Question who knows four of you know salando Okay, that's only a few Next question are the people who know salando how much engineers do you think work at salando? So maybe raise your hands. We have around 50 and hundred engineers no one Okay, if you then between hundred and three hundred Okay, and Between 500 and 800 Yeah, so basically the father people who doesn't know who don't know salando Salando is actually the biggest fashion company in Europe and we are also the fastest growing fashion company in Europe This is our website. So basically most people actually know us from the advertisement with the screaming people and That that was how we started and now we are Yeah, we are the perfect combination actually Between fashion and technology So our tech headquarter is in Berlin and we also have offices in Dublin Helsinki Dortmund mentioned that birth and effort and we have more than 800 People working in the technology department now and we want to hire a lot of what engineers within the next years So and what technologies you use at salando? Well, these are some of them, but in the future I think we can say everything because at salando we believe that every team knows their job best and Every team is doing knows their product best and every team can choose the best technologies for their job We have lots of Java engineers, but we also have Python Scala We use Docker for deployments on AWS We also have some people that are very passionate about node.js. So if you like node.js, we also have a place for you we use Cassandra postgres you name it so we are our foundation principles are And what you we want to do is be API first So when we do a new project we build first API and then we think about implementation this way We are not stuck with the implementation and We don't have to worry about technologies that Consumers office business of an API are using and we can show ourselves from it We use rest we use software as a service and we want to do it more We are migrating to cloud to AWS and we are currently migrating from our monolithic structure to microservices Because we believe that's way to do to do if you want to be reliable If you want to be scalable and if you want to give teams autonomy and freedom to make their own choices So basically you already mentioned some things we want to focus on now So actually we implemented radical agility in the whole technology department in the beginning of the year to really focus on trusting our people and their abilities and we want to Give the key give our teams the way like And the autonomy so that they can really be creative and that people that also projects get Get done quick more quickly We will implement a tool of mastery for our in Employees and technology so that they can develop their skills and also exchange their knowledge and we also try to really Develop our leaders so that they can Manage their teams better What is really amazing about us? So we have tech talks every week where people really talk about their projects so everyone knows what is going on We have two heck weeks a year where actually people coming together build new ideas and now we also have a Innovation lab, which is amazing because those ideas are not just ending after this week, but we can implement them in the daily work and From you know those of you who are like fashion addicted like me We also have 40% discount if you're working at Salando and Yeah, if you want to learn more about us, please visit our tech blog We are also here till The search they actually there's gonna be a colleague from Dublin tomorrow So just come over and ask all the questions you want to know Okay, can you hear me if I stand this far away from the mic? Is that okay thumbs up in the back? Thank you very much so We that was a very great presentation by Salando. Good job. We have no slides Nothing nothing of the sort. In fact, we didn't know we were gonna do this until a few hours ago Your list is and I are not from HR. We are both Engineers so we're here to tell you a little bit about data robot a lot of you have probably seen our Display out there and some of our stuff is stuck in Madrid. So Come back tomorrow, and we might have some t-shirts Well, we're getting there So I guess we can start by saying what data robot is and what we do That would probably a good start. So we're building a tool for predictive modeling So people in the world have data they want to use this data to make predictions like an insurance company want to predict if you're gonna get into a car accident or if one of your credit card or not it not an insurance company a Credit card company wants to know if one of your transactions is fraudulent The way that they do this is they look at lots of old data and build a model And then we are building that tool for them to build that model much more quickly So there are applications for data robot in insurance and in banks and in pharmaceuticals and in telecoms And in sports analytics all over the place. I'm obviously a little biased, but I think everyone should be able to use data robot. It's good So your listies wanna you tell us or tell these fine people what sort of technology we use Yeah, sure. So we use Python of course Also some no sequel databases in red is Mongo we use a Docker for deployment as a matter of fact we use Docker for multiple things Distributed testing deployment and also for some prototyping As far as the Python libraries. Well, we are all about machine learning So there are multiple libraries out there that we use like pandas known by Cycler. Yeah, so If any of these Sounds familiar when I talk to you even if You know what we're talking about but You're excited about it. We still want to talk to you. That's pretty much how I actually I Join their robot. I was very curious about the stack. I didn't have much experience in it, but it's pretty much I guess but Got my my interest so anyway Python backend engineers full stack engineers Develops there's a lot of automation that we're building around our infrastructure You know, we're all up all about Automated testing of course a continuous deployment. So there's a lot of work to to do around the infrastructure side. Yep so Yeah, we use Python for our entire stack except for the front end That's all JavaScript But because the data science and the web frameworks, they're all able to do in Python. We're one big happy Python family But specifically some things that we we'd like different packages and things we do We're fans of Python 3 not all of our stack is in Python 3, but we're moving that direction So if you're a fan of Python 3 come talk to us We really like machine learning obviously, but we're big on automated testing. So if that excites you that's we'd like to talk to you continuous deployment Letting letting measuring and monitoring determine our decisions and our engineering You know, I guess decisions and also distributed computing So if any of those things sound interesting to you, we'd love to talk to you the kind of problems that we think about and that we want to solve in the near term are Training our models on larger and larger data sets scaling out to terabytes and petabytes of data We'd like to move more towards a microservices oriented Architecture, so if you ever done that or you think that sounds cool That's one of the things that we're thinking about I'm sorry, I let it go to sleep Um Cuz that's all we have to say those are the kinds of things we'd like to work on come talk to us This is Clark he's a data scientist his job is to build accurate predictive mom We were gonna do something we want everybody can you hear me? Okay? Yes, okay. Thank you And so I'm here today to talk about Fanjil and so who are we what do we do? Fanjil started with five people in Edinburgh in 2009 and today We are the market leaders in one day fantasy sports in North America 300 strong across Edinburgh Glasgow Orlando, New York and soon to be LA Now our technology base is in Edinburgh and Glasgow And that is pretty much why we're here today. We are continuing to grow We are looking for developers right across and the stack particularly obviously Python So we couldn't bring our office to you to show you how fantastic it was and we couldn't bring everybody from Fanjil To show you how fantastic they are so instead. I thought I would show you this and now I need to know how to So any questions, please come and see myself in Julie at our stand Hope to see you there soon That's why we focused on the US and that's why we focused on fantasy sports We launched Fanjil in 2009 with five co-founders The reason we launched was we saw as a big market But we felt the existing product weren't great and we could do it a lot better Fanjil is a fantasy sports game It takes the traditional concepts of playing fancy sports over entire season and shortens it into one day We saw real opportunity because there's a lack of innovation in the fantasy sports industry I remember our first playing customer We managed to get five dollars from them and we pinned the notice up on the wall. This was so exciting I remember Discussing with the CEO about how we can bring more players into the game and I remember I'm saying to me We just need three paying players each day and we'll be okay and now you know, we're getting 10,000 a day So this year we'll pay out over 500 million dollars in prizes next year. We'll pay it over a billion dollars in prizes There's over 40 million fantasy sports players in North America and over 100 million sports fans We've got slightly over a million paying players. We've only just scratched the surface of this market We've actually created this whole new category and from a business perspective. That's very exciting It's funny more and more people in the US have heard of Fanjil, but in the UK We're still relatively unknown. Nobody realizes. We're building a billion dollar business on their doorstep We serve over a million users across web mobile and tablets at peak times They are making up to 200 entries and edits per second. That's the equivalent of selling out Wembley Stadium every eight minutes The tech that we're using of Fanjil is exciting because we're solving problems and doing things that no one has ever done before We are looking to double our headcount by the end of 2015 from 120 staff to 250 and that's across our headquarters in New York and our offices in the UK It's about the people that we get to work with We get to work not only with other developers and designers and so on They're also with because of the New York office we get to meet people that we wouldn't get to meet We're not only building a company. We're building a team. We're moving forward together to our success It takes a lot of people to make a winning team and everyone's contributions important So we've strived really hard to build almost like a Silicon Valley type culture here in the UK So it sounds a bit cliched, but it really is work hard play hard every week There are new faces in the office. It's amazing to see how quickly the team is growing You're going to get interesting and difficult challenges here on a product that serves millions of users on various platforms You know if you want to work for one of the fastest growing web companies in the UK then take a look at our careers page today So, yes, hopefully I will see you soon over at our stand. Thanks now. Okay Welcome to the recruiting session. My name is Christine. Like I'm a data scientist at