So my name is Arnold Ross for those who don't know me. I'm part of the open technology group at IBM. I've been working in open source and open standards pretty much all my life at this point. And so I've been actually, I'm one of the dinosaurs of hyperledger. I've been involved in hyperledger since the very beginning. I'm a contributor to hyperledger fabric, and I've served on the technical steering committee for all these years, part of it as the chair. And so more recently, actually a year ago, I started working also in another project of the Linux Foundation called OpenSSF, which you may have heard of, which has to do with security. And although I'm not a security expert, it kind of led me to look into more of the security part of the software industry, and especially in the space of open source. And so I thought it would be interesting to kind of have a look at this within hyperledger. So actually a while ago, I brought that up in the technical steering committee, and I said, I think there is best practices that are being developed and promoted by the open source software foundation, OpenSSF. And I think we ought to look into this. And we created a task force. Hey, Brian, welcome. Please have a seat. And so we started looking into this. I said we should have a task force in the TSC. We got a security task force started, and we started looking into the security spectrum associated with blockchain open source in the context of hyperledger. And it was interesting because we ended up having different types of discussion, some of which has to do with how the projects themselves run and operate. And again, some of this has to do with best practices. And another aspect, obviously, is because especially in the space of blockchain, we're very sensitive to security. And so we had several discussions also of different aspects related to security and the blockchain technology. So today, I thought it would be interesting to have different people come in and it's fairly unscripted. They'll all come one after the other for a few minutes and talk about different aspects of the security space for blockchain. So with that further ado, let me call my colleague Angelo. Please, Angelo, join me. So give a quick introduction. Hello, everybody. So I'm Angelo Decaro. I'm a research staff member at IBM Research Zürich. I'm one of the architects of hyperledger fabric. I'm a cryptographer in background and I'm also in the technical engineering committee. Yeah, and currently I'm working on CDBC, Central Bank of Digital Currency. Yep, thank you. And unlike me, he's a true expert in security. So not just one who plays the security expert at times. So Angelo, tell me a little bit. So you've been involved in blockchain for a long time and with that specific focus on cryptography and security and privacy. So what are the things that you actually are working on nowadays that are related to those spots specifically? Yeah, definitely. As I said, I'm working on a central bank digital currency and in order to have a better privacy is one of the key features for central bank digital currency. So you must have a ledger that protects the information about the users who are transacting even against the central banks. So it's very crucial. In order to do that, we have to deploy technologies like zero knowledge, multi-party computation to protect the keys in such a way they are not in a single place. So we can distribute this load to other parties. And I think blockchain gave us the possibility to deploy finally all these technologies to the wide range. And CDBC, I think it's really a core use case for this technology. Zero knowledge, absolutely. And indeed, I want to invite everybody. Wednesday afternoon, we'll have a session, a workshop, and an entire workshop dedicated to CDBC. We will have Bank of France presenting there for their experience with the technology. And we will also have a focus on the Fabric Token SDK that is the one delivering these technologies to Fabric and other blockchains as well. OK, I was going to ask you what space should people look into if they're interested in this. There's Fabric SDK, Token SDK, and... Definitely the Fabric Token SDK is the entry point for all these technologies. It's a Hyperledger Labs, as you know. So it's pretty active in the first 10 most active Hyperledger Labs projects, so definitely. Does that depend on Fabric? Right now, so it started as an SDK for Fabric, but actually now we extended it to be able to deal with other blockchains. So you write once your application and then you can run it against multiple blockchains. So that's the beauty of it. And you don't have to worry about the zero knowledge aspect because it can be very scary at the beginning if you don't understand the technology. So the developer doesn't need to know what zero knowledge is. So the framework will take care of everything. So Fabric is a beast of misnomer in this case because the Fabric Token SDK no longer depends on Fabric. That's what you're saying. And wasn't there the Fabric smart client also involved in this? Yeah, yeah, actually. So definitely that's another... I think everything started exactly because Fabric is a beast, was very complex to deal with. I know because I'm one of the designers. So it was very powerful at the core, but usability-wise was very complicated. So the smart client is another Hyperledger Lab project that wants to bring usability to the client side and we leverage it also for the token application. So the idea is that really that a domain expert, really just a domain expert should be able to write these applications without having to worry about the cryptographic aspects of it, which are really scary even for cryptographers, to be honest, because all these protocols working together are not simple. Not simple to handle. So having a framework that does the right thing, just what you want, yeah. So this is one of the aspects, yeah. And so since you talk about cryptography and unfortunately the term crypto now has been hijacked by all the cryptocurrency, when I talk about crypto sometimes, I really mean cryptography and people say, you're talking about the blockchain thing and I'm like, no, I'm talking about cryptography, which is a bit of an unfortunate thing. But so, you know, detaching yourself from fabric and all this good stuff that's happening there in the space of cryptography, one thing I actually ask and people keep asking is what happens with cryptography when quantum comes into the picture? And this is the first thing I actually asked one of his colleagues when I met her years ago. I was like, what happened with crypto? And she's like, no problem, oh no. What's the deal, what's the situation? Yeah, very good, thanks. Indeed, so as you probably know, NIST finally decided and to be honest, I'm very proud that some of the algorithms that IBM proposed got accepted, so they will become the standards and they will offer post-quantum security. At least for signatures and encryption. So if we translate this to blockchains, it means that we are covered for the signatures, we are covered already for the hash function, we just, for the hash function itself, you know that we just have to choose hash function with a bigger image, so instead of using 256 bits, we use the double and we are good to go already with the current hash functions. That's the belief, signatures as five, but unfortunately that's not really enough for the more advanced applications. Like, we still don't know how to do very efficiently anonymous credentials. This is something that appears in self-solving identity, but it's a lot also in CDBC because another, you want to protect the anonymity of the transactors, right? So the anonymous credential, it's a primitive that guarantees this thing. Zero knowledge itself, so it also can break for with quantum computers, the old-fashioned zero knowledge. So we have schemes that are post-quantum, but they are still not yet there on the efficiency, but research also, IBM, it's moving fast, so we hope to have a replacement also for that part. Is that, are we done really? So apart the cryptographic schemes, there are also other aspects that must be taken in consideration. So, okay, now we have new keys, new algorithms, but these keys must be understood by our stacks, right? Take the TLS SSL stack, the X-Fionine certificate stack, they really, now I have to understand these keys. So we'll have to see first all these updates of these stacks, and then they will come the updates to the blockchain. So luckily, as you know, for Fabric we have a plugability on the cryptographic algorithm. So we started since the beginning with this kind of cryptogility. So it's easy to plug there to change your algorithms with cryptogility, but yeah, the stacks are not yet there, yeah. But do you expect the plugability to actually work? Because no offense, but you know, there are many aspects in Fabric that were designed to be plug-able, and then when we actually came to try to change the pieces, we realized, well, the APIs didn't really cut it, and we had to react. No, no, for that to be honest, because it's very simple, the APIs. Hash function, nothing changes, signature, it's very simple, nothing changes. And so this is all like quantum resistant cryptography, but people also working on quantum crypto, like crypto using, I'm like, you know. Oh, this is, there are communication, there are algorithms to communicate using quantum physics, quantum mechanics directly, yeah, but this is old fashioned. So I think that they already use it in production. Satellite communication you have already using quantum mechanics, so they can, essentially they cannot be tampered with. So you will see, you will recognize someone tries to tamper with the message. So that's, yeah, that's pretty advanced already. So you still have plenty of work to do. Yeah, let's go, let's go. And I'm gonna be out of the job. To be honest, probably you know, of course, that we have also an IBM, a quantum computer at IBM too. Yeah, that's the first. So that's cool, it's a gigantic fridge, but it's beautiful, yeah. All right, well, thank you very much. I'm taking back the microphone. Thanks for your participation. And now I'm gonna call for Dano, if you would, join me. So Dano is one of the maintainers of the Bezu project in Hyperledger. And by the way, they both also TSC members with me. So Dano, welcome. Hello. How are you doing? Good. Good to have you. So you are in a different part of the Hyperledger ecosystem. Why don't you tell us a little bit about what's going on? What are the kind of things that you're thinking about when it comes to security on your side of the house? Yeah, so as Arno mentioned, I'm working on Hyperledger Bezu. And it's a main net Ethereum client. So one of the very distinct things we have from a lot of the other projects at Hyperledger is we need to worry about the smart contract security and the smart contract changes, and the risk factors that go into there for people who would develop on Ethereum main net. The problems are very, very, very diverse and very problematic for some of them. One particular smart contract bug dating back about five years, often known as just the Dow, was there was a bug in the way that contracts were being transferred. They would commit the transfer and then they would call another contract to do some other effects. And what happened is somebody figured out how to make that second call fail. So it wouldn't detect and revert the first transfer. So in effect, they could slowly leak money out of it. And that is the event that really kicked off a lot of the notion of smart contract auditing of these best practices. Like you never give them the money until you have the tasks that you need done first. That's, I mean, that's like sales 101.  