engaging people that Will take on those leadership roles is crucial to you know So it's nice to talk about that, but there has to be an actually a concrete organizing plan for the leadership Great point. So one other thing there are trainings remote emergency management trainings for the folks who are going to be in charge of this in the City and there's like an operations like you know center. That's like that crops up an emergency, right? So there are all these components that are sort of known and done There's trainings we're looking folks up with and then you practice it right you practice that you see how it works And part of that we've heard early in our research of the can network is just what you said It's hard to sustain it in between emergencies. And so you know, that's the question is how do you find those leaders? How do you keep the can network simmering in between times of emergency? So I see some other hands. I also would love to ask you all that question of What would have worked better for you, right? Like this is the sort of moment of brainstorm of and do you have experience in the can network? What are your ideas that might make a can never just so everyone's on the same page? That's this local neighborhood like leadership, right?  You know who needs a supply, right? You know it's sort of like this like first pass alert and then support Neighborhood by neighborhood which we have had experiences. It was just alluded to in my pillar So I think the can neighborhood started up so I live up off Deerfield off Terrace Wait, what are we Park Park West Park West? I always get all the mob killer Park West neighborhood. And so we had what worked really well for us was Getting fed information so that we could feed it out. And so we created mechanisms of communication through We have a Facebook page, but then a lot of folks were like well, I don't use Facebook So we did a listserv so we collected everyone's emails And then we got down to the lower level which is just going to talk to your neighbors So I know almost I would say 80% of my neighbors just talking to them and understanding what their needs are and You know and you should we did that when there wasn't an emergency, right?  I don't remember we had those like truck those uh, like oh, right We had the like a sandwich board sandwich boards for that was another way of communication So as soon as you pull to the neighborhood we posted like Flyers and information so as people walked by, you know, if they didn't you know have email or Facebook or they don't want to come out and talk to you It was like more of a passive way to like communicate information. So I personally like the can network I think it was a great way to bring the neighborhood together and inform people That was not activated during the flood at all because we were not given any information to pass along to our neighbors So I think that was a break. That's an opportunity for improvement There's no longer any city support for it. So, okay They well even if I mean the the structure exists And so how do we continue to build that and think of a way to enhance it? And I think it was just information that we needed to pass along So I think there's just an opportunity for to improve That's your question. Yeah So first of all, thank you for for doing that I think that there are some elements of it that still live so one in one component of all of this is either Reviving reinventing reinvigorating whatever the existing and old network and that's sort of improving upon that existing structure And that is one of the sort of alert Methods that will go in conjunction with what the city is doing or what any other volunteer networks would be doing There were so many things that happened this July that were I mean a lot of them were initiated by the city And then the city didn't sort of stand up and take credit for those things So there were a lot of things that the city was doing for example Setting up the the hub tasking the parks department and Montpelier alive to sort of run that thing was an effort of the city and A lot of things happened because we we got lucky We had some of the right people in the right places at the right time and they just made it work So part of the work that we're doing is figuring out who is aware of the can network who was part of the volunteer hub What did the city do? What did individual businesses do that did it didn't work and then trying to piece all those things together into the toolkits So we're talking about and bring all that together into one larger more robust plan Sorry before we go there. I think Part of your plan I hope it is but one of the things that was missing during the response was an opportunity for improvement was including the Public Health Department So the state Public Health Department I work in public health. That's my background and in the world of epidemiologists They have emergency response plans to respond to these emergencies and that is what they do for a living And it was lacking in terms of our PPE our public health response our safety for our our citizens So they don't get sick. They did get sick It wasn't necessarily ported through the health department or through the hospitals But it was an unintended consequence that could have been prevented and I hope it's going to be part of this plan Thank you Look that goes back to the Great financial crash when there was a lot of worry about Seniors et cetera not having Services support so it was a way of trying to organize the neighborhoods to check in on people who might be having financial difficulties Yeah, and I think it speaks to and Adrienne brought this up as well that not everyone he not everybody Communicates or receives information in the same way And so while the city was was putting out messages and Monterey alive was putting out messages There are folks that just don't receive messages in that way So we have to sort of diversify the way that messages get out even if it's your next-door neighbors knocking on miss McGillicuddy's door to saying what do you need here some water and this is what's happening, right? And that's the beauty of this right? I think our whole concept here is my pillar is small enough We're large but we're small enough that what Adrian just described is your experiences in the you know can leader is You know exactly everyone in your neighborhood and what they need and how they get information be a knock on the door or social Media or an email and the only way to do that is at that level of granularity and it layers So that's like the surefire way that everyone that neighborhood is getting Communicated to and then there's like layers from there up to the city and then the state and great point about the public Dan and Adrienne So I hope you'll welcome a call when we get to that and we reach out to you and say what what experience and knowledge Can you help share with us? We still use that structure in our neighborhood all the time by the way I do have the database of the original leadership Thank you. That'll be super useful Having social services and mental health be part of The any planning for emergency response. I'm still in my Therapy practice. I'm still you know, obviously still it isn't that long. I'm still supporting people and picking up the pieces They're traumatic reactions to the flood and I'm sure that's true for an therapist in in the area I I would love for there to have been a And for there to be kind of a structure to to mobilize a much more organized response There's a group of trauma therapists from the Burlington area who I know we're Reaching out down here and kind of trying to send Um, essentially sending therapy missionaries I just quickly want to make a pitch to like I mean this is I feel like excellent feedback You know exactly right right and the goals of this kind of group coming out of it are things like that comprehensive Response plan right that is actionable for businesses individuals in the city, right? The neighborhood network that helps with that neighbor to neighbor assistance But also like this this thing that susan is really leading of this long-term recovery group I just want to talk like really quickly like what that is like we've seen incredible response to support businesses Right and the municipality But really what to be frank like You know, I think the original narrative coming out of the flood was like our downtown businesses are devastated and in berry It's all residential, right? And in fact, it's a much more complicated narrative, right 400 individual households or individuals Applied for FEMA assistance, right? And so across the state This is not like my computer inventing something new there's systems with the agency of human services Leah's a representative from capstone who's working on part of this to really set up You know, you've got if your house gets devastated you've got insurance You've got FEMA you've got the state fund of last resort And then you have your neighbors and you're never going to be made whole Right and so this final gap is the work of this long-term recovery group And it's not just it's financial resources, but it's labor it's materials It's support emotional support all of those things And so I just really encourage you folks as you're kind of like spreading the word about the work of this commission stealing There's an opportunity for everybody to engage engaged right now in this long-term recovery group We need more members than it and we need Additional energy So I want to give space for anyone who wants to get up and move to water shed or adoptive downtown Thank you so much. This is exactly the type of conversation And this is not the end That would be great, right? We're just gonna give you another minute for people to turn over here Thanks for those who stayed and we'll get even get more into it So We'll give it a minute We'll get started and we'll let people join as they come high to the newcomers and thanks for those who were part of our last round We actually just had a great You know feedback session, which is exactly what we're looking for. So just another recap This is the emergency response preparedness You know, how can we be prepared in light of the next The next one be it flood or whatever it might be And we just had some amazing conversation around the community action networks Locals or neighborhood alert systems. Some people have had experience actually currently be on those And some gaps and you know great feedback that was identified and we have Suzanne here as well as a resource to talk about long-term recovery So I'm just going to open it up to folks because we just had a really robust and I could tell there was more ideas Percolating that we didn't even get to so yes I would just like to talk about long-term recovery. Great And I don't have my prop with me tonight. I wish I did it's tape measure But the tape measure goes up to here Okay That's how high the water was in my house on lower stick street Okay, we are still not in our houses We were put through the meat grinder at your expense Hey I really appreciate you sharing that and it exposes so much of the complexities and the human element So if anybody wants to contact me get any kind of information, you're never going to be whole never and flood insurance Not good. Yeah flood insurance will pay for maybe a third of your total damage So if you're ever flooded You're never going to be Really cannot thank you enough for sharing that because we need to hear this exact story And that's why we have a long-term recovery group. But as you're saying, we're nowhere. We're eight months in and we're no Some of us are ready to move a little bit. We're told we can't All right, so they're This country has had so many natural disasters. It should be a seamless process you're assigned People that work with you through the whole process I was on the phone yesterday for four hours With sba because their portal to send them information wasn't working This is the nutty stuff that happens.  