My name is Larry Graham. I'm your host for this Think Tech Hawaii program called Don't Just Age, Engage. I'm pleased to have you with me to look at some of the issues around aging in Hawaii and across the world. Frankly, we have a society, generally speaking, that really turns aging into a marketplace that I used to complain about our society made our children into marketing tools. Well, the aging process has also been fallen to be a marketing tool. And so if you go with the social understanding of aging, you are destined to become a victim because that's what marketing does. It turns you into a victim of the natural processes of aging. My program, this program Don't Just Age, Engage, as well as my book and my program as coaching is a counterculture experience. I want you to experience the empowerment of being able to make choices, of being able to make plans and of being able to prepare for adulthood in such a way that it will be wonderful and not just wonderful, but also a creative experience in your life.  I look at it as this way. There are a couple of ways to look at an aging process. When I was on the East Coast, I flew one day from Richmond, Virginia to, I think it was on the way to Raleigh, North Carolina in the Piedmont region, just in front of the, I'm to the east of the Blue Ridge Mountains, those gorgeous Blue Ridge Mountains. And as we got to the airport, the pilot came on the speakers and said, well, we're right above the airport, but we can't land because you'll see we're above clouds and those clouds are storm clouds. So I'm gonna circle around here around the airport until I find an opening through the clouds. So we circled around the air above the airport, above the clouds, beautiful sunshine all the way above the white and dark clouds. And then he came on and said, I found an opening, we're going in. Well, he found an opening and the plane went plunging down through those clouds into the rainstorm and all the buffeting by the wind and finally, of course, landing safely, no problem at all. But the point is that our lives are oftentimes like that. We wait until there's an opening, our crisis that comes and we have to plunge down into taking on the resources, plunge down into finding the resources that are available and needed. And that's one way of approaching aging. But on the other hand, if you're coming into the airport in Honolulu Airport, you're starting way out, miles away, you're starting that descent.  And so that to me is the option that I offer to you in my program, which is to become a landing, an approach that is gradual, peaceful and competent. And today I'd like to look at the preparation for elderhood with that sort of framework in mind. I have a wonderful website here in Hawaii, Hawaii that is, I'm sorry about all this noise. I'm not sure how to, let me see if I can turn it off here. There we go. And it is called caregiverconnectionofhawaii.org. Would you flash that up there? Caregiverconnectionofhawaii.org. This is a wonderful resource. And I want to approach, open this resource up to you as an expression, as an experience of how you can make that approach to elderhood graceful and full of competence and planning. So we're gonna open up here in a minute. Yeah. And let's go to the resource library, Eric. And this is the resource library of this, terrific website. Now you may not be in Hawaii, but I suspect in your own context, your own city, your own state, there's something similar to this available to you. So, and going through this will give you an opportunity nonetheless to see the topics and the issues that will be at hand to prepare, to make good preparations for your elderhood. Now let's go down first of all to what is Medicare? You know Medicare, some of you are already on it. You have to be 65 or older. You may be younger than that with a disability, which has enabled you to get on Medicare or have particular end stage renal disease that also qualifies people for Medicare. There's part A, part B and part D. There's also a part C, which is an all in one alternative. But for instance, Medicare covers primarily physician, hospital, stays, care in a skilled nursing facility, hospice care and some home health care. Part B covers the doctor services, outpatient care, medical supplies and preventive services. And then part D, description drug coverage. If you're involved in this already, you understand what that's all about. And you've been using it effectively and no doubt. But if it's new to you, you've heard about these different parts and that's what those all involve. And if you're retired and on social security, then compensation or charges or fees for Medicare come out of your social security monthly. What it does not cover is just as important to be aware of. It does not cover long-term care, a long-term care facility, a room and board in long-term care. It doesn't cover most dental. It does not always cover eye exams. Some of them will, especially related to prescribing glasses, does not cover dentures or cosmetic surgery, acupuncture hearing aids and exams for fitting them or routine foot care. So Medicare has its limitations that are also such a grand and wonderful resource that we need to be aware of. And as you reach 65 and have reached 65, some of you already, you know the asset that it is.  It's yours to draw upon now. And Medicaid is similar. Let's go back, Eric, to the resource library and choose Medicaid. Medicaid comes through the state. And Medicaid has a different kind of coverage, as you can see, from Medicare. It is, first of all, determined what you get and how much, according to your household size and the maximum income level per year. It also takes into account assets that you have. And you may have heard people talk about having to spend down their assets. Well, there's an asset limit that you will find you have to make or a ceiling asset that you have to make. And it has to be spent down to that point. Your assets have to be given away or spent down to that point before you would use Medicaid. That's so that it's really available for people who definitely need it. If philosophy is, if you have enough assets that you can support yourself in your aging process, and that's what's preferred. Okay, let's back out of that and go to the resource library again, Eric. And at the bottom of the resource library list, you see SSI. What is SSI? SSI is Supplemental Security Insurance Income, I'm sorry. And it's a federally funded program. Gives aid to disabled adults and children who have limited income and assets. Again, once you make application and describe what your situation is, then you'll be able to, they will determine for you what you will be able to receive as a social security benefit. But very important and very helpful for some folks who have now built up a reservoir, a reserve of cash and a reserve to support them. And then suddenly have this need. Or if not so suddenly, you may know that you can count on it being there available for you. And the need does arise. And again, all this is a way of saying, while you are competent, while you were thinking well, become aware, become alert to the kinds of services available, the kinds of resources that are available, many resources available and how it might be important to one day incorporate into your thinking and planning for a wonderful elderhood. Back up to the top of our list, we see advanced healthcare directive and post. You may have already put together your advanced healthcare directive. It's a living will.  It will define the kind of thing that you want done with your body in response to any illness or sudden event, sudden incident. Now, Hawaii has an advanced healthcare directive form that you may fill out. Or there are others, one form that comes from a group called Aging with Dignity and that's called the Five Wishes document. Very good document, very thorough and comprehensive in its approach. Also, there is a post which is the Physicians Order for Life-Sustaining Treatment. Eric, let's pull that page up and take a look at the advanced healthcare directive. Click on that. This is a simple form, but take a look at what all it involves. Individual instructions for healthcare and that gives you several scenarios, possible scenarios. And essentially you choose what you would want to do in those particular scenarios. You choose what is the desire. If I have brain damage or brain disease that makes me permanently unable to make and communicate healthcare decisions about myself. And that's when these statements will apply. A choice to prolong or not to prolong life. Yes, I want to have my life prolonged as long as possible or no. I do not want to have my life prolonged. What about artificial nutrition and hydration? In other words, a feeding tube or in your stomach or in the vein. Yes, do you want that? No, I don't want that. Relief from pain, yes or no? All of this gives an opportunity for your family to say this is what our beloved wants. If you're not able to make your own decisions, this advanced healthcare directive form puts into place what you want done. Okay, Eric, let's go back and look at the post. Look, click on, yeah, thank you, consumer post. Usually you can get it in a green form and put it on your refrigerator with a magnet and that way anybody who comes in if you fall and are unconscious and someone at the house calls EMT then they will see this and follow your orders. The post is provider orders for life sustaining treatment. And it usually is for someone who has a long-term issue right now, it could be a COPD, a breathing problem, it could be a disease of the lungs, it could be a disease of the heart, something that's prolonged and might be actively involved right now. And it would give you a chance to make those same kinds of choices but directing more focused and directing towards the physician care. Akua Mao is a continuous care program that provides that pulse form and also provides some other wonderful resources. Okay, Eric, let's go back to the, yeah, the resources. And where do you wanna live? It seems like such a simple question. Where would you like to live for your elderhood? 95% of people over 65 in America want to live at home. They wanna live at home right up until the day of their death and so that's really surprising because for all the facilities that you see around your city and your community and maybe know that your friends have entered into but probably only about 5% or 6% of our aging population or elderhood population live in facilities. And you may see yourself one day having to do that or you may see yourself first and foremost to live in your home or to live in the home of your family member. Now, when I'm doing coaching I caution people of assuming that any family member would be willing or desirous of your home. You're entering their home for whatever reason. We often change locations and go into our family homes to be with children, adult children to be with the grandchildren. And we think that that's gonna be an easy change and it is, I guarantee you, not an easy change not an easy transition and needs to be talked out, talked over and talked out thoroughly before the move is made. Suppose you do decide to go into your own home stay in your own home and you find that you're going to find the debilitating illness of some sort comes on. What's available in home care? Just click on home care for us. There are all kinds of home care people who are available but services are often included in home care are personal care, assistance with dressing, feeding and personal hygiene, homemaker assistance, including housekeeping, shopping, meal planning, preparation, respite care and assistance and support provided to the family. If your family member is giving you a primary care then it's important that they get a chance to have days off and nights off and times off. And if you need to have the care ongoing for some reason then we need to provide for that. So this is one of the things when you think about living in the home which is just fine. You may want to explore what home care services are available, the costs and how they can be covered. Again, these are the costs in original Medicare, zero dollars for home health care if qualified. Oh, I'm sorry, that's your costs in Medicare, zero dollars if you qualify. 