And this is kind of the same sorts of situations showing up in smart contracts. So one of the recent developments in the past few weeks is the Enterprise Ethereum Alliance released a spec called ETH Trust. And it's a collection of some of the best practices that they've discovered that a lot of the auditing firms used as a baseline to start with of some of the things you need to look into as you write your smart contracts. Now most of them, it looks like there's 157 different points and some of them, it sounds like a huge number to worry about. But almost all of them are immediately ameliorated if you use the most current version of the compiler. Because a lot of the things are saying, well, if you use version 8.37, don't use this construct because it's bugged and produces wrong code. Which is part of the, in a constantly moving ecosystem, you gotta stay up with your tools and stay current. Now the simple thing might disable why don't you just always use most current tools whenever you compile anything. Which is what I'm used to in the Java world. If there's a bug in the Java VM, you just upgrade your Java VM. But some of the requirements that they have for compatibility with some of the contract libraries you're using with, sometimes they are locked into a specific version of the Solidity compiler. And there's issues with supply chain attacks and provenance, why they need to use a specific version of the contract in its hard to upgrade. So in this specification, they'll at least go through and enumerate if you're using this version of Solidity, you need to look out for this particular problem and this is how you would fix it to make sure that you're not impacted. There's also other higher level issues like the issue I was talking about where you make sure that the reverts are atomic before you're gonna do calls to other items. So you don't accidentally leak out money. And there's all sorts of others. Well standard practices.  And the higher levels that involve actually getting humans to audit it and look at it and have good standard develop code formatting and linting. And there's just the level of, as a developer some of these security recommendations just make me all Twitter paid it because it's like, oh my goodness, code linting and keeping your code clear is actually a security impact. Now I know how to get my manager to change those things. This is needed for security. This actually is not specific to the blockchain space, right? I mean, this is something OpenSSF talks a lot about. There's a serious lack of education in the space of, you know, safe secure programming. And of course, it's very detrimental to the blockchain space when it's smart contracts. I mean, there are regularly there are attacks, right?  And so is your opinion that, you know, it seems like, okay, people are recognizing this is a serious problem and they need to bolt down the technology and have people get the proper education and the right tools to really do a better job? Yeah, I think they need the proper education and the right tools. Because you notice all these hacks very, you know, it's the number of repeat attacks versus novel first attacks. There's a lot more repeat attacks. It's not often that you'll see a novel new attack. Probably the most novel one I've seen recently was the Nomad and it was some issue with the way that they were doing their math with their, with their Merkle tree proofs. And it showed up as a regular old code inspections like you didn't check for Null here or it was some very simple thing that they had persuaded themselves wasn't a big deal but it turned out that that was, you know, it was even, they found it in audit and they even ranked it as low.  But that's the exception, you know, that's a new attack. That's a novel attack. A lot of these attacks that are coming through, they're just rehashing the old attacks. So that's one of the values that the auditors do is they have the catalog of all these old attacks and they'll run it against your system and make sure it doesn't work. I mean, stepping away from smart contracts, stepping into actual basic code. When we had the Tavor audit a couple of years ago, they noticed that we had the GraphQL. So one of the things they did is they just went to their GraphQL library, ran all their set of standard attacks and they actually found something that both Geth and Basie were vulnerable to if you exposed the GraphQL. It had a very simple fix in the way you do it to keep this loop from going on forever. You just had to stop the loop because it was, it was a, you either need to make your GraphQL an acyclic directed graph or you need to have some sort of a waiting to make sure that it doesn't loop forever and produce large, ridiculous sums of data. But that's some of the things that these auditing firms do is they have much larger catalog of smart contract attacks than you can keep in your head. And that's, you know, at a base level, at the lowest level of audits they do, that's what they do is they just turn the Gatling gun at your system and just fire away everything that they can. You know, after they've done that, if you're still standing, that's when they'll get really excited to say, ooh, I gotta get creative to figure out what's wrong. But so, and so from a project point of view, you're talking about Bezu and that's one of the things I was talking about. I, you know, I'm trying to bring some of the best practices that are developed by the OpenSSF. How do you think that, you know, Hyperledger handles that and especially in the Bezu project when it comes to like vulnerability disclosure and so on? So this is something that we're trying to get, you know, our hands around. But one of the things a lot of the projects have been doing is they've been using the GitHub advisories. We have an email address that all security vulnerabilities are supposed to be funneled through. We have a committee of people who are look at the vulnerabilities and filter it to the right person and get the right response. Some of these vulnerabilities are just, they're not vulnerabilities, they're misconfigurations of some service that just needs to be set up and it's not really vulnerability. Some people are fishing for just dollars. But on occasion, you'll get an absolute gem that comes through. There's one that I'm working on. It didn't, that we got a vulnerability announcement that's gonna come out in the next little bit from Bezu. It's been patched. But while it was unpatched in those networks, if you knew what to do, you could bring it to a halt. So based on that, you know, what we're doing in Hyperledger is we're making sure that the vulnerabilities that get reported get routed to the right people and if they're ignoring them, I noticed that Ry Jones is really good at knocking on the door and saying, are you gonna do anything about this? Absolutely. Yeah, because in the responsible disclosure, it's an agreement between the two parties. I'm gonna disclose your vulnerability and I'm gonna hold off telling the world for 30, 60, 90 days while you fix it. And if you're doing nothing with it for 30 days, these are security researchers who, that's like a feather in their cap and they find a vulnerability. They're not gonna sit on it for a year while they wait for you to get your project plan together. If they don't get what they need after 30, 60, 90 days, they're gonna release it because they did their part of the game. They talked to you, they gave you your time and for a vulnerability like this, if only a few people know about it and are exploiting it, that's not the best situation. Either nobody needs to know about it or everyone needs to know about it and the responsible part of that disclosure is once you've let people know about the vulnerability and you've given them sufficient time and they're doing nothing, you have an ethical duty to tell the world. All right, well, thank you very much for your participation. I'll take back the microphones. And that's a great segue to Brian Bellendorf. We have the honor to have Brian here who doesn't need any introduction I think, but you can still introduce yourself. But one of the things we're talking about, responsibility disclosure, OpenSSF actually as part of its work, published a couple of guides on that point. The first one was to actually help projects, OpenSource projects adopt proper policies on how to handle disclosures. And then we just recently published another guide which is kind of the opposite of this, which is for finders of vulnerabilities, how to interact properly with an OpenSource project. So Brian, please, welcome. Hi, hello everyone. I think I know about half of you in this room at least, if not more, good to see many of you again. I stepped off a plane about 60 minutes ago from San Francisco, so I thought I was looking a little greasy or whatever, but. You're doing great. Okay, great. And yeah, it's really great to be with my community again. The community spent five years in until September when I stepped over to go lead the OpenSSF still within the Linux foundation. Yeah, so. September last year. September last, wait. Very September, right? Right, so actually it was like October last year. But anyways, yeah, so we'll be announcing the finders guide for CVDs tomorrow, which is intended to just help everybody who's crawling through code look for stuff. But OpenSSF has, it's like a circus. There's lots of different things going on, most of which are actually not software. We have a few software projects like Sigstore, which is a signing authority inspired a little bit by the lightweight key distribution mechanisms used by Let's Encrypt to try to sign artifacts through the entirety of the software supply chain. We have a specification called Salsa and some software to implement that, which is intended to provide for degrees of confidence and levels of attestations throughout a software supply chain. But a lot of what we do is guides and educational materials. Training courses actually that have been put up. And one of those is about a 20 hour course on writing secure software. It's something that is just a compendium of the kind of gotchas and the kind of common mistakes that software developers make, such as don't trust user provided input ever at all. Don't use it for database queries, right? Hello little Bobby Tables, for anyone who knows the XKCD comic. But most importantly, don't parse it for format strings, which is part of the mistake that the Log4j developers made. And if anything kind of the Log4j incident, which I prefer to call Log4shell because Log4j is the name of the community, Log4shell is the name of the compromise, unfair to tarnish the developers with like that mistake. But it was so symptomatic of a lot of systemic issues in the open source community. And in a way it helps serve as a galvanizing kind of force for us in open SSF to go, wow, there's a lot of different angles on how things are broken out there and maybe we can have an impact on that. But so you kind of started talking about different things that are being done at open SSF, but I mean stepping back a little bit, what is the mission of open SSF? Maybe not everybody is familiar with that. I'm sorry, the mission for open SSF is to improve the state of security and the default state of security in open source software and across the software supply chain. The difference between open source software and the entirety of this software world is getting to be smaller and smaller. About 90% it's claimed of the average stack of code, whether that's in a phone or on a server or a car, is pre-existing open source code. And when something like Log4j hits, it becomes a vulnerability that can be exploited not just on Apple iTunes website, but also on systems that run nuclear facilities and water treatment plants and apparently door badging systems also were vulnerable to Log4j. And it's something that not only do the Log4j developers care about in the downstream redistributors and the end users, but also folks like the National Security Council in the United States and other national governments who kind of asked, is this the ordinary state of things, you know, kind of a leading question or could you do something better? And in a way, the open SSF has become the, how do we as a community organize to try to do something better? Yeah, absolutely. And I