Hello everybody, first of all I'd like to apologize to my friend Gene for last night. He did his best, but I still ended up sleeping in the hallway. All right, I'm a sysman, this is Mark Lar, we're from the Hacker Pimps, and we're going to be doing a presentation on attacking information gathering systems. So these are systems that collect personal information on you, and we talk about different ways that you can protect yourself, and also about doing research like new cool technologies. Often we end up buying the next biggest coolest thing without much attention to what it could be doing, and a lot of people just don't care what it does. By the way, we have 91 slides, so we're going to try to not kill you with them. Some of this stuff that we talk about will probably get you in jail, so just keep that in mind. So why would you want to create systems and make them unreliable? It seems like the opposite of what we should be doing, but some of these systems are out of your control, so they have your personal information and you have no control over that. I mean, every night when you go to sleep, your personal information is sitting out there somewhere, and the people that are in charge of protecting it, they don't know where it is either, and most likely it's painfully obvious to get to. Technology changes everything, and while we were working on this project, Mark said something very intelligent, which is really rare for him, and he said, we were talking about why this was such a big issue, and he said, we don't have new problems, we have new technology. So if you think a couple hundred years ago, if the technology was there to spy on citizens, it would be used, and now we're getting to the point where we're throwing our privacy away. We seem to like having our freedoms. We trade that for cool factors. Okay, I'm going to turn it over to him for a little bit. So I'm going to talk kind of about the theoretical, why do you need privacy, and maybe some ways that we can start talking together on how we can get some of it back. And I was rather upset a few weeks back. I saw on Slashdot somebody put an article out there saying, I'm going to debunk the idea, why is it that I need my privacy? I'm not doing anything that's wrong, so who am I trying to hide from? And I was upset just kind because he didn't really answer all my concerns, and I thought about it for a while. And I came up with this answer, which is, obviates everything else. I have nothing to hide is the comfortable position of those who are not marginalized. And here's some people that are marginalized.  Or do you just need to express unpopular views that would... Do you need to express unpopular views that would risk your safety? Are you a whistleblower or a security researcher?  I mean, we need our privacy and we're putting it on my space and that's fine, but what about keeping what we have? So I was thinking about who is watching me if you don't think it's enough to not care. Well, we've got the executive branch and right now they're signing national security letters where they can subpoena your personal business information and you can't tell anybody that they took it or if you probably will never know, there's no court oversight. And speaking of... Well, and then we have the Department of Justice. Two years ago, I saw Alberto Gonzalez get up in front of the Congress and say, if you want to pass laws about how to run the Iraq war, we will listen to your advice. So he said up front, we are a lawless executive branch. And so we have the other executive branch. Of course, this is Futurama's mom and Mr. Burns.  It's not about being malicious, he was dumb. And he took 600,000 people's search records and put them in a tarball and dropped them on the internet. And if you know where to look, that stuff is still available. And then we have DoubleClick, who is being acquired by Google, which doesn't make me very happy. And we have the other imaginary judicial branch. This is out of order. Anyways, I don't know if you guys have seen Harry Potter, but I was really struck by Professor Umbridge being a very close clone to Harriet Meyers. And it's funny, but it's frightening too. The blurb here, she actually said this, the president is the most brilliant man I have ever met. Meanwhile, he was looking at a picture of a banana. And so we also have the branch, which must not be named. And, you know, I forgot something here. The previous slide we were talking about the judicial branch, well, okay, so when the government wants to spy on me because I'm a citizen, they have to get a subpoena. Well, they have to go to a judge and get approval. Well, the FISA court, that's who does that. And they turned down about six requests in 3,000. So they're not really overseeing anything. So who else do you want to protect yourself from? And let's talk, you know, Jesus said the neighbors, the one, the Good Samaritan, the one that helped out. So we're all neighbors, right? Well, inversely, everybody in today's internet connected world is your neighbor because they've got access to packets. And there are blood suckers out there. And, you know, we don't know who's looking at us. And so we just need to be thinking about it. And then we have our nosy neighbors, which is just the guy that lives next door that saw your open share on your wireless that has your bank account records and letters to your mother and your bestiality porn. And whatever it is that you're concerned about. And then your good neighbor is the accidental lawyer. You know, somebody I saw again on Slashdot because I'm kind of like that. I read it a lot. And there was a thing about on HGTV, they weren't encrypting all the channels. And what you're watching shows up on your neighbor's TV as like, you know, channel 1000-1 instead of just 1000. And so even the stuff that people that aren't malicious, they're seeing your stuff. And so we need to be thinking about it. And so I said to myself, well, Nate, of course, said something to me, which was great because I'm looking at the privacy situation we have. And so there's so much arrayed against people that want to just live in peace by themselves. And so, okay. I tried to think to myself, what is the best target that we can come up with? Because who's taking the snapshots? And we were talking about DoubleClick and we got Google. And there's one thing. Whoa. But web search is if you can get a list of everything that you search for, that's kind of a record of stream of consciousness of your thoughts. We've been, you know, just put, we randomly type things into Google and it says something really deep about us. And so Google is the obvious target because every 60% market share, blah, blah, blah.  And these are the parts that we need to be concerned about. And so I thought, how can we try to address all these things? And the reason we need to is you can't just turn everything off. If you get rid of your JavaScript, then the web becomes unusable. The things that make it useful are the things that invade our privacy. And so the first order of business, there's probably three or four or five presentations today just on tour. And it's a system where you proxy your web request through it and it hides your IP address from the website you're trying to reach. And so that's a good tool and we've already got it. And then the problem with tour is that this doesn't deal with your sessions, it doesn't deal with your cookies. And so I want my cookies and I want my sessions because they help me, but I want to be able to go into kind of quiet mode when I want to look up things that I don't want the world to know that I'm looking at just because, yes, last night. Oh, it was fun. This first one is obviated, you know, turn off your automated search completion in your Mozilla web browser.  It just stops working and then block in your cookies. One simple step that we can take is if you can just press a button that says right now, the browser can't talk to my cookies. And so I haven't written the code for that, but it's an idea and it's something that I do plan on doing. And then we also have on iMilly.com, there's a Google cookie anonymizer. And that's helpful, but I thought this turn off your cookies is a more general solution because we're not just dealing with Google. We've got Yahoo and whoever you're using. And then the next part is I propose a plug-in to Firefox. I don't have the skill to write this myself, but it's a proposal. And I call it a P2P web search identity diffusion, which is the ability to hide in the crowd when you're trying to search. And I'll be up front. It's nifty and it's helpful and it's insufficient. But this is the outline of it. Basically, when you do a web search, then you put that into a P2P network and then a certain large number of people also pull down that search. And everybody does it. And you order yourself randomly in the search so that it's hard to tell who originated it. And that diffuses your identity and it's not sufficient. And the reason why is because we have this aggregate picture and if you don't look at something often, then it looks like it maybe wasn't you. But if you're always searching for your Swedish beastiality porn, I'm sorry I'm revealing too much about myself. But if you're always doing that, you stand out from the crowd. And the other problem is that the model of the internet changes over time. So I want to give some examples that it's more of a population aggregate than a single person aggregate, but it illustrates the point. Sometimes things aren't what you would think they would. I looked up sheep sex. And the top countries are Ireland, New Zealand, and Australia, UK, United States. Nobody is really surprised by that order because that's where all the sheep are, of course. And so I also looked up goatsy because it's not really goats either. But I thought it was quite fitting that Finland is five times further out than the nearest competitor, which is very appropriate given that that's where Linus Furbalz is from. Anyways, so this is another interesting thing. I want to talk about why it's not what you think. I looked up stocks and nobody's surprised. United States, Canada, well India is a little bit, not what I thought, but it's pretty much what you think. But you change one letter, you look up stock and it turns into Hong Kong seen before, India. And so for some reason they're all searching for stock and we're all searching for stocks. And so I just wanted to point out that this is what gets revealed when you can see everybody's web search is this deep look into how people do things. And I'm not sure I really want to be a part of it. I'm a voyeur. I'll admit right up I like looking at this stuff, but I don't want me in there. And so this slide here is just because I'm going to use the terrorist word several times and I'm not planning on blowing anything up, but I just wanted to, in case I flag the TSA people or whatever. Okay, let me clarify. I didn't mean to say that I'm not planning. I'm not going to do it. I haven't even thought about how to do it. I just want to put that disclaimer here. So I looked up terrorists and this terror issue is so apropos to our lives right now. And I want to use this as an opportunity in the middle of this privacy thing to give a little speech, which is that maybe it's not quite how we think it is. Obviously we're being taught to fear terror and terrorism right now. And so obviously we're not surprised United States, Australia, United Kingdom, our top three allies in Canada are the top searches for that. But it's kind of a little bit self-centered to think that we should be so concerned because we're not the ones getting the terrorist attacks right now and there's lots of them happening. You look at terrorism and it turns into Pakistan, Morocco, the Philippines, Singapore, and these are places where there's real-life terrorism happening today. And then I was really shocked by the next one, which is that if you look up instead of terrorism, you look up terror, you get something that's not even on our charts. It's not even on the radar screen. Peru, Mexico, Chile, Colombia, these are Spanish-speaking countries.  