There's another elephant in the room and you raise it in your book Suicide in the workplace There was a scene in a very famous movie called Network by Sydney Lamette and had the the actor Australian actor Peter Finch And he said very famously I'm mad as hell and I'm not going to take it anymore and that became a catch-cry and it was a huge speech in depth and length and emotional commitment and His ability as an actor was boy. It was on show. He did it in one take They started to do a second take but they had to abandon it because he had heart problems We was getting too worked up. He and he had very serious heart problems and there he was at work over overextending his his physical abilities So thankfully they stopped shooting he ended up getting an Academy Award for that one take But he got it posthumously You could go on and talk about the the astounding irony of that particular workplace situation or you could talk about apocalypse now where Martin Sheen Legendarily when his character went mad at the end of the movie and he and he got accolades and awards for it But during the shooting of that they had to cut him off to hospital Of course in network the character shoots himself live on camera which was Considered overstating things a little bit by all the critics at the time and it was considered a black comedy until years later That very thing actually happened and Sidney Lumet and Patty Chayesky famously said at the time. This is not satire This is real life In your book, you have this amazing figure saying that somebody takes their own life every 40 Seconds around the world. That's an astounding statistic and whether it's 40 seconds or 40 minutes or once every 40 days You can't close the door after the horse's bolt. It's a classic case of too little too soon So what sort of research has been done about suicide in the workplace? The research on suicide in the workplace continues a Victorian study found that about 17% of the suicides in that state 17% were due to problems in workplace. So that's still very high. I mean 40 Suicide every 40 seconds around the world is huge Yet 80 75% to 80% of those are men so we have a huge problem with suicide and it may also aside and And you know one suicide is too many regardless of gender, but what can we do in the workplace? Obviously people are not happy You know, that is something that we get from people. They're not satisfied in the workplace And one of the reasons why they're not satisfied is because they they're not connecting with the purpose of their workplace and the workplace the purpose of their lives and a person with a purpose it's Like a ship without a rudder. It's it's Aimless it's not going anywhere and to be aimless for a human being is not a good thing Workplace is actually good for your mental health. I mean, you know, that's the irony It when we when we put a person with a mental health issue and in a work in work that is is Significant and it contributes back to the community that we see a better recovery overall So it's good for your mental health and yet if if you don't manage to connect to the values and the vision of the workplace On in your team, then you remain disengaged and that's when the danger starts because Suicide doesn't happen in community. It happens in isolation Suicide is decided in your head not in a collective And some people that suicide take a collective with them, but the decision is individual So we can do a lot in workplaces to turn that around as managers Is that's why I say mental wealth the book is a leadership book because it teaches managers how to lead their team So they're connected with with something meaningful one of the things that I see in in talking with so many organizations is that Sometimes there can be the attitude like if people have personal problems. They should leave that at home And if someone takes their life, well, it wasn't our risk. It wasn't our fault and it wasn't our responsibility And and that's right ultimately, you know, people take actions themselves Having said that there's still an impact on the business. So when we go around and we and deliver training Internationally one of the questions will often ask is, you know, just for a show of hands how many people know someone who has taken their life and You'll normally get seventy five eighty percent of the room say yes I know someone and yet it's something we don't talk about every day So all of not just the person who's taken their life, but all of their colleagues are going to be impacted as well So it's quite common for us to hear from organizations who perhaps have delayed You know doing anything in the space of mental health and then they contact us and say oh We we wish we'd come to you sooner because now we've had to shut down operations for Days weeks months sometimes because everybody's reacting to this incident that's happened, you know And and we don't know we're out of our depth. We don't know really how to handle this We like to keep our boxes of work is here and home is separate, but in reality people are like that They do they impact on each other So you've got to look at the whole person a whole employee and it's not just frontline It's can be very high-level people as well that yeah and talking about an employee Just every single individual how much responsibility do they have to take do we have to take as people? For our own workplace mental health a hundred percent I I believe that um no one cares about your life as much as you do period now Are they caring people around us that we can act we can we can Connect with and they can help us. Absolutely. They're there. Do they care a hundred percent about your life? They do but they can only care as much as you let them So that's an important thing I see a lot of emphasis on stopping suicide I think that's the wrong focus what we need to focus is how do we connect with people? How do we make people happy so happy?  It's not the problem. It's a very fatal But you know the problem is people are not happy connected people happy people don't want to kill themselves So that's why we're going to go back. We've got to go back to the basics And this is why I like workplaces workplaces sure they're artificial We come together in an artificial way, but they're highly social workplaces We can we in in some workplaces. I've seen them operate almost like a family. They can't wait to go to work I've seen most workplaces that doesn't happen But you know in some teams they love each other they they're there for each other They've got each other's back And how do you create that and that's that's always changing as well Because there will be that group dynamic will shift and people will come and people will leave and then that can And it's up to the manager to sustain that To know how to talk to people to know when to talk to people to know what to say to what not to say What to do because sometimes people won't talk but they'll do Okay, so how much can a workplace Actually support a team member who's suffering mental health. How far can they go? That's a good question. And that's one that a lot of the managers have as well And it's it's really important that they know the limits of their capability as well We're not upskilling people to be counselors or Psychologists or therapists or anything like that even though some of them might like to go that far We can see that can be counterproductive as well So it's really important. They know where that line is and that's things like identifying it in the first place As a human being one person to another having a conversation and showing care showing compassion as you spoke about earlier Showing empathy Sharing information about you know, what are some of the options because it's not just One size fits all solution when it comes to mental health, you know, everyone's situation is so completely different You know what works for one person may not work for someone else So managers need to be really careful that they're not giving advice Or you