Welcome back to the AI for Good Global Summit here in Geneva on day three And this is a good chance for us to talk about Africa because I'm joined now by John Kamara Who's the director of Mia which stands for Machine Intelligence Institute for Africa good to see John Thank you very much Chris So I think for understanders that you gave a talk in front of a big group about is AI Neglecting Africa and social inclusion or exclusion even tell me about that So, I mean, I think for us that you AI in Africa is a very important part of the development of our emerging economies and Because of a lot of data that people are collecting in Africa in terms of how they lip frog You know the infrastructure issues that we had before using mobile phone AI is a very Integral part of what we're going to do. So based in that I mean, I think a lot of conversations about AI has really filtered into the African continent And there's this disconnection between what we're doing in Africa across multiple countries And what the world is doing and how they visualize, you know AI going into Africa. So direct answer is yes I definitely think AI has been overlooked a little bit in Africa and yet not playing the devil's advocate But I've spoken to a lot of people here from different foundations all saying they're trying to pour a lot of AI data into use in Africa The keyword you just said is trying They're all trying to but the problem is for you to be able to have any level of success You need to understand the homegrown issues that are hurting the social economy at the very low level So until you can do that actively and also then understand a lot of the you know AI exponents a lot of the AI developers the companies the young kids who are building these tools Until you tap into them properly and begin to engage them and see how they collect this data How they actively use this data then we'll always be having the conversation of great intentions great idea But you know execution is a problem Again, let's take countries like Nigeria, Ethiopia I think Rwanda are going through a double-digit economic growth They've got the they've got the kids to use the people who could who can work on AI then now, don't they? Yes, they do I mean, I mean Rwanda is actively pursuing their own course in AI driven by a very forward-thinking president and then obviously bringing people together and then really looking at how he developed the AI community the young kids Technologically from the secondary school. So that is an impactful but consistent long-lasting approach driven by a positive leader It's all about Nigerian generally government doesn't do much for you know the community or the AI So it is the young people who are actively, you know propelling AI solutions and like for example data science It's at Nigeria, you know, they run AI programs for young people themselves It has nothing to do with the government because they're you know the guys who run it realize that we have to do something We have to first of all teach this kids how to use AI but also change their mindset on how to make sure they use AI for good Ethical AI, you know and also making socially inclusive and the protection of data as well The data that they mine and how what they use that data for from the AI perspective So you gave a talk in front of a bunch of people here. How'd they go down? I think it was it was um, I mean I was coming purely from an entrepreneur perspective I'm an entrepreneur, you know as being Mia, Mia is a non-for-profit. So as entrepreneurs we find Mia So what I talked about was let us really get down to the root cause of the problem and let us find You know those solutions that allow you to be able to talk to the end user directly It went it went down really well because we got a lot of response You know Mia's getting a lot of response from people and a lot of people want to come know Okay, what can we do? You know, how do we you know cut this middleman approach, you know To how we are currently provide funding into Africa for AI project. Where do we find these young people? How can we re-engineer their mind? How can we bring education to you? So we've had a lot of positive response so far.  I think the best place for us to be able to speak our minds, you know without holding back We spoke our minds here that look we're happy to be here But also we do need to tell you guys a story and there's no better place than to do it at the tender UN platform And now we're now seeing the interest in okay. How can we work with you? That was what we came to achieve here Great. So that's John Kamara talking about artificial intelligence and what it means for Africa and making sure Africa is really Involved in this part of the solution. Thanks again for your time. Thank you very much


Uuuuhuahuuhu거 Thank you for the comment, i write down request for in joke The right 2020 will be wool And thanks to all of you for leaving comments Fantastic How are Someru, has been well Thank you Oh my gosh Please introduce yourself to people faux Next name is Storm The Move we ni gathering SDORMP-EOMVE Mi mimi wana injiri na penda gospel na na penda yes na nimi aukoka Yuhun liambu o akuna tufauti ya kuwa gospelatisi na kuwa koka Okay, for sure, kuna prikwa industry na kuna prikwa ministry Wow, that's deep The above tell me the difference But before that we have a question And we're asking you, what is your favourite genre of music and why? So remember it's at WhiteFive on Facebook, Y254 channel on Twitter, WhiteFive for underscore channel on the gram hashtag is Thursday vibes. Dando, how are you? What do we do? Pizokali says, Manadrela, you like drill, like my page. Wow, look at you. I woke up today with a great smile on my face. Thank you for everyone making me achieve. Hey, Ulepata Five South Suns, follow us on Facebook and that one on YouTube. Thank you community. Okay, I'm not sure why you're telling us this one, but congratulations both things. Like my page, Bado Tuyuko, Asimana, Fena Drill Music, Ijiwa Cardinali, Okevoji and Elfas, Kipletin, Kapzulu, says, I don't discriminate niski and goma Tuyo yote, Pita Kikgo, and he says, hip hop, kaza ma real G. Yeah, sorry. Dominic, the Buddha says, Sisi County, Kaimbo, Bayes, Tuned Inn, Samo, Ochen, Okumo, says, Hello Nisami, Repink, Sumodala. And my favorite remains hip hop because it's the longest serving genre and undisputed. It changes with time too. Cheki, Said Kona Drill, to metuka kwa rap, napo hindi li kwa hardcore, but still all the styles work till date. Eriko Kahiga says, bongo jya information, Damaris, Kaluma says, Gospel because I love Jesus. Sosa po mam, nuna jo kuna gospel rege, kuna gospel hip hop, kuna gospel raga, tell us what kind of gospel you like. Hashtag is Thursday Fives. Onapenda nini gospel geni. What is your favorite genre? I love Afro, Rnb. And that's why I'm bringing in a new game. Don't ask ya yo vibe kwa kuna, kaya yo vibe li vibe nani. I didn't know.  I'm okay. Hashtag Thursday Vives. Tell us a bit about yourself and how will he come up ne? Vibe genre because I can't hear Rnb, I can't hear Afro somebody. Uli trawa api, ya mas kumoja tulipua, stukioka by accident. No, no, see accident, by the way I listen to music a lot. I love music as a whole. So, me, I won't say see God, ni God every time, and I create. I sit down, I create in my deepest moments. I, mimi ni ulem jama napenda kwingi ailezaon. So, I create when I feel it's time to create and God has told me create. And yeah, I love Rnb. I love music that someone can hear the message. See le, kubaya kelele na se mekana kelele, but I love it when someone is hearing it out. And most of the time Rnb mtu naskiya dinazoti. Afro music mtu naskiya everything. And yeah, that's why I ended up liking Afro beat. I love Afro benga, dogo pa le Rnb. Dancel nta gusa because I'm a dancer so. Ya. Ya, because apon ni kuwani kuji heavy heavy apokwa Dancel atini kelele. So, tata sama nijia champion ka. What are you going to say about Gavi Royal? And they just disturb our peace without their talent. So, tell us about how dancing and singing is inakujabi apokwa. So, once upon a time I was dancing and ni kaskiam ziki from the one I was dancing from. So, ni ka imba like siku imba hati yaku gas ni ka imba. And I was like, ok, soa ni kuna voice. Ni kia na kwa sista angun ka muleza. Jo nneza imba, mi nneza imba, kana mehetubu try. Tata kwa imba. Kwa tu woteni wa imbi. Wow. Wa imbi. Tata kwa imbadi. Wa imbi. Mstia kwa imbadi wa imbi. So, everyone in my place, my mother, my dad, everyone is pokwa, ni mtaje. Bratangun kwa wa imbi. Oh, fanya nene. Yende akuna pesa. Ha. Nakutakia mazori rasa. But he's a good writer. Ha ha. He's a good writer. So he writes my music at times. I see, you need each other. Ya, for sure. So he writes my music at times. So, eh, kwa tu wot kwa na imba. Ni kia muleza sista angun eza imba. Kanda kwa imba kubafu. That was back in 2018. But si kwa na, kuna ele, uji amini. Exactly. Si kwa na jami niya. Taki do go ni gya mbo ni bebele atu ni nga liya. Tua heza sayi ni nga imi na niya. Bia pazi ni kuna ibecha. But he leende, he leende liya kugro. Ni leende liya atu kugro. Iti ni amaji. And my mum used to tell me, in try, imba, imba kudro. We do prayers. Ha kwa na kwa mbe ebu kashule kwanza. I want you to gani nende kwa niya. Kwa ni kwa imba. Ebu reads. It's important. Ha kwa kwa ya. Ha ya. I kwa ya master mumangu. Ha ya. So alikwa na nebi. Ikipa u konda niya kwa imba. So na imba. Na imba. Nende liya atu kugimba. Ha imba. But si kwa na imba mbe liya atu kumu. Kwa familiya atu. Kwa familiya atu. Atu sayizi, nina woga kugimba kwa yo D&C, backstage na wewe, kwa sababu sigia. Zoya kugimba mbe liya atu. Nimi ozoya kudans. Mbe liya atu. I found an artist. Nimi kwa bwa sayi, he is the exact opposite. Sayizi is kizia, like his family and his trees, a family man. He has children and a wife. Like sayi sayizi, nda kwa umbiku. Hidra the god side, nimi skizi atu kaisa, tokaka, singo, kama ikohit, kama unna skizi atu kwa radio. Lakin evi atu. So this is, wow, they are different. Nia, for sure. So that is just me. Nimi me shindo, kuna time I tried singing, me liya atu, me liye pata machozi, na tokawai, nile courage bird, na try to collect, na hike o enough. Unaka evi, na otaku na imbe, unakarage. Kwa chani kombiata gulia, na lii pigo na kamawe. To tokadongo. To tokadongo. Inakaga sura ningumu lakin, nile courage bird, singumu kamawe sura.


