My name is Cole. I'm going to talk today about TPMs and how we've used the TPM to provide some secure attestations using Spire. My name is Cole Kennedy. So a little bit of the work I've done recently. I co-authored the CNCF Secure Supply Chain Best Practices paper. I've contributed to Spire and Toto and a lot more open source projects. Open source is really a passion for me and I think it's really driven a lot of our innovation forward over the past 10 years. I'm a security and dev tech architecture SME. I've done architecture and security for Duke Energy, Colorado State University, Platform One, GBSD. And then most recently I worked on the city secure software factory. SME with air gap and high compliance networks. And then I'm also a Iraq and Afghanistan veteran. So I work for a company, thank you. I work for a company called TECSER. I own TestifySec. We just launched last Wednesday. So we're providing cybersecurity professional services and software to enterprise and federal customer. We're focusing on software supply chain zero trust, automated governance and open source software risk management. But enough of that. So what are we doing? We want to use workload identity to secure systems all the way from source to production. So when we threat model CI systems, we're looking at three different things that we really need to attest. We need to attest the materials that are going into that build. We need to attest the environment that the build is taking place in. And then we need to attest the actual process that is acting on those materials in that environment. And then we need to protect private key material with trusted hardware. And that way our attacks are either limited to hardware attacks, which are tough, or critical software components that we know to monitor. So really what we're trying to do is we're trying to understand what was a system state when we issued that identity. And we're using Spire to do this because TPM policy is pretty difficult to manage per machine. We're using fleets of machines that are ephemeral, they're coming up, they're coming down. We're changing them all the time with these immutable states. So if we got to change the TPM policy for that, the tooling around that might be a little bit complex. And then Spire provides an identity management engine. This identity management engine is federated, it's distributed. And Spire, best of all, it's really ready for production deployment. We've been running Spire in some production deployments for various customers for a long time. It's been rock solid, we really love it. And its plugable design really meets needs for complex use cases. You can take Spire and really make it whatever you want it to be. So Spire is a community project and it's backed by a bunch of major corporations.  So it's a project that has money behind it and really good solid devs. I consider Spire high assurance open source. So again, that TPM that we're talking about, that's going to provide selectors for Spire's identity issuance. The Spire selectors framework works really good with the TPM. You'll see that in a second. The architecture of Spire really simplifies how we use TPMs in our system. And finally, Spire provides some really good APIs that allows us to build on our secure systems. So what are we going to show you today? I'm going to show you remote attestation of a machine or edge system if you want to use the marketing term. So with a cloud-based Spire server. So cross your fingers, please pray to the demo gods now. Hopefully it works. And then we're going to use the use of the TPM platform configuration registers to remotely attest that system. We're going to test the boot state of that system. And then we're going to issue an identity to that system based upon the public hash of that attestation key and that boot state of the system. So let's go back a little bit and talk about what is a TPM? Why is it important that we're building secure systems around this device? So there's different types of TPMs. It's really important because they all have different threat models. So you have a discrete TPM. This is what the trusted computing group considers the most tamper resistant. Most of our TPMs that we're going to be talking about, I think, are going to be integrated TPMs. And that's going to be a hardware component that's integrated onto the chip. There's a firmware TPM, right? And that's actually integrated on that CPU. Those might be vulnerable to like management engine attacks, for example. There's a software TPM. Don't ever use these unless you're testing. There's really no use to actually secure an environment. They may be good for metadata if you're in a trusted environment, but really TPMs are not that hard to find. And then virtualized TPM, right? So if you're running Cloud, if you're running your builds in the Cloud, actually Google actually gives us a shielded virtual machine that includes a virtualized TPM. And there's some proofs that they have about how secure that is. So you can go ahead and look at that yourself. And then if you're using like a virtualized system, I know VMware or KeelMU also offers TPMs. So TPMs, right, they can do a lot of things. They're the list of some of the things they can do. But really today, well, we're going to focus on our two things, right? We're going to focus on platform identities, and then we're going to focus on the protective persistence store, right? That's where our PCRs are going to be. So how do we use a TPM for identity? Wow. Look at this. We have selectors that we can select identities on. So with a TPM 2.0, you see we have these PCR registers and we have some hash that identifies that system state. Also, we have the public key hash or the CA certificate hash, right? This TPM plug-in was actually forked from Bloomberg to Boxboat and then we forked it from Boxboat. So there's a lot of different things you can do with this. And then also, we're going to get that process identity from the workload API. So what does this trust actually look like? How does it work? Well, the server takes the attestation data that was provided by the agent and encrypts it with the public key, right? So then we take that and we ask the agent then to decrypt that. If the agent is able to decrypt that, right? We know that the agent is who it is. The agent owns a private key for the public key that we have. So we take that public key hash it and use it as an identity selector. Not shown in this, but there's also PCR data that is attested. So we need to do TPM quote verification. It is going to want what you want to look up on that. But we actually do that to verify that those PCR registers are in fact what they are on the server side. So what exactly is in a PCR register? Well, here's an example of what normally is in one for an x86 PC. Now, depending on where your TPM is, right, that's going to dictate what gets put into it. A device manufacturing can change this, but trusted computing group, this is generally what we're looking at. So what we're going to look at right now is PCR4 and PCR5. That's that master boot record. Now, if we have a hash of that and we have a hash of the config, we can assert that nothing changed in that MBR and our boot state is what we expect it to be. Also, we can select on the BIOS hash, the option ROM hash, right? All of this. One that you might not want to use there is PCR6, that's state transition, so if your computer goes to sleep and wakes back up, that's going to change. And then PCR10, that is a really interesting one. The Linux integrity management system actually uses PCR10 when it's able to do integrity checks on all the files in the system. So if something like SolarWind happened on your system, if you had that enabled, you could look at PCR10 and verify that along with IMA to see, okay, there was something that happened in the system that we didn't expect, so we're not going to issue an assert. So demo time. All right. This will go actually pretty quick. So we are going to... So the first thing we're going to do is actually go look at the PCRs right now because let's assume that this machine is in a trusted state, so we want to get those hashes. Those hashes are pretty hard to predict. There's some work being done on it, but it's best probably practice to trust on first use, grab those hashes, and then register in the system. So that's what we're going to do. So we can see we have our PCR hashes there. Now if you look, we have PCR4 and 5. As long as our kernel stays the same version and we don't have any kernel modules or anything else going to NBR, that's going to stay the same. And I think that's some important information that we want to include in our build metadata. So then we're going to do a SPIR registration. All right. And then we are going to start our SPIR agent. And there we go. And you can see we have a SPIFI ID issued to this node based upon those PCR registers. So if we go in and we do add a kernel module to here and we try to get that identity again, even though nothing else has changed, even though that TPM still has that attestation key, the same one, right? We're not going to issue an identity. So this is important, right? This is important because when we are building software on systems and we are assigning that metadata for that software, we now have a way to assert the state that that software was built in. We can now ship that data either downstream to our production systems or off to our consumer of our software to give them confidence that we have done the right thing and the risk level of running the software on their system is low. So what's the future work look like? So unfortunately, this plugin was written on free plugin SDK. So in the next few weeks, Mikhail and I, we're going to be rewriting this to use the new plugin SDK. We're looking at using a key manager plugin, TPM key manager plugin for the server so we can securely store those keys whether you're in the cloud or on bare metal infrastructure. And then we're also starting some work on IMA hooks into the Unix Workload API, right? So that way when we issue a certificate to that workload, let's go check that PCR register and see if it matches. And that will allow us to make sure that not only the boot state is consistent, but also the current state of that system is consistent with what we expect it to be, right? If any of those files are different than what they expect it to be on that IMA 10, that IMA 10 will show it. And then I know VMware is also working on some spire like trust on first use semantics. There's some work going on in there. I think there's a GitHub issue. I think that's another issue that we need to look at because we don't want to trust that certificate that we issued to the agent for a reissuance, right? We want to go check those PCR registered to make sure that system state is still within the constraints that we set, right? Well, that is my presentation, but I'm sure you all have a lot of questions. Q&A works differently now that we're in person. Our moderator, Andrew, here will read any questions that come from the platform, and I can walk around with a handheld for any questions in person. Question in person number one. You have to raise your hand if you have a question. Hey, cool. This is awesome work. I noticed you mentioned IMA for PCR 10. So do you see kind of there being a separate server to kind of validate locks before you kind of, you know, create the entry, or do you think you can specify your IMA policy within the node attested cell? How do you see that working? I'm looking at building it into the Unix plug-in for the workload attester, because I think that's where it belongs, right? Because if we want to test a state that's changing, we want to check that every time we issue a certificate. So I'm open to figuring out where that fits in, and we've been talking about it a little bit, but I think that's where I want to explore first, and then we can add additional selectors when we hand out certs to workloads. Cool. Thank you. Any other questions? We will give one minute for the folks on. We've got one already here. So you kind of pointed out that, you know, getting your hands on those PCR hashes is kind of like a trust on first use sort of process where you kind of like go onto a machine that's in some sort of good state, and you dump them and then you kind of figure out what's in your policy and whatnot. What are some of the ideas, if you have any, right now on how you might make that process a little more easy for folks? I think, you know, it's hard to say, right? I think there needs to be somewhere to share those hashes. We haven't quite got there yet. We're just kind of trying to get this whole thing working from the left to the right. But yeah, I think that's going to be an organizational thing, right? I think a lot of those hashes should be similar. Organizations buy the same hardware a lot. So I think that could really aid, like let's say this, we get two of these Dells, right? It's shipped on the same day, but their PCR hashes mismatch, right? It might be worth some investigation. We might not want to issue that device a certificate. Sorry, I didn't mind for timing on that a little bit. In IBM research, we have figured out a way to kind of reliably validate a boot log. So the idea of what we're doing is all the PCR values on the different machines are going to be different. But we have a process to take in a boot log, take in a policy that you define an organization, validate it and to compute or pre-compute the PCR to see whether they are valid. And then use that to kind of create the association. There you go. Learn something new every day. Can we get a talk on that next time? PCR hash pre-computation, yes. Next time we want to talk on that. I actually have a question. I saw on your slide, and I don't think you covered this. I apologize if you did, but I saw on your slides that the PCR, there's like a six or seven of them. Yes, here. So we got, yes, seven, I guess. PCR 8 through 15 reserved for us, yes. And then within that range, the next IMA, which is obviously operating system features. I'm wondering, you know, is 8 through 15 not yet commonly used? Is IMA really the only thing that has picked it up? How far up into user space can we go with this thing? So I know BitLocker uses them, but I haven't really messed around with Windows in a while. Other than some, Microsoft has some really good docs on TPMs. So they talk about BitLocker a lot in there and the PCR registers they use. Okay, so what I'm hearing, if I'm hearing this correctly, is kind of like, hey, these things are in use. Each operating system makes its own choice on how to use it. Yeah, traditionally, the way that people will use these PCR registers is that they'll set a policy inside the TPM that says, okay, PCR registers much mass. What PCR registers, 0, 1, 2, 3, 4, must match these hashes, and then we're going to unlock that key. But that's difficult to deploy and change across the fleet, securely at least. Totally. Are there any other questions or about out of time here? Going once, going twice. Awesome. Thank you so much, Cole. This was great. Thank you. And if anyone's got any questions, there's my information. Just hit me a DM or talk to me in the hallway. Thank you all.