know what worked for me But that they're opening up a conversation and and allowing the person to go and get the support they need from wherever they need it But they're and they're they're on the side as a a go-to person If if there's anything here in the workplace that that may I may be able to assist with Can't promise the world. I can't do everything But I'm here and we'll talk about it and let's keep that line of communication open And it's amazing what people are able to do when we feel supported You know just to know someone's got our back That sometimes that's all that is needed, you know for that little bit extra energy And that's that's what we're talking about sometimes, you know that that energy to climb out of a hole And sometimes guess what once they find out that somebody has got their back They find out there was no hole to begin with They just had this idea in their head That's what we find with conflict when people get to talk to each other they realize oh Oh, so you didn't mean that. Oh, right. Okay. So I've wasted two days of my life Making this huge problem in my head that has disappeared by a two minute conversation So we teach people how to have that conversation in the book as well


पवास्ल्मुचकी, अन और संप जाडाता, अपूर्च्रेटना नहीं जाडाता। जाडाती। मिहोर्च्रेट दीता। तो Most Help is your query which you asked earlier, can we have a separate rate, separate methods for one organization, this is the example of reliance, your query was, is it allowed, for fixed assets they are using WDV, but for credential SLF, for one more asset 100% depreciation in first year. 100% depreciation in first year for another one its life is more SLM even one organization can have a separate race can have a separate useful life can have a separate method allowed it law or AS never never stops I will pick up the major major issues second one point came to me which was a very good point automatic care absolutely sir notes to account is very good sir even accounting policies you can specify yes certainly sir certainly sir there was one good query sir let suppose we have given an advance to a supplier CPWD this is known as your capital advance of 100 rupees logically your bank must have decreased banded your payment so guaranteed from here it must have been 100 minus yes two query which was asked they were good points now the question was from which date we should transfer this to capital working progress which advance from which date we should start putting in CWIP and from which date we should charge to fix asset logically very simple advance even we do it at our home also if we have given the advance unless a person has started the work we don't capitalise it when after one year two years he will give you a certificate then you transfer to CWIP then there was a query sir how we can say how much work has been completed clearly given in year 7 construction contracts it says if you cannot calculate the actual cost but you have given the advance logically first he will be using your advance to create the asset and if the project is for let's say 10 month and you have given the advance on let's assume 1st November 05 then by 31st March 06 you have your 5 months 5 months out of 10 months have been used logically you will go to the site if substantial work has been done on time basis 5 by 10 at least we can assume at 50% work has been completed 50% co-op advance remove you can transfer to CWIP sir I agree the same thing I raised it I said CPWOD whatever it is they must be giving a certificate in that they must be writing how much work has been done if let's suppose even it is not available then this method is for mishable under ASM it means now if I prepare a balance sheet on 31st March 06 I will write CPWOD advance 50% and CWIP capital work in progress 50% and when it is ready it will transfer to fixed asset yes sir please very good sir 100% work done account sir me I agree if 100% work has been done they must be issuing some certificate to you know sir if 100% how would you say 100% work is done CPWOD is done right sir you should know that what work has been done sir please auditor account and never goes by the intuition they always go by the paper I know that I will be getting a property useless sir please even accounts takes time balance sheet is prepared by me but you still prepare your balance sheet you travel by my 31st March right accounts may be rendered later but if they have given a certificate that 100% work is completed right it means immediately how much cost has been incurred will be guaranteed immediately that cost you can transfer to CPWOD when it sir I am not saying CWIP when they issue the clearance certificate CWIP means the work in progress in CPWOD that may be the building right and when you they issue you the clearance certificate then you transfer entire CWIP to fixed asset I know even 100% work done sir but sir normal as of the clearance you cannot start sir it happens in lot of pollution plants everywhere plant is ready right but until unless you get a clearance you cannot execute your plant you cannot car you purchase it until car is transferred in your name you can never run the car on your road you run it but if you get stuck you will be charged apparently new car means when you do not get a number plate you always put a piece of paper as a number 1 clearance similarly you cannot charge it never next the good point which was asked here this I am raising to you guys I will not explain this it's a query which was asked let's suppose a grant is received for 1.4 crores this is a grant and asset has been purchased for 2 crores and the balance sheet already has let's say 10 crores the query is how to treat this how you guys are doing it right now we have also discussed before the break chocolates are waiting and after the lunch the desert was not as good so you can have good chocolates here yes sir in balance sheet 2 crores as of 8 crores you are explaining gross or net yes gross gross approach ok asset 2 crores sir right then yes ma'am bank will reduced by is 0.6 0.6 crores bank will decrease by 0.6 perfect ma'am now what balance sheet has not been matched capital fund will be added by 1.4 but balance sheet is not telling no sir let's go step by let's go step by step it was a query from one of the institution bank opening 10 crores capital fund 10 crores and we have received a grant of 1.4 and 1.2 now ma'am tell me ma'am forget about acquisition first tell me the asset you are right chocolate is waiting bank amount will be reduced by 2 crores ok sir and asset will mentioned for 2 crores now balance is telling ok now what next step depreciation ok first if I am preparing this by net then you tell me the balance sheet we will charge 1.4 as depreciation ok full amount right it may just become 9.4 9.4 9.4 capital fund is 10 crores now net approach no no bank will be 10 think sir yes bank will be 10 ok and then depreciation will be on 0.6 on net approach the bank to 9.4 yes yes yes sorry assets right up together perfect perfect 0.6 and then depreciation perfect income expenditure depreciation on 0.6 let's suppose 10% I take it be cool together perfect this is a net approach perfect but if but their auditor objection to this what auditor is saying you have been following gross approach for all the assets this is the first time in your history that you are getting some partial grant partial grant not 100% and therefore you should follow a net approach for this then that institute was in confusion can we follow for some asset and for some asset net tell me yes or no I hope the question is clear no one stops you sir first of all no one stops you ok it means if gross has to be followed for everything gross ok otherwise reasons are please remember auditor you will have to give reasons same procedure should be followed either net or gross otherwise depreciation calculation will be affected so simplified I agree with your approach but no one stops first of all AS never says separate asset you can have