My name is Dominic. I work for Intel Open Source, and we're going to talk about security. So, those who know me have been working in security for quite a bit of time. I did a project with British Telecoms and I work in TV industry, where security has been a long tradition, and after that, I probably moved to IVI. So, the first thing I want to raise really strongly is that a lot of people believe that in embedded, security is a problem mostly for the press, but not for the engineers, not for the management. What we have to realize is that actually, attacking IoT is a very viable business, and it's viable for different area. One that has not yet started, but I expect will start soon. I see people doing photos of the slider. It's very nice things, but I can tell you I've already posted that on the website, so you should have it. So, the ransom model that has been very popular in the last two years on PCs is certainly going to start in the IoT. So, why would you like to run something? You can store and manufacture it quite easily. You can lock down the very expensive items, and as I told you, I'm working on automotive Linux, and it's a very interesting proposition to actually lock your car, and one day you will come in the morning, and the only thing your GPS system will display is, please pay 500 euros in bitcoins before using your car, because you will have to pay. So, it's an interesting model. It can be used for competitive advantage, especially when you want to collect R&D or manufacturing data. It's quite badly protected, and they are highly valuable. And you can also disturb production line. I was recently discussing with a guy doing food in the food industry, and one of his fears was that actually someone with bad intention blocked his manufacturing line before Christmas, because that would kill him, that would completely kill the company. And finally, indirect, and that's what we have seen in the last two weeks. You may have read in the press that for the first time, a terabyte per second dose attack was launched against a French cloud provider called OVH. That was the first time ever that a dose attack actually overpassed one terabyte per second bandwidth, and that was achieved by actually hacking mostly video surveillance camera. So it is definitely a very viable business, and we cannot just say, oh, in IoT, we are protected, we only do small devices, who is going to hack small devices? It's going to happen, and it's already happening, and especially video cameras have been very weak, but the other example, you know, Dick Chenay had to get his space maker replaced because they realized that actually it was not protected, and you could remote activate the emergency mode. Not that so many people would try to make any bad thing to Dick Chenay, you know, it's so popular, but no, it's not things that you want to hear. So we really have to understand the risk, and the risk in one way is a bit tempting to forget. So if we look at software, we tend to believe that we are all the same, we're all hidden, and why would it be me? For a developer, it's an absolute nightmare to try to look at security. He has to think about all the potential weaknesses he should have to deactivate every possible user error, and we all assume that long-term support kernel and application are provided for free. So that's a developer side. When we look at it, yes, if you just take it to the absolute point, you should say it's so difficult, why to bother? You know, it's too complex, in any case, I will fail. The good thing with security is that you don't have to be good, you just have to be less bad than your neighbor. It's a system which is moving all the time, it's a bit like in houses, if you live in an area which is not very safe, if your house is a bit more difficult to hijack, then likely it's your neighbor house that will be hijacked. It's not pleasant, but it's far more pleasant than being your house.  I'm lucky enough to live in a place where when I just go, I leave the house open. It's very practical, the friend visits and he has something to give me, he just can get me in the house, take what he has to take or put it, but not everybody can do that. In software, we've been behaving and embedded a little bit with the open house policy. Default Wood Password which are published on the internet, open port, kernel which are five or 10 years old and which have a few tens of zero-day attack, well-published. So that is on the development side. Obviously on the blackout sides of the baddies, in one way the work is a little bit easier. You just need one security hole, you just need one entry point and then you're in. You can trust to be held by careless users and careless developers. That's a good thing when you want to hack a system, you can take as a principle that the user and the developer will have been misbehaving and so you are going to do social engineering and try to find out who they are. And you see things far worse than just having a post-it with a password glued on a screen. You see terrible stuff. And once again, the long-term business viability is very good. If you think from a return of investment and you put yourself in a black hat situation, it is a very promising business proposition. If you think the cost against a return, it's extremely interesting. And they are well organized. We have a good international network here in the Linux and open source developer community, but the black hat are not bad at all themselves. They are extremely well organized. They have a good way of sharing information, sharing businesses, sharing tricks. If you go on the dark web, you will find out that people are even grading themselves so you know what you buy is good. The guy is reliable. Some even provide some after-sales support in case you would not know how to use a system. So we really need to understand that risk. And that potentially is the biggest problem I face today. I've been talking about security and embedded for the last five years, almost in quite a number of conferences. And quite sadly, I have to say that I have seen very little progress. There is more and more people in the room when I talk. That's the only good thing. When I started five years ago, when I had just a bunch of a few people and most of them were my friends who came for support, it was not there. So we start to have a little bit of hearing, but we have difficulty with multiple layers in understanding the risk. The developers, because it's a pain for them, they have to really work harder and they have to organize themselves. So they're a bit lazy on the side. We have difficulty with the people providing the tools and the continuous integration. When you tell to your QA manager that now he's going to have to sign every single image that he's doing and continuous integration. So the continuous integration test will be done on a signed image. It tells you, yes, this is going to require a specific server and who is going to provide the key. Yes, it is difficult. And it's difficult with management. And with management, the difficulty is slightly different. Obviously, they look at the cost, but they also look at the risk. You know, if as a manager, I say, I am going to provide a secure system, then you have to commit to it. And as a manager, you put your head on the block when you say something like that. So if it doesn't work, you are fired. So there was a key to statical. Now, it's not going to last. So one thing I am sure is that before I will retire, which is not in that long, you see my white hair, it will happen one day, I am sure that security will be taken into account. So that's a good thing. At least I've been talking for a few years in empty rooms, but I can see that it is coming. And in coming, the good thing is that we have most of the technology and we have the capability to really improve the level in one way quite easily. So what are the fundamentals? The first one, you have to minimize the surface of attacks. That's the base rule, is that the more you provide services which are not needed, the more you are going to have trouble. So yes, you may have a debugged demon which is running on your system. In production, it should not be there. And the only way to not getting there in production is to remove it from day one and just make it optional so people have to manually install it. You have to control the code which is when. That's something which is done far too little. People start to check licenses, but a lot of people are not running code checker, buffer, overrun, stack violations. You have static code analysis you can do, that one step. But also trust your code, get your developer to sign their code. So you know that code which get in your Git repository is a valid code. And most of the company I know don't do it. So if a hacker has a capability to get into the system, for example, show a video camera like it happened not that long ago, they can post code on the Git repo that will become valid code because nobody ever checked that. It's very simple to do it. So trusting your code is interesting. Obviously provide an upgrade bullet proof model. I will come back on that. I will never insist on the fact enough that the update must be bullet proof. Being available is step number one, which is already a big progress because quite a number of unbedded devices. The upgrade process is so difficult that actually it's impossible in the field. But it has to be bullet proof. Tracking security patches, that is potentially something we have quite far away in embedded in the sense that most of people tend to be stuck with one version that they are using. They are not capable to go to the next release of kernels. They are not capable to go to the next release of the build system. I was discussing yesterday with automotive grade Linux. We are likely going to have to move to the next Yachto. It's not too difficult, but the natural tendency is to say, no, we're going to stick with the one we have. That's really bad. So you have to put a process which allows that. Use hardware security helper when they are available. Should be done, but most of people still store their key on a disk or on a flash. Stop lateral system, that's far more complex. We will see how automotive grade Linux does it. But it's a significantly more complex stereo. And develop and get QA with security turn on. You cannot turn on security later on. And finally, never rely on human. If you want to fail, you rely on human. All developer are good. They are going to take care, no. Customer will change the default password. No. Or QA