I'm so sorry you're going through that and your experience does Help because really as someone said earlier over 400 So seven homes as you just mentioned substantially damaged over 400 homes affected and I kind of think that's not really well known You know by your neighbors I'm saying a berry and the situation of berry is just horrible horrible horrible horrible It's stunk so bad for weeks after the flood. I mean those poor people I feel lucky compared to Yeah We are collaborating with berry in some ways and we hope to deepen that collaboration We really want to use this to sort of make it better the next time. So I'm the resource Really appreciate it and you mentioned layers of maddening bureaucracy is part of your Thing as well and that's what we're trying to investigate We just got off a call folks from the department of financial regulation We're doing some research on other tools In addition to flood insurance because there's this acknowledgement that they don't make you whole and what does that look like? Could that be you know for the city to buy for the city to be umbrella for residents, right? So I think there is an acknowledgement of what you're saying and trying to support So what happens is every time you go a little step you get a new person So you start over from the beginning. Yeah, how yours I have my story Memorized every word and every inflection in my speech about it And it happens all the time Well, I appreciate you being here and being going to say it yet again to us because it does matter I'm lucky I can still laugh Thank you Thank you Kate I'm really encouraged to hear of these conversations with the department of financial regulation because I have An idea rattling around in my head that has to do with better ways to help people get resources after the floods You know, maybe it's a formal insurance program But we've also seen an outpouring in this community and we know people who weren't affected who want to help people Who were affected who want to help people have flood insurance might not like to put their money toward that again What might we do with that energy and those resources? I wonder if there's some sort of community driven grassroots mutual aid style local insurance A product that would be legal to create And that would give people some sense of assurance that there's going to be something there for them And it's going to be less traumatized. They should access it other more conventional resources. So this is an idea that I've made up Great We'll take the seat of your idea and see what's there See if it can go. I love that. Thank you very much. Kate. This is um, this is how I cope with this is What are their ideas? How can we move forward? How can we sort of keep moving? Right? Um, which is my own personal coping mechanism In the light of disaster. Yes I'm Katherine Probo and I I just want to Tell a tiny bit of our story because I don't know if it's been brought up or not We live up Up by from our college And the groundwater Seeked into the basement. We had a stomp pump in the long spot My husband and I stayed awake 38 straight hours two shot backs We were thrilled lucky Came out way way way better than everybody else But in terms of preparedness and adaptiveness, I don't I haven't heard anyone mention And had exactly the same 36 hours that you did and it was Shocking, you know, because we weren't we were not expecting that at all And I think what you're saying is part of this general alertness of We are living in a different world now It is a wetter world It will always be wetter and we can need to be adaptive in all these ways and and maybe there And you know, again, like lots of talk about like lifting up utilities And as a reason we can all do that together and this idea of maybe All mobiliar can be privy to these conversations because they might be strategies. We all want and it doesn't have to be necessarily located by a stream a river a lake It can be groundwater driven in terms of preparedness and set back Exactly. Thank you for the people on the hills. I'd be worried about a landslide Yeah Yeah, pretty much deadly Yes No, go ahead. I'll pass for the moment. Oh, I don't think anyone else was a cool Okay. Um, well, I was just going to say first of all that I had a somewhat similar experience also at a higher elevation Um, um my sun pump kept up. I was very lucky, but you're at I'm 100 with you that that um Nobody is completely You know safe Yeah, and the same was I mean we're sitting there thinking what about our neighbors because the three of the four neighbors were all gone We couldn't even go check on their houses or anything. So when you think about preparing this That's great, but if you're holding on to those four Yes, so That's a very good point by the way And we can maybe get into that again with this group a previous group We did talk a lot about the idea of this community neighborhood action Which is a way to be connected with those neighbors as that first line of defense sharing resources Calling saying can I go into your basement check out on your you know, you tell you whatever it is So this is what we're very excited about is we just feel like we've got momentum in this small enough You know ready enough community that we can do that layer that level of granularity that might support what you're saying At least for neighborhood to neighbor. Please come And then I was also just going to circle back to what people were saying about public health and I I also work in public health at the and for the Vermont department of health So maybe we can talk a little more later about how we can collaborate We'd love to and back to sort of are the idea of this Local emergency operations plan The idea is you build the infrastructure and you build the relationships including with the state folks public health, right? Like all the different levels When you're not in an emergency so that when the emergency strikes those relationships are there, you know who to call You know, who's the authority? I we heard this so we've heard this so much I think we'll still hear who is the authority to say yes or no and there was confusion, you know, and that's why there was like not like yes, this is the declaration of what to do with You know PPE or with mucking out or whatever that is So I think that's really focused on that as we create the plan as we help create the plan So during the emergency I work for the state and so we were in age of commerce And so we were finding ourselves in the same kind of position like who's responsible For responding to the businesses or responding to so we we kind of made up the playbook a bit as we were going I mean the state does a really good job in terms of its emergency respond to this to Saving lives and you know clearing roads and you know the things that have to happen first But you know that plan like for the 48 hours after like how do we support the businesses and the property owners with consistent information, you know and and to get through kind of the now unfortunately, there's a lot of experts in town, but You know like having that roadmap of not just, you know, locally here Here's our roles, you know Katie and Alec were kind of making up, you know, like all of a sudden they're assigned like you're in charge of businesses You're in terms, you know, in charge of residents like having that in the plan in place and What's the role of the chamber of commerce or what's the role of these other entities regionally or statewide? So, you know, whether it's me or you know, somebody else In that position assigned at that different agencies would be helpful for all of us I love it and that's exactly the vision here is like very clear expectations now with enough time to actually practice I mean, that's the thing that's beautiful that they have trainings and they actually do practice You know exercises everything from a sort of more of a intellectual table top of who's on first This happens who do you call and who's in your, you know the speed dial to actually like practicing a full Activity of you know, this disaster happens. What do you do? Um, so right having that established and then even like worked in it a little bit to make sure and you write the city The state businesses volunteers. This is what we've heard from a lot of people too of just like Who is in charge? Yeah Um, we also have to The technology we have and the technology we're going to have available to us because rainstorms of that intensity Usually come with wind and the one we had didn't and so we kept power So the some pumps worked and the you know, the shop that's worked But we need to be thinking about you know, what happens in this storm That's more like a hurricane or a tropical storm Irene where you also wind and you're likely to lose power So setting up those systems in advance as well So Being realistic Can I just add that we were we were in conversations with um with playing field and they brought us a point of like cellular problems Like actually we're not so I career stuff on satellite phone Like having another form of communication beyond like when the cell phone cell powers go down You can pick up a satellite phone if you'll remember those They claim two things but being able to have some form of two to be Not sure that's a solution Yep, well we've heard people mentioned sirens and stuff and there's a real variants of opinion Some of the things that I hear people talking about is sort of one of the elements that we've talked about For example knowing what happened to you last time and then during blue skies times thinking the next time the water comes What do I need to do so that you already know ahead of time if there's wind if there's power outage If there's a forest fire, how am I going to respond to those things and sort of Not just knowing your own so that there's the city has a responsibility Volunteer networks will have a responsibility But each resident and each business owner will have in some way their own responsibility to know what You individually are going to need to do and then once networks are in place be able to communicate that ahead of time for example If on december 18th Was it the when when that had happened if we had already known From previous time because we'd had the perfect situation and enough time to prepare which we did but For example that oh this business needs this many people to get stuff out of the basement these