So here, can you do a quick demo of how it works? Sure. So let's just take this as an example. So basically what we do is we supply these application templates, which have all the necessary driver code and stuff to be able to program your application onto one of the development boards, STM32 development boards. So in this case, this is an application made for the STM32F769 discovery. And we just have two screens. So we have a screen one with a button and an image. And basically what the designer will do is generate screen definition code for you and some spots. We take this code with you, enter your favorite compiler, like ID or IEL, or IR. And for each of these images, the tools of TouchFX will do the conversion into some spots, pixel arrays with those particular image formats, those particular clips in your font that you're using for that particular size and the quality. And basically then what we'll do is just to add some life to this application is use something we call interactions. So for instance, this particular interaction will transfer control to a screen two using a slide transition from the east. And basically this screen will do the same thing for another button that has a text just going the other way. If we take a look at some of the code that's being generated by the designer, it's going in here. So this is something that's modified by the designer. So anything you write in here will just get overwritten.  We'll not get overwritten by the designer. So let's see what happens when we add this interaction. So this interaction was doing the screen transition, right? So what actually happens is the designer will generate callback. And we can recognize this from what we did in the designer, right? So it is going to screen two using a slide transition. And something else we've done is add a new interaction that calls a virtual function. It's called Fun. And this is something that you can implement as a developer to make the button call something in your back end, right? Make the button turn on an LED or whatever. Send something through a queue to another peripheral task or something else. So let's see this running in the simulator. So basically the design has nothing to do with target hardware. It's just a generator for screen definitions in C++ and a generator for C++ code for your image assets that you can place in external quad-spy memory. This will get moved by the Chromad chip to the framebuffer using hardware alpha blending. So here's the demo that we made, just a simple demo. And basically when we press this button, run target, what will happen then is that it will execute this particular command. So you can kind of hook into these commands and execute whatever you want. So in our case, for the application templates, what happens is that it will just call a make file that knows how to flash this particular bot because we know the quad-spy tip is on there. So if we just press run target, now it'll call make. It'll compile using RGC. It'll program the bot using SCLink with this particular flash loader for the STM3769 scurry. So let's just wait a bit. We can see, so while it's doing that, let's have a look at some of the codes that's being generated by the image converter. So what you can see here, for the one state of the button, it's just generating a huge sparse array of pixel data for this particular image format, these dimensions. So that's one of the states for the button. So it's still a program target code. So it's flashing the target right here? Yeah. This cable is a bit wonky, so sometimes it probably say it can't connect to target now. OK. So it's important to have a good cable. Yeah. And so is that the final step or? So what happens now is that, you can see, couldn't connect to target, I'll just do it again. So what happens now is that the designer and the image converter tools and the font converter tools have generated all the necessary C++ code for this particular application. Then you'll just take your other C++ code, put it into your IR card project, and then you'll start your operating system task, maybe three hours, and start your scheduler. And then some external signal will trigger the hardware abstraction layer and charge effects, and we'll take the application and keep it running, then render some of these screens to the frame buffer, which will then get clocked out by the LCD controller to the screen. Yeah. This is the easiest way to do advanced UIs. Yeah. So now it's done flashing, and we can see the application we made. So it's pretty fast to get started with prototyping if you have one of these development boards, because you can just select these templates, and they're guaranteed to work. You can also, if you want, since 5.0 of Kube Max, you can now select this is graphics framework. This is choosing the board selector here. Then you can just, what happens then if you generate your project over here, generate your code. What happens is that you'll get a trust effects project here, so you might recognize the structure from Kube firmware pack applications and demos. And what's new is that you'll get this folder here, the charge effects folder, which is the same structure as usual. And you'll have some target specific code here, charge controller implementation for this particular screen, DMA health support for GSI. And all this stuff will then get imported into this particular IR project in this case, but so we're constantly adding support or improving support with Kube Max. So the integration is kind of ongoing, but we are working constantly with the Kube Max team to improve integration.


Yn dweud hyn bwysig yn ei wneud yn ei gynnig i'w gwn i eich saint, a'r ddweud hynno'n mynd o ddweud ond o'r ddweud wedi bod i'w gwaith yn y ddeithas. Dwi'n gael bod dwi'n eich ddweud yn ôl. Felly ond, fynd i gael ddim i'n gael ddiweddau. Nid ydym ni'n dod. Mae oedden nhw yn 1996. Mae'r ddeithasio eich dyma i rhaid, rhaid i chi i'w ddweud, Ond ydych ddweud yn gwestiwch mewn y gwaith. Ydych yn gwestiwch, a rydyn ni'n mwyaf rhai a'r cyflodd cyd-dweud. Ac oed lead o'r ddeud. Yw bitio sy'n arsig pethau'r gyfa swydd. Ond rydyn ni'n i'n ymdinelliaeth. Nŵr ddim. Rydyn nhw o'n ddweud hynny. Rhaid i'n ceisio'r rhaid i hynnyddiadu hynny? Rydyn ni wedi rhoi i leddu, Mae'r hyflwr yn oed i'n leddu i leddu, o'r hyflwr o'r hyflwr o oedon hynny. Os y gallwn gyffredigol a'r wych gilydd, gan gyflwr, gan gyddoedd gymryd ddweud o'r hyflwr o'i leddu i leddu, yn gyd? Rydyn ni'n meddwl i hynny erbyn, Mae'r dda'i gweithio bobl ondyn ni'n ffordd mewn i Ysgol, ond mae'n dweud i mewn sgwylech i ysgol. Mae brindio ddwy'r ddweud i yn Ihe allan lle si'n mwy deisugio. Mae'r ddweud i wedi'i ddde i'r Gwlad. Mae'n dweud i'n ddweud i'n llawer i am y ddeifadau? Ie ffordd flydd yn y lle am y ddech chi ysgol? Mae y dda i amser yn ei dda i'r ddweud i'r ddechis. If you haven't heard of the bar I'm getting in any trouble, you haven't heard of them doing anything off the field. You know, we've had this for years where people's egos or how they're seen is like, I didn't know about them.  You did say that about Ryan gigs and the other stuff came out of them. But was Ryan gigs any worse than what Mr Smith down the street might have done? Do you know what I mean? It was a bad thing, but it was a bad thing because it was Ryan gigs.  And that's what I'm saying, football, we used to be like, people are the things they used to do in the past.  And then it's like, now it's like, the standards are just so high for them. They will be because they're in the public eye and celebrity is more than you should be. That's what you've got to remember is that. They were still celebrities in the 80s, but they were the same thing in the 90s. The Premier League changed the way we look at football. I totally agree, I'm not lying. You get paid a massive amount of money. You've got to have standards, but it just makes me laugh that. Shaving people, and it's the same, it's like this weird outrage.  That's the end, you'll go now. Oh, why have you done that? And it's like, because he's the manatee. If he wants to take them off, he can take them off. Doesn't need a reason, he's the manatee.  Oh, and it's like, get rid of them.  Darren Gibson drove his car into a petrol station while bladded, and we didn't sack him. People wanted to do that. But what I mean is, it's always like, if that wasn't a reason to sack him, or in terms of his contract, he must have had a good contract, it's just all, that's like to me, he could have blew after bleeding town up. No, I know it. It's hard to... It's hard to quantify isn't it? The question is, is he any waste in football years ago? The answer to that is no. We've probably got a lot more money than footballers years ago. But they did equally mad things, and all we have. Because at the end of the day, we tend to think of football as not human beings. That's what we think. We think of football as robots, said this to Sylvan, and the other day when he was talking about things like the online abuse, is that, and as fans we turn up on a Saturday, we expect a perfect performance every time from them. We expect them to be 100% fit when we see them. Off the pitch, we expect them to be these superstar human beings. The reality is, the lads are very good at just the sport kicking a ball around. They get very, very well paid for it. The top players get ridiculously well paid for it. And they will make mistakes. A lot don't make mistakes. A lot of them. Have you ever heard Phil Jagielcher doing anything? It was a fella, he was 36. I know he split up with his wife and he had an Instagram jail in the end. But in general, apart from that, that's his private life to do with anyone else. He didn't really do anything. He's 36, 37. Sylvan Distan, whatever milk he was delivering that week, he was still a footballer he played for all those years in the game. He wasn't called out in town fighting or didn't do this or didn't do that. But do you think that story came out? What's Sylvan Distan know? Was because he was trying to not put the spotlight on him that he was a footballer. I know, I'm just saying.   And get on with it. But there's young lads who've got a lot of money and therefore you're right when there's a story, there's a story. Keynes being the reason why this, in my opinion, has got so much outrage to see with this because he's gone against the National guidelines which are socially isolated, don't have these parties. The thing is there was, and again I'm not condoning it, but there was what six people maximum and I think three of them lived there, so it was three acts of girls. Who said you can't drink? You can drink behind closed doors if you want to, just everyone else's. So why can't they have a baby? So it was the fact that he had girls. If he'd have come out and gone, we all lived together and have been socially isolated for six weeks together. There's no story. The fact is these girls have come over according to the story and they've had a drunk fuelled party. Well, he can have a party all he wants in his house with the dossiers. The fact is it's because it's the time of lockdown, that's why it's made the headline. And it is what it is, but there's no worse a guest in place. In fact, some George Best was all over the place. The stories if you go back and look at what's gone on. There's loads, there's absolutely loads. I remember Gaza saying he was caught man of the mat against Southampton, he was bladded, out of his mind, didn't remember it.