QuickBooks Online 2023 Progress Invoicing Example Number 2 Customer Deposit Get ready to earn the skills needed to boost your bank books on up with QuickBooks Online 2023 Support Accounting Instruction by clicking the link below giving you a free month membership to all of the content on our website Broking out by category further broken out by course each course then organized in a logical reasonable fashion Making it much more easy to find what you need than can be done on a YouTube page We also include added resources such as Excel practice problems PDF files and more like QuickBooks backup files when applicable So once again click the link below for a free month membership to our website and all the content on it Here we are in our QuickBooks Online test company file we started up in a prior presentation Remember we're in the accounting view as opposed to the business view you can toggle between the two views by going to the cog up top Switch the view down below We're going to open up some tabs to put reports in like we do every time Right click in the tab up top to duplicate it right click in the duplicate a tab to duplicate it again Tabbing to the middle down to the reports on the left opening up the balance sheet as that is thinking It's not thinking there's nothing there but I go to the tab the right anyways reports and then we'll open up the profit and loss report Back to the tab to the middle I'm going to put the date range this time from 010125 to 06325 Just for the first half of the year nothing's in it because our prior practice problem was for the second half of the year Tab to the right I'm going to do the same thing here 010125 to 06325 and run it nothing there because it's for the first half of the year Let's go back to the first tab last time we created our project and we are in project number two now And and we made an estimate for project number two based on this information estimate for 100,000 didn't record anything Now we have the first deposit that we would like to receive from the client if they accept the estimate So now we're going to say we're going to get $10,000 before we've even had any expenses yet Last time all we did was just record the billing when the billing happened with an invoice This time we would like to focus a little bit more on the revenue recognition So the thing is if I make an invoice for it then what's going to happen is it's going to increase accounts receivable Which is what we want but the other side is going to be going to revenue which is which is not what we want So there's a couple different ways that we can deal with that So one this one way that's kind of like the simplest way but it could cause a few issues with records to the to the collection being as easy Would be if I look at my flow chart here you've got an invoice receive payment and record deposits Now if I'm going to get receiving the payment before I do the work then you would say I wouldn't normally want to create an invoice I would rather enter the receipt of the payment the 10,000 down and then I can apply it to the invoice that I'm going to create basically in a future time period So I'll first take a look at that option the second option would be to create the invoice but have the invoice not record to revenue But instead record to some other account account like a liability account so we're not recognizing revenue when basically we make the invoice Let's start with the first option I'm going to enter in the first option show you what it looks like and then I'm going to actually delete it And then run with the second option so that we can continue on and show you the difference between the two So if I was to go in here we could say hey look here's the estimate that we gave you I'm going to go to the sales tab And we could say here's the estimate and we could say that based on the estimate we want $10,000 we could put that in the note or the message Or in the email that we send them here's our estimate we need $10,000 down we don't send them an invoice for it We just send them the estimate and the information of how much we want down and then they just pay us on it without an invoice We're not tracking accounts receivable and that could work quite well that would be fine The only kind of issue with the invoice is sometimes the invoice has the payment options that are kind of linked to the invoice It can make it a little bit easier to give the payment but if that's not an issue if they know how to pay you and whatnot Then you could just say you know give me a payment for the $10,000 and then when we receive the payment We can do the second step in our normal kind of flow chart over here which is just to receive the payment So I can go into my projects I might do that from project number two and I can say that we're going to receive the payment Without an invoice related to it project number two let's say that happens on 1125 whatever the payment is I won't put it here but it's going to go into I'm just going to put it directly into the checking account As opposed to putting it into a clearing account just so we can skip that added kind of step for simplicity's sake And we're going to say that it was for $10,000 Now normally here there's going to be a payment down here or an invoice that I can apply it to I don't have one What's the system going to do then? Well it's a receive payment that means it's going to lower accounts receivable There's nothing in accounts receivable so it's going to make a negative accounts receivable for this particular client and project And then the other side is going to go to the cash obviously is going to go up And it'll create like a credit that I can later apply to the invoice That's the nice thing about this method that works quite nicely So I can save and close and it says you didn't select any invoice We'll save this payment as a credit to your customer since you didn't select an invoice That's what we want that gives you that nice matching kind of system So I'm going to go back up and I'm going to say what happened then if I run the report on the balance sheet Now we've got our checking account has gone up and we've got this negative receivable Note that negative receivable also isn't exactly right Because we would rather have a positive liability or something like that Usually when we got a deposit because a negative receivable means we owe them money Which we do because we haven't done anything yet Usually that should be like an unearned revenue type of thing However the negative receivable works nicely internally Because I'd like to match up the receivable to an invoice I'm going to make at a future point in time And the accounts receivable is the account to do that And if we needed to make it a period in adjustment for financial reporting, external reporting It would be fairly easy for us to take those negative receivables And make a journal entry for external reporting purposes to put them into a liability So that's not perfect but that's where it goes there If I go to the income statement, nothing's on the income statement, that's the point We don't want it on the income statement because we haven't earned the revenue yet at this point in time Now internally if I look at my customers over here If I go to my sales and go to my customers, customer number two I've got the estimate and the payment Which this side works very nicely from the bookkeeping side of things Because now I can easily look at this and say Okay, the next thing that needs to be happening is that I'm going to invoice them And I should be able to apply this prepayment to the next invoice that happens So I'm going to make an invoice just to show you what I mean on that And then I'll delete these two things and show you the other method So if I was to say, for example, I'm going to make an invoice And we're going to say, okay, this is for customer number two We could pull it in from the estimate if we want So if I was to make the next invoice from the estimate It's going to be, what do we say for the estimate? It's going to be 25%, let's say 25%, 25%, 25,000 And then we'll say copy it on over And let's say this happens on 115 Which is using it for practice purposes because I will delete it So you may not want to record this on your end because I'm just going to delete it But there we have it, so it comes out to the 25,000 What's the invoice going to be doing? It's going to increase the accounts receivable And the other side is going to be going to the revenue generally We'll talk about the revenue recognition issues with the revenue But the point is I already have 10,000 that I received that I can match up to this invoice So if I save and close it, for example Then we've got the 10,000 unapplied amount of the payment And the invoice of the 25, I would like to apply these two out Which I can do by going up top and saying that we want to make a payment For job number two and you can see on the payment side Now I have an invoice and I have the unapplied amount So I can match those two out at this point Which again works very nicely from an internal reporting perspective So now if I look at this, it's beautifully laid out from a bookkeeping standpoint Because now I've got the estimate, I got the payment that I received in advance And I've got the invoice which now shows me the charge on the invoice And the amount that was applied to it I give this invoice to the client now showing that we still have the balance of the 25,000 on the invoice to be paid If I go back to the balance sheet then I can see then in the checking account now we've got the 10,000 The receivables is now a positive number So note that that negative receivable is only a temporary problem Because the timing difference, it'll go away So that's still an issue