very much like your statement about open source because a lot of people say all open SSF is about securing open source software. And I say, well, it's really open, it's software in general because indeed, there is no software out there anymore that doesn't use some open source. And as, you know, Daniel was touching on the point that oftentimes you have dependencies that the problem come from the dependencies. And, you know, we've seen it and a lot of companies will admit that in the case of Log4j, for instance, the first challenge is, do we use this? Where do we use it in our products? People don't often even know what they have in their product. And if you use any modern programming language as some packaging system where you have some import mechanism that will allow you dynamically often to just pull out a whole ecosystem of packages that are maintained by different people you don't necessarily know who they are. And this is a real problem and we don't even know what's in our product. L-S-L-R, pipe to grep, doesn't work anymore if it ever really did for stuff that's compiled into jar files and the like. So, and getting there after the fact is really hard. And that's one of the reasons why, I mean, one of the 10 different things that we're hoping to have an impact on specifically calls out S-bom, software bill of materials. It's not a magic pixie dust, it's not a silver bullet, whatever metaphor you wanna use, but it is a key part of trying to understand what enterprises are running and get a picture of the risk of software in body and side of that. It's kind of like the ingredients on the back of like a ketchup bottle, so that if you're allergic to paprika, you know that there is paprika in there, right? That's what S-bom's are intending to address. And so, OpenSSF, as you were talking, there's like a lot of education material, there are guides, but they're also tools that people can use, right? So, we've developed a software system called scorecards, which attempts to analyze repositories and look for certain practices within those repositories.  Now, what it can't really tell us are you meaningfully using fuzz testing, right? Are you actually purchasing the very noisy results that you'll get from fuzz testing? Have you actually adapted it to your inputs and looking for the right places? But at least can tell us your build system invoking, you know, OSS fuzz or one of the other fuzzing tools. And if so, it raises your score a little bit. And so, there's all sorts of other automated things you can do. There's another thing called dependency pinning, where what's kind of considered a good practice, especially in certain ecosystems like NPM, is to fix a certain dependency version, a certain version of a dependency so that a rogue update caused by somebody who's stolen some credentials doesn't cause your website to go down your next build the way that happened to a lot of websites that use the colors.js module that got hacked one. Or no, I think that was turned into actually like a protest where, if I recall correctly. Anyways, but there's other, that's kind of a compliment to the best practices badge, which is not an automated tool. It's more of a questionnaire for projects to fill out. And I think most hyperledger projects have filled out the best practices badge and some of them are passing and some are still on their way to passing. It's not a perfect picture, but that's part of why I've been trying to, I have my own microphone, so you don't have to worry about it. And I've been trying to bring that up into hyperledger so that we also are good citizen in that space because a lot of this really is going to be about, getting people in all these different projects, there are so many open source projects out there, right? To do the right thing, because it's not like OpenSSF alone is going to go fix all the problems all over the place. We just can't scale to that level, right? So it's really has to have that kind of snowball effect where we're going to try to give people the right tools and the right education so they are sensitized to the problem and they can go on and spread the good word and hopefully start doing the right thing.  I mean, do you look for like numbers of GitHub stars? You probably look for, hopefully you look at least for like a development team that's responding to comments made by users and cutting a release, maybe at least once a quarter or something like that. But do you look for projects that have, I've been third party audited, right? I know that's something that certain projects like hyperledger take as a priority when it before is something gets to a one dot or a dot zero release, right? But most open source projects actually don't even have the resources to pay for third party audits. So how do, so one of the things we are looking at or ask ourselves or put some plans around is how might you help inform people when they're going out and looking for a Java logging framework or a distributed ledger framework, right? How do you compare apples to apples against not only the automated tooling like Scorecard, which has now been used to score a million different repos, I should have mentioned that. And Best Practices Badge, I think has hit 15,000 projects have kind of taken this kind of self-attested course to other kinds of attributes, right? Security attributes and look at it at one place, maybe even think about something like a credit score for open source projects based on whatever objective data we can get about the integrity and the likely security. You can never guarantee bug free code or have automated ways to find all bugs, but you could at least help inform people on what is likely to be the next log for J? Or what's the thing that they simply want to look a little bit more closely at? Yeah, I mean, on the question you were asking earlier, how do you trust certain software, certain project? I can say that I was talking to some big agency in the US not that long ago, and they were telling us, oh, we do this analysis and we look at the Gita profiles of people. And I was like, but I do know who's behind it. And well, they didn't know. So this is the kind of stuff people do. Which is not unlike how it was, I mean, not to play the old-timer kind of card, but like when you and I, we're at similar age, first started using software and using open source software, getting to know that people behind the project was a key part of trusting a project. And that scales to a certain level, right? It scales to a couple dozen major things that you're using, but not to the thousands of dependencies that are now included inside of something like Kubernetes, which everybody then uses. So part of what we need to figure out is how do we take these social kind of cues that we look for and data that we just kind of use to form a gut instinct around and turn that into something quantifiable, something that serves not only to help the people consuming open source code, but also help the developers understand what can I do, both to appear to be improving the trustworthiness of my code, but also actually improving the trustworthiness of it. All right, well, we're out of time, but thank you very much. And by the way, so if there are people who are interested, you can look it up and there is an open SSF day for those who are subscribed to also the open source summit tomorrow, right? Yes, lots of competing stuff going on this week, so I didn't want to compete with you, but open SSF day, Europe taking place tomorrow, nine to five. If you have the bed for open OSSEU, then you can come to that. But also all the videos from the one we did in Austin are on YouTube as well. We just try to be very public about everything that's going on at open SSF and so please, at your leisure, come and join the party. Thank you. Thank you, Brian. And so to finish this, we're going to invite Hop Montgomery, who has a very interesting profile of being kind of in between all of this because he's the CTO of Hyperledger and his background is a security researcher. Hey, Arnaud, thanks for having me. So how do you see all these things? So first maybe from like the security, what we're talking about more with Angelo and Dano, what do you think is going on and what's important? Well, I think there's a lot of stuff and Angelo and Dano also talked a lot of, they both made a lot of good points. Is there anything in particular you'd like me to address? No, but so I mean you, so you have this enviable position to be in Hyperledger's CEO seat where you kind of see all the different projects. There are things that you see that should be maybe people should be more aware or pay more attention to across the board or that they are doing. Do you see common threads? What's your view on this? Yeah, I mean, I think a common thread is that in many cases we aren't organized enough. We could have better protocols and better methods for say, how do we handle a CV, right? We haven't really codified that process and all projects sort of do that differently. Some do it better than others. But if we put these things down on paper, they might work a lot better. Same for the bug bounty program. I see Dave out there who responds to a lot of those males but again, we'd like to broaden that. So maybe people don't know about the bug bounty program we have so why don't you say a word about that? So we have a bug bounty program that's primarily focused on fabric that offers various different rewards for certain types of bugs but we'd like to increase the rewards. We'd like to see more action on that. We have budget and we're not spending all of our bug bounty budget. So we'd like to find the equilibrium where we spend what we want to. You know, we can't do the Ethereum million dollar critical bug but you know. And historically it's been a bit of a challenge, right? We get a lot of things that are not very relevant and it still takes time to, you need to invest time into processing the submissions. That's what Dano said, right? He said that most of the time it wasn't very good but occasionally you got a gem and those gems you got made it any worth it. It's a good price to pay to get it, yeah. And so on the cryptography side, I mean, you've been working in Ursa which is one of the Hyperledger project. What's the status there? With Ursa in general? Ursa. Yeah, so Ursa is still widely used by Indy and Aries. It's also used by Iroha and the Iroha team is adding some maintainers to Ursa to keep the interfaces where they want them. So yeah, I mean in the beginning we sort of had a dream to modularize cryptography throughout Hyperledger. That's been sort of difficult. What's the difficulty? You know, it's always one of those things. It's like anything else where it's a short term cost for a long term gain, right? When you are protected fabric, right? You all put a lot of, you know, there are a lot of hard coded calls in fabric.  