So I go and look it up and they have the Shining Path Marxist Maoist group that is wreaking havoc and they've been mostly tamped down, but all these three slides are from 2007. I didn't do the overall year search. And so I just wanted to say maybe we should change our perspective a little bit and think that we don't really know what's going on in the world because it's a big world.  So the point of this talk is to say two things. One is let's wake up. It's not like they say it is on the news. And the second, my real point, is that defusing a query source isn't sufficient until n gets pretty large. And so if it turned out that millions of people were using this kind of a system, it would be helpful. But until then it's not, which is kind of a hard thing to start up. But our purpose in this talk, and I'm about to turn this over to Nate, we're really here to start a discussion so that we, because I don't hear people talking about these things in public and I just want to see if we can talk about it and help the situation. And I think that's the last one. This isn't, I have no idea. This isn't my slide. That was mine. So, oh, can I do this? This will just take a second.  I was putting together my slides last week, and this was the first time I ever saw this screen from Google.  Type in these letters. And the reason that it was interesting was because I was searching through TOR and somehow that means now I'm trying to protect to hide who I am and now that means I might be a virus. And really they're just trying to stop me from doing it to make it a pain, is my opinion. Of course, I was talking to a guy last night. I'm really ignorant about some of these things, and a guy tells me, no, Google is used all the time for doing virus stuff, but I still don't see why it's such a big deal. Somebody might disagree with me, and I'd like to hear your view on that. We're going to be in the Q&A session later and let's talk. But why it was really ironic is if you look up here in the corner, the search term was Bill of Rights, and that was the first time I'd ever seen this page on Google. And this is Nate. Alright, it's going to seem like we went out of order a little bit and it's not just because I was hung over and messed up the slides, although I did that too. We just kind of wanted to run through what we had to talk in like one chunk so we could get on a roll and like move along. I really think we need to start. We seem to be really concerned about our IP address and where we're coming from in hiding, basically not letting people know exactly who we are, but this focus is actually really too narrow. We need to look at the big picture. There's a lot more that's going on that's a lot more dangerous than just knowing where somebody comes from. It's somebody actually knowing who and what you are putting those pieces of data together. That's the ultimate goal of these information systems is to gather all this information to basically create almost like a dossier on you. So let's talk about who you are and you could say that, you know, I am a name, possibly an address, my social security number, my phone number. Data like that will identify me, but some of this can be used to steal your identity but in the grand scheme of things you may care more about what you are and having that identified. So there's many things that determine what you are.  And the scarier prospect is putting all this data together so they know who and what you are. So collected data is multiple things. It can be sold, it can be misused, it's correct. And if the data is incorrect, like let's say somewhere out there in this data, it says I'm a female.  So when something is wrong about you, it can be almost impossible to correct. And when you talk about collected data you have basically two types of data, like anybody who is familiar with some of the information security concepts around aggregated and inferred data, aggregated data is data taken from multiple places. So it's matching things like your credit card, your grocery bills, maybe mailing lists for businesses. That data can be taken and put in one spot. Inferred data is taking data from multiple places and making assumptions. So basically you buy multiple packs of Sudafed so you must be cooking meth or you drive through bad parts of town so you must be buying drugs. These are inferences made on the collected data which that can actually be very dangerous. If you take that a step further and create a profile of somebody, you could actually say, you know, statistics show that since you watch shows and download porn and have diabetes you're 30% more likely to kill somebody. That's a statistic or something. You can take statistics and match them to who and what you are and come up with like crazy things. So you might be 40% more likely to be guilty of domestic violence. Now these are made up numbers, I don't know if that's true, but you get the point. So it's hard to have your own cake without people knowing, you know, who you are or what you work for.  I mean that seems, you know, to make sense but people do it anyway. So you should decide, that slide shouldn't have been in here.  So some interesting things came about in the past couple years. Microsoft is working on technology to basically identify you through your web habits. So the way you type, you know, linguistics items like that. I saw this too. It's a stealth iris scanner. Can you imagine having a stealth iris scanner in a store? So it can identify, you know, I look at 40 items of clothing and I always go in and I buy something else. So I go over here and look at this but I always buy something else. You can actually make inferences based on that. That's something that I want. And if stores start using this technology they're definitely not going to tell you they're using it. It's only going to get worse too. Victor, Mayor Schoenberger just wrote useful void, the art of, you know, forgetting the age of ubiquitous computing. And that's, data sits and doesn't go anywhere. So unless it gets lost very badly. But so something that I post on the web, like say I rant about something on my blog, you know, 30 years from now, that data could possibly still be there. So do you really want to be held accountable for things you say? Like if you have like a drunken rage or something? I mean, I heard that. And also, when people think about privacy it actually affects your freedom of speech because if you're always worried about things being held against you, you're less likely to say what's really on your mind. Qui-Gon and myself did a talk at Hope Number Six about future connected technologies and how these future technologies are going to end up spying on us. So I want to get to more of the other stuff. Can you tell? We already talked about that. So let's talk about systems in general, like systems analysis and attacking these systems. So I had a co-worker who told me that computers haven't changed since they were invented. It's just input processing and output. And I thought that was like very, very, well, it fit him. So, but basically you do, you have some form of input, some form of processing and some form of output on any system that's useful. So let's expand on that a little bit. So if you add a couple more components to a system, you basically have an input method and possibly some sort of storage. And then you have an output. So somebody's going to be making decisions based on that system. So when you talk about analyzing these systems, systems that are collecting our data, you may want to think about several items. So is what you're analyzing installed software? Is it black box technology or is it a system that's out of your control?  So it's not always necessary to know all the pieces of the puzzle to attack a system. You may only need one particular input device to create an attack surface. So you have to take an inventory of what you have to work with. So do these systems, you know, they're most likely going to have to interface with you in some way, shape, or form. They only take one to create a successful attack. So in the case of installed software, I mean, this is software that we buy and install on our systems. So we have a very large amount of tools to be able to analyze software that we install on our own systems. We have access, full access to our systems. But one thing you may want to really think about is reading a eula. I mean, does anybody ever read a eula? I didn't think so. Well, some of them are very interesting. And I think it was... I think Vista has like 23 components in the eula that says it's allowed to collect information on you. Yeah, and it says, oh, by the way, we can collect anything else we want to. So, yeah, nice. So what is the purpose of the software? Take an inventory of the purpose of the software and know what it's doing on your machine. And then you compare the actions. So some of the concerns you may have over installed software is what files or what part of the computer is it accessing? Why is it accessing that? Is it a function of the application?  But, you know, if you're using accounting software and it's like going into different parts of your system for no reason, that's definitely a problem. And ultimately, if the data never went anywhere, it really wouldn't be a problem. So is that data going to some form of third party? So use tools at your disposal to analyze the software. Communications, is the software spying on you? Is it going to send the data somewhere? Where is the data going? What protocol is it using and what is the format of the data? So say file access, what files is it accessing? Is it expected to access those files? I realize I'm repeating myself, sorry. And tools you can use. So if it's using standard, you know, network communications, you can use items like Wireshark, TCP dump, et cetera, to find out why your computer is speaking with, you know, some company or some other country. And for file access, you have LSOF, Filemon, et cetera, depending on what platform you're running. So you can actually tie together the network access and the files it's accessing and where it's sending the data. And is the software open source? Somebody may have already analyzed the software for you and wrote something up on it. Research for known issues. And keep in mind that, you know, it's installed software, so you put it on your machine, it's probably going to have a large amount of access to your machine. What about black boxes? So black box technology, you're going to definitely want to read your agreements and other documentation for the black box. Know what the function of the device is. What medium does it use to transfer data? And what interfaces does it have? So you're going to have a significantly lowered attack surface for some form of black box technology. And what type of information does the black box have access to? So if you take, you know, remember it doesn't have to be credit card data to be important and important to you. I mean, if your friends find out that you've like DVR'd like 100 episodes of Will and Grace, that could be actually kind of embarrassing. Is there some sort of visual or audio cues to the black box? Does it have activity lights? Does it have a hard