At road construction jobs like the one behind me on US 23 in Pike County, contractors are used to people occasionally knocking over a barrel or even stealing a sign from time to time. But Monday morning's vandalism near the Penny Road intersection was much more severe. They had stolen, we believe, 10 traffic control signs that tells traffic where to go as they approach the job from both sides. In addition to knocking every barrel that we had on the roadway out of place, so essentially the traffic didn't know which way to go and had nothing to channelize them to get through the work zone. Officials at Mountain Enterprises who is doing this work on US 23 say they are taking Monday morning's vandalism very seriously. We believe it was deliberately vandalized because if you're traveling through a roadway you're traveling one direction so if you hit a few barrels in one direction that's probably mischief. But the fact that it was both sides, the entire job, and signs on both sides of the job. It's approximately 2.2 miles in one direction so if you reach out of the road that's about four and a half miles. What we suspect it was a pickup truck somewhere in the neighborhood of 3 a.m. between 2.30 and 3.30 a.m. and it should have spent some time on this section of roadway in both south by northbound directions. Officials at Mountain Enterprises say they are concerned with the monetary damage in this case which is up in the thousands but they say the real reason they contacted the Kentucky State Police in this particular case is because of what could have happened. It's not just inconvenience for us, it also could have had very serious consequences. If you have any information please contact the State Police with just a partial vehicle description or license plate any county information should help.


It kind of reminded me of this time I was living in LA and I was arguing with my Salvadoran co-workers about Manny Pacquiao.  I was like, uh, uh, how does that work? He's Asian. And they're like, nah, nah, see? See? His name is Manny, and he's Catholic.  That's where they look at me dead in the high and go, hey, exactly fool, where do you think they got the Eno from? Yeah, you know what? You won this battle, but you didn't win the war, man. Let me get my Filipinos back.


Seriously, thank you. Thank you all for coming. Specifically, I'm going to talk about writing Elixir in Elixir. It's a meta-programming talk. Cool. So fact is, and actually some of you got a preview of this in Lauren's talk just a bit ago, a large portion of the Elixir programming language is actually implemented in the Elixir programming language. And that is super interesting. It's super meta, right? Whenever we make bold statements like that, the first thing that comes to my mind, you're curious people, it probably comes to your mind, too, is how much, right? That's great, Jay, ha-ha, it's a lot. But how much is a lot, right? I've got an answer for you. It depends. Doesn't it always? So what does it depend on? We need to figure out how we define Elixir, right? We could just take the code base and look at it, but there's a lot of other things in the code base that maybe isn't the language, the tests in particular. So here's how I defined it for an example. Take the basics of the language, the structural elements of the language, and add in standard library. The idea is basically anything that you're going to touch and play with when you write an Elixir program, we're gonna call that Elixir. So I did some highly scientific analysis using the linguist tool provided by GitHub, came up with 78%. Wow, it's a number. 78% of Elixir is written in Elixir. Pretty interesting. I actually got this number by basically deleting everything that wasn't the Elixir source implemented in Erlang and then the standard library, which is written in Elixir. You might compare that to similar values if you look at Ruby. So I came up with 44%. It's like, oh cool, another number. That number's smaller. I must like Elixir better. That's impressive, but I don't know. Numbers, they're sort of inherently faulty. Ruby is MRI, at least, is implemented in C. C is noisy. There's a lot more characters. You're gonna use more code, so it depends on how these tools work to come up with those numbers. And it's sort of the same story in Elixir, right? The portions of Elixir that are written in Erlang, or in Erlang in Erlang maybe is more noisy in some way than Elixir. So I don't know. The numbers aren't terribly impressive to me. What is really impressive to me is when you write Elixir, you use all of these different constructs and pieces, and almost every single one of them that we interact with is implemented in terms of Elixir. Examples, if, it's a macro. I think a lot of people are familiar with this. The if control flow operator that we use, maybe we use it less than Elixir because we have pattern matching, but it's a thing. It's implemented as a macro in Elixir. So you can go look up the source code in Elixir to see how if is implemented. Pretty interesting. The same thing for def. So function definitions, module definitions, macro definitions, all these things are implemented with a macro called def something, or just def, and def itself is a macro that's used to define these things. And even operators like the pipe operator is implemented in Elixir as a macro. And a lot of the operators in Elixir are implemented as macros. So it's really neat to think about how much of the language that we interact with is actually implemented in terms of Elixir itself. It makes it really easy for us to learn about the language because we can go read the source code and instead of having to know C or know Erlang or whatever it's gonna be to read the implementation of the language, we just know Elixir, which is what we're writing. So we probably know Elixir already. So how does this happen? Metaprogramming, wow. Yeah, metaprogramming in Elixir kind of just boils down to code generation, which is sort of simple. It's not all that complicated. In other languages like Ruby, we get into a lot more complicated subjects like runtime, message dispatch and stuff. In Elixir, we're generating code.  So let's pause for a second. Let me introduce myself. My name is Jay Hayes. You can find me on the internet, set I am very, I am inside your computer, just go to that and it's me. I come from northwest Alabama, the Shoals and turns out we bottle the stuff there. So this is the, yeah, the big factory where Elixir is produced. That's an old logo, but yeah, pretty cool. Fun fact, Alabama. Woo, I work for Big Nerd Ranch. Actually work remotely. I'm a full-time remote employee for Big Nerd Ranch. It's in Atlanta. We do development, so we'll build programs for you. As a consulting company, you come, we'll develop first-class solutions to your problems. We also teach. We'll come to your company and teach on-site as well as we have open enrollment classes where you can come to us and we'll learn for a week together off in the woods somewhere and it's not scary at all. And then finally, we write books. Pretty well-known programming books. It's been really fun interacting with people throughout this week and finding out that you learn how to do maybe iOS development or something from our programming books. We just released a front-end programming book which is really, really good. You should check it out. So when I found out that I was speaking at ElixirConf, I told my wife. I was really excited because I haven't done a lot of speaking and I consider it an honor to be here. So I went to her and I was like, honey, honey, this is fantastic. I'm speaking at ElixirConf and she responded much less enthusiastic. Oh, that's nice. Where is it? I'm like, come on. So she kind of settled me down a little bit. I was like, it's in Orlando. And then she perked up like, oh wait, that's where Disney is. Can we go to Disney while we're there? And I was like, well, at least she's excited. Yeah, actually it's at Disney. So we can totally go. And she's like, oh my gosh, you're speaking at Disney? I'm like, well, I mean, sure. Yeah, if that's what you want to think. Yeah, that sounds great. And she interrupts me, gets on the phone with her friend. Yeah, yeah, he's speaking at Disney. We're going to Disney and I've already lost her. So here we are at Disney and she's really excited. Her and our eight month old son, Liam, came down for the trip. We had a lot of fun. One of the things that I didn't necessarily expect is Liam was absolutely enthralled with the Disney princesses. Like he would be fussy and wiggly in line and then he would see a princess and she's like, wow, she's beautiful. And so he got a little closer to them than, maybe I would have liked an eight month old. Anyway, metaprogramming, right? So a lot of people think metaprogramming is a really, really scary thing. I don't know, in Elixir, that is sort of dispelled a bit. The metaprogramming model in Elixir, it makes it somewhat simpler. You know, I referenced Ruby and there's a lot of different styles of metaprogramming there. Maybe it's simplified a little bit in Elixir. You'll be the judge after you see this. So to talk about metaprogramming, let's talk about what it really is. It's just programming, right? And what's programming? Programming is performing some work on some data. Well, what's data? I like defining things, cool. Data is quantities that we perform operations on. So when we're metaprogramming, we're performing operations on data just like when we're programming regularly, yeah? So let's look at a really simple program. Four plus two. Most of us understand what that means. Where's the data? The data is the integers in the plus operation, four and two. So we could rearrange this. Looks more like a function. We have the plus function now with the arguments four and two. Still doing the same thing. The data's still there. And it turns out this is really exactly how the plus operator is defined in Elixir. They just give us some syntactic sugar so that we don't have to write it. As a function call, we can use that infix notation. So in metaprogramming, the program itself is the data. That's the definition of metaprogramming. Instead of us operating on basic data types, actually operating on a program as data, doing something with it, maybe transforming it in some way or generating a new program. And really the main mechanism for doing this in Elixir is macros. Here's the thing. Macros are everywhere in your Elixir code. And the reason that you may not know that is really good macros are pretty much invisible. You don't even realize you're using them. They feel like an extension of the language. And oftentimes they're used to extend the language. So here's an example. This is a test, a test written in EX unit. Probably looks somewhat familiar. So let's find the macros. Literally every single line of code in this file is a macro. Def module is a macro. Use is a macro. Test is a macro. Assert is a macro. So the question comes up, where's the program, right? Well, for def module, the data that you're performing some operation on is everything after def module. This is actually the arguments to the def module macro. For use, it's the module ex unit case. For test, it's the description and the definition of the test. And