20% is your coverage for Medicare approved amount or durable medical equipment. So, but these are also requirements you can see in the list here. Bring that back up Eric. You can see in the writing here that there are qualifications that you have to fulfill in order to be eligible for home care coverage in Medicare. But home care is a wonderful option for you to stay in your home if you can afford to and have those resources to pay for for home care that is available. And there are many, many resources and people who do this or their own sense of calling and living that they do. So back to resource library. If you are going into home care staying in your own home care you may want to take a look at some adult daycare centers. And if you have a mother or father who wants to live with you you may want to also research availability of these daycare services so that several things can happen. For one thing, I know my my aging mother at one point wanted to move to California where my older brother lived and his two daughters and his wife. And so she moved there and she sort of shocked because she actually gave up her whole community a supportive community in her hometown of Kansas City in order to be there in San Diego close to her grandchildren which she loved very much. For her, her adult care or her adult community was in the church but there are these other adult community opportunities that could be looked into in order to make that social connection for a loved one and you can do it for yourself as an aging person. Be aware that there are those ways of connecting person to person and they're very important for your health and well-being. Let's go back to the Resource Library. Also, as we go down this list, we looked at advanced health care adult daycare centers. Case management agencies are very, very helpful. I reckon we don't have any listed here on this website, but I recommend that we look into case management agencies or case management persons when we need them. When things get critical and the family feels anxious about how they're going to manage everything and they're not certain what's available. Case management agencies or case management persons can be tremendously helpful and they can be social workers. They can be so well-trained and so much aware of the resources that are available that it will just relieve the anxiety of the whole family system. So, home care is a possibility.  If we don't go and stay with home care, we may find that we need to go into some other kind of housing. Click on the housing for me, Eric. There are several kinds of housing available. There are care homes and foster homes, assisted living and senior communities, nursing facilities and transitional emergency shelter. But the first three is what I'd like to look into. These sort of can be, in a way, graduated. You can go from independent living in a facility to assisted living and then to nursing facility. In other words, if some of the retirement, for instance, some of the retirement communities that you might be aware of already are senior communities, click on this, Eric. Assisted living and senior communities are for moderate to high income elders, 55 and older. And they provide sort of a safety net of all kinds. System of a system of care right there on on site. Assisted living facilities provide laundry and housekeeping services. Assisted living and provide apartment units and bathrooms. And they enable you to do what ADLs or activities of daily living that you're capable of doing. Sometimes for some of us, those ADLs diminish and we need assisted living to increase and take on more of what of what we need to be able to do and care for more of our self care. Some of the retirement and residence communities scroll down there a little bit, Eric. They are for moderate and high income elders and they provide housekeeping, transportation, recreation, meal services, on site medical care. These are actually sort of a condominium, almost condominium living. You don't rent if they're usually on a rent lease basis. Some of them can be purchased, but rent lease basis. But the point is that they provide, again, the whole community life support, transportation, some of the ADL activities of daily living that you may need some assistance with. And. But they provide that whole support system. And if they're and if there is a diminishment of your physical capability. Some of them have attached to their facility of a retirement community have attached assisted living care and also skilled nursing care. The skilled nursing care is the next. Is the next level of care. And when I was in a long term care facility in. Our Vanna, Colorado, just outside of Denver, I worked with patient and people who were in. Independent living. And then. In their independent living would then be introduced to assisted living without moving out. And then would be in then would move to the next level of nursing care when they got more severely ill. And that nursing skilled nursing care would be focused on their. On their particular needs. They had pharmaceutical support. They had. PT support. They had all kinds of care in the skilled nursing nursing facility, even to the point of memory care, then with. Dimension and all timers. So within that one facility, it went from independent living to all time assisted living to. Skilled nursing to Alzheimer's care. So you had the full range of care available within one facility. And that can be something you can think about. As you age, move into this aging, do you want to do you see yourself needing that kind of support system as you move. Through elderhood. And again, sometimes when some people like clients have moved to another place so they can be close to family members. Not living with family members, but close to family members and then are able to afford a retirement community that is that actually provides this ongoing support system. Let's back out of that again, you see some other there are also care home, foster homes. Care home, foster homes, if you click on that, Eric. Under housing. Your house. And sometimes. As I mentioned, our approach to aging with some family members, for instance, maybe an approach that is. Crisis oriented. Get into my family member has a crisis. And we've just got to do something. Care home and foster homes can provide opportunities for housing. Sometimes on an emergency basis like that, because they're small and they have the devoted most of them I've known have had devoted caregivers. Who take care of six or so. And are very well focused on the care that they give. So returning to housing, you can see we have. Listed here in this website, care home and foster homes, nursing facility assisted living. These are the general categories. And then down here below, there are some actual lists of available housing of that that. Remaining on the island, you could explore as being options. And one of the things I recommend is going to the facilities before you need to go to the facility. Go check it out. Go if you have friends or in them, visit with them. If you don't have friends. Or family members already in the facilities, go look at them. Check them out and see what they're like. And kind of get a feel for imagining yourself in that position to be ready to move in and to want to make a choice. Good, good, good detail here on on housing. Most important. It is the most I think the most important question that we face in our aging process. Beyond that, no, there are, of course, meal services, medical equipment, let's go back to the resource library. You see topics of meal services. Any meal services are provided medical equipment, palliative care, senior centers, support groups, family members of Alzheimer's, for instance, or Parkinson's disease. All their support groups that are very helpful for for family members of particular diseases. Oh, this is this is one website that provides a variety of resources. I do coaching on which is a program to engage you in the coaching process so that you move smoothly and gradually into this into this landing into elderhood. And we look at all the resources that are available, but also I work with you to create an action plan so that your action plan can be one that you use to make it the most wonderful landing opportunity it can be. Thank you very much for joining with me here today in this exploration of entering elderhood, preparing for elderhood. I want you to have an aging process that is wonderful, well, and then to die well as well. We don't provide much for that, but I am confident that we have all the resources needed and just need to make sure that you're in touch with them and that you're planning well and preparing well ahead. I want to say hello. Hi, this is my don't just age engage program every two weeks here at two o'clock on Tuesdays. I look forward to seeing you again in two weeks. Aloha.


Hi, I'm going to show you how to set up your printer and make your default printer the copy machine in the office, or whichever one you use most frequently. So once you log into your Windows 8 computer, go on down to the bottom left, go to the Windows icon, the start window.  Go ahead and click on that. This will bring up any printer that's installed on your computer already, so this will be the printers you have access to. Scroll down and find the one that you would use the most. For example, I'm at Ryan's, so I would pick the Ryan FO as front office and as multifunction. That's the copy machine in the office. Right click on that printer, whichever one you choose to use your default. Make sure you click right here as it says set as default printer. Right click again, go down to printing preferences. This will be just like we used to do with all of the XP computers. Right where it says job type, click the dropdown, make sure it says locked print. In details, your user ID, put your last name or whatever you'd like to appear on the printer screen when you go into get your print job. Your password is your printer code. So go ahead and type in your password there, which is your printer code. Click OK. And the second thing you need to do is go up to valid access right here towards the top. Put in your print code there as well. Once it's all done, click apply, click OK, and you're ready to print. If you can print two more of the copy machines, your building may have two or three copy machines in it. You'll have to do this for each one of those printers as well, but choose one of them to put the green checkbox as your default. Once that's all done, you're ready to print. Hope that helped.