businesses This is how what we need then when there's a flood of volunteers There's already the volunteer hub already knows these things for example All right, you take two people to botanica three people to enna four people go to julios or what have you and similarly with various neighborhoods that that type of pre-planning work during blue skies and then working on the the exercises in between allows us to kind of Be prepared when it happens. It's going to take a lot of research development implementation and then Keeping it alive because what happens to these types of plans in a lot of various is You go years without Something and then by the time it happens everybody who was experienced from last time has already died or moved away or whatever I mean, maybe this is part of your stakeholder analysis, but I'll feel bad if I leave this room. I don't say it The school should also be involved You know when there's any type of you know delay an opening or like whatever they have the technology to send out to every Single family and popular and rocks very so I just want to make sure that is part of here We there might be But I want to assume so yeah, thank you. This is yeah. Well, this is why we're having this meeting now This is all in like the preliminary stages of development. We've got our goal. We've got our priorities We want to hear input and now you know going into the actual sort of writing development phase and again There will be opportunities for I love that you bring it to life that example because that's like the exact point of like What do we need to do there are actually checklist for example that exists already that we've been looking at developing Like expanding upon for business for a resident, you know, what are your needs? I think we can do that Back and forth, but I think that's where we are not going to develop this in a Close room. You know these have to be really responsive to the proper parties, you know Good point about the school sorry I'm thinking so are you partnering with the remand and what is the management is that's I mean, I'm assuming they Write the responsibility. He's like I was just They would take a leave of the actual idea a couple things We have some folks that are Part of embers management and tangential to them on the commission So we're in sort of like a real flow of information there And then too, we've gotten incredible advisors who have already sort of like just said here's everything I know call us anytime, you know what I mean, and they're the ones saying, you know, we have a training That's for, you know, must take for anyone, you know Who is the municipal leaders who are the captains when this something happens? And of course the folks in city, you know city government who are those people are very responsive and say yes Sign us up for the next one So yes, and the beauty of this is every town has to have one of these in place and we do have one in place but it's like the First past year is like the continuing operations, right like what we've all seen now is it must be so much broader than that To do all the things that sort of mark and and we've been saying, you know for businesses and residents So that's the part that is not like mandated, but It's done. Let me just say it is done. We do we are not creating this from scratch You have to have a robust plan like this and we we have templates and advisors who are going to help us To speak just a little bit more to that I mean in the case of the city, for example, the city has An excellent plan for what the city needs to do to maintain the city's Assets to continue the operation so the fire But it also cannot be our firefighters and police who come Responds to the flood needs in my personal opinion because Who's going to respond to a fire when all the firemen are mucking out basements? Who's going to be we need police and fire to be there to do the work of police and fire departments But there have been so the city has a good plan It's just limited in scope and doesn't include what are we going to do at your house When it's full of water, right? So there are other communities in Vermont Bethel is one example that has A very robust plan they unfortunately kind of let their plan die But at its inception it was it was it was a really good plan and sort of laid out the volunteer networks will do this Individual residents and businesses will be responsible for doing this The government will be responsible for doing these things and so we're using that as a It's not a jumping off point, but it's a great reference point to us Yes We're going to build on that sure I was just going to say you know the other thing that we could think about is You know sister communities that maybe are like in this place flooding effects that we had Not every like Addison county wasn't hit the July floods Well, if you have a sister community in Addison county You could get equipment from or get supplies from or fans or whatever it is It's not always going to work that way. Sure because it might be a you know It's not a storm that impacts the entire city It could be a flood I think it begs us to kind of think about that a little bit because there's certainly a lot of across state borders into You know New Hampshire into New York where it might be able to get build those relationships a bit So if you have a break to see they can be at least aware and supportive and have that connection I that's a great idea. Thanks. I love that idea. Thank you Thinking when I see the footage of what happened in Maine Recently, I keep feeling like if we were three years down We would be in such a much better position to sort of offer them our experience and our tools But you know, we're still we're still working it out at this point and we're actually thinking about the creation of this robust sort of, you know leo be the long the emergency operations plan as potentially a template that could be Fill the whole PDF for every town in Vermont because we do feel like we've got the energy We've got this commission and every town needs one of these and very few actually have them It's like as big as we're thinking about this one. So we really actually would love to accelerate progress elsewhere Yes Has there been discussion about how to keep the momentum going? I mean assume the flood next flood isn't for 10 years We all have a short memory. Yes, and everybody's going to disperse and nobody's going to be here So what how do we keep this going so that There's always somebody that's prepared or somebody with institutional knowledge that knows what to do It's a great question And the answer is no, we're not because you're not going to let us do that and we're not going to let us do that I mean, that's a very high in the sky kind of notion But it has to be written into the thing of what is the schedule and who are the players that need to come together every Six months every 12 months. What have you rain or shine? Do tabletop exercises do broader live exercises or what happens? And one cool thing that we've been learning is we're getting to know this language and this this plan You know what it is all about is that it's like really the in an emergency You need the captain and the deputy right and they can they don't need to be specific humans They don't even need to be specific positions. It's actually more about the personality Like is this a good manager under stress? So I'm also choreographer and so you can sort of write that into this emergency operations like plan and then, you know Center and that those people could be even changing depending on, you know Turnover and other things but to mark's point is you have to have a practice schedule You have to keep to it because again, this isn't just for floods. This could be for anything So that's one very mechanical I think the answer to your question as far as momentum I spend a lot of time thinking about that bigger picture question How do we really get consensus and rally Our community together around making big possible changes here that are really going to make us more resilient more You know flood ready for the next time, you know, probably even more in the watershed adaptive downtown groups Big projects. Maybe that we've not been able to move to completion yet They've been in every plan for the last 35 years. Why and that's a big part of this commission is Understanding where did it get stuck and can we unstick it and I believe your point about keeping momentum and energy Is the only way we're going to really make major change that could really truly make us more resilient And public education is a big part of that I think we we're seeing is a lot of these projects are related to flood mitigation and no one's connected those dots It's like we've been able to move x forward If we come together and say, you know what that saves this many feet of flood You know storage next time around which means this many millions of dollars in sort of like savings and heartbreak And really tell that story and connect these dots We have a moment now that I think we have to take advantage of to make systemic changes that will last You know on their own. So anyway, that's just a more philosophical I think response to you because the public education piece of this I think is going to be critical and you'll see that in the next year as this all rolls out Just a two minute heads up. I'm going to ring the bells in a couple of minutes. Oh man. Okay. Thank you I just want to ask if you've um Looked into the incident command system at all because the structure you were just describing with people stepping into those rules Is that that is like that is the incident command system? Absolutely, and actually I happen to personally have had some experience post-ireen in government and uh The V-trans incident command centers was sort of like What made that response happen? And I just talked to scott rogers who actually works national life now Who's just like doesn't live in mom failure but said put me in coach. I'm ready to advise you all anyway You want I want to succeed and he was in charge of those incident command centers So just just to show you a little bit of like the behind under the hood What we're doing in the commission who we're talking to and it's amazing who's coming out to say I want to help however I can and it's that sort of expertise. That's just been Invaluable. Thank you So I have a Push over here comment If not you're gonna go nothing. I'll have to respond to those gentlemen. I think sustainability is like Like should be actually at the forefront so To answer that you should be able to answer that first and thinking about where this lives And how do you put it into policy so that it's held accountable over the long term? So I mean is it a part of the city structure like this plan like where like this should be part of your Planning right now because this needs to have a home. Yes. So who is going to own it? I think you should get big g I think should be part of a policy that Is held accountable that is required to have those two annual, you know, whatever, but I don't know if it lives in the commission I don't know where it lives, but I think you the part of this process is That should really be