then finally for assert, it's some statement that we're asserting truthiness about. So macros kind of do this. They take an expression. That expression is piped through the body of the macro, the definition of it. And then they produce some new expression. It's code generation, right? Let's define expression. Let's make sure we're all on the same page. An expression is what we're gonna call quoted elixir code. The general form for quoted elixir code is this. And we'll get to a little more details about it. But in general, it's a three element tuple. The first element is the function that that particular piece of code uses. And the last element is the argument list. So with this combining these together, you can produce an abstract syntax tree. Many of you I'm sure are familiar with the idea of abstract syntax trees. They're very common structures used in many languages. In a visual form, they might look like this. The cool thing about syntax trees is they capture precedents within them. So in order to execute this syntax tree, you have to first determine what the result of the subtraction operation is, and then use that result with addition. So it sort of supersedes the traditional order of operations because there's precedents built into it. If we walk the tree, then we produce something like this. And this is like prefix notation, which maybe some of you are familiar with it. We'd often don't have to worry about it. But in this case, of course, the functions are the operators and the arguments are the data. If we throw in parentheses, it looks a little more familiar. At least we understand the precedents there. The two and the three subtraction must happen before it's added to one. But rearranged in infix notation, this is something we're a little more familiar with. So that's abstract syntax trees. The thing is, macros and elixir, the arguments to the macros are implicitly quoted. So those quoted expressions are produced implicitly for whatever arguments you provide to the macro. Let's see an example. So say we have a module named expression that implements a function or a macro in this case, matchA. And what it does is it returns true or false based on whether the argument, the expression given to that macro is a match operation. So you'll notice that the top, that's not a match, that's greater than, so it returns false. And the second one, it is a match, so it returns true. Now, some of you might think, hey, there's an error there, right? The atom law does not equal the atom what? That doesn't match, so you would get a match error. The answer is no, that's not an error because that expression is never evaluated. We're just looking at the syntax tree that that expression produces from the macro and determining whether it's a match or not.  So how would we implement this macro? We might do it like this. So we can use pattern matching on the arguments to that macro to determine whether the function used in that expression is a match operation or not. So if it is, we can pattern match it, it's true. And if it's not, if it's anything else, we don't really care what it is. Well, then it's not a match, so we get back false, right? So again, using it looks like this, but the neat thing about Elixir is an important detail about how macros work is macros are evaluated at compile time. So when your programs are compiled, every macro becomes the expression that it produces. So the macros that we define produce the literal booleans true or false, depending on what expression was given to it. So at compile time, as far as the VM is concerned, it's looking at literal values, false and literal values true. So the next thing about macros is they must return a quoted expression. So remember, macros just accept expressions as arguments and produce expressions as results. They're just generating code. They're producing something from something, right? So we need to return a quoted expression. Here's a macro. It is a macro that produces an expression that's a bad match. It's the same bad match we saw used in the previous example. But here we've hand coded the literal AST for the atom law, matching the atom what. Now, it's hard to read that, I would say. It's kind of hard to glance at that and realize that that's an AST for a bad match. So Elixir provides this quote macro that produces those syntax trees from some Elixir code so that we don't have to write those by hand. As you can imagine, if it got any more complex than that, the syntax tree that we would have to write by hand would be really difficult to produce. So I'll talk a little bit more about the quote macro in a moment, but in general you can make this a little more readable by using it here. But the point is, if we were to use bad match anywhere in our program, we would get a match error at the point that it was referenced. And that's because when your program is compiled, that call to the bad match macro becomes literally this expression, which is a bad match. It will fail, it will raise a match error. So let's talk about quote. I've been promising some discussion of that for a few minutes now. In review, and giving you a little more information, the quote macro produces three element tuples. They're composed together to make arbitrarily complex expressions of Elixir code. The first element is a function that's being called by that expression. The second element is some metadata. So metadata is things like maybe the module that that function's defined on, maybe other modules that need to be imported in order to, for code that's referenced within it, things like that. Oftentimes we're not too worried about the metadata, but it's useful to know what's there. And then the last element is of course an argument list. It's the list of arguments that are being provided to that function when it's called. It also may be additional quoted expressions nested within. That's how the precedence is expressed. So here's that same bad match, right? That's the one that we saw in a couple slides back as a quoted expression. The function is of course the match operator and the arguments are lull and what as atoms. And that's produced by using quote. So we know this, we've seen this. So the thing about quote, this was really hard for me to grasp. So I'm hoping, I'm hoping that I do a good job here and I can convey this and it will be clear to everyone. Quote is, you can kind of think about it like strings. And that seems weird because it's not strings so don't think too much into that. But the point is in other languages, sometimes we put programs in quotes, right? In Ruby for example, you might have a program that's in quotes, it's a string, you're storing your program in a string and then you for evaluation later, right? So that's kind of what we're doing in Elixir. We're putting our program in quotes, we're quoting it to produce an expression to be evaluated later. So this example is actually just the one line version, some Elixir syntactic sugar lets us write it in multi-line if we wanna drop the parentheses and do that. It's the same thing. But that's kind of what we're doing with the quote macro in Elixir. So quote just returns an abstract syntax tree of the expression that's being quoted and it can be arbitrarily complex and as you can imagine the expressions that are produced become quite complex. We take a simple example like this, we have two minus three and we quote that, then we get an expression that looks like this and this is maybe what you expect from what you've seen so far. The neat thing is if we fade out some of that Elixir data syntax, you kinda see the infix notation buried in there. So the infix notation for that expression is right there in the Elixir code. If we were to quote a more complex Elixir program, then we get a decidedly more complex abstract syntax tree but it's still neat. That infix notation is still embedded in there. It's sort of inherently part of the data structure that Elixir uses to express programs as Elixir data. So what's the point of quote? In my opinion it makes it easier to grok these complex syntax trees that you're dealing with when producing metaprograms when you're producing the expressions for macros and stuff. It's a lot easier to see on the top that we're producing a syntax tree for a couple math operations than it is on the bottom. On the bottom it's like, I don't know, the numbers and like a smiley face that's eyes are above its mustache. I don't know, it's something weird. Before we stop talking about quotes I do wanna mention that there are a number of values in Elixir that are considered literals, meaning that when you quote them, they just return themselves. They kind of act as terminal values for like the recursive nature of quoting. If you quote an expression, it's gonna quote all the nested calls all the way down until it eventually gets to some fundamentals that it can't unquote, they're just the same thing. So these values just return themselves. Things like strings, atoms, numbers, both integers and floating point numbers, lists of anything that returns itself. And in particular, I found this interesting, the two element tuple is also a literal that returns itself and the reason for it, I confirmed it with Jose, so you can quote me on this, ha. It's because it's a support structure for keywordless in Elixir. So they want keywordless to also be a literal that when quoted returns itself. So in order to pull that off, the two element tuple in particular is one that returns itself when quoted. Interestingly, other sized tuples actually return the quoted three element tuple with a function and arguments and stuff, so you can see that you can play with it. Cool, let's talk about unquote. So quoting expressions is great. You can produce syntax trees for Elixir code, but what if we wanna like inject values into those trees as they're being produced? That's what unquote's for. So when you use unquote, what you're doing is you're injecting a value into a quoted expression. Now, remember how I said quote is kinda like strings? Like, don't think about it too much, but it's kinda like strings? Well, unquote's kinda like string interpolation. And it's actually, I think in the documentation, it makes a reference to this and when I read it, I was like what, what, that doesn't make sense. And it does, it just takes a second. So again, I hope I'm able to communicate this in a way that does it justice. So let's talk about string interpolation. String interpolation is injecting a value into a quoted string. So if we have an example, the string su, we bind it to the variable name with the match operator, then we, in the next line, we produce a new string called high name. Now, we wouldn't expect the value stored in name to be inserted into our string in this example, right? Because name is quoted, it's in quotes. It's part of the quote. It's not making reference to anything outside. It's being quoted. So in order to do that, we use string interpolation. That's fun. And the way I like to think about string interpolation is we open the quotes to say, hey, Elixir, we're starting to quote a thing. And we start typing, hi, and then we say, oh wait, temporarily pause the mechanism for quoting and let me reference something outside this quote for a moment. And we say, go get name