Okay, hi everyone. Just letting you know, I'm going to start this in just another minute. Hopefully, you can all hear this. If you don't have it open, open up the group chat channel and you can type questions to me at any time. Okay, well, we might as well get started. As you probably see from the screen, the first midterm is being held on March 5th and that's what we're assuming you have the most interest in at this point. The cutoff date for material is pretty much the previous class on March 3rd. So all material up to that point, again, I assume the professor will announce exactly more details. But anything up to that date will be covered on the midterm. It is, of course, no notes, closed book, no electronics whatsoever. Basically, just whatever you have in your head, plus what you can remember right down. The format of the test itself has not been completely determined. We'll get more details about this as we get close to that date. And just one other comment, we get this every year. This is a very large class. We don't really have people asking questions during the exam. If you see a mistake on the exam, please call us or if there's some factual problem. But if there's anything unclear on the exam, just make sure you write down what is your assumption. If you say this could be understood multiple ways. Say, assuming this means this, this is my answer to this question. And again, a professor is very lenient in those type of situations. We'll go from there. Before we go any further, does anyone have any questions either about the midterm itself or again, if you have any other questions about the last project or any other subject. But again, just if you do have any questions, anything quick, feel free to just, again, type it in and I'll stop or address your questions at the end. I'm basically just going to give a quick summary or quick review of a number of topics on the midterm. The practice midterm has just been posted and it's available on Piazza. This guide or this review does not really cover that practice midterm, but we of course hit some of the similar topics. A couple more recommendations on the exam. This exam is very concept heavy. It's really going to focus on if you understand the topics that have been discussed. We try to downplay coding, try to downplay memorization and try to stress what you understand, how you understand it, and what you can explain. If you want to review the best subject, of course, I think is the lecture slides, especially of course the 3, 4, and 5, the access control, cryptology, and authentication slides. You may of course want to review the recorded lectures, review all the slides, and so forth. There's again going to be a study guide. There is going to be multiple review sessions. Usually, of course, before the exam, the TAs are available to answer any questions you have. If you look through the practice exam, and again I highly recommend going through the study guide on your own and answering those questions on your own, those will be very similar in topic to what you'll see on the exam itself. And working through the study guide questions, you may end up actually looking at some of the concepts that will be on the exam itself as well. You're always welcome to bring the study guide into a TA session and ask us to give you answers to those topics or have us explain reasons. The undergrad TAs are also planning to have an additional session review. We have a quiz available, a little survey asking what areas you would want us to really focus on or talk about. What's the muddiest point? What are the most unclear topics in the material so far? Again, that meeting, signs, all that are announced on Piazza. Anyway, let me give you a couple examples. This is mostly from what Adam has used last year, my experience TAing this class last time. Couple things you might see are topics, questions again about access control lists, what they are, what they do, examples of systems that use it. Again, I'm not going to give you all answers here, but you can guess such as Unix systems use access control lists, access control matrices. There's going to be a lot of cryptography. Understanding again, what's the purpose of hash functions? How are hash functions different from encryption functions? What do hash functions accomplish? What is a good hash function? I mean, again, hash functions, of course, provide like an authentication signature to one way hash. You can generally encode something in one direction, take a longer message, convert it to a shorter message. Something that's really infeasible to reverse, exactly why that's infeasible to reverse and why that's valuable. It would be important to know. Lots again on authentication, authorization, determining again who you are versus what your authorizes to do. Giving a lot of good examples of those would be good. Act at the very beginning of the slides. Another good topic is CIA. What does CIA stand for? What do they mean? Why is it important? Again, why it's important. You can, of course, give much more details, but pretty much all attacks and all defenses for security can fall under one of these three categories. Looking at a list of your access control policies is also important. There were quite a few discussed and described in much detail. Just two of them, of course, are like mandatory access control, centralized access control, discretionary access control, where again discretionary, an owner of an object, owner of something determined to security versus centralized systems. Why would you use a certain method? Why would you prefer one method or another? What is one good for? What is one not good for? Lots of cryptography. I assume everything's been discussed on public key, private key encryption. What is a public key? What is a private key? How do you implement non-repudiation? This is another very good topic. What people can obviously understand very simply how you can encrypt a message using public key encryption. You encrypt it using the public key that you make available to everyone. You decrypt it using the private key, which in only the receiver or the owner of the key keeps. So therefore anyone can encode something, but only one person can decode it. But how do you use the same system to invoke non-repudiation? What if you want to say, here's a message that I have signed and it came from me and only came from me? And you just quick answer that question, you create a hash as a message. You encode it with the private key and then you can decrypt it with the public key. And since these are complementary keys that tells you that only this person owning that private key was able to encrypt something that can be decrypted with the public key. So it's a reverse encryption. You'll see possibly questions tied to the concepts of your programming assignments. And assignment two, assignment three especially. How did you accomplish breaking the Caesar cipher? How did you accomplish breaking the visionary cipher? Again, don't try to memorize exact steps. We're not going to have you write actual code on the exam. Try to downplay the amount of memorization needed and again, focus more understanding. Also, don't try to go too far into advanced steps of DES. Don't try to go through every individual step of the DES encryption process. Same with AES. Try to understand what the basic system is, what's significant about DES, what's wrong with it. Same thing with AES encryption. Again, some more topics include the one-time pad. What is it? Why is it a perfect encryption system? What's its weaknesses? When does it fail? What are rainbow tables? What are salts? Again, rainbow tables being pre-computed hashes. What are salts good for? Why are salts implemented? What are they? Again, I'm assuming this has been covered or will be covered pretty soon. Salts being extra randomized characters stored with your password that are designed to lengthen the password. Again, when you perform a hash function, it's much more difficult to reverse a longer string than a shorter string. Take your password plus this long salt, create a hash on a very long string, works much more effectively. Also, if your password table gets stolen, you've got randomized hashes. If you didn't have a salt, two people with the same password would have the same hash possibly. If you have the hash plus this long salt character, obviously you can't just compare and look for identical hashes in that table. Also, salts make rainbow tables worthless. You can't pre-compute hash tags if all of your hashes are computed with salts. What is a slow hash? Why is a slow hash important? If it takes like 300 