And sometimes these get short cut, right? You know, and so there's always a balance but you know, it's hard and it takes a lot of effort up front for a long term gain. It can be hard to get people to see that. I see Angelo not being so... The programming language also becomes an issue, right? That's been a challenge throughout is when we want to try to have a module like this that's used by everybody, all the different projects use different programming languages and it makes it hard for something like Ursa to say, well, we're going to use this language and... Yeah, for Ursa in particular, it's mostly written in Rust and the calling Rust code from Go is not in a, still not in a great state, so that's unfortunate, but... So that's one of the barriers, right? Yeah, that's definitely one of the barriers. It's a barrier to Ursa. It's not necessarily a barrier to modularity, so... I can say, being part of the TSC, we get these reports from the project and for quarter after quarter, when Ursa reports on the status, they have this call out, come on, please tell us what do we need to do to make it more useful to you? And unfortunately, it's a bit of a call in the void, right? Yeah, I mean, but in an ideal world, I would love to use fabric with BLS signatures. You have to tell Angelo. Oh, Angelo knows. You know, stuff like that, and that wouldn't necessarily require Ursa, right? Yeah, but, yep, please. Is there anything that wouldn't be improved by BLS signatures? You need to repeat the question. So, Dana asked, is there anything that wouldn't be improved by BLS signatures? So, if signature verification time is your bottleneck and your blockchain system, then that's a problem because BLS verification requires a pairing, which is substantially more costly than ECDSA verification. But that's really the only downside. BLS signatures are smaller, and they allow more exciting functionality, right? Like, you essentially get threshold gates for free. So, you get free threshold signatures, multi signatures, all that stuff. There would be a way to avoid, if we had an interface of an in-memory channel, an in-tent process channel, that's actually the base of the GIMP. So, what you do is you have a client server kind of protocol, and you connect to the... Yeah, you need to speak in the microphone because people are going to listen to the recording and get frustrated that they couldn't hear the answer. No. I just want to say that one of the basis for crypt agility is to have this client server approach. So, when you ask for a cryptographic primitive, so essentially you connect to a server process in-memory, so it should be very fast, the server will generate the cryptographic object and send it back. So, that would avoid any problem with languages because essentially the other process can be written in any language. They just have to both use the shared memory, and then that should solve the problem, right? Yeah, and that's a perfect solution too because you can also switch protocols as well as languages, right? So, yeah, Angelo is describing basically the dream architecture. So, is Ursa going to attack all this? Well, this is not only... This is a both sides thing, right? This is more of a, you know... And you could even do this in Go. I believe there are BLS implementations in Go. They're not Ursa, but they're still reasonable, so. And is Ursa used outside of Hyperledger? Yes. So, that's successful from that point of view. I mean, all of these things, we never really know how often they're used, so. That's part of the open source status of things. But, okay, so I think we're out of time, unfortunately, but thank you. Is there anything else as CTO you want to tell people? I know, thank you for hosting. This is a very interesting discussion. Yes. Well, thank you for being here. Thanks everybody in the audience, and thanks to Angela, thanks to Dano, thanks to other people like Dave, who does a lot, a lot of work for security, so. All right, thank you. Let's go have a drink. Thank you.


So welcome to this session and an allotation jam session adding meaning examples discussion to the UNESCO recommendation on OER with great. Thanks to Alan for joining us very very early where he is It's around 4 a.m. I think so. Thank you very much Alan for joining us. I think this is going to be really interesting session And I will hand over to Alan Okay. Thank you very much. It's really great to be here Hello and welcome. This is Going to be a highly interactive session. So I put a link in the chat more or less everything that I'm going to show is coming from a press book where we have Imported the UNESCO OER recommendation definitely not required that you know any expertise about this but I just wanted to To give everyone a chance to sort of have a hands-on experience this project that I've been trying to get rolling. So First of all, I think thanks again to Kerry for setting things up quite nicely. I Just want to find out like what people's experience is with Web annotation especially with hypothesis. It doesn't matter if you've never done it before It's going to be really easy and I will try to walk through things Very quickly because what I really want to do is Give everyone a chance to do this while we're in the same room together. So For the people in the audience if you can let me know through chat Just if you have any Experience or questions about doing this it doesn't matter you can certainly watch along as I go through and demonstrate But pretty much everything I'm going to do is shared at the URL that I put into the chat and I guess I'll just walk through and start so So yeah, some people have heard about it That's pretty good It's quite interesting in many ways because I remember when When I first started on the web way back in the ancient pre-cambrane era the first mosaic browser browser actually had Annotation features built in there and so the idea that you have a space to record and Share notes on anything on the web has always been compelling, but I'm going to go now get to the action Let me know please by audio or flag Kerry if You have a question or I'm going too fast or I Done something ridiculous because as I share My window here, I will probably lose Site of the chat. So here we go I'm going into this section in the middle of this press book I will sort of give an overview of this but I decided to call this an annotation jam I like the musical references, especially for my friend Chahira, but the idea that People get together and sort of do things in the same space that sort of always appealed to me as as an approach For for teaching Etc. So it seems a lot more fun than listening to me blab as I'm doing right now so Yes, there is this document the niscoe recommendation where we are I am not going to give a history of this etc. But it's many years in the making. It's an official document It's pretty high level, but it's rather important to the work that we do and so when you You know actually look at this document, of course It is it is pretty general because it has to apply to the whole world and so Being clever actually trying to be clever This is a screenshot from it and I've actually annotated itself by you know, we do this very often when we're Teaching especially online. We draw attention to materials or things that we want to get people to think about or maybe we Give instructions to so this is a form of annotation But you know typically with a document, you know, you have the ability to read it That's what we can do with the document But sort of this became a framework for some work that we've been doing the open education global I started trying to imagine like what if you know, you had the ability to actually go into very specific words freezes in this document and share examples like I Not familiar with what policy environments are or what examples are or what if we can ask questions about You know, why does it talk about? What does it mean effective over our practice? It's who does defines what effective is so annotation can serve many purposes But many ways it allows you to sort of Contribute to the document, but you can also interrogate it You can ask questions you can be in discussion and that's what I saw as potential for what we could do with this document I'm not going to get the history of annotation, but it's been around a long time We've done it all along in our academic careers. We make notes in the margins. We highlight There's many forms of annotation that My good colleague and I definitely recommend anything by Ramey Kahlir who's a real scholar on Annotation at its uses he and in Entero Garcia have co-authored a book published last year called annotation and the particular tool that you're going to be exposed to in this thing called hypothesis a house annotation to be happening right in the screen and so It's actually enabled right on this very Screen that we're looking at and I'll get into that in a second, but Right here as I flip that little button in my top right It brings over this toolbar, which is where I'm able to do annotation. So If you're looking at this right now If you have if you've never used hypothesis You can actually sign up and create your account here or look I haven't been in for a while So I can just log in right away and now I am logged in to my hypothesis and so There's a note here and there's a picture and a video of a penguin So these are things that we can do. So in terms of the way you can interact with this on Any web page, but it's enabled here and press books as a feature is You can always hide it and go back to my reading and we'll get into the nuts and bolts and do this But one thing that is very powerful about this being web-based annotation is it helps you so it's a way if you're doing this as a regular basis I've done many classes where I really encourage my students to do this because traditionally You've got like articles that you've printed on a stack of paper You like highlighted them marked them up you notes, but they're all distributed You can't really access them because they're on paper or in books and you have to remember where they are or summarize your notes So but because this is on the web There are ways that the system can sort of track on what one person has done. So This is looking at one particular strange user's account And this has all the annotation activity that this person has ever done Across any document and that's kind of interesting because you can also use tags to organize things. So You can do things like this example and I'm kind of leaping into an advanced feature But this is showing the same person's account But just their entity on annotating this particular document that we're in right now. And so if you click any of these You can come in and see The actual notes that this person has done. So it tracks In a good way the things that you've done in your annotation activity and to me This is like an incredibly useful as an academic as a scholar If you do it on a regular basis, it allows you to sort of have your your notes and your references Organized in a way that you can come back to and find layers. So That's enough blabbing about this. So again I've already kind of covered this. So annotation in this case this site is set up that we can automatically enable it Generally if you're using hypothesis and you've created an account There are several tools you can use that allow you to annotate anything on the web Whether the site owner has enabled it or not. So anything at a public URL including PDFs can be annotated with this method But the key is this button in the top right this little annotation drawer. So And and again, I have seeded this with a few annotations. So again Some people are maybe already you know figuring out that they have an account and they could log in Others of you are probably trying to say wait a minute. I'm creating my account. I'm trying to log in Alan's talking too fast But you can I just want to give a sense about some of the things that you do sort of in an annotation activity so One of them is and if you've already Scored up and down the page you might have seen there's a few annotations already So one thing you can do is look for things that other people have made notes on and if I skip this over This is a key feature. This annotation is in a public space So we're ability to do group annotation on this same document So I already set up a button and I said, are you ready to annotate? So one thing that you can do is okay. There's this existing annotation. I sort of set up a greeting And I can reply to it and I can say like I am ready to go But Alan is going way too fast and well, hopefully You might add Something more relevant. I'm encouraging you not certainly not requirement But if everybody tags things done in their workshop we are 22 Um, you can actually see all those annotations grouped together And so this is basically this is like commenting on a website. This is like replying in social media. So We can actually have discussion about something In this UNESCO OER recommendation right in the page The other one is thinking about and what I love about um Rami and Antonio's Anteira's book on annotation is they they give a lot of examples of things that are annotation In everyday life like