continuum analytics and Fabio here Also works at continuum analytics. He's a software developer working on bokeh. I'm working on blaze I don't know if you've seen any of us in our different talks that we've had At your Python. We also have a booth. So if after this session you want to talk come talk to us Feel welcome to come. So how many people here have heard of continuum analytics? How many people have heard about Anaconda? Okay, so there's a few not everyone I've had a lot of people talking during the the conference who don't know about Anaconda Anaconda is a free Python distribution with a lot of packages for scientific data science and Analytics That's already compiled that you can download And it solves a lot of problems that people have with installing Python in Windows and also In some of the libraries that have C or Python C or Fortran bindings At continuum, we have a product called an Anaconda server that's built on top of the Anaconda free Distribution and it allows large corporations to manage their packaging for structure and have everyone download install internal that internal binary packages Besides that we also do consulting and training in both Python Python and also finance applications Here's our website continuum that I owe We also have support a lot of the open source Python scientific and data science libraries And we are actively recruiting. We are growing a lot Last year when I joined we're about 50 employees right now we're around around 130 and Joining every day This is our office in downtown Austin We have more or less around 60 people there Another office in New York with around 1520 and then most a lot of other people are remote working in both in other cities in the US But not also in Argentina, Colombia, Poland, UK, France, Spain right now we're Yeah, we have an Italian office with one Sorry, Fabio forgot about you So we're hiring Python developers people that can do Finite that are experts in finance, too We have a lot of our customers or hedge funds and and banks, especially in New York web app developers and C++ And and also in general anyone who really loves open source and Python So we're every we're employed people all around the world as I said and you can find all the open careers at the website continue that I Flash careers or stop by our our booth. We're gonna be here all week. I don't have much to add just that As Christina said Christine said we really care about open source community. We have a great We great company environment a great It's great to work with really smart people that have shared the same passion for community open source and everything So if you are interested come reach us and let's talk. Thank you So hi everyone. We are scraping have as you might have noticed Sorry We extract data from the web people collect data We're a fully remote company. We started remotely It's part of our DNA. It's part of our culture The company started five years ago and we have double each year More than double each year. We are now a hundred members Spread all around the world as you can see We have a very generous benefits package. We offer vacations hardware allowance online services allowance we also offer That's better We also for the opportunity to work on open source projects We have more than 10 open source projects We have many challenges We have scraped 11 billion items last year and there is a very big infrastructure behind that So if you like challenges You're invited to apply for a show at scraping have and Please visit us our booths if you want to continue talking. Thank you I'm in the open source program office We are building worldwide world-class cloud and we do speak Python Penguin and whale among other things So if you are interested in being part of that team, whether it be Python or open stack We're hiring many developers To participate in those teams if you're interested in other projects like cloud foundry Or Hadoop or are we also have teams for that? So if you go to hp.com slash jobs You can do a search when I did a search earlier this week for careers in Python There were currently over 300 jobs So wherever you are in the world or whatever technology you'd like HP's a Company that will will provide you the opportunity to grow in open source as well as in technology So come stop by our booth or ask me any questions at any point this week. Hi everybody I'm Tyler with red hat. This is our fourth euro Python, and we're very happy to be here It's always been probably I would say our best recruiting event globally year after year the question that I always get year after year is how can I get a hat and Everyone ask it no matter what event we go to and the answer to that is really quite simple We give a hat to every new employee on their new hire orientation So if you really really really want a fedora, then you need to come talk to us at our booth and We can tell you all about the opportunities that we have This tells you a little bit about what red hat does most of you probably know red hat for bringing Linux to the mainstream But we also have solutions in middleware. It's mostly J. It's J boss. It's mostly Java virtualization we have a management suite that is all written in Python Cloud which is open stack open shift so infrastructures a service platform as a service heavy Python There are large pieces of the operating system like anaconda installer that is completely Python And we also have a storage division. So we're looking for software engineers test engineers dev ops even some evangelists with Python skills and Why red hat I think the number one reason to choose red hat is the commitment to open source Every product that we put out is completely open source if we acquire a company and it's proprietary The first thing we do is take it open source We're consistently rated as for one of Forbes top employers for software engineering We're also very likely to hire you remotely if that's something you'd like to do in Europe Our largest engineering office is in the Czech Republic in Bernon. We're actually relocated four years ago And it's fantastic. We have 800 engineers. They're working on all of red hats products So we can bring you there or we can hire you most likely where you are and The company is doing extremely well. We've had 53 consecutive quarters of revenue growth. So it's a good time to join red hat So how to apply stop by the booth come talk to us We've got a lot of engineers here this week that would be happy to answer any technical questions You have or tell you about the projects that they're working on You can talk to Yuri Fulta who's down here in the front with the camera or myself. We're happy to talk to you You can check our career site one thing I will tell you is if you see a job you like don't worry about where the location is listed if it's listed in the US But you want to work from here? Apply for it ping me ping Yuri a lot of times we move the job where the talent is and you can reach out to us on Twitter So that is it. So hopefully we'll see you at new hire orientation and we'll put a hat on your head Yep Okay So hi everyone I'm Stefan Wiener. You may know me as the core developer of Sight on Sight on compiler and maybe also the xml xml framework It's a couple of years ago. I decided to start working at scooby and so scooby is The the leading German Provider for an e-book subscription service. So you can think of it as a Spotify for e-books and As I said, we are the market leader and now So that came we've gone online in 2012 and We've basically, you know, I thought the market and last few years So we have the largest catalog with 130,000 books in total Which means that you can sign up with our service Pay 10 years 10 years a month and then read as much as you can't possibly think of So I have all sorts of Huge catalog with lots of content. I see a couple books here Most of it is as we're German base is in German, but we have large international catalog and we're constantly growing it We're working together with publishers We have pretty much all German publishers on board by now and We're constantly Increasing the amount of publishers that we got on board. So it's like we're not doing set Self-publishing is what I'm saying is like real publishers titles meaning books. You actually want to read So so what do we do at scooby? I basically pretty much are our Well, let's say most of our infrastructure that we've developed for All the way from getting books in from the publishers up to getting them to the to our subscribers our customers Is running in Python? on AWS so we're doing cloud deployment And that's the technology framework you coming into we're doing asynchronous programming. So we use in tornado as our main web and grist front-end platform and So we're really in doing cutting edge development on our side Yeah, and So that's the the one back-end parts. So we're doing web web developments and our back-end part is Basically using the same same infrastructure. So also not a base And apart from that we're also doing So we were working with our catalog once you have such a large catalog with so many books and so many users on You start facing the problem that you know, you need to get the content to users and large catalog becomes Difficult to navigate and people can't be sure that they find the content they want. So what we're working on is And Nedley and our users to find the right content for them making it easy for them To to you know, get the books they read they don't want to read finding the content they like having recommendations having automated ways to to bring the content to our users and make them happy and That's basically the thing that Motivates us so making our readers happy and we see that every day that there are because We're talking to them directly. We have them on the phone So they call up problems. We can just tell them, okay, this is how it works and they are just you know, they go I'm so happy you're there because this is the best service I Was using the last couple of years and So that's the feedback we kind of we currently get and so we're very happy that We can we can keep that up and you know, keep you making our users happy And that's what we're working on every day so If you're interested in job offers, we're that's that's us. We're actually a pretty small company. We're just about 15 people and Well, being a market leader at 15 people is It's tough, but it's it's very motivating and We're constantly we're growing. We're looking for you to help us Keep up our vision of making our making readers happy making Getting getting people Read the books they like find the books they like So we're looking for for web developers second developers Python developers in general but definitely good developers so people who know what they're doing and Who help us achieve our goals? Okay, so his little This our app you can read us read Scooby on Android devices and iOS devices So the add is a native app and it feels really nice. You can just download it from the from the Google Play Store or the Apple App Store we're also available for for Kindle fire devices So just give it a try see what we've achieved so far have fun reading a bit and then Yeah, come and meet me. I'll be around for next couple of days on the conference and So, yeah, you can you know see my t-shirts Wherever you see someone from screwy just talk to them get in touch with us. We have to hear from you. Thanks Everybody I'm Philip I