a separate policy for it but I agree simplified approach so simplify it and put it all together sir the following procedure consistency should be there I agree I am not denigrated but it's a new asset so if the same thing has to be done for the gross who will tell who will tell the same thing for the gross bank 10 crores capital fund 10 crores again a chocolate pudding yes sir you got chocolate not you you got chocolate someone else same thing with the gross approach then sir grant 1.4 crore capital fund capital fund is a grant grant 1.4 crore right sir bank 1.4 crore perfect sir asset purchase 2 crore brilliant sir then asset 2 crore I am repeating this again and again because this is the major point where we get stuck I am taking lot of examples for this sir then sir bank reduced to 9.4 crore perfect sir perfect bank is 9.4 billion 11.4 crore and this capital fund is also 11.4 crore right it means my new balance sheet will have bank 9.4 asset 2 asset 2 perfect ma'am 10 then and grant 1.4 right now what sir then sir if depreciation charge then depreciation brilliant sir brilliant brilliant 10 percent sir 10 percent right sir point 2 point 2 depreciation right then it will be reduced sir from asset and from right capital fund the approach which you guys are following you are taking as deficit and subtracting it or what I mentioned to you then take it as a as a best way because it will classify separate point 2 grant billion perfectly fine sir another query and I am happy those queries are all related to AS6 or AS10 now tell me one more query there was a query that in 1961 let me take a calendar year easy in 1961 there was some building was purchased let's suppose for 100 for these years no depreciation has been charged now you want to show in your balance sheet this asset this asset is coming at 100 your capital fund is coming at 100 for these many years you have to charge a depreciation how to how that organization can do it legally and accounting wise yes sir ok sir ok sir ok sir and for the past period retrospectively we have to calculate the depreciation and the depreciation amount for the capital fund it means even if anyone has not charged the depreciation till date please there is no harm it will not affect your income expenditure reason income expenditure is for the year for the year you are not you are not charging depreciation of current year you are charging the depreciation of the previous years and therefore very simple first atleast if I forget about the current year till 2012 till 2012 if a depreciation rate is let's say 2% I am assuming 2% 102% is 2 rupees from 61 to 2012 how many years let me take a very simple 1% 51% if it is 2% it will not even show in your balance sheet asset will be removed no harm just in that year in that year in notes 1 accounts it will come no harm if it is 1% 51 years 51 rupees goes here 51 goes here for the current year asset is 49 and fund is 49 rate simple approach so there is no harm I am just responding to a query which was asked there were 2 or 3 institution which were asked this query there is no harm in that next is I am just raising major major points another point was this which was applicable to you which was asked by some people about revaluation it is again given in year 6 now understand what is written because again it is very important if your balance sheet is showing an asset of 100 let's say capital 100 and due to any reason any natural calamity what normally due to any natural calamity this asset this asset is destroyed now you cannot charge a normal depreciation not possible you have to immediately revalue your asset ream is repeat now let's suppose the new value the new value you will not write yourself you have to ask the value roads, buildings civil engineers are right persons civil engineers tell you what is the value let's suppose the value is this asset is 60 decrease by how much amount 40 a simple logic for that year your asset is decreased it is a loss your AS6 says AS6 says charge to P&L account there was one more query which was asked sir still I was surprised sir does AS applies to us why not why not I said yesterday even one transaction which is commercial nature ASR applicable and no organization does 100% charity atleast 1% transaction 1 transaction is commercial nature so ASR applicable so for that year 40 becomes your loss what you can do there is one more variation which can be possible because frankly speaking ASR is not applicable to you guys you can even reduce it from capital fund because ultimately income expenditure deficit goes to which capital fund nahi very good doubt aya what happens in case of net value in case of net value it will not even appear you will just showing the notes to accounts as I mentioned lot of people ask me during the break sir if we are following net approach then then one query was aren't we showing our balance sheet at a lower value please understand we organization are not supposed to make our balance sheet say label we are not selling our balance sheet second you can prepare a one note of fixed asset as a separate disclosure don't make an entry for that all the asset at the cost price write the depreciation show that these are the actual book values but actual book values are never same as the market value we all know it because in account we show as per historical cost market value might be different you can show it as a separate disclosure then there was a query about this in this if natural calamity rises nothing in the balance sheet sir just in notes that this is the worth you must have seen correct me where I am wrong there are lot of computers you have charged a depreciation 60% am I correct you have charged a depreciation 60% 60% means guaranteed in 3 years 4 years in your books computer will be almost like 0 isn't it but tell me honestly does that computer physically available in the institute or not available those are known as unrequited assets which physically exist but book value is 0 due to depreciation same here in this method in net method we are not saying physically available physically available but we are saying it has been 100% appreciated because it was funded by the government simple logic so I hope this given query was clear it may got point as a revaluation sir this is a decrease let's suppose it's a land this is a tricky point in AS it's a tricky point now if land gets increased let's suppose you want to increase the value of land market valuation and you want to show it at the higher value your board of governance says let's go for the revised value fair enough let's suppose 400 profit but tell me does that profit have you received from sale of land that you have sold the land accounts is very very clear everyone knows it prudence, conservatism never anticipate the profit is this profit in your pocket no they were very very clear any profit will not be taken open a separate reserve rr revaluation reserve you can even add revaluation reserve in your fund also so ultimately all the reserves are added to the funds so please this is a major part if you increase any value of the land immediately do this do this part so if increase over rr otherwise p&l income expenditure so this is an example for the revaluation which will be important for you if you want to copy, most welcome otherwise it will be given what are you doing sir, revaluation in their case, in Uttarakhand what has happened there were lot of buildings now that building has been destroyed right sir now the worth of the building is around 10 rupees or 20 rupees loss has come at loss you have to show it somewhere okay right sir either you can charge immediate income expenditure due to the natural calamity it comes at the debit side or if you are charging as a loss you have revised the value reason due to some reasons whenever admission is there, retirement is there when some person says let's bring it to the real market worth in that case sir, revaluation permission is around but the revaluation of land so we can