will remove the special extra software we have for debugging before shipping the image to the customer. No. So that doesn't work. You have to get your process which are taking on. Which probably to a first fundamental that security cannot be added after the fact. So if you develop your project without security and you say, oh, we will add security when we are after the proof of concept, you've already failed. The good news is that then you know immediately you have failed. That's practical. But it is a reality. So you really have to sell that to your management very quickly. Why can we not rely on human? There are two different reasons. The first one is that the people who really understand security and in particularity in embedded are almost non-existent. And I just give them a few numbers. We have about today in the world nine million mobile software developers, about eight million web developers, about half a million embedded developer. And out of these half a million, a handful of them are security aware. So your chance of hiring them or your chance to have one on your team is about the same than the one of winning the lotto by buying a ticket. OK, it's almost nil. So you definitely cannot rely on that model. It's just doesn't work. And if you take IoT, because we are in an IoT summit, where we want to develop numbers varies. Today, people seem to agree on 30 billion device by 2020. OK, it was 50 billions a year ago, so it's getting more reasonable. How many developers are we going to need to develop these devices? Actually, we need more developers that we have in embedded world today. So it means that these devices are not going to be developed by embedded developers, that the first rule. You have to realize they're going to be developed mostly by web developer and potentially mobile developer. So we are going to have to adapt that. And the knowledge of security is for them in existence, because that's part of the platform. So on the application, they don't bother with that. And so that is one error. The skills are not available. And the second one is that, as I've already said, and I've repeated because it's difficult for us because we are developers and we tend to believe that the developer has the best people in the world. We are unreliable. OK, we find any reason to actually put it for tomorrow. Now, I told you the concept are known and the technology are known. So we all know the basic principle of this type of things. The first one is that, I cannot do that. Sorry, I wanted to put a mouse, but I cannot. We know that our software is going to run on a hardware. OK, it's a pain. We all know that software developers, we would love to not have any hardware, but it has some good side effect. Me working for Intel, it allows me to be paid every month. So I'm quite happy you have to run on hardware. But on the hardware, we have a number of areas. Typically, I would put them in three domains. The first one that we all know is the secure boot. Now, depending on the hardware vendor, it can be different. At Intel, it's part of our UEFI model. The secure boot phenomenally allows you to know that the core part that you're going to run on your hardware is known and that your hardware is in a safe state to receive it. That's what it will do for you. Every vendor has that. Then we tend to have a TPM, which is a type of trusted zone in our friends from Cambridge, which allowed to have some safe storage and potentially some safe execution of the dedicated code, which will have very key functions, like validation of something and scripting of something, time to be available. The final one is probably beginning. It's been available in certain technologies, like in TV, we've been there for years on mobile. It's coming to traditional embedded, which is capability to manage IDs, which is a very interesting point, capability to really have an ID which is specific for every single device. But that's coming from the hardware. So then you put your Linux, and your Linux has to be up to date. Because if it's not up to date, you're going to be in trouble. Now, up to date doesn't mean you have the very latest kernel, but you could work with an LTSI, for example. But you have to put the patches for security. And a lot of people in embedded, what they do, the first thing they do is they do their own kernel. They had a few drivers from here and from there. And that's it. That's the end of the maintenance. That's not good. People are laughing. They know that. OK. And then you come to more complex area. And we have capability to harden OSs. It's been in Linux in the cloud for quite a long time, in enterprise. We had capability to harden Linux quite well between the mandatory access control, the name services. We can create domain. We can do restrictions in the APIs that you can call in the kernel. There are plenty of models which are there available. And then you're going to have API and you're going to put your application on top. That is fundamentally describing the base principles that everyone should use. I have a hardware. It has some functionality and I take benefit of it. I am using Linux or another real-time OS for smaller system. But here I'm talking to Linux, mostly community. And that has some facilities. I am going to use them, OK? Not deactivate them to start. And then I'm going to separate the application from the core OS. And that's a very important point. We all know the principle now very well because Android has made that very common practice where the application and not part of the OS, Chrome OS as well. So we start to get used to the concept. But in embedded, it's new. In embedded, we used to have the application built in the OS as one package, one big blob. And that was the system. That's not really viable in security, which has some side effect. Obviously, if you have application separated from the OS, it means you have to get an application framework. OK, there is today no standard application framework in Linux embedded. There are candidates. I will show you one for automotive, which could be used for other industry. You have to create default policy. So you have to get a packaging we say what is going to be authorized because a good principle is that everything which is not explicitly authorized is strictly forbidden, which means that you have to know what you are going to authorize, which are typically policy. And finally, you have to manage all the signing hassle to know where your code is coming from and should it be running here and who has done it and so on, which is actually more complex than it seems to. So do we know what we can trust? You can only know what you can trust if you have a valid chain of trust, which has to start with a trusted boot. So there's no alternative to that. If you are permanently connected, which was the case when I was working with set of boxes, you can find some shortcut around that. But for most of the devices, without activating the trusted boot and without having a very valid chain of signature, you will never know if you can trust anything because your base will be very unstable and you will be building on top of mud. You have to separate the application installation from your OS and you have to have an update system. And that update system should validate that update are only coming from a trusted origin because if you install a faked update, you are not really progressing very well. I will make one specific point on the container and people want later we could do privately from container. Container are not a miracle solution, especially when you come to update because you have no control of what gets in the container. So it's a big side effect. But you have to really think about that. Once you know what you can trust, you're going to do a layer architecture. And here's the idea that you are going to start to make a model in such a way that if you get one part of your system broken in, which is not more if, but rather when, the guy cannot move from one place to another one. And so obviously the most untrusted part is everything dealing with the outside world. So most of the time, the UI. It could be an API if it's a system which is UI less. But what is dealing with the outside world is really what you cannot trust. And so you have to isolate that very well. And the best is to isolate it by providing APIs where you have defined services which are acceptable for that application. We started the first system I worked on which had that and embedded was Tizen. It came from Samsung. But they had the very basic principle to say, is that application can do this, can do that, and can do that. And that's it. And every time it will try to do something else, it would be rejected. Then you have the services. And the services quite often are part of the OS and they are trusted. That is something that is less and less acceptable. Ideally, you want to be able to treat your services like your application in such a way that you don't really trust them completely and you install them outside of the OS and you run them in a domain which is contained. And this is really interesting because it means that if someone break into your service, it doesn't have the capability to spread out on the side. Because otherwise, if you have a Bluetooth demon, and I take Bluetooth as an example because it's a code which is extremely complex, if someone can break into it and you run bluesy as root, which most of people do, if you break in it, you are root. And if you have not layered your system in certain ways that root is not capable to do anything, which most of people let root be the king, then you are in and you are the king. So this is how actually the big hacking through video camera happened. People came through a very side effect maintenance and became root, and from root they changed the VLAN on which the camera was connected. Hey, yes, it's very easy once you root. And then they could listen at another VLAN and they could go in the management of the router and then they could patch the router and progress that way. So you definitely want that. This is a bit difficult to implement, but you have OSS, which does it. And finally, obviously, at one time you have a platform and a system services that you have to trust. So the trick to be able to trust that part is to make it as small as possible. So the more you're going to add services, application, and extra on top of your very basic core system, the more you're going to take risk. So what do you want in your core system? Absolutely the minimum. The trusted boot, the base kernel, the file