All right. Thanks everyone for coming to my talk. I'm Asankya Sharma. I'm the head of research and development at Source Clear. Source Clear is a software security startup that is focused on helping enterprises manage open source safely. That's the topic of my talk today. To give you a bit of a background about myself, if I had to summarize last 10 years of my professional career, what I've been doing in a single sentence, so then it would be I've been focused on building security tools for software developers. I have done it at large companies like Microsoft, where we built CAD.NET or the code analysis tool for.NET. At Source Clear, where we built the Lightman scanner. I've spent some time in academia during my PhD and soon after working at National University of Singapore. I also have a couple of open source security tool project that are of interest to developers. Most recently, I've been involved in the design and implementation of security graph language, which spans all three of these areas. So let's try and set some context about why the use of open source and third party dependencies is a big risk to enterprise. So there's some data which is picked up from various central repositories like Mave Central, NPMJs, RubyGems, etc. It's tried to show over the last five or six years what has been the growth of the libraries in these repositories. So on this side, you see that as of 2017, there are over 1 million different libraries. If we take this and we extrapolate it over the next five years, what we say is by 2026, they're likely they're going to be like 400 million plus different libraries and components. There will be more libraries than there are people on earth. So obviously it's little tongue-in-cheek, I mean we just extrapolated the growth, but if you think about different ecosystems like NPM, there are libraries for things like is positive, is negative, left pad, and so on. So, but the idea is that there are a large number of components that developers can choose in order to build or assemble their applications. If you look at each individual application as well, there is a lot of complexity in it. So this is data which is aggregated over scans then by source clear customers. Typically on average, if you look at a Java application today, when you add one library in your application directly, you pull in four other libraries indirectly on average. Some languages are different than others. For example, in a Node.js project, the problem is worse if you add one library directly, you end up pulling nine or 10 different libraries transitively. I don't know what's happening there with Python that seems to be like a different outlier in our group, but this has been consistent across different languages that we have seen our customers use. To give you an example of a particular project, and this is like a fun burst of the dependency graph for Apache Spark, which is a really popular open source project. To look at two things here, one, so the dial which is inside here shows all the direct libraries and then their dependencies and their dependencies and their dependencies and so on. If you look at one particular library here, which is this Spark SQL snapshot 2.4.0, that library in turn ends up pulling four or five other libraries. That's one. Then if you notice that this particular library AOP Alliance is pulled in through two different ways. So it's pulled in through this library and it is pulled in through another dependency in the project. So the problem is complex because each dependency pulls in multiple other dependencies and they may pull in these through different parts in the dependency tree. So if you build a new web app today, what ends up happening is you build it something like this. You don't write a lot of code yourself. You start off with something which is like your operating system or the framework or the database, which is actually most of the time open source, or the web server, Postgres, Apache, etc. Then you write a little bit of custom code or your business logic, and then you'll use a large number of libraries that are available to you. Most of them are open source or freely available and third party. So a typical application today can contain as much as like 90 percent of the code which is open source and third party, that is the code that you did not write yourself. So this is a really interesting visualization. This is a single graph representing the entire Node.js ecosystem. So all libraries and all their dependencies that are there are represented in this. This is a good visualization I picked up from the site. You can go ahead and play with it. But the basic point here is control over what goes into your code has shifted from you to either developer tools or package managers or build systems to open source code and third party developers. So all these libraries which are available are not written by you. They may have different maintainability, quality, et cetera, characteristics, and they represent the entire attack surface or over 90 percent of the attack surface of your application. So let's take a look at what are some of the common threats that can come in through use of these third party components. So one of the most common ones is that these components or libraries may have vulnerabilities in them. So these are like known vulnerabilities in popular libraries. Just because you're using a version of the library that is vulnerable, you will be exposed to that vulnerability. Other threat is it is very easy to publish a library. So there's no checks or balances. You can just write a library, get NPN published and directly it's available for everybody to use. So there are cases where people would try and upload malicious libraries. So libraries which are like malware and actively do something bad to your system. The third thing is typosquatting package names. So this is very similar to how people typosquat domain names. So if you buy a domain name which sounds similar to a popular website, by mistake you might end up on that domain and then they try to sell you ads. So the similar thing applied to the package managers. So you have a popular library called React.js. So you develop your own react with a WE, and then you register on NPM and then by mistake if somebody types it, they end up on your library and through that, you can actually attack the build system. Or sometimes like what happened in the case of Left Pad the developer actually unpublishes the library and the namespace is again available and somebody went ahead and registered their own library in the namespace. Then whenever you built your project, you ended up pulling the other library. Each package manager or build system actually allows some kind of command execution. So you can do things like data expiltration, like you can extract out environment variables which might contain keys like AWS keys, etc. because this is all running on developers' machines. You can also do command executions during build. So these are all potential threats or attacks that are possible through use of third-party libraries. So next few slides, just to try and convince you that this is not theoretical, this is all practical, it has happened in the last two years. I'll just show you a few examples. So everybody remembers Equifax. So this was the single largest data breach in history. The root cause effectively was that they were using an old version of Apache struts, which is a Java web application framework, and they either could not find or patch that thing in time. So if you think about as a large enterprise like Equifax, they don't even know what code is running in which application and which servers. It's so complex. So either they actively did not care or they did not find it at the time and they looked at it, and they didn't patch it, and it was there unpatched and somebody broke through it, and that led to a data breach. So here's another example from Python world. So this is on PyPy. Last year, somebody managed to publish 10 malicious libraries on the Python package index. So these are like actual malware, because like I mentioned, there is no checks and balances, nobody reviews these libraries when you publish them. So they managed to publish things which were actual malware. The common attack vector, like I mentioned is typosquirting. So this is another example from the NPM world where look-alike NPM packages, which were similar to popular NPM libraries were published through a typosquirting attack. This is the example which I was referring to. One of the popular things for these malware or these malicious libraries to do is to do data exfiltration. So this was a package which was cross N where it was stealing the environment variables on install. So why is it useful? Because if you think about how you would deploy your application and product in environment variables, and when you build it, you might actually expose your API key or your AWS secrets, et cetera. So this was a real example from last year where a package was trying to exfiltrate environment variables. And all of this actually breaks or shakes the trust people place in this whole open source model. So you have all these libraries, you democratize the development of components, it's all nice and easy, you can publish your code, anybody can publish things, but it really, what it also means, and that represents a big risk for enterprises when they build applications today. So how can we solve this problem? Or what do we need to do in order to be aware of it? So when we started doing this four years ago, there was no term for it, but now industry is sort of coming to a conclusion of what to call it. So what we're calling it now is like software composition analysis or SCA. This is to figure out or discover vulnerabilities and licensing information for open source components. So in an enterprise context, I didn't really talk about licenses earlier, but license information is also important. So they want to know whether they are using a GPL library or not, for example. And the way to do it is if you're familiar with other kinds of application security testing is you typically need some kind of a scanner and you need some data about the libraries so that you know about the known vulnerabilities. So let me describe very briefly how this could work or what kind of scanning technology you need. So first of all, imagine you have a dependency lock file. So this is like shrinkwrap package.lock, gem lock file, et cetera, where the dependencies are all explicit. So your application top depends on some library with a particular version, that depends on another library and that's it. So you can parse this file and you can build the dependency tree and then you know all the direct and transitive dependencies in the project, right? Or if you're using a build system where the lock file is not supported, like you're using Maven, Gradle, you don't have a build system go, in that case, you first have to resolve the dependencies yourself. So that would typically involve doing a build because that's the only way to really know what dependencies gets pulled in. So you would, the scanner would do the build or generate the dependency tree, resolve the dependencies and then in turn build the dependency graph, right? So all of you must have heard about GitHub. They recently launched this GitHub security alerts feature for JavaScript and Ruby projects, right? So they do something similar to the first case here where they parse the file and then they just tell you the dependencies