like On the top. Yeah, rather than like going to do all this stuff like where is it going to live and who is going to own this? Because it could just die. I've seen programs like this die and it's Terrible. Yeah, it's such a good way. I just wanted to speak to that for a second The commission isn't met as you've heard been sort of say it's not meant to be necessarily a permanent structure But we're more like a catalyst or an incubator and so the example of this plan There is my this one. It's like This is a little bit less tricky because it's super congregate There is literally a plan that will be a product and then we will have an exercise and this one is more straightforward it really needs to be embedded in the mechanics of city government and That's where it's supposed to live. That's where it's supposed to live by like all through, you know, works of management And that's why the first conversation we had was with the city and I just want to say again Like it was an incredible conversation because they said thank you. Yes, we know we need this and we could Really appreciate the capacity. We've so much to do We would love to spend all of our energy on this and we just simply cannot right? So I think they really see this as partners bless you It's sort of added added capacity, but we got that by an early so that they because we said let's just No assumptions here. We're not going to go right help you write this big plan You know consultants in if it's not going to become embedded and you know, let's just make sure Not mincing words from day one and really we're all on the same page about that. So it's a very good high level point I believe every project the submission touches that you'll hear in all these different groups They're going to have different answers about where they live. What's the long term? Okay, thank you so much everyone. This is just the beginning. Thanks


into the last video and this one. The last video that we've recorded and you can tell it was the last one because I'm wearing the same clothes. Oh, I'm a wardrobe. Dang, folks. And sometimes it just doesn't happen. So anyway, I don't think Avery's gonna come into this video, which is fine. But for those of you that wonder why we let that stuff slide, it's because you need to go back and look at the McSweeney video. Alright, so if you go look at McSweeney video, then you'll see that she was talking about habituation to reinforcers, right? So let's assume that this sort of format might be reinforcing for you under certain circumstances. And if that's the case, it's possible that you'll habituate to us. And one of the things that you can do to mess with habituation and recover sort of the value of the reinforcer would be to produce a stimulus in the environment that's largely just random. You know, one of these things. Avery may have served as a disabituator. We don't know. Maybe the cards are a disabituator. We don't know who knows. But all we know is that after nearly 800 videos, we haven't done much to disabituate you. So you might expect us to do something or not in the future along the lines of disabituations. Or we just tell funny stories about really cool journal articles such as this one. Conditioned inhibition of cocaine seeking and rats.  But it's one of the things that I don't know how to speak quicker. I can't imagine doing cocaine, because if you can imagine how quickly I speak now, I can't imagine what would happen if I did it. That's what would happen. I would go nuts. Alright, here we go, because this is a quick article, discrimination training for self administration of coke, click tone, and something else. Oh, and or neither. So sorry, folks, I'm really not on coke. Here we go. So the idea is, this is an extension of some of the literature on drug drug issues, right? Drug seeking behavior. So we need to look at drug seeking behavior first. So what is drug seeking behavior? Drug seeking behavior is when you seek drugs, like I'm gonna go from Oh, drug seeking behavior, I just did it. Why? Because there's drugs in there. It's caffeine. It's great. You know, sans vodka even better. Alright, so in the fact that I'm reaching for that or looking around the room for that's drug seeking. So the moment I grab a drug seeking behavior, right?  I have to grab drugs taking behavior. That's it.  Hi, at least I'm not driving trains. Casey Jones, you better watch your speed. Why? Because somebody's gonna steal it from you. We're screwing around on this video, folks. I don't know why because we are. Alright, so discrimination training for self administer. Oh, sorry, I was back there. So we're looking at condition inhibition. And we have to understand that one of the pieces of any drug taking behavior is drug seeking. So you have to seek it before you take it. For the most part, sometimes there's other ways that people can give it to you, I guess, you don't have to seek it. But that's a different issue. The literature as a whole has been focused on I can't keep a straight face when he's back to get close. If drug seeking behavior doesn't happen, what does that mean? There's a guy out there with a gaming NCR just I was thinking more about over a bridge or an airway. Just blow it. Everywhere. Everywhere. That would be the the way to do coke, like in a non drug seeking. Like I didn't seek it. I swear to God officer me just blew it all over me. I don't have powers of white. People think we're on drugs. Before this one, y'all were high like, no, we would just be like this. Because we have very limited. It's probably about five minutes. Now I'm doing nothing. All right, can we try this again? Can we just start over? Like, I apologize for all of you that are paying attention to us at this point. Did our disabituator work? Maybe you did maybe you didn't. We'll tell by the views. It's an empirical question. Actually, watch time. People turn our videos off halfway through. There's a story behind that.   So traditionally, when we're looking at drug taking behavior, we'd look at the seagull article that we've recorded a video on before you looking at it from a classical conditioning perspective. These folks we're going to look at it from a different perspective. We are going to look at it from an operant. So what happens if they establish a discriminative stimulus that actually serves as an inhibitor for drug seeking behavior? So we have to think about the type of training that that would happen and I am not going to go through the four pages of descriptions of how they established those discriminations. Because oh my gosh, it was detailed and it was really cool. It was very from what I interpreted very effective. And so did Journal of Experimental Psychology animal behavior processes, which is a pretty top tier journal for Wow. Yeah, anyway, it was a crazy cool procedure. So what they did was they established discrimination training for self administration of cocaine. So the critters self administered coke now is pretty low dose. And they started off on continuous reinforcement, they faded it out. And once they established that they could do that, then they put it on a discrimination training for multiple stimuli. So the click was that something like that. And they had a tone. Alright, so either the click or the tone sick was a discriminative stimulus for the drug, right? So that it's available. And you can compress the lever and get the drug. They had a catheter inserted and it was all it's really cool. Anyway, then they did they have extinction trials obviously. On top of that, once they've gone through all that to establish those things as discriminative stimuli, then they established an inhibited an inhibitory stimuli, essentially, that's minus where they said, we're going to put a bright light in here. And that is going to signal that no cocaine is available. And then they're going to pair that bright light under certain conditions. So if you take that bright light and go by itself, right, you turn it on, no cocaine available.  But what happens if we turn on the sea or turn on the SDs of the click, and the tone, and then the light? What happens? Will that reduce drug seeking behavior? And the answer is, Oh, my gosh, yes. Holy, as I say around here all the time, Holy Spicoli, which the irony of Spicoli and the drugs and it's great. So by training one discriminative stimulus to signal that a particular drug is not available, you can then use that discriminative stimulus and present it at the time that other SDs that indicate that the drug is available. You use those together in conjunction and drug seeking behavior goes, boom, it plummets. The condition inhibition is an effective tool to reduce the drug seeking behavior. So there's a lot of detail in here. And I want to talk about that right again. But I want to read to you the best interpretation of this article by incorporating conditioned inhibitors into q exposure therapy. Pause q exposure therapy is the stuff that you look at the seagull article, all that stuff. So go back to launch the video on that or pull the seagull article from 1975 and you'll see and then follow the research trail around that. So by incorporating conditioned inhibitors into q exposure therapy, practitioners could potentially improve treatment outcome by providing the client with a means of dealing with still active drug related exciters. Here's a tool you can use to help you reduce your drug seeking behavior in the normal context in which you live rather than having to change everything about the context, which is always a problem when you look at treatment of drug seeking behavior, drug taking behavior. The conditioned inhibitor might be a small and portable object, or perhaps a specific phrase or thought that the individual could deploy in situations that produce drug craving by suppressing this stimulus elicited drug craving. This conditioned inhibitor could help attenuate drug seeking and thereby avert relapse. No one says it better than that. I can't say it better than that, which obviously means no one. It's pretty cool. Like again, here we go. Rats jumping over into the real world of cocaine drug seeking behavior. Yeah. Oh, don't forget your AB literature, folks. We've talked about it before. I'll talk about it again, probably a hundred more times. But oftentimes in the applied literature, you can't do experiments like this. Okay, so you can do this experiment with rats. And then you can test the effects to see if it generalizes to humans when you're out there in your practice. This is the evidence that you might need. So one more thing that I wanted to talk about with regard to these people. Holy cow. When they talk about the apparatus, man, the difference in control of an experimental analysis paper versus an applied paper, they're talking about literally what type Tygon tubing from Saint Gobain performance plastics in Akron, Ohio, extended from the 10 milliliters syringes to a 22 gauge rodent single channel flip something apparatus by Alice King. I can't read that. Something medical arts and author in California. Like, there's so much detail in here. And that tells you the level of control that you need to have in order to do genuine experimental type research. So anyway, cheerio.