Well, let's talk about test trace, shall we? So first, some audience participation. Who knows what trace is? OK, almost everyone. And who uses it regularly? OK, almost half. And who has had some issues with its performance? OK, so yeah, there are still some people. So probably those are genuinely interested in this talk. Anyway, S-Trace, as you all know, is a Cisco tracer. And this talk focuses on one particular bit in its main page that a tracid process is running slowly. And it's considered a bug. But in fact, it's part of the way S-Trace works. Specifically, S-Trace uses P-Trace debugging subsystem for tracing. And P-Trace actually is a generic debugging interface which provides a set of commands for manipulating traces. And among these commands, requests are like reading and writing traces memory, reading and writing registers, et cetera. And almost all of these operations are performed on the stop-ed processes. And another part of the trace API, which is kind of peculiar, is the fact that while it abuses the standard Unix sign-link interface, specifically wait-beat, in order to deliver like notifications about traces event. And for this, it is used for all kinds of events, like standard stops, which are issued after P-Trace continue or P-Trace single step or P-Trace Cisco requests or some signals that the tracid has received and so on. And what S-Trace does, well, it just sits in a loop in waiting in wait-for, and upon receiving a signal from a child, it tries to figure out what child it was and what event happened. So then it actually reads the information from the tracid. Usually, it's registered, but sometimes, depending on the architect, it also memory. And then it can figure out what the Cisco is and what its arguments are. And then based on the Cisco number, the specific decoder is executed. And additionally, it performs some additional memory reads in order to properly decode the Cisco and present it to the user. So when the decoding is finished, well, the tracid is resumed. And this stops and resumes happen twice for each Cisco, which is kind of unfortunate. So well, assuming that little can be done about the way S-Trace works itself, we can try to at least optimize the way it does what it does. And actually, there is some room for optimization. Specifically, depending on the architecture, there is a different way to obtain the registered data, for example. Historically, it was Petrae's PQSR request, which allows reading word by word from specifically designated addresses, which represented traces registers. But later, for some architectures that appeared later in the Linux script, new interfaces have been implemented, which then have been backported to older architectures such as x86. And by enabling these interfaces, actually, we could speed up the S-Trace's operation to some extent. But yeah, it happened quite a while ago. Like for x86, Petrae's GetRedSet enablement was done in 2013 by Denis Vlasenko. And instead of issuing a multitude of Petrae's operations, it reduced to only one. It is not all that rosy for some other architectures. For example, for 32-bit x86 architectures, you still have to read memory. And for MIPS, you still have to read memory. And for IA64, for Ethereum, you still have to read memory in order to obtain the registered. Because for Ethereum, it's stored in registry files that is basically a region of memory. But for most architectures, it has been reduced to a single Cisco for obtaining registers on Cisco entry. The next thing is just, well, do not issue some Petrae's request that are not needed. For example, you don't need to get the Cisco number on existing, assuming that you are doing your traces state tracking correctly, which is another issue that has been solved by Petrae's Cisco info request that it reports also whether you enter the Cisco or exit. Otherwise, you can't distinguish these two states reliably. And well, it's a source of several bugs throughout history. You have, for example, an assumption that after exec, you are in trace. The first Petrae stop after, for example, exec v is Cisco exiting. But it's not always the case and not for all architectures. And well, we have hit such bugs several times and well, you still couldn't solve them reliably without while implementing Petrae's Cisco info. Same goes for like filtered processes. Well, when we know that, well, we are not interested in specific Cisco that we do not need to issue any Petrae's request on its exiting at all. It's just, well, you have to resume it and that's it. The next thing is various optimization specific to like specific Petrae's modes. As a leftover or after like get rexet and outment, separate Petrae's PQser request for EIP register has been left over and then it was patched. So after we have obtained the registers, we need to actually read data from trace. And again, historically, it has been done by Petrae's big data interface, which allows you reading traces memory word by word, which is not very quick if you want to read some large structure or some array or something like that. But in Linux 3.2, a new set of Cisco was implemented, specifically process VM read V and process write V. It was originally designed for applications like MPA-based message-pacing interface-based applications when you have several processes running on the same node, you can avoid double copying of memory via like shared memory or via pipe by like using this specific Cisco that allows you to copy messages directly between process. But well, it was also useful for S3 as it allows like issuing a single Cisco for reading all the data it needs, well, at least for specific data region. But it still was a bit cumbersome since we have separate move calls for each array item and so on. So six years later, Dmitry implemented caching for this calls to perform the seeding of the whole page of a single process VM read vehicle and that allowed speeding up array-pacing considerably. Another thing that was done is like some general optimizations. For example, it was usually assumed that, well, you don't have like a lot of processes to trace. And well, there was a simple algorithm implemented for matching PID to like Tracy control block like Trace description structure. But when you have a lot of processes, as some did, it all starts eating significant amount of CPU time and by like implementing trivial hashing by like using the lowest 10 bits, it was sped up quite significantly. Like in this artificial example, it was five times speed up. But yeah, not all the fixes are the same. And there was actually a bug that was opened by Red Hat partners that was some flat stop when Trace with follow forks option is executed on multi-thread processes. And the issue was, well, the reproducer is quite simple. Just, well, you have main process that runs, well, spawns 10 threads and each thread like starts running a cheap Cisco like get to it. And the problem is that after spawning three or four processes threads, it will just stop doing so. And it virtually hunks. And as it turns out, it was a scheduling fairness issue. And well, you can assume that it's a kernel bug and Trace shouldn't care about it. But on the other hand, it's Trace and Trace users who impacted by this bug. So the solution was proposed to collect all the traces stops in a batch and then dispatch them. It was like implemented in a month. Like it was more or less by the end of January 2009. But there were some disagreements with Trace's maintainer at the time. It was Ron Pongra. And yeah, there was some disagreement within some specific of this patch and was the way it was implemented. So after initial inclusion, it was reverted back half a year later. And the fix itself became real only. And it was like that, like almost 10 years. There was like one follow-up discussion three years later when the time has come to forward port this patch to yet another rail. But yeah, status quo was like it was carried over in a rail. And that's it. When I became maintainer of Trace, I faced the need of forward porting it again and decided that I don't want to do that more than once. So I tried to upstream it once more. And actually it took more than half a year and uncovered several bugs in Trace, like more or less like some corner cases. But still, we have added like three or four new test cases for this corner cases. And yeah, it finally has been included in Trace 5.0 that was released back in March 2019. And this patch has quite a number of results lines and co-opted by lines. And I actually noticed that I've missed at least several people when I write a document message for it. But it doesn't help much with general solveness of Trace. Like, this removal of redundant Trace requests and using of PSP process VM read where I was like speeding up stress only so slightly, like tens of persons. And, well, as some may know, there is like a famous or infamous post of Brandon Gregg about how stress is like 400 times and so on. And now I'm reciting it or making it more popular. But actually, I couldn't reproduce it. But the issue is the same. If you have some process that just spawns Trace, then how you stress becomes a major bottleneck and can slow down the process significantly, like more than 100 times at least. But in real world, you still have such a slowdown, but not as dramatic, but still. And you can see that in this example, like all the improvements of Trace over the past 10 years a lot, only gaining tens of persons of performance. So if we can't, well, speeding up as Trace anymore, we can try to approach the problem from another edge. And actually, it was approached by security researchers who uncovered several side channel attacks which slowed down Cisco entry code significantly. And as a result, it's now like three to four times slower with all these kernel patches and microcode mitigations. And actually, there was quite a fine-crafted Cisco entry routine for x86. And it's now has been thrown out in 2018 by Andy. So it's no longer the case that it is there. One aspect of this fine-crafted routine was that, well, if you have a fast pass, you're not, for example, Ptrace, then well, you have much better execution time for Cisco rather than Ptrace. So by having Ptrace itself slow down, the process significantly. So yeah, with this fancy side channel mitigation stuff, you now have only a couple of times of slowdown, which is actually in line with what other architecture has, for example, MIPS, ARM, Power, or S590. But still, it's like significantly slowed down a couple of times of times. And all this because we have to stop Trace each time for each Cisco. But well, we don't actually have to do so. There is actually another infrastructure in Linux kernel that is called SecComp for secure computing. And it allows enabling some filters for processes or Cisco filters. Originally, it was implemented for process unboxing, but then it was extended. And what is interested for S3 is that in Linux 3.5, the SecComp programs gained an ability to return to Ptrace-based Tracer by issuing specific return way. And sometime later, it was actually a result of two GSOC projects. The support for generation of such filters for traces has been implemented into S3. And it was included into S3 5.3. So now, with this SecComp BPF option, you will slow down Trace in this artificial example only by a couple of persons and not by a couple of times of times, which probably a significant improvement. Yeah, and with some more or less realistic examples, you still, like, if you, for example, trace only, in this example, I was tracing only memory-related Cisco and I gained only one and a half slowdown instead of two to three times. So that's probably a short history. And yeah. And there's not a lot of playing for future, like, in the near future, probably, like, some refinement of the existing capabilities. But in the distant future, probably, some drastic changes are possible. But it mostly related on the addition of specific kernel interfaces first. Only then you can implement it in S3 later. So that's probably it. Any questions? So before we jump to questions, I want to tell you that we have a mic for questions. So just raise your hand. I'll come to you. So, hey, I'm wondering why is not the BPF backend default yet? What are the problems? No, first, we have enabled it in release 5.3, which has been released less than half a year ago. The issue is that I personally don't feel confident enough in enabling it by default. For example, when you impose a second filter on a program, then the processes down the code for chain can't set up their own second filters, and so on. And actually, we have uncovered several minor bugs in which we are fixed in the later 5.4 release. So we just probably want to wait a bit some time before we can enable it by default, like it was with, for example, second reading, which second reading is a bad example, because it took almost six years for enabling it by default. But yeah, the issue is that we don't want to regress people. And when we enable something by default, we want to be sure that it won't regress a lot of people. I have an alternative answer for this. So second BPF, it has two limitations. The first one is that you can't do this when attaching to already existing processes. So strace-p, you can do this unless you are privileged. And strace is normally not privileged. If you are rude, you can do all that kind of fancy kernel tracing when you are just a regular user. You use strace, and you can attach a BPF filter to already running process. It's the first issue. The second issue is once you attached a filter, you can't detach it.  It will convert to a, the filter will work the way that instead of stopping, instead of trapping, it will just abort all this call in vacations that had to be forwarded to Tracer. And it's really unusable. Oh, my last question. OK. So assuming you have Perf and an unlimited buffer or just a way to stop the process when your buffer fills up, will it be the ultimate solution? Or are there any benefits of the current approach, right? Yeah. And actually, that's what was proposed by Steven Rosted in this patch, like pausing the Tracer upon, well, when the buffer fills. But there is actually another issue, like trying to port all the decoders to BPF. Like Perf enables rich Cisco decoders by having some BPF programs that will attach to trace points. And thus, you can perform a retrieval of specific parts of traces memory which are required by the decoders. And it puts these parts of traces memory into buffer. And then you can retrieve it from buffer in order to print it to the user. And it doesn't go well as it is with currently implemented decoders for S trace. But yeah, in theory, if you have an approach like this will be enabled and you don't have other significant issues, well, it is quite possible. And it's actually, well, the future is seen in the far distant. Because, well, BPF programs as well as quite limited as they are now and not all decoders, we can port that easily. For example, IOCTL. You can't port IOCTL to BPF. Or like some network Cisco we want to decode net link. But yeah, it's a limitation. But I mean, it is the same as with second BPF. We can implement it for most of the CIS calls and then provide special handling for the rest of it. So thank you for your questions.