work for blue yonder blue yonder is a predictive analytics company and What we basically do is we build predictive applications to fully automate business decision-making for clients and various markets such as retail travel transport industry logistics and so on and Our apps are heavily relying on Python a complete stack is in Python and we use some of these technologies you'll see listed here and Of course our applications and corporate lots of data science know how because they're mainly based on machine learning algorithms and Currently blue yonder has around hundred and fifty people right now. We are really fortunate to be growing really fast and This is why we actually search for clever people were experienced in software development as well as data scientists We really like open source software Python has already mentioned. We really like clean coding depth ops continuous delivery and so on Currently we have three office locations. I had quarters on thousand Germany and we have an office in Hamburg and One in London. Most of us are actually writing code every day, which is quite nice So I'm not so much management at blue yonder If you would like to know any more details about blue yonder visit our booth We are here all week and yeah, that's it. Thanks. I've only got one slide Hi, I'm Alice. I'm from cluster HQ Who a company that is based in the UK in Bristol, which is a really great city if anyone's been there We also based in San Francisco in the US And we're looking for people also who would like to work remotely Oh Sorry I'll start again. I'm Alice from cluster HQ We're a company that's based in Bristol in the UK San Francisco in the US And we also have some remote workers and we're a startup with Silicon Valley stun Silicon Valley funding We started in Bristol about five or six years ago and we've recently Pivoted to have a product that works alongside Docker to manage the data that in containers So the positions that we're recruiting for Engineers who can write Python at all abilities developer evangelist and infrastructure engineer So our booth is near to the entrance when you come downstairs We've got more information about the different jobs and things there. So I think we've probably seen some of you We also have t-shirts coming again stuck in customs at the moment. So hopefully but before you all go home We'll be able to give them out to you I'm just gonna hand over to Richard. He's gonna talk a little bit about our product flocker, which is an open-sourced product Thanks, Alice. Um, so I'm Richard. I'm a senior engineer at cluster HQ. Um, What should I say? Our slogan is container data management and what that means is that We're developing an open-sourced product called flocker which is designed to Help you move your Stateful Docker containers from server to server And we do that using technology like ZFS and we use We use we have a different System which uses cinder and open stack and we have a third back end Which uses Amazon and EBS block devices I've been involved To tell you a bit about what I've been doing recently at cluster HQ I've been working on the open stack and cinder driver for flocker and It's been it's been an interesting learning experience for me It works by Attaching creating and attaching EBS block devices to a virtual machine Creating a file system on the block device Mounting that file system and that file system then becomes associated with the container whose data you want to save and make portable And when you make a call to our REST API flocker will Detach the the file system. Oh, sorry. It'll stop the container detach the file system Unmount the file system I should say detach the block device and then reattach it to the new server before starting up the container on One on that new server What else can I say? It's a it's a great place to work I've been there in Bristol for one and a half years so far and I'm working with some of my I Don't know how many of you have sort of programming Heroes and mentors, but I I'm really excited to be working with the twisted developers Jake Jean-Paul Calderoni It's a mark Turing and Jonathan Lang all three of them were kind of there at the very start of the twisted project And they're really smart people to work with but I work with a whole bunch of smart people And we're distributed all over the world And that's that's the other interesting part of the job for me is the amount of traveling and And the conferences I've been to and the the interesting people I've met since joining the company so I would recommend joining coming and seeing us at our booth and And find out a bit more about the software and the roles that we've We've got on offer and I think Adam you're gonna tell us a bit about just a bit more about how we write the software so we almost exclusively use Python and as Richard mentioned twisted and and We really focus on making high quality code So that's the main thing or one of the main things we're looking for in a developer is not necessarily someone who has Experience with zed affairs open stack Docker twisted. Although those would be nice But we know that we're quite limited with that So we're looking for people who really like writing high quality code So we do things like test driven development Everything goes through code review lots of CI kind of things and We really have a culture of knowledge sharing so Like Richard has some of his programming heroes me too There and I've learned a lot working there and I really really recommend it for that and one of the cool things is that Like someone mentioned right you mentioned about red hat also like us all our stuff is open source and We also give back quite a lot to the open source projects that we depend on and like we're kind of allowed to do that and Contribute back and give back the community when we want to Yep, so we've got our own side projects with John flocker And also just if we find bugs or one features in other Python libraries It's pretty nice that we can spend some of our time working on that Come and find some stand and talk to us. We're here till Friday


Welcome back with us folks. Now this time I'm going to show you a few things about how size matters and how Looking at a ticker enter day can tell you what could happen in the event where it turns around with a very good chance of success. So this is NVIDIA last Friday that I played personally without alerting because I believed it was a little risky. However, look at where it was doing a tighter move right like this here and while it was doing this, trust me on this, spy was still going down. So we talked about strength in the ticker. So spy is moving to the downside and this thing is consolidating and ready for breakout. So as soon as spy got a grip and started moving to the upside, this is exactly what happened. It started poking its nose out of that flag and it took off. So I was really fortunate to play the 220 here on this play as we got to this corner getting tight when I saw spy moving down. It was reaching support and then it started taking off. My point is not this play.  You know that here was the trigger for something to the upside. As soon as we got enough bowls in the market, the whole thing started to the upside. So it reached a certain point, higher and lower high, lower high. So it's moving to the downside. Algos took this down at precisely two o'clock and market throughout started pulling back. I believe the president had a press conference schedule at that time. It didn't start it too, but it had a conference at two o'clock schedule. Algos took it down for a certain amount of time. However, look at what happened. Sorry here. Look at what happened. Remove this. Look at what happened. It came down to a line where this is where the bulls started picking up as soon as it turned around. So basically here was my interest. I was watching it carefully because when I was thinking whenever we reach this line we will see the bulls that started to pick up the overtake, the volume from the bearers to the bull side. This is what happened there. So I'm watching the same line as soon as we reached it. This we alerted in chat. We said they're alerting small position and the 220. Why? Because I really see this line here. Yes, it's lower high, lower high, lower high. But the possibility of reaching back up to this line, which is above 220, is really high in the event where we go to the upside, right? So size matters. Am I going all in? This is Friday afternoon. It's 2.30. Very close to that final expiration, which is at 4. It is very risky. We have an hour and a half and at that time we were almost five out of money. How much did we pay for 220 calls? At we paid 30 cents or 20. The total per contract is $30, right? Now, many people will tell you you can play in the money. We could have played in the money. We could have played the two 15s. However, I didn't want to spend much. All I wanted to spend was something that was going to give me back up to a little over 220. And in fact, I had in mind 220, 225. So anything close to 222 would have been very good. And if you know the math, if you're at 222 expiration, basically, you'd be going $2. So from 30 cents to $2, that's a pretty good investment. So let's go back to this. How many can take position size matters? How much are you willing to lose? I was thinking I'm OK to lose $100 on this thing. So let's say you play three, three contracts, three contracts at 30 cents. How much is that 90 $90 total because this is times 100, you know? So $90 for a play that will probably, I said, we're looking at a move to the upside to 222. And that particular case, when we reached a certain point, I alerted the exit. Exit was at 92 cents, so $92 per contract. So I said, I'm leaving one, taking one out, 92 cents. So it's $92 for one contract. And we exited before the top, but I was super happy at 520 times the rest. So basically whatever you had, that's 520, excuse my writing. So whatever you had taken in the first place, you were looking at $90 initial investment. And now you took 1132 total minus your 90 initial investment. Basically you're looking at a final in your pocket, $1042 with an initial investment of $90. So if I had gone with a hundred contracts, it would have made a pretty good end of week and of month for many in a year for some of us. However, that's not the point. I'm not looking at spending something, throwing money out of the window. I'm OK to go with something rather small and end up with something that is that is decent, you know, $1,000 when you invest 90. That's pretty good. So just to recap this whole thing. Why am I looking at this thing here? I believe that there was very low volume on spy when this whole thing came down with the Algos, very low volume. This was called in chat, low volume on this pullback. I believe JTW was calling that. We picked the bottom from the breakout in the morning. And then it looked like we were taking off for the rest of the day. So basically it was it was just a bullish move to the outside. If it had gone down to under this line, basically this is pretty much when we decide to bail and if you watch just the other video about the how we learn from the bad play, this was a pretty good exit. And given the fact that we had $90 on the table at the time, it was not too much of a deal. So I guess you guys are learning from this as well. Let me know any comments. Always appreciated and I'll see you back in a few.