a family recipe like often we have these cards I have recipes that my mother or my grandmother gave me But I put notes in them sometimes because I say like well, you know Mommy didn't use enough garlic or I think this needs, you know baking powder instead of baking soda So that's an everyday annotation activity and even Rami argues that meme images putting text on an image is an act of annotation. So You can Look at something and if the words speak to you I could say like I could highlight this And this is when you see a phrase that you want to add a new annotation to I'm gonna bring this up I'm gonna click annotate and we'll say I have many of these recipes Where I have added notes if I was more clever, I might have had a link To maybe a flicker photo of mine you can You can do some basic formatting of your I can make this italic obviously And you can add a link to this any URLs you put in here For those interested in science and math it does include latex. So for people who are teaching Math Concepts you can give Like examples or things that you want your students to do in latex I can barely speak English much less latex So I can't give an example and you can start images if you know where their link is but For right now, I'm just going to Add an annotation here and you can see that I've added something new That's in in yellow right now. So this exists Another interesting piece about this activity every one of these I'll go back to this one and I hope everybody's okay. I'm not really can't really see what's going on in the other window. How are we doing carry? anybody See I can just talk one of them blab forever so hopefully Everybody's doing okay and not too lost as I am quickly talking because Okay, you know, sometimes you feel like you're talking to avoid and you know, I'm I could be great at blabbing But yeah, so thank you a key feature to this is that every annotation that exists in this document You can click this And it has a link so Everything that you do as an annotation activity is referenceable at a url. So you can copy that You can put together a series of links. You can send out an invitation To people to annotate. So if you said if you wanted to like I could Bring this one up and I could copy that link and I could go over discord and say like Alan's doing this crazy bleep and annotation and we're all annotating on this thing et cetera You may not see updates in real time. I think you might have to Yeah, so, um, yeah, there we go Hey, so thank you my friends for for joining in the annotation into the activity so Um, so you can say it's almost like um, like a living discussion board around this document So I may just I'm gonna stop and I'm gonna come back here and uh, just come in and make sure Uh, people are people alive. Okay. Found your hypothesis password. Okay. Thank you, Sarah There's importance to add penny gifts and like I'm I'm really pleased that they thought of Adding animated gifts as a thing that people would want to annotate with it certainly can spice things up So I'm seeing uh, yeah, Leo's describing it as Bringing discussion to a thing. Um, one of the things is like thinking about it And I've had the great fortune to do a lot of sessions and conversations with rainy. He's such a great um Explainer of this in a way that makes sense. And so My way of thinking about it is like the thing that you may want to put in an annotation It's like a post-it note. It's pretty small. It's not like writing a treatise And it can be as simple as adding a link or a comment Um, and you can certainly uh go farther if you want to so now I'm going to get into This thing that we're doing with this oer recommendation so I've been working for about a year and a half with open education global and The 2021 conference That we held was online in september and it was all themed around the implementation of The unesco oer recommendation, which of course is this broad statement about what open educational resources Should it can do and what member states should do to encourage it and it defines these five action areas Let's see quiz me if I remember them building capacity developing supportive policy policy there is creating accessible and equitable oer There's sustainable oer and there's international cooperation and again these are really quite Broad and each one of these recommendations has several sub items and so The oe global conference Had presentations leo was there chahira was there I believe Where all the presentations and discussions were built around discussions of examples of things or things that would be needed to make the recommendation come to life to be implemented and so one of the ideas that we had because The upcoming oe global conference in person and not in next month Also is built around the oer recommendation is We had the idea or I had the idea that we could use this annotation to do things during the conference in between to Ask presenters or people participating in the conference To take things that they heard in sessions Or came across as references or things from their own work and attach it to this document And sort of fill it with things that sort of have those ability to add meaning To particular phrases and words in this so I've been trying over the last couple months We've run a bunch of asynchronous activities. I call them three days of focus where we've done Asked like a call to action to have people annotate the building capacity Action area and so we've been trying just to keep kind of a pulse on this activity and doing things Like presenting at conferences To show this so an interesting thing and you know people have some experience using A hypothesis and and we'll get into actually what we're doing with the recommendation first But um, my colleague Grammy, I've mentioned a lot had developed with a colleague at University of Colorado Denver, um, Francisco Perez. They developed a thing called I figure what the acronym stands for crowd layers, but it's a way of creating a visualization about The annotation activity on one specific document. So if you're doing something in Having your students doing annotation or if you're working on a project where it's part of it This is a way to sort of see activity of it in sort of a visual way. And so I think it's pretty interesting and so They actually created Something that combines Several of the annotations that are part of this project So you have the ability to see here The annotation across and you can see that there's Ones that have happened relatively recently Across several pages within this document So you can see the annotation. It also gives you a sense about who's participating So me, I'm kind of a loudmouth with the annotation. I've done a lot But if you're teaching with us, this is a way Not necessarily to check up on your students, but sort of being able to visualize what the activity is We have organized the different versions of the oar recommendation into different language versions So in this way, we can see the annotation activity on separate documents And so I just think this is a really fascinating tool that I want people to know about That's available. So if you are doing anything With annotation You actually put in Where annotation activity is happening and it'll generate a link that brings up this data for one particular annotation document So incredibly powerful free to use. So if anything with annotation, I definitely recommend the crowd layers I heard something dingle Anyhow So again What I'm trying to call attention to I had fun making a remix encouraging people with the remix of The old war posters in the u.s. This was originally rosy the riveter I rebranded her as rosa the annotator and so a call to action the people To do some annotation. And so I've been kind of pumping this For the last couple months And so what I'm doing that we can do maybe in this session is Get some of you coming in and doing some Annotation around one of the particular actionaries, but actually, I don't care where you annotate. You're welcome to do it anywhere in this this document and is to Sort of think about some of the wording and some of the things in the inclusive and equitable OER actionary because you can have questions like what does it mean to be inclusive and equitable with OER? And how do you know it is and what are the examples of it? So I'm going to jump into this With I have a direct link that will take us there But again, just to remind you There's different ways you can go about approaching You can look for annotations that exist there and add on to them. That's definitely highly valuable If you from your own work if you say like well, I'm doing this great project or I'm working on this paper Or I've read these three research papers That I know are probably relevant To this action area So if you have something you know that you think should be attached to This recommendation That's the other way you can do it and the other way is like you just read the thing and you start to look at it to take about What draws your attention? So the link I gave brings you right to this action area of the UNESCO OER recommendation and so There are already links here. So, you know, it talks about, you know, the things that we're talking about in terms of Ways we want to address Equity and so across so you can actually if you want to go in and sort of If you know of something or have a question or want to comment about Something that maybe about we have a lot of things going on in this conference about Indigenous ways of learning so you can add A new note here to talk about the different places or ways that we want to think about people who need Access to equitable OER and so this is quite a detailed statement. And so you can look at a very specific word Obviously with things going on In the Ukraine right now, there's a lot of things going on with important activities on refugee education Displaced persons a lot broader and so you can zero in on the general but We also may want to talk about things under very specific These sub items within so obviously there's a lot of emphasis important with going on about access to OER so Anything that might be an example that talks about learners who The way OER is meeting learners who Don't have the the financial access to and so many of the work that we're doing and talking about here can going in One of my interesting things that I'm really interested are some of the technology platforms that allow people Places of no internet or very weak internet to be able to use OER and use OE live OER resources and I'm sure there's a lot of things People at this conference can contribute to that We can think about next one OER examples of things that address Gender-sensitive OER and culturally sensitive OER is so and obviously Linguistically relevant OER Which again this person named Alan probably added in here some time ago, so the thing with looking at This document is it's to me it works better if you really focus in That's something very specific like a word or a phrase But there's no rules for that so sometimes people want to you know highlight this whole chunk And talk about now. I know some work going on with evidence-based standards and some research going on so When you look at You know document you can see like well, there's been some activity and it gets darker if there's more notes on something So you get a sense about Things that have gotten attention and things that haven't got attention. So that's another sort of approach For thinking about jumping into this document But my whole position is and I will Come A fantastic way to come about and sort of like share our work in one space and actually attach it specifically To this document, so I'm coming back Yeah, and so I want to think about Gabby course brings it's definitely not like A forum activity where basically The key thing to me is it's it's the context of the content you're talking about So it makes a lot of sense to have discussions You know if you're having you know, if you're having a discussion or even commenting on a web post You have to talk