All right, get ready to see a rule that you probably didn't know existed, probably haven't seen put into effect, and then get ready to see a version of that rule that you definitely have never seen before. This one's brought to you by DraftKings. Download the number one sports book app. Use promo code Johnboy when you do to let him know. I sent you. Ozzy Alby's going to take this pitch and slap it right up the middle, right over the bag. JT makes the stop.  And he hits homers and he can tie the game with one swing and a nice curveball drops him to one knee. And now they're like, hey, he's swung at that curveball. Let's throw another curveball a little more off the plate. So see if he'll swing at that. And it's a little off and so layer says, no, I'm good. And now the one one pitch, another curve and that is such a nice pitch. And Ozzy goes to second and he's safe and he's going to third. No, I'll stay, I'm good. Look at that pitch, man. Look at this pitch. I think it would have been a called strike too. And Solaire just swings out of his shoes at it, just misses it. Now watch the umpire cause Solaire leans into the catcher. He doesn't get out of the way, leans into the catcher spot. The throw goes wide. The umpire, Mike Esterbrook immediately calls interference on the batter, points at him says, hey, you got in the catcher's way here, you can't do that illegal. Now the confusing part, the very confusing part is the first part of the rule says, if the batter interferes with the catcher, the plate umpire shall call interference. The batter is out and the ball dead. No player may advance on such interference and all runners must return to the last base that was in the judgment of the umpire legally touched at the time of the interference. So Ozzy has to go back to first and the batter is out for interfering with the catcher on this throw. The only problem where it gets really confusing is Mike Esterbrook, after making this call, so lairs out, right? So that's fine. He called interference.  And Esterbrook says, yeah, that's three outs. Now that's where you have confusion on top of confusion because he lost track of the count. So he thought that Soler struck out and that was the third strike. So that's an out, meaning if he struck out and then interfered with the catcher, then there has to be a punishment for interfering with the catcher on this play on the stolen base. So the punishment would be the runners out as well because you can't punish the batter. He's already out and now the runners out too for punishment for the interference. Does that make sense? That's the rule that he's putting in place here. So they tell Ozzy this and they're gonna explain it. And Soler's like, okay, I have no idea what just happened. And Ozzy's like, what happened? And then Mookie Betts comes in and says, yeah, what's going on? And then he lets him know and Dave Roberts is like, I'm so confused, but I'll take the double play. I'm not gonna ask a single question. So he tells them, well, he's struck out. So Ozzy's out for the interference and Mookie goes, oh, classic. I have no idea how that would make sense, but I'll act like it does. Meanwhile, the first base coach comes up and says, there was one strike. It was one and one. It was one and one. It was one and one. It was one and one. I was like, yeah, it was one and one. And Manny, the ump's like, oh, what's up, dude? How are you doing? Glad we get a chance to say hi. It was one, one pitch. So if that, no, no, no, no, we're good. We'll figure this out. No, we're good. We're good. You go there and he's like, hey, it was one and one. Can you go tell him? It was one and one. So this ump, Manny goes to tell him, now Snicker is playing with his chain and he's like, well, the batter's out and Solaire's like, dude, I still don't know. Stop asking me. And Estherbrook's like, wait, what was the count? It was only one and one. So it's not a strikeout. They go check on the count. Everyone's hanging out. Everyone's confused. He's like, I think I got this, man. I think, I don't know. And they're trying to figure it out. They're like, we're gonna figure this one out. He's like, hey, Manny. Hey, Manny, Manny, come here, come here. Is this what happened? And the umpire says one and two, he goes back. He's like, yep, it was one and two. It's one and two count. He goes back, batter is out. Yeah. So he goes back to first, batter's out. There was only one out on the play and Ozzy's like, wait, I go back and him and Mookie are like, I guess so that makes sense. He's like, wait, what? No, that doesn't make sense. What's going on? And you can talk to the umpire and he's gonna ask him like, wait. So I go back to first. I don't get second base. He had called out though. He's like, cause, what? Cause I had no idea. I was just running. I didn't know Mookie's like this. And then they tell him, no, no, no, no, no, no. And he's, he probably tells them right there. Like, no, the batter's out for interference. Like, well, what? And then Mookie's like, oh, on the backswing, on the backswing. And Ozzy's like, oh, or he leaned into the catcher. And he's like, yeah, so he's out. They're like, why would I have been out? And so there's like, okay. So I don't get to continue the at bat. I'm still out. And Muncie's like, man, I got no idea. Don't ask me. I have no idea. Yeah.  He's like, what's going on here? So there you go. We've all learned a little bit. We're all touch smarter. You can take this knowledge. You can use it on the field, apply it to some bets. Draft King Sportsbook is waiting for you. Use promo code Johnboy when you do. Bet on the Dodgers to win.  Why not?


Moving on, on this session, we have a third debate now on dust technology care about health. I will have the pleasure to interact with Carlos Moerera. Carlos Moerera is the founder and the CEO of Wisekey with a cybersecurity company based out of Geneva. He spent about 17 years in the United Nations as an expert on cybersecurity and trust models. So no doubt he will come back on this question. It is my pleasure to introduce this debate, dust technology care about health. And I would say having been in technology for decades, I'm always anxious to start with technology because very rapidly, if you don't have people passionate about a certain type of technology, can they answer what question? Because technology is always a solution in search of a problem by design. So that's the challenge. So I will try to put some context. And for this debate, I was thinking of referring to the work of Carlota Perez, who is an economist and published a seminal book at least for people in technology in 2002 called Technology Revolution and Financial Capital. And I'm sorry for her because I will go very fast. But basically it says they are in the fifth technology revolution. They are like a congrats cycle for technology and basically they have three phases. There is the boom and then it leads to a crisis because the boom always entails excess leads to a crisis. And then ultimately when society understand the potential and it takes some time of these new technology, they appropriate the technology and put it at work to solve more critical problems. And I think this wave started with mass production of processors. That's the foundation of the information technology. Thank you, Intel. And then it has grown. We've seen the excess. I don't need to explain them. And we suffer from some of them and notably the monopolies that have been built around technology and the incredible power of these organizations. So they are excess in the way technology is used. But now we see we have major challenges at society level where technology will be part of the answer. And we will put it to work.  When you discuss with enterprise and there is one not to be in front of someone named them, but someone will recognize who is a large tire company and that says what does it help? What does it bring if we develop the most efficient, the most effective, the best ever tire company? And if the world as we know it will have disappeared in 10, 15 years. The conscious of this overarching problem is very high across. And I think it affects health as well. Health is part of it. You can't be healthy if you're in a dying or unhealthy ecosystem. So you saw a lot of craze in technology around the ultimate customer experience about the way you look and I'll come back to handle your citizens. But my view, this is passé. The problem is to address the human being, the consumer, the citizen, the employee in the planet context. And we should think more broadly on a planet-centric design. And it's not only about being sustainable. You hear a lot of commitment. Given the way we consume, it's about also regeneration. So Arthur will see if the next revolution is biotechnology or clean tech. But hopefully they will work hand in hand together with information technology. So that's a little bit of the context we've all done that I would see for this session of the WPC on health. So planet-centric design based on this evolution and the need to regain control of technology. When you think of taking control of technology, for me, there are always three dimensions that you need to check for whatever technology you, I speak, information technology you're looking at. Number one is data. We heard about data. We'll develop a view. Of course, data is the object of information technology. The second thing and Carlos will develop afterwards more on this is security. Security has not been part of the initial design of information technology. Again, back to Intel. If you think of Moore's law, Moore's law is just about performance and cost. That's how all of the information technology has been built. And now you start to see because of the transfer of value online on information technology. Of course, the more value, the more interest there is for people accessing either the information. That's what we call through advanced persistent threat. Primarily the government agencies or organized crime. There is not a week without that you read about the ransomware attack. But Carlos will develop this topic and then the standards. I think people don't pay enough attention to the standards when they look at technology. It was mentioned in the previous debate slightly. It's because all these technologies are built in silos, most of them. And then we have an issue of the interoperability between the different system and for the information exchange. And if you want to have a debate, now we'll come on practical examples. If I develop briefly on data, the first thing that strikes me this year. I'd like to share is that how come we had two major events. First, the pandemic, obviously. Second, the US presidential election. How can it be that with available data, available data brokers, you can manage your political arguments street by street, house by house, individual by individual in every family. And you can deliver it constantly for weeks. And then we are told we cannot track clusters for me. That's something I have some ideas, but that's something extremely striking. How come we are faced with this? And we heard this morning from an rightly so from the representative of the industry, be it Sanofi or Axa, the data is key. That's what we need. Not only the technical data, but the data about the behavior. And yes, I hear about GDPR, so general data protection rules. Yes, but it exists today. You can run a billion dollar for each camp, a billion dollar more campaign and get the success that you want, the goal that you want. And probably Jacques, it's because there is another giver there very clearly. There is someone setting the direction that's in our case. But I think data and when you go a little bit deeper, it's the same situation today. According to a study done recently by E3 on the GovTech governance tech market, what is called the GAFAM, so the big US technology group, represents 73.3% of global investment in artificial intelligence for health care. So it's another edge taken. What do we do? There are initiatives and luckily under the leadership of Commissioner Thierry Breton, who was rightly, rightly raised around the bell about the enterprise data, which is the last thing that Europe can protect against the US and China. We've published on this with the feedback in 2018 on the geopolitical importance of data. So I don't want to develop more. But clearly, yes, there is a big topic. As I mentioned, the second pillar is security. I will leave it to Carlos Leitron. He will not cover only this, but certainly this part. And I will conclude my introduction on the importance of the standards. Standards are important in technology. If you think of the internet that allows us to, it's you heard IPv4, IPv6 stands for Internet Protocol. It is a standard. You heard about Ethereum, maybe in blockchain. It is a standard.  