or add two numbers together or do anything. Anything outside the context of this quoting until I close that unquoting, or until I tell it, you may resume quoting, essentially. And we do that with string interpolation to access things outside the string. And so as you would expect, the string that's produced now says hi, sue, taking into account the name that's in scope there. So with unquote, we do the exact same thing with expressions. We're injecting a value into a quoted expression. So let's say we have the number 42. It's a good number. We bind it to the variable name and we then produce a new quoted expression that adds one to that variable num. I said name a moment ago, forgive me. So num. Now, the syntax highlighting doesn't really do us any favors here. It kind of looks like we're referencing the variable but we're not. What we're doing is saying, produce me a quoted expression for the elixir code adding one to a variable num. And that's exactly what it produces. You can see in the output code, we get the plus operator with the arguments one and then some variable num. But that's not what we wanted. What we're wanting is to produce the expression for one added to the value stored in the variable num outside of the quote. And to do that, we use unquote. It temporarily pauses the quoting mechanism of elixir, says go find me something outside of this quote, evaluate it and inject it into the expression and that's what it does. It produces the quoted expression one plus whatever value was stored in num and that thing could be more complex than that. It may not just be a variable, it may be another quoted expression, right? So you can kind of see how, hopefully, how unquote is a lot like string interpolation. Okay, I have now armed us all with the insane power needed to produce a macro. So let's implement one that maybe we're pretty familiar with. I was wanting, when I was working on this talk, I was wanting to come up with something crazy and like just have a lot of fun and I thought, you know what? Why don't we just stick with something we know? Maybe some of you even know how to implement the if macro in elixir. But I feel like it's a concept that we kind of all have a good grasp on. It's fairly well understood. For those that don't understand or need a refresher, here it is. So we can say if we give it a condition that needs to be a truthy value or it doesn't need to be, it could be a truthy value. When it is, it evaluates, or it executes a true case that's given to it. So it would say pass if it was a truthy value. Otherwise it's a falsely value and it would say fail. So there's a lot of syntactic sugar that is happening here. So we could rearrange that and realize, oh, actually, if is just a function. It's a macro in this case, but a macro is just a function. And it might look something like this. And if we take away a little more of the sugar, you'll realize that it's just a function that takes two arguments. The first argument is the condition. And the second argument is a keyword list that captures the true case and the false case. So the condition is the first argument and the second argument is the cases. Let's talk about truthiness and falseness. It's just in case you're not aware of that. So in elixir, the if macro kind of captures that idea. Without if, we would be stuck writing maybe complex case statements or something to determine if something is not literally true, but kind of like true or kind of like false. So the if macro sort of encapsulates that idea for us. So falsely in elixir is the literal false or nil. So it's kind of nice not to have to check for false or is it nil? We just say if, right, or unless. Truthy is anything else. So it's a lot like Ruby in that way. If you're familiar with Ruby, true is anything but false and nil. And elixir is the same way. So with that, we can imagine writing a case statement that our if macro would act a lot like. The condition would be the condition of the case statement. And then the cases would be the two things that execute. If the value that comes out of the condition is false or nil, then it's the false case. Otherwise, it's the truth case. So that's really all we need to write the macro. And I'm sorry, there's a lot of code on the slide, but we'll step through it. It's relatively simple. We start off with the first argument to if being the condition. And the second argument is that keyword list where we get the true case and the false case. And then we build the expression for a case statement. We unquote the condition. So we inject that condition into the case statement. And we inject the cases into the case statement that are executed for either true or false. And so the result of using this macro is we would actually use it like this. It would look just like we saw earlier where you have those conditions and cases in there. When your program is compiled, it would literally produce a case statement. But we don't have to write this. And it's very nice that we don't have to remember to define falsiness for our cases in this particular case. The macro does that for us. It sort of encapsulates that responsibility. And so there, again, are the case and the condition in that case statement. So, one question that comes up pretty frequently and it's an important one to answer and I certainly don't have all the answers but I've got some guidelines that I've been thinking about is when should we use macros? I'm gonna shamelessly steal my first point from the Elixir Meta-Programming book which you should all read because it's really, really good. And that's just don't. Just don't use macros because they're really complicated. Especially if you're using them when you shouldn't and that's the point. If you can write a regular function to do what you're wanting to do, write a regular function. So here's a bad example. We define a macro add and in order to add two numbers together we produce the quoted expression for adding those two numbers together. Now in order to understand this you have to know okay A and B are going to be quoted because that happens implicitly in a macro and then we're producing a new expression for adding those two things to get whatever. Just do this, do that, right? That's much simpler to understand. So the point is those implementations like that are just a lot more direct and there's no reason to add indirection to your code if you don't have to. You're also much less prone to making errors. Dealing with quoted expressions can be really complicated and so if you don't have to do it, don't do it. So you should be excited about macros, they're really useful but that doesn't mean you use them everywhere, that's the point. Another one that I stumbled upon that I thought was pretty interesting was constants and this is kind of a duh to me now but I honestly did not think about it before this talk. So macros become the code that they produce at compile time so it's a really nice way to be able to name a thing and reference it by name but when it's compiled and executed you don't have any overhead for function calls. That's great, that just makes sense to me. So I thought that's a good use case. DSLs are another use case. I'm gonna go ahead and steal this example from the Elixir Meta-Programming book as well. So Chris talks about how you could produce a DSL for generating HTML code. So this is valid Elixir syntax but you could write a collection of macros, a family of macros that when used together like this would produce the expected HTML code and Phoenix also establishes DSLs. That's a pretty common thing with macros. Like in Phoenix the routes file is a big DSL for generating function heads for each route to be matched. So macros can also be really good for hiding details. This one's interesting. So take this example. You may be familiar with the EX unit library. So in EX unit a lot of stuff happens when you define a test and you probably don't care.  I just want my tests to run and get out of my way because I'm trying to figure out how to write a program and I'm already writing tests and trying to convince people that that's a good thing. So what's actually happening here? I won't go into all the details but a lot. So when you define, when you call tests, the test macro, when you use that in EX unit, it actually defines a function that's named the same thing as your description and then it adds that function to an accumulating module attribute that's being built up throughout the definition of all your tests and then eventually all the tests are defined and it shuffles that up so that you get some random order to them and runs your tests and that's really interesting that you just don't have to worry about it. We don't have to care that that happens. So macros can be a really good way of sort of guarding your users from that complexity that they just don't need to know about. So macros are also used to reduce boilerplate and that's kind of the same thing as the last thing but I had a really funny example so I wanted to share it with you. Language extension, that's kind of fundamental, right? Everything I've talked about is talking about language extension, ifs and unlesses and Chris implements while in his book and that's really cool. So consider this. We have def module, the module's law what defines a function law returns an atom what and that thing too fancy here but you decide, you know what, metaprogramming is too much magic. I don't want it, I don't want to deal with macros. I want to do it all by hand. I'll say, okay, you like pain, that's cool. Just go ahead and jot this down real quick. You're gonna have to figure out what the quoted expression is for defining that function but that's fine. You can compile, paste this into your IEX and I promise you it will produce a law what module that you can use. One problem though, the Dunder ENV thing there, that's not a variable, I'm sorry, that's a macro. So we can't actually use that because you said you didn't want macros so you can just write this down real quick. Just take a quick note, stick that in your E. It works great, I promise. Literally that is how you define, if you were to expand all the macros, that's what you would get for defining that module. So I tweeted a couple weeks ago it's like 50 characters to define that module but if we don't use macros, we would be typing, it's close to 2,600 characters there so that's pretty cool. And all that's of course because really good macros are invisible and you should write really good macros. So I blogged about this. I've actually heard a lot of people been very nice about the blog. They said that they've read about it. Hopefully you enjoyed the talk and got something out of it as well. You can find me on the internet at IamBerry. I have swag and stuff up here if you want some big nerd ranch swag. You can look like this. But anybody have any questions or anything? We've got plenty of time, I kept it short. Oh, nice, good, good. Hi, well I've used macros before. I've struggled to figure out what they represent in elixir code, like that compiled form in the like kind of Lispy expression, they can get that. Actually can I wanna see what would that look like had I written it in elixir? Does that make sense? Like debugging the macro to what that expands to that can't