system, and then the daemon to load your services, half trusted, the application framework to load your application completely and trusted. That's what you want in your core OS. I talked a little bit about update. I did a project a few years ago which had the capability to cut every single telephone line in 30 million houses in the UK. Believe it or not, I had a security guy on my back for quite a long time. It was very worried that someone would hack and system and actually would cut the telephone in the 30 million of houses in the UK. And one thing we learned out of that was that the only defense we had in case of trouble was update. The trick was how could we do an update on a system which is already compromised? And that's what you need to think. A lot of people are thinking about update, how I'm going to optimize, how I'm going to make it quicker, how I'm going to be able to roll back. Yes, all of that is nice to have, but it's not critical. The only thing which is really critical is how can I upgrade a system which has already been compromised? Which is a far more complex proposition. And you have to think about that, how to do it. The way we did it in British Telecom was that the upgrade software was actually not on the box. The only thing we had on the box was the capability to download the software that actually would be the upgrade software. So when the upgrade software was downloaded, if we had some specific things we had to do before we can upgrade, we actually had the capability to get them. So it was coming after. And that was not perfect. We did that system 15 years ago and at the times of risk were not as bad as today. But you will still have to think about that. Obviously you have to sign it and you have to think how your keys are going to be. Protecting keys is a very serious challenge. You cannot trust anyone, especially you cannot trust your manufacturing if you are manufacturing in a low cost country. In a high cost country, you cannot trust them much but in a low cost even less. And it's a problem. So you have to really think at the complete chain of protection of keys in that area.  That's not acceptable. Now sometimes with mass stuff you have to do it. But if you can afford to have either update system, something which is specific to that device, it can be quite simple. It can be just one file that when the request comes is the idea of the device and you add that in a file and you push it just in such a way that it makes more difficult to reproduce identical by just replaying memory. It will increase your resilience quite a lot. So I've been talking in general. I will take a practical example, automotive grade Linux. Automotive grade Linux is a distribution that could be called industrial IoT Linux. It's fundamentally a Linux which is secure, provide display management and has an application framework to be honest. It doesn't have much specific to automotive except that it fits that requirement. It's been derived from Tizen too. Then they have done quite a few interesting improvement in certain area. So service isolation. Obviously you can use system D to start your services and you can drop privileges. You can activate mandatory access control. In AGL is don't use Mac. You have C group which can stop people to eat all your CPU or your RAM. And namespaces can be used to further force isolations. So in one way there is no magic there. It's just organization. Now if you do that the first time on an OS I can tell you when you're going to boot nothing is going to work. Because right will be wrong. So it's that where it's interesting to work with people who have done it. More interesting is to segregate application from the OS. And AGL went a bit further in the sense that they not only segregate the application which is something we were already doing in Tizen they also segregate the services. And that is done through the application manager which is capable to load the applications, to run them, to start them. But when they are started they are started under the control of the security manager. And fundamentally what the security manager does is that when an application wants to use an API it does check that the application at installation time was declared allowed to use that service. You all know that from your telephone and apparently we use the small Android robots or the Apple. They have the same principle. Application have privileges which declare what an application can do. And so that's the basic principle. So obviously this right have to be managed somewhere and that is managed in the security manager. And that has to be interfaced with the entire system to know every time you create an API that that API is dependent from a specific privilege. What is a bit original in the way it's been implemented in AGL is that the services have been implemented under a model of binder. So it's in one way it's an application which is running without UI. And you talk to that one through a web socket. You can use D bus for legacy but the real model is to use web socket. And so you have a West API and that West API is managed like you would do in the cloud. So you have a token system and that token is passed to the application at the initialization. And if that token, if this is broken it's stopped to work which means that if a fake application would try to use a socket which has been opened by a valid application it would be rejected. That's quite unique in embedded world. It's unique in the sense that it wants to provide a very nice level of control and isolation because it really stops someone who would become valid to run an application in system. Obviously a fake crook application would have difficulty to actually eat resources which have been established by other application. In that point it's interesting. It's also interesting in the sense that it does rely on the technologies that web developer know. And remember what I said at the very beginning. We don't have enough engineers to actually develop IoT devices. So the fact to implement the security model on a concept which is known and understood by nine millions developer is very interesting because that means you can actually pull all this guy to start to do embedded and not only to do embedded but to do secure embedded. So practically this is the way it's implementing and I give an example. So the transport and access control is done through web socket. The access is done through open authentication too. And then you can have services and that these services for example navigation service can do the map handling, the point of interest. It doesn't have to be the UI. And a service can call on another service which means that you can actually extend an AGL core to become what you want to be. Most of people today trying to do something in cars with it which with automotive grade Linux is not surprising. As I told you, it could be very well an industrial controller for a machine. And you actually run them on top of this transport and actually call them. Now every service is controlled with a Mac. So if you have not looked at mandatory access control, there are three which are very popular. SC Linux which is very well known because Red Hat use it. Aparmo which is used by Ubuntu and OpenSuzi. And SMAC which is used in mostly embedded devices for reason that it does a little bit same thing but smaller. It's used by Philips originally in television. It's used in every Samsung, Tizen device or more or less every TV, watches and gadget done by Samsung today is using it. And it's used in AGL. But they do the same thing. They're more or less what you have attached to an executable, a label. And that label will define what that executable is capable to touch. So it's really a control. And the executable does not have the capability to change it by itself. It's not like access control. When I put an access control, I have the capability to change it. So if I become rude, I can decide that anyone will be able to read a file. Not with SMAC. With SMAC, it's a bit more tightly controlled. And anyone who has tried to play with it knows that it can be a bit painful on the configuration. Because it requires you to be extremely well organized. But the beauty with a ready-made system like AGL is that it provided for you. Now, how does it work in the application framework logic? Well, it's very simple. The application is having a binder client and can actually even embed a binder service if you want. So your application can be having a fairly wide if you want domain. But it runs in a specific isolation control. So this application could only talk through the standardized transport to other services. So if that application requires other services, it will call on them through the transport system, which as I told you is mostly based on WebSocket or D-Bus for legacy. And this services could themselves change that. So it created a little bit of heaviness in the system. And this transport is using JSON. So once again, the technology that web developer knows so we can pick up them. We'll look at what is the cost of it. Because when you look at that, say, oh, this is really tough. You know, it's going to put my embedded system down. It's actually not bad at all. We could on small, medium-sized CPU. I did the test on a miniboard. And my friend Stefan, who's at the end, did the test on the portaboard, which is from Renaissance. Results are roughly equivalent. We could manage about 30,000 exchange of data per second. So it's not bad. Because these are small CPUs. So it would fit most of usage even on a small CPU. So the cost is not prohibitive at all. If you use D-Bus, it will put your system down very quickly. Okay, WebSocket significantly quicker than D-Bus. Now, when you write an application, what is the side effect of it? The first time, you will have to decide what your application has a right to do. That's a very important point, because that will define the privileges that you're going to request. And if you don't know what your application has to do, then you'd better not write it anyhow. So you will access to your services through WebSocket, mostly. You will have your own run domain. That's done by the application framework. You don't have to do that. And so you typically write the front-end. Our advice is that you run the front-end and we like HTML5, because then you can write these one-page applications with this very nice framework that people use today. And it's interesting because it allows to make very nice application. It allows to debug running on a PC. While you are connected to a WebSocket, you