but it's kind of manageable issue And now we're where we want to be And again from the internal side if I was going to have a question from the client This side of things looks very nice, right? Everything's lined up quite nicely Alright, so now I'm going to delete that and show the other method that we could use So I'm going to say maybe the problem with this method is the one problem is the payment that I have right here I received without giving them an invoice I gave them the estimate and told them to give me a payment of 10,000 based on the estimate But sometimes it's easier to send the invoice depending on how they're going to pay you If it's going to be connected to the payment options of the invoice or something like that That's one of the major kind of issues So I'm going to actually go into the payment and go more and delete it Delete the payment and then I'm going to go back into the invoice and delete the invoice So I'm going to delete the invoice So now we're back to where we were If I go back over here, we've got nothing in our reports again Same spot we were at before So the second option is that I would like to bill the client for the $10,000 So now I'm going to say, alright, invoice $10,000 because it'll be easier Because I have their email or whatever for them to pay me with the invoice setup that we have So we're going to say, alright, project number two I still can pull it in from my estimate so I can do that still Here's my progress invoicing just according to our plan 10% down that we want So I'm going to say 10% down, save it on in And everything looks really nice that I can then give to the client that gives me the $10,000 But the problem is that if I do it this way, it's going to record revenue Because these are all going to revenue So what I'd like to do is not record it to revenue But record it instead to another liability account Which you might call unearned revenue, you might call customer deposit I'm going to call it billings, which is sometimes a term used for a job cost system So I'm going to make two transactions here I'm going to reduce it back down to zero by reducing the revenue account And then I'm going to put it into basically a billings account So this is a little bit ugly on the invoice, but you'll see what it does here So if I make a new item and I say it's a service item And I'm just going to say reduce revenue account item Just to say exactly what it's doing, you can name it whatever you want But I'm going to say, there it is, it's going to go into the revenue of sales of products And I'm going to go boom, and then I'm going to say that I want it for the whole amount, the $10,000 To reduce the revenue, not by $100,000, but by $10,000 Negative, negative $10,000 Get it right, this is going to be class two So that brings it down to zero, and where I really want it to go is not to revenue, but to the liability account So I'll make another item here, which I'm going to call billings So I'll say new, and it's going to be a non-inventory, let's call it billings Billings account copy, paste It's going to go not to the services, not to an income tape account at all, but to a liability account So I'm going to make a new account, it's going to be another current liability The second thing doesn't, I'm just going to call it other current liability and call it billings And so we'll save it, and so save and close So that is going to be the full amount again, the $10,000 I'll put it in class number two So what this does then, it allows us to use the invoice, because the invoice allows us to collect an email and do all that kind of stuff But then this last bit down here is going to make it so these items, I don't have to use other weird items I can just say, I'm just going to reverse what it did to the income statement side With another item that just reverses the income account to take it out of income So it's like another little journal entry at the bottom here Reducing revenue, this increased revenue, we reduce revenue And then we put it into a liability account instead So what's this going to do ultimately, it's an invoice, it's going to be increased in accounts receivable That's what invoices do, it's going to be negated out of the revenue from this whole thing And instead, the other side is going to be credited to the billings account Which is a liability type of account similar to unearned revenue or customer deposit or something So now, and I can send this to them even though it's a little bit wonky with these last two pieces And I can send that to the client, so I'm going to save it and close it So then, there it is, if I go back to our financials and run it Now we've got accounts receivable which went up, which that's perfect And the other side went to billings So if I go into this, I can see my accounts receivable going up with the invoice, perfect And the other side going to billings, which is a liability account Which is what we want going back up And then I'm going to go to my income statement, nothing's on the income statement Because we haven't recognized any revenue, which is basically what we want Going to the first tab, if I go into my sales and my customers Customer number two, now we've got our normal kind of invoice process again And at least the collection process from this point should be fairly straightforward Meaning the next thing that we expect to happen is we expect to get paid on the invoice So let's go ahead and say that happens So now we bill them and then they're going to pay us for the invoice So we might do this from the projects again, so I'll go into the projects And then I'm going to say project number two And then let's say now we receive payment for project number two And I'm going to say that this happened on 115 So cash payment, it's going to go into the checking account directly And this time we've got the invoice, we entered the invoice first And now we're going to receive the payment from it like normal And I'm going to say save And what's this going to do? It's going to reduce accounts receivable And the other side is going to go into the cash So I'm going to say okay And then I can go back on over here and say balance sheet what happens The accounts receivable goes down and it went into the checking account And this billing account is still here on the liabilities If I show this by class by the way Then notice that this billing account is a balance sheet account That it breaks out by class Which it doesn't do all the time with some of the other ones like checking Unless you're into a hire, unless you pay more for it But this is the QuickBooks Pro Plus But this could be useful to us that it breaks out the billing here So that we can track the billing by class That's why the class and the jobs that double thing could be useful for us So we'll see that more in future presentations Nothing's over here on the profit and loss First tab, we can see that there's no income in the project yet Even though we collected 10,000 on it This is basically showing kind of an income statement for the projects That's why the balance sheet having the classes of the billings Is kind of nice that it breaks that out by class That's why that redundancy is kind of nice And then if I go into the sales over here And I look at customer number two Now we've got the estimate We invoiced for it And the payment is here So everything looks quite nice from a collection standpoint Using this method as well Although the invoice is a little bit wonky To set up the invoice So we'll continue with this process Next time And go through what would be happening Once we actually run costs And then we're going to build the client based on this schedule Even though our revenue recognition will be different Than that schedule That's our problems going forward


The Tiger, Financial News Network. Hi everyone, Basel Chapman here. This is Monday the 7th of February. We're looking at the Dow, and this is the Tiger Financial News Network. 10 a.m. market update. Dow's down 8 and 35,083. I had a little sign on Friday with my Chapman. We've chingaged to say that the Dow should be a little weak at the opening before trying to rally. We've got that. Now what we're looking at is the Dow is holding quite nicely, right on the 9-period moving average in the 14-minute. It needs very quickly to break into the 35,250 or higher area. The S&P at this particular point is trading, let me see, excuse me, is trading up 45,11, sorry, S&P 11 at 45,11. And we're also looking at the QQQ, then the S&P 100 having a pretty, this is a pretty nice rally, up $1.90 at 359, 1 with 360, but it also needs to get much higher. It needs to get to the 360. Three levels to say, hey, I'm trying to get back to the 370 level of last week. We're looking at the IWM. I'm not sure quite why my charts are not showing. I think I messed it up over the weekend. We're up to at 200 on the IWM, just struggling. Gold's trying to have a rally earlier on. It's still running quite nicely. It's up six at 1814, stuck in the range between about 1825, maybe, and supported the 1790s. You've got Crudo. I think Crudo is starting to make just a little bit of a sign that that Chapman Web Insight Track repellent zone is starting to pull. It's becoming a little bit of resistance to say that. And we're talking about the TLT, the Eman 20th Treasury Bond Fund, down again, down $0.30 and $1.3870. This is really telling us that those bonds, the bond yields are starting to move higher. We'll be back in a moment for my Tiger Technicians Hour. Hope I'll be able to correct the pictures. And at the same time, what I will say is, check out my opening call, my dating news now. I'll be back in a moment, just waiting for the music, and then I want to figure out how to get the charts showing correctly.