and show you the details about it. But it's likely to miss certain things and that's the reason why they can't support certain languages where you don't have a notion of lock files where the dependencies are explicit. You could do the same thing if you're wondering on infrastructure. So this is going one level below on the stack. So you're talking about vulnerabilities in runtimes or your applications that you might use like containers, et cetera. So you can do the same thing on containers, on clusters of containers and so on. In fact, there's a talk by Chris from Red Hat later today which talks about how to do security in a container environment, right? But the principles are the same. You have some sort of scanner which detects these packages which are say installed through app get or yum and so on and then you can build the whole dependency tree, right? So that solves the problem of figuring out what libraries or what dependencies are there in your application. So the next question is how do you know whether they are vulnerable or not, right? For that, you need to have access to data. So there are like publicly available sources of vulnerability and vulnerability-related data. So the most popular one is NVD which is the National Vulnerability Database which publishes, you know, CVEs. A lot of big projects will publish their own advisories. So for example, if you go to Spring, they have their own page where they list all security issues and they publish them as they come along and they fix it. You can join some mailing lists like full disclosure, bug tracks, et cetera where they publish, you know, information about disclosures and vulnerabilities, right? However, what we realize, this represents a very small percentage of known issues that are there in these components. If you think about certain ecosystems like Golang or NPM, rarely ever somebody takes the effort to go ahead, register a CVE, publish the information about, and so on. They just patch it and then they move on, right? So a lot of this data resides in these software engineering artifacts like commit logs where somebody might just commit saying, hey, fixing xxs and then move on. Or in bug reports, somebody goes ahead because these are all open source projects. Many of them have like public data boards or bugzilla boards and they just publish certain things saying, hey, you know what, this looks like a potential security issue. We should fix it. Change logs, pull requests, et cetera. So the key thing with the data is that security issues are often not reported or publicly mentioned. So if you're only tracking NVD or CVEs, you're likely to miss a lot of these issues about libraries, right? So give an example of how severe this problem is. So this is data we collected over the last two years where we looked at a CVE for a particular library and then we looked at the first reference related to that vulnerability in one of these places. So either the vulnerability was mentioned in some way in a fixed commit or in an issue or a pull request or a bugzilla entry or a JIRA ticket, right? And this is the average number of days the vulnerability remained unidentified. So it was already fixed in a commit like for 60 days ago and after 60 days, you actually found public mention of this in a CVE, in a GitHub issue, pull requests and so on and so forth, right? So this tells us that if there was a way for us to actually mine all the data about these projects, then we would be able to discover these issues well in advance before they actually are publicly mentioned or become CVEs or are published by the project themselves. So that's what we actually did. So this is the paper we presented last year at FSC which uses NLP and machine learning to identify these security issues from commit messages and bug reports. So I would encourage you to go ahead and take a look at it but it's a standard classification problem. You look at a commit message or a bug report and then you try to use NLP to understand it and then you try to classify whether it's related to a vulnerability or security issue or not. And that's what we did here. So if you're thinking like, hey, this all sounds good but if I want to do it for my own project do I have to build all of this? Of course not. So there are like several players in this space today. There are a lot of vendors who have solutions in this space including an open source project. So this is a dependency track which is a project from OWASP. And you see vendors which are focused on application security like Veracord. You see players which are specific to software composition analysis like source clear, white source, et cetera. So there are a lot of companies which have come up with different products. They differ in the depths of analysis like I just mentioned and they also differ in the coverage of data that they have, right? So the next question is if there is so much choice and there's so many things to consider how do you decide like what tool to use? So last year we did some work on creating a benchmark for software composition analysis tools. We call it EFDA, the evaluation framework for dependency analysis. So it's open source and it's available on our community, DevSecOps community or on GitHub. So it consists a set of test cases for different languages and different package managers with the expected results. So and it's artificially created the benchmark. So somebody actually went ahead, created the POM file with these dependencies and verified it, how many are pulled and so on. So you have expected results for each one of them and then there are certain criteria you can fill in the spreadsheet with what you want to give importance to.  So you can use your favorite tool, run these tests and then you can get results to compare against, right? So the next question is where you should actually do this analysis, right? So if you look at a typical modern software development pipeline, it looks something like this. You have a developer, he writes code on his own machine, commits the code into some kind of source control management system. Could be GitHub, Bitbucket, GitLab, so on. From there, the thing goes into continuous CICD system. The tests are run and eventually it's deployed into one of the cloud services in production, right? So you could actually do this in various places, right? You could do it here just before the code is deployed. You could do it here, you could do it here and so on, right? Right on the developer's ID. But based on our experience, the right place to do this analysis is actually in the CICD system just before, just after you build the code. If you remember the second slide I had about scanning technology, unless you do the build, you don't really know what are the bits which are pulled in. Some of the indirect libraries may be loaded through class path or they may not be defined. So the only way you would know the full picture of what gets built as part of the application is after the build that happens inside the CI system. So that's the best place to do this analysis. So for example, like Source Clear, we integrate with all of the known CI so you could just write a command and then after your build completes, it would do the scan and it would give you the results, right? But like I said, it could be done at different places. So an example would be like GitHub's own security alerts feature that's doing this analysis at source control level. So they don't know how to build your project but they have your source code so they can look at your dependency file and they can tell you about the dependencies, right? So if you're thinking about a modern DevOps like flow, what you should really think about in terms of dependencies is how you can go from kind of how you can build a big security in this DevOps workflow. So the first thing to do is like I said, to integrate the software composition analysis scanning in your CI pipeline, you should create an open source users policy. So the policy actually just tells developers what kind of projects or components they can use versus not. So for example, you could say things like you are always required to be within the first major version of a release of a popular framework like Spring, right? So if you don't have a policy, what tends to happen is that you would end up with code which is out of date very soon. You go back to Equifax example, like they're using struts to really old release because they didn't really have an active policy which goes ahead and tells people to make sure that they upgrade when a new release happens. We can fail builds on high severity vulnerabilities. So we just talked about detecting libraries and vulnerabilities but what is the action that you can take, right? So for example, a developer commits some code and now you run this scan and then you see that there is a library which has a high severity issue. You could actually fail the build. So that's even more of the reason to implement it inside the CI system so that the code doesn't leave the boundary. So just when it is built, you can fail the build and you can tell the developer, hey, do you know what? This library has a high severity vulnerability. You should go ahead and upgrade or you should batch it before you actually ship the software. Gather data on open source libraries, vulnerabilities and licenses. So this is more for sort of across your entire organization or your team. You want to make sure that you know exactly what libraries you're depending on, what vulnerabilities they have, what licenses they use. And this is like a very high level. You can also review what is now called the Bill of Material Reports on what's running in your application. So at any given time, you should know in production what are the libraries or components that your application is using. And this reports can be generated by most of these tools. They have some kind of like a Bill of Material thing. You get a full thing. All libraries across all my applications and so on. That said, I am almost towards the end of my talk. So what are the golden rules for using open source or third party software? So these are the four key takeaways. If you don't remember anything from this talk, just remember these four things and it'll be good. So first, you should know what you're using. So like I said, it's very easy for anybody to publish some code on the internet. It's very easy for you to use it, but you need to make sure what you're using. Think about where it came from. So who was the developer? I just gave some examples, a lot of malicious libraries were uploaded into PyPy or NPM. And it's notoriously easy for somebody to use a typosquatting attack vector to actually convince you to using some library which was not written by the person you think it was written by. Understand what it's doing to know its behavior, whether it's doing some exfiltration, extracting some data, running some commands. And fourth, which is probably the easiest, is to avoid using vulnerable libraries. So if you know that a library has a known vulnerability, make an assessment and avoid using libraries with known issues in them. So that's all. I think we have four minutes for questions. That's my Twitter. If you found this interesting, if you want to really know about how to build these kind of tools, you should look at an upcoming book that I have which is all about building security tools for software developers. So thank you for your time. Thanks. Thanks. Good question. That's more than expected. I'll answer it.