about Something that's very specific in a general sense and to be able to attach Information to the thing you're talking about is really important and powerful and so It's hypothesis gdpr compliant. I not an expert, but I certainly can think about Maybe some people here would have an answer to sarah's question I would Well, I can't hesitate what I could speak for the company because I'm not really with the company Yeah, just like to see the comments Coming on to the here But the main thing is that what We want to come back to oh here. I've been terrible terrible teacher here. Antonio has had his hand up for a while Can I help you Antonio? You are enough. Thank you. Alan. I found my way now Thank you. Sorry. It's a legacy hand. I found my okay my way through I just money annotation Yeah, that's good It's it's really not that difficult and that's that's the great thing is that once you've done This annotation and once you've been able to show someone how to do it They're able to Pretty easily it doesn't you know, it's on a steep learning curve The um a little bit of like, you know, when you're actually doing the editing you can actually see what's being generated as a markdown But you can you can see it as a preview um a bunch of the media Alan, so if you put a link into youtube it embeds automatically. Yes No, just thinking that my question before sorry. I'm gonna give my camera my question before was about um how to Annotate from scratch A page because I went I went a bit too far. I was busy doing something else. I'm at home And I went too far. I went too far and I went to the declaration itself And I clicked on an extension in chrome, but nothing happened. Yeah, then I realized that there was a link That took me to the stove and now I am annotating it But how can I can people just go and create annotations by clicking on the Annotation extension on the right when he says it's active, you know annotation is active. Can you start from there somehow or no? Oh, yes, and so if you actually went to the original unesco document and um Let's see. I should actually do a demo and I can show you how it would work so I went to screen share and uh, you know I always like it when someone asks for something that you hadn't planned to do because That's what we should be prepared to do. So I'm going to come uh back To and avoid the inception here. Um, I'm going to find my link to the uh full, uh, unesco recommendation and uh And so uh, this is a big document and so we actually had explored looking at annotating the unesco document itself, but The way they have it set up. It actually has the five languages built into one and you can see Mine is not even there.  So, um So in this case, um, we don't have hypothesis available. So Yeah, go to the hypothesis site. There's a couple ways you can Create annotation. So if if you have yeah if you have The browser extension so I can just click this And I can bring this up And I can annotate here And so I can bring this up I don't think there's any there's no no one who's annotated this document. Um, so what we have done is we imported This into press books Because it it actually just makes it a little bit easier to separate them into chapters. So we have the French version as a separate chapter here and also that hypothesis is always enabled within Within this press books version And you can say well, they might be a problem because if people go to annotate unesco one, you know The annotations aren't synchronized There are ways you can synchronize things across document. It gets into some really hairy technical stuff But the last thing I want to let you know is the other way you can do this because You know, I've done this with students sometimes You have to get them to install a browser extension And then you have to like get them to know how to use the browser extension. There's there's a bunch of steps there so there there is a service from hypothesis That allows you this to create a link that you can Now I think it's it's via dot So here's the perils of alms like demos So more or less if you have a web page that you want your Your particular student so I could come in and I could say like I want people to annotate the help page For the oer conference and so I can come over to hypothesis here and I can create I can put in a url and It creates a link So it creates this kind of funky link That you could share with your students or your colleagues or people you're doing a project with to say like This is where we're annotating and so it saves people the hassle of having to deal with the browser extension And so this is a sort of a it's a funny looking link because it has this url in front of it and then the url for the document that you're annotating but I did this quite a lot when I was teaching For examples where I wanted my students to annotate one particular document Antonio has his hand raised Pretty topical. Yeah, you want the link to it? Yeah, it's okay I'm just multitasking with the screen. Sorry. Yeah Anyway, I've managed Yeah, I shared a recommendation if anybody wants to put it on it that's that's quite excellent and You see it's very easy to share the link Mainly I'm just hoping like, you know As I'm like looking through the conference sessions going on here and I had a couple, you know, there's many works, you know Catherine Cronin's Talk yesterday on the just knowledge project definitely applies this area There's definitely lots of gogn research going on that are looking at issues of equity and inclusion in in this and so What I've been kind of hoping is that the people at this conference and I'm encouraging this as an activity during our conference in Nantes Which are we global putting on I'm going to be remote because I can't travel right now But we're sort of want to create Ways for people to participate and some of the ways you can do that is through this adaptation activity So you can be looking at a presentation. You can watch one that might be stream You can see a reference that someone makes and we could sort of use it almost as a like a conference, you know note taking activity But you know, mainly it's the idea that To me in this recommendation are a lot of like Examples of things that we should be doing or that we are doing and if we had a lot of Gathered activity like putting examples of what implementation of some of these recommendation activities look like That it would make the document that much better because then it's not just this high level document. It's sort of a living document that has examples and so I've been trying to get People gauge with this It's been a little bit uphill trying to get attention on doing this and Yeah, you have to be engaged enough of this to say like hey, I'm gonna remember to go annotate when I see things but You know as I'm going through what's that people are sharing In my email or in social media It jumps out to me says like wow, this is something that really should be attached to the OER recommendation But you know the the bigger outcome, you know, and I see it in the comments here is that People see what I'm trying to do with annotation and they can be also thinking like These are some of the ways that I could think of using it in my projects or the classes that that I'm teaching and so to me the idea that You can actually participate as a group and Add information or meaning to any public web address is incredibly useful. It's like so many got so many possibilities So That's my studio. I hope again People might have some interest in participating or getting some activity around this I've Bothering all my friends and colleagues. This is The main press book where we have all this annotation activity going on There's a little bit of explanation and kind of a recap of some of the how-to's but the main part is That the recommendation is there in the five languages although I still have some work to do with the arabic Um Because of some of the way the documents formatted and we're trying to get that in action But we want people to be able to annotate if they want in the in french or spanish or chinese into the orio recommendation of their That is most appealing to them so With that that's kind of I maybe have blabbed a bit too long, but I wanted to give a chance To share what we're trying to do To maybe encourage Some of your folks to get out there and annotate as well So I will Give some pause here And check the chats and things Yeah, um alan can I say something? Please Yeah, no, I manage now To get annotate uh annotating Random web pages not just the web page of The oya press book book Etc. Yeah, and uh, yeah, it's interesting to see that the original official document of The declaration doesn't have any actual annotations itself Is no you know what I mean that nobody has gone to the original source to annotate Do you think we should be making the original one in instead of this one? Yeah, um, it really doesn't matter like Sometimes people get like they want to make sure it's like pure and it's got all the same annotations It can get messy and so one of the things is like Wherever we're annotating it could pile up and um, it could be um, uh, uh, like it could be oh my god, there's like a thousand annotations It's almost unreadable and I've heard from some teachers. That's what happens in the document Oh, you can actually create another kind you know version of it and start over again So I don't think it matters as much Um, you know the fact that no one has annotated it says to me well like no one has really thought about it I don't know But the reason and I did think about trying to annotate the original version because that seemed more proper It's nesco's document But because of the way it's structured, it's a large cumbersome. It takes a long time to load And if you're annotating in the Spanish section, you're actually 10 pages down from the other one So it gets to be it was kind of unwieldy and it wasn't as easy to navigate and the curve to me From some other projects that having it in press books And we could have done this on a wordpress site There's lots of ways to set this up But the fact that you can enable annotation to be available when anyone goes to the document Seem to make sense Antonio, I don't you know as long as people annotate would make sense You know, you know, and you know, and you know, it is certainly fitting that it happens at unesco And we we've we've let them know we're doing this Um, and actually if anybody has any connections, I've been trying to let them know a long time that on their Main page for the recommendation the link for chinese goes to arabic and link for arabic goes to chinese and I don't have any context And so That's something that that probably needs to be fixed Yeah Sorry, I did not raise my hand, but i'm just gonna talk alan you mean contacts at at unesco Yeah And we can't fix that Okay It's been a long long time when when I was working for the un but um Yeah, I think I think there were a few contacts remained and uh It's definitely two different languages and it was very I was very emotional to see the the arabic page I'm saying that the report is In development. Um, and I hope that will be soon available Well, there was there was um, we did a lot of effort and there was something that made it Not even feasible to copy and paste from the pdf um I did some digging and I could see in the unesco version There was somewhere um a word document that it was based upon but um, I don't know how to find that that document so Um, and so I just haven't um, you know, we've got to get back to reaching out to some contacts We have a few who might be able to help us out to um to to Translate that because you have to copy it into the the press books interface and I definitely do want to Change or mess up the understanding of it in arabic especially because My only ability to sort of see what i'm doing is to run it through google translate, which is not suitable um But yeah, because the document's structured. It's pretty easy to you know pull one item from a list You know put it into press books go and that's