embedded the development platform, which is really luxury. But it's also possible to develop with other technology. It's not linked to HTML5. So you can use QML for people who are using QT, or you could use anything else, to be honest. At the end of the day, it doesn't really matter. And you're going to use WEST APIs to talk with your services. Once you have done that, you're going to make a package, and that package is based on WS receive widget, on which you have to add what you need as privileges. And you shake all of that, and then this is going to be installed by the application framework, independently from the OS. That's a very important point to remember. So that's the only thing you have to do special. So that's what we have today. Today, if you go on the website from HGL, you will find HGL 2.0 candidate, and you will have an application framework and you will have capability to play with that. Where are we going on? Now that we have a transport system, which is working on WebSocket, we can actually work in different manner. We can have multiple CPU talking together in a network, or we can work with the cloud. There is no need to have the service, which is on the embedded device. It becomes completely transparent. So we have the capability to extract services, send them to the cloud, as well as we'd want them, locally, as long as we are connected. Because the technology we're using is technology, which is very common in the cloud area. So that's the next step. That should come, I would say, reasonably quickly in the sense that it's more an implementation, details, and a real architecture change. The architecture we have done is already doing that job. The next step is a bit more complex, especially I like it because working for Intel, virtualization is a domain where we are pretty strong. We believe that there is an interest to actually allow virtualization to run in this type of environment at very low level, especially when you want to deal with safety functional applications. Functional safety is out of reach for Linux today, and it's likely going to be out of reach for quite a bit of time. So, by running a very low level hypervisor, we could have capability to have some functional safety compliant application running on the same hardware. But on the other side, we could run as well as a client of AGL and another operating system, which is potentially more friendly to what we want to do. For example, two games, okay, and then we could have the system which is running the basic application, but you want to have a game on the side. You may not want to run it on the same OS and have to manage all the codec issues and potential risks, so I think a virtual machine is a very strong interest. So, as a conclusion, technology for implementing a decent security are available already. So, all the excuse for not doing it because it's not available are no good. The management is not more ready than the engineering. And they are still capable to push it out. And engineering sees security as a break for innovation and that is really wrong. I've been in security for quite a bit of time and I can tell you there is a lot of innovation in security. It may not be as sexy as doing UI work because typically people don't see what you do, but I can tell you for your paycheck at the end of the month so for finding a job, it's a very good one. So, there is a lot of innovation and there is a lot of opportunities which are there. The complexity is there, complexity is huge and I would not advise, I would actually dis-advise you to try to do it by yourself. You should take a ready-made implementation and it doesn't matter if you go with AGL, obviously we do AGL so that's the best and Stéphane agrees with me. But if you go Philippe on the side, he's working on Tizen. And Tizen also has a security model. And even Snappy has a security model from Ubuntu. It's based on containers so it's a bit, in one way, less secure. It's more difficult to manage because you don't have any control of what gets in the container when you control the platform. But they are models which are viable. Try to do it by yourself except if you really have an army of very skilled people is likely a bad idea. With this, we may have a few minutes for a question. Yes. Should I have a comment on that? It's clear that the systems are not yours. They are actually owned by someone else in the car. So, while I would like, if I buy a car, I would like the car to be secured on the outside attackers at the point where you try to make the car secure from you. I own the car, you are trying to secure it from me. Yes. I get pretty angry at you. No, you would like, you would like not to do that? Are you, would you be more happy if you would know that your system with your remote key control can be opened by anyone? No. No? No, but that's different. Yes. You want to hack in. No. Yeah, no. Okay. That's a very valid question. I have known that question in TV for years. In TV, we had that problem for years. It is very clear that when you buy a device where people are committing to maintain it for you and are taking legal responsibility that it is behaving in compliance with the law. You know that your car is not allowed to do things as soon as it moved more than two kilometers per hour by law. If the car manufacturer ship you a system which could do that, he's actually liable.  That's very clear. You are not going to get from a car manufacturer, from a TV manufacturers, from a telephone manufacturer, a device that delivered as it is, is easy to hack at low level. Because there are legal compliances that they cannot commit. And it's very unpleasant, I do agree. Yes, you get phone, but that phone is actually not necessarily legal to work on your country. Yes, that's a trick. So if you want to go outside of the law and you make a clear decision, that's perfectly possible. But don't expect any company or corporation to take that risk for you. Now they may not lock it completely, but they are not going to take it. Yes, yes, you're right, you're absolutely right. There is a part of population, which is a hacking population, who will actually break into devices. They have been for years, they have been there. It will be there. I have been part of them. It's just a reality, but that's not a business. Reality of a manufacturer having to do it. If you are a service company and you have to develop a management system for a factory building devices or making food, the fact that the guy can hack into it is the last, the least of your problem. The fact that someone walking by as a company is not capable to break in is far more important. But you're right, it's a break on that point. What's the question? Yes? Okay, so the question is if you create a system which has only one application, would you need all that complexity if I translate your questions? Obviously it's possible with a system running on a single application to simplify it. Now, you still have to develop a secure Linux.  So the cost of doing all of that specifically for you and to maintain it is likely going to be more than taking a ready-made Linux which is secure and to write a single application. So it's likely not that it is as critical in that type of situation, but all the things you have around makes that likely it's still interesting because it comes ready-made with people who know how to use it, have documented it and will maintain it for you. Yes? Yes? Yeah, so the question is if I translate it simply for people who will watch the video after that is if you make a very small device which will not be capable to run a full Linux with all its complexity, is there some standard system or pattern to develop it secure? Yes, there are few domain remain very true. The number one is that the update capability online must allow to update the system even if it has been compromised. So I would say with very small devices, the number one security is going to be can I upgrade the system? And the number two, can I upgrade the system and not be sure that no one else upgraded for me with the wrong thing? If you have that, you already put yourself at a fairly reasonable level for small system because you're likely not going to be able to do much more than that. And if you take, I take two examples, Zephyr, when I was being sponsored by Intel so I have to talk about it, but Ambed as well that I quite like because the user interface is really friendly. They both have a security model. Okay, it's not as sophisticated as that. It's designed to run a small OS with one application but they still have ported the SSH so they have the capability to use a kind of SSL implementation so they can secure their communication. They have implemented a model of keys and they have an update system. So that's the absolute minimum. If you don't have that, you're in serious risk. Time for last question. Yes? Yes? So the question is, is virtualization viable from a performance point of view? Yes, in embedded world. Okay, virtualization has a cost. It's a bit, as I told you, our security model has a cost. It's not too high but it has a cost. We know that getting messages and getting security has a cost which we tend to evaluate at around 10% of CPU, roughly what we think that get eaten by the security model. Virtualization tend to be in the same range so the low virtualization is very low. The ones that are working on very low hypervisor like JL House from Siemens which was presented on Tuesday here. Those one are very low. They are below 1% but they do very little. Now if you have a full virtualization, the cost can go anything from 3% to 15%. It depends how much you have in your hardware. And this is why I like virtualization because I've been working for Intel. We have a lot of hardware helper which enable to reduce the cost of that virtualization. But if you have the right implementation with KVM you can be as low as 5% of cost by running virtualization. So it depends what it provides you. 5% is a lot and little at the same time. If it allows you to run and the way that otherwise you would not be able to run then it's cheap. If it allows you to provide a solution very quickly because the customer wanted to run Android and you had not planned it, okay. And you want to put Android in three weeks on top of your system, it's very cheap. And finally I would say if you have to buy a more expensive CPU which is more powerful at Intel we're quite happy with that. Okay, with this, thank you. The slide already on the website. And so I'll let you with that. If you have any question you have my email.