Hi and welcome to the session. Let us discuss the following question. Question size. Find a particular solution of the differential equation. Given differential equation is, x plus 1 multiplied by dy upon dx is equal to 2 multiplied by e raised to the power minus y minus 1 given that y is equal to 0 when x is equal to 0. Let us now start with the solution. Now the given differential equation is, x plus 1 dy upon dx is equal to 2 e raised to the power minus y minus 1. Now dividing both the sides of this equation by x plus 1, we get dy upon dx is equal to 2 e raised to the power minus y minus 1 upon x plus 1. Now taking reciprocal of both the sides, we get dx upon dy is equal to x plus 1 upon 2 e raised to the power minus y minus 1. Now let us consider 2 e raised to the power minus y minus 1. Now we know e raised to the power minus y is equal to 1 upon e raised to the power y. So here we can write 2 upon e raised to the power y minus 1. Now this is further equal to 2 minus e raised to the power y upon e raised to the power y. Now we get 2 e raised to the power minus y minus 1 is equal to 2 minus e raised to the power y upon e raised to the power y. So substituting for this term 2 minus e raised to the power y upon e raised to the power y, we get dx upon dy is equal to e raised to the power y multiplied by x plus 1 upon 2 minus e raised to the power y. Now this further implies dx upon dy is equal to e raised to the power y x upon 2 minus e raised to the power y plus e raised to the power y upon 2 minus e raised to the power y. We know on adding these 2 terms we get this term. So we can write this term as sum of these 2 terms. Now subtracting this term from both the sides of this equation we get dx upon dy minus e raised to the power y x upon 2 minus e raised to the power y is equal to e raised to the power y upon 2 minus e raised to the power y. Now clearly we can see this is a linear differential equation and this equation is in the form dx upon dy plus p1 x is equal to q1. Now comparing these 2 equations we get p1 is equal to minus e raised to the power y upon 2 minus e raised to the power y and q1 is equal to e raised to the power y upon 2 minus e raised to the power y. Now integrating factor is equal to e raised to the power integral of p1 dy. Now substituting corresponding value of p1 here we get integrating factor is equal to e raised to the power integral of minus e raised to the power y upon 2 minus e raised to the power y dy. Now let us find out this integral. Now we will find this integral by using substitution method. So we can write put 2 minus e raised to the power y is equal to t. Differentiating both the sides with respect to y we get minus e raised to the power y dy is equal to dt. Now the given integral is equal to integral of dt upon t. Now we know formula of integration integral of dx upon x is equal to log x plus c. So applying this formula here we get integral of dt upon t is equal to log t plus c where c is the constant of integration. Now substituting 2 minus e raised to the power y for t here we get log of 2 minus e raised to the power y plus c is equal to given integral. Now we get integrating factor is equal to e raised to the power log of 2 minus e raised to the power y. We know this integral is equal to log of 2 minus e raised to the power y. We have already shown this here. Now using this law of logarithms we get integrating factor is equal to 2 minus e raised to the power y. Now we know solution of the given differential equation is given by this expression. Now we will substitute corresponding values of integrating factor and q1 in this expression. Now we get x multiplied by 2 minus e raised to the power y is equal to integral of e raised to the power y upon 2 minus e raised to the power y multiplied by 2 minus e raised to the power y dy plus c. Now here 2 minus e raised to the power y will cancel 2 minus e raised to the power y and we get integral of e raised to the power y dy plus c is equal to x multiplied by 2 minus e raised to the power y. Now using this formula of integration we can find this integral and we get this integral is equal to e raised to the power y plus c and here we will write x multiplied by 2 minus e raised to the power y as it is. Now let us name this equation as equation 1. Now for the given differential equation we are given that y is equal to 0 when x is equal to 0. So we will substitute y is equal to 0 and x is equal to 0 in equation 1. Now equation 1 becomes 0 is equal to e raised to the power 0 plus c. Now we know e raised to the power 0 is equal to 1 only. So here we can write 0 is equal to 1 plus c. Now subtracting 1 from both the sides we get minus 1 is equal to c or we can simply write c is equal to minus 1. Now we will substitute this value of c in equation 1 and we get x multiplied by 2 minus e raised to the power y is equal to e raised to the power y minus 1. Now this further implies 2x minus x multiplied by e raised to the power y is equal to e raised to the power y minus 1. Now adding this term on both the sides we get 2x is equal to e raised to the power y multiplied by 1 plus x minus 1. Now adding 1 on both the sides of this equation we get 2x plus 1 is equal to e raised to the power y multiplied by 1 plus x. Now dividing both the sides by 1 plus x we get 2x plus 1 upon 1 plus x is equal to e raised to the power y or we can simply write e raised to the power y is equal to 2x plus 1 upon x plus 1. Now taking log on both the sides we get y is equal to log of 2x plus 1 upon x plus 1 where x is not equal to minus 1. So this is the required particular solution of the given differential equation. This completes the session. Hope you understood the solution. Take care and keep smiling.


In August and October of 2020, Ipsos surveyed people in 15 different countries asking them whether or not they would receive the COVID-19 vaccine once it became available. Well, of course, several months later, the vaccine became available. I received it back in January and February, I believe. Hopefully you've received it as well. And so what we can now do is we can take the measures of people's intentions to receive the vaccine back in October of 2020, and we can compare it to whether or not people in those countries received the vaccine. We've gotten the updated data from those 15 different countries, as well as all the other countries that report their data, from a website called Our World in Data. I've been abbreviating it as OID. And in the recent episodes, we've been taking the Our World in Data data and cleaning it up to get it to a position where we're now ready to join it, to merge it with the data from Ipsos. Along the way, some of the things we've had to do is to filter the data so that we get the most recent data from each country, where we know the percentage of people that are partially vaccinated or fully vaccinated. We now, like I said, are ready to join together these different data frames. And the ability to join different data frames is one of just the coolest things I find about Deplier that makes things so easy. Before I found out about Deplier and was using R and using Baysar, this is one of those operations that was just so error prone and just, I don't know, had me in knots and was just a real pain. But using these join functions from Deplier is a real game changer and really makes things so much easier. And that's what I'm going to show you how to do in today's episode of Code Club. So I have my code where we get the data from Our World in Data and we clean it up. I'm going to go ahead and load all that. I also have our old code from building out the various plots we made with Ipsos's data. I'm going to go ahead and copy that code where we read in the CSV. That CSV is actually part of the repository. So if you want to get a hold of the code that I'm using, you can go down below. There's a link to a blog post as there are for every one of these episodes that will show you how you can get the code and get the data that we're working with here. I'm going to go ahead and copy this and bring it back over to Comparison Figure. And I will put this at the end. And I'm going to call this Ipsos. So we've got OID and we've got Ipsos. And I need to get rid of this pipe here at the end. So what this pipeline is doing that we're now calling the output of Ipsos is it reads in the data from a CSV and it renames those columns. We now have Ipsos, which again are those 15 countries with their percentage from August and October and those 15 different countries. We actually also have a row in here for the total. I believe we figured out that that was actually the average across the 15 different countries. And then if we look at OID, we have those same 15 countries with the location, the percent of people that received at least one jab of the vaccine and the percentage of people that are fully vaccinated. I know that the China here is an NA. I think I'm going to do my analysis with the percentage of people that are fully vaccinated rather than all vaccinated to get that data point. We'd have to go back more than a month. And it was a pretty high number already, you know, just a little bit higher than the fully vaxed. So they're in pretty good shape. So I don't think it really matters that much. Now what we need to do is merge the OID and the Ipsos data frame. And there's a variety of ways that we can do that. The first thing to notice is what column would we join the data frames using? In the Ipsos data frame, we call the column country. And in the OID data frame, we call it location. Well, we could rename location to be country, right? And so that we could do up here. And I'm going to hold off on doing that for now because I want to show you what can you do if you have two data frames with different columns that you're trying to join on. So I'm going to come down and do a little bit of work here in the terminal with you. So we'll start with a function called full join. So we'll do full join on Ipsos and OID. And we will then join by. And so we use the by argument with a C vector. And here we're going to say what two columns do we want to join on? So in Ipsos, it was country. And in OID, it's location. So we join that. And now we get a complete data frame of all 15 countries plus the total. And we notice that although we don't have the all vax and fully vax data for total, it's putting in an NA value for us when we do this full join. So again, the full join looks at the column that you want to join on. And it returns a data frame with all values that are found in those columns that you're joining on. If that doesn't make sense, then let me show you what happens when we do an inner join. So if we do inner join on Ipsos and OID, and then we also do the by equals C with the country equals location, we now see that we only have 15 rows back, right? And so the inner join requires that for the data frames to be joined together, that you only return the rows in the new data frame where that column has shared values, right? So OID didn't have a total value in the country column or in the location column. And so that didn't come in the output, okay? So inner join is what I often use because it basically performs a filter, right? So we use the country labels from Ipsos and filter the data from OID. Another type of join that we might think about doing is a left join. So again, we could take the same syntax, but instead of inner join, we could do left. So what left join does is it uses the names in the column that you're joining on. So in this case, country, that's in the left hand data frame. So Ipsos, right? So the Ipsos data frame had a value in country of total. So our output has total, right? If we were to do right join instead of left join, you can almost predict what happened, right? Well, now we use the data in the location column from the data frame on the right. So OID. So OID didn't have a total value in location, therefore it's left out. So for this data, right join and inner join look the same. And left join and full join look the same as well. But that won't always be the case. So another type of join we can do is what's called an anti-join. And the syntax is again the same as all these other function calls. So we'll do anti-join. And what anti-join does is this will tell us what is an Ipsos that's not in OID. So basically what from Ipsos would not turn up in a output of an inner join. So we should get total as the output data frame. And sure enough, we get a data frame that's outputted. That's basically the total row from the Ipsos data frame. Now, what if you wanted to know what's in OID but not in Ipsos? Well, we're going to flip it, right? And so we'll do anti-join, OID, Ipsos, and then buy. And now we need to flip location and countries. So we'll say location equals country. And now we see we get a table with no rows as the output, because everything that was in OID is also in Ipsos. So these are the five different joins that you frequently will use with the plier. So a full join, you can think of as returning all of the data. Inner join will only return the data that is shared between the two data frames. Left join will return the data frame that's dictated by the data frame on the left, whereas right join is dictated by the data on the right. An anti-join will tell you what rows are left out of the output when you would do something like an inner join. Now, I mentioned that you can think of these joins also as a filter. Right? Now, what would happen if I go ahead and remove this filter function? Right? So, well, if we run this, we will now get OID to represent all of the countries in the database with those values of partially vaccinated and fully vaccinated for those countries with the most recent data. And so here we go. We have 226 countries worth of data here. And so what we would like to do is we'd like to join OID with Ipsos. Again, you can think, well, if I do a left join with OID and Ipsos, again, buy, and then we can then say the column location equals country. We now get all of the rows that are from the left hand data frame, right? So the OID in this case. And anywhere there's missing data, it plugs in the NA. So that's not totally what we want, right? Alternatively, we could do right join. And so in the right join case, we then see that we get all of the rows that are found in the Ipsos data, right? And so in this case, total is not found in the OID data.  