Hey, what's going on guys root at no shell.com here today, and we are looking at some more Python Today we're gonna check out some variables variables are kind of like the crucial the most the most important backbone of Programming and computer science because they act as placeholders. They are abstract. They represent a different data type And let me get started. Let's show you let's show you guys what's up So I'll get idle going and we'll drag it over here so you guys can see it and let's get started So now when you are working with the variable when you're trying to initialize the variable as a terminology that I want to be Using today when you're initializing the variable what you do is first in a different language other than Python you would normally Declare the variable they call it declaring because you're just simply stating I'm going to use this variable you allocate or you make room for that variable in your computer's memory and In like a language like like C++ or something or C You would just type in a int and the name of the variable like number now in Python You don't have to do that. They have Python has what they call Dynamic typesetting because you can set a variable without having to have to specifically declare Okay, this is what the number this is what the variable means You know obviously the variable has a specific data type whether it's a string whether it's an integer whether it's a float Whether it's a boolean that sort of thing, but it doesn't have to be like static It's it can change and you don't have to declare it that way one way all the time. So But that's that's kind of all I wanted to get across to you in this was what declaring is the terminology for just saying the variable name like let's call it number and So when you have your variable when you've declared it what you don't have to do in Python So you don't have to worry about that you can what you do is you define it? Defining it is giving it a value or giving it something that it represents of the actual value of that variable You're gonna hear the words value tossed around a lot because that corresponds with the variable What is the value? What does the variable actually mean? What is its value? You know, so that makes sense So number if we have something called a number, maybe number can represent. Let's say four There you go now. It's number is set. It's stored in memory So if we type in number we will get four because that's what it equals That's what it represents now. We have declared and defined number to equal four So that's interesting though. We can we can set up like floats Actually, we'll name it something else. So it's not a it's not a keyword. We'll call it double equals 3.14 Actually, we'll do like 45.67 we've got double If I can type it correctly we got double we can set pi to three point one four And now we have now we got pi three point one four. Awesome. We can print these things out if we need to Three point one four and boom actually. Whoops. I should you've used the variable there That's let's pay attention to what I'm doing here people Yep printing out pi gets you that same thing as three point one four because that's what it equals to we've set it To be that now if we work with that a little bit more though We can set maybe we can set a name. Let's say let's use a string variable. Let's use John Just use my name name is John. We can just use name is John. We print that out name Now you can just get John. That's that's easy enough, right? This represents something else now You can have underscores letters and that sort of thing all in the variable the name of the variable But you can't have it start with the number if we had like one inch equals two It freaks out if we had in two inch one equals two It'll understand that and we'll have in one but anything with a number in front of it It's it's not gonna it's not gonna accept that that Yeah, the program Python the language will just be like nope shut down rejected and you'll get an error But anyway, what I want to talk about now though are assignment operators assignment operators are those Operators or those symbols that you're using to actually define the variable and we've been using an assignment operator this entire time We're using equals. We were using number equals four. We're setting. We're assigning the value four to number Does that make sense? So now we can manipulate that though we can set things relative to what they already are since number equals four We can use number Plus equals and we can add to it We can add we can use we're gonna use that assignment operator plus equals to add to number and let's add to how about that? So now when we check out number again, it's six because we've got four and then we add six to it I'm sorry four and add two to it and now we have number which is six Perfect that makes sense right? Let's try with name. We can do name plus equals Hammond Name John Hammond awesome note the space there That's what I'm using to differentiate the two names John is the first name And we've added him and on there with that space so you can tell that it's two different names It's actually one name obviously, but you understand what I'm saying if you're using subtraction though It that works the same way you can use number subtract equals three Number is now three you can use number times equals to four Number now equals 12 you can use number divided equals to Number equals what number equals six there you go now. This is interesting though But because we're setting it as it's because the variable is treated as a data type if we use number divided by two It's going to take the value of number Six and then divide that by two so you'll get three But when we check out number number is still six because we haven't assigned that value to it. We're just we're just manipulating it Number when we have that equal sign there. It's setting it relative to what it is But when we're just playing with the data dividing it by two without setting it or anything there it is Does that make sense to you guys? Want to make sure you guys understand this now because I want to move into something else because some people some programmers It's this is sort of a style or a technique that some people like to adopt I myself don't use it too often But they'll use a naming convention when they declare variables So they'll have a better understanding of what it really means because the whole point of using a variable is that it Varies you never exactly know what the what it might be and this night This might seem kind of useless at first because if you wanted to do like a number times two You already know that number is equal to six why didn't you just do six times two in the first place? That's dumb the thing is if we had a user input information like if they're trying to If they're using this program for a more general sense if we're trying to build something for them that they can manipulate on their Own they're gonna have to be able to put in their own data So we don't know exactly what they're gonna send in but we still have to be able to process that and that's all variables do they allow The programmer access to what the user needs to get done by this sort of like fourth wall, and I don't want to say it's the fourth wall, but Yeah, that I think I'm I think I'm rambling about this more than I have to the variables vary for that reason Because you never know what it might be and that's why Sometimes they use a naming convention if they know the type that it has to be if we had an int underscore number Let's say that's 30 int underscore number is 30, but Now now that we have that int underscore We know that it's going to be an integer because we've declared it that way if we're processing it in our in our program Let's say we're just adding things to it in number Plus equals four or something do it again do it again do it again do it again do again if we did int number Plus equals string That wouldn't make any sense because We as a programmer already know that it's an integer So we would never do that because we've given ourselves a little notification that okay, this is an integer variable We should manipulate it the way you would normally manipulate an integer not a string.  I I don't even care Billy Bob Jones equals fish and Now we know that it's a string variable because we've got that there. Oh Close and a unity. I don't know why I hit that there you go string Billy Bob Jones equal to fish good enough But that's really all I want to show you guys today I want you to be able to know the terms declaring defining value Assignment operators. I want you to have a little bit of an understanding what these assignment operators do what they can do for your for your variables for the data that you're manipulating and Yeah, that's that's all I mean once you get those down You should be able to have a greater understanding and you should be able to be able to work with things on the fly You'll be able to just pop out. Okay. I need this to equal that and I'm going to have to add things to it relative to what it already is and You have to have that abstract sort of mindset to be able to manipulate the data that you might have to process later on so That's all I'm gonna bow. I'm gonna bow right now. I Don't know. Thank you guys. Thank you for watching. Thank you for listening. It'd be awesome if you could give me a like Maybe a maybe subscribe. I don't know. I don't know. I'm just gonna just gonna toss that out there I'm gonna give you an idea here. You can you can take it or leave it Thanks again guys. I'll see you in the next tutorial. Bye


So, let me just briefly introduce you by name and affiliation, and then I'll allow you each to kind of go and give kind of a deeper kind of kind of intro. But Tracy Reagan from Deploy Hub, Raul Akakula from JP Morgan Chase, and Bob Callaway from Google. All three of them are folks who are deeply, sorry, sorry, involved with OpenSSF, with the governance. Tracy and Raul are both on the OpenSSF governing board, and Bob is the chair of the Technical Advisory Council. So, thought would be kind of interesting to put together kind of a closing panel, again looking at how do we help business understand the impact of what we're doing, how do we help make the case for this kind of internally in our own organizations, and security is one of those things that companies sometimes get a little rivalrous about. We would love our customers to believe that we're more secure than the competition, right, either directly or indirectly yet. Working in OpenSSF kind of is about sharing that as a first-order principle. So why don't we just kind of go down, and I've got a few questions for my panelists to start, but then we'll kind of open it up to broader conversation. So why don't I start with Raul? Could you tell us more about the role you play in JPMC, and kind of what led you to OpenSSF? Yeah. I'm Raul Akakula, the head of product security in JP Morgan Chase. I've been working in startups and technology companies for 20 years. I thought it was fun to work in a bank, so I joined JPMorgan Chase three years back, expecting a bunch of guys wearing suit and running around, and developers in the back working in a dungeon, but actually it's opposite. I'll talk more about it. It's actually a tech shop with a bank face on it, so it's interesting. So with the OpenSSF, I mean, as Brand mentioned, I'm serving on the governing board now. I've been doing that from 2020 from the inception. Before that, I was part of the governing board for the Open Source Security Coalition, which is merged into the OpenSSF. I served on TAC, Bob is serving now, but I was on the TAC last year. So I'm glad you're with OpenSSF, JPMC has been from the beginning a big supporter of OpenSSF and we are a primary member now. Great, thank you. Let's go to Tracy next, Tracy, as representing to some degree the kind of the startup ecosystem in this world of what are otherwise kind of the big monster players in the tech industry, tell us more about Deploy Hub, tell us more also about what kind of led you to participate and join OpenSSF. So my background comes from the build space. I cut my teeth on Wall Street in software development and moved into insurance and finally went to work for Discover Card, Discover Financial. And in all those cases, they always asked for what we now call an S-Bomb. And in 1995, my partner