How much should we listen to the early church fathers? Should we listen to the early church fathers? Well, it really depends. One, why are you listening to them? What are you going to them for now? Is there a value that you can get from listening to them? Can we glean something from them? Well, sure. But to what degree it depends, it's true that they were close to the situation, but is that always reliable? Remember, even today we can find witnesses, even eyewitnesses, who were there and got facts wrong, who misunderstood the situation. And the same thing happened there. As a matter of fact, if we're going to give validity to the early church fathers, we're gonna have to do a couple of things. One, figure out which early church father to listen to because when we started looking at certain key doctrines and theological statements, there doesn't seem to be always a lot of consensus. This person might believe this. This person might believe that. And if we're gonna listen to the early church fathers, what then should we also listen to the early Jewish leaders who preceded the church, what do they think? Should we go and give a lot of validity to, let's say the Talmud? Well, there's always something that you can glean from there. You can get an idea of what some of the people were thinking, what some of the ideas might have been. But remember, we're not told to look at them. We're told to look at scripture. We're told that all scripture has been inspired. Breathe out. Well, whatever the early church fathers have said, be it an Irenaeus, be it a Polycarp, be it a Justin Martyr, you name it, Oregon, Tertullian, you name it, they all differ in some ways. How could it be that these men who were closer to the situation than we were, how is it that they differ on so many different things? Well, because they're human beings. First of all, we would also have to assume that they were all believers. Now, there's no reason to doubt they weren't believers, but there's also no proof that they were simply because they had made a profession of faith. Not that they're not, but the point is, their words carry no more weight than anyone else's, especially in comparison to the scriptures.  Now, if you wanna take what the scripture said, and then see what the early church thought or how they applied, that's fine, but we also have to remember something else. The writings that we do have, the few, and I mean the few that we do have, we don't know of all the other writings that may have existed. We don't know how completely the thought is presented when we listen to this writer or these few writers, because again, everyone did not have their writings to survive. We have people attest to what someone may or may not have said, but I would be careful in listening to the writings of dead men. There can be some value in those, even those who have written in the 10th, 11th, 12th, 13th, 14th century, even 18th century, even now. You can always gain some wisdom or some extra information from the benefit of what others think, what they thought, how they felt, understanding also the early church fathers in relation to what the culture was like at that time, kind of gives us a little bit of understanding. But the problem is sometimes as we end up taking our denominations and our doctrinal views, we take our cues and keys from them and then read them into what the Bible says, and that is not what we're supposed to do, as though God didn't have enough foresight to think that these other men are gonna come behind and then give extra clarity. That was never a guide. There was never something that God wanted us to do. Listen to someone who was not inspired to give you God's words can be a problem. And even when listening to the people who were inspired to give God's words, there were times where we see accounts where they were confused, where they went off on their own beliefs.  What do they do? They begin to argue about who is going to be the greatest. In Acts one, their mind is thinking of when will he return? Won't the kingdom of heaven be restored to Israel? Jesus says it's not for you to know, but instead be prepared to be my witnesses once the Holy Spirit comes upon you. Sometimes our minds are in different places that God didn't. Why? Because they're not God. They're not the Holy Spirit. And so there can be a difference of opinion, a difference of belief. Remember Paul and Barnabas had a difference on John Mark. And so it's possible that even godly men can differ on different things, on how things ought to go, how things look. Because again, they're not God. What we do have that God made sure that we would have is his word. Let's use that and be careful not to use so much of what these other men have stated. They can be helpful, but I can promise you, there are people that have gotten so far off because they have read the works of this person. They've read the writings of that person. They've listened to this older church father. They can be helpful, but there should not be the guide for how we look at the scriptures. Amen.


Today I'm going to talk about the emerging field of human bionics. Specifically, I'll describe research underway to advance bionic limbs and the implications of such research on disability and human augmentation. How is human bionics defined? Human bionics seeks to advance biologic or synthetic constructs that attach to the body or implanted inside the body that normalize or extend physiological function. Bionic researchers contemplate a future in which technology is no longer comprises lifeless tools from our minds and bodies. A future in which our built world has been carefully integrated into nature. A world in which what is biological and what is not, what is human and what is not, what is nature and what is not will be forever blurred. You know, it's interesting. We understand the synthetic world more than we understand the cells and tissues that make up our bodies. Years ago with my colleague Bob Dennis, a tissue engineer, we set up to build what we called an actin-miasa machine, a swimming robot. It's a hybrid machine. It's unusual because it's powered by living muscle tissue. Because the science of organ maintenance had not been perfected, our machine only lived for 48 hours. I predict one day we will understand biologic constructs as well as today we understand synthetics. In that future, when the architect designs and builds, she will ask, should this part of the device be polymer or should it be skin? Should this part of the device be shape-memory alloy or should it be skeletal muscle? In that future, hybrid machines such as our actin-miasa machine will live on as part of the built world, the built environment, a new nature. Today we live in a world where disability is commonplace. The level of human suffering is beyond all comprehension in the world. So many people have disabilities and a poorer quality of life than they seek. The field of bonnix imagines a future where that's not the case, where largely disability has been solved. The science and technology that will enable the elimination of disability after disability will also, I believe, set the technological foundation for human augmentation. Recently with colleagues Ed Boyden, Bob Langer, and Joe Jacobson, we've established at MIT the Center for Extreme Bonnix. The center has been and will continue to focus on four critical areas to mitigate disability. Program Mon is brain IO, getting information in and out of the brain. Boyden is developing very dense arrays that will go into the brain. Second program is getting information out of the body. A goal there is an interface to peripheral nerves to get high fidelity, efferent afference signaling, mainly for the control of external artificial limbs. And thirdly is how do you build synthetic body parts that emulate the mass and dynamics of the biological counterpart? So, bonnix arms, legs are examples. And fourthly is the area of regenerative medicine. For example, how can one repair a spinal cord lesion to restore functionality, as was shown in this animal model. It's critically important to deeply understand how humans work from our limbs to our brain. How does it all work? As you can see, I'm wearing two artificial limbs. I'd like to describe how they work today. And then I'm going to kind of talk to you about how I want them to work. 20 years ago what I'm wearing here will just simply be laughable, but it's a start. So the legs have six microprocessors, small computers, and 24 sensors that measure positions and accelerations and forces and whatnot. That sensory data goes into those computers as microprocessors. And the microprocessors run algorithms that control a muscle tendon-like artificial actuator, a motor with a series compliance. And when I walk, what we've done is put forth algorithms that enable me to walk without much training. It's very natural and very simple for me to walk. So how did we do that? Again, the science is very important. We advance mathematical descriptions, and we ask questions such as what are the muscles doing in the leg? How much energy is the tendon storing? How the muscle is being controlled by the nervous system? And that informs what we build and how we program what we build. Here's part of the control circuitry that's running in the leg. We have a physical description of the muscle tendon, and we input sensed position and speed of the bonnet joint into that, and it informs us what this virtual muscle, its length, and its speed.  We know scientifically that the dominant reflex of the human calf muscle is a positive force feedback when the foot is in contact with the ground. Simply works as the greater the force born on the calf muscle in the Achilles tendon, the greater is the activation of that muscle. So we actually program that on chip in the bonnet limb in the synthetics. The greater the torque that I apply on the device, the greater is the force of those virtual muscles. The greater is the muscle activation, and then we tell the motor to output more current. So even though the limbs are obviously synthetic, they move somewhat like a natural limb. That's the goal, that it doesn't really matter that they're synthetic because they move like flesh and bone. This is a really compelling strategy. One reason is one gets emergent behaviors. We didn't study running at this time. We studied walking, but it turns out those reflexes are really effective in running and well. This is a US soldier lost a limb, and this video is taken shortly after he was fitted with a prosthesis. Those same reflexive capabilities gave him that functionality. So you get this emergent rich behavior when you carefully look at the biophysics and design the mechanism based on that science. So what about a neural signal? What would we do if we could have information from muscles and nerves and maybe even the brain? How would we use it? Well, what we're exploring is taking the same control, reflexive control framework and using the neural signal to affect the sensitivity of the model reflexes. So how this might work is I am amputated here. My biological leg comes to here. If I relax my remaining calf musclature, the sensitivity is very, very low. I don't get power from my bionic limb, but if I really fire my muscles, I get a lot of power and energy, and I can really get a lot of energy if I run. Predominantly in the field, that neural signal from the peripheral is gotten using a surface electrode, which has many, many issues. The most obvious is if I were to leave this stage and if I were to run for 30 minutes or so a few miles and come back here, I could fill an entire glass with sweat. So it's hard to imagine a surface electrode working in that environment. So we want to go inside the body. We want to develop, as a field, we want to develop implants that get these signals. So there's a compelling biological phenomena. If you take a muscle shown here as M, a muscle that needs a nerve, a denervated muscle, and you put a nerve next to that muscle that's transected, that's been cut, time and time again the nerve will grow again, regenerate, and innervate that muscle. It's a very robust phenomena.  