The next speaker is an old friend of ours. She spoke for two years ago. Has it been two years? It seemed like it was two years ago. It seemed like yesterday. Cheryl is, what is your title at the Diana Initiative? I'm a founder. Oh, oh, the founder of Diana Initiative. And it is absolutely my pleasure to introduce to you Shelby Fuss. Thank you. Good afternoon, everybody. Thank you so much for coming to my talk. I hope you are having a great con so far. So yes, my daylight name is Cheryl Buswas. You may know me on the Twitter as encrypted. And I'm going to give you a little talk today about how complicated patching can be. So a bit about me. I work as a strategic threat intel analyst with a, quote, major bank, unquote, in Toronto, Canada. We've only got five of them. And the views that I express here today are mine alone and not those of my employer. As Ming said, I am so very proud and honored to be a founder and a member of the Diana Initiative. We're holding our third year. And the conference is running over at the Westin. I hope if you have been able to attend it, you're enjoying it. If not, we'll see you next year. We celebrate women and diversity and security. And it's getting better all the time. OK, so let's get started. Why patching? Well, because it is a pain point we all share.  And it's also a necessary evil. It's also a highly contentious and a divisive issue for which there are no clear answers.  But it really isn't that simple. It is easy, however, to throw the phrase around and to call out offenders because patching, right? It's just common sense. Why wouldn't you do it? But that right there is why we need to have this talk, because no, it isn't that simple. And playing the blame game is not going to fix the problems here. Because this is about the stuff that we don't know. It's about concerns and considerations that keep stuff running in areas where we don't have familiarity. I'm talking about ICS, medical equipment, legacy systems. If they aren't running, we're not going to have critical infrastructure. We're not going to have things that we take for granted and depend upon. So it's about the real costs of trying to do the right thing, but it goes wrong. Terribly, horribly wrong. And that is the gap between us and business. So I don't know if anybody listens to the Defense of Security podcast here, but on the anniversary of Wanna Cry about a year ago, the hosts, Jerry and Andrew, asked why was Wanna Cry still hitting companies? Now it's 2019 and Wanna Cry, the bug behind it, is still a real threat, because not everything got patched. And that's the reality. Patching gets ranked in with all of the other stuff that enterprises are contending with. And it's not up to us. So I like what Alan has to say here. Patches are important. Complicated and largely misunderstood. Who here would agree with that statement? Yeah, thank you. So we know that patching is, of course, a fundamental best practice. Why aren't we doing it right? Or more importantly, why aren't we doing it at all? And this is the talk, again, that we need to have to address some of the harsh realities, because at every level and in every sector, I've been hearing the same symptoms of what is essentially a worsening condition. So let's start with some pain points. It's messy. Directions are vague or they're missing or they're useless. Do you want misconfigurations? Because that's how you get misconfigurations. It can feel like the worst game of hot potato ever, because everybody's concern is nobody's responsibility. You get talk to until you are out the door completely. And that's, of course, why accountability is an issue. Not my circus, not my monkeys. Thank you. Does this one sound familiar? It seems a lot more like ongoing crisis management. But when your patching strategy is so broken, nobody wants to take on the added pain of process review, because change is hard. Survey says patching sucks, right? Well, let's take a look. These are some of the numbers that came out of a study done by the Ponemon Institute. And realistically, who could commit the resources as they are laid out here? Is anybody here responsible for patching at your organization or involved in it? Are you able to achieve what's laid out here? Is this kind of like a wish list? Yeah, OK. So I have three words. Prioritize, optimize, automate. But that is easier, much easier said than done. Do you remember the good old days when life was simpler and just revolved around patch Tuesday? It was all wrapped up into one neat package? Not any more, because now we have to deal with staggered releases and out-of-band releases. And then there are previews. And then there is supersedance. How do you manage the downtime with the need for uptime? And how do you get all the stakeholders? And there are so many of them. And I don't even want to go there. Informed, I'm working a bank, and signed off. And how do you even know which release you have? So we're damned if we do, because yes, stuff goes wrong. And things break. You just have to ask anybody who went through the joys of what Spectre and Meltdown did to their systems. But Swift on Security has pointed out many, many times that patching needs to be a given. So it often comes down to this. Is the cost for that ounce of prevention one that you can live with? And then we're damned if we don't. And while it may seem like the cure is worse than the disease, WannaCry was a huge wake-up call, not just for those who didn't patch regularly, but for those who actually thought they were. So there are some dangerous assumptions out there about attacks only being targeted. And why would an attacker bother with me? Well, it's not like that. Yes, they're looking for low-hanging fruit and easy pickings. It's not just about targeting. It's about systems that are vulnerable. And everybody has vulnerable systems. So you're not a target, but a victim.  And based on what we've learned, how can we work with our organizations to make this process a less bitter pill to swallow? OK, WannaCry, Eternal Blue, Apache Struts. Not once, not twice, but three freaking times. And just ask Equifax. And then, of course, let's throw in Meltdown Inspector and Total Meltdown Inspector NG. And now, because who needs to sleep, we've got Blue Keep, right? Is that dumpster fire hot enough for you? But on a serious note, we've learned hard lessons from WannaCry. And that still persists because, of course, not everything is patched. And now, we see it being leveraged frequently as an exploit. And I can say that from working in thread intel and looking at what our adversaries are putting together as more complex, multi-staged attacks. And that raises the issue of how older, unpatched systems in municipal governments, libraries, universities, not just hospitals, are being targeted and shut down by ransomware at an alarming rate. 2019 has seen the return of ransomware at high impact. Municipalities are getting hit faster and harder. And if you haven't been following the news, there are far more virulent and damaging strains out there. City services get shut down for weeks. And when this happens, you don't know what you've got, quite literally, until it's gone. Try closing a house deal when you can't. And with that $17 million price tag attached to it for Atlanta, and Baltimore has an $18 million price tag, more and more municipalities are opting to pay the ransom rather than live with the downtime. And the sad fact is that municipal IT departments are underfunded, they're understaffed, the equipment is typically older, software is outdated, and terribly not patched and up-to-date. So what do you got? Low hanging fruit. And we know from painful experience that patches are not perfect. Things will go wrong, and that is why you need to have a process that is complete and tested in place. Then there are those patches that don't quite get it right. For example, last year was not a banner year for Cisco. Who here uses Cisco equipment? Because you probably know what I'm talking about. Yeah, they had to issue a second patch for their adaptive security appliances to address, quote, further attack vectors and features. It was a hot mess. And that was after issuing an initial patch for what was a critical remote code execution vulnerability in their SSL VPN feature. And there were nation-state adversaries pretty much lined up around the corner helping themselves to this. Well, this talk would not be complete if we didn't address Spectre and Meltdown and speculative side channel vulnerabilities because nobody saw this coming. And that is the whole point. 20 years ago, this was not an issue because we had no idea that this could happen. We did not understand the technology we were making as fully as we thought we did. And so the generation who come got to deal with the unexpected problem. And it is a doozy. OK, so it's still ongoing. And we're going to have to live with this fact every time we innovate and create something to go out there. For as much as we may want to take care in producing security around it, we have to allow for the fact that there is the unknown. And thanks to Spectre and Meltdown, we actually know how severe that unknown can be. We also know it now with Blue Keep. And we've seen it, bless you, with various Linux libraries. It's going to haunt us. Every month brought new drama and breakage as we tried to address these. The patches broke more than they actually fixed. And we need to be prepared to expect more of the same that is going to come. So the question is, what have we learned from these painful lessons that we can carry further and use to build in resiliency? So let's talk about the warnings regarding side-channel speculative execution attacks with this latest CPU doomsday attack. Yes, it is affecting Windows machines running on 64-bit Intel and AMD processors. Intel CPUs made between 2012 and today. That is a huge amount of vulnerability right there. So an attacker could access passwords, sensitive info in the operating system, and the kernel memory. Stuff you're technically not supposed to be able to get to. Assumptions. So SwapGS attacks leverage the SwapGS instructions. It's an under-documented instruction. So it makes a switch between user-owned memory and kernel memory. That's pretty complex, but it's also highly severe. We can't expect everybody to know about this. And yet, the impact is on everybody. And how do we rope everybody into something like this without creating unnecessary fear and chaos around it? Well, apparently Bitdefender was working on this for a year before the announcement came out because it bypasses all known mitigations. I'm going to let that sink in. There's nothing you can do.  But we really don't want to run around saying to the company, oh my god, the sky is falling. We're all going to burn down. That's not how we want to solve these kinds of problems, but we have to deal with them. And we have to get management by in to be able to properly and rapidly address this and secure the systems we have in place rather than have it all thrown into the regular patching cycles. There's no guarantee, according to Bitdefender, that an attacker who knows about this, who found it out, hasn't already exploited it. There's a crux of the issue there, too. So Jerry Bell is a connoisseur of Dumpster Fires. He's also the host of Defensive Security Podcast. I get a lot of good stuff out of that one. He summed it up very well. The complexity of patching this thing correctly, and he's referring to Spectrum Meltdown, but I thought it lent itself very well to this as well, is going to provide years of quality post-exploitation privilege escalation. So are we really ready for what can and will go wrong? Question, do you have roll-up rollback points? Do you have backups? And have you tested your backups? I'm going to tell you quite frankly, I have spoken to a lot of places and a lot of companies. I've done security audits. And they don't test their backups. And I'm not going to say anything else about that. So the hard lessons that we have learned, thanks to Spectrum Meltdown, are about the price that we were willing to pay for speed and performance in a by now, pay later arrangement. It's business. It's profit-driven. It's market, driving it to the finish line before anybody else. We didn't read the fine print at the time, and now we got served the bill. And this is going to be a constant refrain that we're going to have to contend with about uptime and innovation. Just saying, but I think we need to question the process when doing things right gets in the way. All right, so how does this extend to the ever-expanding realm of BYOD and mobile policies at workplaces? Here's some statistics that you should mull over. What are your people bringing onto your network? And how do you trust your average users, your office workers, to maintain their technology and keep the patches up to date on what they're putting on your systems? Oh my god, so many things. Why does everything we make have to connect? But it does, because that race to make the next new connectable consumable has left security in the dust. And passwords are default if we're lucky. Hardwired if we aren't. And updating the glitches in the firmware? Well, it's pretty much impossible. So from industrial webcams to SOHO hopelessly Brooklyn routers, Botnets Unite, to, I'm not kidding, the family crockpot. We are talking legions of doom. Sorry, but said it and forget it is definitely not a security best practice. But the fact remains, we keep building stuff we can't fix, especially consumer IoT. It is disposable. So try asking your neighbor to change the default password settings on their cable modem I have. I did not go well. And tell me, how do you patch the firmware on your IoT stuff? So I don't know if anybody's watched the movie Die Hard I rather love the fire sale scene. Well, welcome to the realm of ICS Skata. These are utilities, water, power grid, transportation. It's mission critical stuff that just happens to run our day-to-day lives. And it's more than just that. Operational tech is proprietary. And it goes down hard. Does anybody here follow, if you follow Drago's, if you follow Chris Sestrunk, they share some really great insights into the realities of trying to maintain and secure this environment. And there really is a grim attitude about how this stuff doesn't get patched, but instead, it gets run to failure. 