This was already a layered haircut. You can see where the weight and the density gets heavier because as you look at this haircut, this part you can't see through. You can kind of see that shift of weight right there. And then underneath here, that's where the layers have kind of removed the weight. I don't wanna go in and thin this area of the head anymore. I'm gonna take a V shape out of the back. The reason I take this V shape is because the head shape works on a round as well. And I wanna stay away from the hairline underneath here. Now I'm gonna cut across that low crown area with a horizontal line.  I've got the crown of the head out.  This is the bulk that I'm seeing in the haircut. So what I can do here is come in, take a horizontal section. What I'm gonna do is I'm gonna come in here. I can see that there's not much density in this area. All the density kind of sits in that mid-shaft. So what I wanna do is I wanna come through. I'm gonna take the 25 texture side. What it does is it feeds hair into the blade in certain areas and blocks it in others. I want my section about as wide as the tri-raiser. And about mid-shaft, I'm just gonna glide out of the hair. What's gonna happen is that just kind of disappears into the hair. And this is where that bulk is guys. So here, light density, bulk gets through that middle. So I come in here, mid-shaft to ends, slide through, take out 25% of the hair, and those become kind of seamless layers. You don't even see it throughout. I'm gonna move up this section just a little bit. So I'll go about one more, half an inch, three quarters of an inch. Still got this blanket of hair that's gonna fall on the back. Section that away, grab a horizontal section, slide through, and then as I look into it, if I see like little bits of these layers that I wanna remove, that's when I go into the texture 50 side. Now that 50, it means 50%. Because these teeth are wider and it exposes more of the blade in between each spot, I will use the corner of this as kind of a dry cutting tool. So it's really soft details on the surface of the hair. Now I've got a nice kind of soft result throughout the back, invisible layers underneath that remove bulk but they don't show through. And then we can move in to the front. Let's work the face frames if I take a parting down here and basically take out this fringe area. Then I'm gonna go right above the bridal ridge and I'm gonna clip this section away as well.  Now you've got only the underneath that you're dealing with. So I'm gonna start taking a vertical section bringing it over to me like this. You can take 50% if they have super thick hair. This is a little bit thinner hair. So I'm gonna go 25. I'm gonna go through here, remove 25%. We're keeping our length but if I wanna pop a little face frame layering in then I can go to my 100% cutting side and just kind of work a line and add in just little pieces that go around the face. I'll bring a little bit more over here just softly cut through. So now we took out some bulk, we got the layers and then I can take this top part down as well but I just wanna iron it out so you guys can see. And the thing I like about a razor is that it doesn't overcomplicate things. So now I'm gonna drop down this top portion which still gives me length and fullness but it leaks everything up a little bit.  It's going to start to debulk the area. So you can see how it goes from feeling super thick over there to now getting nice and skinny. Just removing a tiny bit of weight to make a big difference in see how it kind of drags out there. This just pops a little bit of length up just kind of works throughout.


Hello everyone I'm Roger Watson and I'm the professor of nursing at the University of Hull in the UK and I'm also the editor-in-chief of North Education and Practice which is published by Elsevier. I'm going to be talking at Annago's virtual event See the Future and I'm really looking forward to speaking to you about the four rules of writing and interacting with you at the event. So go ahead and book your seat check hashtag See the Future for updates and information about the session. See you there.


First station stand-up paddle board the biggest board you've ever seen 12 feet long 31 inches wide and over 4 inches thick I Think the leader displacement on a weapon of this size is probably around 300 leaders. Ha just kidding guys But she's out there at 150 for sure Construction she's coming much like a surf tech type boards where they got that epoxy that's got the Plastic kind of more feel to it. So it makes for a really strong board Really stable. They can take those dings and those oyster bars a little bit better now You know, it's a do you have these three millimeter three MPI propene top that you give you all your foot traction needs You know even if you want to get a little surfing with it. You've got plenty of traction You know just paddle into do the size of these boards. It is good that we did include a carry-in handle That's snuggly in the arm guys this board's over 12 foot long You can float three people in a cool beer on this thing Now come to the surf station and get one before they're all sold out


What's up everyone it's your girl Kenzie here from Leighton Sports Cards and I am ripping 2020-21 Panini Illusions basketball team all edition 10 box break number 11 tiered random teams. Again here's a look at the random results you can always find these at leightonsportscards.com underneath the results tab. Link is also in chat for you. Alrighty best of luck everybody. Thanks again for hopping in and for the fill. Let's see what we can get. Again we are looking for the red and yellow exclusives out of here. Covington we've got Jayson tapes, rookie, rockets, red and yellow season highlights of Bradley Beale for the Wizards out of 25. Gonna roll the dice here one two three top four five six bottom that'll go for the rest of the break unless it's a one of one. No autos of this so just a one of one. Well that is a one so it will go to the top. Top on these rookie reflections so I mean that's Raptors card I just realized for both of them but it will still go top. So Lewis Jr. C.J. Elevee all right you're gonna have to do it eventually so whatever. Palladipo, Foltz, Porzingus we've got Acetate, Donovan Mitchell, Shining Stars, LeBron and Nathan Knight rookie. For which one Karen? I don't I think I missed the first part. Moses Brown rookie, we've got red Kelly Oogre Jr. Warriors, Desmond Venon's to Impact, Stevens and and James Weissman rookie. Last pack last one. T. Lillard, John Collins this is gonna go magic. Clear shots Acetate, Zach Levine for the bowls Kevin Love, Jay Chantate rookie. Oh yeah I don't know at all. I think there's some mellows Ant-Man's, Maxi's, maybe some Baku, there's Box, Precious Achiwa rookie, Josh Jackson or mellow ball instant impacts, first mellow. Halliburton, can't forget about him, there you go Kings, Trey Jones, my guy called Anthony, Milton, Westbrook, Kyrie, red and yellow Nicolay Yolket Shining Stars, Isaiah Joe rookie, Sexton, Jalen Smith rookie, Red Baku nice one there Thunder, it's gonna go Nyx, Zeke Najee and A Desmond Bain another good one there Grizzly, a lot of people were asleep on him at first, RJ Barrett, counter Simmons, Denny, we've got clear shots Acetate Bradley Beale and Beale Maldon rookie, that was the sticky note you gave me right, okay can you reply to that email and just say who's first tonight, thank you. Lillard, we've got Skylar Mace on the rookie there, Wiseman Instant Impact, Trilineage, Moses Brown, Jay Chantate, oops wrong emoji, we have here we've got Jazz trophy collection of Greg Ostertag, here's an old school name, trophy collection, okay sounds Peyton LeBron, we've got Mystique Acetate Kyrie, Ellen Cunis, Kevin Love, Junior, we've got Tyrese Maxey, red Paul Reed rookie, Sixers on the color match, rookie reflections, T-Wolves on that one, we've got Obi-Top in rookie, Lamello Ball rookie, RJ Hampton rookie, and it's Saban Lee, couple extra rookies out of that one, nice, Brian, Zach Levine, Killian Hayes, got Amazing Acetate Steph Curry, Dotson and Cole Anthony, got LeBron, nice, Campazo rookie, it's gonna go Top, Rockets, Paul Reed and Poku, Kill, Roby, got Living Legends Acetate KG, Kuzma, Beckerly, not rookies on that one, Kevin Love, Xavier Tillman rookie, we've got Red Darius Basel for the Thunder, Paul, Campazo, Laverte, Brogdon, Valenkunas, we've got Montrez-Herald, not rookie, it's gonna go Bucks, Mystique, Collin Sexton, Acetate, Cavs, rookie, Smeral, Noora, Malachi Flynn, and Azabuki, box five, still three nothing, three one now, okay, they score, they score, what anything is it? Back up for the game, not a six or seven probably.  Yoko, McCollum, Okiki, do you love me, Amazing Acetate, Cp3 Sons, and Okangu rookie, what name was it? His last name is Onana. Oh really, that's not your one. We got Obi Toppin for the Knicks, Red, Harrison Barnes, Kings, and you'll quickly, Smith and Precious Atua, last pack here, that's like I had to, that's soccer, that's who it was. Yeah, I was gonna say it's gotta be soccer. Angles, Holiday, Turner, it's gonna go Top, Piston's Car, Shining Stars, Acetate, Kairi, Bolts, and Composal, rookie, box six. Again everyone, all full for group breaks tonight, still plenty of spots left for personals if you'd like to hop in, Q, Josh Green, Robert Woodard II, like Conley, got Living Legends of Kevin Garnett, Celtics, and Moses Brown. GanForce will be live starting at 10 a.m. Eastern tomorrow for group breaks, big release for Baseball and Basketball, for Baseball he'll be ripping some Diamond Icons, Mason Jones, Red rookie Patrick Williams, gonna go Bulls on the color match, forgot about him too, Wiseman Instant Impact, Kendall Carter Jr., we've got RJ Hampton rookie and Saban Lee, and then Obsidian Basketball as well, so fun release day tomorrow. Starting here at LSC at 10 a.m., CJ Elaby rookie, Isaiah Stewart, Joe Harris, T-Wolfe's car, Mystique Acetate calling Sexton Kass, and a Lamello Bone, no hornets. Got Kira Lewis Jr. rookie, Bio, Young, Killian Hayes, cool Anthony, and Obi Toppin, nice. Seven, Precious Achua, A.L. Konglu, Palladivo, Mystique Acetate, Kyrie on the red and yellow, Joe Harris, and a Tyrese Maxi rookie. Sixers, thanks for the follow, Mepharius, so six, Wiseman, where'd you go? Jalen Smith, Payton, got red, Bridges, that's cool, career lineage, Lebron, Raptors on the top there, Denny Avdia, and Kenyan Martin Jr. Xavier Tillman, Compaso rookie, Shay, we've got Amazing Acetate, Steph Curry, Lowry, and Peyton Prichardy, Celtics. Shoulda know. Oh yeah. Najee Marshall rookie, Zach LaVie, Damian Lillard, Son's car there. We've got Season Highlights, Lamello, Tatum, Cheetah McDaniels, and a Devin Vestel Spurs, box eight, Gary Trent Jr., Sam Merrill rookie, Ben Blitz, Spurs on top, got Isaac Okoro and Devin Dodson, Chris Paul, Thomas Bryant, Anoby, got Instant Impacts, Anthony Atwoods, Estique Acetate, Yannis on to the Kumpo, Laniakko Okonglo, it's been a minute since I read phrase six huh, 50 rows, Emmanuel quickly rookie, we've got red, Lonnie Walker the fourth, Spurs, it's going to go Magic on top, feeling Smith and Precious Ochoa. I remember even going ham trying to get a golden nugget, still never fold one. Yolkich, Gold standard, yes, no, yes, gold label baseball, Jamal Murray, Amazing Acetate, Ben