Because we might get oh sparking didn't go off. You know what? How's it going everybody? Dottonoi here back with some more Dragon Ball Fighters ranked matches this time playing the all Broly team with Dragon Ball Super Broly Goku and Dragon Ball Z Broly I think we all know that more importantly though is that we're going up against the second highest right play Krillin team Gohan and Ginyu that is a team right there I believe we played this person before if I'm not wrong I feel like this is a team I remember or at least the Krillin and team Gohan part But still gonna be a very scary as I did that. It definitely hasn't been for a long time Broly. Go and scream at him What a way with words Do I make a read right away reads? Oh, maybe in a million years that would work That was sick though. I feel like by the way, this might be a chance to see some crazy Krillin combos I don't want to put the other person on the spot, but we have two big bodies and a lot of other Krillins They like them. They like learning stuff. I don't really go for character specific. Oh, I wish that would have worked. I Don't really I've never really learned the character specific stuff to be completely. Why are we gonna? Oh, I think it was going for right there actually. I was right to bring it up I don't really go for character specific stuff because I don't know it's never been what I'm into when playing fighting games It's a little too much for my uh, all right, I'll say it It's too much for my small IQ. Oh Not the classic Krillin even I'm susceptible That was so sick. I see why people get hit by that now. That was tough Why'd I bring out Broly? Why'd I bring out Broly? All right, we might see it right here Probably not though. I'm not what this set up This was a little too high this guy. All right, this Krillin is moving by the way. This guy is aggressive. Oh That sucked. I definitely thought Goku was gonna have his back right there Man, be missus. It's been so long I've used a beam assist that they feel a lot slower than I remember them Krillin is just all over the place Krillin time This is a classic Krillin combos all the time. Well. Oh nice Nice vanish shouldn't have opted for a Super Dash there when vanish could have killed that was something I should have probably been expecting There we go unfortunate that I had to go for that but Yeah, not so much Krillin can do against that Hopefully one bar kills here. All right good. I'm glad I'm glad that worked I was like I'm really gonna risk a lot here, but I ended up getting the kill now We have to deal with team Gohan does he get aggressive to start with he does all right, so we read that right Doesn't cover the vanish though. Unfortunately All right. He's seen us try to push buttons once now We've seen us try to push buttons three times the next time he makes an aggressive move like that I don't think it's worth it because we might get all sparking didn't go off You know what the auto combo team go on took the stairs the elevator was out man said I could use some cardio That was sick. I want to spark early Team Gohan was crafty to get out of that one that Broly was looking angry to me All right bombos we love to see it I am Broly after all I am literally Broly I held vanish. I held vanish. Why did I do it? Oh no Oh so much damage. Oh sparking just to get even more All right, we'll take a hold vanish there Again, we're just trying to get team Gohan out of here. Oh, you know what? Let's not let's not waste any more time than we have to get him out of here Could have definitely done that for cheaper, but we still got three bars. Anyway, uh, but I probably should have I probably should have Went the extra mile. Yeah, we're gritting and I hey you want to change bodies You wouldn't have to want to change bodies, would you?  Is that a no? Okay. It's a no Oh, I thought that dropped for a second. Oh, that was a risky move All right. All right. I like it. I like it Not bad not bad Let me go ahead load up Whoo. All right great first game though. That was a lot of fun. That Krillin was all over the place Okay, time to refocus. We're not going to go for the read this time. It didn't work the last emissist Oh Should have been able to should have tried to punish that beautiful reflecting the 2m I can't deny bombos with Krillin out This is so dude Krillin is such a good character What are we gonna all admit it? I got hit by the rock. I felt like I was blocking low there too I got hit by the rocks On the ground destructive disc gonna have to switch out A second destructive disc wouldn't have killed there just because the scaling gets so bad But that was still really nice Okay, we need to we need to make adjustments there. Oh, I can't even do anything here We got very lucky No, oh my goodness. He tried to 2m me right there. I don't know what I did to deserve that but that was scary Do I want to use a level 3? I should but I don't want to lose corner One more time. Why not? I'm going for it. Gotta go for the big combos I'm rushing that hit though. I'm rushing the hit. I think oh, no Okay, I'll take it The team go on a scary man kick him out of here. All right still got to deal with Krillin I need to see more of the ginyu. I don't know how afraid to be of the ginyu He's timing these super dashes really well Oh, there's the ginyu. Okay, we need to see more of him. Anyway, gotta do it. So nice. I gotta fire him twice Uh Now right here. I'm way more inclined to take a level 3 Because I feel like we might as well go for something here. What's the distance again? Did they nerf this too? Or can I still get a 2m here? Oh my god? All right, that didn't get nerfed. That was always like that. Oh huge. Come here Krillin Sometimes that 2m is so slow. It kind of works as a frame trap. That was sick All right. It's a transmission. I'll make sure to visit your grave classic voice line. Now. We just got to deal with Krillin Krillin's the only one left. That beam is fast.  We block at that time He didn't commit. He didn't commit. He didn't commit. He didn't commit so good I gotta stop biting that line, dude. I've never received. I've never been on the receiving end of it All right, we still have Broly. I would definitely say we have the lead here And I'm not saying that like I'm for sure gonna win. I just want you to know if I win It was the I I should not be the underdog It's basically why I said that Oh, I I just didn't think he would commit to it. I thought he wouldn't risk it Oh god, that was scary. That was actually terrifying. No didn't block low. Is that it? Never mind We were gifted a second chance here and Krillin. He's too. He's too quick on his feet Sit down. Holy dude. I forgot I was Broly keep last keep last keep What?  Wow, that was a lot. I'm glad we got that one now We're moving on to the next one. All right, we are back and it is uh, we are up against the jeer player So who knows we might be getting a taste of our own medicine here. Can we switch? All right, we do get the switch also playing gojina and beers, which is really nice I'm not gonna lie. It took a while to find this second match. So I have mostly forgotten about I think it was the Krillin That sounds crazy because Two seconds ago for you guys. I was absolutely going through it But here we are we are I'm all over the place. Okay. Nice. All right, finally got out of the corner now. We are back in the quarter Oh, no, bro. I don't want to be here. I was having a great time not in the quarter. All right Good blocks though.  We're just gonna go right back out in the burly for that. Yep. Go into the keyblast. Why not slam them down? Oh, I should have kept stepping that would have been crazy. I'll take a grab the do we still have super dash? We don't all right use that way earlier burly I'm trying to get to the jeer. I want to see he had a jeer and icon profile picture He's named after one two three four. Keep stepping broly. That's all broly knows how to do Man broly is so much fun in this game. All right, take a level one if that doesn't kill Oh, it did. Okay. Nice. It killed so that's more than fine enough for me now We just have to deal with beer is do we make a read? I'm gonna say yes. Oh, if I would have actually gotten the input maybe that would have worked Beautiful. I can't get anything off that though.  I've been waiting on dude jeering Oh, I'm scared now. I'm scared. I'm scared of any counters It's always fun playing to get jeered dude.  Maybe you can counter it. No counter. I'm just here comes the headbutt. Here comes the giant fist Grab this Counter this oh never mind. I might be dead I might be dead big damage for anchor jeer level three this attack decides it Uh, I don't think at this point it does but maybe the okie afterwards will we'll see I might even armor through it I do regret my choices. I do regret my choices if it means a difference If it means anything to you jeering, I would take it all back Oh, I'm nervous That move does have a threatening aura dude that move is threatening All right, let's just broly level three see if we can't this broly level three might be the start of something great, dude Quick level three Overhead no, no, we don't get the overhead. All right. We're sparking. It's time to spark. It's gotten far enough Oh, you could have counted that no counter. That's gonna be all she wrote for jeering by by jeering Unfortunate, but we still get the win. All right If we in the next game The next game's gonna really be the inside if he wins this one The adaptation might prove too much for me if we get if he gets the counters Once jeering gets rolling it can be hard to stop and pierce right away. Wow Maybe wants to save gojita for more of that mid game. All right You know what I want to see jeering now If that's your anchor, I gotta see him now One two hold it keep last nice super dash great choice there Oh get back in the corner Oh, he's he's he's trying to run for scramble. I actually I'm gonna get stuck Scream at him Broly scream Hey, let's grab just keep screaming at him. Why not? Go for it. Oh, I'll take that too Broly It is just Broly's day out here down into the key. I'd be beam. Yep Down into Broly. Why not go ahead get a grab. Why you know what? This is Broly's game now I'm just staying in with Broly. I'm spending three bars for the damage boost. Let's go Oh What's the read It's it's too good, dude. The character's really clicking with me now Say last Broly. This really is the Broly.  Oh, that would have happened. I would have called this a wrap. I would have called this a wrap Broly would have been too far gone Stop, stop, stop, stop ahead, but The combos right themselves. It's Broly's world. We're just living in it reads Oh, no That could have been the that could have been the final touch. All right beers stepping up Oh Too much damage beer us Stop. Oh, what that was a great 2h? Oh, no You could probably tell I'm really trying to land that grab Feel like jumping. Oh, so you felt like jumping here comes the giant fist headbutt No jumping. Okay. He didn't jump That's going to be it for Broly, but hard to say he didn't do his fair share He put us in a great position to win and at the end, you know We we let the Broly get get to our head, bro. It was too much grabs too many command grabs. That's fine I'm more than okay with letting this be Dodge it. Okay, nice Keyblast might wrap this up. No, they don't There it is finally stagger actually gets us some hits I'm just gonna level three here.  Yep There it is the oaky is going to be more than enough and we come away with a big big win there That was a lot of fun. Uh, it was great playing this double Broly team again I might actually do it one more time Uh, because I feel like this video definitely got swept away by that team go out and grill it But if you did enjoy it, let me know down below your favorite moment And maybe some other teams you'd like to see me play and while you're down there Make sure to like button and subscribe to the channel to stay up to date on all the fighting game goodness We've got going on over here other than that you can watch even more videos right now There should be some on your screen if they catch your eye, but I have been down to do it Thank you so much for watching this video all the way to the end and I will see you in the next one