30 and 40-year-old equipment, you don't patch it. You leave it alone until it dies. Gone are the days, though, when these systems were kept separate and secluded from the internet. So are we aware of the operational technology that lives within our enterprise environments, or where we might be at risk from our trusted third parties? Culture change doesn't have to be a Band-Aid solution, but we need to talk about how to make that happen. And it's really just this basic. OT is not the same as IT. And 20 years ago, they just didn't see this coming because security was not something that was baked in the systems. They were pretty much kept segregated. They didn't have to then. But then things changed and migrated, and stuff got connected when that was never supposed to happen. They didn't plan for it. And that's what makes patching these crucial systems that much harder. We have to understand the differences and then work within those specialized requirements. And that attack surface just keeps on growing. Enterprise technology, or ET, is about sensors working over time. And it monitors what we rely on to get business done. So it runs the gamut from, think of refrigeration systems in shipping containers. There are braking and fuel systems in transportation. There are ships and ports. All of this stuff is automated and connected. It relies on technology. And the things that we take for granted have become shiny new targets through technological enhancements. So innovation and automation are emphasized to increase productivity and efficiency, but at the ongoing cost of security. So how the heck do you patch a container? Well, according to an article I read by NullSweep, containers are immutable in the fact that they're not really designed to be patched the way that we think of. Conventional does not apply here.  Well, guess what?  And so we're carrying over the same bad attitudes and bad habits of if it ain't broke, don't fix it, or why mess with a good thing to the cloud. And is there any way to identify the containers that could be running vulnerable or out-of-date instances on them that do need to be patched? So the best solution is to try baking, patching into a solid DevOps cycle with automated integrations and deployment, which sounds lovely. I don't know if you can actually make it happen, but it's a starting point. All right, let's talk about something that is really a matter of life and death. And I know there's some great people like Josh Corman and I am the cavalry who have repeatedly brought this or my friend, Yelena, who identifies it from working as a pediatric nurse in the Netherlands. This is specialized critical infrastructure for critical care. Downtime for patching versus downtime because the patch broke something is a very real issue in medical. And from pacemakers to insulin pumps to MRI machines, there are some very hard choices to be made around how do you patch this equipment and maintain it. And it's something that we do not understand in terms of the hospital cycles and how the equipment is used versus the people who are on site using the equipment. So let's talk about learning to understand that perspective better and being able to work with the people involved to make some real headway. The prognosis is grim, but we know it. And when medical tech gets hit with ransomware because the operating system has been unpatched and it's unsupported, well, then the existing policies in place need resuscitation. This is an example of a pacemaker vulnerability. It was updated last year. But look at the vulnerabilities as they're circled. If this was a Windows box or an Active Directory issue, we'd be all over it because there's authentication and encryption. And how about the fact that somebody just standing close to it could exploit it? 80 of England's 236 national health services trusts were infected by ransomware, as well as more than 600 of their national health services organizations, like just general practitioners. The national health services assessed their cybersecurity level of the 200 trusts, and every single trust failed. Some of them had failed to apply crucial patches and WannaCry leveraged those outdated patches. So why are there no patches? It's because the systems cannot take being patched. They're too far out of date, and there's no funding to be able to update the equipment and the software to the level that it needs to be done. There is, in fact, no easy solution here. All right. Does anybody here work in the wonderful world of mainframes? This is the stuff you don't want to have to think about patching because it's high availability. It runs super fast, like 1.1 million transactions per second, and it's used in things like global finance for that reason. There is no such thing as downtime. That's why these are so carefully guarded and relied upon. I started out in a mainframe shop, and I can tell you there are scheduled outages. Why? Because without those scheduled outages, you will have unscheduled outages, and then very, very bad things happen. So not only can you, but you should hack a mainframe. I don't know if anybody knows these two gentlemen. Big Indian Smalls and Soldier Fortran. They're two really great guys. And they have made it their mission to bring this news to the world for good reason because these wonderful behemoths are vulnerable, too. But you don't hear about it. Why? Because IBM likes to keep those details very secret. And if they issue notifications about integrity vulnerabilities to the users, they don't give descriptions. We don't talk about that. Now, I respect these two guys, and they actually offer courses like Evil Mainframe to teach people and grow a new generation of mainframe pen testers and hackers. So what do you do when you cannot patch? Patching is a best practice, but it's not the only one. Let's talk a little bit about misconfiguration. Misconfiguration has been increasingly at the root of some evil recently, as we know. But that is a human vulnerability and not a system one. So network setup, firewall rules, ports left open. Those are human failings. And they're over and above patch management. But when they're done correctly, they can and will block attacks. We've had numerous out-of-bounds patches to fix over recent years. Do they cause more problems than they fix? Anybody have an opinion on that? If you have to do out-of-bounds patching, does it actually create more issues than it solves? And who here understands what we mean by sequential patching? Again, thank you. It's this terminology, but it trips us up when we try to have talks with the C-suite or other departments. Who here has an actual test environment for patching in place to use?  Who here wishes that they did? Can't put my hand up. Thank you. We need testing and rollbacks for countermeasures, right? Because stuff will happen, and it will go wrong. You do not test on the prod systems. And everybody who has lived through a bad patch Tuesday and had to roll it back, oh, my gosh, yeah. Oh, my gosh, yeah. And the customers and the phone lines are on fire, yeah. People freak out if they can't access their email and their outlook. And that's just the tip of the iceberg, because if that's gone, then there's worse stuff to follow. Now, Windows has had successions of bad patch Tuesdays. So you know you have to prepare for this eventuality. And when the stuff breaks, customers go down. And that is a direct impact to the bottom line.  For business, however, this is the hard argument in dollars and risk against patching on anybody's schedule, but their own. Now, many security professionals think that delays in patching are largely due to the fact that we don't have, well, a common view of applications and assets across security and IT teams. So this is about what we're seeing versus what we are not seeing. Because you cannot patch what you don't know about. What endpoints do you see? And what systems and services are catalogued? I can tell you, from experience, the nightmare it is to try and find vulnerable systems without a proper asset management program in place. And the C-suite wants answers now, because they got a notification of a CVE that was rated like 10. And nobody wants to help you because you are bothering them saying, do we have this in the system? Because asset management isn't showing it, but I need to find out, like, stat. And you can't find the answers to the questions when you need them. Well, asset management, real asset management. I know, eh? It's just, call me a dreamer, please. Thanks. Yes. All right, mitigations. There are some good things you can do to get around the fact that you can't patch. For example, virtual patches can and will help you.  So security is not a band-aid solution. It's a process in line with the needs and the objectives of your organization, not somebody else's, not somebody represented by the Ponymon Institute, but your specific organization. And patching is an integral part of that security process. If we want to move past the pain points, then we need to be able to build our case to the business, to be given the resources, the time, and the acknowledgement required for us to do this well. What it comes down to is, if we want to help management hear that message, we have to write a new prescription for patching. And it's time for a second opinion. That's it. Thank you all so very much for coming. And if you've got any questions, I can take them. Thank you. Any questions? Sure. Okay. So the question is, why didn't I talk about security software architecture review? Unfortunately, it's an area that I haven't worked in, so I don't have the familiarity. It's been kept really segregated where I have had past. Yeah, I understand it, but only at a removed level. And I have heard it talked about when you're doing DevOps and software defined life cycles and being able to incorporate it at that, but I haven't had the practical experience to properly talk. They're not doing it. I like it. I agree. Yes. Okay. Yes, it is a big issue. Thank you very, very much. I appreciate the confidence and the support. Okay. That's my hope with the Dumpster Fires to like. Every slide. Thank you. Yes. Hi. Yes. Certainly. Absolutely. Thank you. Thank you. That's all yours. Thank you very much. Are there any other questions or does anybody need a slide to bring back to rally the team with? I have a fine selection of Dumpster Fires for you. Yes. How do you explain things to management to get by and is it just, is it dollars and cents and risk? It is dollars and cents and it is risk. If you cannot explain it to them in terms of business risk and business risk to that specific organization, you will be sent away. Why? Because I got sent away. I know. Thank you. Yes. That is right. Yeah. Yeah. So the point made is show them how this will impact not just their bottom line, but their own security in their job role. Yeah. Any other questions or comments? All right. Thank you so much. Have a great rest of the con. Thank you. Okay.