drive that you can hear spinning at certain points in times? Are there times when the activity can be observed being heavier than normal? I mean, these are things we don't typically think about when we're analyzing systems. We get so caught up on protocols and we don't think about the kind of off-center analysis on these devices. And they can actually be a clue that's leading you to something more important. So can you put a device on the medium to listen for communication? So if it's network communication, that's fairly easy. You can put a sniffer in between the device and where it would be sending data. But it's a little harder when you start talking about, you know, different types of technologies, such as cell phones or, you know, DVR, things that interface with the television system. It's not impossible to analyze that, obviously, but it takes more expense in the tools to do so are more rare than just putting a sniffer on the medium. And does it have other interfaces that can be messed with? So if you have a DVR or a cable box, and obviously it has, you know, RF inputs, but there may also be USB or serial ports, you should look at all of those ports and see what happens. I mean, plug something in. What's the worst thing that happens other than you might get in trouble? So let's take an example of a cable box with a built-in DVR. So what information would that have access to? So it has access to television and movie data that you watch real-time and recorded. That's the obvious, that's the obvious one. But what about, what else it knows about you? Like your schedule. So if you basically take this cable box and DVR and say, well, it knows that every, you know, Thursday I record Jerry Springer and I'm not home because I'm DVR-ing it. If I was, you know, at home, I would probably be watching it real-time. So it can actually determine when you go on business trips and all their kinds of data about your schedule. And that's some of the things that we don't really think about. We get embarrassed about the television shows we watch and don't really think about all the other data that it really has access to. And the medium to transfer data, transfers data over coax cable. It has multiple interfaces. So you have IR, USB, serial, multiple coax inputs, miscellaneous video inputs. And it also has, you know, hard drive and lights. So what about systems out of your control? These are items at stores or, you know, so it could be, you know, credit card machines, reward systems, scanners for groceries. You're going to want to read any agreements or documentation or warnings. A lot of times these systems don't have agreements that you really agree to. It's kind of something that would be posted on a wall.  Most likely you're going to have a severely lowered attack surface to work with. So you're going to have to identify the interfaces that interface with you and identify the data the system has access to. And sometimes the data is painfully obvious. So in a store it's scanning your groceries that you buy and, you know, your credit card and data like that. So let's take an example of a surveillance system with some form of detection, some form of anomaly detection.  You can also get your location at a given point in time. The, you know, the transfer medium could be, you know, wireless or ethernet. And interfaces, it's going to have a video camera and it's probably going to be the only item that you have an interface to. So let's talk about actually attacking these systems. So the goal of attacking one of these systems is to affect its integrity and affect its availability and sometimes confidentiality. Basically making the system's data so it can't be trusted. Simply, sometimes, you know, systems can be attacked by just not using them. So the whole point of our presentation, creating unreliable systems, is if a data for a system cannot be trusted, then it won't be used. So bad data, bad decisions, unreliable systems. Somebody in the background is making decisions based on the data that it's collecting on you.  I mean, if banks had a tendency to lose your money to use them. So let's take a look at attacks. I kind of came up with a classification scheme for attacks on information gathering systems. So there's three levels. A level one attack affects the ability of the input device to perform its function. So an example of a level one attack may be destruction of the input device, disabling the input device, or cause a malfunction under certain conditions with the input device itself. A level two attack affects the accuracy of the data stored.  And that's another thing we don't think about too often as well. A lot of these organizations that collect all this data, massive amounts of data are worthless. It's the actual analyzed data, the end result, that's what's important. So if they have too much data to analyze for some reason, that can be a big problem for them. So ISPs, for instance, if they were required to log every single packet that went over their network and keep it indefinitely, that would be almost ridiculous. A level three attack affects the processing decisions of the system. So false positives and false negatives. So if you have cell phone monitoring, you know, you could say, hey, have you heard that new band assassination plot? They're the bomb. And I have this friend who seems to like calling me and saying he seems to always get the word nuclear in our conversation somehow and bomb. And I'm like, how do you even do that?  So I'm definitely sure my conversations have been recorded on multiple occasions.  And then hopefully they turned it off and said, don't ever listen to these guys anymore. So let's take a look at examples. Now these examples are very simplistic. So example one is a simple security camera without an active watch. So it may be a security camera that just stores data on a DVR and somebody looks at it only if there's a problem. So the most likely your attack would be on the input device. In example one attack, you can either blind the camera or destroy the camera. And second is the data stored.   You have to have like 150 million giant bananas and then we all fit into a banana nation or something like that. Now example two is a security camera with some sort of active intelligence. So it would be making decisions based on the data it's collecting and analyzing. So the data it collects are movements and actions.  But the input method is the camera. The computer basically analyzes the behavior and there could also be a DVR back there as well. And the output goes to a monitor for human follow-up. So you can take out, you know, blinded or destroyed the input device and you can also falsely trigger events. It's kind of funny they're working on technology that will identify bad behavior in people and draw attention to it. And I really think it's funny because I cannot wait till cameras get fitted with this technology because I'm going to walk around humping the air all the time and just see how many times I can draw attention to myself.  If everybody did that, which we would all look very foolish, but it would actually defeat the purpose of that. And then I'm always wondering, like, what behavior are they looking for? I mean, could I just swing at the air all the time? And would it be smart enough to know that I'm, like, swinging at the air and not, like, you know, having a fit or something? So let's talk about an RFID passport now. The data collected is personally identifying information. So we have the input method, which is scanner, computer, centralized database, monitor, and human follow-up. So what if one out of every five passports wouldn't read? And this is not the right slide. So what if one out of every five passports wouldn't read? So, like, say we're frying the, yeah, I know. Got it. Say we're frying the passport. So level one, if there was a way to do that, I mean, people wouldn't count on the passport reading. So we're injecting bad data.  And if I told that enough, it would be enough of an anomaly that they wouldn't count on that data either. And if you think about, like, somebody that was actively going around frying people's passports in the airport somehow, you know, think of all the frequent travelers that would run into that and how many times they would see that. Stealth-threatness scanner, same thing, personal identifying information, the input method, decisions based on behavior, central database, marketing and ordering information. So you could just be cool at the moment and wear sunglasses and that's a level one attack. Or don't shop at the store anymore. And that's also a level one attack. It's kind of a cheesy level one attack, but I don't care. I was tired. So what can you do to avoid becoming a victim of some of these systems? You can avoid using the systems that collect data about you. You can encrypt your communications and ensure you're communicating with who you think you're communicating with, which is something we tend to forget. We worry about encryption and everything else, but we never really check to make sure we're actually communicating with the person we think we're communicating with. You can analyze systems and filter unwanted traffic and contact companies and tell them you refuse to use their service anymore. We really need to start looking at all of our new technology from the eyes of a researcher and not so much as just a consumer with the next cool thing. We can use a new discount card every time we go shopping so they don't have a specific set of data on us. Or we can create new... Oh, I actually... I was in like a CVS pharmacy and they always ask me, hey, do you have a discount card? And I say no. And they'll grab one off the shelf now. They'll swipe it once and throw it in the trash. So I don't know who told them to do that, but if you think about it, you can actually weed out certain types of people by doing that. So it's actually making their data more accurate. You can minimize the use of your credit card, which is hard for people like me who travel all the time. It's just one of those things. You can leave as little data behind as possible. You can use encryption when instant messaging and encryption for email. You can also analyze your new toys for possible backdoor accounts, hidden communication, some of the things that we've been talking about already. And be aware of any technology that can track you and put you in a given place at a given time. It's not about whether you're doing something right or wrong. It's about the fact that it's nobody's business. I like my privacy. Not because I'm doing something wrong. It's just because it's nobody else's business. And I realized that there was a lot of bestiality in sheep sex or whatever in our presentation. But that's your prerogative or whatever. It's nobody else's business. Intrusive storage should be avoided. Remember, I already did that, move on once you have validated your data or your new devices. Now, this URL doesn't work because the DNS got messed up. But it will work here very soon. We're starting a project called the False Life Project. And it's solely dedicated to creating, to fostering discussions in actually creating tools to defeat behavioral based analysis. So we want to hear from everybody. So it's just a message board and we're going to have some topics. We're going to talk about different items and hopefully build the tools to implement some of this stuff. And here's some email addresses. So if you want to tell us how bad we suck, feel free. Just don't send me any more porn in my email. And that's about it. I think we're going to the track 1 Q&A room. So if you have any questions, please come by and see us. And thanks.