Hey everybody, welcome to another Monday OpenShift Commons briefing with another wonderful upstream project, this one Claire. We have Louis De Los Santos here, who's a principal software engineer working on the Claire project for Red Hat, and he's going to take us inside the indexer. And so I'm going to let Louis introduce himself, introduce what everything's going on in the Claire world today. And if you ask your questions, throw them in the chat and we will answer them at the end of the presentation. So take it away, Louis, and thanks for your persistence. Yes, thanks for the introduction. So today we're going to do a talk called inside the indexer, how Claire before extracts and persists the content of containers. So what this talk is really trying to uncover is getting the community or the watchers of its presentation more acquainted with the internals of how Claire works. Claire's fundamental goal is to provide insights about containers to the client, whether that's a developer or an operations team. We want to show you what exactly is inside the container and what might be vulnerable and have your teams patch those things or act accordingly. To do this, it becomes obvious that we need to understand what's inside the container, extract the contents and place them into some kind of schema which is searchable. And that's what this talk focuses on inside the indexer indexer is a service which actually takes all the layers from a container looks inside them, pools out the contents and creates a report. So what is indexing indexing is a term that that we use with the process of extracting the contents of the container itself. It is the first step in Claire's analysis pipeline. So inside Claire's pipeline we're trying to take a container and we're trying to understand what content is vulnerable. We split this pipeline into several phases and indexing is the very first phase. It's responsible for creating an index report which we're going to go into detail in just a bit. So if we're looking at the complete Claire pipeline to create a vulnerability report this is what we're looking at this is the 30,000 foot view. I have highlighted the portion of the application the portion of the pipeline which we're going to cover today in this talk. What you'll notice is we take a container manifest. We feed that to the indexer. The indexer performs a bunch of work which we're going to go into in detail in this talk and then it generates an index report which is the findings of the work that it just performed on the container manifest. So there's a couple key components here. Now if you'd like to follow along or you go back and you would want to look at this talk. If we're in Claire core, which is our project, this is the engine. This is what's really doing the scanning in the Claire project. If you do want to follow along in our source tree, the indexer code is in this internal package. And then there's the indexer directory here. Almost everything we're going to cover in this talk is laid out within this indexer directory. And there will be a lot of references back to this. So if you are interested in following along or just, you know, you're looking at this talk at a later date and you're trying to piece together what we're talking about to the code. This is the directory of interest. So the key components in this little section I'm going to cover the data models, basically how we go and structure our data to accomplish this goal of extracting the contents and reporting what we found inside the container. So first we have a manifest. The manifest represents container image for us. You'll notice it's made of a slice of layers. Those are order dependent. So if you go and you created a container, you know with with Docker or pod man. Those layers are created with a parent child relationship, and we represent that with the slice. So when you submit a manifest to us, you're creating the same concept as the layers hierarchy, the math, sorry, the containers hierarchy of layers. You represent that with a slice of layers to us and then just the hash digest of the manifest the content addressable hash signifying the manifest as a whole. Now this is the index report. This is how we communicate to clients what exactly we found inside containers. So we'll start again with the with a hash right this is a hash of the manifest as a whole so you can think of it as a unique identifier for the container and its layers in that unique ordering. And what happens to obtain this hash, you might know about this if you're if you know about how Docker images are built but if you don't, this hash is actually computed by taking the hash over each individual layer inside the container. And that computes a final content addressable hash. The state this is used internally and it is exposed to HTTP clients who might want to query the indexer. So the way this works is that when you submit a job to the indexer. If you were to try to submit the same job, we would actually give you back this structure and give you the state of the index. So Claire is smart enough to know like, hey, we're working on this right now. But here's the state you might want to pull the state if you want to pull the state just this wait until you see an error, or you see that it is successful. So we don't do this in quay right now. But as a usability factor, you could write clients which just kind of sit there and like poll on their job. It's part of the design specification for the indexer itself. Packages, this acts as a, let me actually take a step back, you'll notice packages distributions repositories. They're actually maps, right. It's a map string with the actual structure of the package distribution and repository. So the index report is really acting like a portable database. We do this for deduplication reasons. It would be unfortunate if we just continue to write the same package strings for every layer that we founded in or had to duplicate that information. So when you're looking at the index report, you actually kind of want to treat it as a database, which has key values that you can string together to understand where certain packages were found. So the way this works is you'll look at the packages, we'll call it a database, and it has the ID, and then it has the package name. So right now, you can picture this as a deduplicated database of all the packages that were found inside your container. Same thing with distributions. We could technically identify more than one distribution. We typically don't if it's a normal container. But sometimes there's dist upgrades or sometimes, you know, there'll be more than one file that gives us a hint on the distribution of the actual container. And this is, you know, whether the container is well, whether the container is sent OS, whether the container is Debian, that's what this is representing. And then repositories. These are usually language repositories. So if we find pip, if we find npm, they'll be represented here. And then the environments is what strings this together. So when you're looking at environments, this will basically give you the idea of saying, okay, we found this package in this layer at this file system path. And we needed to do this to support language packages. Because once you start supporting language packages, you have this predicament where the same packages could exist in multiple directories across the file system. For instance, if you are using npm, and you have a forms library, you might use that in five projects that are scattered around the containers environment. So we record each one uniquely without having to duplicate the packages identity by compressing them into these small databases. So that's really the bulk of what the index report is providing you. Now there's just some bookkeeping, whether you had a success or not. So this is again, if you're a client that's polling, and you want to know, okay, did we have a successful index or not, you can pull for that. And then if we didn't, if success is false, then we'll give you a detailed error message, which is just helpful for debugging. That's the index report. That's the output of the index error. So now we have scanner interfaces. This is a very important concept when dealing with the indexer because this is the externally implemented sections of code. Each scanner is in charge of taking a container layer and then parsing through it and finding the desired content that they're interested in. So we wrote these as interfaces, allowing other teams, other upstream contributors to come in and say, okay, I want a jar package scanner. You'd come in, you'd implement this interface, which takes the layer looks for jars and just parses them into packages returns it to the clear code. Very simple and this has been proving itself useful with the CRDA integrations we've done. I was working with a rune on code ready containers and I discussed this with him I was like, how are interfaces doing, and he showed us the PR it was all code add nothing needed to be changed. So this abstraction has been working pretty well for us. The same goes for distribution scanner or repository scanners. This plays an important role later on in the talk, but as you can imagine the indexer is taking container layers and trying to understand what's inside them. This does the bulk of that work. We hand each implementation a layer, and it can go ahead and scan through it and understand with its own business logic, the clear code proper isn't too concerned about what's happening in there. So the flexibility is there's a lot of flexibility there to to perform package scanning distribution scanning and repository scanners scanning the way the ecosystem sees fit whether that's npm or python or whatever. And then there's a coalescer. So this this is probably my favorite part of the indexer. And it's somewhat this took a little bit of time to figure out, you know, how do we do this right. So let me think of the best way to explain this. When you have a normal container. It's a series of discrete tar balls right and that they represent file system layers. Now, inside those layers, there might be what's called a white out file. And what that allows us to do is handle deletions between the layers. Now, Claire doesn't necessarily need to understand that. But at some way shape or form Claire needs to understand. I've had these layers. There might be situations where the packages I found in layer one, don't even exist in the later layers. So we don't want to put that in the final index report because they were deleted in some intermediate layer. So the coalescer is another interface which handles this business logic. So it can go ahead and it looks at layer artifacts, which are similar to the index report, but they represent the individual packages distributions repositories found inside an individual layer. So the coalescer will take a list of these artifacts. And with its own business logic, it will understand whether it should actually keep or remove particular artifacts from the final index report. In a similar fashion as if you were a container runtime, and you had to apply a set of layers on top of each other to get the final container file system image that's going to run on the host. We do this, we obviously don't have to do it with the file system in mind. We have to do it with the end goal of creating an index report in mind. So a little bit of in-depth detail there. There's two implementations of the coalescer currently. There's one specifically for REL that you'll find. And then there's a generic one. So let's take a look at that real quick. Inside this, inside our root directory, if you go into internal indexer, Linux, because this is a Linux focus coalescer, the coalescer is inside here.  