What's going on guys, today I am back with another Destiny 2 video and today I'm going to show you guys the location of the engine key chest within the Leviathan raid. Now I've had so many requests to show you guys the locations of these chests as you've got the keys from the feeding buses and certain points within the raid but you don't know where the chests are. Today guys I will show you where the engine bay key is, I've already posted one on the pipeline key and the drain key which can be found linked within my video description if you do want to check them out. So today we have the engine bay but before we go any further guys I am giving away Xbox and Playstation gift cards for you to buy that in game server with Destiny 2 to win one simply drop a like on the video and leave a comment down below. Ok so first things first you want to basically start at the start of the raid to do this because you need to unlock a hidden pathway so follow the path I take on screen now and you will eventually come to this room right here where there is six levers where you have to pull them all at the same time so you need obviously a fireteam of six. Now once you've done this a waterfall will open up around the back left hand side and what you need to do is you need to scale the pipes behind the waterfall where the water in the waterfall disappears it reveals pipes so you want to scale the pipes behind the waterfall and when you get to the top just follow the location I take. Now when you drop down to the fans as I do you want to actually turn back on yourself look up and jump up to this platform right here the room is here literally this is the room where you'll get the engine bay chest from now once you get to this room there are four watchers within it if these spot you it is over now what I suggest you guys do is I suggest you take a look around this room so you get to see where these watchers are doesn't matter if they see you this time that does not matter at all so get a gist of where they are then eliminate all enemies including the watchers within the room then if I were you I would take the route out of the back push down the corridor a little bit as we do on screen now then turn back on yourselves if this has worked is reset the room and the door will be closed simply open the door get ready for when these watchers turn away take your positions and annihilate them once you've done this a chest room will open seen on screen now and this is the engine bay chest but yes guys hope you enjoyed the video and I hope it helped you out plenty more raid secrets underway thanks as always for stopping by and hopefully people I will see you on that next one


So I'll give just a short introduction and then we go directly online. Don't know who remembers the show, no? Okay, so with Henig and actually also Maria Pina, we have decided to give a restyling to the entire website. So we have actually, I don't know if you notice that we have a new logo and with the shades of red which attracts a bit the attention instead of the gray one. And there was a totally new homepage with new submenus and actually also which decided to change also the terminology we are using and submenus. We have now the network which represents all the information about the people involved, how the project is structured and we introduced more material in terms of description and also some graphics because we felt that there was no picture and no graphic content on the website. We add also something that is very important when the glossary was ready we added it on the website so you can actually go and click. So you know what? And navigate and we have news in the van then you will have a page to resources and download where you will be able to see all the material. I think it works much better if you just go online and I'll show you. So finally, I hope it's okay. So this is a new homepage where you can see we introduced some slideshow on the bottom and now we have these fancy menus where you can click and you will have all the different information. Let's for example go to the working groups. I'm sorry. It's not working. Oh my God. Oh, I'm sorry. The PowerPoint, right? I thought it would go automatically. I'm sorry. Okay. But you can't see all of it. That's okay. I will try just to scroll and you tell me if you can see everything. So this is a new homepage. We add some slideshow here. And actually we reserve some space here for the video. The icon so that you can see that it will be the brochure uploaded there but instead of just having the name with the link which is not really effective for people to just go and search for the world it's better to have the icon. And we have more fancy menus. And for example we could go to the working groups. I want to see much. I'm sorry. Yes. So we decided to give some sparkle to the graphs and we introduced actually the description of the working groups with all the familiar faces. Let's see. Another interesting audience was... Sorry for the issue with the navigation now. For example, innovation committee. So we have a complete new introduction about how innovation is addressed in our cost action. And actually Helder was so kind to... Yeah. Helder was actually providing us with the content. What is... Yeah, you have of course the contact list. Well, it's a bit more... We thought it was a bit nicer to reorganize all the websites in this way. So to have these double layer menus, for example for the management committees and actually it goes to the... redirects you to the official cost website. The advisory board, we update everything. But I think maybe the interesting... Wait. Let's go. Just navigate a bit in the network. We introduced actually a map with all the institution and the list of institution which before was hidden. Actually you had to go back to the official cost website to see who is involved. And now you can see it in a very straightforward way. We have the international observers. And yeah. Actually this is what I'm a bit proud of. We introduced actually the feedback from the STSM with the description of what this program is about. And we decided to introduce also the testimonials from... Of course we have the full list of performance ones which needs some update because I think we missed one or two items. And actually this is... Well, we need some... I will show you but actually we are going to change this because there are some issues with the functionality of the website. So we introduced the testimonial with some picture about the experience that people have done during their STSM because we think that it's not just about the scientific content but the network is made by people. And I think it's nice that people involved are actually present with their face and their experience and their feedback on the website which makes it also for people who are not really familiar with the topic and appreciate what is going on and the effort we all are doing here. So I hope soon to have more input from all the participants especially for the STSM. Resources and download. Yeah. We have an update page of all our publication and a page for the reports. And this is something very nice. I think that it's very useful to have actually the full glossary online so in a sort of interactive way. So you don't have to open the PDF file. You just can go online. And for example, click and go directly to the item and while reading and then you want to find... That was... Yes, let's see. No, if you are not that lucky. For the Marfillo, this would be the third. The third also will not work. Yes, it will work. If something can go wrong, it will go wrong. You know. So this I think is a very nice functionality to have it online in a very interactive way. Yeah. Oh yes, that would be... Yes, right. It's really important if you give us feedback. Actually, you can also download it in PDF. We have of course the documents redirected to the old page but now we have also the photos and the videos with information and we hope soon to have actually to add also the web page on the cases with the description that would be also very... Also it's maybe here or in the description. Yes, exactly. And this is something we are very proud of as well. We have a very fancy... The very fancy news and event page with all the items.  So actually any get to do really... To spend a lot of time doing that. But now at least it's also more easy to find out about events and all the past workshop. If you want to go back to the first workshop and look into the presentation, now it's easy, very easy. It's always divided in session and we have conference session as well so you will be informed about the new event, the coming event and probably... We are actually thinking about introducing a calendar because we have this feature in the site core but it's not so easy to use. And for the rest maybe it was just a repetition but we need you. So please answer when we ask for feedback. We miss a lot of the feedback of the STSM and the advisory board and the recent publication especially. We miss a full list of publications. We will send out another call for publications. And of course we have to say thank you to this guy here, to the PhD student of Sebastian because he's really investing a lot of time. I'm actually more working on the description and content and the graphics of the website but he's actually the one who is implementing it in the site core system. So he's really investing. Yes, thank you, Henning. Okay, thank you. Yes, I can't remember the list but it should be held there maybe.


My name is Johan Fischer. I'm the engineer for Nordic Semiconductor and USB support maintainer for Z5 project. Yeah, so the title is a bit weird, maybe because I'm maintainer, so I'm not sure I can provide you a perspective from the application or from the users, but I know some pitfalls, and I tried to look for some questions in the Discord or internal channels, and yeah, what the user have for difficulties to configure to get some parts working, so I will try to provide some guidelines for this. We updated documentation recently, so it's, I think it's a bit better, but there's still some gaps, and I also used preparation for this talk to improve the condition, but I still working in it, so let's start. So I will just show how to enable USB support, what can I configure USB support in ZFAR, and then I will go over the supported classes in the tree and points on how to configure some pitfalls and stuff, and yeah, let's start. So how to enable USB device support in ZFAR? First thing you need is to, from your board, perspective to, from board device trees, to provide ZFAR UBC0 node labeling. That is node labeling used internally by the stack to identify a controller. What one is, in that case, is USB-D for Nordic swim conductor, but it differs from the board, yeah. And for the current use, we have, maybe no, we have two device stacks now in the ZFAR, the current one and the new experiment on the front floor. This example is for the current one and most part configured in using cat config options, yeah. So you have to enable device stack and set vendor IDs and product IDs values, and then also device, the strings configuration is done using cat configs, and it speaks, yeah, you can change in the runtime. As for the configuration, self-powered or maximum power is for the specific configuration, only one configuration is supported for the current stack is also using cat config options, so you can change it at the runtime, actually, and that's one of the issues, but yeah. And you need a small code to, that actually depends on the classes you use, or your application, but you need to provide some minimal code to enable USB. And one thing not everyone knows, there's a, you can pass a status code to USB enable function, and it will be code every time there is a new event on the low level, yeah, it's actually as it is, it defines up on the driver level and on the stack, and that can be used to let the application know if the device, if the host selected a configuration, so you can prepare your application that the next time the host will start communication, yeah, it doesn't, it needs to be the case, yeah, but it's like the first step, yeah, I know something happened, yeah, and yeah, you can also check for the results, yeah, and so there are a few other cat config options, they are maybe weird, or yeah, it's, the reason isn't that's how the current stack was developed over the years, yeah, and function are added or simplified, and there's a weird cat config options, that configues the composite device, so in the current state of industry, yeah, this function just changes the code triple, yeah, for device plus device subclass on device protocol, so if it's this option is