and I created a company called OpenMake Software that really leveraged the build process and locked it down really tight. We sold that to what is now Broadcom and that product has been around now for 27 years, still pays the bills. But now we saw a shift coming with microservices and said how do we reimagine that and how do we start tracking S-Bombs from that perspective when you have lots of S-Bombs and no way to aggregate them up to the application level. So when I saw the OpenSSF start to shine, I was like, oh, they're my peeps. Finally, I could talk to somebody about S-Bombs. And I can't tell you, I literally feel like I've been waiting most of my career to be part of this community because we were on a very, I always used to tell people, we're like a furniture store on the very end of a dead-end street with no lights. Nobody wants to come down there and talk to you about S-Bombs, but now we're talking about it and I couldn't be more excited. Also, it helps to have a White House executive order. It really helps to have a White House executive order is like finally. Right. And Bob, let's go to you. Google's investments in open source security are legion now, kind of well-known, but why is that? I mean, Google's a big contributor to open source in general, but this seems to have risen in importance very recently. Could you tell us just more? I mean, Google has made such a massive commitment to it. Help us understand a bit more deeply kind of your role perhaps in that and Google's priorities. Yeah, sure thing. So I'm Bob with Google, a tech leader manager of Google's open source security team, and our team is 100% focused on working on the same fundamental mission of the open SSF to make upstream more secure. In terms of your specific question as to why, I would point to, I mean, everybody knows what Google is and the role that plays in people's lives. That's given the company a very unique perspective to not only the scale of the challenges that are out there, but also to the breadth of different open source communities and practices that are being adopted. And so at Google, we have the blessing of being able to employ over tens of thousands of people that work upstream every single day. And so it's that richness and that almost community dynamic that gives us the almost informed opinion to say like, look, there is a lot of opportunity to make things a lot better. And so coming back to kind of our corporate rallying cry or motto of do the right thing but do the right thing for the user, when you look at that space and you look at the places where you're working day in and day out, you have that moral obligation in some sense to give back and do better. And so when we saw kind of the formation of the open SSF, we said, you know what, this is a really unique opportunity where we're seeing all of the massive players come together. We need to play a leadership role in that. So for us, the business case behind that is, again, not so much in that, yeah, there's a ton of problems, but if we look at where our customers are going, even if we had a magic wand and cured all of the vulnerabilities and all the issues today, projects are still going to be created tonight that may have issues going forward. So it's about really making sure that we're solving the problem sustainably in the long term. And so we realize that that sustainable approach needs a structural, its own unique structural kind of mission above and beyond just going and trying to clean up everything that exists right now. But isn't somebody between you and Sunder say at some point, like this is costing too much? How do we justify this to shareholders like, no? No, I don't think so at all. I mean, again, it goes back to the breadth of the use cases that we see on a regular basis. It goes to security as the cornerstone of our product and go to market strategy in terms of where we see our differentiation. So there's benefits to us as a corporation that are very clear, but it's also going back to that notion of how do we do right by the customer and do right by the broader user of all of our services. For us to take a leadership role, the business case and the justification is very clear all the way up and down the management chain. Rowe, I'm sure there's somebody between you and Jamie Dimon. Jamie Dimon is your CEO, right? Okay, yeah, there's gotta be somebody. Well, he hates Bitcoin. He was the head of the curve on that, it was really good. There's gotta be somebody between you and him who's pushing back. Who's going, why make this investment? Why jump in? We're consumers of this technology, aren't we? It's actually, I got surprised, I was actually expecting that. But I think part of it is where heavily regulated industry, compliance and security being highly prioritized actually. So most of the business is supportive of the security initiators. So that's what actually made my life easier to support OpenSSF is actually all up to the Lowry Beer, who is our global CEO, and Jamie Dimon, they're fully supportive of OpenSSF. That's great. So, yeah, I mean, do you expect that? But I think probably thanks to regulators, but actually security is concerned that's very important. Yeah, again, it helps to have the White House beating a drum. But there's something that regulated industry is like, especially banks have to follow, which is the NIST cybersecurity framework, right? Does that play a role in justifying this work at all? It does, and also regulators also getting smarter and asking the right questions too, I think it's definitely helping. And obviously, Log4Shell and SolarWinds definitely helps to make the case, right? But I think overall, the trend has been changing. I mean, Log4Shell is a good example. I seen the business execute asking the right questions about earlier, I think few years back, the knee-jerk reaction would be, let's stop using Log4J and let's build something inside, right? But actually now they're asking, hey, let's actually understand more about how do we help the open source community to do better? Where else we could actually understanding the critical software we're using? How do we help them community-wise? So I think the trend is kind of changing and more being transparency, supportive, rather than blaming earlier. For an organization who knows how to price risk to five decimal points, so I imagine some of the better statistics and the metrics that we've talked about to evaluate the trustworthiness of code to be helpful in making that case too, right? Certainly, we do that, right? I mean, as I mentioned earlier, we do actually have 53,000 developers now. You have what? 53,000 developers in JPMorgan Chase, which is actually surprised to me when I joined out, I didn't textbook that number. That was actually 35,000 when I joined three years back. Now we're going to 53,000. So as you can imagine, 53,000 developers developing applications. And most of applications these days have 80 to 90% open source software. That means we're actually using.  Exactly, right? So half a million open source packages are out there for developers to use. So we do actually turn a lot of code, including open source. So we do actually have security controls and automatic mechanism to look for security vulnerabilities. Making sure the right software get into the bank and also continuously looking for vulnerabilities in the process every day, right? So there we do how those mechanisms and that definitely helps. And Tracy, same kind of question to you, but it's obviously at a different scale. Like how do you make the case to customers or even to like your own internal stakeholders about investments you make in stuff that just goes back out and could be easily picked up by your competitors and used to compete against you? So I think that- Is your mic working? The point about being accountable to your customers. I don't think it's working, sorry. We'll just get. Why don't we just get the handheld mic up here? Yep. I'll run and get it quickly. I think the battery went dead because it had a light on and now it doesn't. Yeah, that's just the battery on. The problem with end-of-the-day sessions figures. So I think being accountable to your customers is primary, but we're in the business of doing security. So we're in the business of right now where Deploy Hub tracks. It's a catalog that tracks your supply chain and who's using it. So if we're not doing the right thing, we can't expect our customers to be doing the right thing. So in our world, it's leading by example. That is where we see the reasons why we participate in these kinds of organizations as well as spend a lot of time worrying about vulnerabilities and scanning our own code and eating our own dog food. Well, the three of you are either lead or are lucky enough to work for rather forward-leaning organizations. On this topic though, I imagine there's folks out there working for orgs where you're kind of here on the slide or kind of because you believe in the importance of it. Carving out the time to be able to commit to it might be a bit of a challenge. What's some advice that somebody might offer to them in helping make the case up the management chain to be able to spend more of their time on these topics and engaging with the public community? Like for organizations run by less enlightened individuals. But they always say follow the money, follow the money. I would say, I think for any size company, startups to like a big bank like JPMC, innovation is the key to move forward, right? Innovate faster, like innovate faster, actually open source is the key in my opinion, right? You don't want to reinvent the wheel. So if you think that way, innovation faster, open source is feeding that. And then security is the key to actually enable the technology securely so that we keep the customer trust intact. So I think if you think that way, no one actually is opposite to innovation. Like all the business wanted to is enable the innovation, move faster, deliver value to the customer faster. I think making a case that way, I think makes it easy. So I think we just have to tie that back and educate the business people about how the open source is securely making that innovation go faster. I think the dynamic I would highlight there is it's also about open source gives you an opportunity to learn from peers around what's good and what's bad and being able to take that back to drive that innovation engine. I mean, in my old jobs before this, I often talked to customers and was seeing a trend towards the overall release pipeline and supply chain is really a core part of a company's intellectual property. Not just from a risk perspective and that they need to do it right. It's how they engage with their developers. It's about the cadence upon which they work. And so talking about the learnings that you get from engaging in the community here helps to really serve that core innovation engine or just the core infrastructure there. It helps you personally to help develop your skills and learn from others. It also helps the company really position themselves to attract the best talent and go after the market opportunities that they have. So it's in some sense, you can look at it very short-sighted and say, yeah, there's some security problems and maybe these are projects that we use. But if you actually start to lean into that diversity in a meaningful way, you can actually make your internal systems and your own career pay off dividends in ways that maybe you never thought of before. So it's, I think, about playing the longer game and really appreciating that there's a lot of insight and learnings that come to benefit all of us by engaging in upstream. In the early days of open source, we kept trying to come up with ways to justify companies spending time and money on this. And one of the quotes that helped us came from a son co-founder named Bill Joy who said, most smart people in the world don't work for you. There are more people outside of your own organization who might be helpful to common cause that you might have with them then. You could possibly muster, well, maybe JP Morgan has enough people inside. But my sense is, and tell me if I'm wrong on this, but my sense is that people are realizing now that in the field of cybersecurity, it no longer is enough to just buy great point tools off the shelf and have a bunch of internal controls that there is