Welcome to the Adam does movies podcast. I'm of course Adam today. We're talking movies as always Specifically the topic on this episode is gonna be on video game adaptations movies from video games Also, you know, we might splash movies from books Although I think it's fair to say that a large swath of movies that come out are based on a book or a play Or a short story or something that Bob's been working off in his garage for five years And he finally got it off the shelf and into the hands of a studio exec regardless There's an excuse that I've noticed coming up a lot because of the popularization of video games turned into movies and that is You're not a fan of the game. So the movie's not for you.  I've covered a couple times in the past mainly from the book side of things But I bring it up now because video games have been on the rise both popularity In terms of like the PlayStation Xbox Nintendo switch all that stuff PC gaming, of course to Video games becoming movies like every year we get more and more of them and the quality is actually getting better I think overall there have been gems I grew up with that I thought were pretty good like Mortal Kombat which came out in the 90s. It's Absolute 90s schlock, but I think it's done very well For what it is. I also think that you can appreciate the movie if you're not even a fan of Mortal Kombat now You got to be a fan of like the Ninja Turtles three ninjas kind of slap sticky action humor movies If you're not a fan of that you're not gonna like Mortal Kombat because it's it's got a lot of that in spades But that's an example of a movie that both stands on its own It gets the story across even if it's absolute nonsense And it pays a ton of service to the video game and its fans You got newer movies like Mario. It's complete nostalgia bait You know every single frame of that film has something that a video game fan can appreciate. Oh my god There's Toadstool.  Oh, there's the one-up block from Mario 1 I'm off the cuff. It's gonna be rough But yeah, you'll see things the cheap cheaps jumping in the air the little fish things You'll see things like that King Boo off during the ceremony and you'll go okay. That's from that game I love that they added that in but they're really just Easter eggs.  We're not I mean, I'm familiar with the games. I've never played them I think there's seven or eight or nine of them at this point. They're very popular My son knows more about the story. He read the comics.  He likes that stuff He's never outright played Five Nights at Freddy's my daughter doesn't care about it But the movie looked good It looked really fun. It looked like he was gonna be a little creepy. The trailers were great You have these Chuck E cheese-esque animatronics coming to life terrorizing the rundown pizza place All right, there's a guy working the night shift. There's other people there a chaos ensues Well, it turns out the movie is very convoluted The story is absolutely insane. There's kids souls trapped inside these machines it's just absolute bonkers and I said so much in my review I said listen if you're a fan of this game because now when you review movies or review anything It seems like you have to have 45 caveats so you don't hurt people's feelings or at least so you set the set the table for them Because apparently people just don't know how to communicate with one another or understand where someone's coming from. I Went into the movie expecting a good movie.    You're going to this movie day one You're probably gonna have a good time. Whatever. That's your prerogative But don't throw it at me when I'm trying to review this from the standpoint of a movie on a movie channel and The comments were gold as always and I wanted to say to myself, you know what? They're probably like seven year olds, but then I looked and Five Nights of Freddy's has been around for almost a decade So these people are at least ten and I don't think they were playing it when they were one So sadly these people are probably in their late teens early 20s, which is just pathetic based on some of the stuff They said to me Insulting not only my intelligence, but my kids my wife like it's just just pathetic and And sad especially when you're dying on the hill of Five Nights at Freddy's how embarrassing Regardless of all that the takeaway that 90% of them said was it's all about the lore It's about the rich lore really the rich lore is what we're going with on this dumb movie. That's sad I feel sad for you Who says that about movies? I don't like the twilight films, but even the book readers weren't coming out going It's all about the rich lore.   I didn't understand it because of the complexities of the lore of the rich vibrant story line I on my TV if you're watching the stream I have what is this free guy with Ryan Reynolds? Funny enough.  I didn't love free guy. I thought it was fine. A lot of people really enjoy it I can see why it's light-hearted. It's fun got a lot of action and again it tips It's had a lot it does however have a good story or at least an interesting different story and that's why um I think that's what people resonate with You look at something like ready player one. It's the same lines based on a book Book is chock full of nostalgia a lot of it based around gaming the movie went all in on this by Steven Spielberg I love ready player one. I can see it's false though. I get some hang ups I have some hang ups with it too, but for the most part. I think the movie is wonderful. It's action-packed It's got some cool characters got a lot of great callbacks to movies video games books It's got it all and so you can definitely do it right another one that I really love And again, these are three examples of video game movies that aren't based on video games is Wreck-It Ralph a film that is chock full of Characters from video games from Sonic the Hedgehog to Bowser from Mario Brothers To made-up versions of games kind of a halo-esque shooter in there You have a Mario Kart game Candy Crush not Candy Crush. What's it called Candy Rush? Sugar Rush sugar rush I got there. I figured it out on my own Which is a playoff of Mario Kart and then Mario Kart would later come out with a map. That's basically sugar rush So it's kind of this back-and-forth collaboration But I like this film a lot because they take a character from a video game as a bad guy They put him in a scenario where he doesn't want to be a bad guy And the rest of the movie is him trying to find himself while introducing a lot of these different gaming elements Very well done very well put together. The sequel is atrociously bad. I hate Ralph breaks the internet It does a disservice to the first film. It does a disservice to the message and the characters Ugly movie and that's how you do it wrong They took what worked and they quadrupled it and then forced in a bunch of Advertising I didn't feel like I was being advertised to in Wreck-It Ralph When Street Fighter characters showed up like Ryu and Ken It just looked like a tip of the hat to those characters They added to the story or when the Pac-Man ghosts fly by and Pac-Man's after them but when I got to Ralph breaks the internet and There was a Twitter area where they were tweeting at each other and Amazon had a space and Pinterest had a location.  It's really wild You take something like Sonic the Hedgehog that came out not that long ago This is a great example of a movie and some people are saying that this was intentionally done for marketing purposes I don't buy it for a second Way too much money would be spent to do this and the animators have come out and since said that yeah We will work to the bone on this Jumping ahead of myself the point is Sonic comes out with the trailer for the live-action Sonic the Hedgehog That's kind of Scooby-Doo-Wish where Sonic's fake You got James Marsden in there playing a cop in a real world, but it's mixy. It's who frame Roger Rabbit in it kind of The trailer comes out Sonic looks like a nightmare.  He's got these weird legs with fur on them. None of the Aesthetic is pleasing. He doesn't match his game counterpart. He's 80 percent there But that 20 percent that's missing is wholly missing. It's really disturbing And so after a massive amount of blowback Of fans being in an uproar over this nightmare fuel The studio made the decision to go back and completely change it all They had a huge amount of this film done and they went back and ripped out the model of Sonic and replaced him with a different one That looked 99.9 percent like the game with a couple tweaks to make it more movie ready And Sonic looked great and the movie was good. It was a good time. Simple easy Bingo bingo bongo. We're all ready for a sequel Another time we're a sequel. I thought was a little too big for its britches. The movie goes on far too long It has some weird bride zilla storyline where Sonic's not even in the film for 10 minutes while she goes in this Complete wedding rage across the golf course. Just odd odd choices with that film But um, wait when you're able to both Marry the fans of the games with general audiences. You you wouldn't believe how well it can actually work out You don't need to pander to one or the other Focus on story first and the rest will come into the fold Another example of a movie working out Bad for everyone involved would be street fighter. Remember that little gem with john claud van dam I actually did a movie roast on my channel adam does movies I'm proud of it. I think it's hilarious, but I went through the entire movie talked about all the negatives, which spoiler. There's a lot They took all the iconic characters from the game Chun li, kami, rayu, ken, sagat, and bison every list goes on for a long time And the casting is actually pretty good for a lot of it But instead of having them be their iconic characters where they're you know, they're martial arts experts or their assassins Chun li's a reporter ballerog's a camera guy professional boxer ballerog's a camera guy sumu wrestler iyanda is the uh What he's like the editor is just insane.  Just none of it worked out It was very corny And I the tone just wasn't there for anyone at least not at the time I think it is a cult following now Because it is fun. It's really fun to watch and laugh kind of at it more than with it But uh, regardless, there's some entertainment there for sure. Just not the kind i'm interested in I mentioned mario by illumination That's how you do it the right way beautiful graphics simple characters easy storyline to understand it hits every age group What didn't work was the mario brothers movie. They came out in the 90s The gritty live action film that was a disaster behind the scenes and the final product was even more so one bob haskins plays mario. You got john liguizamo is luigi It's it's it almost has to be seen to believe how bad the movie is has almost nothing to do with the video game The plots paper thin in the game to be fair, but what they came up with here is just absolute atrocious garbage Uh getting back to kind of the message of this podcast is I guess really twofold It's it's like threefold. It's a it's a truffle. It's a trifle.  