Hi, my name is Igor. I'm really happy that I can come here and I very much would like to thank you for the invitation. I normally do not prepare my talks today. I did prepare it and even wrote it down, which makes me very stressed. And so I'll just maybe not look at my notes and try to carry on this topic. It's a very different take than most talks I think you would hear today. I decided to go a little bit broader and make a certain reflection after writing the books, as you said, very much focused on the province. I mean, I kept such one in my focus, but maybe some kind of other event in life would have put me to study Shanshi province or Hebei or any other province. So the big question comes. It's kind of a theoretical quandary, really. Why would you even want to research Chinese provinces to start with or even think of kind of a provincial space, something that we might want to research and what kind of problems are there because it might seem like a great topic. I'll write a book about Sichuan, but I would rather say, think twice or think even more and so for the next, let's say 20 minutes, 30 minutes, I'll talk about it. And we are very much justified in being annoyed at much what is happening within any scholarship on Earth. I mean, that is the function of historians or anthropologists, archeologists or any other decent humanistic and divorce that we shouldn't be very much satisfied as what we find there on the shelves and try to find the new questions, how to go forward. And we're quite, we could quite justly say that in Chinese studies, we can be annoyed with this China, a notion of a country that we can just study that is very large geographically, immense population. And so once we pick our case studies and say, well, this is book about China. It sounds a little bit ridiculous. When you face, if you study Qing Dynasty, some 450 million people who study something pertaining to today's era, 1.4 billion people and very large area.  This name China appearing in all the books might really just mislead us into thinking that, in fact, this book is not about China, it's about some little aspects. So should we really just sort of have this flag all along in there? But there's so many books that say that. Another thing that whenever you pick a book publishing the People's Republic of China, and if you notice every title starts from Tunguo, ta, ta, ta, ta, ta. So, but this book's really about this. Is it really that Tunguo? So you said, what is the fallacity here? It's a very large fallacity because it makes us think that, and again, the set of case studies are actually representing China. And if you notice that, if you try to map them geographically, you would find very fast in this book about a fairly limited set of regions, a fairly limited set of problems that then get authority of having a Tunguo on the top of it and representing a whole China. But does it really? And so, other thing is that this China is being very much ratified. So just continuing on this topic. If we very much look at these studies, where the case studies come from, they come usually from certain geographical regions. We have much more studies coming from Jiangnan. We have plenty of studies about Shanghai on Beijing. But once you start going into a good research library in China studies, you suddenly realize that by the shelves about Yunnan or Sichuan or I don't know, Gansu, that, you know, there are just first few books in there, many of them dusty and nobody writes it. So the big China, whether it would appear in the Western language studies or in Chinese language studies, so more often than not, are regional studies or sets of case studies that then get stretched very much to cover the real China. But they don't really do the job. So I think as historians, we should, historians or other, you know, branches of humanities, we should be very much aware that perhaps we're dealing here with a grand problem, the problem that, well, this China, can we really study it? And what is the take we can, you know, have, you know, or at least some kind of a decent method into dealing with the size of a topic that we are actually truthful to our case studies. And what they would carry on is just telling you about one fairly attractive, perhaps way of doing it and telling you what kind of problems we have with it. So, you know, province, what is an easy, beautiful exit? You know, well, I don't want to study China, I would then pick Sichuan. So here we have a lot of people who like Sichuan, but we don't pick, I don't know, Hubei or I mean Hubei, you know, why not? You know, just we got our beautiful provinces and here we're happy. Well, there is a number of fundamental palaces that come in game, which I would like to make you aware of. And one of the first one is, well, you know, provinces just look like something else. How do they look like? Like European nation states. They have pretty much the same sizes. They have these beautifully demarcated borders. Very often, they have a nice center, a capital. Whoa, we're home, yes? We have a capital, we have province, we have borders. There are even nice neat mountains very often all around the main river passes. God, we're like in Germany, England, France, Poland, Italy. Oh, we're home, yes? Now, we can do basically a national history by doing the provincial history, then we are on the top and we're all done. Well, you know, this is pretty much the worst thing that we can potentially do. And the first, you know, problem of it is the European nation states and their histories. I mean, what are European nation histories? It's something that we are combating against for the last 30, 40 odd years. We're trying to destroy the national histories. We're waging, you know, sometimes won something, lost war against educational ministries to throw away all those useless books that, you know, make children learn the national history. We're in the forest of the fight against the demon that appeared in the mid-19th century in a very, very, you know, odd, but kind of most true historiographic tradition that basically clipped off a certain political entities from the context of what was European history, now then reified a set of heroes or events as being unique and then made our national histories. But our national histories are really aberration of writing history, as they are what history shouldn't be. And most of, more often than not, they're distorting entirely our ability to actually comprehend any historical process or any process whatsoever, yes? Whether it would be related to migrations, lives, only social, political or cultural event that happens in Europe. Now, do we really want to copy it to China? We might rather think twice. Well, you know, but that is sometimes, that is happening. I mean, how many of you have seen those new beautifully published, I don't know, the seven volume, Sichuan history, whatever volume, Yunnan histories, or beautiful or large or full of information, all of them you find in libraries, you know, about Chinese studies, which means we're basically within a process of replicating the same, yes? The same process for writing local history in a very different political context. Other what is connected to this velocity is the repetition.  There's the opera drill, there is the, I don't know, whatever, my, no, any area has its own gazetteers, multi-volume gazetteers, and many, and all of you probably know that random, that if you get by the border areas, you appear, there appear only repetitions, yes? The Yunnan to Sichuan, the Sichuan to Hubei, you know, once you get there, you just repeat the same content about culture, about developments, about politics, about whatever else, because that's creating the pseudo-national provincial histories simply doubles the information, but then distorts the real connection between the people. Something which we always know, that people cross the border, they don't care about administrative borders, if they're not prohibited to do so, yes? So the production of this kind of sources, again, as in case of national histories in Europe, or in case comes from a certain political arrangement over space and over-living people to which you just enforce certain units and double on information which without any logical connection to one another. The other thing that goes on with this is the idea of, well, you know, okay, so we say, well, provinces make no sense. This is a point made ages ago, you know, they're none of the unit. I mean, this is a point makes a long time ago by Mark Alvin in the historical Atlas of China publication from mid-1980s. He said, well, you know, these provinces simply are just administrative units, yes? They've been just created that and they have no history. There is nothing natural about them, yes? As if there was something natural about European nation states or any other states. But, you know, so this kind of Alvin's points extremely radical, but we should always keep it in mind, you know, maybe not as a point, but as a question, yes? We should question the kind of spaces we are discussing. And, well, you know, and aren't Chinese provinces anything natural? Well, you know, yes and no, many of them exist for around 500 years. Most of them came out during the UN dynasty in a bit of a different settings as they, by themselves, so they have a very long history. If this exists as a certain socioeconomic entities, they did exist as a political bodies, you know, changeable political bodies historically, but we can say that for at least 500 years, most of the provinces do exist on the map and represent some kind of organization of the society in question. So, aren't they a natural organization? Well, nothing is a natural organization in case of human existence, so we can just, you know, brush this point aside. Now, you know, looking at this, however, what is more important than thinking about provinces as just kind of entities, it's thinking how deep does it go? Is it a more interactive way? So if we talk about this unit that exists for 500 years, we should not think about that they formulate a certain entities, but how do they glue with other units that are underneath? Where they functionally existing forms of social organizations? As in short, how did they relate to other forms of government, methods of marketing, circulation goods of people and so on and so on? If that thing occurs, then we can actually already identify that this sort of unit exists. And, you know, if you look at China, you know, some of them did, some of them not, some are more centric, some are less centric. If you think about who they, you know, everything comes out to the one confluence of Han River and the Yangtze River. But if you're looking up toward Guangzhou, you would see that there are very separate spots that are going out. There's a Guangdong province, yeah? So there's a Guangzhou, there's Shantou and so on. So each of them face and have a basically independent self-existence. So, you know, the diversity should be our key. And the last thing is that, you know, many of these provinces in China change their populations over these 500 years. Well, in case of, you know, some of them have been entirely destroyed. I mean, in fact, a lot of people here study Sichuan, so 92% of population lost to the Yuan Dynasty against 70% lost. It would mean transition. I mean, but this is a story that's quite repetitive. Not only just massacres, death, epidemics, whatever else you mentioned, but also migration, in-migration, out-migration, you know, large changes in population, large ecological transformation over this period. All of them impact very much how it all work. And, you know, last velocity that comes to my mind, obviously when talking about it, is the velocity of more even of the ethnicity. You know, we have this notion which we'll talk about that in eight and a second ago. So, Chu hua mi zhe, yeah, so the Chinese, the notion of Chinese nation gets smiles on the faces. But, you know, that gives a sense of ethnic unity which supposed to exist 5,000 years, though I'm not updated, maybe now 6,000 years, you know, you never know longer and longer in history. But then again, you know, we get to a certain problem of historicity, of ethnicity and historicity, of identities