milliseconds to calculate a hash for a certain password or key, what does that mean? That you stole a database of 100,000 user accounts with passwords and the accounts had all the hash values. But if you try one million passwords, brute forcing per account, that's 10 million times 100,000, take you quite a long time to brute force a database of hash functions and you will get very few keys out of it. Also, what are pre-image tags? What are other aspects of hash values, et cetera? EC, FLS, the abstract concept of an authentication system. All these, again, might have some questions about. We've seen a couple of questions in the classes already. Again, you have, of course, A being information that proves identity, C being the information that's around the computer, identity, F being the mapping function, L being the testing function that tests your identity as being selection, saying, how do I change this thing? And you'll see some questions possibly tied to, again, back on the slides where it asks again, if an attacker has a hash, wants to find a password, how would you express this in ACFLS? And if the attacker does not have the hash, but wants to try this password using a logon function to generate the correct hash, how is this expressed? And again, the answer to these two questions are right on the slide, the last slide for ACFLS. And that's basically a summary of a couple of things you might see. Again, this is the study guide to practice midterm has just been posted. So again, there are some confusions or some things that are difficult to see easily. So make sure you discuss, look at these answers carefully. Maybe discuss these answers between each other. We definitely don't mind you discussing the answers to these questions on the Piazza channel. And again, feel free to ask us any questions at all on either what the slides mean on answers as a practice midterm or on anything else. Pretty much all I have for my presentation here. Again, anyone have any questions about any of these subjects or anything on the exam? Okay, let me see if I can pull up DES real quick. I'm not seeing a great way to put this into the window. Let me see if I can switch off to slides. Okay, that should, I assume you guys can hopefully see the cryptology PowerPoint slides here. I'm basically just going to run down to 50 and onward. Whole point of DES or any real implementation of cryptology, and this gets back to the subject Adam mentioned why you never want to build a cryptology system yourself. Because there's always a tax possible on very simple encryption systems. So real encryption systems use some very complicated, multiple step system of, again, substitution transpositions that have a lot of properties that make breaking it or analyzing it difficult. DES was one of the earliest standards, as I mentioned here, standardized in 1976. And was strongly influenced by the NSA, which many people assumed had maybe some of the various purposes here. So NSA could possibly attack a bit of possible. Add, again, a 64 bit data block size, a 56 bit key runs through a number of very quick substitutions and transpositions. Again, as I mentioned earlier, the actual steps precisely of how these things work is not going to be on the exam since I mentioned that already. I'm not going to repeat and go through the lecture in details. But keep in mind that the purpose of having multiple rounds of transpositions and substitutions is that you randomize any type of analysis, any type of pattern that you could see in a slide. Any tax on either transposition or substitution, any English frequency that occur in the text would be completely lost by the time you go through just a couple of these rounds. Of course, the weakness of DES is that the key size is just simply too small. As computers got faster and faster, as I mentioned here, there was a system in 1988 where DES was cracked and they broke a DES key in two days. Modern computers, of course, can break DES much, much faster. There was a couple of quick extensions to DES, like triple DES, which did nothing more than run DES three times in a row. And the weaknesses of this small key size, horse, and other ways of analysis showed that DES was a flawed standard, was not usable, and we've later moved on to other types of, again, complicated encryption systems, such as AES and so forth. If I can answer your question, any specific questions about DES? And in practice, many different types of encryption systems have been broken over the years. There's nice laundry lists of former encryption systems, which are suggested that you no longer use. And of course, more modern ones that people still use today. Any other questions? Okay, let me pull that up here. See, I believe, instead of pulling up to practice midterm, I'm going to go ahead and just go to the very next slide here. I believe it's mentioned. Let me see. Again, just a brief summary of, again, two different techniques of running symmetric encryption, or either ECB encryption or CBC encryption. Again, I'm going to skip over a bunch of non-essentials. The gist of it, though, is that ECB is known as electronic codebooking, which is in a basic form, a very, very basic form of encryption. Basically takes your data, encrypts it directly, as you can see from their diagrams here.  Again, the encryption system used here is generic. You could apply anything where you have DES here. You could be using a more modern DES encryption system, for example.  This is, again, the simple, direct method most people would assume. Break up your plain text into blocks, encrypt it, combine the blocks into your ciphertext. Modern systems use different techniques of making analysis more difficult. And again, it's independent of the actual encryption system. One technique is known as cyberblock chaining, such as shown here. The gist of it here in simple English is that every prior block that you encrypt is exored with every subsequent block. Again, you can apply any type of encryption here. And the purpose of this is twofold. Since all blocks are dependent on prior blocks, then you are required to decrypt one block at a time. You can't decrypt later blocks unless you decrypt prior blocks, which, again, breaks a lot of the parallel processing, a lot of the ability to use massive parallel processing to brute force your decryption system. And the second benefit of using a system such as this, such as cyberblock chaining, is it further scatters any type of pattern you can see in the text. You randomize or, again, encrypt your data dependent on both the encryption system, the plain text, and the prior blocks data. Any patterns that you see will definitely be scattered in later blocks. The first block here, as you can tell, is, again, you'll notice that IV that I mentioned, you have a certain IV key that is used to provide some sort of randomization to the very first block. Because without that, the first block would be pretty much straight encrypted by the encryption system as well. Exactly. So simple English. Yes, ECB mode is very simple, much less secure than CBC. CBC is much more secure because you're exploring each block. It's much more difficult to detect patterns. And it's much more difficult to brute force. Any other questions? Again, unfortunately, the final version of the midterm exam has not been made yet.  Again, this is up to Adam, not myself. And because of a large classroom size, we may have a slightly different format. In the past, the midterm was very similar in style and structure to the practice midterm. And there's a chance that, again, the midterm will look the same as well. But yes, as far as number of questions, I'm expecting something fairly similar. But don't hold me to that. Let me see if I can pull that question up for you on the screen. Question about number four on the practice test. Let me see if I can load it here first. I assume everyone can see the question. I'm not going to read the question in its entirety. But the gist of it is, what type of access control mechanism do you use and why under this particular circumstance? And again, there's a number of access control messages, like originator control, access control, mandatory access control, discretionary access control, logical access control, role-based, et cetera. I don't have a total list of them here. The answer to this question is, which access control mechanism would use in this particular case? What I'd suggest doing to approach this question is, again, write down all the different type of access control methods discussed in class and understand basically what they're good for. Understand, basically, what