That's great This movie should stand on its own though It can be a companion piece sure But you have to draw in an audience and tell them what's going on and make them understand and give them something that's digestible Making a movie that has all these weird. I guess callbacks to the game. That's the other thing is The comments make you seem like you're dumb for not liking the storyline, but the storyline wasn't complex It was just dumb It was just bad So that's one thing maybe understand that What you like might not be compatible with what other people like but stop and actually listen to what they're saying Instead of just throwing out insults or hurling, you know ignorant statements back Just just listen take a beat Second thing studios need to understand that you have to do more than just put out a movie with a game license Like need for speed Oh, it's got uh erin paul from breaking bad. This is a surefire hit. No That movie was terrible You got to put in some work with it Like they did actually with grand turismo a movie that I saw last year almost this year. I guess Blown away. I thought for sure. Oh my god much like rough breaks the internet I saw the trailers for it and I thought okay, so this is sony just Doing a two-hour advertisement for how great they are and grand turismo the game series This is the most pathetic thing ever. I watched the movie and it's damn good It actually had good characters a great story some fun lessons Based on true story plot that really resonated. I think with a lot of people It was definitely made with two I think two main focuses one Obviously sell some games Sell some playstations get the brand out there more but two Make a good movie It was refreshing It was very refreshing the third thing I'd point out.  They can't just slap a label And the third thing I would say about these video game movies Is don't be afraid To change some stuff But don't go so far away from the game that it's not even the same thing anymore You could look at something like x-men for instance the brine singer films early on and then they kind of continue the trend going forward Of introducing some of the fan favorites from the comics and the animated show wolverine cyclops storm gene gray beast professor x they'd come and go What he changed about them were the outfits at the time Yellow spandex didn't really translate well at least in the wardrobe department. They couldn't make that work So instead he went with a very bland very basic very much Early 2000s look the black leather the the matrix look From the the late 90s it trans it transferred for a couple years the leather was in And so he went with that and I think for the time it came out It didn't hurt the picture It also didn't kill me it did it did kill some fans that wolverine was tall I thought Hugh jackman embodied the role very well Yeah, wolverine's a short stocky dude with a hotheaded temper, but jackman really made it his own So yes, you can take creative license You'll get something like tomb raider with angelina joly They didn't really take any creative license angelina joly's a smoke show That was one of the requirements for tomb raider maker look great laura croft looks great angelina knocks it out of the park So there are some good case studies to be had for the most part though these games Usually get it very wrong these game movies They they cast a character that looks nothing like their counterpart set them in a Area that has nothing to do with the game The storyline is just completely all over the place Or they just pander so hard to their audience on social media before the movie even comes out That they've made up their mind about the film. Yes, this movie was made for me And not for regular moviegoers. So i'm going to alienate them I'm going to make them feel dumb or i'm going to make them feel Less worthy to go watch this you should want more people to go to the movie to celebrate what you like So that you get more of it Of course five nights at freddy's i think did pretty damn well because again It's based on a popular v8 video game franchise and the trailers looked really good that said I have a hard time believing a lot of the people will go back for a sequel I know if i wasn't a movie critic who goes out and sees everything to review it I would not go to a sequel for five nights at freddy's based on what i saw It didn't draw me in Great it's by the the same company the same studio that made megan. All right Megan was actually great and that was also pg 13 So that can't be an excuse either you can make it work with the rating You just have to put in the work and not get so lost in What fandom you're trying to appeal to? Make the good movie the fans will follow All right, I don't need to make this any longer than it needs to be hope you enjoyed the conversation Hope you got something out of it Where are you where are you at on this? I do you agree do you think? Hey, maybe if you make a movie it should stand on its own You shouldn't be required to have to read a book or play some of the video games to understand the movie It should be able to present itself the characters and everything it's trying to do as its own medium because that's what it is Or Do you think no adam you you should you should know all this stuff going in it's your job now To go I can't even get through it. No one should think that that's insane That's absolutely insane All right, thanks for watching leave a comment if you like the video if you have any thoughts on this Or if you've run into this In your own day to day with people debating Video game movies books, you know that come from movies Movies that come from books. I can't talk. It's it's getting late when I'm recording Let me know if you haven't please think about subscribing to the channel the podcast on spotify Apple podcasts and other podcasting services trying to grow them over there You're free to watch and listen on youtube, of course too. That's where I primarily post all my stuff But I am putting the live streams out on the podcast as well So you have more to listen to every single week when you're driving or you're doing ever whatever you're doing playing a video game Playing a video gaming listen to me. It's a win-win. All right. Thanks very much and hopefully I'll catch you next time. Take care


My name is Paola Di Natale. I'm 35 years old and I'm Italian. My current job is a software engineer. As a software engineer, I design and planning information technology solution that translates business requirements into technical tasks and I follow agile methodology and I build high quality and effective software products that deliver real business in the shortest time. Every day is quite different, but there is also several aspects that happen every day. Daily I translate the requirement into technical tasks and assign the tasks to the most appropriate person of the team based on these or our attitude and expertise and shake validate the code committed by the other engineer of the team. I start my PhD in another field. So at that time I need money to pay my degree. My parent couldn't afford this expense. I have a lot of friends of mine that was working on IT. So I decided to attend this course and after a few months I do my first job interview with a company that they hired me. And that experience gave me the chance to grow up like a developer. Honestly say that I'm not expecting that these became so interesting. So it's something very innovative and from position for the innovation and digitalization that is something very important today. I really suggest everyone to give a chance to this type of job. You can imagine that maybe the more difficult that you can find is to learn something new. It's not true because we have a lot of course and peer-to-peer occasion to learn. The main difficult maybe in my whole company not in this currently it was that my team was with only male and Italian. Someday I feel that I cannot share my real version of me. I saw that more and more girls and women are involved in this field and really we need because it's not true that is a male job. Probably the most difficult part is to have the right team. A message for young women that want to apply to this job to have faith in the process of change. This is a work very innovative and you have to find the courage to do new things. There is other words and other realities that you don't know and it's right to invest in new experience without having the fear to invest your energy and effort to learn new skills. For suggestion there is a lot of peer-to-peer learning course and free open source course that you can really have the chance to attend. So even for women difficult in this field I would recommend that to attend this course because they could really have a positive change in their life. So it could be a great experience for them.


July is going to be hotter than ever because you get up to $50 off any smartphone at Appalachian Wireless to your agreement required. Better service, bigger savings, that's today's Appalachian Wireless, an East Kentucky network company. With temperatures on the rise, there are ways to beat the heat. Drink plenty of water, take a swim, stay indoors in the air conditioning if it's available to you. And being mindful of yourself and others, and being fashionable, are also ways to beat the heat. Drink plenty of water, make sure you drink plenty of water, if you're going to go outside in the hot sun, we said the buddy system, wear light, loose fit clothing, lights, yellows, that sort of thing, you can stay away from darker stuff.  For many, work outside in the heat is unavoidable, but for those with an option to put the work off, be it the day job, or work in the yard or the garage, the evening is the best time to work during the summer heat. Less work in the morning, if you have to, kind of wait it out to the day, yeah, just basic stuff, you know, just take care of yourself. There are those who are more at risk than others during the summer months. In the conclusion to this series of reports on the dangers of the summer heat, we'll take a look at who is the most vulnerable, the elderly and infants, when it comes to high temperatures. In Pikeville, Chris Anderson, EKB News.