And there's a little bit of heuristic in here. We have to kind of identify distributions in a very piecemeal way, right? Because while it's not the common case, what could happen is that you have layer 0, layer 1, and then finally in layer 2, we find something that gives us a hint on the distribution of the container. We now have to somewhat backfill that information to previous containers and then attribute the packages found in those previous containers with the distribution information we found later on. And this is just the nature of Clare, right? Like this is kind of what makes Clare a unique application in the fact that it's dealing with piecemeal information the entire way through. And we're kind of finding novel ways to stitch this information together and then create a cohesive result that represents the final image. So the architecture of the indexer itself, it has a RESTful HTTP API, and we've written this in such a way that you could theoretically, if your application needs, we're simply just, I want to know what's inside the container. I don't care about vulnerabilities or matching them against anything. You could go and you can take the indexer and use it as a discrete service. It has no other dependencies. So if for some reason you had the idea of like, okay, you know, I'll go and I'll do my own vulnerability matching. Given that I have this little piece of code, this service that's able to give me the contents of a container, then you can simply just use this alone. And there's a RESTful HTTP API to do that. It is also architected and modeled as a finite state machine. And the reason we did this, well, if you're not quite sure what a finite state machine is, it's a set of logical steps, states, if you will, that house business logic. So as you're moving through this business logic, you're transitioning via states. What this allows you to do is when we were re-architecting Clare v4, we wanted to be able to basically quickly say, okay, there's something else we need to do. We don't want to refactor the entire application. So if we model it in a state diagram like this, don't worry about knowing all this. We're literally going to go over every step in this. But if we model it as a state diagram, and then we decided like, hey, after scan layers, we actually needed to do this new thing. We just pop it into the diagram and then do the plumbing necessary. Almost no code has to be refactored, which has worked out very well for us because when we were re-architecting, for instance, index manifest came as a requirement much later in our development cycle. And it was almost no refactoring was necessary because we just created a new state and popped it into the state diagram. It is a common pattern. I'm just explaining it in case you're not too aware of what that looks like. So I have a little snippet of code here about how the state machine runs. And let me go back to the source code just in case you do want to follow along. The actual state machine is in the same directory, the internal indexer. And we call it a controller to follow along with a lot of the semantics around Claire. Maybe a small aside is that a lot of times you'll see interfaces and then controllers. And the way we kind of architected Claire as a whole is that people upstream individuals very simply just implement interfaces and the controller handles most of the business logic. This separation has made contribution pretty seamless because contributors don't need to worry about databases. They don't need to worry about how Claire actually stitches things together. All they really worry about is implementing interfaces and then we have controllers which control these interfaces. So if you are interested in following along anyway, this controller is the actual implementation of the state machine and the guts of it is really in controller.go here. So I'm just going to go over the actual run method here because I think if you are trying to follow along then it can give you good insights. We have this this dictionary or this map of state names to state functions. And as you could assume state functions are the actual business logics of each of these states. So you'll probably see like a fetch layer function. What we do is we get the current state of the state machine and then we automatically run that state function that state function is going to return a new state is a very recursive algorithm here. It's going to return a new state. We're going to see if we need to do any error handling. We're going to check if we're at the terminal state, which is a canonical way of saying everything's done. You can halt the machine. Once we have once we determine it's not the terminal state, we set the machine state to the one that was just returned. We do a little bit of bookkeeping here, which writes the new state to the database. This goes back to if a client is polling the indexer. This is actually the hook that says, hey, there's been an update to the to the index report, you probably want to be aware of that. If we can't do that we do some error handling. And then finally we just recursively call run, which just does the whole thing again with the new state. So it's a recursive algorithm. But again, what's nice is that when we update the state diagram, we don't really refactor anything. We just add a new state function and then we update the state map. Okay, so now I want to dig into each of these states individually to give you an idea of what the indexer is doing. So the very first state that that we enter when you submit a container manifest to the indexer is called check manifest. And it's exactly what you think it is. It's we determine if we've ever seen this manifest before. So, we can do this because of content address ability so I don't know if you've if anyone has watched previous talks with me and Claire, we're always hammering on this the content address ability aspect. What this really means is that if we see a manifest with a particular hash, it's content addressable it's the same content. No matter when we scan it again, no matter when we see it, we can always be sure that the same layers with the same content make up that manifest. Therefore, if Claire sees it, it can go. Oh, okay, I've seen this manifest. I don't need to do anything else. I can literally just return the index report that I've already computed for this manifest. Now in this case, we're going to say Claire has not seen this manifest so it's going to go okay. Move it through the pipeline. We need to we need to move it forward. Now there's a bit of a subtlety here and just something that's nice to know. When you're working with multiple scanners. What we'll actually do here is let's say that let's say Claire has seen the manifest, but now the implementer of the jar scanner for Claire made some changes to it. And it might detect things a little differently. The check manifest state is smart enough to say, Oh, that jar scanner has changed. So I'm actually going to submit this manifest down the pipeline to the next state, but I'm only going to scan it with the new jar scanner. So this adds to the ability of just doing as little work as possible. And you can see that actually in the source code, there's a little section where we we clip off scanners. If they have actually scanned the manifest before so just a little tidbit of information that I think is is nice to bring along just in case if you see it in the source code. So now, once we have said okay, we haven't seen this manifest before. And now we're going to move it down the pipeline. The next state is what we call the fetch layer state. So in this, in this state, Claire is trying to determine which layers it actually needs to go out, spend system resources to fetch, download, decompress possibly, and then scan. So in this diagram here, I express the common case of Claire deciding this base layer. I've seen it already. I don't need to go and grab it. It might be UBI 8 base layer. It might be a Ubuntu base layer. It's a very common case because a lot of containers are just built from the same from in the Dockerfile. So this is another example of basically how we're doing less work when it's possible to do so. When Claire fetches the layers, it's going to buffer set buffer them to disk. This is a small change which adds a lot of benefits from Claire v2 to Claire v4. Claire v2 would actually do all the work in memory, which can be problematic if you're trying to pull down gigs of layers, right. So now we buffered a disk when you're running Claire. We advise, you know, definitely have at least 100 gigs of scratch space SSDs will help because we actually do use the disk layer quite a bit for buffering data, especially for very large layers. Now we go into the next state. So we have the layers. They're local on the file system. Now we take the scanners which were computed in the check manifest state. We say, okay, we have this list of scanners. We know what we want to scan inside the container. Now we do that work. So the way the scanning state works is it takes that list of scanners and it will concurrently via go routines fan out the scanning business logic. The controller does this right. It knows the implemented scanners that are configured. It'll scan them out and then hand them each layers. And then they just begin scanning the layers. And then they return their contents back to the controller and then the controller will write those contents to the database. So in the scan layer phase is when we are actually computing what's inside each layer and then storing the partial results of each layer into the database. So to touch on this a little bit, I went over this in the components section a little bit, but just as a refresher, because there's a lot of data throughout the talk. So I wanted to put little reminders. This is what the package scanner, the distribution scanner and repository scanners look like. As you can tell, when you call their scan methods, they're given a layer. If we go back just a bit, you will know that the layer was buffered to disk. So it's a little bit abstracted, but the scanner can get tar handle to the layer if they want, or we do have some abstraction methods on the layer that says hey just give me this file. So an example of this, if I was implementing an MPM package scanner, I would implement the scan method to look at the layer, grab a tar handle, and then look for all the node modules directories that I can find. Parse any packages found into clear core packages and just return them, and then your implementations done. So that's the level of abstraction that you can expect if you're trying to implement these scanners yourself for your own purposes inside Claire. That's all you have to do. And when we get back these clear core packages, these clear core distributions and repositories, we simply just write them to the database with our with our own database handling logic, all internal to Claire. So any implementers will not have to worry about that. This is a look inside the Claire data model of how we actually stitch these items that are found during scanning together into an ERD for searchability so we created the idea of scan artifacts inside the Claire database. And what this is really doing is it's just tying together the ability to search saying, okay, we found this package in this layer and it was found by this scanner. This data model makes it possible to say a new scanner has been changed. Let's scan that layer again, because we're recording exactly the scanner name version and kind, which found these artifacts. So this is just a little bit of details in how we stitch everything together inside Claire's database. And then we get into the coalescing step. So I mentioned coalescing a little bit about how this is how Claire computes all this partial data into a final index report. And the way this works is the business logic in in the controller will go ahead and it'll ask for the scan artifacts for both these layers right the the two layers that we scanned. It's going to go and it's going to get this layer artifact structure, which has the packages the distributions the repositories. And it's going to go ahead and it's going to get the the other layer artifacts from DF zero. And you're going to feed both these layer artifacts trucks to the coalescer. Now what the coalescer wants to figure out is how can I attribute packages to distributions, we touched on this a little bit but the distribution information might be you know in layer 10. And the