So this isn't exactly what we want either. And I can already tell you we don't want full join because full join is like everything, right? We want an inner join. So we can then do inner join. And then we get back 15 rows, all 15 countries. We don't get that total line. And we get the percent August, percent October, the all Vax, fully Vax from those two data frames joined together. So this is really an example of how you can use inner join to filter one data set using another. We're using the Ipsos data to filter the OID data. So I'll go ahead and put this as part of our code. I'll comment it out for now so we don't accidentally run it. And I'll go ahead and delete this big long filter statement that we ended up not really needing. And one thing that I commented on is that an alternative to using that by statement was to actually rename the location column in OID to be country. So let me show you how we can do that and how that would change our inner join syntax. So again, with select, we can rename columns using an equal sign. So I could say country equals location. And then I'll go ahead and put date on its own row. And then I'll group by country. And now if I look at OID, I see that I now have country as the column name. So now if I want to join these two data frames together, I can do inner join, Ipsos, OID. And actually that's all I need. So I can run this and the output that you'll see is that table with 15 rows and five columns. And it tells us that it's joining by country. Now my preference is always to try to be explicit in what I'm telling R to do. So what I would do is to add the by argument. So I would say by equals and then in quotes, country. And again, this gives you the same output without that little message that we got before at the top of what it's joining by. And so now we've got our 15 rows and our five columns and we're off to the races. We're ready to go in the next episode to take this data and plot it. So I'll go ahead and save the output of this inner join to be Ipsos, OID. And I can change my buy to be by country because we changed the location column to be a country column in the OID data. And so like I said, now we're ready to go and plot the data in the next episode. Again, I hope you found this discussion useful of how we can use different joins to merge various data frames and how we can use an inner join to filter one data frame using the values in another data frame. Also, I appreciate that kind of like this example, we get data out from the wild and different places call things different things, right? So OID called those countries location. They also had continents in there besides the locations, which is okay. And whereas the Ipsos had things called country, even though they weren't all countries, they had total in there. Anyway, those joins are flexible enough that they allow us to join two data frames on columns that have different names but represent the same type of information.  This kind of gets us into the realm of thinking about our data as being relational. And it's just like I said, a game changer for me in terms of being able to combine different types of data, where perhaps I have a set of metadata describing samples and then I have other measurements of those samples and I can then use inner joins or whatever to join those together. And it's just written really nice. And we can see in this case how nice it was to be able to take data from the OID website and join it together with the data from Ipsos. And then great thing about this is that it's automated, it's reproducible, that I can come back tomorrow in a month from now and rerun it and get the same output or I guess updated output without having to change anything. I have nothing hard coded in here in terms of dates, in terms of countries. That's all defined by the data that I have. And that's, I think, really cool and really is a testament to the value and power of these deployer commands. So make sure that you're subscribed and that you've clicked that bell icon so you know when that video comes. And we'll see you next time for another episode of CodeClub.


Did that change? Yeah, we just got to take care of the football. I think we did some good things up in New England. Obviously ran the ball extremely well. But the turnovers killed us. Didn't finish in the red zone and then gave the ball up too many times. So something that's obviously a big emphasis for us as we move forward. You guys have had a lot of success in the first game after a buy since Mike got here and since your tenure here. Why do you think that is? What do you think maybe you guys are doing to kind of gear in the first game after kind of the time off? I don't know if it's anything special we're doing, but I know that guys are excited to get going again. Like I said, mentally refreshed, physically refreshed, and excited to get playing. I have a huge stretch here coming up to finish the regular season. And we're excited for the opportunity. The situation where it feels like it took a really long time to get there, but now when you look at what's ahead, like, hey, maybe this timing is going to work out OK? Yeah, I think it's definitely the latest buy I've ever had in my career and felt like it took a while to get here. But now as we're here and we're looking forward, it gave us a chance to heal up late in the season. Like I said, mentally and physically refreshed and built some excitement as we finished this regular season. You didn't finish the way you wanted to with two straight losses, but you liked the position you're in, kind of moving forward and kind of feel that energy in the locker room. Yeah, I know that obviously didn't play our best football, leading up to the buy. But as we look back, we've put ourselves in a position where everything we wanted is still in front of us. So it's just a matter of going out, executing, playing good football as we finished on the stretch. I said the season is just getting started, and it's so key for teams to be playing their best in December. Did he talk to you guys about that season just getting started and kind of the turning point after this break? Yeah, I mean, it doesn't really matter what you've done up to this point. You have to be able to play your best football December and January. So that's what we're looking to do. We're looking to come out and improve on a daily basis and play our best football, starting with Jacksonville this week. And just getting back to the basics and fundamentals, I mean, how key is that? And just picking up maybe practice in terms of speed now that you guys have got to the buy-reak in our past it. Yeah, no doubt.  Technique and fundamentals, one of the pillars of our program. And something we emphasized on Monday. And we'll do it again today as we pick up practice again. Something we believe in. We preach a lot. And really, football games are won and lost in large part due to that. So I think guys are excited to get back to work. And we'll do that today. What's it like being trying to get on the same page with a guy like Golden Tate who's been around the league, knows a lot of different systems, but maybe doesn't have the familiarity with you that in terms of quarterback and receiver. Yeah, we're building that relationship. Throw through with him a little bit leading up to the New England game during practice. He's over during all the special teams periods and stuff like that. And as he learns the offense more and gets deeper in our playbook, we'll be able to get more and more reps as the practice days go on. How much, maybe, Julio back in the mix? And how quickly can you guys kind of pick up where you left off? Yeah, excited to get Julio back. Have to build on things we've done in the past. Like you mentioned, it's been a little while since we've thrown and caught together. So these practice reps will be huge. We got some reps on Monday, which was nice. Excited to see him back out there making plays and looking good running. So yeah, like I mentioned, excited to have him back. Before you got hurt last time, Ryan, before Julio got hurt last time, did you feel like you had gotten to a certain point within that you were hoping to get to this year in terms of the chemistry and just? I think we've had spurts. We've had spurts. I think that it's been frustrating year for him, just kind of the up and down of being injured and not being able to speak for him. I'll let him answer that question, but I can imagine if I was in that position, it'd be quite frustrating. So hoping to keep him healthy as the season goes on and build that consistency the more time we get together. What was the first part of that, I'm sorry? The screen game? Yeah, maybe have as many moving forces as anything you guys do. And how much effort has it taken to get to the point where you are where it's working pretty well? Yeah, our guys have done a great job. I feel like we've done a great job of reponting and practice and then taking that practice and carrying it over to the games.  Our guys with the ball in their hands are making guys miss out running people. And they've paid off with some big gains for us. Is it one way to maybe scheme around some of the missing X plays when you're without some of your speedy receivers? I mean, screens are kind of one of those things where it could be an X player, it could be a game of two. You don't really know when you call it.  But you never really know until it happens in the game. You see you've got to get that franchise stick replaced on them, like you have it. There's an expectation to elevate everyone else's game. How do you approach that? And are there things that you could do possibly to help elevate everybody's game around you? Yeah, no doubt. I mean, as part of being a leader, as part of being a quarterback is driving the train, so to speak, pushing the guys around you, whether it be in walkthrough, whether it be in practice, making sure the energy there, the efforts there, pushing the tempo, making sure I'm communicating, elevating, trying to motivate. It all goes into it. For a second, from an ability standpoint, what does he give the offense if he is able to play this week? Yeah, no, obviously he's a rare talent that has done it at a high level for a very long time. So a guy with his speed, his size, his range can definitely make plays, which he's shown for us at times this year, and hopefully we can get him back and get him going again. Back, Ryan, at clips of the past few games or whatever, do you think you're taking any more chances than you had in the past, or does that maybe contribute to some of the turn numbers, or what's your thoughts? Like I mentioned before, everyone has a story, but at the end of the day, we all have to be on the same page, and I have to be accurate with the football and make a decision. So that's my charge going forward, and I look forward to it. Ryan, how much improvement have you seen from J Bill's defense since the first time you guys played it? They're playing well. You see a lot of improvement. Their second area is disguising, doing a really good job of that. Up front, they have talent, and they're getting on the quarterback. They have speed and length, which can make it tough on the offensive line. Their backers are flying around making plays, so I have a ton of respect for the way they're playing right now. It's going to be a good challenge for us. You have any sense for why you guys have been so productive in the second quarter? I think you've scored 43% of all your points. Then have you settled in and adjusted to what a defense is doing maybe at that point? And you'd like to get off to a fast start. That's something that we talk about and want to do. But occasionally in games, it takes a little while to settle in and get going a little bit. So you're getting to the meat of the game there, and you really want to be able to move the ball consistently. If you can pair that with a fast start, then you're going to be in really good shape. Confidence level grown with Borman and Hilliard, the way that they run the ball the last week or so? Yeah, going back to the New England game, both of those guys ran the ball extremely well. Getting tough yards, finishing, driving their feet through contact. There's a couple runs where there's contact at the line of scrimmage or no real hole for them to run through, but they're able to lower their pads, drive their feet, get some leverage, and then with the O-line finishing behind them, a one-yard run turns into a five-yard run. And if you're able to do that consistently, you need to keep yourself ahead of the chains and in good position to extend drives. What makes for a good red zone target like you've had with AJ over the years and with Johnny last year as well? I think the red zone comes down to timing and trust and getting yourself open, those three things. Spaces are tighter, the windows are tighter, and so their trust has to really be there from the quarterback. The ability to get open quickly has got to be there from the receiver or pass catcher. And when you put those things together, you can have a beautiful thing. One of the things that maybe if you're playing with the receivers, not as much time with them as a guy like an AJ or Johnny, that's maybe one of the things that could get affected is red zone with timing and so forth. I mean, it could be, no doubt, but I do have reps with a bunch of these guys and I have a lot of trust because I've seen them do it. Maybe I haven't had it lately or they haven't been the starting lineup for very long, but I've built up some of those reps over time and seen them make those plays not only with myself but with other guys in practice. So I definitely elevates the trust. You maybe that's been a challenge this year personally, just with your game over the years, you probably haven't played with maybe this many guys rotating in and out throughout a season. And I would guess that building that trust is a challenge at some point when you have that many guys coming through. Yeah, no, it's a challenge. It's not an ideal situation, you know, our team, I don't know what our number is up to right now with the number of guys that we've had play for us. But it's a testament to the resiliency of this team and the way that the mindset is and variable starts from the top is no matter who's in there, take advantage of your opportunity, go make plays and we'll find a way to win. If I cause my cleats and if so, what's your cause and why? Yeah, my cause this year is Life Water. I've supported them in the past. It's an organization that provides clean water sources to villages over in Africa and they do a great job. So it's an honor to work with them and excited to be wearing their cleats.


