like that i i'm very passionate about mental health and advocacy and all that kind of stuff and that's what my channel is about i try to leave my political political opinions outside of here but this is absolutely bananas but we could really talk about this with any case with any case of sexual assault and things like that not all of them end up like this but i i just want people to understand that this is why more women don't come forward this is why people don't come forward and it's like you know as a father as a father like i i just hope and pray that my son feels comfortable enough to talk to me if anything like this ever happens like watching the the Ford's testimony was brutal i don't know how many of you watched it but i was at the gym and i was watching it and how many times she was asked to recount the details of this and explain and go through it like that is so difficult for anybody like i talk about some of the traumatic things that happened in my past and they're nowhere near what have happened to most victims out and around the world so the fact that she's willing to come forward and do this and i hope what i hope it does is it's kind of like with mental health like i hope it inspires more people to come out and share their stories and talk about them and everything like that like i am a firm believer in due process and i think the last thing i'll say in this rant video is i think it's ridiculous that we don't hold somebody with a lifetime term as a supreme court justice to the same standards as anybody else who would go through the criminal justice system like they're trying to knock this thing out and like a week like people were like giving her crap like oh why didn't you fly out here oh oh hold on there's more to this rant they were trying to discredit her anxiety by bringing up the fact that she gets anxiety when she flies so i don't know if you saw that part of the thing but they were questioning her like well don't you fly for work don't you fly for this i'm like really really you're trying to discredit her about this sexual assault by talking about her her anxiety by flying like how many people on that planet on that panel actually know a damn thing about mental health neuroscience anxiety ptsd or anything like that and these are the people making laws like it's no wonder it's no wonder why why mental health treatment is so vastly underfunded in this country like look the way they think it works you know what i mean but yeah part of my channel is advocacy so i talk about this stuff but anyways um my girlfriend had me watch this uh awesome video on vox i'm actually going to link it down below basically talks more in depth about why certain memories you know might not be uh you know as vivid as other ones and things like that like for example he brings up a very good point like about five minutes into the video he's like you want to test it i showed you a clip at the beginning of this video what were they wearing what were the names of these people you know what i mean so i don't know it's it's very interesting check it out it'll be in the description if you have any thoughts comments concerns if you think i'm an idiot anything like that make sure you leave them down in the comments below um you know like i i have noticed that i have a very large female audience on here and like i i really hope i can make videos that can help you inspire you and things like that and talk with each other like i am just a guy here talking trying to be a voice i'm not trying to white knight or anything like that it's just i don't know i have compassion for people as a whole and it just absolutely sickens me when i see this type of stuff happening to anybody out there in the world so anyways that's all i got for this video if you like this video give it a thumbs up if you're new subscribe ring the notification bell i make a ton of videos i was actually gonna make a video about why you date who you date but this made me very passionate so i made this video first so make sure you subscribe bring the notification bell because that video should be coming tomorrow all right i love you all stay safe i'll see you next time