Simmons, Mitchell, and Compaso, I don't know if we, anyone at LSE fold one, I don't know, that's like great when I start, first started working here, I'm not sure, all right, box nine, couple boxes left, we've got Kyle Lowry, Killian Hayes rookie, Pistons, it's going to go Pelican, that's cool, the ball, hard there, Stuart Mason Jones, to each their own press, we've got Covington, Tatum, Clear Acetate, Larry Bird, Celtics, CJ Ellaby, some people like it, some people don't, goes for every single product out there, Foltz, we've got Patrick Williams rookie, bowls, red, poor Zinkus for the mouse, it's hard in, we've got a Halliburne instant impact, RJ Barrett, James Weisman rookie, Nathan Knights, and Kira Lewis Jr., box nine, Shay Aldeepo, Julius Randall, it's going to go top for the Kings, both Kings there, Living Legends, Jerry West, Isaiah Rovey, LeBron, and Lamar Stevens rookie, all right, last box here, yeah, T-Mall can be hit or miss, especially with the different parallels, you know, I mean if you're looking for shorter printed cards, T-Mall is the way to go of course, but again, it doesn't have the hobby guarantees, and Wiggins, Najee Marshall rookie, James Harden, Isaac Acuro, Naysmith, Emmanuel Quickly, Conley Washington, Hajimura, Curry, Amazing Acetate, LeBron Jai, so you got Lakers, Aten, Sadiq Bay, Harris, we've got Anthony Edwards rookie, there we go, think that's the first Ant-Man, but it's a nice one there, you got T-Wolves, red, OB Toppin' rookie, Nix, Grizzly's card there, last box, the trash, other trash, I don't think so, unless it dropped frames for a minute, not a bio, Cole Anthony instant impacts, Shining Stars, Aztec, Bradley Beal, Westbrook, Fox, and Josh Green, yeah, I don't think we're live on, no, it says two out of two, and I've got Green, that's weird, let me look at that, all right, that'll do it for illusions everyone, we've got 10 box Tuesday basketball, coming right up.


The open source security is based on the concept that the source codes open are available, that numerous programmers around the world are reviewing your code and letting you know about the vulnerabilities in it.  First a word from my sponsor, they won't even claim the body. I am here because I believe in the open source movement, open source software. I am here because I believe blindly. I ignored my education and my experience, and I believe. I had a customer ask me, let me know if you can't hear me because I'm around. I had a customer ask me for recommendation on a tool to sanitize hard disks so they turn computers in. I said there's a great open source tool out there, Derek Sputnik knew, D-Band. He said, can I trust it? I don't know. How will I know? We said we would look at the software and make a recommendation on whether we could trust it or not. And so we took on the task to review software for D-Band and other open source solutions and make a recommendation on whether it can be trusted or not, what kind of review had been done. We couldn't find any evidence of any reviews for D-Band or the other tools that we had found. One of the primary hurdles we faced in doing our review was a lack of developer documentation. What we found was high-level functional description, why you'd want to use this program, and in most cases, comment at source code and nothing else. So essentially if you're trying to understand the program, you have to really understand the program. So there are a lot of reasons why we need to review open source security solutions. I'm here focused today to talk about the lack of developer documentation and why we need it and who can benefit from that. And I'll talk about two different communities who need that kind of information. After presenting some benefits and hopefully getting some buy-in, I want to discuss the difference between functional, which is what most people look at when they talk about security versus assurance, confidence in what's being done. I'm going to use a model. I am not endorsing common criteria. I am just using the assurance piece of it as a model to discuss how to gain confidence in an open source security solution. Then I'll be focusing on the development piece in depth. What I see as a path ahead and my limited view of the path ahead, and then I'm going to wrap it up. First thing, confessions. The title of the presentation was meant to antagonize, to draw the crowd. For Sunday afternoon, I think I got it. As I said, I am a believer in open source. I use the solutions when I can. I recommend them when they can. I was just challenged and wanted to share my frustrations. One of the things that seems obvious, but maybe not so obvious, is just because the source code is available, does not mean it's being looked at. In some cases, this is true. In some cases, what people think is being looked at is just a spotty, not comprehensive look for vulnerabilities that can be exploited, ignoring other vulnerabilities that could be exploited but were more difficult to develop. We need to appreciate that there's a difference between just having the source code available and actually having someone look at it, preferably someone other than the person who wrote it. There's some challenges to that. A recent survey of what's on Source Forward showed that about 98% of the software out there has one or two developers on it. And I'll highlight an issue with that later on. This problem, not documenting how you develop the software, is not an open source problem. It is a software development problem. It doesn't matter whether you're commercial or open source. You face the same issues. You just have some abilities to solve them different ways. I'll tell you up front, I think the open source community may address this faster than the commercial world can, simply because of our willingness to share lessons learned, the pain we felt, and try to have other people not experience that same pain. Yes. That is one of the things I'll highlight again later in the presentation. But commercial software, the schedule is primarily driven by a marketing schedule. It's a business decision when to shift, not a technical decision. This is different than the open source community, which tends to shift when they think it's ready. Different philosophy, different pressures, different motivations. And software lifecycle. We need to respect that software's never done, just shipped or posted. It is a continuous process to improve that software. The other thing that maybe isn't appreciated, and this is going back to the one or two developers on a team, is the development teams have life cycles of their own. On larger teams, you'll see people come in and then we'll walk. And so we need to look at that transition. Most of the mistakes that are in software, we're not put there deliberately. There's screw ups, all shits, whatever you want to use, they're there because someone wasn't thinking at that moment about that particular issue. You'll also find where we discover new vulnerabilities that we didn't really think about when we were doing reviews beforehand. So a review five years ago might not have thought about looking for integer overflow situations, where if you're doing that today, you might do that. Maybe you should. Repeating again, the status quo for most of the open source projects is a high level functional description. Why you want to use the software, and then its comments of varying qualities in the code itself. There's typically no supporting documentation between except for the occasional user guide. There are some exceptions. Mozilla is probably one of the best that I can point to. It's a larger team obviously, so I'm somewhat cheating. But they have a site dedicated to developer documentation and cover it so you can kind of wade yourself in. Not suggesting that all projects need that level. The other one I heard today was Tor, which was interesting because the onion router or routing, I can't remember what the R was specifically. They have design documentation, and that documentation allowed the porting from Tor, which I think is written in C, to be written in Java over in Germany. I forget what the acronym stands for. Why do we want to do developer documentation? There are two distinct groups who need this documentation. The first is development teams themselves. And it's kind of hard when you're doing the solution yourself to think that you need documentation for yourself. But if you go back to my point about the teams grow, people roll in, roll off as they have different needs. You can see that having information about design decisions recorded somewhere would be extremely useful. If you have development documentation, you lower the bar for project participation. You can bring more people in because they can understand what your tool does and how it works easier. I have to put out a word of caution. I was introduced to a term that I had not seen before. It's a concept known as a net negative programmer. And that basically means that at the end of the day, this individual has done more damage than good no matter how many times you sit with them. So you want to lower the bar, but you can't do it blindly. In that development documentation, you're going to communicate design decisions. One of the more important things that you might not intuitively think to document is the alternatives that were considered but not implemented. Because this becomes very good down the line when someone says, oh, I have a great idea. Let's do it this way. If that path was previously explored, you have a record. And if the team members have changed, you're able to see that. Those benefits all benefit the team that is developing the open source software. There's another group who's interested in looking at the software. And those who are trying to say, yes, we can trust it. Not just for what it, not just the function, but we can trust it. We need to gain confidence that if it says it does A, it does A. But we also need to gain confidence that it doesn't do B when it's not supposed to. And that's a much more difficult task. It is not a trivial task. It is, well, never mind. I think I'm speaking to the choir on that point. We need to separate two concepts which may or may not be well understood. One is, what is a functional requirement versus an assurance requirement? A functional requirement is this is what it does. It does not imply any confidence in how much we should believe that it's going to continue doing that. This is contrasted with an assurance requirement that says, this is how I can show that you should have confidence. It's going to do whatever I said it was going to do. It depends on your model. There are assurance requirements that cause functional requirements to be created in the common criteria model. I guess that's the easiest way to say. You can have, from my perspective, it's easier to separate the two mentally is I want to talk about what it does, and then I want to talk about what I'm going to do to give people confidence. It does that and doesn't do anything else. As I said, this is not an endorsement for common criteria. It's a model I'm familiar with. They have a vocabulary to define what the thing does. They have a vocabulary to describe what assurance requirements are there. They have a methodology for evaluating someone who says this is what I want to build, and for someone who says I built this. The only piece that