that's how we had to do some of the other ones Yeah, please do let me know. Yeah, if um, I'll reach out if okay I will definitely call I have a chance to catch up Yeah, I have a another question. We talked about the messiness that can be reached through so many annotations Do you think that and this is something that um The teachers we um advise you, you know go through an experiment with a social annotation Do you think that there is a way to um moderate the messiness or um allow for as many annotations as as as possible, but then also and Maybe prepare the teachers to say at a certain point. You got to be You know coming back to to the As if it were a conversation, right and try to moderate that So we go away from this overwhelming feeling. There's so much going on to there is much going on But it's useful and and in kind of trying to to facilitate that or do you think that the nature itself of annotation should not be moderated because I'm the messiness is tricky, right? Yeah well Because of the way the platform there's actually no way that you can sort of I mean there might be some some ways or with some other platforms But you know it's an open platform. So you don't have the ability really to moderate what is done I mean, there is sort of you know, if something's inappropriate you can flag it and and report it Which is an issue. I wish I had the problem where I had too much annotation. I haven't really run into that yet and so You know me personally the way I teach I don't think it's a problem And if you have that much activity going on You know, I I have had some conversations with with ramy about this and so, you know, one of the things you can do is like You know, think of it as just a raw conversation And so one thing you do if the annotation gets messy you want people to synthesize it somehow and sort of like, you know You know extract the meaning from All this kind of messy conversation and it's you know, it's same thing with discussion forums like they can get messy too So you can lose the thread and and what what the focus is So I don't think it's you know, a real Super problem And there are ways what and I mentioned what we're doing is Is public meaning that anybody can annotate you can set up private groups Which means that when you come into Into the annotation screen you can toggle from doing public annotation and you can create A private group. Yes, Sarah So if you just want it for a course You can so have your students say make sure all your annotations are within, you know, the You know, eng 532 course group And for people, you know Hypothesis does offer services Where you can have Your your learning management system or your vle Connect with hypothesis where that is done automatically and so it's a little bit of a different approach, but Certainly some of the learning management systems Can be arranged. So if you're in a course and you have an assignment exercise, it's automatically within group There's some other issues that happen with that but that can sort of ease Some of the issue. Yeah. Yeah, the modal plugin that those things always come with a cost when you don't do the Annotation So, um, yeah, I've tried I've done some with a group Because sometimes people don't Have public annotation or if you're doing A specific class discussion, maybe you want to you know limit the participation I think that's certainly a way to go and it's just a habit that you get into if you're doing An annotation assignment have to say make sure you you know your annotations are in the group And that can that can help, you know You know, you could have an activity where you put people maybe create like five working groups and you have students working in the groups and they do their annotations within The the groups to do their their activity So it kind of depends more about the nature of the activity that you're That you're trying to do but there's really not the ability like like when you moderate comments or things like that to be in control of the document to approve or to delete things And so yeah, that that can be a downside Thank you Great to see you. Thank you. No, Alan. I was um, I was thinking that um, this is great Um, the fact that you can have the private groups and the fact that you can Create a group every year because obviously the annotations will be only visible to that private good So private groups so if I have an article that my students have to read We have this problem in arts and humanities that students read less And they dedicate less time to reading as well and Reading is seen as boring and we have academic articles We have a literary text that they can read and usually they are online so increasing the the social aspect An interaction and the you know, learning from others When it comes to facing these articles is is important So effectively what I could do is to create A group every year Because otherwise a private group because otherwise the annotations of previous years would be Getting messier messier and everybody would be We which doesn't mean that at some point I cannot make public the annotations of previous years This is what is interesting or for the sake of comparison so now the there is a There is a cost associated to to that of course if you want to have your Students to engage Not necessarily through having Moodle groups, you know, I'm thinking about one of my classes in which I have 25 students, you know, I would go there and create five groups Um That would have a cost wouldn't it The cost in terms of financial just cost of like overhead of your Way to management No, no, no cost meaning that That the account is free if I am doing things like this with you now But that obviously there is a paid version. Yeah That's only for integrating with your your vle or your lms There is no cost and hypothesis to create as many private groups as you need for your courses Um, it's more a matter of, you know, having your students understand That, you know, they need to be Selecting their group first before they do their annotation. Yeah You know, I know people will mess up and they Yeah, I agree with what leo was saying about paying good people for doing good things so The sustainability of the tool relies obviously on the on the plugins and other Things that are being Produced Yeah Yeah, and that's good. I'm not familiar with elevator and again, this is certainly not the only annotation Uh platform out there and so it's it's you know, great to see. I mean, there's you know You can think about some of the tools that allow you to, you know, put comments as you're watching a youtube video or Some clouds ability to put comments Right in the moment of a of a soundtrack and there's a form of annotation and Annotating images is is an incredibly useful tool in many places. So But yeah, hypothesis has a lot going for it Because of their commitment When you for those who care If you're doing public annotation By default any annotation is licensed with a cc0 License there's a long convoluted reason I think about it, but I don't really think about like who's going to reuse my annotation Without my permission, but it's interesting that they've included that As part of their platform Interesting. Thank you So, um, I hope you have a conference Tell other people and Tones to fill up that document with yellow notes. Please Thank you, Alan perfectly on time as well. What a fantastic session So wonderful as well to have so many of you joining in and really getting stuck in it's been great to Great to observe and I've got yet another thing I can go and play with now I'm learning lots of new tools to go and play with so a huge. Thank you to Alan for getting up So unbelievably early to present and being so awake and engaged in his session despite the early morning I'll stop the recording now And I think we have a lunch break now So I think we start again. Let me just check at Yeah, one o'clock. So hopefully see you all again then. Thank you once again, Alan and I'll give you a A sort of online clap. So thank you very much


obviously this is a solid defensive team that you played, but they have on occasion given up some threes. Can you explain what you guys saw in their defense that we were looking to take advantage of? Yeah, I mean each time that we played against Charlotte this year, we've gotten the number of catch and shoot threes. I think they are actually one of the highest in the league in terms of the amount of catch and shoot threes that they give up. They are a good defensive team though where they close the space quickly and get good contests, but I think we did a good job just sort of moving them around, you know, giving up maybe an extra pass here or there from a good shot to a great shot. Christian Winfield with the New York Daily News. Hey Joe, when you've got a guy like Kevin who can just dribble up the floor and shoot over anybody who's waiting for him, kind of the three. Does that do something for you guys or do you kind of have to plan that? Like how do you work through him having that ability but also trying to get settled on offense as well? I mean, I think that's just something that's very specific to Kevin Durant. I wouldn't say that there's too many people probably in the history of basketball that can do what he does and at the clip that he does it. So yeah, it's definitely a luxury to have that and it makes everybody's job a lot easier because he commands so much attention, you know, no matter when he has the ball. Even tonight, whether he was bringing it up or, you know, catching it in the post, they were trying all sorts of different sort of schematic things where, you know, they would zone, try and just overload, always trying to be in help and it allows a lot of us, other guys, you know, much cleaner looks. Greg Logan with Newsday. Joe, how frustrated were you the other night in Philadelphia where they get everything they could to chase you off the three-point line? You only got two shots. And does it kind of underline the importance of three-point shooting for this team and for you in particular to how everything goes? Yeah, Philly did a good job defensively. I think, you know, in total, I think we didn't make too many threes. I can't remember exactly what the number was, but I know it was one of our lowest of the season.  But a lot of times the threes are going for us because, you know, the defense, you know, everything is sort of all in sync. The defense is there. We're able to get out and transition, get easier looks that way. And, you know, against Philly, it was kind of tough from the start. It seemed like we were playing against a set defense for most of the night. Alex Schiffer with The Athletic. Joe, Miles Bridges got off to a hot start and just seemed to have, I think it might have been a career night for him with 32 points. What made him so tough to guard tonight? I mean, he's been playing really well. He's had an unbelievable season. You know, I think it's one of those things where he's just kind of getting more and more confidence.   And he's so athletic, he can, you know, penetrate, get to the rim, and then he's an excellent finisher just because of the strength and athleticism. Back to Christian Winfield. Joe, at what point would you say you added sidestep and step back threes to your game? Because that's not something you always had, but I think you had a couple today. Yeah, that's not something that, you know, I typically do, but it is one of these things where, you know, this pass-off season and even now during the season. I just work on, you know, a little stuff like that to create space, you know, because for me, a lot of times it's really just about trying to hunt and find space to get shots. So whether that's, you know, moving without the ball, or then when you have it, you know, flybys, sidesteps, things of that nature. So I have been working on it, but it's definitely one of those things where it's so much of a feel thing over the course of the game. And I think because I was able to get some shots early on and made it a little bit easier to feel it out later on.