do the revaluation of land almost every year sir, I have told you you are not doing it even law never says do the appreciation yes but what I have said if your board of governance is not there we want to show it on the market price we advise the board of governance to do revaluation revaluation we will show it on the reserve sir, it makes nothing is wrong reason if you see it here we are not showing any income no taxes imposed we are just getting a reserve and even this reserve is not in cash definitely not in cash in kind but the reserve will be too much like the land of old universities its value will be in few lakhs today it will be 1000 crores so if we do revaluation the reserve will be 2000 crores, 10000 crores it can be that much 40-50 thousand crores sir, you know that the reserve is increased by any amount till the time the reserves are always substantiated by the asset side definitely that will counter when there is no cash CA institute has also issued a guidance document on this on the revaluation of the assets they are very very clear this reserve cannot be used for any purpose sure it is just they have given it because you know it when a treatment has to be given in the document they have to take all the possibility you are saying it is not possible but it might be in an institute it comes on top you have to revise it and he says no we have to revise it is there any possibility it is possible I am not saying that it is legally wrong legally allowed what is the fault of the legalists I agree with your point that the reserves will be increased sir, I am not denying it particular I am from Allahabad Allahabad, Bombay etc these are old universities so our land will be 2-3 lakhs today it may cost 1000 crores 2000 crores in other universities result is much more no no no let me clear this word there will be one doubt sir account says historical cost I don't know sir I know your question sir wait wait no no no no let me just come to that point this is the definition of cost in ASX cost means historical cost or any amount substituted by historical cost it means actual purchased by after 5 years 6 years if you have re-valued or change it then logically it gets repaired in case of Uttarakhand ASX 28 applies impairment of the asset asset is impaired users of the asset if asset is impaired then logically you will replace historical cost with the new cost for this chair if both the legs are broken and you still show it as an asset it is useless it is the impairment of the asset impairment means useless asset you are taking our laboratory equipments there are lot of laboratory equipments computers which you know are available but their market words are not there impairment books you are talking about you know the books are obsolete immediately charge the entire loss but problem is I have not touched that point because ASX 28 was not here ASX 28 has made that there are lot of assets which sometimes are not market available market means no value still with you immediately remove it you can do it allowed but my point of discussion here was if anyone ask you to do it is it legally allowed or not legally it is this is the point sir I have totally understood I was knowing this point let's take one more thing I am just referring you there was one query depreciation rate options at present three options are available to you which I know one is income tax act please income tax act means not only to follow everything of income tax act you can only use the rate of the guidelines company's act and there is a national municipal valuation model which ministry of finance and urban urban has passed it central government this is a change in income tax act or company's act if you see at the last one unit of production method of depreciation is not permissible as per mc sir earlier but now it is permitted that 5000 point which I have mentioned to you I am not saying I know new okay new format may be given I am just sharing the knowledge earlier if you see companies act companies act only talks about depreciation rate of tangible assets but now they covered both tangible and tangible earlier there was a rates of tangible assets now just see it contains only the useful life of tangible assets does not prescribe the depreciation rates even they know it mca ministry of corporate is not a fool that they have removed the rate they were knowing that everyone was facing a trouble in this they were applying the rates assuming that rate applied to all the assets blindly whether it is 2% we are applying 2% all the furniture but logically it should be as per the life and useful life the person knows it for this useful life a very good question was asked during the break sir now as a accountant are we supposed to find out the useful life also of every asset see in the real life accountants are not supposed to do this this is a task to be done by the engineering department engineering department gives you yes these are the lives now you calculate the depreciation real life may a sara calculation we only do the calculation estimation we never do it estimation is always done by the valuation department always i have raised your point i hope income tax is a book of the point sir i have checked yesterday the rates of books in the income tax act they only talk about these clauses books owned by SSC caring on the profession is 100 books being the annual publication annual means every year they are charging 60% books are there than those covered by A is 100 so logically 4.75% i didn't get now you will check sir that was tough when old income tax rates are being revised every assessment year these rates have changed 2 or 3 years there was a separate block for books if you go through the block of asset concept where plant is a block the definition of plant says under the income tax act the plant includes books also so we are following that rate plant rate is 4.75% sir plant rate plant mean a lot of classifications single shift 4.75% never use it because books are never the concept of single shift so now there is a separate heading for books so now the rate suggest 100% 60% 100% that is also not acceptable 100% means in one year all my books will go that one saying that one saying whenever you go for this income tax rate only are the guidelines all are the guidelines please these are given we followed blindly you are right that is the reason companies act if you ask me I have taken a right approach see the life use take a decision if you feel it can be used for 4 years please start for 4 years or books useful life can never be one year 100% never as per the income tax act if you ask an academician academician they will say it will never because in academician almeera always you find books guaranteed now intangible asset many people were asking me specially in the engineering department I was asking 2 or 3 organizations you guys must be developing some software patents copyrights then I was asking whether those patents were in the name of the professor or in the name of the institute I was advised they are always in the name of the institute you remember it means like in 3 idiots also if you take an example when America last seen all the patents were in his name so when patent are clearly now given in AS26 the problem which was discussed was it is very tough to find out the cost it is very tough to find out the cost of the patent copyright trademark it is very very simply given in AS26 paragraph 44 AS26 paragraph 44 is clearly given it says if we have incurred expenditure on research research let's suppose 5 lakh rupees and that expenditure only the person who is doing a research will tell you he will have a proof his effort and from that research if a concrete item has been developed which is registered as a patent registered as a trademark then you immediately you immediately should record in the books if you are not recording take my words in writing record my words I am telling you day is not far behind when the auditor is going to comment if