I'm grabbing right now is, and I'll caveat it, most of the assurance requirements, and the reason I'm grabbing that is just to have a model we can look at. The majority of the assurance requirements are the ones here. The one I'm skipping is the concept of assurance maintenance, which is a bit overwhelming at this point. We'll look at configuration management, delivery and operation, development, guidance documents, life cycle support, tests, and vulnerability assessment. My focus again is on development and developer documentation. What I'll try to do is point out for each one of these how we in the community have tried to solve the particular aspect, and the only one I'm going to talk about a little more in depth is development. Configuration management, vocabulary first. The definitions that I'm grabbing here come right out of common criteria, and you're going to need to know three definitions that we go through this. The first one is tow, targeted evaluation. Just read that as your software, because that would probably be the correct answer. When you see tow security function, that just means the security functions that your software does, and that's differentiated from other functions. And then if you see ST, that's security target, and that's just the statement of what is about your software. For configuration management and managing the versioning, the changes that are made to open source software, the de facto standard is CVS. That seems to be one area where we get it. We have versioning control. We have a way to control who can make changes. We seem to be on track with this one. Delivering operation. This deals with having your software go out, get installed, and come up and operating in the way that you thought it would come up and operate. Right now the software is typically distributed from a website. The concern you could have is that the software could be swapped out, compromised, et cetera. The way a lot of organizations have dealt with that is they pull the software down to a mirror, and then they wait a few days because people care about their software. If your web server that was providing the software got trojan, you'll know about it rather quickly. The word will get out. If they see that, they know that their internal copy's got... The issue with MD5 is it is just the hash. With PGP, you actually have someone signing the hash. If you have a software on a website, I'm going to put my Trojan software and my Trojan MD5 up there. You can see the difference. Some people don't even have the MD5s up there. MD5s provides a low level of assurance. You have some confidence it hasn't been compromised, but not a great deal. You know that if it was compromised, where it was compromised, the web server is providing you the signature and the software. With PGP, it's a little bit higher. It's a whole big area to get into, and I do not see a lot of widespread use of digital signatures to assert that the code is correct and came from who it was supposed to. Development. The area that I'm going to want to focus on and the area where we have... I'll use the term the least documentation, because what we need to start with, in theory, is a high-level description of what we want. That's going to be turned into requirements that get turned into security functions. That's the TOS-TSF. Then we're going to take those requirements. We're going to design some software based on modules or some sort of subgrouping. We're going to explain how, as we go down each level, all the way until we get to the source code, where that function is being handled. You can see right now we have high-level functional description and source code. Without really getting a note of code, you're having to jump from the top to the bottom. More specifically, you're starting at the bottom, and then once you understand the code, you'll understand how they implemented that high-level function they're describing. Guidance documents. That's a variety of guidance documents that are out there. In general, user documents are common. Administrator documents are common. Then some organizations have technical user. Some projects have additional ones. This is just a use documentation. How do you run the software? Lifecycle support. It says ad hoc, but if you look in the middle of the paragraph, you'll see floor remediation. That is one area where you cannot argue that the open-source community has a real advantage because when a vulnerability is identified, the ability to pull people in, especially if you say help, has no parallel in the commercial world. That is one area where we do have an advantage, and it depends on the size of the project is your ability to pull things in. That's the key issue. Should they use them? Yes. Let's see. Testing. You can argue this both ways. You could say that we released the software, we let it to run, we allow people to feedback when it doesn't work, and that's our test model. You may have similar projects that are extremely well organized, and they define test cases, and every time they make a change, they do regression testing to ensure that they haven't broke something else with that change. I did not see a lot of cases where that was there or that they provided the test cases that they used for the results from those test cases. Using the common criteria model, that kind of evidence would be provided to some sort of reviewer to show. Going back to the assurance team trying to say, yes, you can trust this, that information isn't available, the test cases and the results from those test cases. Let's see. Vulnerability assessments. Really interesting topic. It's where you're looking at your design, and you're saying, how can someone screw with me?  Philosophy called abuse cases is the one I was introduced to kind of explain this. I haven't seen a lot of that kind of formality in the open source community. This is not to be construed with what's going on where you have people looking for holes that they can write exploits against. That's different. This is more, I'll use the term internally driven versus someone trying to punch holes in it. If folks are interested, this sounds like something that could be worked on and built into a presentation for next year. But this is this year. Let me talk about development documentation. We need to understand what is the requirement. What am I looking for? From my perspective, I represent the teams that would look at open source software and say, yeah, we can trust it. What we would be looking for is two things. One, some document that captures the design philosophy and then this tracing down to the software and what tools are available. Before I start digging into that, I had someone look at my presentation who was involved in a couple major open source projects and gave me some insight into how not to do documentation, developer documentation. Before I get into how I think it needs to be done, let me just emphasize that I'm acknowledging that there are a lot of ways to screw this up, a lot of really painful ways. Individual was worked in an organization where the documentation consisted of source code, comments, which was pseudocode and only the pseudocode before the actual code. It was so obvious to be useful and annoying. From a paper written on IC Sharp's website, Bernie Spaduto, I mispronounced the last name, wrote a paper in 2002, which kind of amazes me. It was on how to comment your code well. I was introduced to commenting back in 1982 in my first programming class, and it just surprises me that we're still writing how to write comments well on our source code. Obviously, we haven't fixed that, and that helps me manage my expectations not to expect to be able to run out and develop our documentation tomorrow, baby steps. One of the things that he emphasizes is don't bury comments in your source code that have to do with configuration management issues. That says, I did this to fix this. He recommends that goes up in front so that you have a version in control for the files. It amazes me. Don't include comments that address the obvious. Apparently, some organizations have a real issue with this where they want everything commented. Don't, this reflects an earlier comment. Don't leave the design and the code out of sync. There may be times that you realize that you need to fix something that doesn't match the design. At the end of the day, they need to match. Don't wait until the end of the project or the code's written to write design documentation that explains how you ended up with what you got. They need to be kind of kept in sync. Most importantly, do not assume that well-commented modular code is enough. If you're looking for your project to be survivable beyond the one or two developers that are supporting it, that is not enough. You need documentation so that more people can pick up and run with your solution if you can't. So what am I looking for? We need in the documentation, development documentation to understand the flow and the purpose of what is there. It doesn't help us run the software any faster. It doesn't help us configure it. This is extra documentation I'm asking for. Years ago, they said put comments in your source code. Then they said, make user guides. Well, now I'm here saying, and make developer documentation. To do a security review in a cost-effective manner, which is the reason I'm here, is there needs to be traceability between the functional description, what you're wanting to do, the high-level design, and then from the high-level design down to the low-level design, which for software is essentially your source code, is important in a document other than the source code to capture your design philosophy. We need overall architecture, pictures are nice, and some sort of explanation for why subsystems are there, why modules are there, why they're called, and without having to go through the source code and understand that. Let us develop some expectations up front, and then as we go through, we'll understand what's written there. And as I said earlier, developing alternatives is a benefit to the developer community more than the assurance community. Also, this is significant in the comments in the source code, is if you're doing protection, like balance checking, make sure that comment's in the source code. And then there are some tools that can highlight that. What are some of the tools that are available for creating developer documentation? Obviously, some of the easiest one are text. On the Mozilla site, they have essentially a white paper that describes the design. That is an effort. You may not have the desire, the inclination, the writing skills, whatever term you want to use to produce a document like that. What I think we need to focus on is the source code comments and especially making source code comments that a parser will recognize that will be able to pull those comments out and put them in a separate document. So you're having your documentation in one file, and then if someone wants to dig in, they can see that in the source code in another file. Flow charts for certain programs. UML diagrams, I have three types of them listed here. What are your classes that you're using? How are they called? What's the sequence? And how do they interact? I don't know if I couldn't find a case, but this is a type of design documentation. Finite state