be difficult. Oh yeah, there's a really great blog post out there. If I'm understanding your question correctly, I believe what you're asking is, sometimes I'm curious, what is being produced by this macro? What's the code? So there's a couple options. Yeah, if I wanted to know what that case looked like. It's like if I just explored it doesn't say case. Yes, yes, okay, so a couple of things. One, check out the macro module. There's an expand function, maybe a macro, who knows, everything's a macro, right? It's defined on the macro module. If you use that with a macro, it will expand one depth into your call and produce the next syntax tree. So that's a good one. But there's another one if you want it to recursively expand all the macros, which is how I got that ridiculous mess on the screen. There's a blog post, I'm so sorry, I don't know who it's written by. He's probably here, hey, if you're here, sorry. But he writes about macro expansion and he has a little tool called MEX, M-E-X stands for macro expansion. And you can just type MEX and then give it a block and inside that call a macro and it will just print to the screen the fully expanded form of that. It's a really great tool for debugging, like just that kind of stuff. No, no, no, it's not, the syntax tree. So, okay, another thing. Macro, on the macro module, there's a two string function. So if you give the two string function a syntax tree, it will show you what the elixir code is for that, yeah. So the macro module, there's a lot of good stuff there. There's also good stuff on the code module. So there's on the code module, there's an eval quoted function that will actually execute the quoted form of the elixir stuff as code, like write it whenever you call it. Yeah. So the abstract syntax tree in elixir is very lispy, schemy. Is that true in Erlang as well? Yeah. I don't know Erlang. I don't even know if Erlang has macros. Somebody told me earlier that it didn't and I was surprised, but oh wait, there's everybody knows this. Oh, okay, okay. So this gentleman says Erlang macros are like string macro, or C macros are just string substitution, but we've got another one here. Oh, this is an Erlang guy, I just saw him. So Erlang macros are like C macros, but there's another feature called parse transforms that act more like elixir macros, but they're much more complicated and painful use. Gotcha, okay. Yeah, elixir. Any more? Yeah, here's one. So going back to your metaphor about quoting expressions as like quoting a string. Right. I think the thing that you talked the least about in that analogy is like in Ruby, you could take that string and run it through eval and actually like generate something and you sort of hinted at being able to do something like that in elixir. So like take an AST and then like, I don't know, export it somewhere else so that someone can then evaluate it and run it. Could you talk maybe a little bit more about that? Yeah, so I understand the question correctly. You're asking if I have an AST that I've stored somewhere, how can I eval that? Like I would eval a Ruby programming a string. So on the code module, there is a function eval quoted and it does exactly that. The second argument to that function is the binding. So that's the sort of the scope, sort of the same terminology in Ruby we have for Ruby binding. So you need to tell it like what variables are, here are the values for the variables referenced in that quoted expression and you could pass your current binding and say just use my scope, right? Does that make sense? Cool, anybody else? Oh, go ahead, what? Yeah, I think you could do that dynamically. I don't know what the use case would be. So the point or the question I guess is could you do all that stuff dynamically? I don't see why not. I haven't necessarily seen it but it seems feasible. There's also an apply function in elixir where you can dynamically make function calls at run time and so that's another kind of dynamic thing. As a matter of fact, that's what X unit uses to execute the test. So it's building up a list of test names when the tests are defined and at the end when all the tests are defined it just goes through that list and applies each of those function names to whatever the module is to execute that test. Yeah, back here? Yeah, you mentioned that when you use quote the macros are compiled. So when you use unquote to kind of break up and make a little more dynamic does that mean it's done at run time instead or is it kind of done in like pieces? Is some of it pre-compiled and some of it's run time? I'm not sure I understand the question. When you're using quote for a macro that gets compiled before run time, right? It gets compiled or it's, yeah, it's compiled, yes. It's compiled, so if you're using unquote does that still pre-compile the pieces that it can and then leave that unquoted part for run time? No, so when you call unquote whatever, so unquote it may be a macro but that expression that you give to unquote is evaluated at the call time and produces something to insert into the syntax tree. So it's not like you have a piece of code that it waits to evaluate until run time. It is evaluated at compile time also. And you would not give unquote a quoted form of an expression. You would give it an actual Ruby expression that it does its thing with, if that makes sense. Here we go, hey, Michael. Hey, good talk. Thank you. When I've been trying to wrap my head around macros I ran into something in a macro module called macro.escape and I have not been able to wrap my head around that. I was hoping you had looked at it and could explain what the heck it's for. Could you, do you have any point of reference for me?  But like, if anyone knows then please. Because I've stared at this and it's made me cry. It's like, it almost sounds like either quoting or unquoting. I can't get my head in the matrix enough to figure out which way it goes right now. But it takes an expression and then seems to escape it. So looking, I think of quotes the way you think of like with string interpolation. It's kind of like putting escapes on something in a string but I can't figure out when it would get used. So I just didn't know if anyone wanted to. We should play with it because I don't know off the top of my head. Anybody else? Oh wait, we got one over here. Maybe a question, maybe an answer, who knows? Man, Ernie is gonna be so fit after this. I mean, he's pretty ripped right now, but just wait. So this may not be true, but what I found is that macro escape means the aliases of your variables are different at that compile time location. So when you escape it says, well wait until I unescape this variable for you to look into the aliases and find out what the variable actually is. Okay, yeah, we're gonna figure this out. I know we can. Anybody else? Here we go. Another Michael. If you could just maybe do it from this side to this side so I can get my cardio in. I just have a question about compiled code size. If you write a ton of macros into your code, is that gonna explode the size of your compiled code? And if so, what are some strategies where you can still use macros, but maybe reduce that? So that's a really good question. And Jose has some good direction on this. There's some libraries that I've seen where macros are so-called not used correctly. So one use of macros is you could dynamically define functions on things. But if those functions don't depend on something like special, like if they're not doing something special when you define them, there's really no reason not to just call them in another place. So the reason that this is an answer to your question is if you had a macro that defined a function, the add function, let's say that we looked at, on every module that used that macro, well then that add function is going to be re-implemented all over the place, every time that macro is used. And that's useless, right? You could just store the implementation of add in one place and reference it. And if you really didn't wanna reference the module that it's defined on, just import it into your module so that you don't have to do that. So it'll become, I don't know what the right term is, but it's like it's available, it's in scope or something. Does that help? So the answer is yes. You could definitely bulk up, but I would say that you're not using macros right if you did that. I don't know if this is beyond the scope of your talk or not, but I'm curious, could you maybe talk a little bit about macrohygiene? Oh yeah, yeah, so macrohygiene is basically the idea that, well, the way that I understand it is you should kinda be able to see whatever you're talking about around your macro. So if there's a variable that's available when the macro is called, then the expression that's being evaluated in the macro should not know about that variable. Like things should not come out of nowhere. But I think you're right, it's a little beyond this because I don't have a great ready-to-go answer for it. The reason that it's a thing is to keep people from a lot of pain because you don't want variables and data to just appear out of nowhere. But there are certain cases, and there are ways to get around the hygiene that the var bang I think is the function that does that. And that's actually, you should go read, definitely read the Elixir Meta-Programming book because Chris talks about, he has a really good example for when you have to sort of violate the hygienic nature of macros in order to define that HTML example actually. Because the HTML example, if you think about it, you're sort of building up nested strings throughout it. And so if that one macro hasn't finished, and how will you know to close it when the other macro is executed, and it actually is passing along like a string that it's building up over time or by not using hygiene in the macro. Another, cool, thanks. Anybody else? Ernie, is one more good run. Cool, oh wait, yes. Thank you for the good talk. Thank you. I have a question about, is there any document, what is a macro or what is not a macro in Elixir to see? What is and what isn't a macro in the language? Actually, it's sort of, it's fairly clean cut. I wouldn't say there's a document, but if you are just thinking about the sort of fundamentals of the language, like what's defined in kernel, basically everything defined in kernel is somebody's gonna tell me I'm wrong about this, I can feel it already. I'm pretty sure everything defined in kernel is functions and everything defined in special forms is macros. I don't think anything defined in kernel is a macro. You don't know. All right, anybody else? But check out the kernel modules because there's a lot of interesting stuff there. There are macros. Yeah, I realized after I said that the thing about special forms is there's no implementation in special forms. Special forms is the things that are implemented in Erlang. So I was probably completely wrong about that. Y'all got me. The documentation, yeah, and that's why we have def macro, so you can tell right there. Oh, yeah, and the documentation always splits up the macros and functions too, so. Yeah, documentation. Sorry, that's totally, that's totally split there. It's not true. Gotcha. All right, anybody else? Cool, thank you so much.