and culture, which obviously do not correspond to any of the geographical or political geographical units. Yes, I mean, as historians, we see the transition through the past and obviously any such notion would just distort our vision. That's why what they think is that once we go and look into research in history, we should be more people centric and much less geography centric. And our history should be closer. That sounds like a good old, you know, Maoism, but, you know, people, we should focus on the people, yes? People as groups of interactions as networks they build, as how they migrate, how they interact with other human units. So we, even though very often our sources are very disappointing, then the way we look at history should really very much keep in person an existing human being and not some kind of a geographical abstract. So now once we start looking more to people, we need to start defining also what we mean by the province. As we said, the province is very problematic thing, you know, we talk about geographical provinces, but that's not necessary. Provence can sometimes mean a hinterland, yes? Provence in a more colloquial word means just a place this is not belongs to the center, yes? So it can be an administrative entity as exist in China on the word of Sheng, but it can be just simply a hinterland of the city. It can be the place that is remote or is a place that exists in some kind of relationship between center and periphery, whether for perspective of economy, whether perspective of social exchanges or in migration. But when you come to China, we always have to be also somehow synthesized to the notion that the province as we use it in English is not a Chinese notion, yes? Our notion of province and this would somehow is very often missing up from scholarly discussion that, you know, a lot of discussion in many areas not only related to China studies but also to global history and so on that when we talk about province and provinciality, we very often forget of the very Roman roots of this word and we largely think of Roman settler colonialism to places like today's Provence, which has its name in the south of France or Sicily or what they called Africa, which in today's Tunisia, yes? So kind of forms of settler colonialism organized by the Roman Empire, which meant and what is more important roots, it's somehow its definition. It was a transplantation of a certain legal and social organization from the Rome, from Latio, to the provinces, to the outlying areas within the empire, which means copying the center to the peripheries. Now, once we speak about Chinese provinces or any provincial spaces, I don't think we could talk of this kind of provinces of transplantations of a core to the periphery. We rather think of a certain means of controlling the outlying elements of the empire, as Chinese provinces come out largely from the mechanism of extending control over the conquered and controlled land within the empires. And only in time they deepen up the mechanisms in which Sicily the center obtains its own mechanisms of control, safeguarding border, transferring taxes and creating a fairly similar ritual, social, cultural order which unites the elites within one's imperial space. So that is quite a large difference than the settler colonialism, which existed in the Mediterranean world during the Roman times. Other thing is that we should look at the province as in the kind of human to human network. So about the interactions that leads to institutionalization of what is a province and how these institutions shape the people. So we're talking about transferring of institutions. You know, it starts like wave one in China. So movement of a certain institutions, both inside and outside to the capital and building identities and building the provincial spaces and redefining them through interactions among people and social groups through forms of institutions. And we also should look at provinces not exactly just this administrative means of things on the map, but also as forms of networks, connections, transfers, exchanges and so on within variety of fields, whether they'll be work, whether they'll be knowledge, whether that will be music, performance, genres, objects, whatever else you name. Yes, so we have to look, if you want to look at people in the center of our scholarship, we don't have to start looking at the way the people actually organize their own society, produce their interactions, produce their networks, produce the memories of it, produce certain scapes, whether it will be city scapes, whether it will be temple spaces, whether it will be religious cults and whatsoever. So thus, once we think of a province, really we should go broader than administration. We should think of a space of interaction, of complex production that happens within the historical time. And there is no uniformity, yes? This is really how it just developed and there's no simple system then of saying, well, we just study provinces and it's easy, we just line up our histories as we have it everywhere. I looked at it again, my 7 volume Sichuan history, shouldn't do that, three chin, during chin, han, and so on, does that really correspond in the way the networks, the organizations, the life within these provinces have been built? No, it rather ignores the kind of interactions that produce real historical results in the place by uniformizing and linking the history to the big national past that is not built on the basis, the notion of this past, on the basis ever derived from the place like Sichuan province or any other province, yeah? So in fact, at least in my opinion, we should have an ambition of building it up from the local sets of interactions. And at the same time, it doesn't make any sense to think of provinces as something independent. So thinking of them as some kind of independent, pseudo-nation states or replicating the mistakes of the times of the nations of national histories in which we cut off interactions in order to write for something unique. And I will later on, just in a minute, provide you some examples of how little sense it makes but that's it, okay. Why is it so important? Well, because we want our histories to be relevant, yes? So not only relatively true and touching at least with a historical truth that we can derive from sources if something like this exists, but we also want to be able to examine the questions and want to examine the developments that happened in history. And the only way to do it is by localizing it. And only by localizing it, we can do it by looking at this broadly conceived idea of a province, whether it can be. That means that, well, perhaps we shouldn't, it doesn't mean that we have to do micro histories though. Micro histories is not the solution, not so easy. Or what they called historical anthropology. That was the method. For China, it was called historical anthropology in China because of David and the way the grant authorities in Hong Kong work. Whereas, we're really talking here about micro histories. We shouldn't jump into micro history thinking that we got a golden solution for everything. Micro history is historians pretending to be anthropologists but playing with books. And it's very interesting, but at the same time, it also might ended up us cutting out our little piece and our case studies and reifying it way beyond its actual meaning. Okay. So, so many fallacies that I have listed to you in here are fallacies of repeating the bad historiographic traditions that didn't help us, the fallacies of, you know, of reifying the provinces or the ones of, you know, wrongly defined topics or the ones of, you know, the way things don't really work. Unless you could hear my solution to it would be that for looking at networks in interaction. So, I'll give you some examples from Sichuan. London, if you see it, is this lovely city in the northern Sichuan, you know, not few western tourists go there. The most Sichuanist tourists travel, you know, it's preserved in approximately 60 something percent as it comes to its original architecture from the mid-dine from largely from the Qing dynasty, mostly 18th century, bombed by the Japanese in a certain moment but without large destruction. Certain elements have been reconstruction, not the tower, this one, from which I took this picture, but this other tower has been freshly reconstructed. But largely the city stands as it is. Now, London is famous for its local hero. And the local hero is Jean-Pierre Nureau.  And that's where his grave, at least historically, but obviously there comes two products that are all trying to accessible with Jean-Pierre Nureau and I lost my picture at Jean-Pierre Pijol, which we can only consume locally. Now, apart from lovely cuisine and the thing, you know, you have an example of this hero. Now, this is very, very particular. I give you some pictures initially and then I talk about it. This is a very particular local quote, religious quote, around the grave of Jean-Pierre. So this lovely temple, you know, which you enter is actually very well preserved and taken care of for. It has a, you know, a kind of a fearsome status of Jean-Pierre. It's, you know, this is the guy that came to your swimming, you know, by the side. So, you know, at least you can know something about your future, which is dire.    And behind it is this mouth, which is according to a tradition, a grave of Jean-Pierre. So Jean-Pierre stands as a local hero for London. It's apart from food production, beer production, whatever else, you know, it has its own forms of historical religious cult, which obviously it's not from the third century AD, but, you know, stretches largely, we would say, around Qing Dynasty is being activated. Most of those monuments are part, obviously, for the grave that is historical date somewhere from the, you know, Kanshi Tianan period, where the renovations of temples mostly occurred in this area. And, you know, this is something also with many people who are from outside Sichuan or even outside, you know, they, by each one, would not have been here about whereas people in London and this area would very much know and identify the place with Jean-Pierre. Now, in which way Jean-Pierre is a local hero or an exemplar of something like local history? If you focus on him solely and exclusively as an element of the local history, you end up in exactly in that place where you would not understand anything or actually understand everything wrongly. Jean-Pierre, you know, figure that, you know, relates to the very, not only very broad narrative tradition history of China, but also a historical figure never born in that area, existing for a limited time, you know, whose, you know, very memory and existence have been produced to belong to that space most probably through narrative tradition and its reviving and building monuments to what is a memory of the past, then to the actual presence of some grave.  