from our studios in the heart of Silicon Valley, Palo Alto, California, this is a CUBE Conversation. Hello and welcome to the CUBE Studios from Palo Alto, California for another CUBE Conversation where we go in-depth with thought leaders driving innovation across the tech industry. I'm your host Peter Burris. Everybody talks about the unbelievable explosion in the amount of data that digital business is going to generate. That's true. But there's an analog to that and that is the unbelievable explosion in software that's going to be created over the next decade. The difference though is that if you create data, sometimes it's good, sometimes it's bad, different quality levels, but it's really easy to create really bad software. And bad software can take down a business. So as a consequence, every business from the CIO down to the most lowly person in the organization has to participate in the process of creating great software, either from a design or conceptualization standpoint to a youth standpoint. It's a very important topic and it's what I'm really excited about. And to have that conversation, we're joined by two great thought leaders in the space. Dominic Turnow is the principal engineer of the office of CTO at Cisco and Sara Linhua is a UX designer at Cheg Inc. Thanks for joining us on the CUBE. Thanks for having us. So, Sara, let's talk to you first. Tell us a little bit about Cheg. Yeah, so Cheg is an education technology company that provides both physical and physical services to students. Okay, great. So with that in mind, I want to come to this issue of the marriage of UX and the marriage of cloud native. Let's start here. What is UX? So UX stands for user experience design and user experience design is the process of creating a meaningful and intuitive experience in a product like a software application for a user. So cloud native? Well, cloud native applications as we talked about our applications that are scalable and reliable by construction. So in order to have a cloud native system, you need a system that is capable of detecting and mitigating load and failure. And you can basically say cloud and cloud native applications have as much in common as Java and JavaScript. Or if you want to avoid the bar fight, have as much in common as car and carpet. So cloud native application or cloud native systems have effects on your entire organization. So Sara, as a UX person, a person who's really worried about building software that is intuitive and useful for human beings. How do you think about the impact of cloud native? Is that something that is good, bad, indifferent? Where's cloud native at Chegg? So Chegg is in the process of adopting cloud native principles. Where Chegg has three million subscribers and is actively growing, especially in the international space. So obviously reliability and scalability are one of our highest priorities. We have a lot of different applications and we have a lot of different teams. So, and due to a lot of different acquisitions, we're at different stages of adopting cloud native principles. So it's something that has immediate implications, not only for as you talk to students and people who you're trying to acculturate to great UX design, but also in your business as well. Exactly. All right, so let's get into this. Because there is a lot of excitement about cloud native and building applications faster. But as I said up front, it's not uncommon for people to build really bad applications fast. So how does UX and cloud native come together? From your perspective, Sarah, what do you think that marriage needs to look like? So I think a lot of what ends up happening with cloud native adopting cloud native principles is that user experience designers are sometimes left outside of that decision. We learn about it later on. And there are a lot of far reaching implications of adopting cloud native principles that we normally don't think about from a design perspective. And one of them would be, we don't know to design for partial failure. If certain components depend on a service and that part of the system then fails, then from a user experience perspective, then a user using that component may have an awful experience. But we're not necessarily thinking about that in terms of reliability. So it's reliability questions. So some of the precepts of cloud native aren't recognized as potential constraints as you imagine the nature of the application. But still you're still focused on translating user insights and user practices and user realities into design elements that can be built. But it starts with at least into design elements. You're trying to build the right application. Have I got that right? I think when we talk about how cloud native relates to design we also have to talk a bit about how designers and developers collaborate. So you've got UX folks that are really focused on building the right application. How does that impact the way cloud native developers have to start thinking? Well, if Sarah is responsible for building the right application, I am responsible for building the application right. And there is, of course, there is a collaboration. There is a peer relationship between design and development. And design happens to be the first step in the process. So while designers uncover the requirements of the application, right? It is my job to implement these requirements. And in this case, I am a service provider to the UX and UI designers. And I get to video only on three counts. That is, if a certain design negatively impacts scalability, negatively impacts reliability or of course negatively impacts security. Other than that, I only communicate the consequences. For example, consequences in terms of costs. So if designers lay out a few alternatives, design alternatives for an application, I can of course communicate how long is it gonna take to implement it or how costly is this solution gonna be? However, it is at the end of the day, the business and the design that makes a decision. So if I think about it, if I can, just let me throw out kind of how I think about some of this stuff. I imagine you really focusing on the social dynamics that have to be reflected in the software, given human constraints and human experiences. And quite frankly, whether or not people are going to find the system useful and meaningful and enjoyable to use, otherwise they don't adopt it. And I think of you in terms of the technology dynamics. So both of you were thinking about the underlying dynamics of how it's gonna work. You facing the system, you facing the user. I got that right? Yes, you absolutely got that right. So if you make people happy, I make systems happy. And you see this is also a core conflict. So even so, we are working on the same application. There is of course a lot of tension because we are pulling in two different directions. Well, you mentioned earlier that what cloud native is and the idea of all the things by design at the system level. But there are a number of techniques that cloud native developers are starting to apply. And we talked a little bit about one of them up front, partial failure, that has to be accommodated because we're talking about greater distribution of systems. One of them is eventual consistency. Historically, we like to say, oh, when I tell the computer to do something, it's going to do it irrefutably and absolutely. But that doesn't work in cloud native. Talk a little bit about eventual consistency and what that's going to mean from a design standpoint. So for some applications, scalability and reliability may benefit, as you said, for applying eventual consistency. So eventual consistency meaning that the effects of the last write converge in the different parts of the system at different times. And yes, while that benefits the scalability and reliability of the system, that may absolutely negatively impact the user experience. Well, for example, if you have, let's say, a sports app, so two users are using ESPN to get their sports updates on how the game is going. And these two users are getting information, if they're getting information from the same node, then we don't have a problem. But if these two users are getting information from different nodes, there's a delay in when they get the game score. This doesn't matter unless the two users are actually sitting in the same room. So someone might get an update about this game way earlier than someone else might. And then they'll be like, oh, look at this, the warrior's just scored and the other person's like, what are you talking about? So once you have that use case of them being in the same room, then that actually creates this negative user experience of someone assuming that their app is slower, something like that. I'm gonna give it, I'm gonna take that example, I'm gonna add another one, because I think that this is significant importance when we talk about the implications. Let's talk about financial transactions or stock trading, that it shouldn't necessarily be that the fact that I'm a few thousand kilometers away, necessarily puts me at a disadvantage. But metaphorically, if my node is processing slower than your node, and you get that information about what's happening with stocks faster than I do, then I'm at a disadvantage. That has a pretty significant impact social as well as technical on subsequent behaviors. So there's this notion of blast radius, of how those impacts affect not just a particular transaction at a particular terminal, but can have impacts in much broader social settings. Talks a little bit about that. Yeah, so for blast radius, the way I like to look at it is the parts of the system that are directly or indirectly affected by the failure of another part of the system. Would you say you agree with that? Perfect definition. So the blast radius being the parts of the system that are transitively affected by one part of the system failing. And even so, we share the same definition of blast radius. Our experience is actually very different. So let's talk a little bit about, for example, a recommendation service, like in an e-commerce application or a video streaming service that takes my past behavior into account and recommends additional items to consume in the future. So I would say in typical systems, the recommendation service is a standalone service. Not many services depend on the recommendation service, right? So if the recommendation service fails, for me, the blast radius is very small. I may not necessarily want to get up at a Saturday night in order to fix the recommendation system. You being the cloud native person. Correct, but the UX designer may have a complete different view of that. So at CHEG, for example, we use recommendations to give our users certain parts of content. So users really rely on our recommendations to really master a subject that they're studying. And we have all these pages dedicated to just having recommendations for the user. You're studying math. Great, here's a list of practice problems that you probably should go through before you're quit. So imagine they're studying for a math exam tomorrow