machines and state charts, they're somewhat related for some very specific cases. I've seen people describe that as a technique to show error cases. But for an overall software, the major design document, that's probably heavy for most solutions. This is an example of a picture that would help someone begin to understand what the code is doing. This comes from one of the earlier versions of password-safe. This picture is in a document that was written by Andrew Mulligan while he was in graduate school. And the good news is he's now a developer on the password-safe project, which is I think the perfect situation. And he goes through in comments and says that what you see here is a design that basically keys events off a GUI, and although this might be good for the initial, it's not good for a long-term solution. And for those who use password-safe, you probably saw a big difference recently when they went to the new version. And those included his changes. I don't want to get into changing the design of the software. What I want to do is show this is an example of a picture that lets me know what are the pieces I would expect and how do they interact? I'm not the devil's advocate. I'm actually here to defend the devil's advocate. I talked to a developer in the commercial industry about this issue who agreed. Software development is software development. We have the same problems. We just have the ability to choose different ways to solve it. And he made the argument that commercial developers are going to solve it first. And I want to try to counter some of that. Actually, I'm going to counter two out of three, at least. He emphasizes that the commercial developers are market-driven to develop the code correctly. There isn't a grain of truth to that, but there is a body of evidence to suggest otherwise. In the market, you have people's salary, professional reputations, it may come into play, but in general, the market pace is not driven by technical. In the open-source community, the pressure is entirely reputation.  And so if there's a hole, your ability to fix that is going to convey to people confidence in whether they can use it. So I think that the open-source community is just as capable, maybe more capable, to develop code correctly. Second, if you're paying for software, you have certain demands for reliability. I can't explain it, but I believe the same demands for reliability exist in the open-source community. Because I see the projects being developed, increased reliability, increased stability. There has to be some motive there, and it's us. We are demanding that reliability. The money is one thing, but I see our ability to influence the development and increase the reliability is an even match between the closed-source and open-source. Yes. Yes, that's okay. The last is one that I don't know if I can argue, and that's the requirement to make the code approachable. If you dig down in the file that's on your CD, you'll see the actual language used, which may be cleaned up a bit. But essentially, everybody has their own perspective. If you're the one person developer on a piece of software, your perspective may be you don't understand why everybody else doesn't understand it or doesn't understand how to use it. Therefore, when someone says, you need to make your software more approachable so that we can look at it, maybe use it, you may be resistant to that. Obviously, that's personality dependent, and I don't know if the commercial world has an advantage other than the market forces to be able to keep their software updated to make their code any more approachable than we do. Path ahead. What I see happening is for the larger projects or more significant projects, they are doing more developer documentation. They have bought into the concept that for the project to survive, we need to capture why that code is there. The OpenSSL project is actually a special example for me. For those who support cryptography in the government, you may have heard of FIPS 140. It's basically an evaluation program or validation program, excuse me, that allows the use of cryptographic items. OpenSSL would be the first open source solution validated and validated source code level as opposed to the binary level. I mean, this is huge because now you're not having to validate every different version that's compiled, which is what we had to do in the past or what the people representing projects had to do in the past. If you go to the OpenSSL website, you'll see the effort that they've had to undergo to go through that process. It's not trivial, but it is not trivial for an open source project. It is a lot easier to support if you're in a commercial world because you can have the marketing person say, I can't sell this to the government until it's validated. And then the price tag isn't that high of a barrier. It's not like a common criteria evaluation where you're talking five to an order of magnitude higher in the cost between a FIPS 140 and a common criteria evaluation. Okay. In general, I think there is improved comments in the source code. I know I made that comment earlier about, we're still trying to teach it 20 years later. I think we'll continually teach it because we have new students. I think we may need to look at how we peer review those comments and that's handled differently within projects. They're human dynamics. Every team is different. I think that if we're going to develop developer documentation, the focus needs to be, as I said, let me back up a second. When I talked about development and documentation, I talked about traceability from the top-downs. I talked about a high-level functional description than our high-level design than the low-level design in the implementation. I don't think that we can go out and do it that way, top-down. That's my opinion. I would welcome it to be challenged, actually. I think that what we need to do is work actually from the bottom up so that if we start from the top-down, we actually have a place to land. The focus needs to be on making the comments in the source code that reflect the design decisions. The reason is that's what we're working now. We're in the code now. You're not asking for a new document. I'm just asking to improve the documents that exist now. The thing is, the tools are available now to help document what's in the source code. To parse through the source code, Java docs is the example that I was introduced to, is able to pull that up and pull it together. We're not having to talk about wrestling with some sort of drawing program to create UML diagrams. It's relatively straightforward. Learn a few tags, and all of a sudden you can create a set of documentation without a significant increase in effort. And as I said, I think the effort needs to be driven from the bottom up. Kind of wrap things up. What I don't know. I don't know how to motivate the folks who are developing code to write more documentation. I mean, I've heard your arguments before. You know, you're commenting the source code. Now we're having to create a user guide, and now you want me to create a document that no one but me is going to use. Well, the answer is yes. I do. I don't want that, but I don't know how to motivate people to say that. If the software is a security solution, like password-safe, if someone may need to have some degree of confidence in it, it's more important than some other solutions, at least to me. That's my bias, of course. The other thing, and this is an important issue, is I don't know how much documentation is enough. I also think the commercial world has that problem. But I do have a theory on how to determine how much is enough. And I'll get to that last. What I do know, tools are available. They vary by quality. They vary by ease of use. But in general, if they, you know, as with all things, people start using it and provide comment, and the tools will improve to what we need. I believe this community is going to solve the problem better than the commercial world, and that the lessons from this community will actually be brought into the commercial world as best as they can. So I think it's our opportunity to direct different ways of handling it back. The advantage we have is, of course, is the open, that's a significant piece, exchange of information. We're able to say, you know, this is a bad design, and someone says, okay, it's thunk. And we're able to move on from that point. It's different than a proprietary development environment where that may be a closed community, and that conversation doesn't live beyond that moment. Feedback priorities. That deals with how much documentation is too much. As I said, there's two communities that can benefit from the development of documentation. It's development team themselves, and then assessment groups. So how much documentation is enough? The way I would determine that is, what does the team need? What can the team benefit from? And the view that you have to have is if we wanted to accelerate bringing someone on board help to bring someone onto the team. The second piece is, if your solution's being looked at, incorporating some of those lessons learned from somebody conducting some sort of assurance review and letting that kind of guide what is enough. I certainly think that what common criteria is looking for is heavy, and prohibitively so in a lot of cases. And so we need to be able to, I'll use the term experiment, find out what works and what doesn't, and then share those lessons learned. I'll open the floor to questions. Yes. Do you have any comments or questions about me opening DSP? No. I mean, I'm aware of it somewhat, but I'm not current. My education is in current, so I don't want to say the wrong thing, which, I go ahead. Yes. No, we're talking about your average desktop user. Okay. I'm going to summarize your questions and see if I got it correctly. And that's basically what's my intent with this development documentation. And that goes back to the development of what the term I was taught was abuse cases and how to refute those. In the example with Derek's boot and new D-Band, it's possible that someone could write a utility that rather than wiping the disk, they actually encrypt the information with their key or some way to hide the key.  