So, you know, we don't know if he actually is there or it's not there because it's quite controversial or obviously to dig in the graves and also very problematic from the perspective of archaeological works if you want to damage. So understanding John Faye as a local, so this is exactly the place where the local meets we would call it national, is it not national or is it certain cultural realm that is, you know, considered time as where a very broader element gets localized within a particular space where they have their own life and local impact where we through them we can understand how this sort of very provincial reality can live and what is an element of a provincial culture that actually is very deeply embedded into the broader sets of traditions that make up what we can talk this sort of corpus of Chinese traditions. And here I'm consciously using the word of corpus instead of a word Chinese cultural, Chinese civilization, which would be very French if you call it a civilization. It's always happens, but you know, but I rather come to the sets of elements that are not necessarily very much connected to each other but that coexist to the other and came out to different strengths of this tradition. Yes, elements in corpus don't have to be in a clear relation to one another. And that's very much, you know, at least for me allows me very much to understand how a broad and long tradition can live, yes? And so obviously then looking at John Faye, and this is not, you know, John Faye is just one example, but I could give you, you know, Du Jiang Yen's, you know, the story of Arlang Li Bing, yeah? So another Arlang, the famous black-faced god, you know, which is a very ferocious, you know, cultural hero in some way and very much connected to Li Bing, which is the official of the Qin dynasty that created a whole dam system that divided split rivers and then provided irrigation to the Chengdu plain and started the Chengdu tradition. You could also use this kind of example, yes? So Li Bing, Arlang, you know, they get mixed together, you know, within a very complex, a bit obscure cultural tradition in these very important works of empire building by the Qin dynasty, yes? And they have both the very local faces and the one that integrate them into broader unity of the country. And I think from us as a historian, this kind of example exactly points us to the difficulty of studying provincial histories in China, but then I could leave China and start throwing you examples from European history of exactly the same quality, yes? Where the networks element of history may overwhelm, in fact, the local particularity. However, nothing in human activity is not local, yes? We only exist in one place in one time, yes? So we need to keep that balances. Well, the second example for which I don't have pictures before we move to one of the pictures is the one coming from Sichuan opera because I spent so much time troubling myself with Sichuan opera. It does that know a little bit about it, know that 70% of the scripts in music comes from the tradition which is called gao qiang, yes, gao like five, yes? So we can qiang, we can call it as a tune, as a voice, as a set of melodies. Well, there is a very big problem with gao qiang and this is the one where that entirely damages much of the writing of province-centered histories of opera music or Chinese performers of tradition or tradition in general. And one of these problems that gao qiang does not originate from Sichuan, it originates from Jiangxi, borderline ahue. It comes with the migrations, different migrations because so many of the opera tunes and opera tune traditions anyway under the yi yang qiang or gao qiang migrate northwards and along the westwards, with migration of people. So we can see these Jiangxi traditions influencing both what later on in its history grew up as northern tradition of opera and later on south of it from other mixed incomes, Beijing opera, but gao qiang moves along the yang qiang with migration of people and ended up being in Sichuan. It brings with itself a set of scripts but also a particular way of music, it's largely percussion and singing, yes? It comes with also certain dialectical twists. The one that ends up in Sichuan and builds it up into Sichuan opera comes from Guang. So again, we've already jumped three provinces as two regions, three provinces, but it is a real somehow a story. So how local then is gao qiang to Sichuan? Well, it obviously is because it is later on, obviously in the 20th century on the, it's integrated as the musical troops started singing in different tunes, the five tunes to Sichuan opera and simply Sichuan opera troops when Sichuan opera appeared in the early 20th century, when it commercialized started to sing in all the five tunes and 70% of the script was gao qiang. And it was much closer to the ones which is sung in Hubei and Hunan. And that's where we get to all sort of problems. Wait, are we talking here about classifications of opera so centric as to the performance culture of China, the Chinese culture? Or can we sweep away these provincial names and start talking about people? So let's sweep them away. And then you think of a big migration from 17, late 17th century, there flows people along the Yangtze and the population of rather depleted Hunan, Hubei areas and later on Sichuan get also colonized by people speaking and singing because they organize religious festivals or press in a particular dialects. Yes, they called it gao qiang because it was high pitched kind of voice with a percussion. These people typically settled in Sichuan. They settled in there at the end in the villages where next to people who they knew. Yes, and they circulated their traditions with the growing and growing in decades and decades communities among the people they knew who could speak that kind of a language. And at the same time, enjoy this kind of opera, the stories related to opera and the stories to the religious holds to the gods. This opera was celebrating. And so we ended up with a horror for somebody who loves provincial stories or getting history of China cut into provinces because it's something that entirely breaks up all the borders and shows you how through language, through travel, through movement of images of culture, in fact, you have certain integrated realms along the routes of transportations and networks of people. In this case, riverine networks that brought people along the Yangtze to repopulate Sichuan and then spread around along main rivers in the China. And so, you know, so we just crossed out particularity of religious cults, no particular culture, particularly of local dialect and tradition out. Well, at least Sichuan has to have something to be focused on it. Let's say warlords, oh, Sichuan warlords. Yes, everybody loves Sichuan warlords. Sichuan warlords mostly came from the family, from your family. Yes, the famous yos of Sichuan, all of them settled in this lovely city, Da'i, is the big county, and in Da'i, there is a small town called An'ren. Yeah, it's kind of south of Chengdu. If those who goes to Chengdu haven't gone there, you'll have fun. Now, so what's up with the yos? Here's the elder of the yos, had the modest house. Here he was, yes, in Zhongxian. He had three sons. Those three sons have been slightly more fertile, so they had more sons and more sons and more. Of the most famous of them, those that love is Liu and Hui, Liu and Cai, and their younger cousin, Liu Xiang, even though he was an younger by age, but it's just how it came on. Now Liu Xiang, yeah, yeah, you should see the arrow. Now Liu Xiang has been the warlord of Chongqing for most of his career. He sat on the city of Chongqing, like a spider on the middle of the web, and because it has been the main source of transporting opium, so nicely produced Sichuan, and so prolifically consumed all around China, so his purse was never empty. And now these two guys had other stories, Liu and Cai and Liu and Hui, and one of them became basically kind of a viceroy of Xikang, and it's very close to what you guys study, so Khan Xikang, where he built his own Leluyiniaans on the capital and lived there happily ever after. And not really, because then there came a communist revolution, and he deflected to the communists. The previous guys, Wencai and Liu Xiang, had a happiness of dying before the communist revolution, whereas the brother, if he's actually deflected to communists in the last moment, handed up the province, became a general of the communist army, became a celebrated hero of China, and died in 1976 in a hospital, 76 or 70, I don't remember, in a hospital in Beijing of all the age after splendid career on top positions, meaningless, but top positions within the People's Republic. He never lost his crown. Now, the family has, you cannot see this, largely conceived on that bed, was all these large children, and so the first of them, the one who's ruler of Tibet, it has this very lovely view now. So just as first I show pictures, I tell you what I want to tell about him. So it is he being a, Wenhuai, yes, your Wenhuai, the one of Xikang, he had this lovely palace with beautiful classical and neoclassical kind of 1930s China, makes things, there's even his sculpture, sitting with his wife and happily watching opera being played for them as an entertain themselves. He had this double room, so one room, just one next to another, has elements of a traditional Chinese household where he consulted on important issues and in order to take care of their motherland here, sure, and in other on the couch, he was sitting under the shining star of the chairman Mao. And now the other villas, that this is the ones belonging, as far as I remember to Yuxiang, it was slightly more modest, and this one where you enter along to the Yuxiang Wenhuai, who is exactly the same kind of warlord and all the others of his cousins and brothers, but he depicted himself as one from the flock of the tigers. I guess it's him and his brother, as the one that was a good communist as well supposedly. And this, you know, it's deep devotion to republicanism of every sort in China, so elegantly managed to use a bit of elements of modern sculpture addition to a classical art. And it's very interesting and I'll talk about it. If you look at this villas, it mixes classical Chinese palace with a European villas. So it absolutely mixes different elements, as you see in a way that is familiar to anybody who likes to visit sites from this period. So obviously, you know, it's very neo-traditional, but at the end, and I'll come back to it, his villa became unsaved during Cultural Revolution because it was filled with a gigantic sculpture of the evil warlords. And this is this very large sculpture composition, much larger than this room, showing how warlords here is surrounded by his cronies. It's, you know, taking from people their wealth and you see the anger of the righteous masses that they would stand up and do what Mao Zedong said, not only when you equip them with guns and pumps, then the revolution can happen. So if any of you harbor any needs for upturning social order, you know, the chairman told you that you need a certain tools to do it, and then it all works just fine. And so Leo's, yeah. But then, you know, you'd think that standing Leo's of UNRAN, you know, that was their ancestral ground, they would be very local, yes? And you know, these are the Sichuan warlords, the famous Sichuan warlords, the guy that came out of a big flag Sichuan for the Sichuanese, you know, they held to their power, they actually managed to kick away many of the official, specialist merchants and so on, who came from different regions of China in the 1920s, promoting locals for this sort of local nationalism. So here you have finally your nationalist hero, if not a little problem, but one of them was ruling Shikha. And it was equally locally nationalistic to Shikha, that, you know, he lived in agreement with local come warlords, as local warlords, in order to build a local, Tibetan, Shikhangish kind of nationalism that was presided by this Han warlord from the Leo family.  Also, Leo's have exhibited a great flexibility. They never really cared about localism. Localism only served the other purpose, getting to power. It was a great way to build their, you know, fortune. So they, their fortress land, but it was an amazing way than to enter into the mainstream of Chinese politics. All of them became, you know, a vote nationalists. Leo Xiang, somehow had some accident in 1938 and it didn't work for him. And so, but, you know, Chongqing was too important, but generally, and then he became one of them at least the only surviving one became a communist. So it has never been about Sichuan. It has never been localism. It's always been about power, right?  