and they're up at 2 a.m. and going through these practice problems and bam, that recommendations module suddenly fails. That is something that keeps me up at night because the parts of the system that, or what I think about as parts of the system are user flows and user interactions. And if we do not provide that service to that user at that time, it could result in them leaving us as a subscriber because of that negative user experience. So it's very clear today that we need to factor the practicality constraints of the system as we do UX, but more importantly, we need to really accommodate the real human experience, those user interactions, user flows in how we design the systems. How, it's not really what's happening today the way we want it to. Give us one simple step. Sarah, we'll start with you. One simple step that you think would improve these two groups working together. Well, like I mentioned before, having those conversations with designers because when a company is moving towards cloud native principles, towards adopting cloud native principles and they leave designers out of the conversation, designers aren't aware that they need to design for partial failure. So get designers into those sprints early on in the system design and not just later on as you get close to thinking about what the user is going to experience. Right, exactly. That is, I 100% agree with that. It is first and foremost a conversation to be had. And you have to have this conversation on the very first step of the journey. You cannot bring in whether UX or UI designers at a late stage in time, you have to bring them in at the very first moment. And you have to establish the peer relationship and you do have to understand that as a developer you are a service provider to the designers. And you know, I'll make a quick observation and my quick observation is having been in this world a little bit, it's actually a lot more fun to think about the human element early on in the process. It just makes the constraints on the technical side a little bit more interesting, a little bit more meaningful. That is very true, I agree. I very much like the examples that Sarah brought up. Because if you think about cold hearted technology, you will think about notes that scale up, for example in the example of the eventual consistency, you think of notes to scale up, but you do not think of the consequences. Yet if you have this conversation early on with the designers, right, you see the consequence what it does if your system scales and you can actually apply simple remedies that have great effect on the user experience. In that case, if there is a geographical proximity to users, you route them to the same note and you make the user experience so much better. It is very fulfilling. Saralyn Hoa, Chegg, Dominic Turnau, Cisco, thank you very much for being on theCUBE. Great conversation. Thanks for having us. And once again, I want to thank you for participating in another CUBE Conversation. Until next time.


For more videos on people's struggles, please subscribe to our YouTube channel. Hello, you're watching People's Dispatch May 25, 2021 marks one year since the very brutal murder of George Floyd in the city of Minneapolis. Now, this is nothing new in America. We know there have been innumerable instances of black people being murdered by law enforcement, by police officers. In the case of George Floyd, the footage of this incident went around the world. We saw the brutal disdain with which Derek Chauvin, the police officer, had his knee on George Floyd's neck. We heard George Floyd's dying words that I can't breathe. And this sparked waves of protest not only in the United States, but in solidarity across the world. There were protests in Palestine, there were protests in Europe and in America, in every part of the world. So one year down the line, we have joined by Eugene Kudryer to talk about what has changed, what has not changed. How has the movement that broke out last year, what kind of impact has it had on American society? Thank you so much, Eugene, for joining us. Well, thank you so much for having me. Happy to be here. Eugene, my first question would be maybe to sort of, how would you see the situation in the United States one year later? We talked about, of course, the protests. There's been a lot of mobilization, a lot of demands. So one year down the line, especially in connection to some of the demands that were raised, especially in connection to justice for black people, how do you see the situation right now? I think that's a great question. I think the best way to see the situation is, I think culturally and socially, there has been a tremendous change. And it's obvious that the events of last year, the uprisings that took place, have changed the shape of politics in the United States and continue to be a major factor in how politicians are responding to the issue of racism in this country. But that being said, there's been almost total intransigence from the point of view of a policy level around the actual issue of police murders and police violence, which I think speaks more than anything else to how fundamental police violence really is inside of, for the needs of American capitalism, that even when you have a huge sort of rhetorical and verbal recognition that quote unquote, something has to happen, nothing happens. And so if you look at sort of the exactly where we are, the best maybe example of this is the Justice, the George Floyd Justin Policing Act, which was the congressional Democrats response to what happened last year in the uprisings after George Floyd's death. And that bill in and of itself was widely panned by almost all the activists and organizers who have been working because it was so minimal. And almost all of the things that it was proposing, banning choke holds, banning no knock warrants had been implemented in many places and people had still been killed under the implementations. So there was almost nothing within it that was any different than had been done in the past at the federal and local level and failed to solve the problem. There was one issue, which was to change a little bit of the legal responsibilities for police officers in terms of financial civil culpability. But because of that, even this very milk toast watered down sort of rhetorical bill that doesn't really do anything is now dead in the Senate and will never pass. And in fact, the Democrats have given a deadline of this week, actually, to whether they could find a compromise. It looked like it's not going to happen. So they're actually about to just completely let it go. And it's been more or less on the same on the state and local level, although not exactly. We've seen some relatively important things. If you look just outside of Minneapolis, where George Floyd was killed, for instance, in Brooklyn Center, many of Minnesota, where there have also been several killings this year, last year, several other years, there have been some changes by the city council there, for instance, to reduce the role of police in dealing with mental health crises, which is a major issue in terms of how the police end up killing many people in the United States. So we're seeing some small wins here and there, but we're seeing a combination really now of a big pushback. And I'll close here right now, a big pushback because the number of murders in the United States rose all across the country in most major metropolitan areas. And so now there's an attempt all across the line by politicians to say, well, maybe we went too far last year, and maybe we should slow this down and give more money to the police. So we're in sort of a precarious time where many, many more people recognize the issue of Black Lives Matter. Many more people agree with that. The most notable fact in many ways of the election in 2020 are one of the most notable facts. In Georgia, 53% of people told CNN in an exit poll that they supported Black Lives Matter, but Joe Biden only got 49% of the vote. And third parties didn't get all of that. So even some Trump voters were saying Black Lives Matter, and Black Lives Matter was more popular in Georgia than either major political party. So we've seen huge change. We've seen sports. We've seen entertainment in that sense. A recognition of the problem, more people willing to protest, more people embracing the challenge that racism is something that has to be addressed in America. But the actual powers that be the elites are very intransigent in terms of really wanting to change something because changing policing is much deeper than just a few policies here and there. And that's something they don't want to touch. Absolutely. You in this context also wanted to go into the demand to defend the police, which was one of the most important slogans and demands made last year. We saw how right now, like you said, there's a pushback even among the Democrats, where sections, for instance, were blaming the demand for the reverse of certain suffered by certain Democrats, which is really an absurd statement. But have you seen any concrete instances of, say, the community and administrators working together to actually bring laws at a local level, which might actually reflect the true essence of these demands? We've seen some. So I mentioned Brooklyn Center, Minnesota. There also is Minneapolis itself, of course, the epicenter of all of this. And there's a lot of controversy over it. But there are two what are known as charter amendments that are being put forward to sort of change the kind of local constitution, if you will, to try to move in the direction of defunding the police in the sense of reducing the scope of what the police do, disarming some elements of them or large numbers of them and moving a lot of a lot more resources into social programs designed to sort of get in front of the issue when the police just show up afterwards. So there's a lot of kind of controversy over the different bills and the different proposals, but it is notable that that is a big discussion in Minneapolis. It's going to go before the voters. People are going to vote on something it seems in elections that will probably happen later this year to determine how they will make potentially some very significant changes. But there again is a big pushback from the mayor. So it's unclear how it's all going to play out, but that is on the ballot there. So it has the possibility of bypassing some things as well. And one of the proposals, like I said, is a pretty comprehensive proposal to make some changes to the police department that would be in the vein of defund the police, if not everything. I think you look at sort of the reverse Los Angeles just increased the budget to the police last week and is saying that, well, you know, the real thing we need is more money for the police so that they can do better things, better training or whatever it may be. But we have seen, I would say in a few areas, some improvements in terms of police accountability in Chicago, even though there's an attempt to water it down, there's a big fight happening in the city council really