not set, so in device descriptor the code triple is set to zero, which means that the host has to look at the interface descriptor, which function, and look for the, for the specific function, like if there's yet, if there's mass storage class enabled, the host will look at the interface descriptor of the, of that specific interface descriptor and identify the function, yeah, here in the example it's a mass storage class, and so you as application or as user doesn't have to enable this function if you use, for example, even if you use multiple instances of less, in the new stack as possible for mass storage class, yeah, or the reason, the only reason to enable this is if you class is, has multiple interfaces, like for example, CDC-SM, CDC-SM actually selects this option, but like for example, CDC-SM, if you use CDC-SM you have to enable this option, for the reason is that this option changes the code triple in the device descriptor to this specific value is, and that advice the host to use interface association descriptor code triple to identify what interfaces belong to one function, so the host, like for the CDC-SM, there are two interfaces and the host needs to identify what interfaces belong to a function, so if you use CDC-SM, ECM class please enable this option so that the host, windows or linux as a matter can identify the interfaces belong to a specific function, and as we have a USB device in slice at both, at both, so that is specific for the best, both like USB dongles in F50 to 840 dongles for similar devices, and the users would like to, to have kind of run to run the USB support at both to use CDC-SM for logging, that's the only reason for this option, and you can also use it with the snippet with CDC-SM snippet to enable logging just at the run time from the beginning, you don't have to call USB enable from your application in that case, but if that application uses some USB classes, you have a conflict, yeah. There's other support for binary object storage descriptors, which is enabled by KACONVIC USB device was option, and it actually it enables, what it does, it enables the OS handling by the stack and allows the user to register, for example, a compliance, a compatibility OS descriptor to a root OS descriptor, but the thing is that this option changes the BCD USB value creator to a two-tane, like it's not, to signalize the host, please look for the OS descriptor, for example, for 8 p.m. If you control a support at 8 p.m., you can use OS to provide the host information, yeah. And this also KACONVIC USB device OS descriptor support, the option to enable that, it's mainly used, or actually in the tree used only by R&Ds class, and that is to provide Windows OS descriptors for the host, yeah. In the, that should be actually covered now in the current documentation for USB device support, so. And now we have a new device support in the tree for alpha editing, and there are a few differences, that is still experimentable, you can use it for a few user cases, but it's, yeah. So differences that we don't have that many KACONVIC options now, so it's just one enabled device stack next, yeah. And everything to configure, like PAD and vendor ID, needs to be done by the application, yeah, that's the difference, so. And the reason for that is that you can disable your USB device and reconfigure when the idea of the productivity on restarted, yeah. Also change other properties from USB device descriptor and ISO class registration, you can remove, for example, you have CDC-SM instance, you can remove shutdown, remove CDC-SM, register another class and power up again the USB device. That's more flexible if you compare that with the current stack. I will explain what classes are supported or not with for the new experimental device stack, so let's start with CDC-SM, that's one, maybe many people complain if they start working with, how to use CDC-SM for logging or for shell or for application specifics, I think it's that you are for, our driver API in Zephyrus is used by various subsistence for communication that's like for Bluetooth, you can attach HCI transport layer through the UART interface and there's a thread, that's named an NPC support that also uses API. And API itself, there's another thing that, also maybe confusing for new people that we have three types of UART API, it's a simple one, it's polling, then interrupt driven in testing and not every driver support testing, for example, but we have subsistence that uses testing for default but for back for polling, for example. So that's, and it's not actually not a driver property or it's just an implementation API. So CDC-SM implementation provides a virtual UART interface, it doesn't use a real hardware, it's an emulated interface and it's desirable for emulation to behave like a real interface, it's not always possible. Well, people have different expectations and CDC-SM limitation supports pollicant interrupt driven APIs only not testing. And there's actually no easy way to, never is but if you start a developer application you don't know what API, what UART driver supports what API, I have to look at the code or try it out and so. And how it looks, it's the same picture yesterday, but they have on the bottom there's USB connection between the controllers, that it's actual connection and the top is serial connection. So your application on the bot side, on the remote, on the ZIFI application, the interface is UART API, that we have there on logical level there's only serial connection, you can use only that, but it's UART API provides and the ZIFI side. The compatibility for the CSEM is ZIFI, CDC-SM UART, it will stay as in, it will not change in the new device stack, yeah? So if you switch to new device stack as default, this class will not read that much. It will just stay the same interface here because it's the common one from the UART. Yeah, and to instead it, UART, virtual UART for your application, you just need to provide a node and compatibility and you can have approximately three virtual devices on your board, yeah? So if, yeah, but it depends, for example, if you controller supports six in endpoints, yeah, you can have three virtual devices because you need for each device, you need two in endpoints, one block, one interrupt, yeah? Yeah, and finally you have to enable serial support in the car config option. So if your application for some level, if you don't need logging anymore in production, yeah, you can just disable CRL and that's for real driver. There's no difference, it's the same insertization level, yeah, same car config option to enable or disable from configuration point of view, it's like really UART controller. And the one thing there is in application you have, what you can do is to, after you enable USB, or before you start using UART, this virtual UART controller, you can wait for a DTL redi signal, yeah? That's the only way to determine if an application on the whole side start communication, or open the port or the interface, there is no other ways, yeah? Maybe you can, if, what, for example, Linux was though, it changed about it. We could have, there's a hacked interface to detect that, but I certainly don't like it and we will work another interface notification system to signal that, but our UART API doesn't prove right away or that polling, yeah? What you can do is just to poll for this that redi signal, I think it is. I think is you can even use a call mix that device is configured because that means that hosts recognize your device and select it to configuration, but it doesn't mean there is an application that actively use the interface, yeah? So then for you, if you write a custom application specific to CDC-SM UART, yeah? The only way to know if there's some application using it or not is to wait for the signal and for the application to use the signal on the host, actually, yeah, what was I saying? The thing is that as a communication for the CDC-SM UART is completely, as heavily used, the communication is determined by the host, yeah? If there's no application on the host side, there will be no in-out token. And for example, if you application actively writes to UART, yeah, start to write, you will lose the data, like on real UART, yeah? On it will just block and some moment not block, but not try I use anymore on virtual UART, yeah? So that's the thing, and if there's a behavior like that if the data passed to UART on UART 3.4.3 and device is not configured, it will be discarded, yeah? It's just not to slow down application at the startup, but the difference is in configurable state if UART pull in is that it discussed the character from the tail, so it's just like overflow and drop the first one, yeah? The difference to the Q that you will not have is actually if you design the application for the UART API, but not specific for the CDCSM UART, that should just work, yeah? So if you start some custom application, don't try to think like of CDCSM specific, yeah? Write it like for the UART, yeah, for real driver, yeah, and that should work. I hope so, if not blame me. Yeah, it's a mass storage class. It's another one that it's some kind of difficult to understand how to configure it, yeah? But we have implementation for the current and new USB device support in the tree, and there are two car config option to enable this support. It's only car config option is used for mass storage class support. So I have no device tree is needed because it's just a thin layer in the USB, yeah, this year, like USB code, SCSI code, and finally the backend that is used as for block devices, yeah? And so the new implementation allows you to have multiple LAN instances, yeah, if you have two stickers or two flash disk or whatever, yeah? And but both implementations use a disk access subsystem as backend, yeah, for the block devices, yeah? So that is the overview of this, yeah? On the top is mass storage class and it uses disk access API. And each driver in the API, if this is enabled, yeah, it's a node in the double linked list, yeah? So it's always, yeah? That is, you can pass the argument. Internally, yeah, you pass the argument to disk access API with the name of a disk and it will go to the double linked list and select the one and use it for write, read or whatever access, yeah? And, yeah, the only car config option you have to use to select what of this disk or drivers should be used in for the current USB stack is car config mass storage disk name. And new implementation is a bit different as an instant sentient macro for the logical units and then you can pass disk name. So the thing is that current implementation supports only one disk. You can have only one disk exposed to the host, RAM disk flash or SDE MMC. New implementation allows you to expose multiple disks but there are limitations on the backend. The thing is that RAM disk can be configured is configured using car config. So you can have only one instance of the RAM disk. It can switch to use device tree for the configuration but it's a bit tricky so that needs more discussion but that would, for testing is the very nicest. You have trouble with mass storage class port use RAM disk as backend. It should always work, yeah? Because it just used something in the... Some area is in the memory. It's actually defined in the disk called selfie and it's like always works here. If that doesn't work open a bug report for USB. And then we have a flash disk support. So this one supports multiple instances and can be configured using device tree. Just to provide a flash disk and disk name property and you have multiple instances of flash disk. And by flash I mean row nor flash like on the SOC or on external flash. And finally SDE MMC, you can use it with a spy driver or some specific controller but usually here with SDE MMC you can even with new support you can use multiple instances because there's one option in CACONFIG and that is the name, volume name, yeah? And because the mass storage class or disk access uses names to identify the disk, yeah? You can have more than one, yeah? So it's one of the issues. So we have to fix this part and probably discuss how to handle RAM disk and so on. And there are a few examples, yeah? That is for the block device on a flash partition. Yeah, you have actually to describe your partition cell or if you have already defined one on the board tree you can, you should delete it but be careful, yeah? If you enable this portion here to be exposed to the host make sure that it's not used by other subsystem like this one, I don't remember the name for the setting subsystem, whatever, yeah? This is one of the things in CACONFIG stack. People do example configure, some example configuration combined with another one and then doesn't work and it's crashed on the board because this partition is used by some other subsystem and you have to delete it before you instate it knowing here and yeah, it's for newcomer, it's actually a mess to get to identify why it doesn't work, yeah, why my firmware crashes because I won't try to access the same partition and main folder or something like this.  