Also just looking at them as the local phenomenon, you know, obscures our rights. I mean, which other families of this period were like this? The Jiangs, the ones from the Jiangjieshe, Zhang Kaisheng. Oh, they're very much upstarts. The songs, very much intermarried with, you know, the Song family, and that had so much. The guys like Jiang Zhulin and so on from Manchuria, they weren't like this. The Guangxi League guys weren't like this. All of them have been like, Lidong Ren wasn't like this, led the president of China. You know, all this localism at the end served various games. So it's just a place of multiple identities and using identities by very conscious players in order to get themselves up. Now, what's about the landlordism? I've heard so much about the Chinese, the Sichuan is landlordism, and Sichuan is warlordism being the most exploitative. You know, you get all the kind of ridiculous figures of how much taxes they extracted, which they did. But also in other areas of China, that time in many other historical periods, different rulers, if they could, did extract as much as they could. And so this figure of the even landlord place in the cultural revolution, you know, so much has been made of it. It's just because it was so good for the particular campaign. It was such a recognizable figure, and it was so easy. And his gigantic villa stood there in the moment of particular campaign. Now, you know, and it's even... So what can you say about them? Really, they were just magnets. As you've seen from Michel and Q, their palaces, their style and life was not like this, but was like this. It resembled in all ways and manners, if you travel to place like Taiping in Guangdong province, you know, where all the rich Huaciao overseas Chinese people were building their villas. If you visit China through that perspective, you'll see Shanghai and so on. How much have you seen it? It's really a kind of a cosmopolitan class that was using a certain objects, material objects, in order to show their own position. And that position required particular purchases and looks. And they've done it so similar to the guys from Caiping in their own places where their clan residence was, their own, you know, the homeland of the particular family, and not in the place where they really resided, whether it would be Beijing, whether it would be Shanghai, whether it would be Chongqing. And so this is really embellishing, embellishing the place where you live. So after even destroying the Sichuan warlords as a form of localism, let's move to conclusions. I think what can the provincial history be? Because I think I gave you enough proof and examples that provincial history is in troubles. And we cannot obviously just trash all the classical handbook-style histories. They're useful. If you pick your seven volumes of Sichuan history, whatever volume you need on history, or whatever other local history, it's useful. It has data. We need them. It's not that they are by themselves evil and that we should never look at them and you should start a little campaign against them. Not so much. I mean, these are handbooks which serve a certain purpose, but they don't belong very much to the tradition of analytical history. And we need to look at them with a large, not a grain of salt, but a track lock of salt, yes? And in order to us to see how this data can then be fed in a much broader analytical network in which we really research what people did. But we obviously cannot have everything in one place. So I think that generally, if you think about any kind of provincial history or history that is more local, we should first of all look, we should look how people network, even though they're local and if they're formed locally and they act locally, we should look at the way these people network outside and beyond the administrative networks within they exist. How they interact across the border and how their life is shaped and not how administrative borders form their lives. So we should turn the picture, not look at them, let's say, I don't know, life in Hubei, but a human who acts from there, yes? So the Hubei shouldn't be a limit by kind of information that provides us with context. We should be very much sensitive to transfer to networks, to contacts, to circulations and the various usages of local environments. And especially, so we shouldn't think that the environment is the formative, easy explanation, but the way people interact with those various elements of their social, environmental, geographical and political contacts. Because if you lose from sight, the real action of people within it will just be replicating the history written by administrators or some kind of chopped up data that exists within the administration. If we focus on a bigger topic than just people, something like a defined space, a village, a city, a county or even a whole province, yes, we should not lose from sight the existence of the broader world beyond it, yes? The cities and also the comparative scales. As we had a moment in writing Chinese history or writing city history or Suzhou history, Shanghai history, lot of Chengdu histories and so on and so on. The problem is that if you get all this history now side by side, you'd see that very often to just say the same history. And this is where the problems start arising. If they speak about very simple, similar histories, then perhaps there's something wrong in writing this kind of history. Maybe this should be a much more interactive history or much more problem-based history or maybe this unit as a city does not really help us at all because those units should be very much questioned. If you look at the institutions of social life, such as temples, festivals, rituals, why even food habit? And we should not give to a false dream of uniqueness. And that's uniqueness that very often comes from the wrong mix of anthropology and history, yes? A wrong, what I mean by the wrong mix is that you use the anthropological methods in order to get a very in-depth study of something, but I'm finishing in one minute. And then I know you're haunting on me. But then at the end, we miss the fact that the cult can be so pro-regional, we miss that the cult exists in a various context or simply that can exist even outside of country because social functions that underline the cult can exist even beyond a particular culture. And that's what we should also ask ourselves if something would happen in Chinese temple, resembles what something would happen in a Catholic church, maybe we shouldn't pervert the topic, what is in this temple, but think about why people perform something and ask a different set of question to understand what we actually see. So I would say that the province is a provincial history can be a first subject, but it's a subject that requires a lot of context, a subject that requires us to have a very much open eyes about cultural, social, geographic and political, environmental issues that are connected to it. And the one where we should be very much aware that if we look at it, we're not gonna find provincialism or we also not gonna suddenly discover the holy grail of unique history that nobody has ever written or something that would give us the sense of pristine localism and then which then might seem as a truer or other view on history. That things typically don't happen as we are social creatures and we always exist in context of us. Thank you.


Greetings everyone, today I, Sohani Goyal, and I, Divita Mathur of Sun City School, present to you Caterpultinate, the ultimate catapult. Today we present to you Caterpultinate, a project that will alter your views of Newton's Third Law. Millions saw the apple fall, but Newton was the one who asked why. Firstly, to begin this presentation, let's understand some history. Sohani, you do know that we're here for physics, right? Of course I know that, Divita, but there's a lot of history behind physics as well, a lot of history behind Newton's laws. Sir Isaac Newton worked in many fields such as mathematics and physics. In 1666, he presented Newton's series of gravitation, and in 1686 he presented his three laws of motion in the Principia, Mathematica, Philosophia and Naturalis. Through his contributions to these fields, Newton revolutionized science. That was quite informative, but why don't we look at some more real life examples now? Okay, that makes sense. Let's start with a real life example. Hey, what is that for? This is a perfect example of Newton's Third Law, which states that for every action there is an equal and opposite reaction. Over here, action and reaction refer to forces. If object A exerts a certain amount of force on object B, then object B will exert an equal amount of force on object A in the opposite direction. The action here was me hitting Divita, and the reaction was her hitting me back. So honey, that's not a good example. Maybe you're right. Let's look at some instances of the Newton's Third Law in our daily lives. Firstly, there's playing basketball. When we dribble a ball, the ball exerts a certain force upon the ground. A rocket produces thrust through action and reaction. The engine produces hot exhaust gases which flow out of the back of the engine in reaction and equal and opposite force is applied. All of us walk and run every day. When we walk or run, we exert a force opposite to the direction of motion on the ground. And according to Newton's Third Law, the ground then exerts a force on us that is equal and opposite to our force. When a plant pushes its roots into the soil as an action, the reaction is when the soil exerts an equal and opposite force on the plant, providing anchorage and support. Divita, wait, I just realized, Newton's Third Law can be applicable to technology as well. Uh oh, here she goes again. Come on, Divita. It's a good example. Trust me for once. Fine. What is it?  My friend's reaction is to like my posts. No. But I suppose you're right about the technology part. Newton's Third Law can be applied to technology-based gym equipment. Gym equipment is mostly pulley-based, so Newton's Third Law of Motion can also be used here during workouts. Oh, and not to mention wheels and levers. They're all based on reaction force. This is the driving mechanism for these gadgets. True. Now, for our experiment, we will be displaying a catapult. A catapult is a ballistic device used to launch objects at high speed. Circling back to some history, catapults were used in ancient times as military weapons. For all the history lovers out there, do you remember the Greeks and ancient Romans? They used a crossbow-like device known as a ballista. While this is similar to a catapult, a catapult usually designates a larger engine with a long-throwing arm that throws rocks. Modern mechanisms using hydraulic pressure, tension, or other force to launch gliders, aircrafts, or missiles can also be called catapults. Divita, I'm sorry to interrupt you, but I wanted to make a joke about catapults.  Get it? A long shot. Um, okay, let's just move on. The objective of our experiment is to prove that a catapult uses Newton's Third Law of motion-manflinging an object. We used ten ice-cream sticks to which are wide and eight of which are narrow. An eraser, which is used as the weight of the payload. And elastic bands. Firstly, we take the eight narrow ice-cream sticks and put them together in a pile like this. Now tie one rubber band at each end tightly to put these ice-cream sticks together. Now, take one wide ice-cream stick and put it in between the top two narrower ice-cream sticks like this. Now take another wide ice-cream stick and use it as a base below and tie these two wide ice-cream sticks together. So before we understand the physics behind catapults, let's first look at its parts. The pile of eight ice-cream sticks over here is the fulcrum. The rubber band at the front is the counterweight. The ice-cream stick on the top is the throwing arm and the ice-cream stick at the bottom is the base. Now that we've understood the parts of a catapult, why don't we have a demonstration. Firstly, we take the eraser, which is known as the weight or payload, as I mentioned before, and we pull the arm of the catapult downwards. Here the elastic bands are stretched tight, which has potential energy. When this is converted to kinetic energy, the eraser then goes loose, throwing both the arm and the eraser. Over here, the action was when we applied a downward force on the throwing arm and as a reaction, the throwing arm applied an equal and opposite force on the object, thrusting it forward. In larger catapults, such as a ballista or a crossbow, which were used in ancient times, we can see that they have a bigger fulcrum and a bigger throwing arm. I can assure you, if we threw an eraser from a ballista, it would go way further than from our little catapult. Lastly, the result of our experiment. We can conclude that a catapult does use Newton's third law of motion. Thank you.