And I don't want to refer to common goods because we are not there, but certainly it's fundamental. And we heard this morning the difficulties. If you think of what's happening and back to the COVID, who are where the pandemic started? At least that's what we're told. Where's a smart city? It's a Chinese smart city. And Chinese smart city means a security city, meaning they have all the means, and we've done a study as well with the free on this, to do the surveillance, to monitor the behavior of the people. Still, they could not identify it, but the response was a very centrally managed response, as you would expect it in China. And then we heard this morning that other Asian country has had very good results in their response, and not to be mentioned by Professor Flau, and Japan, Korea. This is not a centrally managed response. This is, there are different authorities. The individual rights to my data, my information are respected, but it's organized in a way that they can cooperate, that the exchange takes place. If you don't enter this concept into your design and you don't pay attention to technology choices on which standard you're going to run, then you will have no choice but a centrally managed model, because that's the only way you can have an end-to-end view, but it doesn't fit most of our political regime, and I would say likely so, at least personally. But then, if you're outside of a centrally managed government, then you need to be able to cooperate, you need to be able to aggregate the data, you need to be able to trace the data, and this can only be done if you pay attention to the standards. So again, a context to summarize beyond health and for health, a planet-centric design, and then looking at your technology choices and the way you design your data, we've discussed about it. Probably there will be other questions. We'll cover security now with Carlos and the question of standards, which by the way, going back to the UN, is a big debate on distributed and decentralized form of governance. And I think there are difficulties, but it's also a direction in which to go. And to finish on this, I think we won't find big global solution to your health problem, your climate problem order. We'll need to act locally. That's what we've seen. The big challenge is how do you bring the global power to the local initiative so that they can then communicate and work together and leverage what they can. That's the problem with circular economy. If you just circle it locally, it's good for the few hundreds you're there. You just don't move the needles for the rest of the planet. So how do you make it? You have the scaling effect and that goes through interoperability understanding. So that's for my quick interaction on the technology principles in my view that matter in this debate.


This is the first time I've ever done this. I've never spoken in a word camp before. I've never been in a security talk before. So bear with me. I also want to kind of preempt everybody with a really bad PowerPoint. I'm practicing. So keep that in mind as I go through my slides. She covered most of what we're gonna go over, but I do want to give you a quick agenda of what we're covering today. First of all, I'm gonna give you a quick introduction to who I am and why you should care about anything I have to say.  We're gonna really glaze over that because there's a pretty good shot that everybody in the room has used a theme or a plugin before. I'm gonna throw some pretty scary numbers at you. And then I'm gonna go over how to get around those scary statistics by selecting things that work. Quick guides to selecting plugins that work and are secure. How to stay on top of updates for themes and plugins, which is really important to work across security and website security in general. Some general security tips for keeping your WordPress site secure and safe. Quick conclusion, and then I will answer any questions that you guys have. So first of all, who am I again? She says my name is Jessica Ortega. I'm with Phoenix, Arizona. I am here with sitewalk.com. I'm a web security research analyst and business analyst for sitewalk. My job basically is to study malware trends and vulnerability trends. I am the co-founder and co-host of a security podcast, De-Coding Security, which takes big security topics and makes it more digestible for the small business owner or average Joe. And besides website security, I am really involved with dog rescue. Like she said, I've helped over 60 dogs find their forever homes this year and I love heavy metal. This is a very cute dog. Her name is Francesca. She is wine, one of my rescues. And she is more interesting than anything I have to say today. So let's start with a warm fuzzy feeling before I get into their really scary security stuff. So some basics. What are themes and plugins? Everybody in here is probably used if they were a plugin at one time or another. Basically, WordPress themes are your template. They're your front end. They're what powers the way that your WordPress site looks. They're, in the old days, they would have been a thousand HTML files that tell your site what to look like in individual pages. Now they're primarily CSS and PHP, though there are some JavaScript elements and other languages that you can build themes in. WordPress plugins are a software that can enhance or expand the functionality of your website. Some examples of WordPress plugins would be things like contact form, search engine optimization plugins, social media buttons, photo galleries. There's over 56,000 plugins available for free in the WordPress repository, which is pretty impressive because what that means is that all of this is open source and theoretically anyone can build a theme or a plugin just like the WordPress core is open source. So some scary statistics. The first one that I wanna throw at you is that the average website is attacked approximately 58 times per day. Now what that means is that it's not successful attacks. Obviously your websites are not getting half 58 times per day. That would be both excruciating and a little bit absurd, right? What that means though is that there are automated attack bots or hackers using scripts out there that are trying to intrude into your site about 58 times per day or approximately once every 30 minutes, which is pretty scary to think about. And it only takes one successful attack attack. One intruder or script or bot that can get into your website to wreak absolute havoc. And when I say havoc, I mean blacklisting on the search engines, your site could go down, WordPress, we could be talking the white screen of death. They can completely hijack your website. They can inject their own content into your website, drive traffic to their websites. That's where you see things like pharmaceutical spam, escort service spam. We've seen things at sidewalk all the way up to and including car, car dealerships who are trying to sell things, MNLM for different pyramid schemes, real estate spam, all of that. You can overtake your website and completely destroy your reputation on the search engines. So that's something to keep in mind. I know it sounds really scary. We'll talk about ways to get around it after this. For scary statistics, about 1% of WordPress sites that were studied in Q2 of 2018 have malware on them. What this means is that if you think about the total number of WordPress sites out there, approximately 5.8 million WordPress sites globally could be infected with malware at any given moment in time. That's a pretty scary high number. We found that WordPress sites on average were about two times more likely to be compromised than websites that were built without a CMS or that were built with a custom non-open source CMS. And the reason for that largely is because of the process that we call responsible disclosure. What that means is that anytime a security researcher like myself or like the guys at WordPress or security find a vulnerability inside a plugin or inside the WordPress core or inside a theme, they notify the developers of that theme or plugin or CMS and give them an opportunity to patch, to release a new version that addresses the vulnerability before they actually disclose or publish that vulnerability. What that means is that once the patch is out, a new version is updated, they do publish and publicly announce. Hey, we found this vulnerability. Attackers could get into your site through a VC vector that's usually something like cross-site scripting or SQL injection where they can actually get into your database. And then script kitties or amateur hackers will actually go and build tools to automatically scan for that vulnerability. What that means is that sites who don't go in and update right away are now vulnerable to a security issue that's published that anybody can build a bot to attack. And so what they'll do, if these attackers will build these bots that scan millions of websites every day looking for this one known vulnerability. And if they find it, they will immediately attack it, they'll exploit it, they'll get into your website and they'll upload whatever malicious content, flavor they happen to be into, whether that's phishing or backdoor files or the aforementioned SEO spam. So that's something to be aware of and we think that's probably got a lot to do with why WordPress and other open source applications tend to be more vulnerable or infected with malicious content in higher numbers. What we found was that 55% of the WordPress sites that were infected with malware were running the latest core versions. That means that even if you're doing automatic updates, even if you're on a managed WordPress platform with your hosting provider, even if you've got every security model in place for the core, you can still be infected with malware if you have a weak password or if you have a theme or a plugin that's not up to date. We found that 24% of WordPress sites had a vulnerability and 16% of WordPress sites had both a vulnerability and malware. So if you're not running the latest core version or you're not running your latest plugin updates, you're infinitely more likely to be infected with malicious content than you would be if you were. When we studied approximately 1.5 million sites that were running WordPress in Q2, we found that 6% of those sites were more than likely infected through a vulnerable theme and plugin. What that means is that they had a vulnerability on their website, but they were running the latest core versions of the WordPress core. So they had a theme or a plugin that was likely not up to date or not being updated by the developers. It was code that nobody cared about and it had a security vulnerability that allowed an attacker to get into WordPress. So those are some pretty scary stats. I know it makes it sound like WordPress is super vulnerable, like it's not a useful platform. Nothing could be further from the truth. The fact of the matter is that we know now that one in three sites online use WordPress. So it's a huge platform. It's the largest open source CMS platform in the world, which makes it a big target. It doesn't mean that it's inherently insecure. It doesn't mean that it isn't worth using. It just means that there are people out there who want to attack it and you have to keep security in mind. Great theme. Obviously, everybody's site is gonna be different and the first thing that you're thinking about when you think about a theme is how is it going to look? How is it going to work? Is it going to do everything that I want my site to do functionality-wise? That's a great first step. Your second question should be, is it safe, is it secure? So a few tips for selecting a secure theme. First of all, if you're gonna use a free theme, which is great, they're super customizable, always choose your free themes from the WordPress repository. That's WordPress.org slash themes or from right within your WP admin, which is what this screenshot is.  