Hola, me llamo Doug, hablo un poquito español, so that's about the extent you'll hear of it in this presentation. So this is I Want It All and I Want It Now, Configuration Management and CEI.  No, I won't actually, so if you want to leave, hopefully you're in the right spot. I'll go ahead and start with a little bit about myself. Like I said, I'm Doug Dobertsonsky. I am Build Manager and a Drupal developer at Promet Source. We're based out of Chicago, Illinois in the United States. In the past, I actually got started with Drupal at the university I attended, where I actually became the Student Manager of the Web Help Desk, taking care of hiring students, ticketing, managing all that allocation, the workflow. It started out with me begging for help because I alone as a student could not be the Web Help Desk, growing it to at one point having eight other students working under me. I've actually made websites though since fifth grade. Although you might think I major in CS, computer science, I actually was a history major and a Russian central and Eastern European studies concentration. So it goes to show there are many paths to technology and Drupal, and it's more about passion and where you want to go. So I wanted to get a little bit of an idea of who you are first as an audience. So how many of you are developers? So most of you. How many of you are sys admins? So there's some overlap of roles. How many are project managers? Some more overlap, not uncommon. And how many are upper management or in more leadership roles? Several more as well. So a fairly good mix with a lot of overlap, which will be very good I think you'll find. So I wanted to start by saying why does this topic even matter? Why does configuration management and CI important? So how many have played the what's on staging? What's on the production? Who knows game? How many of you have been in that situation? Trying to figure out what's on production versus staging versus in development. So several. How many have had times where you've had to play deployment roulette? Oh, it worked this time on production. Worked this time up. This deployment blew up. Any of you experiencing that? Couple more as well. How many have had or heard or said, but it worked on my machine? So that's that's a lot more common. And how many have played the what was fixed at one point game? So several more as now. I think throughout those most, if not all of your hands went up, this is why this matters. This is why configuration and CI matters to help deal and hopefully alleviate these problems or at the very least reduce them. So I want to get started with a little bit more theory to think about what it is. So let's start with configuration management. Here's one definition. Configuration management is a critical cornerstone of IT automation, providing tools that allow you to centrally manage the packages, configuration files, process state, firewall rules, and other settings that equip servers to do their assigned jobs. Configuration management is the management of configuration items, which are the things that you care about, but things that are essential for delivering an automated business service. Configuration management is unique identification, controlled storage, change control and status reporting of selected intermediate work products, product components, and products during the life of a system. With IEEE, Institute of Electronics Engineers, and way back in 1987, and their guide to software configuration management actually included these four components, identification, control, status accounting, and audit review. So this isn't a new concept. Whatever configuration management, SCM, or just plain CM configuration management is any organizational framework that is a discipline for managing the evolution of computer systems through all stages of systems development. Okay, who's confused? Anyone in here confused because I am, and I'm supposed to be talking about this? As you can see, there's some debate and variation over exactly what configuration management is. If you decide to take on configuration management as a company, this is something that you will have to think about. What does configuration management mean to us? Come to an agreed upon definition so that you're all talking about the same thing, and maybe identify certain parts of it that are important or more important to your business aspect. So for our intents and purposes, I'm going to define it as setup of the infrastructure used in order to get your software from the beginning, that is from programmers and developers to the end, that is the customers. I think it's really important in there to define it not as just the infrastructure setup, but why are you setting up that infrastructure? It's your ultimate goal so that you don't forget where you're going, and are blindly going down a path and then say, oh, maybe this isn't exactly what we wanted. It's always good to keep that endpoint in mind that you need to deliver a product that developers may have pieces of the code, and somehow you need to get that together and out to the client and be able to have that consistent. So why should I even adopt CM? The beginning questions where everyone almost ended up raising their hands thinking about those scenarios are part of the reason. Puppet Labs actually outlines three reasons for CM. Not automating configuration management causes pain. So if you look at this as setting up servers, if someone's going in and manually setting up your servers, all your VMs, it's going to take time. They'll probably forget something. If they're setting up, say, supposed to set up five servers by tomorrow, chances are the developers or the client is going to go to use that server the next day and something will be missing, something will not be working. It might be, oh, we forgot to set up DNS on this. So the package installs actually failed. Or oh, we forgot a package. Then you have to go back. If it's gone to your client and you didn't even catch that, that's embarrassing. Your client's not going to be happy. It's frustrating for developers who say, OK, here's all the work. Let's push this out to a QA server and now it doesn't work. They can't push it out. Now QA's delayed. The project manager is probably going to start worrying, say, oh, we have this much time to do QA, but we don't have somewhere to QA in it, when this is going to happen now. Relatedly, everyone benefits from automated configuration manager. The clients don't go to a server and find errors. If you're setting up a server for the client's technical person to use, they don't go in then and find issues with it. Your developers are able to push more consistently without issues. QA can get it somewhere where they can actually QA. It makes people happier. And in that process, it saves time and gives you time to do other things that you want to do. Now you can work on improvements and innovations. Now what maybe took hours or maybe even days to set up X servers, you can automate, get done in half a day. Now you time to say, oh, what else can we do? What can we do to improve our company? What can we do to be even better? And you can deliver things faster to your client. So what are some tools out there? I'm not going to go into a lot of depth in this, but puppet, chef, ansible, and salt stack are probably the four that you'll hear most often. I tried to find some metrics in relation in the Drupal community to how these were used. Didn't have much luck. So I searched any community, just what are some metrics on the use of these, which are most popular? And the bottom line is metrics are hard. I won't go into details on how it's measured. Do you measure downloads? Do you measure insoles? How do you measure that? Do you trust people to report? How do you get enough people to report to get a good picture? There's an article that I'll link to, a blog post on some of these challenges of getting metrics on which configuration management systems are out there. But some of the four ones that you'll want to look at, puppet, chef, ansible, salt stack, I can say from anecdotal experience from what I've seen and talking to people within the Drupal community, puppet and chef are probably the most common. So then it becomes a question of, which do you use? These are questions that have been asked before, and there are some pretty good answers out there, so I'm going to just share a couple of them. So this comes from a blog post on just puppet versus chef. If you want to get into some really interesting debate, just Google puppet versus chef, and you can go down a mine hall of information and comments. But one of them ultimately concluded, if you have time to try them both, then do. It's a bit of a case of horses for courses, and you may be surprised. Doing one is light years better than doing neither. So if you're agonizing over the decision, just stop, toss a coin, and get going today. Bottom line, something is better than nothing. Similarly in a book, taste test that compares all four that I mentioned, Matt Jane says, just using any of these tools is a huge win. Being scripted, documented, replicatable servers can speed up your development and operations dramatically. So ideally you would want to pick probably a couple.  We're going to implement this to this state on this project by this day using no more than this hours. And see how far you can get with that. You may get there, you may not, but it'll give you a good idea. It may be this isn't the right tool for us. It might be maybe this is more than we can chew off in this time. It might be maybe we don't have the resources to do this. So moving on then from CI, starting again back with the theory, what the heck is CI even? When talking about CI, of course you have to look at Martin Fowler's blog post on CI. So Martin Fowler defines CI as a software development practice where members of a team integrate their work frequently. Usually each person integrates at least daily, leading to multiple integrations per day. Each integration is verified by an automated build including tests to detect integration errors as quickly as possible. So let's go ahead and break that down a little bit more. There are only four aspects required for CI, version control, build script, some sort of feedback mechanism, and a process for integrating source code. Basically you're going to want your items, your configuration, your development into a version control repository. A single version control repository. I want to add we were, I was explaining this to someone, and like, yeah, we have that first step met. I'm like, okay, point me to your version control repository. And they're like, well, it's on every developer's computer. Using a single version control repository isn't the same as using version control, you're using a version control system individually. Using it individually, every single developer could track changes they made. And they could say, yeah, I made these changes. I made these changes. I made these changes. But there's no way to track what's being merged. And at that point the project managers, when they're trying to get a picture of what's done or what changed, or you're trying to debug what might have happened, whether the changes in this time frame, it's going to take a lot of time to get your developers to report that. You might run into then, well, I'll leave out this one detail because it doesn't seem important and it's embarrassing. And it might turn out that's the one detail you needed. So you want to have a single version repository, the master where you know this is where everything's going. This is the state that we can use. You're going to want to have a build script, some way to create your system. In this case, once you have a server setup, you're going to want to get Drupal, get it installed, get the right modules enabled. If you're maybe doing updates and changes, you're going to want to get all those changes applied. And you're going to want to script that. You don't want to have to go in and say, okay, I need this change, this change, this change, oh, this change requires I could go into the UI and change all of these pieces. You're going to want to automate that so that A, you don't miss pieces. It's