I saw that mainstream coaching was out there teaching scripts and teaching strategies. All that is designed to figure out what the client can do for the agent. Now what I'm doing and why I'm even here tonight is I'm on a mission to help reduce the failure rate in the real estate industry. Okay, so the way that I want to do that and the reason I started writing books and speaking is because I saw that mainstream coaching was out there teaching scripts and teaching strategies and everything was directed. If you really look at those scripts and you really look at the strategies behind the mainstream coaches out there, all that is designed to figure out what the client can do for the agent. Think about it for a second. You know hey Mr. Seller, this is selling so down at whatever realty. You know I was calling the neighbors in your neighborhood. I didn't know if they're you know you'd consider selling your house. It's like you don't even know me.  I'm trying to make me some money.  Well cool man. Do you know anybody else? You know anybody else that might want to sell or you know do something to make me some money? Not worried about you anymore. Let me just move on over to somebody else that might be able to make me some money right? And that you know it's like handle objections and the whole nine yards man. I mean it's almost like how they handle objections to get you to join their coaching program. I don't want to get on get into all that but what I'm trying to do is teach agents how to communicate who they actually are as a person because those scripts are designed to to they're designed really and what happens is prospects run away from you so fast because they smell the the the commission breath the desperation in your voice you know whatever it is it's just not you.  I want you to use that to communicate to people who you are why you're there right and build your business on that personal brand.


Yes, please welcome our next speaker, Tim Mackey from BlackDuck Software. Hello, everyone. Can you hear me OK? I press the button. Awesome.  OK, so today we're going to talk about something that is not really covered all that much in the DevOps space. You hear about DevSecOps and that sort of thing, and this is kind of like trying to bridge the gap between the mindset of an operations engineer or site reliability engineer and that of a developer. And so there's a lot of content in here. I'm going to try and make certain that it fits in. If we're really, really lucky on time, I have a demo at the end. If not, please see me later. So a little bit about myself. My name is Tim Mackey. You can tell by my hair that I've been around a little bit. My last most recent job before joining BlackDuck Software was as the Zen Server community manager within the Citrix open source business office. I've been with BlackDuck now for about six months. I do write code occasionally. I used to say that I write it in anger in order to prove a point. I also write it for cool projects. And that's some of the code that I'm going to talk about today as well. My current preferred language is the new hotness of go. Java is so far behind. And if you want to hear something about the cool things that I've done, I'm very much willing to talk about it over beers. You can find me on Twitter. Almost every deck that I present goes on my slide share. This one will be on my slide share probably tomorrow. And I welcome LinkedIn connections and so forth. So everyone, please put your hands up. I believe in interactivity. Please put your hands up. So put your hand down if you've never built a Docker container. OK, cool. Put your hand down if you've created a base image yourself from scratch. That it's not you brought in from someplace else. You've used your own base image that you built from scratch. You've installed only software that you personally built or you personally know the person who created that software. You have performed a static analysis, fuzzed, pen tested that software every single way. You've never deployed a long running or production container. So guess what, guys? All of these things, you're vulnerable and you probably didn't know it. So that's the basis behind this talk today, how to identify what you've got. And so no security talk on the planet would ever be complete without the person in the hoodie. I probably should change that to Mr. Robot at some point in time, but if anyone's ever delivering a security talk and they do not have a person in the hoodie, they have no credentials. So there is a hosting provider, Telco in the United States called Verizon. Verizon is a very large organization. The majority of their business activity occurs out of an organization called Teramark. And every year they put forth their data breach report. This is the types of activities that resulted in a breach of data in either Verizon services, Verizon managed data centers, or customers in those data centers. And the one for 2016, the one for 2017 probably won't come out for another six weeks, six, eight weeks. They found that 89% of those breaches had some form of financial or espionage component to it. People are trying to find ways to get at the data that they can then sell or manipulate or use. The other interesting aspect of it is not the cost of going and figuring out how to fix this that is the dominant factor. It's the attorneys who are trying to figure out what is the overall risk, and then the forensics analysis. Fixing the code, changing a firewall rule, things like that, those are incidental. Paying whatever regulatory fines, those are incidental charges. The third thing is that vulnerable software is going to be out there for a very, very long time. There are vulnerabilities that have been known to the world. And I'll actually have a slide on this in a little bit. For years that are still prevalent today. And so what can we do as an organization to make this a little bit better? So number one, I'm certain that at least half of you have gone through some form of threat modeling exercise in the past, trying to identify the types of activities that an attacker might use to compromise the system that you're building. The problem with every single one of those activities is that it's theoretical. The attackers decide what they care about. Case in point, the town next to me, year and a half ago, the police department was hit by ransomware.  One, you can back away and say, I don't want to mess with the police. I don't want them knowing anything about me. Sorry, my bad. And make like it just went away. You can stay the course and ask for your ransom, which in this case was 300 US in Bitcoin. Or number three, you can recognize the value of what's there and ask for more. In this case, the ransomware, people didn't have that information or chose to stay the course and the police department paid their 300 in Bitcoin and then went all over the media to say, look guys, if this can happen to us, it can happen to you, pay attention. So when we look at overall systems, one of the truisms is that attacks are always mounted against the application layer. Who here has heard of an attack on a firewall? Who here has heard of an attack on an IDS system, on an IPS system? Those are rare. It's a denial of service, but it's still a denial of service against. And when you do a denial of service against, that's your last-ditch effort. The majority of attacks are actually against applications themselves, and the majority of investment is on perimeter defenses. This is very good for the likes of Cisco. Not so good for the red hats, the SAPs, the oracles of the world. Investing in application security is really where our focus should be. So let me take a look at a potential attack. Again, our friend in the hoodie, I'm going to name him Mike. Now Mike's job in life is to define, design, implement, and release an attack. So Mike has a theory. He has a theory that if I put this carefully crafted whatever or try and use this vector, I'm going to be able to have an attack that's going to be successful against a particular platform. So I'm going to test it. Like most software, it's probably not going to work the first time. So you iterate a few times. Eventually, you find success, or you find a new, unimagined, unplanned for attack vector. Once you have that success, you need to create a deployment kit for it. So for example, putting it in Metasploit, you need to document it, and YouTube is an absolutely fantastic way of documenting any of your exploits. And of course, you want to make certain that this gets the best attention possible. So don't forget the PR department. Fox News is very happy to put any kind of large scale message up on the news, and Sky News and the rest of the world will pick up on it, because sensationalism is part of the media today. If this model looks rather similar to an SDLC, to whatever you're building today, it's because it is. For Mike, this is his business. This is what he does. This is how he gets paid. Forget who his employer is. This is his job. Now if he's a responsible researcher, OK, this is all disclosed, and there's an opportunity to fix the defect in the whole. If he's not, you end up with this particular model. So with this as kind of the backdrop, it's important to understand a little bit about a vulnerability lifecycle. So it starts with who's actually responsible for the code. If we look at a closed source world, Microsoft, or Microsoft a couple of years ago, more precisely, they have an SLA. They have a security response team. They have regular patch updates. The phrase patch Tuesday has become so synonymous with updates from Microsoft that it's just an industry standard term. If you have a Microsoft piece of software or dependency on a Microsoft piece of solution, you know where to go and get updates for it. Flipside is open source, community-driven, no SLA's, broad interest. So let's take a look at a sample update. Now I brought this in from MediaWiki in previous life. I was a MediaWiki admin. And so this is the type of things that we'd see coming out. So this is a maintenance release targeting multiple versions. And specifically, I have things like various special pages resulted in fatal errors. That's helpful. Please note that 124.6 marks the end of support for 124.x series of releases. Technically, this ended a few weeks ago with a release of 126.0. So an end of life statement is put in the middle of a release like this. However, we thought it was prudent to fix the bugs anyway because we're good guys. Open source is kind of like that. You have to know where to look to find what you need to find in order to actually produce an actionable result. So that's MediaWiki. Let's decompose a vulnerability. So last year in February, we had CVE 2015 7547 got published. And for those of you who don't know what a CVE is, it stands for Common Vulnerability Enumeration. There's an organization in the US called MITRE. MITRE maintains the overall list of these things and has a handful of people working on it. Red Hat is one of the data sources into it for Red Hat curated product. So this vulnerability is not ghost. It had sort of the branding of being ghost 2.0. Ghost was a year prior. So bugs reported against G-Lib C. The bug report looked exactly like this. This change causes the pointer variable used in the function to use the wrong size if a new buffer is created after the address has been changed, aka