Okay. My name is Hung and I'm from the Oxford University clinical research unit in Vietnam and today I'm going to share with you our experience in antimicrobial stewardship or AMS implementation from the health system approach in Vietnam. Okay, so AMS is an important structures in the global and also national action plans around the world. And usually an AMS program will contains a number of core elements that are providing the important structural foundation for the implementation of the program, including the leadership commitment, accountability and responsibilities of the team, drug expertise, specific set of actions to improve the behaviors, tracking indicators, reporting and feedback and also education and training. So AMS or an AMI is not confined in any department or any area. So that's why we need a whole system approach. We need to involve different stakeholders and players. We also need to bring in the implementation science and so shows the science methods in order to address the factors and the contextual determinants in which influence the prescribing behaviors within the hospitals. We have lots of evidence, evidence-based interventions are there from previous experience around the world. However, we need to identify and use suitable implementation techniques in order to tailor these interventions to the specific context of each hospital setting. Okay, an important aspect of our AMS program is networking and sharing of the AMS knowledge and experience internationally and locally. We started the AMS since 2013 with the VNRS project which initiated the concept of the AMS in the VNRS hospital network across Vietnam. But not until 2019 we were able to organize a national AMS stakeholder meeting together with the Ministry of Health and with the WHO, where we share the experience in implementations, identify the issues and challenges, and also identify the way forward. We also collaborate with the Duke antimicrobial stewardship outreach network in the US in trying to implement the AMS models in provincial hospitals in Vietnam. And we connected the local hospitals with the local experts who have experience in implementation and also with international experts. And recently we are working together with our sister units in Indonesia, Thailand and Nepal in a CDC funded project together with the other groups in Central and South America, America and Southern Africa to try to develop a contextualized AMS assessment tool to help the local hospitals in evaluating and improving their implementation in AMS. It is very important that we need to have an understanding of the barriers and the opportunities for AMS implementation in order to design our AMS program. So this is shown in our recent paper from a mixed method study in the VNRS network hospitals. And from this qualitative data, we identified salient aspects that need to be addressed within the future programs. For example, from the important roles of different stakeholders like leadership doctors and pharmacists and microbiologists to the practice that need attention. For example, taking culture prior to antibiotic treatment or using antimicrobiology data to help guide treatment or the escalation for the patients. So these are very important and give us the foundation to design our programs. In our implementation approach, we consider hospitals as complex adaptive systems, which is such as by a growing body of literature. So a complex adaptive system is a collection of individual agents with freedom to act in ways that are not always totally predictable and whose actions are interconnected so that one agent actions change the context for other agents. So conceptualizing hospitals as complex adaptive systems has an important implication for us in trying to find ways to how to intervene within the systems. And it's also reinforced the idea that hospital is unique, each hospital is unique and we can sort of move intervention from one hospital to another with predictable results. So we need to look at, we need to have a system thinking that we need to look at the interconnections between parts of the system. We try to incorporate multiple perspectives, try to consider the local conditions and also leverage the local resources and capabilities. We need to think in the context and also in dynamic that is trying to be responsive and also adaptive to the change in the in the within the hospitals with the system over time. And we need to involve different levels within the system from the senior management to the frontline staff. And in our MS program, it needs to consist of consist of ongoing rather than one of activities. So this flow chart kind of give you an impression of how the different actors and actions within the that influence the antimicrobial prescribing and use within the hospital system and you can see there are a number of of them and we need to all have a good understanding of all this and trying to identify the areas and also where we can find the scenery and the coordination between the different action and actors and stakeholders. And of course context matters in a mass implementation. And we need to assess the context your need to be in from different levels from micro level like factors related to prescriber or patients factor related to organize at the level factor related to the cultural the support the structures the writing readiness to change. And also at the macro level at the national level the guidance networks and regulation and evidence available. And we also need to take into account the, the factors that are at the multi level that happening at the multi level layers like the show so relationship the financial matters leadership styles time availability feedback mechanisms and also the physical environment. So here I present an example of our implementation study that we are doing at the moment with a mess program in several hospitals across Vietnam. Here is the process where the in each hospital, starting from baseline evaluation through to identifying the opportunities for intervention, and then planning phase implementing phase and then evaluation and with reporting and feedback. And along this cycle, we provide training and technical support and monitoring. For our hospitals MS team specifically a multidisciplinary MS team proceeding of different key department represent representative and also expertise from the hospital. And they work on those for analysis which is a strength witness and opportunities and threat analysis and then develop the annual implementation plan. And with the specific activities activities like training audit and feedback by the clinical pharmacist, performing what rounds with regards to antibiotics and review of the antibiotic prescription and provide feedback to the, to the clinical work. And also analyzing the routine data and reporting, and we also conduct the knowledge attitude and practice surveys to inform the implementation. So the few next slides I present to show some so that you understand that we can see the various and between the hospitals and even between the words within each hospitals. And for example, we in some hospitals we can identify the words are similar so that we can select some of them for control work and some of them for intervention words but for some other hospital days impossible. So we need to design our study in a way to fit into these conditions and trying to find the best, the best available methods in order to compare and to monitor the process. Okay, there are also large variations in the process indicators like the guy like compliance or the level of appropriateness in antibiotic prescriptions for some hospitals very high level of in appropriateness as reviewed by the reviewing doctors, for example in hospital to here up to 85% in appropriate. However, at the same time the level guy like compliance is quite high. Actually, up to 70%. So this might reflect the fact that the guidelines are not up to date and, and the local doctors do not find really find the guidelines are applicable or easy to use in their local settings. And also observes a lot of various in the reported practice in from the KP surveys across the hospitals. And from this we can identify an important factors, and that might explain the over-prescribing in in doctors for example the psychology of doctors in trying to cover the patients expectations or in trying to avoid potential problems. So these are the type of areas that we can look at in our MS programs. And for the further details in the process of implementation, you can refer to this paper just recently published. So initial analysis at one hospital show some promising results in the overall antibiotic use, for example, after the independent, after the start of the intervention, we started to see the amount of antibiotic use over time. And it seemed to be sustained over the implementation period. However, in the in the control words, the chance seemed to be even increasing. So, it is kind of promising but also warrant further further further investigation into how this can be the, how this can be sustained over time, and what are the issues that we can explore further in in the next analysis and also the next step implementation and research. So in summary, for AMS program interventions and call elements need to be put into the local context and need to be implemented within with an interdisciplinary approach in order to provide sustainable impact on antibiotic use and help to tackle the challenge. So with that I would like to acknowledge the contribution from different hospital MS teams across the hospitals in our network, and also different collaborators and funders to this work. And with that, I thank you very much for your attention.