So it's not, be not confused, yeah? It's not converted to NAND, yeah? It's still the same NOR flash but that is how it is in the tree, it's not only in USB that it's other in other areas for the file system and so on. And you have to provide the same name here, yeah, not here, that's wrong here, just ignore it, you don't have to, that's using device tree for the flash, that's a typo. So and another example is to using is the MMC, that is very magic, yeah? Because you don't, here on the car config side, you just configures to USB on the Enable Smart Storage class but you don't have to, in the current state of three, you don't need to enable anything in car config so just drivers magically enable just by compatibility here. So that's a kind of issue we had, maybe we have to fix that somehow, but yeah, the thing is like, if you look what kind of car config option I have to enable and enables that because it's there, yeah? But it's enabled if that's fine, this compatibility but for the user, it's weird because I see the car config option, everything happens because it's, the node is still not there, or they cannot enable that somehow in the config file and so on. So the thing is that everything comes here, you have to describe your controller on then this like MMC and here node inside the controller to enable two drivers, yeah? And that's, I think that it's for the user, at least we had that last time this issue on the GitHub but that just was kind of, yeah, problematic to explain why it's there, so. Then Bluetooth host controller interface, that works actually, very nice with Sapphire, we have support for Bluetooth low energy controller and, but there is no support for the classic EDI-ECO channels, yeah? We don't support that and what this transport there does, it uses host controller interface role API to expose host controller interface to remote, for example to link source or I don't know what else works with that one. Yeah, and we have two implementations for the current new USB device support and this for the current implementation there's a limitation or as an issue that it's kind of combined with other classes. So you device, if you use that with the current stake your device has to support only one function, yeah? And only the host controller interface transport layer do not combine it with CDC-SM or with VU, it will not work because of how it was designed, yeah? We don't support this type of transfer with what low energy link layer only, so this part in the driver implement or in the class implementation was just skipped, yeah, it's not there and what happens if you look it in with multiple interfaces, yeah? And for example to the link source it tries to claim this interface too, yeah? And if that is CDC-SM, you can access that anymore, yeah? That's the issue, yeah? So you have for the, with the current stake you have provide just single function device not combined with CDC-SM or the VU whatever, yeah, it will not work. Even with so much fixed provider fixed to the VT-USB driver, but that was about interface number so it's, this issue is still there, but that is fixed in the new implementation, you can combine it with CDC-SM or other classes, but there's still no functionality, it just consumes resources on the controller side because we don't, in Bluetooth we don't have this type of synchronous data support, yeah? It's not there. So even with new stake if you combine it, it just wasted some, it would waste isocronos endpoint resources, yeah? But that is, yeah, we have to refit it somehow. So we have networking support by, provided by CDC-SM, EM and NG support, that works mostly the same, yeah? It provides a virtual internet connection between remote and ZFI network support. So it doesn't expose you, you internet controller to the host, yeah? It creates actually a virtual internet connection between the interface on the firmware on the host, yeah? And that's the reason we have to provide two make addresses for this implementation. The one is, for example, like ECM is I make address, that will be used by the host, yeah? On the host side, the interface controller, we have this I make address, but because there's a kind of provided internet, virtual internet connection, we also have local make address. It's the same for all three implementations, yeah? But the way how to provide this information to the host is a bit different, yeah? We have a new implementation on ECM support, it's improved a bit, but maybe we can also work on some solution to export real internet controller, yeah? To the host for whatever reason, yeah? But people are creative, we'll find some excuse, yeah? For testing, I don't know. So the configuration for CDCCM is for the current implementation is that these make addresses are hardcoded and you cannot have multiple instances of the cluster, it's just always on. There's a remote address is hardcoded, remote address can be set using a carton reduction, but local address is hardcoded and there is no implementation to use EPI from network management to change this make address, yeah, it's a mess, yeah, it's an issue, but, I didn't hear people complain about that, but I look at it for the documentation and for the internet founder that's a bit, yeah, it's not nice. The same for CDC, that ties the typo, and new ECM supports, you can set the make addresses using device tree, both, remote and the local one. If you do not provide local make address, it will be a random one, but there is also the EPI implemented to set it from the shell, you can change the local make address from the shell, yeah. And finally, CDCM and NDS for the current implementation has the same issues, but there's even the local make is hardcoded, yeah. And if you use NDS, please enable carton-fig device or S descriptor, I will, it's otherwise window source will not recognize the device or not the proper driver, yeah. Yeah, HID, yeah, another thing that they have, they have implementation for, as a new, there's only one, yeah, in the tree. I'm currently working on a new one, and HID supports multiple instances, yeah. But it abuses device driver model, yeah. So there's no HID device EPI as such, yeah. There's no device config or device data provided internally. So it just uses this device model EPI to get the instance, yeah, nothing more. And installation itself is provided using listify macro and carton-fig option device count, yeah. There's a carton-fig template, and if you select two HID devices, listify macro will create two instances internally. And in your application, there we explain. So in your application, you can get it based on the HID prefiscundant number postfix, yeah. So for HID, each instance required HID report descriptor. That's on the, right, sorry. So that looks the same. You could use the same descriptor for Bluetooth HID, yeah. It's in EPI is split into parts where as for HID, we have two headers, one is common one that you can also use for Bluetooth HID. And API part for device support, yeah. And yeah, in the simplest case, you just have to provide a one callback. There's an interface to register, yeah. And you just need to provide interrupt in because interrupt in endpoint is required for HID. Yeah, you have to provide just the one for the, to get it working, yeah. In simplest possible way, just a single callback that just write the endpoint and increments here in the report. The report here is just two octets, that's ID and some counting number. And yeah, that's very small example for the application, yeah. And here you have to use status callback. And if the device is configured, if you get the event, you can just ping the callback one time to get the communication started. And yeah, the host will obtain the reports based on the descriptor settings, yeah. There's a default descriptor settings by the Cloud Compute options in the communication will not get in details here. But the thing is that now you here in, it is in set a device, an application, you have to use device binding but it's problematic anyway. And I know people would like to remove that. And the thing is that you, what is confusing is that you have to register a device. Yeah, you have to, you get a device, but then you have to register a device. But it's not device, it's just a interface, yeah, provided by heat ops, yeah. And yeah, it's used by the core. So it's a bit confusing. And there was a progress to move to device three to instead of using device three, but it's problematic as well because the resources here, yeah, it's on the controller side, yeah, like end points, but we are on the opposite side on the user part, so. And one of the issues is that with current interpretation that other config options applies to all instances, yeah. If you change the polling interval, it applies to all instances, yeah, that's a big issue. Or if you enable output, out interrupt end point, it applies to all instances, yeah. So it's a mess, but as long as you, if you implement two keyboards, fine, or the keyboard mouse, that should work. Audio class, I will skip that. If you, yeah, as well, so, questions. Yeah. Yeah. Seems to be working. Two quick questions, one comment. Yeah. I see the move of configuration settings towards the application side. Yeah. In the new version. Is there a way for the application side to inquire or handle situation when the number of end points provided by a device is exceeded or it's not available? So how, then, the question of the application handles this exception condition when the number of end points gets error on initialization. But that happens at runtime. Yeah. So when you design the software for a particular purpose and you don't necessarily target single device, how would you handle the least common denominator or handle errors or design the application to run without it? There is no easy way, then, to use, to get information about your controller, how many end points it supports and to know how we, sure, we can improve implementation, class documentation sector to document how many end points it requires. But the thing is, if you design a specific application, you have to know your controller and what it supports and then select your configuration. It feeds the purpose of an operating system abstracting hardware resources that you want to not be specifically tied to one particular hardware. But I understand your point. Thank you. The thing is, in the tree, we have various of boards and, like, for example, if you look alone at STM, how many controller, different configuration of controllers like, yeah, and it's all, it's the issue, yeah, that sometimes it doesn't work if people select, I don't know, three CDC STM instances and on HID, no, you have just four interrupt end points. For example, in end points, two of them are like two interrupts and you're out of the resources, that's, yeah. But you will, in the new support, it's there will be detailed error message that's just gonna configure, apply this configuration, but it's on runtime, yeah. You can, because we, there was a, people wanted to have that, this functionality, yeah. Just to do, maybe crazy things, but just reconfigure behavior of USB device at runtime. Change configuration to a new one. It's also for us, it's very good for testing, yeah. We have child support, we can change device configuration at runtime once we start it, yeah. It's CDCM, you restart it as ECM and so on. The same spirit, how about setting up the interrupt priority when working with a specific, or configuring specific USB controller? I don't get it, so. As part of the configuration of the specific USB controller to work as a device, would you not be able to configure the interrupt priority of the USB IP for it to be, yeah, but that's a different setting for the driver and for the subsystem. So the driver is, so you're setting the application still doesn't have control over the ability to, over the specific hierarchy priority? No. It's the, it's the config option. And actually it should be device three, property. Yeah, it's device three. I can't configure it on the device three. All right, got the message, thank you. No comments. It's just that the, we can discuss on the floor. No, I understand. It's just the use of new may be confusing in some amount of time. So if you use a V2, it would be more clear. Thanks. Okay. Carlos, come on. All right. Okay, sorry. No time, no time. Okay, thank you.