null pointer dereference type issue, buffer overflow over on whatever you want to call it. Standard C badness. The program will crash if the calculated size of the buffer use is 0. This is the bug report. That came in in July 2015. So the G-Lib C team, they took this bug report and they thought about it, triaged it, and ultimately came to the conclusion that this was in fact a security issue. They assigned the CVE and they assigned it on February 16th of 2016. So we had the bug report in July. We had February 16th, the actual disclosure on list. So if I'm Mike and I'm trying to find a way to exploit something in G-Lib C, I'm going to be looking at the list. I'm going to see words in there that look like they're really problematic from an overall system stability perspective. So I've got a whole, what is that, six months to go and develop something against it and potentially target it. Now that particular item also said the bug was introduced in G-Lib C29, which was from May of 2008. So a particularly astute researcher could have had years to go and take advantage of this. Now that's all low risk. When a vulnerability is disclosed, there's a number of ways that it makes it out into the world, one of which is through the National Vulnerability Database or NVD. In this case it came from the cybersecurity awareness system and that is your highest level of concern. That came out on the 18th of February. So there was two day lag between the message on list and this vulnerability being disclosed. And you can see all of what their summary was, which doesn't necessarily have any correlation back to what the defect was. And for practical purposes it's rarely ever actionable unless you truly understand exactly what's in there. So now we have a two day window where there's additional increasing risk for no other reason than some people know about this and others don't. But the end objective for everyone on the offside is to just fix the problem. That's all they really want to do because once somebody knows about it they need to get a fix. So I took the CVE, put it into Google and up came VMware. Now VMware had three dates associated with it and I don't have any highlights in here. The first one is on the 22nd of February. They patched some versions of their ESXi hypervisor. Day later they patched a few others. Day commercial company, commercial software have to run through test suites, pretty normal. Took another six weeks for them to go and back port it to a few other impacted systems that were more legacy. Again, it takes time to do all these things. Not terribly untoward but it's taking longer to get there. So patches need to be available. You find it in your environment, you fix it. That's one vulnerability. They come out somewhere around 10, 12, 15 on average per day but that's one vulnerability. Let's focus this down on something that's even more targeted. So if you've ever heard of an embargoed security announcement or a security note, that's when a responsible researcher goes and contacts an organization like, say, Red Hat and says, gee whiz, but I found this problem. And here's how I believe that I'm going to reproduce it. And this is the badness that I see resulting from this. You guys probably wanna go and take a look at this and figure out how to put together a fix. Goes to the security response team. Security response team goes and works with the researcher. Comes up with usually a reasonable rational timeline for when that fix is going to be put out there but because it's so severe, they're not going to pre-announce it. They're not going to have a set of public list entries that are necessarily going to have it and everybody on the same day is going to get the result. And so this is what one of those looks like. So this is Dirty Cow. And Dirty Cow is a branded vulnerability. There's a number of these silliness things out there but it's also known as CVE 2016, 5195. So this is Linus Torvald's commit message. This is an ancient bug that was actually attempted to be fixed 11 years ago. But that was an undone for problems in the commit itself. In the meantime, the VM has become more scalable and what was purely a theoretical race condition back then has become easier to trigger. So in other words, decisions that were made 11 years ago about when to post-ship triage bump, whatever the term is that you're using for deciding that this particular scenario isn't going to happen in real life, those things have a way of catching up to you. It's kind of Moore's laws against us. So interestingly, if you look up in the upper corner you'll see that Linus was working on this on the 13th of October and posted this commit on the 18th of October. So we have October 18th get ID this vulnerability. Now, Dirty Cow, if you're not familiar with a copy on write condition, all the patches were normally issued at the same time. So Red Hat, Canonical, everyone who was involved in this potential patch stream had their patches available in the same time. Media coverage began at the same time. A lovely logo was created and in fact this one had so much silliness associated with it that there is in fact a Dirty Cow store where you can buy Dirty Cow merchandise at exorbitant rates. Hopefully making sure that nobody in fact buys them. It's 2000 US for Dirty Cow branded coffee mug. But this type of information makes it out there. And if you look at the bottom the date on that is the 21st of October. So exactly coincidence. So there's a three day lag where somebody might have been able to figure out something if they're looking at Linus's commit IDs. But there's nothing to necessarily tie it back. Now, in the US we have this lovely holiday called Halloween. I don't know if that exists over here in the Czech Republic or not. But it is a fall festival full of people dressing up in silly costumes going around and either getting very drunk, having lots of candy, dressing in silly costumes, getting very drunk. Did I mention getting very drunk and dressing in silly costumes? So at Black Duck we have a certain culture associated with us where we'd like to have fun. And one of the things we do is we have a company costume party. And so we have here upstream patch and Bargo expires Halloween. We actually have one of our sales people who in fact dressed up as Dirty Cow. That was her costume. I'm still not entirely certain who's photobombing her but we didn't realize that there was in fact a photobomb happening until we blew this up for the presentation last week. Now if you recall from the last timeline that I gave, there's a national vulnerability database. And I haven't highlighted it on here because we have the 21st of October, we have Halloween, which is the 31st of October. The NBD didn't pick up on this until the 10th of November. So now I have this huge window that goes from the 21st of October to the 10th of November where the only way that you know that this thing is out there. The patches are not only available as either you have a vendor feed. So for example, you're getting it from Red Hat, which is cool. Or you have the media. It's our industry, we know that there are a large number of people who have vulnerability scanners out there. The majority of them feed off the NBD. So they would have this massive gap, huge, huge, huge gap. And so that's an embargoed vulnerability. Now, usually people ask the question of what was our data feed on that? We actually saw it on the 18th of October as well. So we saw the Linux's commit stream. We were able to map it up correctly. So one of the other things that happened in that time window was an a set of assertions about the nature of the vulnerability itself. So for example, on the 21st of October, there was an assertion made that containers were completely immune to this vulnerability. It was not possible to trigger dirty cow from within a container. Therefore, everyone who was using a containerized environment was safe. It was also asserted that anyone who was using KVM was also safe. About three days later, it was proven that KVM was not safe. And two days after that, it was proven that, in fact, you could get to it and trigger a dirty cow scenario from within any Docker container. And it was, I think, another five days after that before it was determined that, in fact, Android itself was completely vulnerable. And there was a subsequent CVE against Android. And so the core message in this is that these vulnerabilities, when they're released, they're not static entities. Mike is out there figuring out things.  And you need to be able to keep on top of that, which is kind of really challenging. And this is one of the things that I'm imploring you guys to do, is to keep on top of these things as you're making your decisions and ask the hard questions of, why do I have this here? What does my configuration look like? Because ultimately, what our configuration looks like helps us to avoid regrettable decisions. So how many of you here have heard about a 620 gigabit per second attack last fall? How many of you have heard about a series of hacked IoT nanny cams and DVRs? Well, that was what was used to mount this 620 gigabit attack.  What was the attack vector? How did they actually get these nanny cams to? So, it was a vulnerability that had been known since 2004 that was in Open SSH, that allowed an Open SSH environment to act as a proxy. If you go and take a look at the allowed TCP forwarding option in Open SSH, one of the things that it says is that turning this value to false does not increase security because you would have to do other things, which were true in 2004. You did, in fact, have to do other things. They're no longer true today. The world evolved and now the default configuration of Open SSH allows for this potential to exist. And so, when you're making decisions around product configurations, you have to make the decisions based on today's capabilities, not necessarily what the timeline looked like or what the paradigm was when the configuration was introduced. Far too often, and I can say this about every single line of code that I've written, I go and I put down a set of assumptions in there, whether it's in a design doc someplace or whether it's actually in the comment block. And at the end of the day, that is a static point in time and the world keeps evolving and I'm usually wrong in my assumptions even though at that point in time I was correct. And I'm certain that that's true for the majority of you as well. So that's one scenario. Scenario number two. MongoDB has gotten a lot of the press in the last week or so for having some really bad choices in terms of its default configuration. Now, in and of itself, it's actually a secure database service. There's nothing fundamentally wrong with it. However, those people who are choosing to deploy it can deploy it in a manner that is not ideal, such as, for example, putting it naked on the internet. Probably not the best thing to do for your database. Yet, 28,000 instances were discovered of exactly that. And in fact, that was over a week where a new scan capability was added to Subon, which is a hacker search engine. And they went from being able to find only hundreds of MongoDB instances to 28,000 and the number of cents gone up from that and that was on the 9th of January of this year. And the third scenario is, remember how I said that there's vulnerabilities that have been known for years and people still have stuff out there? Heartbleed is two and a half years old at this point. There is no fundamental reason on the planet that someone should be using a version of OpenSSL that is that old on a public phasing service. However, again, Sodan has 100, we'll call it 200,000 websites that they've crawled that are vulnerable to Heartbleed as of the 22nd of January of 2017. Might be test servers. Might be things that are pilots of some form or other. It does not matter. One of the things I can say over my career is that the thing that was put in as a pilot has an annoying habit of becoming production without you realizing it. And so when that happens, you're stuck with all these bad decisions. Try and avoid the bad decisions from the outset. So that's a lot of the scare tactics and security guys like to have the scare tactics and I hope I put a little bit of fun in there. So let's shift gears just a little bit and say what the implications of this are for an agile world. So let's start with a standard scrum process. We got ourself in sprint zero and we're gonna take a look at what's in our backlog. Now I'm not gonna go through like a full methodology in here. What I'm gonna highlight are the things that we need to be thinking about. So I've got the off side, I've got the dev side and I wanna go and I wanna take a look and automate the most of this, the majority. So I'm gonna put all my strategy, my compliance and policy, my standards and requirements. Those are manual things. A human's gonna have to review those.  