much more of a, it takes a village kind of thing. There's much greater interdependence even between potentially competitors to try to close some of these issues. Is that, do you guys see that too? Is there an example of that? I mean, if you look at the dependency graph for Kubernetes, it's one of the famous images you're probably gonna see all week long in talks, right? It's a mess, it's an air tribe web of all of these things. And so even if you solve one key point, like, okay, there's still 100 more to go after that, right? So it begs the question, what are the patterns? What are the systemic approaches that we can solve? That we can use as approaches to solve the problem? And in doing so, it's about sampling the community. So I think it's absolutely true. Is that why Google open source Salsa and brought it to the community? Because it started life, if I remember correctly, as Google's internal kind of DevSecOps pipeline tool, right, to manage the risk around the plan. Yeah, it comes from our internal systems running on board, which is kind of the predecessor to Kubernetes, something called BCID. But it was really about, if we don't understand how to apply that within our own infrastructure, that's great. But if you look out there for the broader open recommendations around best practices, how to do this? There really, there were point things here and there, but there really wasn't a single place to actually talk about for verifying the integrity of source all the way through the pipeline to get to prod, what are the best practices? And leaving it in an implementation and tool agnostic way. So just literally saying, what are the right things to ultimately do? And so I think what we've done with Salsa is not only just say what it looks like, but we're actually helping people to answer that in the environments where they really are. So go where the projects are. If they're running on top of GitHub Actions or they're going on top of GitLab or other CI infrastructure. How can they ultimately take where they are today and implement one or more of those best practices and make it actionable? That's where we've seen a lot of the engagement around that community. Not just like, hey, let's all tell people what to do. There's plenty of people up pontificating about what good looks like. Help them get there is really where we're trying to take the Salsa community going forward. But yeah, it does come from our own learnings of building out our own web scale infrastructure on the Google side. Anything else either you want to add on that? Well, I would say when I first saw Salsa and started reading, I realized that we finally started looking at our new door metrics, to be quite honest. I always tell people the door metrics, we can still use them and they're still important, but they may be getting a little bit long on the tooth. And I think Salsa really helps us pivot a bit from that. So if you've not read them and not understand what those basic principles are, I would highly recommend you do that and combine them with your door metrics. So one of the things that's different about OpenSSF compared to other typical Linux Foundation projects is we're not just about writing some code and shipping it, right? Or even lots of different hundreds of pieces of code. We're also about education materials. We're also about specifications like Salsa and tooling to support that. But also we're looking at a number of projects that lend themselves to a little bit more like what Let's Encrypt does, which is another Linux Foundation project. It's very much a service rather than a piece of software that has kind of commoditized the TLS certificate space, right? And there's kind of some active questions in the community about, are there other kinds of information services or other kinds of systems that perhaps started life as something that a company built as a proprietary thing, that it's about time for that to potentially become community managed or community governed? And I don't know if either of you have kind of thoughts on this, but are there services in the cybersecurity space or kind of things that should become public resources the way Let's Encrypt has? And if so, what are some of the things that you think we should be looking at in the open SSF community on that front? Well, again, I come from the, really my head is so into compiling linking code and putting the pieces together. And then from an open source perspective, we've really built this massive Death Star with all these interdependencies. And now we've got to clean it up and sort it out. But if we could talk about AI just for just a minute, there are these foundational models that are starting to come out that's gonna be generating code like Microsoft has co-pilot. I feel like that is something that the open SSF at least should be having a conversation about because what if we have something bad in that, right? And everybody's generating code based off of co-pilot. So and that's not gonna be the only foundational model that's out there. There are a lot of AI companies that are really pushing to build these foundation models and what's in them and who's using them. And as soon as we start consuming them, if we have 53,000 people at JP Morgan alone and as Jamie pointed out, education's important. Bringing in new color workers, I can promise you that they're gonna be using these foundation models to create code. So I'd say that's an area that the open SSF should be looking at, okay. Yeah, two spaces come to mind. One is around the six door project, certainly is maybe the trigger for the question. But looking at how let's encrypt fundamentally disrupted the TLS market, not really of like, hey, we're now gonna give something away for free. But there was this underserved market of people that just said, hey, look, it's too difficult to go get a certificate. And arguably like, okay, it wasn't super difficult to get one. But to keep it up to date and to understand the life cycle of what that looked like, that was daunting. So if you look at what was done there, I think what the six door project has done around code signing certificates, there's a strong analogy to really removing as much of the friction as absolutely possible to A, get a certificate. But then managing the key material that's behind that and removing as much of that friction as possible. Again, not trying to position that that is one model that everybody must use. It is an option and that the six door project aims to be very open and modular to adapt to different folks. Because people, let's be honest, banks are still gonna own HSMs. Companies are still gonna have hardware keys. Those are not going away anytime soon. So I think that's an opportunity though for us to say what are those underserved segments of the open source developer population? And are there better ways that we can reach them? And I think six doors is one example of that. Yeah, six doors is a great example of something that's part software, like just regular open source code. And certainly part service that today is kind of, I don't know, it's under Luke Kynes' desk, the main kind of six door key issue. No, it's in a colo somewhere. It's running in GCP with our world class services. So I think we're good on that front. That being said, I think the other example being the OSV project, right? So you take, hey, we've got vulnerability information from many different vendors out there of different levels of fidelity, depending on what project you're talking about. We said, look, how can we normalize this and define a common schema? To answer very simple questions about I have open source package X. What vulnerabilities exist in that package? And having just this very simple canonical way to answer that question. So within the Open SSF created that. But again, a schema does no good if there's not actually a service behind it to give you that information. So the OSV API that we've launched aggregates all of those different sources that are out there. And from the package managers, from different vulnerability databases, it makes that very easy for folks to consume. And we're now seeing adoption come full circle within Python tooling.  So we're starting to see these notions of public good services come out that are either serving segments of the developer population that were perhaps underserved, or answering questions that were just unanswered in the past due to various levels of friction or barriers that may exist for some valid reason. But it's preventing people from getting the information they need to make same decisions at the right time. I think in my opinion, actually, a few years back, the automated tools to detect the vulnerabilities were actually proprietary. Over the years, I think most of them are actually free for public open source practice, that's a great thing. But still, I think the fundamental problem is, we still have turn off tools finding issues. We're still lacking the tools to help the developer and maintainers to fix the issues, right? So I actually would like to see more, I mean, there are some research happen like open rewrite. But I would like to see more of maybe opennesses of taking on that. Programmatically provide the remediation fixes to help the maintainers. I think the biggest challenge there is dealing with false positives. And somebody has proposed, I forget which working group this is within. But I proposed an AI model to try to help weed out the false negatives from reports back from automated scanning tools. I don't know if it's really the right kind of tool for the job, but it's worth at least trying to figure out, can we get better at that? Because that's the main reason open source helpers haven't used these kinds of scanning tools, is there's so much noise that comes out from them that it sometimes feels like it's not worth it. But I think we can change that. I think that if we asked, most people still turn off warnings when they compile their code. And I think accessibility of the information, it becomes problematic as well. Because you think about it, you generate an S-bomb, for example. And it's in a text file sitting somewhere where you generated it. Where is it? Did you version it? And then you've got to map that out to get your vulnerability. So if we're not creating a way to make this easy and developers have enough on their plate, it's really hard to expect them to take advantage of the information if it's not in their face. I mean, I'm guilty of that in so many ways. It's like I don't want to have to go dig for the information. I want it served to me. So I know that we have S-bombs everywhere as one of the projects. And I'm working on that. And I think that that is going to be a primary area to have S-bomb information and the vulnerability information available to everyone and make it easy to find. Not go, where's the build? And I got to go find that. And now where's the vulnerability report? And I need to go find that. It just is hard. There's a lot of pieces and parts in it's heart. I think I mentioned I wasn't a very good programmer. And one of those was I hated all those warnings about my void stars being used as a float in the code. Like, I just didn't want to see that. Well, it was important because memory is really required. Yeah, probably should have paid more attention. Or just use a modern language that is type safe anyway. Well, think about where we really started. It was at least where we started in trying to come up with why we needed a build on it report is because we were trying to solve the question, why does it work on that machine but not on this machine? And if you had a clean build on it all the way down to what the machine looked like, you could do a difference report and clearly see, again, going back to accessibility of the information. How accessible is the information and how can we act on it? Neutrino, so bit flips and memory. So cool. Well, I think we'll have time for one or two questions. And this can really be open-ended about what folks think about the future of OpenSSF or things that we could be doing or things that are going on now that you might know much about. But let me just ask one question before we open it up. What is the most unsung hero in the OpenSSF circus? Like, the project that you guys think should have a whole lot more attention paid to it. Alpha, omega. Alpha, omega, OK, great. Rob? I think OpenCRD, the common requirement one, is actually picking up the specification. I think I'm hoping that we'll pick up really quick. OK? Yeah, I'd go back to OSV. I think it's an amazing tool that answers a very simple question that I think a lot of people have, but it does it in a very elegant way. And I'd love to see more use of it. Mine is we have a repo called Creatively Enough Security Reports that attempts to be an archive of all the third-party code reviews that have been conducted on open-source projects. If I have that right, David, I might have that wrong. I mean, the goal of trying to understand who's been actually looked at by third parties and is there a consistency to the reports? Is it worth trying to create a wikipedia-style kind of archive of this information? I think it'd be a great set of knowledge to have in one place when I'm going out and looking at what's offered to you. Anyways, I'd love to see some more investment in that. OK, with that, why don't we open it up to some questions?  