you are not recording because logically you must have incurred lot of expenditure if you have incurred expenditure then guarantee the money must have gone out it means you are charging entire money as a waste you are charging as expenditure which guaranteed somewhere in the future auditor will raise this point 100% take one more example if you guys are reading the newspaper last month there was in the news that state bank of India is selling the trademark of kingfisher airlines flying high flying high was a trademark they are selling a trademark it means the trademark must be registered in the balance sheet of kingfisher you take your time after the class go and check the balance sheet of infosys ran back see all the research companies they always show they always show the intangible asset because their major task is only the intangible part software IBM go and check IBM STL Apple iPhones because that's the research they are doing it kindly my advice will be intangible asset if you are not recording it start doing it income tax may not search to your point income tax may carried 25% will you believe AS26 AS26 talks about 3 to 5 years AS26 says this was the impairment which i was talking about for you your balance sheet if you write AS28 impairment perfectly fine no auditor can raise the objection if you read the second paragraph intangible asset below 25000 can be expense need not be capitalized and they use the word can be shall be or must be its advice the higher limit is prescribed to avoid detailed recording and amortization of minor items like software which are generally below 25000 and if you see the top one period of amortization will depend on the asset AS26 prescribes a presumption 10 years for the life of intangible however in case of item like software where technological advances will result in quicker loss a time frame of 3 to 5 years 3 to 5 means around 30% but income tax says 25 no one says to follow the 5% you can use 3 to 5 years so I have given you two ways follow either income tax 25% or given in AS26 3 to 5 years you can follow it but I can guarantee especially if you know engineering department will come and nowadays in all the institutes at least you guys are purchasing the CDs when you are purchasing a CD it means you have purchased a license even license fees which you have paid is an intangible asset is an intangible asset the day has gone when we were talking about goodwill patent copyright trademarks all are now you will be surprised there is one more item given in the intangible asset recipes recipes of any of the good cook because recipe is a unique recipe and recipes are now being sold nowadays even against the intangible asset so this is again a part which you can have it


Hi, everyone. Welcome to this talk. That will be an Introduction to 6-Tour for Pythonistas. My name is Maya. I'm a software engineer at Red Hat. I work on the emerging technology security team. And you can find me on social media, on Twitter, my student GitHub, under those handles. So this talk will be about supply chain security. So I would like to try to answer two questions. What are digital signatures? And why are they so important in this context? So maybe you know this information, but software supply chain attacks have increased of more than 700 percent during the past three years, which is kind of a huge increase, of course. And a lot of these attacks have been targeting the Python ecosystem. And in particular, the Python packet index. The attackers use techniques like typosquatting or dependency confusion, or also taking possession of a maintainer account on PyPI to try to inject malware in important libraries. So this increase in malicious package upload was so important that recently PyPI maintainers decided to temporarily suspend new user registrations and package uploads because they got so overwhelmed by those attacks that they couldn't handle the volume of malware anymore and just had to temporarily deactivate this important function. So we're talking about software supply chain. So I would like to try to define what exactly a supply chain is. So for the sake of this talk, we can say it's like the end-to-end journey that software takes from development to distribution. And that involves all the tools and the people that are responsible for delivering the software. So for instance, that is developers, version control systems, build systems, registries, package indices, and also deploying platforms in production environments. So when you have a supply chain, what attackers play on, usually, is the expectation of developers that every step in their supply chain is going to be systematically reproducible, which of course is not true. And that creates some kind of vulnerable links that attackers can exploit to upload malicious software in your supply chain. So why are cryptographic signatures or digital signatures important? And a key component of every secure supply chain is because they offer two guarantees. It's software integrity and software authenticity.  So it ensures two things, usually, when you open such a letter. You can see if the contents of the letter were tampered with, if the seal was open. And also, the pattern on the seal can allow you to identify uniquely the center of the letter. So it's the same thing with cryptographic signatures. Of course, before 6-store, other signing tools existed and other standards. So I think the most famous one was probably OpenPGP or in supplementation GPG. But those standards and particular PGP had a bunch of problems that prevented a good developer adoption and didn't allow developer to use code signing as a day-to-day tool. So the first one is public key distribution. So public key distribution is the act of ensuring that your end users are going to be able to identify correctly the public key. That you generated. So we're talking about asymmetric cryptography. So you have a private key that you used to generate the signatures. You have to keep secret. And the public key, you need to distribute for people to be able to recognize your signatures. And in the case of OpenPGP, you have different methods to do that. So it's called public key infrastructure. So it's the infrastructure you put into place so that users can identify your public key. But the problem is that it's not very standardized. So usually standards for discovering public keys can widely differ between PKIs. So for example, you can trust more centralized certificate authority to say, what are the good public keys to bind to a signer's identity? Or in other models like the web of trusts, you can trust users. It's more decentralized. So other users can vouch for other users' identities. So I put this picture in the slide. This is called the key signing party.  So it's kind of a specific way to verify other people's public key in person. And maybe you will agree it's not very convenient. So if you have to verify a public key by meeting your colleagues in person, it's maybe not the best signing and PKI scheme. So it's quite a specific example. Of course, not all standards are that inconvenient, but still it's a kind of nice illustration, I would say. Another problem of OpenPGP is private key storage and rotation. So private key is a very important component of asymmetric cryptography because you have to safeguard it at all costs. And that means literally in terms of costing money. So you don't want your private key to leak at all. So you need to invest in some kind of secure storage, for instance, like a hardware security module to guard your key, which is very costly. So you need to invest in specific infrastructure, which also implies specific knowledge about it. So maybe hire people especially for this kind of things. And you also need to regularly rotate your private key because compromises are pretty frequent, I would say, and more that you can sing. So you need to also think about rotating your keys also as a best practice. If you've used GPG before, you could agree that the