the benefit or strengths or weaknesses of that particular approach is. And again, there might be more than one way to answer this question. Write down what access control method you think is most appropriate for this particular situation and why. I describe, again, details of what its strengths are, why it applies to this particular case. And again, this is more of a judgment call. You want to say, why your choice for which method is better than all the other types of access control methods? And you have to understand what all the other access control methods, strengths and weaknesses are in order to do that. Make sense? The question I have here is, can we email you later with a completed practice midterm for feedback? And we prefer not to do grading for you for your practice midterm. What we'd rather have you do is post, again, a couple questions, or if you want to post all the questions, or some questions in the Piata channel. I'd rather not, again, create complete midterms and tell you that, yes, your practice midterm is perfect or your practice midterm is not perfect, et cetera. Again, you're welcome to come to TA office hours and just discuss every single question with us in person, of course. Next question, public keys. One second, let me pull that up on the slides. I'm just going to run over these very, very quickly. The gist of public key encryption, again, it's already been mentioned that you have a public key that does a one-way encoding so that your public key can encrypt a message, but you cannot decrypt that message with that same public key. You require to use a second or separate private key to decrypt a message. So the simple concept is that when you publicize your public keys for everyone, anyone can encrypt a message with the public key. So the short version is, yes, you can simply, once you encrypt a version of the message with a public key, no one but the owner of the private key can decrypt it. The process of actually mathematically generating the public and private key is interesting. There are several versions of this. There's RSA, et cetera, which I again, I'm not going to go into in this particular case. It's extremely hard, mathematically intractable to take a public key and determine the private key. And it's the purpose of the encryption system and, of course, the weaknesses of the encryption system. If technology such as quantum computing somehow make it possible, it could break public key encryption pretty badly if you could simply take a public key and generate the private key from that. But as of this moment, it's incredibly difficult to do so. So the system is fairly secure. But again, showing the slide, you take a message, encrypt it with a public key, and the receiver, Bob, can decrypt it with their private key. You reverse the process for non-repudiation, as mentioned before. I'm not going to go into much more detail. If you want to both package message and encrypt it, you first use your key to, in this case, use Alice's private key to take maybe a hash of the message and sign it. And then encrypt the entire thing with Bob's message. So when Bob first decrypts the message with his key, he gets the internals of that message being Yvette saying, yes, I can take the public key of Alice and see that the message is signed. And I know that both Alice is the person who sent this key because only Alice can sign the message. Everyone else can de-sign the message. And I know I'm the only one who received the message because she encrypted it with my public key. And I'm the only one who can decrypt it. So in this particular case, if you do things in this particular order, you first encode the message with, if you're Alice, for example, encode the message with your private key, which signs the message. And then second step, encode the message just second time with Bob's public key. Bob does reverse. He first takes his private key to unwrap the outside of the message and then takes Alice's public key to unwrap the message again. He knows, first of all, that it came from Alice. He also knows the message. And an attacker such as Eve cannot do anything with this. Eve can't unwrap the outer package saying Eve cannot read the message because she doesn't have Bob's private key. Eve, also more importantly, cannot impersonate this message because Bob sees that the message is wrapped with Alice's public key or Alice's private key, which only Alice's public key can encrypt. So Eve cannot impersonate Alice either. Any questions about this? OK, again, I will be keeping the channel open until roughly 2 o'clock. OK, one more question. As far as the ciphers, will we only be asked to explain how we would approach solving them? I'm assuming for the purpose of your question you're referring to, I think it's my question five on the practice midterm. Questions about approaching the ciphers as far as the homework questions went. In general, yes, you're asked what approach you took, kind of taken outline of what steps in plain English, how you approached your program, how your program operated, what your program did to break, for example, in their case, a Caesar cipher, what's actual steps you did to decrypt the cipher text in with a Caesar cipher. You're not really asked to explain exactly what program in the language you use. You're not asked to explain anything specific in your detailed description, just maybe a couple of sentences at most of how your program operated, as if you were explaining it to someone else. Also, here's question number five on the practice midterm for your reference, this is what I was referring to. Again, this does not say that there won't be any discussion of other ciphers that were in the PowerPoint slides, but I don't believe you were asked to break any ciphers or go through the elaborate steps for anything else, besides the examples of the ones on your homework and the problems and the actual lab problems. Okay, so question five, will it be a good way to determine how it was decrypted, how it was encrypted? The 5.1, the first part of this question is actually not really tied to the homework. This, you need to, again, review the PowerPoint slides and just understand what is the main weakness of Caesar ciphers? What did you use to break the Caesar ciphers in the first place? If you were trying to determine, again, I'll just go ahead and give you the answers to this one. For 5.1, yeah, exactly, you do a character analysis. If you see some distribution of letters that looks not symmetric, some distribution of letters which shows certain characters repeated much more often than other characters, you do a frequency analysis and you see somewhat like a similar to a English pattern, letter distribution, or again, if that was a different language, German pattern or some other pattern of letter distribution, that pattern would be similar to the actual plaintext frequency analysis you perform in some way. And again, as already mentioned, yes, a character analysis would show some distribution, some uneven frequency distribution of symbols. And part two, one of the possible answers to part two would be yes, like you did in the assignment, try every shift until the English becomes valid. There are other answers to part two as well. You could also look at the actual frequencies and assign the most frequent terms to the most frequent terms in English and so forth. Okay, well, we have another five or six minutes. I am gonna go ahead and close the session down at two o'clock, but if anyone has any other questions, we'll be here for a little bit longer. Yeah, I'm going to go ahead and shut down this session. If you have any last questions you're typing up, please say something pretty quickly. And if not, good chatting with everyone and feel free to either contact us by Piazza or by email if you have any other questions on any of these subjects.


The Constitution was written by a number of white men 232 years ago, 1787. How do you accurately infer what they would think in a 21st century? It's hard. Doing law is hard, isn't it? Law students, you find it that hard? Yeah, it's hard.  All right? But it's what judges and lawyers have done for a millennium. That's what we do. I can find you a hundred if I can find you one Supreme Court decision that says that judges should interpret statutes and contracts according to their original public meaning. And I'm unclear why we shouldn't do the same thing with the Constitution. Our founders rejected. They knew what an evolving living Constitution looked like. They came from England. They chose to write things down instead. They chose a different path deliberately.