So the reason that we recommend using the WordPress repository is that there's actually a team of volunteers who monitor that repository for security issues and updates. If, say, a security researcher reports an updare of vulnerability inside of a theme to the WordPress themes team, so those volunteers, they'll actually remove it from the repository until that theme has been patched and updated. So generally speaking, the repository is the safest place to get a theme or a plugin. You can pay for themes. The issue of paying for themes and plugins is that unlike the WordPress repository where anybody can download the zip file and run it through a code scanner or review the files themselves for vulnerabilities or anomalies, with a paid theme, you have to buy the product before you can actually look at any of the code base. So it can be kind of a mixed back. But it's not to say that paid themes are not good. It's just to say you can't look at them before you download them and pay for them. So if you're gonna use a paid theme or you want to use a paid theme, make sure that you're actually paying for it. I know I feel like that should go without saying, but let's face it, we live in the era of pirating and streaming and free unlocked versions of everything, right? You see a premium theme being offered for free and it's not being offered as a trial or a premium from the actual developers. You're seeing it on say a torrent site or a free download site. It means that there's been malware infected with it preemptively. So attackers will actually download these themes. They'll pay for one copy. They'll make a million copies of it and make that available to you. But before they do that, they'll actually insert their own malware or their own backdoor files. So once it's been uploaded and installed on your website, they have remote access to everything in your code. So that can be pretty dangerous and it's something that a lot of people aren't really aware of.  Generally speaking, you want to look for an updated date within the last three to six months. What that tells you is that the developers still care about that theme. They're still reviewing the code. They're still monitoring it and they're still taking updates. You want to check on your developers. So inside of the repository, they'll actually have the name of the developer or the development team for every plugin and theme. You can generally click on that and go to look at their website. Do that. Make sure that their website is secure. They're using SSL. They have good reviews, things like that. And then do a quick Google search of that development team. And you can use things like theme name broken, theme name vulnerable, theme name hacked. You can use in a quick Google search to tell you whether or not other users of these themes have actually had issues with them. You can go to the WordPress repository either through your dashboard or through WordPress Tower and actually download the zip file associated with everything. You can then either open it up on your own if you're good with code or you're relatively familiar with it and look for anomalies in the code using a text editor. Anomalies in the code would be things that exist say outside of your opening and closing PHP tabs or things that seem to run off the page. If everything looks relatively uniform, everything is really well-notated. And then all of a sudden, you have to scroll way, way, way, way right to the right or way, way, way down or way, way, way up. And there's random obfuscated or randomly generated code in any of those places. A lot of times that's a symptom of malware. Most theme of plugin developers will keep really good notes. They'll make everything look really nice and uniform because they know their code is publicly available and they want to have a good impression. So looking for anomalies like that, even if you don't understand what they're doing because you're not a malware researcher or reverse engineer in code, it's a good tip that hey, this might be a red flag. Maybe I should run it through a vulnerability scanner or a code risk scanner or just an antivirus scanner if you happen to have one on your computer. You can download that zip file and run it through and it'll tell you, hey, there's no malware or there's no viruses inside of this code. A lot of this advice is gonna sound repetitive because a lot of it is the same across themes and plugins. However, with plugins it's arguably more important. So if you pay attention to nothing else that I'm saying, pay attention to picking your plugins because plugins have the power to do a lot of good, a lot of damage as well. Plugins often access the actual code for your WordPress site. They change the functionality both on the front end and the back end. They gather information, they store information in your database. They're critical to the way WordPress functions and because of that, there's a lot of room for malicious actors. There's a lot of room for bad to happen. So again, if you're gonna install plugins for free, make sure that you're doing it from the plugins repository. That's wordpress.org slash plugins. Much like the themes, there is a plugin team. It's a team completely comprised of volunteers who will actually go and remove reported plugins from reported vulnerable plugins from the repository to ensure that nobody else is downloading that vulnerable code or if malware is found in a plugin, they'll go in and remove it from the repository. Just last week, there was a pretty big plugin, WP GDPR, which was used for GDPR compliance for the European Union, had over 300,000 active installations and a security researcher found a critical security vulnerability in it. Within a couple of hours of reporting that vulnerability to the WordPress plugins team, it was removed from the repository and it was kept off the repository for about 24 hours while the team patched that vulnerability. So keep in mind that, again, the repository is generally pretty safe because there is a team of people who actively monitor and manage that. And again, along the same lines as themes, check reviews and active installs. Generally speaking, if a WordPress plugin has a lot of active installations, it's probably safe. If it's being frequently updated, it's probably safe. Even if there have been security issues with the plugin, there have been a lot of security issues with really popular plugins, things like Contact Form 7, which is one of the most popular Contact Form plugins. That's had reported security issues, but because it's got an active development base, you don't have to worry about that so long as you're running the most up-to-date version. And there's nothing inherently wrong with having somebody report a mistake or a vulnerability in a plugin so long as that team of developers is patching that vulnerability. So again, review your developers. Look at who's making these plugins. I don't know if anybody got to catch Kathy Zant from WordPress yesterday, gave a speech about evaluating the security of plugins as well, and she talked about what happens when plugins change hands. Sometimes the development team will change, and you can go into the plugin's repository and see a complete history of every change that's ever occurred on a plugin. And if it changes development hands, make sure that it's still being actively developed. Make sure that somebody is still actively updating and managing that because it could be a very popular plugin that gets sold and changes developer's hands and the new developer is now inserting malware into it or they're no longer paying attention to it. So keep an eye on the history of those plugins that you're using. Do a quick Google search. Search for problems. Things like plugin name broken. Plugin name hacked is probably one of my favorites because it usually will tell you whether or not issues have popped up. You can also check the WordPress.org forums. One of the best things about WordPress is the community. And I mean, that's what brought us all here today, right? Is the WordPress community talking about it, getting out there and engaging people who work with WordPress. Use that to your advantage when you're selecting your themes and plugins. And search for, scan them for known vulnerabilities. Again, just like themes, you can download that zip file and you can review the code yourself on a text editor. You can run it through a malware scanner. There are plugins that you can use that will actually scan it for vulnerabilities. There are a lot of different companies out there who offer code scanning and vulnerability scanning. And generally they'll tell you whether or not, hey, this is something that we know is insecure. This could lead to your saving hacked. And install the updates as soon as they're available. Unfortunately, unlike the WordPress core, there aren't a whole lot of themes and plugins that have active automatic updates. So you have to check for the updates on your themes and plugins and you have to update them as soon as possible. Now there's a couple of different ways that you can make yourself, get yourself, get alerted to updates that have been released for themes and plugins. With plugins you can go to the WPVolmDB, which is the WordPress Vulnerability Database. They have both an RSS feed and a mailing list that you can get on so that they'll actually send you an email alert or an RSS alert as soon as a plugin's been updated or as soon as vulnerability has been identified. So you know, hey, I have to log in tomorrow and update my WordPress or I have to log in this afternoon and update this plugin. About updates a little bit. This is in case you've never seen it and I hope you have if you're using WordPress. This is the WordPress update page. It's really tempting to go in here when there are updates and hit select all and update all. That's great if your site isn't critical to your business or if they're minor updates. Your site is critical to your business or your major version updates or it's an older plugin that hasn't been updated in a long time. Update these things one by one because if something breaks, you're gonna wanna know which one of these items caused your site to break. Even better if you can and it's your business website, use a staging environment. I'm calling Jamie just had a talk a couple hours ago about using a staging environment for your site to make sure that when you do these new plugin installations, new theme installations or updates that you're catching any errors or issues before that happens before they break your site and take it down. So all of these plugins and themes should be