configuration can get quite complex. So sometimes it's difficult to really understand what you're using, and especially what that involves. Understanding the underlying cryptographic protocols when trying to sign an artifact because not everyone, of course, is a cryptography expert. So even if you're a developer, you're not supposed to really care about those things, but sometimes you need to. So that's not really ideal. I put a reference here to a really good article that was published recently. It's called PGP signatures on PyPI, worse than useless. You can check the link when the slides will be published. So it explains why PGP signature will remove from PyPI. So I think the title is pretty explicit, but you can still check the audits made by the blog author to understand why it was not worse continuing to maintain the GPG signatures. OK, so now it's time to introduce SIGSTOR, which aims to make code signing easier and more accessible for everyone. So the motto of SIGSTOR is to become to digital signatures what let's encrypt is to HTTPS. So I will explain what that means. So SIGSTOR has built-built in terms of philosophy on the model of less encrypt. So if you make a quick comparison between the two services, you can see that less encrypt is a free and automated certificate authority. So you can use it at zero cost to obtain TLA certificates to adopt HTTPS for your website. And in the same way, SIGSTOR is also a free service that has a public good instance. And you can use it, as you'd like, to log transparently and publicly your signatures. In terms of numbers, less encrypt has stored over 200 million certificates since 2016, which is roughly 3 million certificates issued per day. And SIGSTOR has stored over 20 million entries since the public good instance went up on 2021 GA. So what exactly is SIGSTOR? SIGSTOR is a tool that solves some common issues with current signature schemes, like the ones I talked about before, and that prevented developer adoption. So with SIGSTOR, you don't need any specific cryptography knowledge or any knowledge of PKI protocols. It has a very simple interface that makes signing truly accessible to everyone, developer or not. And you don't need to maintain your own private keys anymore. So that's a big advantage because you don't have to invest in all this infrastructure and knowledge at all. It also allows an easier auditing and revocation of signatures in case they get compromised, all right? Our fake, for instance, which is still pretty rare. And signatures are bound to a public identity and not to a public key anymore. So that's kind of a big change compared to others' asymmetric cryptographic schemes because you can bind, for instance, a signature to something more concrete like an email address that is easily identifiable by a human, not like a public key, for instance. SIGSTOR is composed of different sub-projects. So here I put the three main ones. The first one is RECOR. It's what we call a transparency log. And that's a immutable app-only data structure that allows us to store signatures so that everyone can be able to verify them. The second one is FULLSHOW. It's a free certificate authority and it delivers ephemeral signing certificates you can use for one-time signing of artifacts. And then that will expire and that people will not be able to reuse after you. So in terms of security, that's a pretty big advantage. And it's used usually as a certificate to verify the signature rather than to sign multiple times like usual signing certificates. And the third sub-project is COSIGN. COSIGN is a command line tool. So you can use it to sign and verify artifacts in a very simple manner. So all the cryptographic primitives are picked for you already. You don't need to care about cryptographic protocols. The command line is pretty simple. And you can use it to sign containers or blobs, for instance. In addition to the three projects, you also have a whole ecosystem-specific set of clients. So you have implementations for Golang, JavaScript, Rust, and, of course, for Python. I will talk about in a few minutes. So SixTor has known a pretty large open-source adoption since it was created, especially in the cloud-native community since it was incubated as a CNCF. So it's pretty well known to be used to sign Kubernetes releases and also resist for some other famous projects like Iverno, Tecton, and also the Python library URL lib3. And it has a lot of integrations with other supply chain projects, like Tecton chains, the update framework in Toto, and Kyverno as well. OK, so now let's talk about SixTor in the Python ecosystem more specifically. So let's cover a few initiatives that the Python community has taken to integrate SixTor into the ecosystem. So first of all, SixTor Python clients is available for Python users. You can do different things with it. So the first thing is use it as a common line tool. You can sign only Python blobs, not containers this time. Using what we call a keyless signing workflow that we'll explain later. But basically, as you can guess, you don't have to manage private keys using this workflow. Instead, you use OpenID Connect. So I will go into detail about this later. You can also use it in a GitHub Action workflow. So for example, in your CI, if you want to sign package release, or a build, or anything like that, it's pretty easy to use. And you can have signatures as output of your workflow. And finally, it has a stable API. Since version one, you can use to integrate SixTor natively into Python projects. If you want to test SixTor, it's pretty simple. It's a Python package on PyPI, so you can just run PIP install SixTor and start experimenting with it. The Python packaging community also adopted SixTor. So SixTor is appearing in two PEPs in particular. It's PEP 480 and 458, which concerns secure downloads of PyPI packages, and also everything related to software signatures on PyPI. So the PEPs are accepted right now, not implemented, but I guess you will see soon how SixTor fits into this picture. So basically, it will enable users to upload SixTor signatures along their packages and modify the API so that clients can also retrieve them and verify the packages upon downloads. So package managers like PIP, for instance, also supports verifying signatures. And overall, the goal of those PEPs is still to make the user experience similar to before. So it doesn't add any overhead for Python developers when downloading or uploading packages, but it guarantees way more security and integrity. So here I put an example as well of how SixTor is used in the Python ecosystem. It's to sign releases of C Python. So if you go to the python.org slash download slash SixTor page to download Python releases, you will see that there are now signs using SixTor. And here's the command I combi-based from this site to verify the SixTor signatures. So you can have an overview of what it takes. It's not that complex, actually. So it's just SixTor Verify Identity. That's the common line to verify. Then you pass the ephemeral signing certificates, the signature file. And then you pass information about the signer, who is the C Python release manager for the version. So here's the email address. And then the URL of the identity provider was used to issues this identity binding. And then you pass, of course, the Python Tor file. OK, so now I'd like to do a quick demo of signing and verifying a Python file with SixTor Python. OK. Can everyone see? Well. OK, great. OK, so here we have a file. It's called hello.py. And it does nothing special except say hello.devconf. So it's a very simple example. So now I'm going to sign it using this keyless workflow that SixTor Python enables. So I will just type SixTor sign and then hello.py. Oh, OK. I don't have an internet connection. So that's an issue. So sorry about that. Let me check the Wi-Fi back to the demo. Let's try again. So now we'll open a browser page. I was redirected to this page by the command line. So here you see that you have a login page appearing. You have different identity providers here, like GitHub, Google, and Microsoft that are officially supported by the SixTor public instance. So I'm logging to GitHub. So I will just click Login with GitHub. And normally I already have a session open. So I would have to normally input my email address and the GitHub password. But here I'm already logged in. So the authentication was successful. I can close this page. And back to the demo. OK, so let's have a look at what we got here as an output on this command. So we finished the browser interaction. We got an ephemeral sign in certificates here in PEM format. And then you can see this line here. So it say that it created an entry at index 24 million something in the transparency log. So this is RECOR. I talked about earlier.  