So we want to exploit that capability. So here's a set of experiments where a nerve is cut and we took skin and muscle cells, put it next to the transected nerve. The nerve grows, does accrued segregation, and innervates the skin and muscle end organs. The idea here is that the muscle amplifies the nerve signal. We can get motor information from the muscle side, and in principle potentially stimulate the cutaneous side, take measurements on the bionic limb, stimulate, and hopefully in the future give a person with limb amputation this sense of contact or touch.  So you have a proximal transected nerve. On the other end of the array we put those tissues, skin cells, muscle cells. What we want is the nerve to grow through the array attached to the end organs. Within each channel we can put electrodes that sense motor information coming down from the spinal cord. Adjacent channels might be sensory, where we can stimulate and reflect sensory information on the external device into the nervous system, closing the loop between the human machine. This just shows a section of the array showing that we in fact can produce growth through these channels, and re-intervention of a target end organ on the other side. How do we plan to get information in and out of the body? Is it going to be wired? Is it going to be wireless? I think a wired approach is very, very compelling for a number of reasons. One is the enormous ease with which one can get data in and out of the human body. This is an approach that's been long pursued in the field called osteointegration. The idea here is to take a synthetic implant, say like titanium, and insert it into the residual skeleton. One advantage of that is you can do mechanical loading directly into the skeleton and not use what I'm using here today, an external socket, to exert those forces on the residual end. Working with a collaborator Mark Picken, we believe we've solved the infection problem. Where the titanium has an optimal geometry, where the skin cells would adhere to that titanium surface. Also compelling about this approach, you can make that titanium shaft hollow and run wires through it. You can run wires from muscles inside the body out to the bionic limb, and from the bionic limb through the conduit into the body for that bi-directional communication. Here's a kitty cat that is missing a hind limb and using this skeletal conduit. A lot of pets lose limbs, so what I'm saying will not only benefit humans in the long term, but also cats and dogs. Now I'm going to transition from prosthetics to orthotics and exoskeletons, so what is that? An exoskeleton is a robot that wraps around a limb. That limb can be a limb of normal physiology, or it can be a limb with some pathology. I'd love this photo. I found this on the internet. To me it says, okay, we've invested so many dollars in society to make wheeled vehicles better and better and better. Carves, wheelchairs, segues and whatnot. My hope is in this century we invest more dollars to make our own bodies, our own morphologies, more efficient, stronger. So there's different types of exoskeletons. One is in series with the leg. It lengthens the leg. This is the power skip. It was developed by some inventors here in Europe. Clearly, if you're crazy enough, it augments jumping. If you take that person and measure their amount of food energy to go from point H to point B, wearing these devices, it'll be higher than if the devices were not worn. So as a transportation device, it's a problem. Also, it's difficult for me to imagine anyway, strapping these on and running across a very rough terrain, a rocky path with logs and without tripping, because the foot-ankle, foot-ground interaction has been disrupted. One can have a series device lengthening the leg that does not disrupt stability. Often, the amount of energy storage and actuation is limited. This is a shoe that I developed years ago, and after about a decade of research, we only got a few percent decrease in metabolic rate. The exciting stuff happens when the exoskeleton runs in parallel with the leg. This is my favorite patent I've ever found. It was at the U.S. Patent Office and came across this. The inventor is Yagin. You see the date 1890. So Yagin had this vision of these exoskeletal body suits, and his goal was to augment the Russian army. He actually worked before communism under Zoroastrian. What you see here are highly compliant leaf springs running up the legs, and then underneath the forum there is a clutch, and Yagin envisioned that as a person would run and enter in the aerial phase of running, they would unlock the clutch, which disengages the spring so a person could retract their legs or flex their legs for foot clearance. To my knowledge, this was never built, you know, microprocessors and sensors and whatnot did not exist in 1890. This mission of to build an exoskeleton, then augment something as common as human walking and running is over 100 years old. Recently, at my lab at MIT, the Center for Extreme Bionics, we actually succeeded in this goal. This is a foot ankle exoskeleton. This, the human wear has no limb pathology whatsoever, a completely normal physiology. But nonetheless, these exoskeletal structures augmenting the extension of the ankle, power plant reflection, injecting lots of mechanical power into the gate, reduce the amount of food energy to walk by about 10%. The augmentation is so profound that when a person wears this device, after only 20 minutes of walking around, when they take it off, their own normal limbs feel heavy and awkward. So these future exoskeletons, we want to be like the bicycle. They have an augmentative effect, but the human inside does not degrade. This is just a graph showing how the device works and some data. The device inputs a lot of mechanical power, similar to a normal biological ankle. So when you inject that mechanical energy into the gate, there's a reduction in metabolic cost. How do we control this thing? Again, I imagine virtual muscles and tendons controlled reflexively. But here, because it's an exoskeleton, there's already a biological limb there. So you can imagine putting virtual muscles on the outside of the body, but they behave and are controlled similar to physical muscles. For this foot ankle device, we're looking at the soleus, attaching a virtual soleus in the external body so that the actual soleus of the human can turn off in an output less energy. We're also looking into running. Again, this person does not have a disability. The goal here is to reduce stress throughout the muscle skeletal system. Hopefully in the future, people wear these devices as a preventative measure to reduce the chance of getting a knee injury, for example, or if one has a knee injury to continue one's athletic career by having an exoskeleton that reduces the loads. I believe in a decade or two when we walk down the street, we'll routinely see people wearing machines, exoskeletons. How does all this current technology and the technology that's coming down the pike, how will affect human identity? How a person sees their own body and that body may be unusual with limb amputation or paralysis or whatnot? And how society views person's unusual bodies. So this is an image taken of me shortly after my limbs are amputated in 1982. What do you see here? Do you see a crippled? Do you see weakness? Or do you see extraordinarily exciting potential? I asked my rehab doctor a few weeks after my limbs are amputated. What would I be able to do with my new body? And I told him I want to be able to ride my bicycle. I want to be able to drive my car. I want to be able to return to my chosen sport of mountain climbing. And he quickly said you'll be able to drive a car but you'll need hand controls. And he said but you will not be able to ride a bicycle nor return to climbing mountains. He was wrong from my perspective today because he viewed my body as broken. And he viewed technology, current technology is forever stagnant, will never be upgraded, will never change. I was very upset obviously when he said I wouldn't be able to do all these things I wanted to do. But quickly I realized that the artificial part of my body was represented potential. It could be anything that I could imagine or the scientific world could imagine. Perhaps one day they may be so sophisticated these bionic limbs that I'll be able to run and run faster than persons with biological limbs. Perhaps the limbs one day will not only have a human-like structure or shape, maybe they'll have wings and I'll be able to fly. So as a young man I had all these dreams and began imagining beyond limitation maybe technology will become so advanced that we can eliminate disability across many forms of brain and body condition. So because of inadequate technology today disability is just commonplace. The basic science of technology that will enable the elimination of disability will also enable, I predict, human augmentation. The ability to use technology to extend beyond innate capabilities. Bionics indeed has tremendous potential for society but not without risk. As a society in my view we need to put forth public policy at a rate commensurate with this ever-expanding augmentation technology to further incentivize bionics that improve quality of life but also to mitigate unattended nefarious uses of augmentation technology. We the people have in our creative power the authority to end disability in this century and simultaneously adhere with absolute obedience to the principles of human diversity and individual freedoms. So I'll put a period there and I'd love to begin a conversation.