over what the proposals are going to be to establish more community led accountability over policing, the ability to hold people responsible to investigate these crimes and take that out of the hands of simply the police themselves or these appointed boards, which is more or less what they have. Now they're in Chicago. It looks like something will pass. It's just a question of how watered down will be. And again, the mayor, they're pushing back. But that's another city where I think there's at least some hope that there could be some changes, even if there's small changes based on what we have seen from really the power of the people. In New York City, which is the biggest city, there was like a fake defund the police, where the police actually, the city, they tried to claim they cut a billion dollars from the budget for this year, 2021 from the police. They really just moved it around in a lot of different ways. But I think one thing that is notable, even though all the people who've been out in the streets were denouncing this rightfully so, the fact that they even felt they needed to pretend that they were doing something to speak to the issue of defund the police, I think does show that we're seeing again, maybe more rhetorical momentum than in terms of actual policy change. But we are seeing more durable campaigns start to take root in a lot of cities in Washington, D.C., in Baltimore, and other places to devote more resources to non-police means of addressing public safety. And we're getting little wins here and there, increased funding for existing programs. But the overall transformative change piece is what we're lacking, even though I do think there is a lot of vitality on the ground in a lot of places and in a lot of cities that are moving some things, getting some small wins and setting the stage for the conversation to really continue, because I don't think it's going away as an issue, even though, of course, it isn't as prominent in terms of millions of people on the street every day. Absolutely. And even in this context, I also wanted to ask you about the judicial process that has followed many of these brutal incidents. We know that Derek Shawin was, of course, convicted, although activists and organizations had raised many questions about how the process took place. But also so many other cases, Elijah McLean hasn't received justice so far, in the case of Breonna Taylor, for instance, in so many other instances, we still see the legal process either not moving at all, or in fact, like in the case of Elijah McLean, those who are fighting for justice actually being targeted. So how do we see, especially the past one, the kind of judicial response that has taken place? You know, I think that is the key issue is that the judicial response is the issue that no one really wants to address. And it comes at two levels, really. I mean, the main issue is what is the threshold by which these people are considered justified to kill people? And right now, the legal threshold in the United States is very low. It basically boils down to this. Did they think there is a chance that someone could potentially kill somebody or do serious bodily harm to them? So anything that even is remotely in that, but it's not just that in the abstract, it's would a reasonable police officer in that exact moment agree. So it takes everything down to a split second decision and says, if you can come up with some story that says in a split second, you couldn't know whether or not this was going to be really dangerous or whether it was going to be fine and you just had to kill them, then you are essentially not culpable. And so since obviously there are a million different threads to every sort of piece, it means that it's a very high bar to convict a police officer because it's very difficult to prove that they either did it intentionally or that they acted recklessly because of the courts. But that can change. You could pass a law that could detail this is the standard and it's a higher standard. Now then a police officer who is arrested could challenge that in court and say, well, based on these legal precedents, I'm actually not guilty. But that's what a lot of people would like to see in the United States because they want that issue to be argued. They want it to be put in play that the standards of use of force should be higher than they are now and that there should be a higher justification and it could in fact be enshrined in law. But there are also other pieces to this, which is, I would say, most legal experts in the United States believe that prosecutors oftentimes do have a good case, but choose not to go forward because of course the police make the prosecutors cases. It's a symbiotic relationship. They don't want to do it. And that is something that I think has also been a big issue here. And we saw it in the Derek Chauvin trial. And we've seen it, we saw it with Amber Geiger as well in Dallas, who was convicted of killing Bartham John. She walked into his apartment and just gunned him down. And so it shows that in a lot of these cases, it's also political. And that really the desire of the district attorney's office and the prosecutor's offices to look tough on crime, to be for law and order, to be cheek by jowl with the police department rather than hold them to any level of accountability at any statutory level is something that they're not interested in doing. So there is a still legal struggle that is happening in a discussion about how to either make a federal amendment or at a lower level. And in California, they tried to do this last year, but the bill was gutted how to just pass a law raising a standard that would make a lot of these police killings that we see basically legal and try to take it back to the courts and try to establish a new standard. But then there also is the political element of it that as we see, when people burn down a police station, they all of a sudden can convict a cop. So there's certainly a relationship there. But I think the legal issue is going to be interesting. And I think there's a number of cases coming up, including Andrew Brown in North Carolina, that are going to raise a lot of the most potent issues around what the real standard should be to murder someone for no reason. Absolutely. And usually finally, one of the most important developments of last year was also this very powerful movement which took over the streets, which raised a variety of demands, of course, talking at a very structural level and posing very difficult questions to those in power. You've spoken at some of these events and you also talked about them. So one way down the line, how do you see how these events have sort of progress established themselves? I mean, there was a very definite attempt by the Democratic establishment to co-opt some of these, but nonetheless, many of these radical strands have continued their grown in strength. So maybe could you talk a bit about that as well? Yes, I think so. I think it's probably the Democrats must be frustrated. I don't think they have been able to co-opt it to the level they thought. I mean, the fact that their major police reform bill wasn't picked up by any organization that is credible on the ground in terms of the issues of police violence and community transformation, I thought was a very telling reality. I think that there are other Congress people that are responding more to the popular organizations who themselves are promoting their own bills and their own moves. Some of them are good, some of them are whatever, but it just speaks to the fact that there is a feeling, I think, amongst a lot of people that the movement is not just going to come to you, but you have to go to it to some degree, even if you want to exploit it for electoral gain. And I think also what we've seen is some of the forces that are the sort of closest to the Democratic establishment, but have some level of movement credibility have themselves not really established hegemony over it. I mean, we had so many millions of people come out, there's dozens of organizations that people have formed, there's informal networks. And so even those who I think would prefer to channel things into a more electoral frame can't just keep it in that lane because there are so many other voices that are out there that are calling for people to continue to be in the streets, continue to do political education. The rise in the spread of independent media and social media has also raised the ability for sort of the radical critique of the role of policing as an integral tool of capitalism to become a much bigger poll. And now, I mean, even the biggest intellectual magazines, the New Yorker, the Atlantic are forced to write articles that are talking about the history of radical black politics, the contemporary versions of that police abolition, challenging capitalism, people who are building socialism. I mean, they're sort of forced to address this and in their own ways, good, bad, or indifferent. But it does show that the movement is variegated to such a degree and has become such a major force in society that so many millions want to see change when it concerns racism in this country that it has created the space where even though there is a lot of co-option and a lot of somewhat successful attempts by people to make their electoral careers off of allegedly being for black lives, there's also a new vital current of radical, even revolutionary people that is growing and getting a hearing in a way that's not superficial, where people want to know what people are thinking and what they're saying. And a lot of people are embracing themselves positions they maybe wouldn't have held a few years before because they've been challenged to do so in a real way by the actual sort of street politics of the movement despite the sort of high politics of the movement being in a very kind of stagnant phase because very little is happening at Congress and the people who are most willing to be co-opted in a way know that they'll lose credibility if they go with the congressional strategy. So there's gridlock at the electoral level in that sense. Absolutely. Thank you so much, Eugene, for talking to us. No, of course, thank you so much for having me. That's all your time for today. Keep watching People's Dispatch.


U.S. regulators are looking into Elon Musk's delayed disclosure of his stake in Twitter. The billionaire had disclosed a 9.2 stake in Twitter to the U.S. Securities and Exchange Commission on April 4th, which was a delay by at least 10 days. Now the reason for this is that any investor who crosses a 5% stake needs to file a form with the SEC in 10 days, hence the investigation has been launched. Obviously, Elon Musk being Elon Musk, that's not the only reason he's in the headlines. There are 10 other reasons, one of them being is that he has finally expressed interest to meet his Chinese doppelganger Ye Long Musk, who has become popular on various social media platforms as he looks eerily similar to the Tesla CEO. Of course, one has to wait and watch what actually happens when the two actually meet.