more reliable that way. And B, it saves time. You have that automation once, you run it. Feedback mechanism. When you're doing tests, you want some way to know tests failed. When you integrate the code, say whether it's on after GitHub or if you have an integration server, you want to know when those are failing. So if someone's code that they're trying to merge in has issues with code that already exists, you want to know when that's going to fail. Ideally, you want to send that out in some way, whether it be email, a text message, a notification in a chat, you'll want to think about what are the best mechanisms to get this out and who do I want to get this out to. One thing to be really careful in your feedback mechanisms is information overload. How many of you get GitHub notifications for every single project? Or notifications for every single ticket updated, even if you were the one who made that change? What happens when you get those email notifications and you just see a ton of them? You don't see them. They disappear. So you want to find the right amount. It's probably not a good idea to send if tests are failing. All the time for every individual developer's PRs, you might not want to send that out to all developers because they're going to start seeing, not me, not me, not me, not me. I don't need to pay attention. There's one there that I didn't see that was me. There's another one that was me, but none of the first ones were me. So I'm not going to pay attention. You're defeating your purpose of getting feedback fast. And you want that process for integrating your code, making sure there aren't conflicting changes, making sure that when you put all of the different pieces together, they fit and don't break. Martin Fowler goes into a lot more depth, into some practices. These entail the pieces that I talked about. And you'll see a lot of the same items here. So like I mentioned, you want that single source repository. You want to automate the build, automate tests. You want frequent integration. Your developers, ideally, should be making daily commits and pushing these. And then all those commits should be merged together, say, on an integration machine. If you're looking at cases where developers do not commit daily and pushing that, that could be one of two things usually. There's probably an edge case that I'm not thinking of. But it's either, A, they're doing a ton of work. And in three days, they're going to push eight new features. Or the tasks are too big. They're either too big or too complex. And there's some problem there. You might need to break it up into a smaller piece. It's easier to complete and test a smaller piece. And it might also be that what they're running into actually is something that's really complex. Maybe it's a bug that needs to be, could take way more time. And it's raising a red flag, hey, this probably is going to affect our timeline. We're supposed to have this one piece of functionality done, and it's not coming. So if you are expecting daily commits, frequent pushes, and all of a sudden those slow down, that's a good sign that something's not right. And raises these red flags in the project earlier rather than finding out later. Yeah, I'm doing work. Yeah, I'm doing work. So wait, what were you actually doing the past four weeks? Which can put project managers and technical leads in a really tough spot. Another key item is if the build breaks, fix it immediately. If it's an integration where there are multiple people working on the code, it's probably good to stop work and get together and resolve that. In fact, you actually should do that. You shouldn't continue work while the integration build is broken. Because that means you're working against something that's broken. And when it gets fixed, you may have to go back and change what you implemented, whether it's a new feature, bug fix, or you may break the build again and have to spend more time fixing the build. If it's someone who, if you're running, say, tests on every PR and it breaks the build, then that person should go back and look at their PRC, what did I do to break the build? The other thing is you'll want to keep the build fast. Projects get complex, so you may find that you have to break this up. Look at different ways, whether it's throwing more resources at it or not running all the tests all the time. I was working on a project where we were running Travis CI with a bunch of tests, and it was a huge project. We were building the site from scratch all the time.  And it got to where it was taking 30 to 40 minutes. That's too long for a single person. It's slowing down your rapid feedback time. And then you may say, okay, I completed this task. And before you can even get it to say development initially, where someone can take a look at it, you're waiting maybe 40 minutes for a two line fix that maybe you didn't have to run all these tests on just the PR. You'll want to work in a clone of production. This should be fairly standard practice now. You don't want to work in an environment that's not like production. This becomes especially important on staging or pre-prod. Wherever your clients are looking at it and approving, you want that to match production. You don't want to push to production and then find out, oh, maybe there was this one difference that was important. Like I've hit on before, you want reports and transparencies. So ideally you would be able to say exactly these changes were pushed to the integration server at this point. These are the state changes that are on staging right now. These are the differences from this time to this time. Here are the tests that are failing. Look, developer B's tests fail every single time. Maybe we should look at this and it's going to improve your process. You can get feedback for helping your developers, improving that. You can save time because your project manager doesn't have to come every single day maybe multiple times and say, what's on staging? What's on development? What's done? What's not done? And then another key that you'll probably see over and over is automate your deployment. Ideally, you want to get where you can say maybe dev is built automatically when code is merged into the main line. At this point, it's cut a release and we say deploy staging with this version. Then you can say, deploy that version that's on staging to production. And the goal is to get to a one step deployment with as much automation as you can. So hopefully you should have some answers right now to why should I even adopt CI, reduce your risks, you catch errors sooner. There's less chance of these errors making it to production and your client calling and saying, why isn't this right? It also reduces repetitive manual processes. This saves time.  They can work on other more valuable tasks. You can generate deployable software at any time and any place. So you shouldn't have to wait to get software out. You should be able to say, OK, this is good to go. We're going to deploy it. Obviously going through approval channels. You have that QA done, a lot of QA done ahead of time. It enables better project visibility. You know when things are breaking. You know when you break things unintentionally. To have one example of project visibility, I actually was working on one page or one specific view. And that was used on a few sections of the site. And I push it. And all of a sudden, our home page tests are breaking. Every single landing page test is breaking. This affected one section. These other parts shouldn't be breaking. If you had QA done, hopefully you would have had a thorough enough manual QA process, if you're still doing that, to check other areas of the site, not just what work was being done. But this was no time other than to write these tests initially. I know everything's breaking. This saved us embarrassment. We didn't even get it to development or QA. I saw that I broke the build. I went back and looked and said, oh, I only used one equal sign instead of two and set the view name on every single page. So this is an example of something that could have been really embarrassing. If this were a hot fix and we're pushing this one thing, you want this to production rapidly. You go through QA. Your QA person looks at the pages that's on. Doesn't look at any other pages. You push it to a reduction. Your client's not going to be very happy if half their site breaks. And that's feedback. I get the notification that I broke the build. I go and fix it. It's only me. I'm the only one looking at it. It saves these time from other people. And I know automatically without having to go and QA first, which is something I would say probably not a lot of developers are fans of. And as that example shows, you can establish greater confidence in your software product from your development team. When you have these tests in place, you can know this didn't break all these other things that we're testing. And we didn't even have to look at this manually. You can say with a much greater chance, my changes aren't going to affect other places or break unintended things. So what are some tools out there? There are a ton of CI tools out there. There's also, you can get into continuous delivery and deployment tools. These are probably some of the more well-known ones and more used tools. There's Travis CI, Jenkins, Bamboo, Hudson, Cruise Control. If you want to know even more, I strongly suggest looking at the Wikipedia page. They have a fairly good comparison, at least as a starting point of these are all the tools out there. And it's huge. So now let's take a step back a little. You may be asking, why did we go through all this theory? Why did we go through all this justification? Isn't this supposed to be you telling us how to do it? Yes and no. In a way, I am. Because this is what you have to go through as a company when you want to start building this culture of configuration management and CI. You have to define these aspects. Look at all the tools out there. Look at what do we want to accomplish? What's all the work it entails? Get people on the same page. You have to motivate people. There may be a project manager who's like, look, yes, that sounds all nice and fancy and cool and all that jazz. But I need my project. We don't have time to do this. And you can go through and give these justifications. Explain, this is why it matters. Yes, it may take more time upfront. Actually, it probably will take more time upfront, especially if you haven't done this as a company on any projects. But you can look at here's what it offers. I can offer you greater assurance that my code, that my changes didn't break the front page.  