So do you want to yell it out? Go for it. So Amanda's question was, and she's from Open UK, by the way, visiting us from London, where you called home. How do we plan to work with other regions of the world and extend it a little bit, as well as other governments to do the same kind of thing we did with the White House? And I'll jump in, but feel free to add to it. So we are already an international project. We've got both corporate members from Europe and from the Asia-Pacific region. And we have contributors. Some of you traveled here from Europe. Some of you traveled here from Australia. I don't believe, and some of you traveled here from Japan, or from Cybertrust, wherever you are. And oh, great. And we do tend to, though, have an unfortunate reliance, in my opinion, on Zoom calls as the fundamental communications bus for the community, which has some great upsides. I've loved seeing y'all's face on Zoom calls over the pandemic. But it does make it hard for those in timezones that aren't kind of US centric to participate. And so one of the things I'd like to see, and I don't want to push this too hard because I want people to be productive and not haggled, but I'd love to see us use email more or use other asynchronous collaboration tools as the most baseline level of form for collaboration. I see our friend Caleb nodding his head vigorously over there. He's from Australia as well, where most of our calls happen at 2 in the morning. So I can see why he agrees. The second part of that question was working with other governments. So as I mentioned, nothing in the mobilization plan or the meeting we had was US government specific. We simply wanted to make sure that our friends in government knew what we were doing and that opportunistically we could find ways to collaborate on one or more of the mobilization streams. We've had interest from folks in Japan, from folks in Singapore. We'd like to, we're working to figure out how to do something similar in the UK. The European Union has put a whole lot of priority on kind of open source software as a policy first kind of thing, which is great to see. And that kind of convening where you bring together folks from different parts of government, folks from local businesses to talk about the challenges with securing the open source community, but also the opportunities is a very repeatable kind of format. And I would hope that it would help us in the long term fill the gap between the 30 million in pledges we've raised in the 150 for the overall plan. But even if all we do is go there and find new allies, it's worth me getting on a plane. So no plan more specific than respond to all the emails so far, but we've got a few meetings in flight that we'll be as public about as soon as we can. I'd like to add to that. So I'm the community manager for open source project called Artilius. It's incubating at the Continuous Delivery Foundation. And we had requests for people out of Australia and New Zealand to somehow incorporate them into the discussion. So what we ended up doing was we have sort of an offshoot of our architecture meetings that we do specifically in their time zone. It does require some additional work, but boy, is it beneficial. Really, really is super beneficial. So if you're on an open source project, I would say find a partner in that region and let them take a project and run with it and kind of build their little offshoot of the open source project. It is a huge way to go. The other thing that we're doing to try to solve this is I'm not a fan of Slack or Discord for tracking these kinds of conversations. So I've reached out to the DevOps Institute. They have something called DevOps in the Wild where it's actually a community discussion board. And we're asking if we can have an Ortelius discussion board out there so you actually have historical record. It's almost like a stack overflow for the Ortelius discussions. So those are some ways that we're trying to address the problem. I feel very old suggesting we use email because I know all the kids want to do PRs by TikTok these days. But... What is there actually? RFC! Oh, okay. RFC. Use net! Go for it. All right, but yeah, I think... And actually another example of this that I forgot to mention. So one of the regions that open source communities often have the hardest time trying to reach is China. Because you have the time zone difference, the language difference and the firewall differences that make using tools like GitHub and Slack and others just a non-starter. So one thing that we've set up within the best practices working group and I've got a charter I'll be delivering for this group very soon and some names specific is a group that will be serve as a bridge between a development community inside of China, Chinese developers, focused on helping translate and eventually contribute back upstream to the guides and the other work products of the best practices. The best practices working group. And if that model works well, we see replicating it potentially for other countries where the language barrier can be substantial as well like Japan or South Korea for time countries where time zones are issues like India. There's a request for Africa as well. Another great one for sure, the Middle East as well. And then potentially with other working groups as well. We didn't wanna try to boil the ocean by doing an openness of wide one just yet. But I think that's key meeting them where they are so they can use the tools they're most comfortable with. WeChat for example, and they've got their own zoom equivalent and the like. So I think that's key to reaching local audiences. Anything else folks wanna? To add, I think as Brand mentioned, all the work streams are actually works globally, right? There's nothing specific to US. Obviously US executive order is helping to mobilize some of them, but projects are actually globally. I would like to see actually the regional leaders actually step up and maybe have the local chapters. And maybe you can have regional open SSF days in future in Europe and AIPAC. Well Arnaud was with me on Arnaud Lior's from IBM was with me on Hyperledger where we build a network of over a hundred different local meetup communities city by city around the world who would host regular kind of gatherings and that kind of weather during the pandemic. But I think we're at the point now where those kinds of things are happening again. And whether it's us or us showing up at B-Sides events and other security community events already happening locally and face to face. The point is kind of fan out and try to get more base into what we do. Sure, go ahead Amanda. And we should be very careful not to duplicate the effort of what folks like Open UK and OWASP and our other friends are doing in that front. Thank you Amanda, that'd be great. I do think we have time for one more question, especially since we tend to give five paragraph essays to answer. I have a question there. In the back there? Yep, go for it. Can I turn the background and ask what we should be doing? But let me repeat the question because I don't know. You mentioned AI and building sophisticated models. So kudos on that. But sorry, I'll repeat the question. The claim was in three to five years most cybersecurity issues will be about automated systems versus automated systems. And we might lose the battle if we deal with it too much as I'm extrapolating here. As a cultural community, let's just go find all the bugs and fix them kind of thing. Instead AI models become much more important and just new kinds of defenses I assume. So unless anyone else on that one. I have thoughts on that. Thank you for asking the question. And I brought this up in DC. So recently I picked up a book on chaos engineering and I was fascinated by it because the point of chaos engineering is outages matter. In our case, security breaches matter. So I feel like we can't code our way out of this problem. I really don't believe we can. We can do a lot to shut down a lot of the penetration points we'll just call them, but we can never be 100%. So I feel like what we should be doing as a community is really coming up with a FEMA response. How do you report a problem? Then what happens? What is the escalation? Is there a central organization that reports to everybody what's occurred? I'd love to find out when Jamie, when IBM found out about Log4J or whoever first discovered that, which I don't know, what did they do? I'm a developer. I found a bad problem. What do I do with it? I feel like that is where we really should be looking at creating a proper response because outages matter, security breaches matter and that's something that we should be laser focused on to solve the problem long after we, Alpha Omega has scanned as much as it can and after we've got S-bombs everywhere we still have the potential of having a breach and what do we do with it? Any other thoughts from the panel? Thank you, Colin, well, yeah. Okay, and any thoughts from you on what you think we could do in this space? Well, I think we have a volunteer to help convene it, perhaps. I see hands up. I think it already has a comment. Oh, is that, no, I think all the hands were like, volunteering to go help. So put together, Ava's gonna help you put together a great proposal for the TAC and I think we have a working group number eight already in hand, great. Cool, well, with that, I think, are we at the time? Two minutes. Anybody have a two minute question that we can give any other questions? Okay. Ava, go ahead. Yeah, I mean, when there's a fire, the FEMA gets involved and they have an escalation policy, right? We don't have that in open source security. We don't. Well, let me suggest mapping out, like what does CISA do in the event of like a future log for J, I'm just looking for Alan. What does ONC do? What does the National Security Council do? As like the government side, but then also what does CERT do, right? And in response to log for J, that was where it was actually discovered by a Chinese developer working for Alibaba, followed appropriately reported it to the Apache developer community.  I wonder what that's for. And then that led to it inadvertently getting out too rapidly. I might be way massively under. Okay, thank you. And so they're possibly, if we were to map it out, we could probably find a gap. And I think one of the gaps that we found really spoke to one of the mobilization plan points, which called for the establishment of the emergency response team, right? Which is modeled after other things that we've seen work, but not as open source focus as what we proposed. But even if we proposed that, I know that's what you were responding to with a comment in DC. There might still be a need for somebody who is more FEMA-like to compliment those efforts. Yes, somebody has to manage that incident. That's the key there. And Crow wanted to say something on that point. So the vulnerability, anyone of us interested in scoping out and trying to contribute to solving this problem, everyone is invited. So if you're interested in this problem, find Crow, find Tracy. There's a meeting first week of July, to focus on this, to get that emergency response team set up. Great, well, I think with that, that's a great place to end on. I want to thank my panel. Thank you, Brian, for having me here. Tracy, Rao and Bob, thank you. Thank you.