Harry obviously not the result we wanted there talk us through that performance Yeah got it to be honest she thought we did really well but again similar to the weekend I think we had we had chances and we didn't take them you know I don't really want to comment on whether it's a penalty or not at the end obviously I'm gutted because you know he saved the penalty and they get another go it's horrible that's a horrible one but you know I think we had more enough chance to sort of put the game to bed particularly in the first half so that's the biggest source of frustration is that we weren't 2-0 up 2 or 3-0 up going into sort of the last stage of the game because I actually think for that for the 90 minutes I thought we defended really well because they're threatened inside you know we expect them to be sort of in and around playoffs and whatever the season so you know it was a good performance but just you've got to be more clinical at the top end of the pitch I think I think it was one of our better performances in terms of especially the first half us managing the ball managing the game really now based on really good stuff it's enjoyable really and then second half it was just about us protecting protecting the goal really but come down to a bad decision in my opinion and just to be fair it's a great initial safe I'm hate so I'm lucky that I fell straight back to the striker but yeah we just take the positives from the game really but it's obviously disappointing to drop two points like that no fault of our own really just an unfortunate decision from the ref but yeah we just move on really yeah I thought we're brilliant in the first half on the ball getting on the ball creating space for each other we're just more positive on the ball compared to last week but just frustrated that we didn't get the three points and as you say we did defend again today we shut down a lot of their attacks before they really got going so there are positives we can take into this weekend yeah no I'm guided because you know like stock for penalty goal here penalty goal should be sitting here really with four clean sheets and four games really and you know it hurts me that we're not you know I take great pride in every save clean sheet like defensive action that I take great pride and all that so it really really hurts to concede a goal and to concede a goal in the last minute of the game and to drop two points as a result of it and that's how we see tonight is two points dropped so I see it anyway really hurts to be honest and it's one that we need to get over quickly because it's another another game here on Saturday and it's an opportunity to put it right yeah definitely you know we dropped our levels against Grimsby in the second half but we showed our quality in the first half today but could have taken a few more chances killed off the game but this wasn't meant to be and looking ahead obviously we're back here in just a few days time against Crawley and what you thought ahead of that game what can we take from today into the next same as when we're going to every game that we expect to win expect to be our side of football and just keep the level we're at today I thought we'd play some really good stuff and the intensity was there for a long period of the game and yeah like I said it's disappointing but we just got to take a lot of the positives that were in the game today and try and do it against Saturday yeah it's obviously we'll be looking for another three points try to get ourselves up to table again and I'm back on a winning run we haven't been on one in a while so that'll be what we'll be looking forward to on Saturday that's that's the thing with this league isn't it it's it's pretty relentless you know Saturday Tuesday Saturday Tuesday but that's how I want it you know when you're looking at it Saturday will be my my 20th game this season and you know that's more football than I've played in the last sort of five years put together or whatever it is so the more games the better like you say you've got to put this put behind you quickly and the best way we can do that is by going and putting on a put a bit of a statement out there at the weekend when we play against against Crawley


physics channel for physics please subscribe my channel hello and welcome back to another episode of physics partner today we are going to dive into the concept of a specific gravity and explore its real life applications so what is specific gravity anyway it's simply the ratio of a substance density to the density of our reference substance the reference substance usually is commonly water and the density of water is usually taken as 1 gram per cubic centimeter so how we calculate specific gravity calculating a specific gravity the straightforward process the formula for a specific gravity is sg specific gravity is equal to density of a substance divided by the density of the reference substance this mean that if we know the density of a substance and we also know the density of water the reference substance we can calculate the specific gravity of that substance now let's explore some of the numerous applications of specific gravity one of the most common real world application is specific gravity will show whether something will float or sink solids and liquids are majored against water so if the specific gravity is less than one it will float if it is higher than one it will sink this measurement is extremely useful to design floating bodies we can also use specific gravity to determining the purity of a substance we can use the specific gravity of a substance to compare it with the specific gravity of pure substance to identify any impurities or contaminants and other application of a specific gravity is the field of geology geologists can use specific gravity to differentiate between different types of rocks and minerals for instance gold has a specific gravity of nineteen point three two which is much higher than that of most other minerals present in the earth's crest the properties allows geologists to identify gold deposits and potential mining sites in the oil industry specific gravity plays a crucial role in determining the quality of crude oil different types of crude oil have different specific gravities and the specific gravity of crude oil can indicate the presence of impurities such as sulphur which can impact the refinery process overall specific gravity is an important concept with numerous real-life applications from the purity of a substance to the quality of the crude oil and even in the production of alcoholic beverages specific gravity plays a significant role in diverse fields so next time you can across the concept you will know the significance that it holds so I think it's enough for today so thank you very much for listening and watching I hope you enjoyed the video I hope this video is useful for you so take care of yourself and don't hesitate to write an email if you have any question curies suggestion and even classes are required take care of yourself meanwhile see in the next video goodbye


So during the EHA 2019 in Amsterdam, we heard a lot about new drugs, new strategies in myeloma. Very promising results. I would like to focus on four topics. First, we could call it a treat earlier. And that is related to the subset of patients who have a small during multiple myeloma. So the IMWG conducted a retrospective study and described a new prognostic score. Very easy actually to realize. Everybody can do it. And predicting of a progression of 50% within two years. So this is, we will see, but this is again a very easy new prognostic score for small during myeloma. And also there is a therapeutic abstract on the treatment of these high risk, small during myeloma, with revlimid or no treatment. And they showed that there is a benefit to treat earlier, these small during myeloma with revlimid only, increasing dramatically the PFS. And actually that may be a change in the daily practice in the future. So that's the first point, treat earlier if I could say. Second point, and this is again about monoclonal antibodies and mostly anti-CD38. Philippe Moreau presented for the transplant eligible patients, the Cassiopeia study that was performed mostly by the IFM, showing a high response rate, combining VTD, Velcade Thalidomide Dex plus Daratumumab, before the transplant and in consolidation after the transplant. So this is the first upfront combination in the transplant eligible patients, a trial showing high efficacy adding Daratumumab to the standard VTD regimen. We heard also in the relapse setting this time, the ICAIA trial combining pomalidomide plus DEX plus a new CD30, anti-CD38 monoclonal antibody namely Isatuximab. And in this setting, the results were compared to without the Isatuximab and the results were really encouraging in favor of adding Isatuximab to pomalidomide plus DEX, especially because the patients who were enrolled in this trial were mostly, if not almost all of them, refractory to lenalidomide and as you know today, this is a real issue in the relapse setting. How do we treat patients who relapse on lenalidomide or who are primary refractory? So this is a very important study. So that was the second point, monoclonal antibodies and with anti-CD38 target. The third topic that I would like to draw your attention on is do we still need to do autologous stem cell transplantation? You know this is a very major issue in the field of myeloma treatment and the IFM published not too long ago that indeed we should still do it, but you should have a look at the so-called Forte trial presented by Francesca Gay from Torino, Italy and without going into the details of the trial, she compared KRD, Carthusomy, Breville Middex induction, autologous stem cell transplantation plus KRD consolidation versus KRD only, 12 cycles without autologous stem cell transplantation and she showed that actually the results were quite similar with or without autologous stem cell transplantation but during this meeting, the EHA meeting, she updated the results and she was able to show that actually it remains very important especially for the high-risk myeloma for this subset of patients you really need to do the autologous stem cell transplantation. So this is the third subject, topics. The fourth one is also a very interesting one. It is about steroids. As you know, there are no real guidelines on how long should we keep steroids. There's no question that steroids is an important part of myeloma treatment but we may give too much steroids if I may say to our patients. Actually, Alexandra Larroca from Italy presented a study comparing Revlimiddex until progression for old patient population versus Revlimiddex, nine cycles, nine cycles and then Revlimid only, so without steroids and she was able to show that actually you don't have worse results without the long-term treatment with steroids, even better without it and of course less toxicity. So this is important because probably in the near future we will still use steroids but with a shorter time probably. So again during EHA 2019 we had new information about the so-called new drugs and I would like to start with what we call now the BCMA therapies and that includes, why do we call them BCMA therapies? Because the target on the malignant plasmocytes is BCMA. So we have actually three treatment approaches. We have of course the CAR T-cells and this was published recently in the New England Journal of Medicine by New Upper Raj from Boston and she updated again these very encouraging results. We also have the so-called bytes, base-specific antibodies that has been also updated during this congress and finally also a very interesting approach. It's called the antibody drug conjugate, ADC treatment. It's a monoclonal antibody targeting BCMA and carrying a chemotherapy and the results are very encouraging also. We also had an update on more targeted therapies such as venetoclax and as you know it's particularly efficacious for patients who have the translocation 11-14 and it's also very active in combination with a proteasominibiter. We also heard about selinexor which is also in development and a new image developed by cell gene, apparently very encouraging especially also for patients who have become refractory to lenalidomide and pomalidomide. So all together this was a very very exciting congress for my Loma.