getting fairly regular updates. If it's something that's relatively static, one or two updates that addresses a security issue or a bug fix every six months or so is usually okay. If it's something more dynamic or more critical, you wanna see things every couple of months at least. Updates can be done from your WP admin dashboard. I recommend checking monthly. So at least once a month, if not more often, log into your WordPress dashboard and hit updates and make sure that everything you're running is up to date. That'll keep it so that your site's safe, your site's secure and it doesn't have any vulnerabilities. And once you've completed your updates, you wanna go ahead and clear any cache that you have and make sure that your site's still running the way that you wanted it to. Look for things like new content that wasn't there before. That could be injected malware or injected spam that's coming from a plugin that's recently changed hands. The guys over at WordPress tell a story about a guy named Mason Soiza who was found to have actually purchased several plugins and used them to insert malware into dozens of hundreds in some cases sites. So that's something that you should always look for. Again, if you can, a staging environment is really good for this kind of thing. That's a double-edged short though and you wanna keep in mind that if you have a staging environment, especially if it's, say, a subdomain or a subfolder on your own, it's hosting a counter in your own server like staging.mindsite.com, you have to put those updates on your staging environment and treat your staging environment with all of the care and love that you would your production site because if it's on the same server and you leave something vulnerable or you leave something not updated on your staging site that is updated on your production site, hackers can still get in through that staging site and they can more often than not traverse directories and get into your production site as well. You'll see that all the time in Cyclop.  And when I say removing, I don't mean deactivating, that's a common misconception. Deactivating themes and plugins is not enough to remove vulnerable code from your website. It leaves it there accessible for any attacker to see. So if you're not using something, make sure you go in and both deactivate and delete it. There are also plugins available that will do things like optimize your database tables, remove duplicate posts and folders. WP Optimize is great for that. And it'll actually clean up the remnants of anything that is deleted plugin leaves behind. So that's something to keep in mind as well. Most of us use either a managed WordPress site or we have automatic updating on our core enabled already. That's a great first step. If you feel confident with your themes in your plugins and I really don't recommend this but I wanna include it anyway because it is an option, you can actually set themes and plugins to automatically update by including these two lines of code on your themesfunctions.php file. So you can go and add these to your functions.php file if you feel comfortable doing that. And we'll actually update all of your themes and plugins automatically for you. But again, the reason that I don't recommend doing this for a production website is because if a theme or a plugin is updated and it breaks your site, it breaks your site. And if you're not paying close attention when those updates occur, things like maybe overnight or late or early in the morning when you're asleep, you may not know how long your site's been down. You can get a white screen of death because it's something auto updated that wasn't compatible with something else on your site. And you'll have no way of tracking that down. You'll have no logs to tell you what broke your website. So if it's a relatively minor site, if it's your personal blog and you don't care about downtime on it, it's not making you any money. Here's a quick and dirty kind of solution to having a log in all the time and check for updates. But it's something that you really want to be careful using. All right, a few tips. And again, it will be available on the website if it's not already. This is my first presentation and I didn't think to break up this laundry list of homework that I'm giving you guys, so my apologies. But just really quickly, we're gonna run through some quick and dirty WordPress security tips, things like changing your admin URL. So what that is is your domain.com slash wp-admin. Leaving that accessible allows anybody who's looking at your website to try and see if you're running WordPress. So we recommend changing that to something else, whether that's your domain slash administrator or your domain slash dashboard, your domain slash your dog's name, whatever you want it to be to hide that. It gives attackers one last thing that they can look for on your public-facing website. And there are plugins to do that. There's ways that you can do it with custom code inside of your settings. But I personally use a plugin because it's easier. You can change admin. There's a ton out there. If you wanna find me afterwards, I'll give you a couple of lists of specific plugins that I'm using. I would have to look inside of my dashboard if I'm being totally honest with you. Patient firewall. This is a paid option and it's not something that every small business is ready for. But a firewall will actually do a lot of these things for you. It'll limit brute force attacks. It'll filter out bot traffic. It stops specific kinds of attacks. For example, uploads, cross-excripting, SQL injection, a lot of firewalls will actually block that type of traffic before it ever accesses your site. So that's a great proactive solution to keep your website online. And a lot of them come with CDNs like Cloudflare that speed up your website too.  A firewall is a great way to do it. Use two-factor authentication. There's a couple of vendors out here who are offering some really cool two-factor authentication options through plugins. Use two-factor authentication. Passwords are not strong enough anymore. Whether you use SMS authentication, whether you use an app, whether you use a physical token, that's all up to you. However you wanna do it, two-factor authentication is available for your WordPress dashboard and you should be using it. Use a malware scanner. So there's free options. There's cloud options. There's plugin options like word fence. There's physical options like site lock, like security. However you wanna do it, use a malware scanner. Preferably one that runs at least daily that can automatically remove or at least alert you to any malware that's found on your website. Ideally, we use all these things. Change the admin. You use a firewall. You use two-factor authentication. Until the end attacker never gets into your website but it's better to plan for the worst than it is to clean up an app, a mess afterwards. Is running weekly an okay practice or should you run it daily? I prefer daily. Weekly is okay if you're okay with your malware not getting caught for seven days. So keep in mind that one of the things about malware, especially like malware changes how your search engine optimization or your search engine visibility works could be sending traffic elsewhere. Reader apps could be sending traffic from your site to other sites for days if you're running weekly. You could have a hack by the Syrian army message on your website for up to seven days. If they get in within a few minutes after your malware scan runs. The same is true of daily scans but typically it takes the search engines and it takes customers longer than a day to find that there's a problem on your website especially if you've got good caching. So I recommend daily, weekly is okay it's better than not at all. There's now as well so I also recommend regularly scanning for vulnerabilities. Now unlike malware vulnerabilities you can scan weekly or monthly for those. So if you don't wanna pay for a daily vulnerability scanner you wanna use something free that you run once a month or once a week that's okay because chances are you're not gonna have a new vulnerability on your website every day as long as you're staying up to date with your updates. Use strong passwords. So the most secure password is the one you don't know. If you can, I always recommend using a password manager. The only password that you should ever really know is the one that you use to get into your password lockbox. If you can't use a password manager use password phrases. So these are things like entire sentences or anagrams made from the first letter of each word in an entire sentence. We're finding more and more that password brute force programs are getting more sophisticated. It's getting easier and quicker to break into passwords and there are entirely too many people still using password one, two, three is their password. Please I'm not gonna judge you. You don't have to raise your hand. You're listening to a security talk and you know somewhere out there you have an account using password one, two, three or password one exclamation point that doesn't make it any more secure. Promise me silently with your eyes, promise me. You're going to leave this room and change your password. I will give you some invitations to free VPNs. I will give you some recommendations so you can sign in over your hotel wifi through the word camp wifi. I don't care. Get out of here and change your passwords right away. It's that critical you guys. They've done studies that last year password was still the number one most used password in the world. Stop it. I can't, I'm begging you. An password that is not any more secure during is change that prefix. So when WordPress sets up by default it sets your prefix on your tables to WP underscore and then whatever the table name is. During setup you can actually change that. You can change it to random letters and numbers. You can change it. I think one of my sites is actually using my dog's name. So it's like lion underscore WordPress tables. So whatever you want it to be that's one more thing that hackers can't guess automatically when you're trying to get into your website. Limit login attempts and avoid group force attacks. So there's actually a plugin that Kathy talked about yesterday called limit login attempts. It has about 150,000 active installs. It hasn't been updated in six years. Don't use that. There's another one called I believe no group force. That's what I use. It's got great reviews. It's regularly updated. And what that does is it locks your WordPress dashboard down for 24 hours or until you reset the password or 30 minutes depending on how you set it up. Once somebody has tried to log into your dashboard say five or 10 times. Check access. So this is something that you can do when you're actually installing new plugins. Sometimes you'll see plugins kind of like apps for your phone ask for weird permissions. They wanna ask for access to things beyond the WP plugins and the WP content folder. That can be really dangerous. Sometimes they wanna do things like change file permissions to 777 or rewrite execute. No plugin needs 777 permissions for anything. Just don't. If they're asking you for that or you see files on your file manager and your hosting provider that have 777 or rewrite execute permissions, run. Uninstall it, delete it, leave a bad review, run. What 777 or rewrite execute permissions do is they allow anybody to view or modify that file without authentication, without permission from you. It's really dangerous. It's a really great way for attackers to use scripts to insert malware into otherwise legitimate files. So something we see a lot of it at sidewalk when we clean malware off of sites is legitimate core WordPress files that have been modified