What are the security features that I'm gonna be putting in here? What are the ports look like? What protocols am I gonna be using? How am I going to be encrypting it? What are my Cypher suites? All of these things need to be decided. What are my attack models? Review all the stories and pen testing will be manual once we actually get through the sprint and have some release artifact. We can however automate some of this. So we can automate the build environment so that we're not building anything different than what should be released. We have all of our dependencies understood. We can automate some of our code review. We can automate our security testing. We can do static analysis as part of the build. We can do some dynamic analysis as part of the build. We can go and trigger off pen testing. So that actually makes it more of a semi manual. And we can also do some of the security features by putting in templates in place that automatically allow for the right decision to be made from the outset so that we don't have people who don't necessarily know the reason why something should be locked down, removed from the decision making process so that the template already takes care of it. And so that's some of the things that can be automated. And I still have one gray block at the end and that's the vulnerability management. That's what we really excel at at Blackduck. And so that's where I'm gonna kind of look at some of this from moving forward. So one of the things that we have observed over the 12 years that Blackduck has been around is that there is a legitimate maturity model associated with how open source components get selected and deployed in an environment. Blissful Ignorance is, hey, I'm building this new project. It's kind of cool. It's mine. I'm gonna toss it up on GitHub. I've got all these dependencies in there, but it's solving a problem for me. I don't ever actually intend that someone's gonna fork that thing. I don't intend that it's gonna be baked into anything else, but it's solving a problem for me. There are absolutely no policies in place when that happens because I'm solving my problem. I don't really care about the rest of it. That's where version management and dependency management, they're not really there. As an organization matures, so I got hired on. Cool, I got a job. I got paycheck. This is no longer a part of my thing for me. It's a little bit of an awakening. And in the awakening, I'm gonna define some manual processes which may boil down to, I'm going to periodically go through a review. I'm gonna periodically in check for updates. And I've got a handful of components that I really care about and I don't really need to worry about the rest. This is where a lot of the world is with containers today.  It's the moral equivalent of going and taking a version of OpenSSL and just running with it. The third level is understanding. Somebody read something up there and the review process needs to be a little bit more automated. I'm gonna create a spreadsheet of stuff. I'm gonna start finding some free tools in there to go and do the right thing. And I'm going to actually do some security scanning. We're starting to see that in the world of containers today. What we need to do is get to the state of enlightenment. In the state of enlightenment, we actually have a fully automated solution to go and monitor for open source risk. Vulnerabilities, versions, license, developer energy, what have you, define your risk metric. We need to be able to get to that point. So if we're gonna design that solution, we need it to work within everything else. So it needs to be complementary to static analysis. It needs to be complementary to dynamic analysis. Static and dynamic analysis is really, really good about identifying and working with the stuff that you made, the code that you wrote.  You're going to focus that on your code itself. Vulnerability analysis is worrying about things such as the components that you're dependent upon as they're releasing updates, as they're releasing information. Now, 2015, a little over 3,000 vulnerabilities and open source components were disclosed. Last year, bump by 1,000. One of the reasons why we're going to see a lot more of that is that there is a very keen focus in the industry on the security of open source software. It's been identified that vendors have a tendency to invest in these things or maybe keep them under wraps. Open source is very transparent and open, but there's not necessarily a level of commitment of energy that you would get from smaller projects or upstream projects to go and focus on the things that you care about. There's this project called the distributed weakness project. And it is specifically looking at if there's a vulnerability and open source component reported there and they'll go figure out who the people are to go and talk to. And it's really putting a security response mechanism behind upstream entities, which is an awesome, awesome thing. So I mentioned about designing a better solution. So number one, if I'm going to look at vulnerability information, I want to make certain I have a broad knowledge base to choose from. So at Black Duck, we've got over two million projects that we actively monitor.  We're watching 8,800, it's probably close to about 10,000 now, but 8,800 websites for types of activity indicative of risk. And we're pulling that all in. And those manual processes, when you are bordering on enlightenment and you had to understand, you might be looking at a half dozen, a dozen, a hundred maybe. We're pulling it in from everywhere. We wanted to find things that matter. GPL license compliance is a huge thing if you're building an Apache project. They're mutually exclusive. There's a lot of different license types, some of which look like they should be compatible, but they're not. So do you have a release requirement that is now challenged by some component that you brought in? I've talked about vulnerabilities. Operational risk. How can you differentiate between a component that is truly stable, there are no changes, versus the developers have decided that they want to go work on something else that's actually dead. Both are stable. One has more risks than the other. Are you gonna see a large change set in your future, some API versioning or things of that nature? Those are huge, huge, huge deals. Does it have a security response process? Those types of pieces of information you wanna put in there. Next thing. If I'm going to put this as part of an SDLC, I wanna actually be able to gate my environment. So it's that if something gets in because of a choice of developer made, or a choice of the developer made six months ago that was perfectly legitimate but has changed since today, that we don't produce any artifacts, that we're automatically detecting that and we prevent the packaging action. So it's that release engineering isn't sending something to test to go and say gee whiz, but this is something I wanna work with. Next thing. Once we release product, I know every single software organization that I've worked in has had this mindset of we've released it, we're not necessarily caring about it that anymore. We've moved on to whatever the next thing is. So that might be my next sprint, that might be my next product, that might be my next version. What have you? I've moved on. Reality is that those dependencies, they're gonna have vulnerabilities that are gonna be disclosed asynchronous to your product lifecycle. So you wanna be able to have an assessment produced off of what was released as well, feed that back in so that you can raise the flag. The instant that occurs, have a JIRA ticket that gets flagged off and sent to somebody saying, guys we need to take a look at this. Of course, integrations matter. I wanna make certain that it all sits within the normal world. But you guys are all, well for the most part red hat people here. So I wanna talk about what we're doing. I've got a specific call to action and an invitation for you guys in here. So the first thing is, how many people just rough show of hands are familiar with OpenScap? Awesome, that's a little more than I thought. Okay, so one of the interesting things as I've gone forward and talked to a few of the field-facing people within red hat, but we got OpenScap. Why do we need with you guys? Our sales people go and say things like, well we've got this competitive thing. It's called OpenScap or OpenScap or how do you pronounce it? Completely complimentary solution. There's a lot of stuff that you get in OpenScap. That will never exist in a black duck world. As a lot of stuff in a black duck world that is very unlikely to exist in an OpenScap world. Perfect example, things that are red hat. Yeah, they're gonna be in OpenScap. That makes perfect sense. But you're probably not going to worry about MariaDB to the same extent that you would worry about a red hat product. We worry about all the other stuff that's not red hat. Both solutions are integrated within Atomic. So if you do an Atomic scan scanner or OpenScap container ID, that'll work perfectly fine.  