This is less exciting than I was expecting. I suppose it's at least passing the time a little quicker. Must be duck hunting season. Since the shots I keep hearing are coming from over the lake, I don't remember when duck hunting season closes. It gets shut down to public access during hunting season. I have many hazelnut orchards. I don't think this one's still being maintained or harvested at all, but I'm not sure. This guy gets over it because it's a narrow shoulder. As much as I would have liked, but they at least gave me some room. It's a real shame. 10 or 15 years ago, wait for this car to pass. 10 or 15 years ago, I couldn't have walked more than a mile without having someone stopping off on me a ride. But pretty much all the old farms have been sold to developers and wealthy people from out of state. And not one of them will stop not for a ride. This place has really changed. Not that I'm looking for a ride. It's just the fact that no one will stop anymore. It's like pulling teeth just to get people to move over and give you space on the shoulder. Before that was just a given. People understood how to drive on country roads. There's just no community anymore. It's every man for himself. It's a real shame that that's what this country has come to. Let me meet nice enough people. I did have a chat with an older lady on my return trip last time, the time before, asking what I was out doing. She was very impressed with the kind of mileage I was putting on my feet. Cyclists tend to be friendly enough. Wait for this car and this car. Cyclists are friendly enough when you bump into them but few and far between and they're getting to their own places. So it's not like they're stopping to chat. It's a lot weirder when there are people out and I'm streaming. I don't want to be talking to myself or people looking at the weirdo walking into town. Are you home or are you lost? It was weird just a bulldog hanging out in that yard. No fence, no tie out. No people around. Most country dogs a lot. Pretty territorial if you walk by their property. So I'm wondering if that dog was lost. I guess we'll see if it's still around on my return trip. Sure it belongs around here somewhere. Certainly didn't take any interest in me. The USB port on my phone is getting worn out. So the cable isn't at the perfect angle. It stops charging. I have this electric hand warmer that I skipped a trial on my friend. The devil's us a power bank. Otherwise I would not be streaming right now because I don't want to run down my battery on my phone. And we're just getting into a situation where I actually need a phone. I don't want my battery to be dead. But as long as the power bank has a charge on it, I'll keep streaming. At least talking to screen. It's like having company, right? I think that's what most of us have anymore. This is good practice for talking out of screen since I didn't do much of that this year. Mostly film stuff that looked interesting. I just did voiceover. During the season I just did not have the time or energy to figure out something intelligent to say and film at the same time. And get all the garden work done. Maybe a couple miles left. I'll be up at the highway. From there I have options. I didn't really have a plan for today. Notice that there wasn't rain in the forecast. At least not until later today. I wanted to take the opportunity to get out. Pretend to enjoy civilization for a little bit. Mostly just have some kind of human interaction. Since I don't get that out at the farm. Makes the holidays rough. I'll tell you that. But this year went a lot better than last year. As so far we'll see what happens as we work in the spring. No idea how the audio is holding up. Even when there aren't cars passing. I thought about packing the mount and my shotgun mic. There's just too much bulk. I didn't want to bring a bag with me.  So hopefully any of this is listenable. I guess I won't know until I stop and go back and re-watch parts of it. I was worried the fog was going to be thicker. It was pretty bad when I was first leaving. Bad enough sharing the road with drivers. When they can actually see you. I was worried I was going to spend my whole walk jumping into ditches to avoid oncoming traffic. But it's also late enough in the day that most of the commuter traffic is already gone for the day. I guess since nobody showed up to watch this. Maybe it's like a free therapy session right? Me talking into the void. Sure why not let's do that. Bad little duckies. Yeah another car. I guess I'll wait to show that. I guess this is how I'm spending my winters now. I'm glad I'm in good enough shape that I can do this walk on the regular. Because last year when I tried to cover this mileage it absolutely wrecked me. I don't think I can move for three days afterwards. This year I'm doing it weekly or so. I'm hoping that'll help keep me in shape for the gardening season. That's the worst part. Spring rolls around and even cooped up inside all winter not doing much. Another car. You build up all this muscle over the gardening season. And then it all atrophies over the winter. You start back a square one in the spring. The first month or two of hard garden work is pretty tough after. You've just been sitting around for the winter waiting for spring to come again. I haven't been doing static squats this winter. Last winter I did and that helped a lot. Another car. Having the quad strength and the dorsal flexion. And the ankle mobility. Being able to get down low and stay there is huge. When it comes to garden season I was worried that it wasn't really going to hold over the winter last year. But I didn't do too bad. I think I got to the point where I was holding like an 11 minute static squat. But you would never do in a garden because you squat down, you do something, then you move to the next spot. But being able to hold an 11 minute static squat is huge for comfort and mobility when you're doing everything by hand and down near the ground a lot.   It's way easier if you can actually hold a squat and hold it. I'm almost where the people are. Smell the fresh cow manure. I haven't grown up around dairies. I don't find it unpleasant although I also have a very weak sense of smell. But I don't find it unpleasant. The dairies themselves are gross but the manure is whatever. I know somebody from out of state moved across from the dairy on the other side of the valley and sued them out of existence because they didn't want to smell it. Neither dairy was there when you bought the place. Would you buy it? That's the way things are anymore. Not that I'm jumping to defend the dairy. It was tough seeing just the rows and rows of veal calves lined up for slaughter being restrained so that they can't toughen up their muscle. But there's got to be a better way to have that conversation than suing a hundred plus year. Business out of existence. Again, community. Are we going to work with each other or against each other? It seems people are choosing to work against each other. All right, I'm getting to the point where it's going to be weird if I keep talking at my phone so I'm going to get off of here. It was a pleasure talking to no one. I will catch you on the flip side.