Yay, I'm here to rev you up after your sleepy lunch Your sleep inducing lunch Hello, everyone this talk welcome to this talk Where we talk about whether s-bomb for a cloud is even a thing You guys are special because you get the disclaimer that says I don't speak for My employer or the US government. These are my views And you get your large language model fix of the day This is something that I fed to Something called API because that's the one that didn't get asked me for my Asked me to create an account Just said okay. Go ahead and test it out and I asked it like If you are made of software and an s-bomb is a software bill of materials Shouldn't you have an s-bomb then and it helpfully replied? No, I am not distributed as a product So I'm just here to chat and help people out. Oh, that's so cute But everyone knows that large language models are trained on Things that people think so this actually reflects the way that Generally people think right now, which is Services are not distributed. So why does it need an s-bomb? Well In this talk, we shall explore what that means here Okay Little about me. I am the maintainer of an open-source project called turn Which is a container inventory tools it generates s-bombs for container images by the way, I have heard that this is the only Container s-bomb generator that fails closed rather than fail open Which is something that I found out from a talk that Ian coal water and friends Did at coupon so in the talk they showed that all the scanners that they were using for containers Said there are no CVEs Even there are no packages And they made it do that by like overriding some files. So But turn is the only one that goes like I don't know what this is. I'm sorry I can't give you any information. So Yeah, so I am the maintainer along with Rose judge Come talk to us about it. I'm also a contributor to SBDX projects I've written documents under like with in collaboration with CNCF stack security And I have been heavily involved in the sysa s-bomb working groups And that's what I'm gonna be talking about here today Justin Murphy has seen me in all of the working groups. Hi Justin And I used to be involved in the open container initiative Artifacts and reference like reference types work that you may have heard of if you were Listening to the keynotes this morning So I contributed I contributed to that a little bit But there's so much s-bomb work going on right now that I had to step away Okay, story time Some years ago 2021 was not a good year for software supply chain security stuff So in December 2020, there was the sunburst attack that got everyone all upset Somewhere around me Anyone who's involved in s-bomb may have remembered this whole string of letters and numbers Eo 14028 repeat after me No, don't so That's when the US government released their Executive order that said that all the suppliers have to give them an s-bomb Couple of months later there was They released documentation on what the minimum s-bomb elements look like so people can actually start Generating these s-bombs and then for a little while Nothing really happened and then all of a sudden in December a zero-day call log for shell Came out and then everyone started panicking all over again Somewhere in the middle People were running around trying to fix this. It's like there. There are companies that are still recovering from it Somewhere in the late fall of 2022 Sysa published that they had started off these S-bomb work streams which tackled different aspects about s-bomb and Earlier this year in April they had published some of their findings from each of those groups So these are the work streams that they created vexes the vulnerability exchange work which is talking about how to Communicate in a machine readable way how Whether a vulnerability is exploitable or not or what the status of the investigation is there's the sharing work stream which has Published the sharing life cycle report in April there's a tooling work stream that Kate's been involved in Kate Stewart SPDx Talking about the types of s-bombs based on the software development life cycle There's the and then there's two other working groups the under ups and adoption working Workstream and then the cloud and the online application work stream, which is the thing that this Talk is about Okay, while that was happening. We've had a lot of class we've had this class of Attacks that have been happening which basically involve Attack like phishing attacks on employees of Service providers and getting the keys to the service infrastructure and then exfiltrating customer data and so This is this class of attacks May or may not exploit a vulnerable component, but it is very much on the rise I'll talk about a couple of examples which are actually really cool to go through Let's see cue the What's the thing some music what the heist music from Oceans 11 or Yeah, anyway step one attacker fishes a dev Developer gets access to their laptop Searches for listens for credentials uses credentials to log into a dev cluster and exfiltrates infrastructure in for in internals systems information step two attacker Injects malware into senior DevOps engineers Laptop senior DevOps engineer has keys to the kingdom Attacker uses those keys to go to cloud backups Cloud backup data stores and exfiltrates all of the sensitive data What's Sad about last pass breach is that they didn't actually share that much about what exactly happened So We're still like Learning things about it. So it turns out that last pass does not encrypt all of the vault It only encrypts passwords Websites are still unencrypted and that was one of the things that was in the cloud Backups and when you have like website information about what the users are using they have the username and then they have the URL so you could create like a phishing attack where you say something like oh you've You are are you trying to link these two accounts or you've lost you verify this other account by clicking on this link So it's it's more the more information and an hacker has about a user The better they can craft a phishing email So that's the last pass breach. Let's look at one that is even more interesting Let's cue the mission impossible Okay step one Malware is injected into the engineers laptop Attacker listens for Listens for packets steals SSO session cookie Step two attacker uses SSO session cookie to authenticate themselves using Github's or odd service. Okay. Now they're in step three use Now that they are the engineer they can they have permissions to Exfiltrate data from their data store All the data is encrypted so step four you act the attacker the Engineer actually has permissions to create production tokens. So Step four spin up workload Exfiltrate encryption keys use encryption keys to decrypt data So this is like actually this is pretty cool sophisticated attack But the takeaway from these two attacks is that it's not one big thing that happens but it's a number of steps that Exploit like basic infrastructure sloppiness so this is it's it doesn't look easy, but Actually, it's using like very basic Attacks that can be automated with existing tools In order to take advantage of the fact that we do not know Anything about the configuration of these in of this infrastructure or even worse you do not know What the service is made up of like who are who what are the components of the service and that's why This is us very interested in the s-bomb for the cloud So there are three sub groups under the cloud and online application working groups The first one is s-bomb for modern applications. This one is a little weird because This is more like bridging the gap between folks who who have who are used to working on-prem and dealing with on-prem infrastructure and trying to get them to think about how Whatever in whatever knowledge they have maps on to services that are in the cloud So it's mostly about trying to find out. What's the difference like what applies what doesn't apply? the second one is service transparency, this is a subgroup that I lead and This is talking about Okay, let's not think about s-bomb for a moment and zoom out and instead think about Individual services that are talking to each other using an API So we're trying to figure out What is the minimum amount of data we need to describe all these services talking to each other and what kind of data? They're dealing with and the last one and this is like more of a vague thing Is called cloud stack transparency and this is more about how do we enumerate all of the all of the pieces of the cloud stack that a Application that you would be deploying on to the cloud would be interacting with so all the way down to the bare metal and This is still a work in progress. So I'm actually going to dig in a little deeper about How this conversation is going about? I'll start with our Consensus about how sass is different from on-prem software the way I think about it is like the difference between Someone owning a home and someone living in an apartment sure of our hands. How many of you own a home? Okay How many do the rest of you live in an apartment or? You know, okay So if you were to rent an apartment or rent a you know our own an apartment You are only responsible for the things that are in the apartment, but the whole apartment itself is Taking care of by like a super and So what that gives you is that you don't have to worry about things like You know if the power goes off in your apartment, but the power is there in all the other Apartments then you just call the super to fix it You know if your toilet won't flush Call the super if you're the there's no running water call the super If this is different from home ownership Full disclosure.  That's your problem so The when you're dealing with on-prem software That's basically it you have full control of your whole stack But on the other hand you are also responsible for your whole stack. So the reason why folks move to Services or move their business logic to the cloud is because there are a lot of things that they just don't want to Deal with and they'd rather offshore it to someone else. So The the difference is that you You get convenience, but on the other hand you lose control From the security part of it if something happens on the on-prem In the on-prem environment Then it's restricted to that on-prem environment But if something happens in the cloud, there's like a whole lot of people that are affected along with it so it's almost like if the if the super turns like Breaks a does a breaker thing like the whole apartment goes out of power. Anyway, I've Extended that too much analogy too much So this is why I would like to introduce you to a concept called the shared responsibility model what this means is basically Getting folks to think about what responsibilities are on your end and what Responsibilities are on the service providers in and this includes cloud providers too. This is taken from the NIST publications and it's got like a It's real. I like I really like this diagram because it shows that there's a gradient of what is your Responsibility and what is the service providers responsibility? There are a couple of models out there that are Provided by Governments like this is the UK governments model You'll see that there are some that are clearly in The providers responsibility and some that are clearly in the customer's responsibility based on what kind of Service you're using and then there are some that are like grayed out This is a scissors Responsibility model as you can see it's like completely different It's there are there are more layers and different things are shaded And These are the shared responsibility models of each of the vendors. Obviously, they're all different So the takeaway is that this isn't standardized talk to your cloud provider for a shared Responsibility model if you are having if you have Business relationship with the service provider Ask your service provider for their cloud provider share and responsibility model So you get a better understanding of where the lines are so on that The cloud stack transparency subgroup works on tackling that shaded area Where there is actually a shared responsibility, but we don't really know where the line is so They are tackling this based on Function and so what they're doing is that they have divided the cloud stack into functional tiers. This is still a work in progress So I'll talk about how y'all can get involved in this discussion if you have ideas or if you want to Get involved and or just look around so They have divided each of the tiers into functions and for each function They are trying to figure out the minimum data set that is described that is required to describe this function Okay Let's move on to how Sass is similar to on-prem software. Well, the bottom line is it's still software. So It's still made up of things. There are still components providers Can be considered as suppliers and they can integrate into each other They still have dependencies. So that means that if you're using a service that service may be using another service So there's definitely a dependency graph there and there's still security concerns so Actually in the sass environment, this looks very much like Old-school bill of materials where you have business relationships and contracts with your suppliers So just replace suppliers with providers and you get a sass bomb so This is just describing what that might look like as an example. So this is Netflix's services And they use many different subcontractors they they have a good relationship with AWS So they use a lot of AWS services, but they also have their own services and They do use open-source components and they host them So it's the take away from this slide is that it's pretty complicated. So and all connected using Communication channels API calls Network connections, so they it is Useful for someone who has a business relationship not necessarily with Netflix because they're They're only care about end users. So this is like all of us. We don't really want next bomb but if they are Using another service then they would probably want this