Most of this information comes from publication 946, how to depreciate property tax year 2022. You can find it at the IRS website, irs.gov, irs.gov. Looking at the income tax formula, we're focused online, one income. Remember on the first half of the income tax formula is an essence and income statement, but just to outline a scaffolding, other forms and schedules flowing into it. One of those, the Schedule C, business income, minus business expenses, gives us the net business income. The Schedule C then flowing into line one of income on the income tax formula. First page of the form 1040, remembering the Schedule C flows into the Schedule 1, which flows into the first page of 1040, line number eight, as we see here. Schedule C profit or loss from business income statement format, income minus the expenses. We're focused on the expenses side of things and more particularly focused on the depreciation, noting that even if you're on a cash based method, you're gonna have to do an accrual thing, oftentimes of the depreciation, putting the property planting equipment on the books as an asset, allocating the cost over the useful life. However, the depreciation standards for the tax code might be different and they might have different objectives than on the business side of things. So we have to be following the tax code. Sometimes they might try to accelerate the depreciation in the first half of the year, or first part of the depreciation period. Why would they do that? Normally for political type of reasons to try to stimulate the economy or whatever they're trying to do. So that's basically what we have here. We're talking now about the electing the section 179 deduction. So note, we're talking depreciation. The first thing you wanna think about is, we're putting it on the books as an asset, allocating the cost over the useful life. That's the normal accounting structure as to why you would be doing that. For depreciation, the first one to think about is straight line depreciation. That would be the easiest thing to conceptually visualize.  Then you might have accelerated depreciation methods like double declining balance, front loading the first side of the depreciation, which could be useful and correct in terms of equipment, which you might be getting more use out of in the first years than the latter years, which is the accounting defense for like a double declining balance. But for taxes, the double declining balance is usually good because we want the depreciation upfront because deductions are good for taxes, right? So we'd whether to have the deduction sooner. And then we can go deviate completely from bookkeeping thought process. And that would be like having a front loaded 179 deduction, for example, which basically means we're gonna be able to get this big deduction upfront. Similarly, like a special deduction. These are things that are basically usually politically related, trying to stimulate the economy or something like that. That's where we're are now. So electing the 179 deduction introduction. So you can elect to recover all or part of the cost of certain qualified property up to a limit by deducting it in the year you place the property in service. So it's gonna be important that you have to think about this election when you place the property in service because that's the point in time when you could take the election or not. Normally, if you could take the election, usually we would want to because that would allow us to deduct sooner and the typical tax planning strategies would be, I'd rather have the deduction sooner than later because of the time, value and money and the possibility that the tax code could change. But that's not always the case because it might be the case that in future years, I think my revenue is gonna be higher than in the current year, in which case my progressive tax rates might be higher in future years as well. So in that case, you could imagine a scenario where you wouldn't want the 179 deduction in a low income tax year and would rather take it in future years where you think the income level might be higher. So this is the section 179 deduction. You can elect the 179 deduction instead of recovering the cost by taking depreciation deductions. So it's kind of like an accelerated depreciation or you're basically depreciating it all up front. Okay, purpose of form 4562. This table describes the purpose of the various parts of form 4562 for more information. See form 4562. So part one, what's the purpose electing the section 179 deduction figuring the maximum section 179 deduction for the current year, figuring any section 179 deduction carryover to the next year. Part number two, form 4562, reporting the special depreciation allowance for property other than listed property placed in service during the tax year, reporting depreciation deductions on property being depreciated under any method other than makers. Part three, reporting makers depreciation deduction for property placed in service before this year. Makers is like the normal thing that usually comes to mind for depreciation methods for tax code, which is kind of a double declining balance usually with a half year convention, for example, reporting makers depreciation deduction for property other than listed property placed in service during the tax year. Part four summarizing other parts. Part five, reporting the special depreciation allowance for automobiles and other listed property. Automobiles having its own special rules because of the problems related to automobiles and whatnot, reporting makers depreciation on automobiles and other listed property, reporting section 179 cost elected for automobiles and other listed property, reporting information on the use of automobiles and other transportation vehicles. And then we've got part number six, reporting amortization deductions. Okay, useful items. You may want to see publications. So you can dive into these publications if you want to get into more detail. 537 installment sales. So if you have that particular situation, 544 sales and other disposition of assets when you're disposing of the assets, form and instructions for form 4562 depreciation amortization. You can find these on the IRS website of course, iris.gov and form 4797 sales of business property. Okay, so what property qualifies? We're talking 179 deduction here. To qualify for the section 179 deduction, your property must meet all of the following requirements. It must be eligible property. It must be acquired for business use. This is a business type of thing here, not a personal deduction. It must have been acquired by purchase. So you purchased it as opposed to just finding it or gifting it or something like that. You bought the thing. It must not be property described later under what property does not qualify. So we'll talk about that shortly.


All right, I need to sharpen the blades on this thing like for real I kind of I've kind of done it a little bit like just with a Diamond file on here, but These things are in really rough shape I'm gonna have to take them off And actually sharpen them especially I know this one look at this. Oh, I love that showing up on the camera, but There's a couple parts that are Pretty damaged other than that though super happy with this machine things been amazing and that up that pulley I made working great So it's totally worth getting these Things off and of course My wrench won't fit in there. I did make kind of a half effort a while ago trying to get these things off And they were super stacked A few years ago. I found this piece of stainless steel on the road and I just took an angle grinder to it hopefully Made a wrench that will fit Which way does this turn? Nice All right, oh No All right, I took out a chunk so I can get it in here funny. It's starting to look more like a normal wrench All right this one though This one even looks like it was damaged. I've not been able to budge it. This is bending my wrench Do I have to take one of my wrenches and like file it down so it'll fit in here? Really want to do that Plus I don't know where my half-inch fricking real wrenches not my real one. This is real, but my Where is it? Where's my half-inch wrench? You don't know. Are you sure? Man, I have to get this off. I can't leave one. I can't get the whole thing doesn't come out if one of these is tight All right, I'm probably gonna end up angle grinding this anyway, so I might as well just jump straight All right, I got one out. This is not the one with the stuck nut or whatever it is There's three of those the first one I tried to get it pretty stuck Anyway Wanted to get this out so I could take a look at it to see What would be the ramifications of me? Oh, these are just bolts All right So I should be able to angle grind one Right through just so I can get this out Place it with another bolt It looks like someone already replaced this Some really crappy bolts These cannot be the original bolts for this someone totally must replace this They'll cut off uneven and stuff. Look at this.  This is just a bolt and a nut couple You know strategically place washers Hold one of these wheels on here All right, it took a couple minutes, but the other chunk of that just flew off somewhere That should be all loose now and to get the other blade out I had to go up under here and Tap the bottom edge of the blade Starting to move. Oh, it's starting to move a little easier than the first one.  All right, those are looking significantly better I figure how to sharpen them And that edge is so messed up.  Well, it's curved like that for one practice been sharpened a bunch of times that way It doesn't work right Because then the the sharp edge isn't hitting the wood first like this This edge here is hitting That's why I'm getting some not stellar results All right, so we're gonna figure out a way to Regrind this edge. I just pulled that bolt out of there So what did a terrible job of kind of I'm gonna have to re-cut all these I checked and it's The thread size in here is not the common thread size of bolts that I have but I did find two That match so we'll be able to replace the two that I cut You know, I just have to cut them to length All right. Well, you get all those out. I will go see about those blades Trying to think of what I mean my bench Grinder wheels I would not trust on this You know, maybe I can mount a brand new one of these on my bench grinder. It's pretty good I mean I could keep going on these because like a Chunk out of there But I have to take like a millimeter off to get that out There are no matching chunks out on the other ones. So I Yeah, I don't need perfection. I just need pretty good. That's pretty good my jig here There's a washer that I bent Right angle Oh Yeah, and then to do this I Just clamped it down To where these were barely touching the wheel and then you know do a few passes and then Loosen that tap it in just a fraction of a millimeter and then go again It seemed to work pretty well. I was I was thinking my Grinder wheels here. We're not going to be smooth enough, but Tested and we seem to All right, my planar sharpening washer. I'm not gonna remember this So I'm putting it in video putting in this hidden this thing of stainless screws right there. Okay, right there Now on the back side. I want to make sure I take off any bits Well, I'm sure this is not the recommended way to do this next part This has a flat enough edge here that I can actually Rest this on and get the angle Careful Dad took me like half an hour to get this thing apart but went back together. I mean like that. It was nothing So nice. Now. I just eyeballed the height of these You know kind of looking in here Like they're all sticking up about a millimeter and a half I Can eyeball that pretty well, but you know, I might have to readjust it at some point. Anyway, I Couldn't wait and I already turned it on Here So good like All right, let me just show you for a second and I'm gonna take two millimeters off this before I was only taking one millimeter off off a board at a time And sometimes with really wide boards I'd only take like half maybe two-thirds of a millimeter off at a time But I just did like two millimeters off this and it's not even slowing down. It's just like oh Okay, hold on. I'm not gonna claim the surface. This is perfect, but man, it is pretty nice Oh, it's a really good huge difference from before and I'm cutting off twice as much so I can go and go through these boards twice as fast now Oh, that's that's oh Like you know, I came up here thinking Let me see if I can sharpen those things and it turned into like a half a day of renovations and Restorations and crap totally worth it though. This is gonna save so much time Oh, this crack in here is because I left it out in the sun and it dried too fast But uh, yeah, the surface man, it's great This is termite damage old termite damage termites are gone now. We can just fill it in with wood filler I actually wasn't even gonna use this board. It's what which is why I left it out in the sun But now I think I will use it. Oh, I'm so happy about this. Oh, this is so good You know every once in a while you do something and it just it just turns out spectacularly. Oh And it's something super useful. Oh, so good so good