Okay. Hi. This is the Glance project review and update. I'm Brian Rossmaid. I'm the current PTL of Glance. Hi, I'm Nikhil. I am the former PTL of Glance, and I'm co-presenting Brian with this bike onwards project updates as well as some context so far. Okay. So take it away. Right. So what is Glance? What is Glance about? It's a code name for the images service within the open stack realm. So if you have been following project updates until today, you might have observed some changes within the Glance mission statement and so forth. Not since Okada. Not since Okada. Not that recently, but it's changed a little bit. It's changed a little bit, and what we have settled down for matured into a long-term vision for the project now is providing services and associated libraries like the Glance Store as well as the client to be able to store, browse, distribute, share, and manage bootable disk images as well as associated data and metadata that's not exactly metadata but tags and other associated information. And this is most closely related to computing resources, but it could be potentially metadata definitions associated with non-computing resources that are neither NOVA or Cinder or Ironic. So that's Glance and Adjust. Going forward. So just giving a little bit context on what we have done so far. So Glance is a pretty old project we started in Bexar and six years down the line we have a great adoption. Lots of clouds use it. I personally know some of the deployments that are using Glance Standalone. So it's a project used just for storing virtual machine images and maintaining the image metadata. But a very good use case would be using with NOVA and Ironic and storing the snapshot as well as bootable image data. So the good news about contributions to Glance is we get a lot of good number of contributors and we had a good count of 55 for Ocata which was approximately the same for the Ocata releases and we are 34 and counting still for Pike. So yay. Thank you. All right. So I want to give the bad news about contributors. That's a picture from the PTG. So as you may know the summits were split into the project team gatherings where design works being done and then what we're doing here is to try to gather feedback and understand what the use cases are so we can go back and code stuff. But the bad news is that we lost our team diverse affiliation tag in December 2016. So the team diverse affiliation tag is something that's put on by the technical committee to indicate the maturity of a project and the idea is that a more mature product is going to have a more diverse team backing it. I don't know if that's true but the idea is that it's better to have more diversity than less because it's a measure of project health. The Glantz core reviewer team was really severely impacted by the OpenStack Innovation Center closing last month. So many people pictured there are not currently working on Glantz right now including me. So I'm unaffiliated so if anyone needs a good Glantz developer please feel free to contact me at your earliest convenience. So just something about the contributors. As you probably know or may not, each proposed change requires two approvals before it's merged into the code repository. So it's two approvals by members of the core reviewer team. So that means that a lot of people have to be looking at the code. You know it's a kind of standardly accepted thing in software engineering that it takes longer to read and understand code than it does to write it. So just pointing out that the reviewing is an important part of OpenStack and so in your capacity as some of you are operators, some of you are perhaps managers of development teams, it takes time not just for your contributors to write their code but they need to be reviewing stuff also and that's what makes the community go. And a lot of reviewing happens which is what contributes to the stability of the code. So it's an important part of the process. So just in functioning and trying to allocate resources it's important to keep in mind the reviewing bandwidth as well as just regular contributions. So it's sort of hinted at this about us losing the diverse affiliation tag. One of the key important aspects of diversity is that a budget cut at one company isn't going to doom a project. So luckily Lance isn't doomed right now. We do have some people working on it but it's kind of close and there are other OpenStack projects that have been pretty much wiped out when a company decided to unfund it. Another key thing is diverse product viewpoints are really needed to help drive feature development and to keep features from being too narrowly focused to one particular use case. So we're trying to build a big project that's usable and consumable by a lot of different people. So it's really helpful to have a variety of viewpoints as we're focusing on features. And the other thing is if you have developers who don't all report to the same boss it's easy for them to be critical of design decisions or feature things that might not quite make sense in the big picture. So that's another reason for team diversity. Okay. So okay. All right open source software. All right so we need your help so as you can tell we've lost some people but people in this room can contribute too.  But there are a lot of other contributions that we need to keep the project healthy that you don't necessarily have to be a developer to do. So for instance with the glance specs these are the design specifications for features that are being implemented. So it's really helpful for people to review those particularly people who use consume the software and have an idea of what the feature might do or have an idea of what their use cases are because it can help make the specs a lot better. So we really like more non-developers to take a look. Then documentation is another thing where the documentations stored mostly in the code repository. As you're reading through the documentation some of it's really good and some of it doesn't. It would be nice to sort of raise the standard. So if you come across typos or you come across paragraph that doesn't make a lot of sense or is confusing, you should feel free to put up a patch. And even if you're not you don't have to be a hundred percent just like with the code. When people put in code believe me it's pointless to try to get it perfect and then submit your patch because no matter what you do somebody's going to have some kind of comment and ask you to put up a copy code. It just means that you have a better attitude toward people making helpful suggestions. So the same thing with the documentation. If you see a paragraph that's a little ambiguous or it's not quite clear, you don't have to fix it perfectly. It's enough to bring it to our attention by putting up a patch that rewrites it. And then several other people will look at it. The documentation goes through the same process. You need two core reviewers to approve it. So people will help you put up a patch. And then there are also glance user stories. So this is kind of an underused thing I think. The product that I'm going to be talking about today is a lot of people focus on you're getting minus twos or minus ones and that makes you feel bad. But the way you think about it is people are coming up with specific suggestions to help you improve whatever it is you've submitted. So that goes for the documentation too. So I'd really like to go into the underused thing I think. The product working group has a repository of user stories for particular use cases that aren't features yet, but that could be features. And what's helpful about that is that you have not just one or two product people, but a whole bunch of product people at different companies who are reviewing these things and clarifying the user stories. And that's really helpful when there's something, so for instance we were talking about the image lifecycle management. So there's a lifecycle of images. You introduce a public image, you want your users to consume it, but then some security patches come out so you want to sort of, you don't want to delete that image because people might still need it, but you sort of want to hide it away and encourage people to use a different image. And it would be nice if there was an automatic way to manage that. And it would be really nice if we had a clear description of where you can contribute. And it's just the same kind of thing. The user story is in the product working group repository. You just submit a patch and it gets reviewed and then gets merged, just the same as code. And then finally for developers in the room, we do have some specs that have been approved that are ready to go, but don't have anybody working on them yet. So you can browse the specs repository and feel free to pick them up. Either email us or ping us. If you have questions and you can get working on that. So there's plenty of stuff to do. So just a little bit more on what we need help with. So we started this initiative of collaborating more with the operators and getting feedback on what the real-world use cases look like, what the real-time pain points look like, and we have been getting some really good feedback through the virtual sessions and on-demand operator syncs and sessions like those.  