And then somebody waits at the sales where they're getting rooted defense equipment or government equipment or health care equipment and then buys up the hard disks and see if they have some information on it. You get one of the Simpson-Garfinkel papers written again. So what I would look at is, how do I know that it's actually wiping it versus then re-encrypting and then writing it back down? And so I look at the developer documentation, I find out where that process should be and then I go and look at it and see how it's executed. So I'm not having to look at the whole code. D-Band's a wonderful example for this because the piece that is really D-Band is really small, but it sits on top of a bootable CD or a bootable floppy. And so if someone hasn't looked at the software that makes up that bootable floppy or bootable CD, guess what? Everything is in scope. You have to look, you have to follow it through and at that point, and still is, no development documentation to guide you down the path to verify that. Yes? Yes. Have there been any objective studies of the relative likelihood of vulnerabilities being exploited on...? I don't know. Let me repeat the question. Has there been a study of the open source versus proprietary software and the ability to exploit the different versions? You know, is there a different way? The vulnerabilities are actually exploited. Or how they're exploited, I guess, is it more correctly? How frequently are they exploited? Or how frequently? Okay, how frequently vulnerabilities are exploited is the metric in your comparing open source versus proprietary software. And I'm not familiar. I can't pull above. I'll study up top of my head. Yes, please. The result sounds good. I'm sure. More obscure than that. How do you think practice is ever going to be? The thing that has to be looked at, I understand that. That was exactly the impression given to me by the one individual who had reviewed my presentation before it came here was, you know, well-commented code is enough. That's all you ever need. And all I can say is people who have done a lot more software development have written that if you don't have that design captured and the comments are on the source code so folks can understand that when you have to go back and fix something, you will spend longer fixing it than you will have if you had written the documentation in the first place. I mean, that's the real advantage. I mean, we may have to run in those situations where it's a teaching point. You had a hard time fixing that, didn't you? It would have been easier if we had the documentation in the first place. Let me mention again, we do have, they can shut down the project that the process is marking once and they will shut down the project or shut down the station so they get the information in the proper QA to the bearers that are on the project, as much as I know. I would get you here about a formal QA process to help the source to find a new one. What companies work for you? Well, not now. I've worked on a large company called Sun, a smaller start-up company so I've seen all sides of Europe. Let me answer with a point is that in the open source community there is no QA group that would prevent youth from publishing. I actually look at that as an advantage. If we had that as a separate process then all of a sudden you can say, okay, that's great. If people who are looking at code and reviewing it, I'm not just talking about finding exploitable vulnerabilities, but actually doing a review that is somewhat comprehensive were to publish that and make that more open, that would be great. There was an attempt to try to create that in the open source community. All right. No. Okay, I can't remember the name. There was a website that was going to collect vulnerability assessments reviews of software and essentially what happened was they shut it down because they couldn't get funding. They couldn't get funding because the only people writing reviews were a few graduate students of one professor at one university. We're obviously not ready for that. Otherwise it would have happened. I don't know how to get to that point but that would be really nice is to have a body of documentation of people who are looking at code comprehensively and saying this is what I looked at and these are the results. Yes. Having a solution like that would do wonders but that's going to apply for the things that would get bundled with an operating system and that's the only limitation but I think that's a good concept for that. Yes? Okay, and what we want to do is revisit at least my impression of an earlier situation and that's with user guides. A lot of programmers out there when it comes to explaining how to use their software the English skills they're not as well as their coding skills. I guess that's the right way to say it. Is that played enough? And so what happened? We didn't stop writing user guides. We found people in the community whose skill was English who would work with this programmer and translate it. Well, maybe what we need to do is open up and say are there people out there who aren't necessarily programmers but might do more focus on vulnerability assessments on architecture on just general discussions open up the body larger than just being a programmer. You don't need to have some sort of programmer badge to participate. There are no bars that I saw. There's a lot of projects out there where you go through source forage where you'll see team members and their roles are identified. Program manager or project manager you've got developers, you have documentation, you've got test specialists. Lots of people have different labels. This may need to be another label. This may be something where we have some people try and then just open it up and say, hey, comment on this. Find people who have experience doing this documentation and saying how does this work? Yes? Do you think documentation is a verified program? Okay. Let me go back to my methodology which is I'm going to develop what I call an abuse case and say this is what I think the program could do and then what I have to do is go through the design documentation and the review. And then the end result is I'm going to look in the source code and make sure that it's actually implementing what it claimed to implement. And the quality of that review is obviously going to vary by the skill of the reviewer. My expertise is at the higher level developing the abuse cases, not at the lower level. Were there any polls in how this was programmed? Okay. That's good. Another site that gave me a tremendous list of tools is a tool called Doxygen. They have a list on that website of both the non-commercial and commercial tools. As I said, I'm convinced that the tools are there for the beginning, the beginning steps. But obviously, we need more practice working with it as a refinement. One last question? Okay. On stage, let me make a Sheenies plug for Geekwares. If you like this T-shirt, $10 in the vendor area. Come along with us. The vendor area is going to be closing at 3. So if you have any kind of business to make please do so before 3 o'clock. That's going to be in my way if you've got kind of surveys going to happen in this room at 4 o'clock. Wow. Very funny one. We need everybody to exit the room. We cannot have people exiting that way as we have a very long queue for the next presentation. That's if you like to see the next presentation and you're asking that you exit. Also, I spoke incorrectly about the critical networks talk when I'm critical on next that talk or okay, now that talk is at 3 o'clock. The critical networks talk is going on.  I said it was being replaced. I was incorrect.


A surprise decision by head coach Brian Flores to name Tua this starting quarterback for the Miami Dolphins. It's a surprise because Ryan Fitzpatrick has been playing lights out. If you want to talk about fantasy football perspective, I believe it was four or five straight games where he's had over 20 fantasy points in those games. Ten touchdowns, seven interceptions, which is kind of, you know, let's turnovers need to be worked on, but that didn't even matter because he's been playing lights out as far as the passing game goes and the running game having two rushing touchdowns on the ground as well. He's been playing as if his career didn't matter at that point. He has nothing left to lose. He's at the tail end of his career. This may be his last season in the NFL, so he just decided to all of a sudden bomb the ball down the field and just show up and show out. So Ryan Fitzpatrick is benched in the process and that was a surprise. We're going to unpack the quotes and what head coach Brian Flores said with the decision of benching Fitzpatrick for Tugovilova. And this is what he said. We feel like that this is the best team or best thing for the team. We feel like through practice and meetings and walkthroughs that he's ready. And that's how we're going to move forward. And then he was asked about Fitzpatrick. Fitz has done a great job. He's been productive. His leadership's been great. It's not an easy decision for me or us as an organization, but we felt like for the team now in moving forward, this is the move we need to make. And I don't know if you saw the reaction by Ryan Fitzpatrick and the comments that he made, but it kind of, it pulled the harsh strings for a lot of NFL fans because Fitzpatrick is a guy that you want to root for. And it was kind of sad because what he said is it broke his heart and he was hurt the whole day by being benched. And he felt like that this was his team and it caught him off guard. And it was a surprise. It was a shocker.  It really is sad because I was rooting for the guy. He looked amazing, but nonetheless, the business decision is to move on with Tua as a starting quarterback. So what does this mean for the Dolphins? Are they going to be as good with Fitzpatrick out of there and to replacing him that they were with Fitzpatrick as a starting quarterback? I don't know personally and we haven't seen enough of Tua, especially with the lack of preseason. So we don't know just yet. We just saw that one drive that he came in and threw a couple of passes. But if I had to make an educated guess on this, I think that the Dolphins will be fine with Tua moving forward. You think about it with Floor is making this decision with the way that Fitzpatrick has been playing the level that he's been playing at, the decision to take him out and put into a saying that he's ready moving forward, you've got to have a lot of balls and a lot of faith in Tua to make a decision like that. You must really believe that he's ready to make a significant impact in the NFL. If you're ready to get rid of one of the dare I even say, it's as far as QBR goes by ESPN, a top 10 quarterback this season and Ryan Fitzpatrick to take him out as far as quarterback rating goes and put into a Tuga Vailoa. You must have a lot of confidence in him. So with all that said, Tua in that instance could be the next Lamar Jackson, could be the next Kyla Murray, could be the next Patrick Mahomes. I don't know, it might happen, but I think that Floor is on that track and on that road and believes that that could happen for the Dolphins because listen, this decision probably would have made a lot more sense if the Dolphins were one and five or oh and six, you've got nothing to lose. Why not just put in Tua, give him some experience so that by year two, he could just take off. But the fact that you're three and three and I believe a half game behind and the AFC East for the lead behind the Buffalo Bills, you're in the thick of the playoff race and you make that decision to change your starting quarterback who wasn't that bad at all. You must really have a lot of faith in Tua Tuga Vailoa. So guys comment down below like do you believe that Tua is going to be this amazing next big thing in the NFL at quarterback or is he just going to falter out and this decision was made by Brian Flores just to give him some playing time because three and three, I believe that the Miami Dolphins organization of this team can make the NFL playoffs. They're in contention to make that seventh, that new brand new seventh wildcard seed that was introduced this season in 2020. So Tua, we're going to have to see very talented quarterback. Heart hurts for Fitzpatrick, but Flores loves the decision and has a lot of faith in Tua.