Bisphenol A, BPA, is a chemical found in plastics and other products that can cause serious endocrine disrupting effects in humans and animals. Studies have shown that high doses of BPA can increase body weight and disrupt normal cardiovascular function, but there is evidence that even low doses of BPA can also lead to endocrine disruption. This disruption may be caused by multiple mechanisms, including altered gene expression, changes in metabolism, and disrupted hormone signaling pathways. These findings suggest that even low doses of BPA can have significant adverse effects on human health. This article was authored by Filippo Acancia, Valentina Palatini, and Maria Marino.


My name is PFC Mensa Sims, Nathaniel. I'm from Danbury, Connecticut. So what happened when I came here, it was around July 12, I believe, 2019. And, you know, I shipped out, came here, stepped on the footprint. I went through fresh phase. It was getting used to being a recruit. When it got to swim week, I fell swimming. He told me how to swim, but it was just hard for me to grasp the concept. I got dropped to multiple companies before getting sent home. Knowing that I'm going back home without becoming a Marine, it was really a sad moment in my life because I didn't get the title. It meant a lot to me because when I was coming to the United States in 2012, I saw a Marine at airport and the way he was discipline, the way he was standing and dressed, I just want to be that person. So what I did is that I went to swim instructor. So what I used to do is I go to work. After work, me and the swim instructor find the time for me to practice how to swim. Whilst I'm waiting to come back, swim, swim, swim, work, swim, work, swim. Because I really wanted to, my swim instructor was still surprised.  I was like, nah, this is what I want. The reason why this is really close to my heart is because of my dad. Before he passed away, I told him I was going to be a Marine, United States Marine. I was going to boot camp and when I got back and he wasn't there anymore, it was just, I had to accomplish this and do it for him. Coming back to the Marine Corps second time, I started March 16, 2015. We used to march. I passed the swim building and it was like, I'm ready. I was more prepared than last time. I would say that my dad would be proud of me because he has never seen that kind of not given up mentality in me before, since I was high school. He's never seen it so, and I think he would be really happy that I did it and I could say I did it. And also, I remember telling, he telling me that if he's not there one day, I should become something big so my sisters can learn from me.


This paper presents a new method called MPROM for analyzing massive parallel reporter assays, MPIAs. The authors compare the performance of their method with other statistical methods on multiple data sets and find that MPROM outperforms them in terms of accuracy and power. They also analyze the effect of different parameters such as replicate number and barcode length on the performance of the method. Additionally, they perform a power analysis to determine how many replicates are needed to achieve a certain level of accuracy. This study provides valuable insights into the analysis of MPIAs and can be used to optimize experimental designs. This article was authored by Leslie Mayant, Demetrius G Avramopoulos, Loyal Agoff, and others.


Hello and welcome to the video about the STM32 cube PCC tool which is embedded power consumption calculator within our STM32 cube MX or cube IDE. It is usually quite hidden so let's go ahead and explain what it can be used for. Usually you have a low-power application or you just want to find out how much power your application will consume and basically you have three options how to obtain the rough value of your application profile. First of all and the hardest one is the real board measurement which will take a lot of time to obtain the final value but it is quite precise measurement but the biggest downside is if you just want to compare two microcontrollers to select the most suitable one it would take a lot of time. The second one is the data sheet usually you will just dig into the data sheet to find the value of the low power modes of the run modes so it's relatively fast but still for a complex project and lots of modes changing within the application it may be quite difficult to evaluate the final profile. And finally with PCC it's a graphical interface so just in a couple of clicks you will find out the estimation of the expected current consumption and the profile of your application but in some cases it may be only a rough estimation of the application profile. For this video I have selected the L476 nucleo and I will simulate a real application which spends most of the time in the stop tube mode the low power mode and that will be for the 990 milliseconds and it will spend 10 milliseconds in run mode to simulate some kind of data processing or data acquisition. This video is not a tutorial on how to use the cube mix that is already covered by some other videos or the available so to create the model application I will just show the crucial steps so at the beginning either in cube IDE or in cube mix I need to start a project give it a name find the L476RG just the microcontroller because I don't need the board in its default state I just need the plain microcontroller project I name the project and finish the creation of the file. When the cube mix project is created I need to configure my application so to periodically wake up from the stop mode I will use the RTC peripheral real-time clock so first of all I need the RCC to activate the low speed clock that will fit the RTC with this clock source on the nucleo board the LSE crystal must be in the high drive mode and then I can switch to the timer find the real-time clock peripheral and activate the clock source and I will be using the most simple feature of the RTC and that is the wake up timer the wake up clock will be set to the RTC clock which is the LSE at 32 kHz divided by 16 so effectively 2 kHz clock signal will be fed into the wake up timer I need also the interrupts being enabled for the RTC and finally with this configuration done I need to set the correct clock for the RTC that means in the clock configuration tab to switch it from the LSI to the LSE and also I want the multi-speed internal to be at 48 megahertz so I will just change the clock for the 48 megahertz the final step of the configuration is to set the unused IOS to analog to reduce the power consumption with the project created in the cubemix or cubite I can switch to the coding view and define my application so I will be using the wake up timer that is prepared by the cubemix I just need to activate it by using the HAL RTC function as you can see one of the parameters is the 2047 which is exactly for the 2 kHz to make the period of one second I will enable the flash sleep power down to save some power during the low power state and then in the simple while loop I will simulate the execution of some data processing by using the simple HAL delay for 10 milliseconds that is just a while loop waiting for 10 milliseconds so the core stays in the run mode after this 10 millisecond period I will go to the stop tune mode and when the CPU will wake up the cycle will repeat again the point of this video is to show the use cases of the power consumption calculator versus the other methods so for the real board measurement I was using the power shield in combination with cube monitor power application and I obtained the value of the 89.44 microamps of my application you can see also the graph that we are periodically waking up with the 10 millisecond duration and for the rest we are in the low power mode the second method is the datasheet method so I need to open the datasheet of the L476RG microcontroller and find at least the two crucial values that is the power consumption in the stop tune mode which can be found in the table 45 and I need to find the power consumption of the run mode and that will be found in the table 29 I obtained my values so to calculate the power consumption of the whole application I just need for this particular application quite simple equation basically it's the percentage of time I'm spending in run mode which is the 10 millisecond and the percentage of the time in the stop tune mode which is the 990 milliseconds or 99 percent of the time and I can calculate these two values together and that will give me the result of 78.17 microamps this is just a quick calculation but if I would combine it with some other peripherals it could grow very large and very complex at equation coming back to the presentation to give a quick comparison of the three methods I used in this video the real board evaluation versus datasheet calculation versus the PCC as you can see they are not so far from the real measurement as for the datasheet or PCC so it can be a good estimation at the beginning of the development or as a tool to choose the most suitable microcontroller for your application so thank you for your attention and hope to see you by the next video