If you have been to a previous summit, it's like a big room where lots of collaboration, big collaboration could happen. So we have right after this one and we would love to get some feedback there. It's meeting room 103 and at 5.30 downstairs. So it's immediately following this session? Yeah. Okay, so what you're here for is the project update. All right, so this is what we're doing. So as you know, Okada was released back in February. We're working on Pyke now. So I want to tell you what happened to Okada, some things to look for if you haven't deployed it yet. Feel free to give us feedback if you have deployed it and have something to say. So part of the reason why the summit was moved to this time instead of being at the same time as the release was people would have a chance to maybe deploy the release and give us some feedback on what to work on. So some things to look for. Key thing is image visibility changes. So prior to Okada there were two visibilities for images and glance. There was public and private. So the public images the ability to make an image public is protected by policy it's restricted by default to administrators. The idea of a public image is that it's one that the cloud provider makes available to users to boot their VMs from. So it's supposed to have been tested it's supposed to be a quality image and possibly and well most likely. The cloud provider provides support for that. So if there's a problem with the image you can complain and get that addressed. So in addition to that there was the ability to share images in the V2 API that's been since I think Folsom maybe. Yeah. So Folsom or Grizzly you've been able to share images in the V2 API. But the visibility was always private. So this posed kind of a problem because as you're looking at the visibility of an image private you don't know if it's really private that nobody else other than you can see it or whether it's been shared and other people can see it too. So that was the reason why we introduced the shared visibility and then there was the man for a kind of so image sharing glance you need to know who you want to share the image with because you have to provide an identifier for that person. So that's not a big deal if you want to keep like a customer list or something if you're trying to run an image marketplace but if you're an open source project and you just want to make an image available for people to use of some cool operating system or something it's kind of a hassle to find out all these people and then constantly share the image with them. So with a community image you can make the image available to everyone in the cloud. Now that's also protected by policy because right it could be abused but the other interesting thing about community images is that they don't show up in the default image list. So it's basically anti-spam provision. So if you want to find community images you have to discover them by making an appropriate API call. So all that stuff in the documentation a quick introduction to it in the API reference that's listed here if you want to take a look and then associated with the visibility changes or the actual community image sharing themselves. So it's protected like I said it's protected by policy just like publicized image. So the default is that it's on so that any end user can create a community image.  So like I said it was a feature that had been asked for and we delivered. And the other big thing that happened in Okada was we made some things, so the first two are things that you can see in either the image response or the way you deal with the API. This last thing that we did was we made some changes to the API. So we've changed the way database migrations happen in glance. So previously we were using a technology called Sequel Alchemy Migrate and now we're using a technology called LEMBEC. And the reason we've made the change is it's going to allow us to do zero downtime database upgrades, which is nice for you. Now in the Okada release we've made the change to LEMBEC. We've rewritten the database migration scripts, but the zero downtime migrations are not supported, they're experimental because we don't, well what we're working on in Pyke is to get real time testing in the gate to make sure the upgrades work seamlessly. But we're pretty sure it works so encourage people to try it out. That's a link to the glass documentation that explains the database management. I guess the only thing that's visible not to users but to operators is that the identifiers for each migration has changed. So previously they were just a numeral, and now it's a combination of the release name and a numeral but that's all explained in the documentation. So please take a look. And like I was saying earlier if you find something ambiguous or something unclear, please put up a patch or let us know in some other way that there's something we could fix. Oh, this is me too. Okay, so I was going to get the good stuff we're going to be doing in Pyke. Well I just want to bring your attention to a couple of recent OSSNs that Glance has been involved in. So an OSSN is an open stack security note. So they always have really horrifying sounding titles but aren't always quite so bad. So 0065 users of Glance may be able to replace active image data. So just so that nobody freaks out, right? This is in a non-default configuration where show multiple locations is enabled. So it's not the default. But if you do use the show multiple location setting you should take a careful look at this OSSN. Now I do want to stress the check sum of the image can't be changed. So even if someone is able to use the exploit which is described in the OSSN, so you can read it there. Even if they swap out the data the check sum cannot be changed. So a consumer who's actually checking the check sum would detect it and know that there was a problem with the image. But consumers who aren't so careful could be fooled possibly. So anyway, so just want to bring that to your attention. And it's got a discussion and it's, yeah, anyway it's worth reading the security note just to be up on top of things. And the other one is we haven't, well, we're addressing this one in Pyke. So I do want to bring it to your attention as something that you should pay attention to. Basically there, so when you do an image create in Glance you can specify a UUID. And what will happen is that Glance will apply that UUID if it's not currently in use. But if it is being used it will reject the request and you have to either supply a new one or you just do probably most people just do the default image create and let Glance assign you a random UUID. But since you have the ability to do that, you can write here's how the attack would work. You would observe the set of public images that are some deployer has and note their UUIDs. And as I was saying earlier, there's an image life cycle with most clouds where somebody takes an image out of circulation. So if it's taken out of circulation by somebody deleting it, you still can't reuse that UUID because the way Glance works is we do soft deletes. So even though the image is deleted its UUID is still present in the images table and so since there's a constraint the database is going to reject it if you try to reuse it. But as people are using clouds images are created, images are deleted, tables get bigger and bigger and eventually people want to purge the database. And in fact Glance provides a tool called Glance Manage that allows you to conveniently purge the database. So what I'm saying is don't use that tool unless you know exactly what your situation is because if you do purge the database then those soft deleted UUIDs disappear and it's possible to reuse a UUID.  And you'd have to do that in a situation where you didn't notice that this dude was creating all these images and deleting them also. So anyway it's an actual attack it could happen not, I guess I shouldn't say it's not very likely because now that everybody knows how to do it you could give it a shot. But anyway the main point is don't use Glance Manage what we're going to do is fix this in Pyke and our proposal is this and I want to float this out there because we've thought of several ways to do this. I mean the whole point of having a database purge is that you eventually want to compress these tables because they'll just get bigger and bigger but at the same time we need to track all the UUIDs and so you can see these are competing constraints. So actually Erno came up with this idea so I should say this is Erno one of our Glance Core reviewers. What we're going to do is not modify the Glance Purge so that in the main images table any of the images that were public when they were deleted will not have their UUID removed. So they'll remain as soft deleted images and then that way it'll be impossible for somebody to reuse the UUID of a public image. We're thinking that'll be good because the percentage of public images is small relative to the total number of images in a cloud I believe that's my hypothesis. Oh, okay. Then private images. Okay. So that's a good data point. So anyway, what I'm going to do is are you on the operators list? Excellent. So what I'm going to do is we're going to propose this as a spec light in Glance and explain this in a little more detail and then I'm going to put a point I'm mentioning here. I'm going to put out a note to the operators list so please make sure you look at the spec and then give your comments because there are a lot of people that trim the database but won't expose them to this. Another thing we had let me just throw this out as long as we've got a few minutes. Another thing we had thought about was introducing a policy to restrict who can specify a UUID when an image is created because now it's available to anybody. So we didn't like that one quite so much because there are some use cases that I want to have the same UID but somebody who wanted to do that could loosen up the policy. But anyway, so let us know and we can have the discussion on the mailing list and on the patch for this because it's like I said I don't want to overemphasize this because I don't think it's a big problem at the moment but it could become a problem and we need to deal with it and we want to deal with it in a solid way. So thank you. You were going to talk about Pike, I think. Sure. I can just mention some of the developments that we have initiated in Pike and this one of the features image import refactor which has been long discussed across projects across with Glantz, DC, Nova and lots of different considerations in mind and we have come up with significantly detailed yet yet a good plan about refactoring the Glantz API for which is called UploadNow but a more sophisticated way of uploading image data so that it can actually be an import into your cloud. So if you wanted to support the hybrid cloud use case or if you wanted to use public cloud with different vendors which are not even open-stack you would need a sophisticated back-end mechanism to morph your image in a way that the cloud supports and the operator would be able to support you accordingly. So