Consider myself. I'm an information designer, but I actually studied architecture history So they've always been my kind of friends and enemies at the same time architects with their amazing Idea that they can redesign the world that we live in which I've always find quite arrogant Which is the point which which one at all this one? I Consider myself. I I designed things that people read I designed maps and I designed like the Economist here the magazine And I think cities are also things that we read I mean the the project we did in London started six seven years ago. It's called legible London We start actually started in in Bristol 15 years ago So I'm talking about you know, how do we read our cities reading them meaning we acquire the knowledge that's inside a system Just like I read a magazine and I acquire at least some of the knowledge that that is in there and to an extent Some of that means we are you know getting back We've given our cities over to cars or trains or whatever Architects who think they can design us architects think they design cities by designing buildings Well, we live in the space between buildings and I'm very grateful haven't heard this morning The distinction between vertical and horizontal because we are horizontal I mean spider man is the only person I know who climbs buildings. We walked along the streets and for me cities are as in New York are very much horizontal and we try to encourage people to use them again and It's always nice to see that there is a German word is called a trumpet trumpet part Which is the little trampled path that people will make Architects designed these great corners four weeks later Somebody will have made a diagonal crossing and the other people will follow so we have a great sort of you know A German imperial building and always gonna go walk around the bloody corner They're gonna make that little trumpet part through the middle of it because that's how we work And we are the only people We we built you know, well, this is you know, this one sheep there goes makes that little curve Why and why do the others follow they want to trample in the snow? Whatever so we have a tendency to follow each other, which is good and bad coming from a German But let's not forget that this sort of trumpet fart was actually built by people. This was designed I mean somebody thought that we want to sit in a car for an hour and drive from Santa Monica to Pasadena or from downtown to New York to West Hollywood I mean, isn't that incredibly dumb idea to put people in these boxes Pollute the air and spend hours in a car. I mean who thunker that for Christ's sake planners designers architects engineers, I'm afraid to say So how do we get out of that rut our European cities and and the east coast it is in America However, we're pretty much designed around the railway This is Berlin the Gleister egg the the the railway triangle built around the the turn of the previous century the 1890s Snap back in the middle of Berlin now These have are still being used But the space that they occupy has pretty much fallen into disrepair that the one and on the right is actually Present Berlin so right in the middle of Berlin, which you know is right by the former border We have this incredible space which had lied dormant for 60 years You know trees had gone through walls trees had grown through odd railway cars. They were on the side There was vegetation there that didn't exist anywhere else in Europe because The the railway cars had brought seeds in from all all over Europe So suddenly we we we get in the space back to ourselves. We're building parks there luckily not car parks in America You probably say oh my god, we can pack a thousand cars there. How cool is that? No, we actually make it accessible for people Which I think is a lot more useful and the amazing success of the Highland in New York Which is a a ponsy little what is it a one mile or it's a half hour walk Which is a you know, it's it's it's a little joke if you if you look at Hyde Park or Central Park or whatever But my god, the world is all about them making high lines now in every other American city and village Because people you know what it's like going to to the to the work as soon as America I'm a little used to live next to one in San Francisco.  I do get it. I'm glad it's happening, but it's the kind of weird concept for a European But once we're we're in the middle of our city Which is essentially the cities that we like are messy because they've grown over decades and centuries and you know If you look at the successful squares in the world, none of them is straight because the Italian cities even to Siena They're all at angles and they're all actually quite deceptive Have you ever walked across the the big square in Siena? It takes forever. It's massive But you look at it. You think it's small because it's all foreshortened. It's very very nothing is central The well is off-center none of the Italian squares are central only the fascist build central squares If you go to East Berlin, you see the vision of some Ponzi little Semi or cause I dictator he thought the world looks big so we have to make eight lanes They had about two cars in East Berlin, but I made eight lanes for them You see the same in book arrest and places. They had roads long before they had cars Little bit the different but anyway, so how do we how do we how do we find a way around? I mean science would he trust that stuff and you see this everywhere I know this is Ireland is the other extreme and now they should probably be in a museum because you couldn't design this if you tried But I mean then you stop there and you try to find your way You know, you have angry people probably shooting you while that would be in Texas But if you hesitate but there you have to hesitate because you have no idea what they're telling you because the one thing about about science is We and of course all of us designers have thousands of these slides. I have hard drives full of accidental Stuff that people design because everybody's a designer and that's asking for it You know putting mustaches on people and on the post in the tube and stuff or you know black in our teeth Is what we all do because it's our way of appropriating the system We don't know who makes these signs so we don't trust them and that's actually not a bad thing Let me take you to this little example in Stockholm Now every psychologist would probably know that affirming is better than than forbidding So this we have one at least one day and who can read this It's a it's a no stopping sign, right? And but it doesn't apply to loading and offloading Between 5 and 11 no between 5 and 11 and certainly not between 5 and 11 Now I call that very redundant and and of course by the time I've read this I've got a parking ticket it is What I think One of them is week days the other was weak and the other one is probably Sundays If you if you're a Sweden you live there, you know this but I mean come on doesn't anybody think about this five You know don't fucking park there between 5 and 11. I mean that's basically what it says unless you're offloading So no wonder that people don't take those signs seriously and then in Berlin We have a so called pedestrian signage system and just look at the one on the right Reichstag Bundestag 1350 meters now. That's a really nice sum that as a tourist from Spain or China I oh that's gonna take me 32 and a half minutes to walk probably I mean that is rubbish Apart from in fact, it's a Microsoft system font Ariel which we all love to hate It has arrows on the wrong page you never put arrow before a word you put it in the direction You're walking in this case the right arrow has to go on the right-hand side I mean that's common knowledge for signage system not known by most designers But it's the common knowledge it should be so this this of course nobody takes seriously because it you don't know where it comes from Who made this some bureaucrat in some office? Who goes home at 430 obviously? So do we read maps now the you all know this if you if you travel to London the London tube is actually diagram It's not a map. It is a it is a symbolic representation of the city It does it bears very little relationship to the the ground above it has some but not exactly Obviously the you know from Green Park to Billy's to Piggy the circus you can walk You know you can't do that once you go to the to the outskirts But people use this because it's free. It's available. It's easy to understand when we did the legible London thing six seven years ago We looked at this and if you look at some of those Most of the stations in London is in central London you can walk to the next one You're at Leicester Square. You can walk to Covent Garden in three minutes You're at Bank you can walk to monument in one minute if you spend more time underground than you spend overground walking so the Look at all these and all this tube station There's a two or three dozen tube stations in London that are within five minutes walk of each other And now interestingly London different from other places Transport for London at the time was interested in getting people off the tube Most places would love people to use transport public transport in London the tube is overloaded There's too many people using the tube and other people are tourists who will use them between one of those stops where they could easily walk Walk in not only because they will take load of the system Also because them they expose themselves to the city is much more fun to walk Even from Leicester Square to Covent Garden than to take the tube and you know being lost tunnels forever So that was the first Revelation and then of course we all know and research again showed it that people don't understand maps Most you see them at the corners people don't know where north. I mean nobody knows where north is Where is north and now west is where the moss grows on trees, but I mean who you know where do you do check that in London? Which also is something funny I find that only the Anglo-Saxon Can't just ever use the directions if you go to Italy or France or Germany the axis will never be called north or west or Something we just call them after a place But in I think it's that great system that comes out out of New York, you know in Manhattan You know where north is it's pretty obvious We don't use it. Anyway, people don't understand maps that don't like maps, but they understand neighborhoods They know when the New York they're gonna go to Williamsburg. This is where it's happening They may not know where Williamsburg is, but you know, they need to be led there They don't care that it's part of this and part of that They just need to go there and people also understand that neighborhoods have meaning, you know, you go one to hang out You go one to buy I only got five minutes. I've only done five minutes Okay, well, I'm gonna be even quicker But so what we do with it with a system we connect neighborhoods Which is what people understand so this People if you don't like maps you make maps they're like the the map the right one is the first one we did in Bristol in the late 90s Which is easy because it's easy city in London. You have to put in buildings They have to be three-dimensional other people can't read buildings like architects can their need and elevation because I need to see The building is tall or low or whatever it's obvious and you put them in the middle and you put a circle on 15 minutes you got 15 minutes time to walk or your legs for 15 minutes go there very very simple And then they put them where they need it if you go outside now Now even they're all over London the first ones were on Bond Street and in the West End now they're all over the place They are pretty useful there will have electronics in them They will talk to your smartphone eventually But one thing that's better than maps is is map apps of course because you can carry them with you You may have the correspondent hardware in the street you can download you know whether it's Harry Becks or my map and Beyond that of course in within the same app you have in this case Deutsche Bahn telling you where you catch