bill of materials of their services So to that effect we actually have come up with a Minimum list of data sets again work in progress This is a list of things that we had as a community agreed that We are able to actually provide data for this, but it's not the end all of it We're still looking for feedback Okay, let's talk about some use cases Where we can apply traditional less bomb sass bombs? cloud stack transparency things so The one of the driving use cases is am I affected by vulnerability X? so You find Vulnerability in the news and then you're worried and you're like, oh my goodness am I affected? Okay, in order to answer that let's look at a very basic Service provider they'll have an Usually you'll have a client that is talking to the service This client can be a web browser desktop app mobile app Command line to they'll make HTTP calls to the service So they'll make the calls to the API gateway if that client had the vulnerability That kind of falls under the traditional s bomb. So it's a physical. I mean, it's a Tangible thing that you can go and poke at an introspect. So That's not a problem and that's probably something that a service provider can give you now if the vulnerability is on the service provider side and in one of their Service software, this is a little tricky because You don't actually know Whether your network call is going to take advantage of that vulnerability It's very possible that that vulnerability is existing in the software, but it's Mitigated or it's not even used because the network calls just never touch it. So This is why Rather than Saying like okay, I want the s bomb for your control plane. You would ask, you know, hey, does my API gateway talk to Does your API gateway? Talk to that vulnerability or touch that vulnerability and you can say no So the second use case is am I affected by a service compromise, this is very this is something that is like very Common a common question that gets asked because a lot of times when you're talking when you're using a service That service may use some service other service to perform a certain function Very typical one is an identity provider. So the identity provider might be compromised But as someone who uses that service you may want to know whether the identity provider is You know something that the direct service may provide or whether they're offshoring it to Some other service so very much like a typical Bill of materials where you have contracts with suppliers. So suppliers are providers here The last use case and this is like a little tricky because it goes into GDPR territory And I don't really want to talk about that because I don't know anything about it Is who has access to my data? so when When you have many folks that are accessing the same service You want to make sure or you want to ask the question to the service provider that Whether there is an appropriate amount of isolation between your data and everybody else's data And in order to ask that question you probably want to know whether That service is using another service with data that is shared and so That's where like a SAS bomb along with the cloud star stack transparency work would help Because it could it could be within the same service the the same infrastructure even And that infrastructure is not very well isolated. So it's kind of like threat modeling But rather than sitting down in a room in a meeting room and having a conversation The service provider gives you a data sheet to start with and then you further ask questions based on that data sheet and And that's what we are trying to get to in these conversations that we're having with CISA This is Facilitating them Okay, can we generate this data today? Not really so Yes, you can generate s bombs for all of these Software components that are used in all of the services But they're not actually going to be useful because that's not what folks are Like that's not the critical part. That's not the thing that attackers are using to Get to sensitive data. It's actually configuration like misconfiguration is I Understand it is the second most common attack vector for services The first one is data breaches, but quite honestly the data breach happens because of a misconfiguration So and this is something that a top-level service provider is Responsible for clearly the rest of it components that they can use So they can set it up, but when they configure it, it's all on them And what happens is that if there's not enough isolation between customers then a misconfiguration From one customer will bring the whole house down So yes, we can generate s bombs for all the services, but they're not going to be useful but what is useful would is Actually some description of these Configurations and we don't have that right now And this is something that you know cloud is Trying to get a handle on but not really so We usually Cloud cloud developers usually talk about like over tools that can make your life easier But organizations that use the cloud have to think more deliberately about what exactly they want so the way that organizations Adopt cloud is that they start with what what their goals are so you start with the people You create you think about what processes you need In order to get to your goal You construct policy that hardens those processes you choose tools Based on the policy you create configurations for those tools based on the policy and then you go and run the tools and you have to do this repeatedly actually Kate Stewart had given a talk Yesterday it was the safety talk where you talked about how requirements are the ones that drive the implementation And if you do not know what the requirements are then you cannot create like Accurate bill of materials for what it is you can't create bill of materials for these kind of interactions and as a result you cannot enforce your policy so It's kind of like the the call to action is to take a step back and think about You know whether this is real whether this is really useful or not It's possible to create a spawns in services It may or may not be applicable Okay, so here are my takeaways for the talk if you don't want to look at all of my pretty diagrams Just look at this list of things That you may want to think about so As bomb for the cloud is kind of a thing We're trying to work on it not really as bomb is a really funny word to use for this It's really more of an actual bomb But even bomb is not a good word for it. I particularly like data sheet But nobody that I talked to likes data sheets, so I don't know maybe I'll make it a trend over here Please use data sheet I Customers definitely want better service and cloud stack transparency so service providers Can't use that whole thing that we are not distributed. We're not distributed So I won't give you an S bomb. They can't use that because Customers will ask for it Um If you're using a cloud provider ask your cloud cloud provider for their shared responsibility model Full disclosure. I work for a cloud provider not a very famous one, but getting there. I hope They have a shared responsibility model if you want to use Oracle cloud infrastructure You can search for the shared responsibility model online. You'll know I think I Personally think it's pretty good In in so far as explaining where your responsibilities are based on what you use But yeah, that that's a place to start asking questions You can apply S bombs to any software that you distribute It's not like service providers cannot generate S bombs for you But it is touch and go and whether that would actually be useful for you You'd gain any information that will help you from that my opinion here is that You need more refined Information other than the S bomb so few more steps to go there You can apply Sass bomb Sass is not like really a word. I like either but I I'm very bad at naming things I'll cloud I'll crowdsource some ideas. So a service bill of materials if you will You can I play that for hosted services and we're working on a white paper that explains how to do that Vex usage becomes really crucial for services Simply because we don't have the tools to give any kind of refined information. We just don't Even right now traceability and observability is a thing that we're still talking about because we can't You know get a full idea of what happens in the cloud so Vex usage becomes really crucial just so you can say like yeah, we're investigating this vulnerability or no It's not exploitable or you don't you don't even see it in the service that you use Etc. So Vex becomes really important there as Bombs for the back-end clouds infrastructure It's not a thing yet But you can help create that because you can get involved in all of these working groups here These slides are published on the talk website so you can download them I hope the links work if they don't work. Let me know. I'll put my Information in the next slide. It's the next slide Alan Friedman from CISA Kindly reminded me to put the s-bomb at scissor.dhs.gov If you want to join any of the CISA working groups just send an email there and they'll get you all set up Each of these links are to the meeting notes and the white papers that the group is working on and That's the end of my talk. Thank you so much for joining in at this very nice sleepy hour It is a very sleepy hour you can reach me on all of those social media thingies Special thanks to Alan Friedman, Bargav Vivekanan and Ricardo who's here somewhere. Maybe not. Okay So, yeah, that's the end of my talk. So it's time for Q&A. I've left a lot of room for Q&A So you can ask me any question. Yes. Go ahead. Oh When when considering for s-bombs for these cloud providers have What is the expectation that they'll actually be able to give these so a lot of the cloud providers? I've talked to they consider their That's everything underneath the hood is their secret sauce proprietary. They don't really want to discuss it or acknowledge it So how do you see some of these working groups moving forward to address that proprietary? Yeah, so They they are not obligated to share their proprietary secret sauce, but they do have public API's And and they have documentation on those API's Anybody can look at how to use those API's there are hundreds of YouTube videos out there Showing you how to use the API's and what client tools are there? typically the client tools are open-sourced even though the Even though the services in the back end are not So Yes, I understand the fact that they probably cannot provide a full s-bomb for the services they host But they can certainly provide an s-bomb for like a top-level service So for example, if there's a storage service that we are offering Then we can provide We can provide metadata for that service so we can say like yes This service is a storage service that uses HTTPS with authentication You can But they can't provide any information about what kind of data you're going to use because that's the that's your That's your side of the equation So you decide what data you want to store in that storage service There's there's nothing. I mean and that's all you need, right? You What good is an s-bomb in that situation? I Mean it's a question that I'm asking maybe you all have an answer to that Can you pass the mic over there you got me thinking thank you Good talk. I'm wondering realistically. We don't have build materials here. We have bills of services So bosses, can we go for bosses now? Let's call it a boss A boss has in it is What you have actually have that ability to have access to Yep Potentially references to other bosses So That's actually what the service transparency working group is working on like what what are the data types that describe a boss So kind of a related question So you have services that use other services that use other it kind of reminds me of software that has dependency on other software So if there's like a vulnerability way down here, do you envision the bosses being linked like we have links and dependencies and software? No Yeah, we actually talked about that like You know dependencies of dependencies and how deep we want to go and What the result we came up with was that there is no way of validating whether that's true or not You can only go as far as you know, the the one level down Which yes, so that's that's what we do anyway is Is Like even even in the regular like I come from manufacturing. So I think about electronic bill of materials too and the way that like reliability engineering works in that field is that you You have a problem with one of the components that you know of and then you contact the supplier of that component You don't know what's in it. You just tell the supplier. Hey this thing broke That supplier will take their component that same component do some analysis on it and say, oh, yeah, this capacitor blew up Who's the supplier of this capacitor? I'm gonna go and contact that guy. So You as like the electronics You know the consumer electronic holder Don't know anything about that and you don't care You just want to you just want to know like, you know Whether this is something that you need to worry about whether there's gonna be a recall How much of money you're gonna Waste on this so it's very similar to that. I think he has a hand up So it sounds like you're describing I'm a consumer. I receive my application from from a vendor who I've paid for it from It comes with my S-bomb that tells me all the random little components that are inside it And really it also comes with another bill of materials, which is every network connection that comes out of this application Some of them are what we think of a service is some are back to that vendor for you know a soft service Some are hitting the internet for a public thing. So it was almost like it is a Bill of network expectations And yeah, so it's the connectivity part and the You can never see beyond the connectivity endpoint. So you're just like I I get a page from Wikipedia It will be pulled into this application and shown Therefore there was a HTTPS Wikipedia node in the connectivity list. So that kind of feels like where this is going So is that called a Benny? Bill