packages database might be in layer two. So we have to somehow coalesce this and backfill distribution information. We also have to figure out which packages should remain in the final index report and what packages should be deleted, you know, based on the state of each individual layer. So the coalescer works similar to the ganners in the fact that the business logic in the controller will spawn coalescers with go routines, run them in parallel. They'll both create their own representation of the final index report. And then we just merge them together to get the final index report with the final set of contents that are left inside the image. So this is in the index manifest state is where we make the contents of a container searchable. It's not a super complex data model or ERD diagram. But basically what we are doing is we just have a giant link table that basically says we found this package in this manifest we found this distribution in this manifest. We found this repository in this manifest. Where this comes in handy is when a new vulnerability enters the Claire system. Vulnerabilities are usually tied to packages and distributions right so if you have the rel pulp security database. When you look at a vulnerability it's going to say like open SSL rel eight. You take that vulnerability and ask the indexer hey which manifests have open SSL and are of the distribution rel eight. And this index manifest makes that possible to give you that answer and it happens after coalescing. So we get the final computed results of what's available inside the container image. We index that hence the name indexer and then it becomes searchable in the way the aforementioned way when a vulnerability is attributed to a particular package and distribution. And this is exactly what the data model looks like. At the end I'll go through the ERD diagram and I'll go through basically the database code. And then finally we have index finished and this is very simple state this basically just massages the the state and success keys. Well the values in the index report and then writes them to the database deferring work so Claire. We touched upon this throughout the talk, but one of Claire's main goals is to do as little work as possible so we can compute results and give them to the client as fast as possible. So I want to just review real quick some of the ways that player before does this deferment of work. So the big first part is just the manifest scene start right because of content address ability if we have seen a manifest before we're simply just not going to do any work we're just going to go right to the database and we're going to say okay I have an index report for this manifest hash. I'm just going to return it. Now again this is excluding when scanners might have changed. Or Claire is just configured in a separate way, or a different way rather than when Claire can understand that it's configuration has changed, it will go ahead and it will scan the manifest again. So another way of deferring work is determining which layers to actually scan. This is fundamentally the same as the check manifest state just on an individual layer basis. So again, content address ability indicates that if I see this hash, if I ever see it again, the contents haven't changed, therefore I don't need to re scan it. So it's another way that we're able to do less work. And another reason why indexing large amounts of images might not be as scary as it sounds, as long as they are sharing, you know, several layers.  And if that's the case, then Claire is really only doing work on a single layer every time you push an application update as long as your dependencies aren't changing. And you write your Docker containers in a same way, which utilizes this, this separation between base dependencies and application. This is just touching upon, when we do decide that we're only going to scan particular layers, we just go right out to our own database that has this information in it already, grab the information, and then bring that information with us for the other steps, the other portions of the pipeline. Cool. So that is inside the indexer. I have some information here for you, which is my email address, if you'd like to get in contact with me. I have the Claire GitHub repository. And the Claire core GitHub repository. So that's all I have for the presentation. I'm into either doing a little bit of code digging or we can go right to questions. What do you think, Diane? A little Q&A here because there's one question and the other thing that I would have you do is go to your site and show the schedule for community meetings, because you've just done an amazing run through to give insights into how to contribute and how it all works. So I want to make sure people know how to find you and get into the community and get started. And while you're doing that, I'll read off Andre's question here. So which phase of the general CI CD pipeline should be the appropriate position for Claire scanners after some deployment or somewhere as a testing linting health check phase of CI CD or as part of the security vulnerability management and QA process? I know you have opinions about that, but I think everybody has an opinion about that. Yeah, definitely. There's there's opinions about that me personally.  When you create those staging containers, and they get pushed to a repository, that's really your time to do that scanning understand the vulnerabilities that might be inside your container before they ever hit production right. If you don't have a staging environment and you simply push containers and then deploy them to production, you still have that period of time where you've built a container, you've pushed it to a registry. It's available for Claire to analyze do that right before you were actually deploy your code. So in the CI CD pipeline, I would say as a, you know, as a general best practice, do it as early as possible, right, like as soon as you have the container built. And obviously before you push it out to an environment, then I would do the scanning as early as possible in your CI CD pipeline. All right, and Andre says thank you very much for that. You're welcome. And now on dev has a, I'm sure it's an interesting thing that he's posted is wait, there's a state management solution for go line. Can you talk a little bit about that and you must have mentioned it earlier and I'm not exactly sure what you're referring to. But we have written that state machine code just in pure go as a incarnation of our own development. We're not using a library for state management. But if you are interested in state management and you'd like to see how Claire does it, I would definitely check out that code. It's probably a decent representation of what a, you know, F FSM or finite state machine implementation and go could look like. Yeah, it was it was written to serve a purpose. It might not be the shiniest cleanest thing, but it works and it works well. So if you do want to take a look at how we work that finite state machine architecture in, again, you can go to our source, which is clear core. It's the internal directory indexer and controller. And what's really interested to you would be this controller dot go and state dot go. And this is basically how we created the state transition tables, which maps straight states to functions. But yeah, no, no library, no manate state management solution for that. We just, we just coded it. Yeah, that's it's usually how things get done. And then eventually someone says, Hey, that could be something something useful somewhere else to modularity and creating libraries. Absolutely. Yeah, someday. But I think what what you've just done, which I wish I could get every upstream project is to really explain how Claire works internally, and in order to contribute to a project. That's like one of the often one of the missing pieces because you know a bunch of engineers from Red Hat and elsewhere that have been contributing over and over and taking the time to really explain how it works is wonderful. I can't thank you enough. I'm hoping that will drive people who watch this and want to use Claire in whatever projects or products or states that they want to. We'll come to these community meetings and then, you know, take a look at it, whether you want to create, you know, take a look at the state management solution. Code base, I guess, rather than solution or contribute to this, that would be a lovely thing. And so thank you for powering through your power outage there. This one is making this happen. My pleasure. Anything else you want to add in terms of what's next for Claire and the Claire community. Yeah, maybe just a couple of touch points on what's coming up on the our internal agenda. Right now we have the 4.1 release baking. And this release has a pretty paramount feature called what we're calling enrichments. You might have noticed when we redesigned Claire before, we wanted to remove false positives as much as we can. By doing so, we've removed nvd as a vulnerability data source. We did that somewhat opinionated. I think a lot of people share our opinions that nvd might not be the best source of data. However, when we did that, we removed a lot of the severity information that people became accustomed to. So the enrichment specification and 4.1 roadmap goal is all about allowing auxiliary data information to enrich our vulnerability report. So we took kind of a best of both worlds approach in my opinion is that we're sticking with the official upstream vulnerability data. But now we're just enriching that data with nvd metadata. So it's a little different from going to nvd and trusting all of it. Instead, we have the trusted source and then we're adding information to the information that we already trust. So this is a 4.1 goal and you'll notice that a lot of information for vulnerabilities will become richer. And if you'd like to follow that development in any way, shape or form, you can go to quay Claire. And on ours, is this big enough to see? Oh, a little bit bigger would be better. There you go. Perfect. So you can go to our discussions and inside this design tab right here, you'll see Claire enrichment specification. And just by the way, we practice open design. So any big ticket changes that are going to happen to Claire will be in this section. So it's just a good good area just to watch. And this is the Claire enrichment specification. And there's a link to our GitHub repository. So the spec is here and the implementation details are here. I'm working mostly on this implementation, but community contributions are completely welcome. Every single detail to my best ability is outlined here. Some things may come up just from, you know, implementing software is not, it's not always so easy to foresee everything that's necessary. But the majority and the chunk of work that needs to happen is all here and welcome for community development. So if you'd like to speed up the rate at which NVD data winds up back in clay, it's a good one to just, you know, be abreast of and take a look. Yeah, other than that, I think that just kind of being aware that we have a community development meeting. Every second Tuesday of the month. I'm hesitating about that. Is it every second Tuesday or is it just every second Tuesday? Every second Tuesday. I'm not sure. That's good. Peer review. This is why we do this. All right. We didn't have to do a pull request for it. That's great. Yeah. Yeah. So cool. So what I'm, I'm hoping I'm looking to see if anyone else has any questions, whether you're out there in Twitch land or in blue jeans or wherever you tubing and watching this or on Facebook, even post your questions. Otherwise, we're all clear with all the questions and we'll go, we'll let you go back to your day, Lewis. And if you can share your slides with me, I'll share it with the community as well. And we'll upload this to YouTube and hopefully. Now that everybody understands how the indexer works, they'll be excited about contributing to it and come to a community meeting. So thanks again for taking the time today. My pleasure. My pleasure. It's very fun.