to 777 or 700 permissions. And they have malware injected to the top of them. They have things like cryptocurrency mining scripts that are hitting your visitors resources, your visitors computers when they hit your site. And you don't know that because it's symptomless because nothing has caught it. So really watch your permissions guys. I know that this is kind of bordering on intermediate to advance and this is supposed to be a beginner's talk but there's a lot of guides available both through WordPress.org and through your hosting provider more than likely on how to go in and look at those file permissions. I encourage everybody to learn a little bit about it. It's not as complicated as it sounds. So remove your WordPress version number. This is another kind of more advanced tip. There's a lot of places inside the WordPress core files where it lists what WordPress version you're using. The reason that you want to remove that number is because it's again, one more thing that hackers have public access to that will tell them whether or not your site is vulnerable. In a couple of weeks, we're going to have WordPress version five come out and everybody running WordPress version 4. whatever is probably going to be vulnerable to some kind of security issue. It's going to be easier to break into a WordPress 4. whatever site than it will be to break into WordPress 5.0. And if they can find your WP-admin page and it says running WordPress 4.98, they know exactly what weak points to hit without ever looking at your actual website. And keep accurate backups. Something that we talk about on our security podcast a lot is the rule of three. So if you have a site, you should keep three copies of that site incrementally every time it changes. You should keep one on the same server where your site is for an emergency. You should keep one off site. So in cloud storage, like a Google drive or a OneDrive or your iCloud, whatever flavor of cloud storage you enjoy and one physical copy. So whether that's a DVD, a CD, a thumb drive, whatever. I had a copy of my first couple of WordPress sites that lived on my iPod. I'm not even kidding. It was just a place to keep it that I knew would be secure. So keep backups. Make sure you're incremental. I recommend backing up your site at least weekly and every time you do an update or make a change. Promise you I love work things about it. WordPress makes building a website really easy. It makes it accessible to everyone. It lowers the bar of entry for building a website to anybody, literally. GeoCities and we had bad MIDI files of Metallica songs and that was how we got our websites off the ground. WordPress site on our iPad with no skill. For you, for good, it's equally easy access for back. Work nothing. It's becoming increasingly profitable. It's easy, it's automated. It doesn't require a whole lot of effort from criminals to hack into websites and do things like mine for bitcoins or siphon your traffic to their pyramid scheme sites or their escort sites or whatever. So think about website security. When you're putting your WordPress site together, think about is this theme safe? Is this plugin safe? If you can do that, you're already ahead of the curve. You're already ahead of the average website owner. And if you have the budget and your website is critical to your business, invest in the security. Invest in a good firewall. Invest in a good malware scanner, whether that's through site lock or whether that's through another provider. As long as you're thinking about it, you're being proactive, you're taking those steps. You won't be in that 1%. You won't be in that 6% of a vulnerable plugin that lets somebody get into your website and completely destroy it, completely destroy your livelihood. Let's go out there today and not be part of that 5 million sites that has a vulnerability or that has malware. From inside the various places where it appears or is that a, I'm going to go in and edit some PHP files or something? There's probably a plugin for it. So she's asking if there's a plugin that'll help you go in and remove the WordPress version. To my knowledge, there isn't, but there may be. However, I know that there are tutorials online that show you exactly what files and where to edit and they're really easy to follow. So, that's one of those things that if it takes two minutes to do with an online tutorial or a YouTube video, I recommend doing it that way instead of using a plugin because the less plugins you have, the smaller your attack surface. So if it can be done manually, I recommend doing it manually versus doing it with a plugin. Jessica, your first comment, I don't quite trust it. This is your first presentation. It is. I don't believe that. I don't believe that. Do those come from the same repositories such that they're trusted the same way? Yeah, so the repository has a lot of what they call freemium. So what that is is where they'll let you download, say, a trial version or a version that's kind of neutered a little bit and then they want you to upgrade to the paid version.  They are asking you to pay basically so those developers can keep the lights on. So I personally really like freemium because it gives you a way that you can interact with that development team. And if you're paying them for something, there's a pretty good shot that they're actually, they care about that code and they're gonna keep it maintained. So they are equally safe to the free plugins on the repository. So long as you're getting them either from WordPress.org slash plugins or from the admin plugin inside of your dashboard. One thing, as far as what you were talking about discipline of choosing things, I frequently worry I have the theme that I use which is mainly because it's the only theme for my needs. It's very much a labor of love by one guy while he'll give you all the support he can provide, the only guy doing it. But having said that, I always get nervous when on any theme or plugin that doesn't have an update for say over six months. Is that a rational concern? Yes, yeah. Yeah, and I mean, you can always reach out to that one guy and say, hey, I noticed you haven't updated this plugin or this theme in the last eight months or the last year or whatever. Are you still maintaining it? Have you received reports and Google it? You know, do a little bit of research but it could just literally be that they haven't had an issue, they haven't had a bug. So I encourage communicating with developers, get involved in the community. That's again, that's why we're all here today is for the community. And those open source devs, it is a labor of love. And if they can, they'll usually answer your question. But it absolutely is a rational fear. You know, have you mentioned change themes? I would say yes, if you can. There are a couple of options there. If the theme or plugin is no longer developed, you can either start researching and preparing to change that theme. And I know with themes it's a large undertaking because it could potentially mean completely changing the way your site functions or the way your site looks. And I know that that's a huge labor but it's probably still a good idea. Alternatively, if you really wanna put the love into it, you can learn how to keep that theme updated yourself. That's a pretty advanced undertaking as well. So, you know, unfortunately, there's no easy answer to that question. The TLDR of it is yeah, if they're not developing or they're not supporting that theme anymore, it's probably time to find anyone. I mean, you mentioned, okay, people are talking about these paid ones, but is there any data that might be not paid or for years? I've found a lot of good themes in the repository. It's hard to give specific recommendations for themes because it's gonna be different depending on what you do with your website. I use one called WP Spa for my small business site and I love it. And I've never had an issue with it and it gets regular updates. But that may not work if you're not running a daycare, right? So. For WordPress, is there anything? I've not worked with WooCommerce enough to give a good recommendation one way or the other. I would say just do your research, look at the reviews and reviews are kind of a double-edged sword, right? Because you can buy good reviews so they may not be great or one crazy guy who couldn't get his theme to do what you wanted it could leave a one star for no reason. So really dig in and if you have to email and interview those developers and ask any questions that you might have about their theme. You simply moved the version number, how do you do that? So you would actually have to go in and edit PHP files that have that version number in it. Like I said, there's a lot of YouTube tutorials out that you can actually follow. It takes about five minutes to remove it from your site if you're good with a text editor and a TP. Yep. I'm going to answer the question about the e-commerce theme that is the storefront is like the theme that since automatic bought e-commerce their official theme is storefront and it's actively being maintained and people make child theme of it. So like that's like probably the fast one. Anybody else? You said about checking the file permissions. Where do you go to learn how to do that? So I would start with tutorials for your hosting provider on how to get into your file manager or how to connect to your site through FTP. Most WordPress sites run on a Linux environment so you can go in through FTP or file manager and really quickly see a list of all the permissions. The big red flag that you want to look for is 777. So lucky 777, you're talking about Linux is actually unlucky 777. So that's a really easy way to remember it and that's all you're looking for. It's the WP VulnDB or WordPress Vulnerability Database. WP VulnDB or WordPress Vulnerability Database. WP VulnDB.org or if you just go Google WordPress Vulnerability Database it's the first result. So it's made about buying a theme or plugins that they have developers that are watching if it's paid, then when it's free then you can read all the records in a way. Yeah and paying for themes and plugins is a double-edged sword too because just because you know that they have developers that are managing it doesn't mean that they're good or that they're aware of vulnerabilities because unlike free plugins or open source plugins and themes nobody can download that content and research it without paying for it. So they might have an in-house dev that manages that but that in-house dev isn't necessarily a vulnerability researcher. So it could go both ways. I always encourage if you're thinking about paying for a plugin or a theme really get to know the company that you're paying for. And ask them, hey do you have above bounty program or a vulnerability program that will research your code and scans your code for vulnerabilities? Okay we got one minute so I can take one more question. So, one more. The statistics of the meaning of vulnerability it's highly recommended that you keep everything updated. But those who update everything what's the percentage of vulnerability there? So it's hard for us to tell because we can't get updated themes and plugins because there are so many. But for people who have almost no plugins so one to five plugins and one to five themes and core updates, the incidence of hack sites or the incidence of malware infection is about half of what it is for the rest of the population. So where we see 1% infection rate for everybody else as an average for those who are running one to five plugins and keep their core updated we see it at about 0.45%. Thank you. And sitelab.com slash website security insider or just go to our site there's a big banner on the bottom of it you can actually read that whole report too.