If you take a curated red hat image, run it through OpenScap, you're gonna thumbs up, you're gonna get some results back. If you take a Docker hub image and run it through OpenScap, you'll get nothing because it doesn't know anything about it. Signatures don't match. With us, you'll get information in both cases. So that's number one. And that was announced last year at Red Hat Summit and we've been jointly running with that. So that's cool. Containers that are being released, they should all go through this dual process. Second thing is around OpenShift. And complicated block diagram, but we're integrating in two areas, on the registry side and on the CICD side. So this is the integrated architecture. So in a black duck hub world, we have our data center, which contains that knowledge base. It's a roughly half a petabyte Adupe cluster at this point. So we don't like trying to ship that to people. Though oddly enough, governments do like to say, hey, we'll happily take your half a petabyte Adupe cluster and we wanna put it behind our firewalls too. So we can do that. It's just why. The rest of everything in white, that's actually within the data center of the customer. So we have this black duck hub. That's just our product. It's a central location for stuff. I take OpenShift and I say that I'm going to walk into an environment that already has OpenShift. There's gonna be stuff in that registry. I'm going to need to integrate with that. I'm gonna need to be able to pull this in. We've got a hub controller and we've got a scan pool. The scan pool is absolutely doing nothing more than taking information from that controller that it knows about those images. And so if you have one image, you have a thousand images. It doesn't matter. It's gonna pull them all in. It's gonna scan them up in black duck hub. We have policy engine in there. Policy engine can flag off of important things like, oh, are there any high severity vulnerabilities in this type of application? Have I done something wrong? Have I done anything that I really wanna care about? Take that policy engine, feed it back into our notification service that then interfaces with the admission controllers. And if you haven't figured out the OpenShift stuff is in red, our stuff is in blue. Of course, there's image stream events that are coming out of Kubernetes and bubbling up. They're going to occur whenever a new build image config or Docker import happens. And so we're gonna tie off with those as well so that we know the activity that's sitting in there. There's also build pipeline that's part of OpenShift. Could be gated so it might fail so that's why it's dotted line. We have a build pipeline engine that we're putting in there too that also feeds off the policy engine. So now the nice thing about all of this is that once this is in place, it becomes exceedingly difficult for someone to go and deploy something that has an issue or to be unaware of something that they've deployed having an issue because the admission controllers can be part of this puzzle.  So this becomes something that is administrator defined and allows for the what happens after release. So our objective in this is not to go and say, oh, well we're gonna stop these bills which we could, that's something we can very much do today. The objective is to say, you're deploying this in production, you need to know what the correct answer is. People aren't talking about this correct answer. Here's a way of doing it. Now I hit a couple slides so I'd be on time but the registry integration piece, that's existing today with the hub control on the pool scanner. The notifications should be done within the next week or so but together we need your help and so this is my big call to action for you guys. We're doing this completely out in the open. Take that, fork it. Help us to understand what the real world of OpenShift looks like because we want OpenShift to be all the success that it can. We wanna understand all the various permutations of configurations that we don't screw it up. If you've got good ideas about how to define the policies for what happens when an image happens to have an issue, we wanna know about it. If you wanna write some code on this, I will happily accept a pull request. This is not an issue at all. If you want some guide, the code's all written in Go so it's the new hotness. I apologize if you're not a Go developer but it's the new hotness because at the end of the day, my objective is through everybody working together we can build a more secure data center and put Mike out of business. Thank you. So I can open this to questions. I can put up a little bit of a demo. It's kind of up to you guys. So I'm gonna start with questions and if it was a little bit of time, I'll throw up a demo. Dang. Oh, yes. Yes. So the question is, can I find a notification as a result of a day zero vulnerability? And the answer is maybe. And the reason for that is we're beholden to the types of research that we're pulling in. So we have a research team in Belfast and machine learning team in Vancouver and they're specifically chartered with expanding our view of the world for what's being disclosed. And as you saw from the two examples around G-Lib C and Dirty Cow, there is activity that occurs prior to disclosure that is discernible. That's what those teams are looking for. So if we know about it, we might actually be able to see day minus one. We do see that a lot. We see day minus one. That's all over in here. So the instant that we've scanned something, the very first time we scanned something, all of the hashes are now known to us. And so from that point forward, we never need to scan that thing again because we know about it. If we see G-Lib C, it's a hash that we've never seen. So let's say, for example, that it's off of a private patch queue that Red Hat maintains. That's a slightly separate issue for us because that hash would not match anything that we have. In that scenario, we can accept the hash. So you as administrator can go and put that hash in because you know that it's legitimate as opposed to some malicious hash and then go and we'll match automatically against that. So for us, that would look exactly like a KB update. One of the things that we're actively working on right now is we don't have as many data feeds from Red Hat as we would like. We're working on augmenting that as well so that we have that data feed coming in such that even private patch queues, we don't necessarily know what's in there but we know that that's something that you wanna have as important. Let's work with that. And so time for a scan, couple minutes. So day zero plus a couple of minutes. Any other questions? Yeah, yeah, note. So we get our note information from a couple of, it's more of a bill of materials problem for us than anything else. And so we do have an integration with NPM and actually if I was gonna do the demo of the NPM portion is not baked in there yet but we have that in our normal scan engine. I just have to put a dependency in for NPM and then I would have it. So yes, Node.js, not a problem. Java, Go, Ruby, blah, blah, blah, blah, blah. We'll get 40-something language is just something we support at this point. Anything else? Who wants to see a little bit of a demo? Who wants to tempt the demo gods? Okay, so I do very much say that this is tempting the demo gods. So if I have done my job correctly, which sometimes I do and sometimes I don't, so what I'm on right now, this is the container development kit. This is effectively the cluster master and I just need to do one thing. Double check that my scanner, oh, that's sad. So if everything goes well, what we will start to see over here is all of the, oh, forgot one thing in here. We are not quite at the point yet of having everything nicely packaged up into a template. And so what's happening right now is that it's done the enumeration of all of the images that are embedded in the registry. It's going and verifying whether they actually exist on the system. So you'll see a bunch of 404s going by. That's normal error messages. We're not pulling down the images if they're not already there, so we don't end up bloating up the Docker machine. And as I've got a pool here I'll move to scan engines and as they're encountering legitimate images they'll run through the scan, they'll upload it into the black duck hub and the black duck hub ends up looking like this. Now let's see if it works this way. That does not look, apologies, I'm gonna duck down. So here's, for example, a scan that we did a couple days ago. So we see the package location, the image ID, and the types of information that are available in here. So for example, this is what some operational risk looks like. There's eight new project versions in here. There's increasing commit activity and so forth. In this case, we're flagging GPL license because we haven't determined whether or not this is something that is going to be physically shipped. It's gonna be an internal service or as a SAS service. It's something that we can define on the project itself. And then a security risk. We'll see all of the maps in here. And so this is one of our sources and it identifies a type of issue that we can go and then go and view the full record on. And you can go through this review process for each thing that's in there, including being able to get things like the impacted projects as well as references for information that we've found so far. And one of the interesting things that you'll see in this particular list appear from time to time is an exploit vulnerability database location. So if we determine that this particular GitHub repo happens to have exploits on a given CVE, we'll highlight those in there as well so that way you can bake, say, Metasploit into your QA process to go and say, well look, we believe we're vulnerable to this. We tested that it was. Let's go bring in all these exploits that have been published and see whether or not they trigger this as well. And so trying to close that development loop with an operations mindset is really what the objective is here. So how am I doing on time? Any more questions? Two more minutes? Okay, if there's no more questions, I thank you very much.  They are American large. If anyone wants one, please do come and grab one. Thank you.


You need a financial advisor with the freedom to focus on your specific needs. Whatever your goals, Reid Potter can create a game plan tailored to you. Call Reid at 432-0777 at Pikeville, Kentucky to learn more. 25 years ago, the Mountain Arts Center hosted its grand opening, which opened the doors for local artists and changed the music and cultural fabric of Eastern Kentucky. In celebration, the Mac will be hosting a 25th anniversary gala Wednesday, November 2nd. From what we can tell, it has been a huge impact on the community. That's what we like to see in arts education and tourism, and it was definitely put here for a reason. It's a staple of the community and the region for the last 25 years with the multitude of diverse programming that's been through these doors. We've been on the stage for 25 years and the past executive directors and staff and partners have just done an excellent job of keeping the Mac on the Mac for all the state and region to know about. The gala will include several guest speakers, dinner and live music. It will also reflect on the history of the center and its impact on the community. A lot better off than a lot of other venues, our size and like our venue. We just feel it's time. It's time to celebrate. 25 years is, it seems like a long time in one way, but it has went by pretty quickly. We are the staple in the arts community. We bring a lot of tourism for the area. That was some of the goals that was set out from the founders and Ms. Billie Jean Osburn and the founding board of this building was to be part of the arts education and bring tourism to the area, showcase the talent we do have in the area. So 25 years is definitely something to celebrate about. Guides to the gala are $75 per person and $500 per table. To reserve your spot call<PHONE_NUMBER>. For mountaintop news, I'm Brianna Robinson.