So a .sync file, which is a base 64 signature for the artifact certificates, which is the one printed here. And also a file called a six-store bundle you can use to verify your signatures directly without needing the signature and certificate. So let's take a look at what is in the ephemeral certificate. So you can see that the issuer is six-store. It's more specifically the six-store public good instance certificate authority for show that issued the signing certificate. Other than that, you can see that the SAM is my email address. So I used for authenticated to GitHub. And the identity provider is GitHub. So this URL here. And if you look at the normally at the time, yes. So the not after for the validity is in 10 minutes. So the certificate is only valid for 10 minutes to sign any artifacts I want. So right now I could reuse it. But in 10 minutes, it will be over. And it will just be approved that the certificate was issued to me with an ephemeral public key that was generated to sign signature. And it was binded to the certificate by full show. So an official authority approved like confirm that my GitHub identity was bound to my public key, which is bound to the private key, which ephemeral I used to sign the artifact. So now let's try to verify the signature. So here we have all the files we got from the signature operation. And now let's try to verify it. So I will just type six store, verify identity. Then I will pass cert identity. So that's my email address, the S-A-N on the certificate. So I'll put that. The next argument is cert YGC issuer. So this is the identity provider that was used. So here GitHub to provide the identity. So I'll just take this and paste it.  And the files will be found in the same pass. So six store just detects this verification materials we have. Okay, so it says hookay. It means the signature has been successfully verified. So as you can see, it was pretty simple. You didn't have to configure anything specific, no cryptography, no complex things at all. So that was it for the demo. So now I think we have a bit of time to talk about how exactly that works. So I will try to go over the workflow. Feel free to go over the slides again, if it's a bit fast maybe. So that will be published, so feel free to take a look. So what exactly happened here? First of all, yes? Sorry, this is a Python specific client, but you have other ones. So for example, Cosine is implemented in Golang. Here it was six store Python. Yes. Okay, so how does that work? First of all, the client generated an fmrl keeper. So it's still private and the public keepers, there are fmrls, so they just stay in memory during the whole signing process. They never hit the disk, so you never have to see them again. They will get flushed at the end of the signing operation. Then the client will do an identity proof request to one of the identity providers we saw on the authentication login page. So it will ask Google, Microsoft, or GitHub, and others in some other configurations for a proof of identity for the signer. So this is where you log in and enter the proof you are the owner of your identity. And then the identity provider will send back to the client a JSON web token, which is called also an ID token, which contains the proof that you, the signed proof actually from the provider that you own your email address. Then the signing clients will send a signed certificate request to full show, which is the certificate authority, that contains the ID token, and also a certificate that is ready to be signed. And of course the fmrls public key to be included in the certificate. So full show also has a transparency log. So it's called a certificate transparency log. So when it issues a certificate, it logs it systematically into the CT log so that it can be able to audit for every certificate that was ever issued by full show. So it's also happened only and immutable, so you can't modify any entries once they are here. So you can have like a full audit of every signing certificate issued ever by this instance. Okay, so it has signed the certificates. So now it sends it back to the client, and then the clients will sign the artifacts of course, and then it will upload what you call a log entry into RECOR. So RECOR is the transparency log I talked about. So it's also apparently an immutable, and then you have a proof of the artifact signature during a given time span. Okay, so that was it for the signing part, and now onto the verification. So the verifier is also the same client in this case. So it uses a verification material I showed you earlier. So either only the bundle or a certificate and the signature files, and it also requests an inclusion proof to RECOR. So it asks RECOR if it has seen this entry that was supposed to be included in the log. If it hasn't, it won't be able to verify the signature unless you specify that you want to verify offline, but this is more specific to air gap environments. Okay, so that was it for the workflow. Now if you would like to join the six-store community, if you're interested in contributing, I would like to encourage you to join the Slack, the six-store Slack, to subscribe to the YouTube channel, the blog, and to check out the six-store.dev website with all the community updates. So thank you, and now we'll go to the questions. Yes? So actually they're not really related. They're kind of different components. So the city log, certificate transparency one, serves as a backend to store certificates issued by FullShow, and the RECOR serves to store signature entries. So it's two different components, but they are the same, actually they have the same backend, it's called Trillian. It's a miracle tree data structure. So it's used for the same purpose, basically. Yes? Yes. So in this case. Oh, okay, sure. So I will repeat the question. The question is if it's the same certificate authority that signs the certificates for FullShow, the same backend, or if there is a federation of CAs. Is that correct? Yeah, between different, it says it's a six-store service. Okay. So in this case, I talked about the six-store public good instance. So this is one instance of six-store that is maintained by the community. I think you also have a staging instance, but it's more for testing purposes. But in general, you can use this public instance, but you can also install six-store and bootstrap it on your own, so you can have a different CAE backend in this case. You can choose from other backends if you have your own infrastructure. Yes? Yes. Yes? So Cosign is used to sign containers. That's the first use case of Cosign, and six-store Python doesn't support that. And the goal of implementing different clients for different ecosystems is to support native integrations into projects. So you can expose an API on your library and integrate six-store directly into your projects. So the question was, okay. So the question was, wasn't there a risk that different clients will implement six-store differently, like the six-store protocol? So I think the community has been pretty good for thinking on this kind of issues. So usually you have normally a working group for clients, so people