So you're saving resources on that project. If you haven't noticed, it's a lot more about just the tools that you use, or maybe the process that your developers implement. I've seen cases where they say, hey, developer A, sysadmin A, work together, makes CI happen. No other company involvement? You can probably guess it doesn't always go so well. It's something that you really need to build up as a culture and as a practice, and get everyone on board to know why this is important, and to help hold each other accountable and help each other. If you have other people working with you as well that are supportive, it's a lot better than pounding away at it as a single person and saying, I'm running into this problem. I'm not making much progress, or I'm doing all this cool stuff, and I'm helping, and nobody else cares. All of a sudden, that person starts getting unhappy. They become frustrated, and they leave. So like I just said, in probably the book on continuous integration called Continuous Integration, Improving Software Callity and Reducing Risk, CI is not just a technical implementation. It is also an organizational and cultural implementation. People often resist change, and the best approach for an organization may be to add these automated mechanisms to the process piece by piece. So this leads into my advice for you. Advice to think about as you're looking at using Configuration Management and CI. I kept it actually really simple, and I have found that you can get overwhelmed in a lot of it, which is kind of ironic and maybe hypocritical that I threw all this theory at you and probably overwhelmed some of you, but the key is start somewhere. Look at one piece you can do and say, oh, this is something we can do now. Hey, we hired this new person who knows Chef. Let's have them use Chef to configure all of our servers. Talk about it. Get other people involved. Like I've hit on, it's not just about the tools that you're using. It's not just about the technical aspects. It's about culture and people communicating and building that trust and getting it going as a company. It's not just a few people doing CI. Make it a priority. This should probably be an obvious one, but it's something that takes time and dedication. If you say, okay, yeah, we'll use CI. It's probably not going to happen. I used make very importantly here. It's important not just to say, yes, this is a priority. There's work involved in making it a priority. Maybe you have to take on some less work to have some more time to implement this. Maybe you bring on another resource. You have to take action as well to get this started, get this implemented. Making it priority also means involving other people and getting them the time. It's probably not going to go very well if you throw this on one person and say, you have X hours to make this happen. Relatedly, allow time. Not just time as in priority for people to do it, but time for this to come. Don't expect that silver magic bullet. It's going to not happen at once. You may start making small incremental improvements. There's a lot to do. There's a lot of things you can go. You may look at, this is where I want to be down the line and lose sight of what you're actually doing. You can say, I want to be all the way in California when it's sunny. If you're aware of Chicago weather, it's snowy. I'm missing the fact that, hey, the sidewalks are cleaned now. If you don't forget that, it takes time for the weather, for things to change. One way you can get started that Promet's actually worked on is what we've called the Drupal 7 framework. It's an easy way to start a Drupal project, what we've dubbed the Promet way. It's by no means the only way. It's a way that we've started using. Working locally to get started, you'll have to have Composer, but once you have Composer, it is two steps, two commands to get a working installation of Drupal. You use Composer, create project, Promet's slash Drupal 7 framework pointing to the GitHub repo, and then your project name. That will get all of Drupal and several modules that are fairly common on every project, including views, items like that.  With those two commands, you can have Drupal on your locally working, and you have several key modules you need. There's no need to go download Drupal, get a virtual machine, do all of that. I'm going to dive in a bit deeper into several pieces that the Drupal 7 framework pulls together. These are all open source tools that either exist in the community or we have built on or used. So we use what we're calling Drupal Tangler. This actually uses Composer to manage your dependencies and get all the files in the correct Drupal-e structure. So getting your modules and sites all modules, getting your themes and sites all themes. Nice thing with using Composer. How many actually have used Composer or are familiar? For those of you who haven't or have used Composer and do code reviews, have you ever had that instance where you're reviewing someone's code and they had to implement some functionality and it's maybe 10, 50 lines of code buried in five module files and you're trying to review that code.  How fun is it? How easy it is to review their work? Yeah, so there's a lot of grip, a lot of flying. It's difficult. It takes a long time. By using Composer to manage your dependencies, you have one line that you have to change or one line that you add to say, I want to add this module and your composer.json and then you also modify the composer.lock which locks the dependencies, the versions, the hashes used. The nice thing is GitHub hides the lock file. So all you see is that one line change and then all of their change. So it makes it a lot easier for review. It also makes it a lot easier because now you don't have to go and download all these modules. It's also much better for version constraints. How many have taken on, say, a support project saw that all their modules were outdated, done updates, and then find out, oh, they actually didn't want to update that one module. This can help you on that because you can say, use this very specific version or only use minor releases. And then you can look and say, oh, this is pinned to version 7.x.1.2. There's a reason it's pinned to that. It saves you time there. It makes updating a lot easier. You can see what changed from version to version in one file or looking at the composer.lock file. It uses Drupal libraries and Solr plugin to get libraries that you may need and place those into sites all libraries. We use Drupal settings compile to load configuration from an arbitrary directory on a server instead of templating settings.php or versioning database configuration. We use Drupal.ship, which actually uses a fork of KraftWagen manifest to create a reusable deployment, compose a manifest. Is anyone in here familiar with manifest? KraftWagen manifest? It's actually really hard to find a good definition of KraftWagen manifest. The goal of KraftWagen manifest is to provide an independent deployment, a deployment that has the same results every time. But you basically define a manifest, name it, give it some information, and then you define what that manifest does. So the way we use manifest, one that's a really good way, is items that might configuration that might be different on development servers or locally versus production. So one good example of this would be commerce settings. You want to make sure that you are always using the production, the live commerce client on production. You do not want to accidentally change that back to dev and maybe cost them thousands of dollars. So this defines a KraftWagen manifest using environment variables to make sure that those settings are always right on every deployment on production. Relately it makes sure then that once you define them that it sets up test settings on development staging, development integration server as well as locally. My advice is if you start doing this, if you look closer there's a default and file which you can copy and then override. Set your defaults to non-production settings. That will save you a lot of time and it's generally a safer thing to do. You can also use it to say, configure how do we handle email on development settings. You don't want to actually be sending emails when you're testing. This is something that we've learned the hard way that you'd think would be something every developer would set up. I set up development environment. This site sends emails. Maybe we shouldn't send emails to everyone on the college campus with an email address when we're testing the email send function. If you want to learn more about it, there's a whole blog series that we have. Actually right about that time I want to make sure we have some time for questions. Have you noticed that there's been a lot of presentations and activity around Ansible in the Drupal community more lately? There's been a book written that includes Drupal playbooks and stuff like that. I agree that if someone in the group knows Chef or whatever, start where you can and that's it. It doesn't matter really. But Ansible seems to be a much easier approach. I don't know if you agree with that or not. Anyway, to discuss. I have noticed that it is becoming more popular. I haven't worked with it. We've used Chef since that's what we have done and what we've known. And sometimes your reason for using something maybe. That's why. Any other questions, thoughts? When you want to talk to your manager into getting into this and convincing them, it's not very easy to just convince them with your words unless you have enough power to do that. What I think may be very useful is to know worst cases or bad cases that have happened. Do you know of any of particular interest in the situation? In that case, you can just prepare a very detailed argumentation of why you are proposing going with this methodology, which is the right thing, of course. That's a really big question. Before it's gone manual, I can actually give one example and then I'll have Andy give another. So in the very, very early stages with just using build scripts, nothing nearly this complex. Everything needs to be encoded. We use a build script to get the correct settings on dev versus staging versus production. Someone decided that's too slow. We don't have time to make sure we define all these things. The client comes and is like, okay, we need to do updates. So we do updates and their whole site breaks. And even worse, we were getting inconsistent results. So sometimes it would take one action and sometimes it would do something else. And we ended up finding one thing that was breaking, which actually was the home page, was happening once every 10 times. And this was because he decided we aren't going to use a build script. We aren't going to make sure we're defining releases and have a proper channel for QA. It's client wants us on staging to review now, so go in and cherry pick some stuff and only that developer knows.  And in the process, I found out that there was missing work. So I don't know if that's not an argument for process. One example. Andy, do you have another? Yeah, so Dougie and I work together. If you guys, one argument that we had for it, we actually had one of those projects that was pretty risky. It had a very tight timeline. It had two teams, both client, a very large client team and a PROMAC team working together. And it had like a drop-dead deadline with a very complex e-commerce build. And we decided to add the extra time to build test cases for every single feature, for every single item. Yeah, in the beginning it was a little frustrating because everything took a little bit longer. But in the last month of that project, when you had 20 developers working on this thing and they had to run to build themselves to make sure that things didn't break and that really saved our bacon. There's no way we would have been able to deliver if every one of the developers didn't have to build this thing from scratch. Make sure it runs on a machine before it could deploy it and make a test running all the test cases. So yes, it did take longer, but when you're working on larger teams, it does save your bacon. So there's one case for it. Any other questions, thoughts? Demo? Do you guys want to see a demo here? So we'll see how this goes since this is completely for Andy's humor. So like I said, this is all open source. So I'm going to go ahead and find that command just to save my typing time. So we'll see how this goes. So just doing Composer, create project. That's the path to the repository on GitHub. And I'm going to call it Drupalcon and we'll see if it'll actually go. And it looks... my internet. So it looks like because I don't have internet, it's not going to go.  But I actually did do that in preparation debating doing the live demo. And it does work. It creates that directory in the folder that I was in with, in this case, Drupalcon as a name, has all the projects, RunBaggerNup, and there you go. It always fails in a live demo, especially when you don't, you know, prep it. So any other questions, thoughts? Okay. Yeah, that's the Wi-Fi, but unfortunately I can't show you the magic. So if there aren't any last questions, I'll go ahead and put up my contact I'm doberzins on Drupal. My Twitter handle is kind of long. I should figure out something better. But if you want, you can find these slides and all the links and resources in there. I'll be around at this time as well. I might have some business cards if you want to come up, chat about this, have more questions. Feel free to try this out. Check out Drupal 7 Framework, see if it's something that you like. Provide some feedback for us. Maybe there are some ways that we can improve it. We're happy to entertain those and work with the community as well. Thank you.