Let me introduce Robert Higgs. I'm so glad you were able to come and be with us here today. Be our black swan in our series of interviews as you described yourself. Let me ask you a big question that I didn't even prepare you for.  I suppose it's my book Crisis in Leviathan. And I say that not so much because of my own opinion of it as because of the reaction it's received over the years. It's now 24 years old and when most people think about me or hear about me if they know anything at all, that's what they know about and so I think the public has spoken. That's what they think I've contributed. Well, as a matter of fact, don't you think your thesis to some extent has entered into popular discourse even detached from your name to some extent? Well, to some extent I suppose it has. What I find a little amusing about that is that the notion of a ratchet effect, for example, was not something I discovered. Economists had been playing with ratchet effects for a while, but most of the work that was done before my book was narrower in scope. Before we talk about spending ratchets, for example, Peacock and Wiseman wrote a whole book about spending ratchets in British economic history and showed that both world wars had created such effects. So I didn't invent ratchets, but I think what I did was to expand them to show that it's not just spending. Indeed, it's not simply fiscal variables, it's not just spending, taxing, borrowing. More importantly, it's institutional ratchets, legal ratchets, and most important of all, it's ideological ratchets associated with the great national emergency episodes of US history. To my knowledge, I was the first one who had fleshed out the ratchet effect in that way. I still think a lot of people don't understand what I did, particularly economists, because they like to seize on something narrow and quantitative, so they can associate the ratchet with fiscal ratchets, particularly. And also in small slices of time, one of the things that's nice about your book is you integrate things that people usually consider an isolation, for example, the war preparations for World War I and the conduct of the war, the wartime economic planning, and the new deal. Yes. Two totally separate areas, separate things, presumably usually. Crisis in Leviathan is, for the most part, an act of synthesis. That relationship you just mentioned about World War I and the new deal was written about in a great essay by William Luckenberg, who's a left liberal historian of note, and I took the bulk of the evidence for that from Luckenberg. So I did not invent that either, and if I have any regrets about crisis in Leviathan, and I do have a few, one is that what I thought was really somewhat original and a real professional contribution, which was chapter three on how to think about ideology and relate it to political economy, probably has received less attention and less real understanding than any other part of the book. So to me, it's as if, well, yes, I talked about these other things, and some people may think that was an important contribution, but I can't claim any creativity or originality in those regards, and in the one place where I might make such a claim, nobody's paid any attention really.  You know, what Haslett thought he did was most important is the most ignored thing, and the thing he's most famous for is he thought it was his least significant contribution, so that's hardly unusual, I suppose. I remember when I sent you Nation State and Economy years ago, this was Musa's 1919 book on the SS chapter on war socialism. You had a letter that you returned, I think this is back for the days of email, and you said, I can't believe it. I mean, he seems to have anticipated everything. Well, you know, one lives long enough, he has that experience over and over and over. So many times, and in fact, maybe one of the worst times I had that experience was when I discovered John T. Flynn's book As We Go Marching, which I did not know about at all when I wrote my book, and of course, Flynn had talked about explicitly many of the things I talk about when I discuss World War II, and one simply wishes when he has those experiences that he had read more and that, you know, in my case, I'd taken Murray Rothbard's advice and gone out and read those other 500 books he recommended. Right, right, right. You know, on John T. Flynn, you make an interesting point. I think that book came out during the war. It did. Now, as a historian, and having read, you know, thousands of books, how do you balance out the value of things written like contemporary histories from observations of what's going on right now as compared with, you know, competent historians who write about the same thing decades later? Well, the contemporary accounts have something that can never be recaptured later. That is, the authors were personally engaged in the events or near the events or in the same world as it were as the events they're writing about. So there's a quality of being able to understand something about things like public opinion and difficult to measure variables that only a contemporary can appreciate fully. Later writers have to use their creativity and whatever evidence has survived to arrive at that same kind of sense of what was going on. On the other hand, it's invariably the case that with the passage of time we find out things that were not known at the time and we may also gain a way to understand them that was lacking for contemporaries. So the contemporaries are extremely valuable, obviously. We should always attend to them, particularly when they are the work of intelligent, perceptive, honest writers. But if we had to rely only on history as written by contemporaries as we went through time, we'd be in trouble. These later reconsiderations, revisions, fleshing out are essential for arriving at what you might loosely call a truer understanding of history. One of the things you notice in the midst of war, whether it's a minor war like, I don't know, you call that minor, but our war is on a rack or whatever kind of war is followed in 9-11, is that there's an element of hysteria, an element of sort of cultural hysteria that affects the writer and the way you write. It's difficult to describe, I would think, after it passes. In fact, it's almost difficult to remember. Do you know what I mean? Well, certainly many people who write about wars, especially in the beginning of wars, are caught up in the enthusiasm or high spirits or hysteria, as you say, of the time. Usually that wanes if the war goes on for a while and people take a more hard-headed, clear-eyed view of what is happening. But even then, some people are never able to put what's before their eyes in any kind of larger perspective. And again, that's why later accounts can achieve something that contemporary accounts can't. Well, one of the things that you find that most commonly rears its head during wartime is a kind of a crazed nationalism. And nationalism or that nationalist spirit is something that you have written about very extensively. You've come to some kind of understanding of what it amounts to. Probably you have a more sophisticated understanding than most people. What do you think nationalism consists of and why do you think it's dangerous? Well, I think it consists, in large part at least, of a kind of unspoken incorporation of membership in a national community into one's personal identity. So if you ask people, what do they say? The normal response, particularly if you're in a country, another country, when they say, you know, what are you, you normally would say, I'm an American. And someone else would say, I'm a Frenchman or I'm from Belgium or wherever the person comes from, the immediate way to identify oneself in the modern age is by what kind of national citizenship one holds. And it's a rare person who responds to the question, what are you by saying, I'm a painter or I'm an economist or I'm a citizen of the planet earth. So I think the harm, the danger that is associated with nationalism arises in part because it's a mindless, thoughtless association and yet one that has very powerful claim on people's loyalties. So that when some excitement breaks out, particularly some perceived danger to the nation state, people are inclined everywhere in the modern nation states for at least the past hundred years to rally around the flag, to immediately fall in line. Even people who were hostile to the government previously, one of the great examples of course is World War I when the great German socialist movement just collapsed and fell into line to go forth as cannon fodder. Of course they lived to regret that before long, but that's what they did. They had been talking for decades about how countries were irrelevant and how the workers of the world were all comrades and brothers and yet when war came, all of that talk was shown to be extremely shallow. It hadn't entered into their self-identification in a way that their national identity. You saw the same thing with the 19th century American anarchists, most of whom over throughout their anarchism to defend World War I and then, well, the most obvious example is American conservatives who in peacetime are all against the government. You've seen this many times, right? Well, conservatives in the United States are of course the most nationalistic people of all and many of them will condemn root and branch every department of the government except the Pentagon. When it comes to the Pentagon, it's as if this vast bureaucracy can do no wrong and every government employee and functionary is suspect in their view unless he's got a uniform of the armed forces on in which case he's not just not suspect, but he's viewed as a hero merely by virtue of wearing that costume and it's so blatant that it's ludicrous sometimes. I mean, it's persistent, isn't it? That was his background. Well, one hears lately, unfortunately, at sporting events, at baseball games, at football games, certain interludes of worship for the armed forces. I find it disgusting myself because I like baseball and I don't want my baseball to be spoiled by intrusions of nationalistic fervor and worship of the armed forces. To me, baseball is glorious for being a peaceful activity.  