that's a short background on what the feature is and we have tried to prioritize this and reprioritize this over the cycles and finally the stars have called us to get that MVP done in Pyke and thanks to a good number of developers behind us we have a few patches up and then we are planning to implement that MVP API for uploading and activating the images not all the features that the import would support would be implemented in Pyke but you would get a flavor of what the new API would look like and this would give us some opportunity to basically get some real-time feedback with the operators in this cycle as well as to prioritize this in the next cycle as well. Yeah, the main difference between import and just the image upload is that the import will give the operator a chance to examine the image run tests, do whatever you want basically before it actually becomes active and is consumable by people and it's anyway you can read the spec and print it out it's probably 120 pages I'm not kidding it's got several FAQs because it got so long so we describe in great detail what the use cases are and how to do it you may have heard possibly even me speak about glance tasks so we had a first try at this six cycles ago maybe but the problem was that the API we came up with was extremely flexible which was great from the operator point was great from the point of view of some people and not great from the point of view of complete interoperability between clouds basically so that's why it's kind of complicated in one sense it's a simple thing that we want to accomplish in the other it's kind of complicated because what we've tried to do is take into account the competing demands of public clouds and private clouds of various sizes but come up with a unified API so that you'd be able to use this no matter what cloud you contacted even though the cloud didn't support all possible import methods so I think we've well we'll see if we've actually right that's I'm sorry that's the other the other key thing was it has to be discoverable so the other the other main problem with the task based import was that there's no way to discover really what the calls were except to read the documentation which apparently nobody likes to do so this way there'll be a call you can make that gives you the exactly what it is that you have to supply in order to successfully import there's a call that because for each of the clouds right doesn't make sense to allow somebody to import a disk that's too big to fit on any of your VMs right depending on what your configuration is so there and individual clouds may support some formats and not support others so we've taken all that into accounts all that information will be discoverable and then you'll be able to import stuff so I'm just I don't know I feel like I have to justify because it's like hey you just import you know just upload the image but it's you know a little bit more complicated anyway yeah I guess something for you in pike so I guess like a point to add that is we needed to have a feature parity for an important feature in version one of the API that's copy from URL and we don't support that in version two by default so this new API would with the discoverability would give you give the operators and the users leverage to identify if a particular site supports copy from if it's saved for them to support copy from and you know if if your dashboard or you know if your client needs to use that then that that feature would be there yeah and by the way I'm sorry to interrupt you with the OSSN there's an OSSN that's out about copy from so you might want to take a look at it just if you've exposed copy from to your customers there's some things you should take into account as you depends on how your clouds configured right like everything does so for a lot of people it's not a problem at all but for some people it might be a vulnerability so please keep an eye on the OSSNs this feature is a pretty detailed one and it's like a really giant beast so as an operator I would really recommend you guys to keep an eye out when this implemented and you'll see that release notice highlighted for your convenience as well okay you can talk about two other things we're trying to accomplish the community goals for Pyke so we I mean ordinarily we probably wouldn't put this up here but since we're having personal problems with Glantz we're sort of pulling back on what we can accomplish so the community goals were Python 3.5 support so again end users aren't going to see anything from this except that right it'll be nice for operators that you can actually use Glantz if you're running Python 3.5 it won't have to run 2.7 anymore and then the control plane and API endpoint deployment via whiskey we're just going to make sure that Glantz can be run as a whiskey application and the idea behind that is just that there are some servers that are very much optimized for this kind of thing so we might as well some people want to take advantage of that so it looked like for a while it wasn't going to go but Matt Trenish isn't here is he but we have a volunteer to pick this up so I think we're actually going to be able to get it done in Pyke too so something to look forward to okay alright and just the release themes for Pyke so scalability and resiliency I mean the feedback we've been getting is that Glantz is operating pretty well so we don't want to mess with it too much so it's not that we don't care about that stuff it's just focused right now so with interoperability that's the image import gives us a major focus there and then security is associated with image import also because it gives you a way to screen images before you let them loose and then with modularity since we're refactoring the image import process and then manageability I guess it's part of it too yeah I guess it's like a little bit of overlap with rolling upgrades to be able to manage images as well rolling upgrades will help with that can I get a comment on that sure I would kind of challenge that not a focus can I comment on that so thank you for pointing that out I was just about to say which I forgot that image import refactor that we're planning to implement it is user experience as an end goal but we want to do an MVP so that people so that it can be experimented so we won't be able to provide that by default but it would be still available for consumption and then we can evaluate it so that's why it's not a focus right away but yeah for sure in the future cycles that's show up purple eventually so in Queens what we're looking at is resiliency so we'll have the MVP of the image import in Pike and then continue to work on in Queens to make it better so same thing with manageability right completion of the rolling upgrades work modularity just will be doing more refactoring to make this stuff more solid interoperability will drop to a minor focus because we're hoping most of the user facing stuff will be done by then and then security is we never want to say security is not a focus so we'll be keeping an eye on that too as we're going through and okay and then in Queens so we're asked to project into Queens so this is our thoughts will be some further improvements to image import so that's not surprise and then we'll continue with the enhancements to rolling upgrades the major things we want to accomplish depending on the personal yes depending on right so if you want to make sure this stuff happens please recruit developers to help out glance and then with the themes for Rocky we're figuring by then you know just general growth and clouds will catch up with glance and so we better address scalability a bit but we're also we also have some ideas about image caching so but you know projecting out this far even though Rocky doesn't seem that far away is right depends on how things go right because if people are using more boot from volume stuff then maybe caching images is not such a big priority we'll see but right now it seems like there is some work that could be done on the glance image cache and then what do we have modularity would be a major focus because we'll be factoring stuff that we've done and then we've got user experience showing up in Rocky and I'm trying to remember yeah I mean we're asked to rank all these things and so to a certain extent I guess like the anticipation is like sorry to interrupt but I guess the anticipation is that imagine port would be mature enough that we would be able to provide a final product by Rocky and then say oh that's there you go okay and then one thing that's not listed here but I know is a concern from I do the we've been doing these operator surveys some of you may have seen them and maybe even filled them out somebody at the end we always ask like an open question any other comments you have and somebody every time has been putting you really need quotas in glance you need better quota handling in glance so that is so you may be aware there's a general quotas effort underway in open stack that was approved recently and I just want to yes so anyway so we will be joining the club of having good quotas but it's a matter of right person power as to when that's going to happen so it wasn't listed as a particular thing but I do think that's going to be something that's sort of in the atmosphere that we'll want to pull in at some point and it says that about time yeah okay and then we were I wasn't supposed to okay that says finish time is up so time is up so here are some questions but if you go to the next presentation you can actually do that so if you go to room 103 so just go downstairs how do you use glance we're asking that in two ways like how do you use glance but also how do you use glance so we want to get some feedback from operators about what you're doing and I'll explain some of the survey results we've had but there will also be some glance people available if you have particular questions about how you want to do something so thank you very much sorry we're like running over but thanks for attending anyway ping us in IRC or on you could tweet at us if you really feel like it or just send something in the mailing list if you have a question about glance or anything thank you