coordinate so that the protocol is still similar according to the implementation, so you have some kind of community agreement on what's supposed to happen here. Yes? Sorry, can you repeat? So the public instance runs its own. It's maintained by the community, but you can also install it on your own if you want to support a private instance of six-store. Sorry, I didn't understand the last part. Okay, so how am I supposed to know the correct identity for each package signer? So that's a very good question. In fact, I think you need to be aware of it. Or you can just, yes. I mean, it sends a certificate, but obviously you need to know what you're verifying. You can't just check any email address, so you need to know in advance what is the email address or identity you're looking for in this case. Yes? Which information? Okay, so the question was, is the information about signers provided on PyPI? So at the moment, it's not implemented yet, so I don't know exactly how it will be in the future, but I guess, yes, we will see that when the PEP 480 and 458 are actually implemented. I don't know yet how the API is going to look like. So any other question? Yes? Okay, so the question was, does it support having a single artifact signed by multiple people? So yes, of course. You can generate as many signature or certificate files as you want. So you just can store them in the same place, of course, but of course, yes. Yes? Oh, that's a very good question. So there's no line in this diagram between Fullsure and the identity provider, but in fact, you're right. So Fullsure recognizes only a set of identity providers, so you can choose if you have your own instance with identity providers to trust. In the case of the public instance, it's a community agreement as well, but you're right that, of course, Fullsure has a configuration and it specifies which identity providers it's trusting. So yes, that's true. Other questions? So the question was, if Sixthrope Python was going to support container signing? At the moment, I don't think so. I didn't see any community initiative in this sense. So I'm not sure at all. I don't think that's the plan as of now. Yes? So the question was, we should be able to sign containers with Sixthrope Python as it's also a file. So the thing is that you have the signature part and then you have the storage part in an OCI registry, which is a bit more complex and necessitates some other kind of implementation. So you need to know how to store the signature compared to where the image is stored on an OCI registry. So it's not something that Sixthrope Python is supporting right now. It's what, sorry? Yes, exactly. So the question was, if the client uploaded the signature into IPI? So not yet because it's not yet supported but they're planning on it. Yes? Okay. So I mentioned I can revoke the signature. So I don't think that's exactly the formulation I used, but Sixthrope makes auditing easier in general because thanks to the transparency log, you can know exactly if you have, for example, if you know when an identity was compromised, if that's the case, for instance, you can know exactly what artifacts to revoke. So it makes, you can't really revoke artifacts, but you can know which artifacts not to trust and you can pull down from your environment. Yes? The question is, would RECORE be able to record the fact that artifacts were compromised? I think this is not the case, but I need to check again, the structure of a RECORE entry, but I don't think RECORE has this capability as of now. If I can get back to you on this, I have to verify. Okay, so we're out of time. So thank you for attending.


I'm Amber Keneally, I'm doing a Bachelor of Psychology with honours. So my name is Taylor Burgess and I am studying a Bachelor of Communications in Journalism. My name is Marussia Gonzalez and I'm studying the Bachelor of Social Work. I left school after grade 10, I decided that schooling wasn't for me, it wasn't the right environment for me, my head just wasn't in it. I missed two years of schooling when I was a teenager due to homelessness and then once I hit grade 12 I had to drop out halfway due to illness and since then I've been raising children, teenagers as well. Final year of high school I was couchsurfing, just trying to get to graduation day which was a bit of a struggle and you know I kind of I guess took a few years off to recover in a way and catch up. I got into retail management and for a few years I thought, yep this is good, I'm getting money, I'm happy but I got to a stage where it just wasn't enough and I still had that niggling thought in the back of my head. I wanted to study. After being in the workforce for a while I kind of realised I wanted something more. I didn't finish my senior schooling and I didn't know if it was a possibility for me to go on and study. I did always want to go to uni, I just felt like with the marks that I got it was never a possibility. Currently studying social work is because I've had social workers my whole life and up until about last year actually I was still in regular contact with social workers. Terrified. It had been so long since you know I'd written an essay or referenced anything. I was definitely nervous to go back into studying. Once I got in I realised I was among peers, people my age, older, younger. It took a couple of weeks and I realised that I was definitely going to have the support that I needed. Even just after the first lot of assessments it was just like that little hurdle that I had to get over and once I got those grades back and they were good grades I was like ah okay I can do this. At the end of it being able to see that number which should not hold that much power it really did I guess bring back that confidence that I was definitely capable. I love it and I'm so glad that I've decided to do it. I'm absolutely loving it. It's a new degree so the courses are all very catered to modern journalism. I'm getting to do things that I guess no one else has really had the opportunity to do so fast so. Every course I do something else comes up and it just ignites that passion and I just can't wait to get out into the field and to graduate the graduation that's what I'm looking forward to.


new role. Any doctor who starts a sentence with young ladies such as yourself, don't let him go any further. Stop him right there. I guarantee you nothing good or helpful is going to come after those words. And by that I mean they're going to blame literally every form of pain on periods.


Max this game took over seven hours 18 innings when you're strode to the plate for the final at bat what's going through your mind I just wanted to have another good at bat I felt really good off from the first two bats I feel like I've seen it well you know he's he would he pitched lights out he was unbelievable he was he was spotting everything he wanted and he was getting us all over the place but you know I was feeling good about my bats and I was feeling good about that one got up 30 he fought back and he kind of went the same sequence as the at bat before he tried to go back to our cutter so I guess it's refreshing at this point yeah although it's kind of waking me up I don't want to do that now I want to go to sleep in the long game Max the 15th it looked like you hit one out there what did you think did you think it was going to go fair I thought I had it I really thought I had it but just barely got foul and he made a good pitch like I say he went to the backdoor cutter that's kind of defeating at that point but I was able to get there and get no shot I know it's probably hard to think right now but you're down two to one they've used their pitching staff an awful lot how do you like your chances the rest of this series feel good you know we got Richie going tomorrow we got mountain he's a you know he's been great the last couple starts and I got a feeling he's gonna be unbelievable tomorrow and looking forward to it Max congratulations thank you very much