of end Network endpoints Look at that. We're coming up with all kinds of nice like media savvy hype names Anyone have any other questions about this any concerns this Is this overly scary? Oh, there we go. Get it any plans for standardizing the format for these services S-bombs No Why are you making me step in this puddle? There can be more than one standard as long as As long as folks are you know As long as folks Understand what the use case is for this? I am personally happy because In the end what we really want is Not not full transparency, but at least some level of transparency So we know what we're dealing with and we can make you know good decisions based on that So for example, I would I would really like to know if you know a service. I'm paying for as an individual is using You know is using and third-party identity provider. So if I was going to use You know a health care service to That the doctor is providing I don't know zoom care Maybe zoom care uses octa for their identity provider and octa. There was actually a data breach I would like to know if zoom care is using octa. I'm sorry zoom care. I'm just Using you as an example. I really don't know whether you're using octa or not. Sorry. I Would like to know though. Well before my question Just shout out because Gary is organizing the spdx profile meetings to try to explore capturing this into spdx at some point So I haven't been a like to those meetings I've been I've attended some but I feel some of the discussion there is Clouded By the fact that sometimes it's a relationship between a consumer Who is using a proprietary service, which is opaque? But if you think about it and you move it let's say internal customers inside or for an organizations where visibility is not a problem You would necessarily want to have that link of service to Esbom to the components of software and Oh, I think we're okay Okay, and So But it is a reality that sometimes you will need to want that information from the outside So is the working group tackling that problem of? As an internal person in our organization I want to understand if a particular request hit endpoints or affected services while at the same time consumers outside being able to At least content address the same information without having visibility into that Yeah, so let me see if I can summarize it. You're asking whether like service providers themselves can make use of like the S-bomb and the service stuff or Okay So let's say I have a service and it hits two microservices and As time passes I want to know which requests were served by a component which was affected in some way Internally, I could have like a lake of data with all of those S-bombs. I can go relate the information and it's fine but when I'm outside I need to have a way as a consumer to Get the exact Diagnostics without knowing the details and it this is some somehow related on there were jokes about I want to know the S-bomb for Microsoft office for example But if they don't want to like share the details, can I still address some of the internals without knowing them? That's up to the service provider unfortunately, so if they want to expose That data to you and and sometimes they do like they do have You know the ability for you to have like metrics And observability stuff like you can instrument your services if you want to But that's only up to the platform that they provide, right? So for example If you if you were using a Kubernetes cluster Or you were you using like I'm sorry go back if you were you using the cloud providers Kubernetes offering so for example Eks And you were deploying containers into that They have no problems with you instrumenting your containers and your Cluster and they probably provide some kind of instrumentation from the Kubernetes side But anything below that they probably will not share with you so for example if Kubernetes is running on some virtualized Virtualized substrate, I'm calling it a substrate If it's a virtualized plane That Kubernetes is running on you probably will not get any information about that virtualized plane you'll get information about the Kubernetes cluster, but Not not any nothing below that and that is determined by the shared responsibility model. So if you Yeah, so if the if the responsibility is on the the cloud provider side They're like no no don't worry about it. We'll take care of it And we'll let you know like if something goes wrong or not trust us My question exactly is how do you trust the data that's in the S-bomb? Where are you storing it like if I'm the consumer and I'm like I want to know what's in Microsoft Office? And I get this table of data. How do I trust that that's up to date? And yeah, how do I verify that? This is my favorite topic I can go on and on about it. My answer to it is how do you trust anything? I Mean this is this is something that is funny about like the whole Question of you know, can I trust this S-bomb and I'm going like well You're like all your services are based on demos that other people have done and put on YouTube So I don't know you trust that But yeah So hopefully not because S-bombs usually have Like verifying data with it And actually spdx 3.0 has added some new functionality about verifying Usage as far as like checking whether the S-bomb itself is tampered with That's like an external verification step that you have to do. So maybe there's a S-bomb that is stored along with hash Actually, this is one of the things that This is why I was advocating for storing S-bombs in container registries because container registries use Merkel DAGs to Check for integrity of each of the components that make up a container image You can use the same thing for S-bombs or any other artifact for that matter It actually provides integrity checking out of the box And then there are tools like cosine that use six store to sign any art you can sign any artifact with cosine and Adds the digital signature to the container registry. So that That stuff would be really cool to start using but Other than that like I don't know like you got to trust something I'm sorry this. This is the last question because we have the next speaker Awesome. Thank you so much for coming add link to And go back to bed


Question is from Cameron Stewart 18. What are the top three to five things that the average American can do to improve their long-term health? Oh, great question. So I'll list what I think is number one. And the reason why I think it's number one is when I think of all the things that a person can do to positively affect their health, when I think of the average person, I think of what will give me the most bang for buck. Like, what's the one step that someone can take that's going to make the biggest general impact? Not perfect, because it's only one step. There's more. Get a big bang. There's more steps, but what's the one thing that the average American can do that will really positively give them the biggest positive impact? And if we look at the average American and we look at the health problems, the vast majority of our health problems, our chronic health problems, are related to obesity and the overconsumption of food. That's number one, it really is. And even high sugar, high carb, high fat, the wrong foods, when you throw that on top of a lot of calories, they become catastrophic. So the number one thing, and if it's, because it's one thing, it can only make it one thing, so I'm not gonna say diet because that's a lot of things, right? I'll say one thing. Avoid heavily processed foods, that's it. I've got three right away, and that's number one. I've got three right away that come to mind. Number one, 100%, I agree with you, processed foods. Yeah, because that drops your calories by five to 600 calories a day. It's a simple, and it's not simple in what it takes discipline-wise, it's simple as in what it takes to follow.  If you're hungry, eat whole foods.  Just literally eliminate processed foods. That single thing I think is the best thing to do. The second thing I would say is actually creating good habits and behaviors around movement. And it could be as simple as this, add a 10 to 20 minute walk to meals.  That's called ritualizing activity, right? It's 100%, you're 100% right. Now you might be thinking, God, a 10 minute walk? Aren't you guys trainers? Don't you guys teach people resistant training and all that stuff? Yes, that would be great. That's actually the best possible thing you could do.  Remember that. Impact doesn't necessarily mean the best thing. Impact has to take into account what will people actually do, how many people will this work for, and what you just said makes perfect sense. Ritualize a little bit of activity. This one isn't really fitness related. It's more like community related. And I think that based off that study that you had told us a while back about relationships and how that plays into a factor with your long-term health. And you see this in the blue zones and you see this with, we're social creatures. We're social animals. And I think that we've all gone way beyond that. And we think that we're being social by being on our phones and talking to people through social media and through all these things. We don't have any meaningful interactions with other human beings. And I think if you weren't to kind of definitely work on that and work on giving more of yourself into your community of making friendships, making relationships with people like in terms of long-term health and have a massive impact. Statistically speaking, you're 100% right Justin. Having good relationships is paramount. In fact, having bad relationships is equivalent to smoking. I think something like 15 cigarettes every single day. Think of the stress it causes. It's crazy, I didn't even think that. And you went to that point and the reason why I knew the 95% communication thing was because what I was gonna write about was exactly this topic is if the average person is claiming that they're spending four to five hours on social media every day, 95% of communication is non-verbal and actually physical, right? In front of somebody. How much are our social communication skills degrading as Americans right now by being- Why do you think there's so much conflict? So that's why we have emojis and all kinds of ways to try to make up for the difference. But it just doesn't, it just doesn't. Absolutely doesn't and studies will prove this. And in regards to the relationships, you know, it's funny, Jessica and I like to walk around the neighborhood and we'll do this like 30 minute loop and we ran into an old friend of mine, this guy that I way back when I first opened my personal training studio when I was 23, I think, I trained this guy for a second. Great guy, one of the nicest guys I've ever met, lost contact, but I still remembered him and thought about him, ran into him, he lives in our neighborhood. So we start talking, he's got kids and we're like, after we leave, Jessica and I are like, we should have them over for dinner. Now we didn't, now you know why we didn't? Because why most people don't? You think about all the time, the energy, we got to organize.  That prevents so many of us from not having these relationships. But the reality is every time we do it, I've never, I'm almost never. You never regret it. No, I've invited people, yes, it's a lot of work and all stuff, but then when they leave, I'm like, you know, that was a meaningful four hour, you know, conversation. It made me think of it because I've been coaching and putting myself out there a little bit more and like interacting with other parents and kids. I just forgot how much of an impact that made, even on myself, not to mention, everybody else that we're starting to connect with more. So I had three that came to mind right away. One was not what you just said, Justin, but I 100% agree that if we're going three to five, that has to be in one of those right there. The other one that I think is extremely important and extremely overlooked is building some sort, and I think it's getting worse, so this becomes more important, is building some sort of night ritual the same way you have a morning ritual. And I like saying it like that versus telling you something specific to exactly do because everyone's gonna have an individual variance, just like we have with our morning routines, but the one single thing you can do that will impact it is just make it a priority the same way you do a morning routine. The same way you- You get ready for your day. You allot yourself a certain amount of time to shower, you allot yourself a certain amount of time to brush your teeth, to have your breakfast, to make your coffee, to maybe read, I don't know what you do in the morning, but for sure, yeah, poop, whatever, you for sure have somewhat of a routine that you start your day off with and some routines are probably better than others, but at least having one is sets you up to have a successful day, right? Yeah, you're right, 100% because we go to bed, we hit the pillow, we expect, I'm gonna go to sleep, have great sleep. Right. And lack of quality sleep is very detrimental. 100%, and only getting worse with the phones coming into the bedroom, with the TVs coming into the bedroom, with the laptops being on your lap still and looking at in the lights, and we talk about this all the time, disrupting sleep, so just having some sort of discipline around how you prepare yourself to sleep, which is one of the most important times of the day, even though you're asleep, as far as your body, hormonally, and longevity-wise and stress-wise, so that to me, I think, if you treat that with care. What a great list, think about this. If the average American dramatically reduced, didn't even count calories, and he just dramatically reduced heavily processed food consumption, ritualized a little bit of activity, maybe tying it to, when I wake up, or tying it to food, like you said, Adam, so I'll take a 10-minute walk after every meal, that's nothing.  They just did those four things, boy, that alone would solve a huge chunk of the chronic health problems that we're suffering from right now. Totally.