your train And they have a walk in there 200 meters in six minutes I walk 200 meters in three minutes, but this is for maybe for people who've got luggage So you buy into a system that tells you how to get there how to use it And of course what the train guys have understood there aren't just trains. There are also cars and there are also bicycles I won't go into the Boris bikes, which I think is a very big misnomer. He certainly inherited them. It didn't invent them, but the big guys understand and sort of the car companies that traffic is something that is Connected you can't just have one mode of transport Well, what did London do because it collapsed, you know They charge people which is one way of keeping people out of cities making it impossible to or to afford which of course is Unjust if you go to Porsche Cayenne, you don't care for you can pay eight eight eight pounds an hour. You don't care But who says we have to own a car in order to use it, you know, this you heard about this the other day It's very very much happening that I work for some car companies still and they're very worried that everybody between 18 and 35 Doesn't want to own a car anymore. It's not prestige anymore And in fact, you embarrass if you had a posh car in Berlin You get it scratched anyway if you park in some areas of it But what's important about the car hire stuff the same goes for bikes It's it is they have to be everywhere if you only have one they have to search them seek them out. It won't work So we did a project and just quickly to show how we do this This is user scented design services and whatever you look at how people would use it and these days with the media We have you can fake this so we made a little prototype a key that actually works That you made an app that isn't actually an episode is a fake PDF on a phone But you get a few dozen people to walk along and find their car You can see this is just just a little cardboard thing go inside the car There you can get a near frequency communication device You can you can hack that within in 10 minutes So you sit people in the car use an iPad instead of the the on car system just to find out How did they use this and we spent three months with a few hundred people and then they build the system after But so it's built by the people who use it not by some designer at some desk or other now one one issue that concerns me Where's all this power gonna come from? Yeah, we're all gonna be electric. Where's they're gonna come from? That's one idea. We are renovating those and some guy in Austria went along said hey We have all of those. I don't know if they said ever in America. There's certain loss here We certainly have in the Germany telephone booth. Let's make them into charge station They're wired up. They've got power there and thereby the curb often on street corners perfect place for charging cars Now you see the very lip in Paris. It doesn't mean they're free, but it means they liberate people That's how I understood the word because cycling is actually quite an amazing activity. It's healthy It's good for you if you make it easy if they're everywhere and they're easy to get you have a winner Yes, I am I'm done three more slides This is of course Copenhagen that the mecca for for bicycles I could show you one in winter that they also use the bikes, but you have to have an infrastructure You really can't just say bikes go you have to do like New York's you know take some parking space away And then people will use them. There's a few problems that need to be addressed Like parking cars is an issue. This is Amsterdam. You know, I have a bike park there I'm never gonna find it again unless I painted neo neo pink or something I know it's in there somewhere, but I'd be damned if I find it again. So that's an issue We have to address One issues but that's in America. Of course, you have to have a cup holder So that has been dealt with you can buy a cup holder for your for your bicycle So no more problems and this is my full disclosure.  Whatever you you provide you make it ubiquitous make it everywhere in other words make it easy Maybe even fun. I heard that word mentioned a couple times before and Then you have a winner You also should get some of us involved because we can make things easy to use and legible. Thank you You're hard act to follow and I have say I'm also I'm also so sorry that her spear did not come here after your speech I would have been very interesting to have heard a very different view of urban planning, but Yeah So so I Have to defend the highlight in New York a little bit because of course, no, it's fine. I love it I just I think it's a little over, you know, you guys think it's amazing. Also, New Yorkers. New Yorkers don't drive Yeah, I mean I get a question in quick. Yeah, I Suppose I will I mean I take your basic point that that that that good design makes cities function better and that we don't listen to designers we listen to architects too much But does that actually But does that actually make any sense, I mean It sounds to me like what you're suggesting is not actually any different what Alejandro was talking about that is to say a Listening to people how they want to use cities and responding them is what makes good maps good diagrams or anything else, right? Yeah, just making it bringing it down to earth again. That's all yeah horizontal. I Was trying to say something slightly different. Yeah, good, which is that architects can detect and formalize certain latent tendencies that Make these Processes explicit so it's not it's not just about listening to people about being able to Listen to people into and to be able to explain through architecture that That action of listening, which is what we do by design We listen to people and make things accessible by using our tools But also to expect to expect to explicit it to explicit aid the processes that are happening behind our designs Yeah, I mean, I'm assuming that that's that's that's basically what you're suggesting happens when you pool information Let's say about smart cars and so forth. I mean The question I guess would be so what is so what is the What is the moral role of the designer then? I mean you you you slipped very easily from talking about The need for bike lanes and the use of cities to certainly talking about 3,500 pound You know electric bikes that are Mercedes way of trying to capitalize on on a bike culture, but it's an extremely different notion of What the value of biking is you say you're a bicyclist. It's not healthy. It seems to me that if you've equally facilitate the creation of a 3,500 pound bike and and and and also good signage for bicycles there I'm not saying you can't do it But surely those are different sorts of enterprises. No, not really Our role is we were translators We we get an issue a problem to solve whether it's housing in your case or whether it's it's it's moving about horizontally in my case if a car company comes to me and says, you know design me the process to to to rent our cars for five minutes or Cycle company comes and says, you know, how can we make this accessible to people? We design the interface the software the hardware to make people use them to make them legible That for me the word legible is the most important I think we need to move on and from interfaces. Let's go back to architecture and cities and spaces with Bianca angles


Russian Storm-Z threat looms over recently liberated region. The new Russian offensive in northeastern Ukraine is causing concern among military officials in Kiev as Moscow's forces look to spoil the ongoing Ukrainian counter-offensive still raging in the south and east of the country. Former prisoners in Storm-Z units are said to be part of the Kremlin's push according to Newsweek. Colonel General Oleg Sander-Syrsky, the commander of Ukraine's ground forces, told Ukraine's Gupravda on Wednesday that the Russian push in the direction of the Kupian region at the border of mostly liberated Kharkiv Oblast and mostly occupied Luhansk Oblast has produced a difficult and fluid battlefield. The Russian goal, the commander said, is to break through the defense of our troops and go directly to Kupiansk. The city was among those liberated in Ukraine's September 2022 counter-offensive, a surprise operation that collapsed Russian lines in Kharkiv Oblast and liberated nearly 1,000 square miles of territory. Fighting is now extremely intense, Syrsky said. Separate positions these days passed from hand to hand several times. Among those settlements reportedly lost in recent fighting is the town of Novoselovskoye, which Russian state media said was captured by Moscow's forces last week. Russian troops are now looking to drive further west from here, though Syrsky said they have so far been unsuccessful. Our fighters courageously hold the defense, repelling all the enemy's attempts to move forward, he said. Among the attacking forces, Syrsky said our eight StormZ assault units, which are made up of former prisoners and are often used in Moscow's high-risk offensive operations.


The study investigates the association between exposure to particulate matter, PM 2.5, and emergency hospital admissions for various causes in 26 U.S. communities. The results show that an increase of 10 gm3 in PM 2.5 concentration is associated with a significant increase in hospital admissions for cardiac causes, myocardial infarction, congestive heart failure, respiratory disease, and diabetes. The study also found that the association between PM 2.5 and hospital admissions was significantly modified by the chemical composition of PM 2.5, particularly by the mass of certain species such as Ni, Az, Cr, Br, Oc, and So42-. An interquartile range increase in the relative proportion of these species was associated with a 1-2% additional increase in daily admissions per 10 gm3 increase in mass. The study suggests that particles from industrial combustion sources and traffic may have greater toxicity on average. This article was authored by Kutraki's Petros, Franklin Mairdiff, Zanabeti Antonella, and others. We are article.tv, links in the description below.


In 2019, Savannah Hall took a 23andMe DNA test to assist in the discovery of three missing siblings that have gone missing since the 1960s. After three years and two reunions, the third and final sibling has been found. So I took a 23andMe and then I got back a result and somebody had a significant amount of DNA matched to me. So we messaged him and it turned out to be the first brother that we found three years ago, Bill. So since these three years we've actually been able to find all of the missing siblings now and that's who we have here today. We found Keith next and then we found Debbie which is the missing sister of the last link. Since the test, siblings Bill Waite, Keith Kraft and finally Debbie Dahlgren have been reunited at last. Sibling Mina-Pinson says having everyone back together is closure. Well, I knew about everybody but they didn't know about me and I have looked for them for years but never been able to find them until we did this DNA thing. So it's been a long process for me and it's closure. I found everybody. We are Pikeville Medical Center and we are an amazing place to work. Healthcare heroes of all types work here. All who deserve great rewards. So while our heroes are working hard to take care of our patients and visitors, we are taking care of them with top tier benefits, higher pay rates and great sign on bonuses. So join our team today. So what are you waiting for? Apply today. Incredible opportunities await at PMCjobs.org. Due to New York adoption records being sealed, a name change and lack of technology, Pinson couldn't connect with family members until a DNA test was performed. With everyone back together, Pinson says she hopes to continue connecting with family members. Well, hopefully many, many, many more reunions. Right? Right. Many more reunions. And maybe we can find some more distant relatives and stuff. So we're working on it. His daughter's great at the DNA and the ancestry and all that. Yeah, so our parents are all gone. So it's up to the kids to carry on. For Mountain Top News, I'm Joel Hodgell.