But isn't that the nature of Leviathan, that it tends to sort of penetrate every aspect of society and culture in ways that are unwelcome and leaves nothing untouched, whether it's religion or culture or sports or anything? Well, I think that is its nature and that's why it tends toward totalitarianism. At that point, of course, it has penetrated everything. There's nothing left, not personal identity, not family, not private groups, not any kind of intermediary organization that stands between the naked, solitary citizen and the Leviathan. You know, you are probably one of the most prolific classical liberals, libertarians in our time, maybe in the last century. You've written many books, I don't know how many, 10, 12, 15, something. You added a journal, you've written about so many topics. I think in some ways as powerful as your contribution is with regard to war and power, there's many other things that you've written about. What do you think is an area that you've written about that you don't want to be forgotten about that you wish would be more attention paid to? I would hope that the topic I lectured about this morning, the Food and Drug Administration, might someday arouse many more people because it's an irony of this matter that even though this organization's activities cause incalculable suffering and excess death, premature death, almost everybody in American society gives it the highest marks. They may condemn the IRS, they may condemn any particular government agency you can name for them, but almost no one will condemn the FDA. In previous surveys it's been demonstrated that more than 90% of the people give high marks to the FDA. What that tells us is that they have no real information, no real understanding whatsoever of the agency, what it does and what effects it produces. This is very disturbing. It's as if people can live in a situation in which they are constantly menaced and many of them are literally killed by a government agency and yet at the same time applauded. It's like something from the last page of 1984 where Winston Smith loves Big Brother as it's boot is grinding his face. So I would very much hope that if not my writings, then other people's writings that others have written on the same vein for a long time and that again is a startling disjunction. The people who've seriously studied the FDA, certainly all the economists who've studied it, have almost all come to the same or very similar conclusions about its net harmfulness. And yet these studies, these conclusions, this understanding have not penetrated the general public. And partially for that reason there doesn't seem to be anything holding back its expansion, right? It's very ill constrained. It tends normally to push out the envelope and then whenever there's a crisis generated by the media, often out of a very small germ, it makes major gains in the scope of its authority. So it too has grown in a ratchet like manner and all the great public health tragedies that we can think of like the Thalidomide Affair give rise to new legislation widening the scope of the FDA's powers. There's no exception. Every big crisis of that sort has that effect. So it's as if nothing can make it turn around. The only defeats, if that's the right word, of recent times have to do with the FDA's constant attempt to take over supplements, dietary supplements. And it's been trying for decades basically to abolish them, really, to drive them out of the market and make them unavailable to people. And when it can't get that, it tries something somewhat less but getting rid of some of them. And it's at work right now on that same quest. When it made its most spectacular attempt to do that in the mid-90s, millions, literally millions of people took offense and were mobilized to make calls and to send letters opposing the congressional action and the agency action and they succeeded. It's really the only event I know of comparable to it in the arousal of millions of people opposing a policy proposal. In a way, it's kind of pathetic and tragic, isn't it, that people have to become so politicized and involved politically in order to stop violations on their liberty. And yet, would you say that public opinion and public activism is one of the most important sort of checks on the state, one of the most effective checks on the expansion of Leviathan? It certainly can be a check and at times it is. I wish it were more often a check, but again, it's difficult to mobilize. Large numbers of people and members of Congress in particular don't respond well to ordinary people unless they come forth in an organized, mass way. Otherwise, they're constantly beholden to special interest groups and its politics as usual. Right. And so many of the special interest groups, all the lobbying pressure, really consists of one or the other side of the same thing, expand the government this way versus expand the government that way. Right. Whereas a true anti-government movement that's really grassroots is really a rare thing to see, isn't it? Well, it is very rare and part of the reason is not simply it's difficult to mobilize people, but in this country, there really aren't that many people who have a general opposition attitude toward the government. People take offense at particular government actions or particular policies enough to rouse themselves and to get involved in political action from time to time. But overall, unless there's some crisis like the current one in the economy that disturbs many, many people, in general, people would just say, well, that's like the weather. The politics goes on, government goes on. I may not like what they do, but I can't do anything about it. They don't get involved because they go on living their ordinary private lives where at least some of their actions can have expected effects. Whereas getting involved in politics is normally a matter of just throwing away their time and money and effort. Now those of us who have watched your work over the course of a long period of time have noticed a certain tendency in your own thought to become ever more radical. Would you agree with that? Yes. No doubt. I mean, we're about to republish a book that you had written on the Gilded Age, which is so good. But you mentioned to me that when you wrote that, you were fresh out of graduate school, newly minted PhD and accepted most of the mainstream ideas about collections of data, about your methodological concerns, about engaging in a kind of conventional conversation. Yet, the book has a very strong sort of impulse towards free markets and free enterprise. What way would you say that is the most substantial way you've changed from those days to now? The most important is my understanding of the nature of government. In the beginning of my professional career, I never questioned the desirability of having a nation state and all the other layers of government were infected by in this country. It seemed to me that government was necessary to do the usual things mainstream people claim it is needed to do, to keep order, to define property rights, to protect people's rights to life, liberty and pursuit of happiness, blah, blah, blah. It was only over long periods of time that I first encountered people challenging that view of government. Many more years went by before I began to say, I think that's right, that ultimately I concluded that government is not necessary for anything. We can do everything we want done without the government. That doesn't mean it's going to go away or that I expect it to go away. Indeed, I don't. I wish I could say we're going to drive it away. We're going to crush it, but I don't believe that either. I think it would be good if we did, but I don't foresee at least in my lifetime certainly anybody and certainly not Americans crushing the state. I did eventually come to the point where I could say anarchism is the most desirable moral ideal. It's not going to create a perfect world, but it is. There are no perfect worlds if people are inhabiting them. Given that, the worst thing you could do is give some people all power. Yes. Indeed, in recent years one of the arguments I've offered is something known as the precautionary principle. It was cooked up by environmentalists to justify crazy restraints on freedom in order to allay very remote and unlikely risks. In that application, I'm completely opposed to it, but my application is that government is a dreadfully dangerous institution. It has the capacity, the demonstrated capacity to commit crimes on an enormous scale, including murders by the scores of thousands, by the millions. If we credit RJ Rommel's estimates, governments in the 20th century alone killed, I think by his latest estimate, 262 million of their own citizens. This doesn't count all the people who perished in their wars, but this is simply the number of people who perished as a result of their own government's actions and very often their own government's deliberate actions taken in order to kill them. If you say we need government to keep order or protect life, I think you bear a very heavy burden of proof. It seems extraordinarily unlikely to me, unlikely to the vanishing point, that without states, any mayhem on that scale could possibly have been carried out. I think there are some crimes so vast that only the nation state, with its organization and resources, is capable of committing those crimes. So in my mind, every time you resort to state action to achieve some objective, you're choosing to take a terrible, terrible risk. If there is any kind of private alternative whatsoever, then it ought to be the default position that we use it. And only if it shows itself to be utterly incapable of achieving the desired objective should we even begin to think about the alternative of resorting to the state. Beautiful statement, Dr. Higgs. Thank you so much for all of your past work and we look forward to all your future work and for being with us here today. Thank you, Jeff.


Just need to make sure that my blinking lights actually do work. Is that on? That's on. That's on. That's on. Power, power, up. All the pins are there. Let me try this again. Up. Oh, that's a good idea to go and switch to the network and then go and random. Yeah. Okay, there we go. Bloody Mac. Okay, so what I want, the best of my wives decided we want to move. So I said, okay, in the new place, we're going to have all LED lights. And then I asked myself, like say, white lights boring. So can I go and make it a little bit more exciting? And so I started looking around and then there's this this wonderful stuff from that's called Ambient Computing. Can I use the LEDs to signal things that are relevant without staring at a computer screen? Is there a possibility? So and I went out and looked around and said, okay, where do I get the lights? So I went to Adafruit. That's a US company which I greatly admire. They have all the geek stuff. This is like candy store for geeks. I used a bought an Adafruit feather, which is an Arduino compatible board. It's sitting here. If you want to have a look, the nice thing is that 256k of memory so you can really play around a little bit. And then I use working for IBM. I use Node Red as my control center. And then ask myself, what are patterns that make sense? Because most of the ones that I found are actually annoying. And then when you start looking around and so you have color, you have the frequency, how a blink, you have the sequence, what is happening? When you have the direction, you go left, you go right. And so I played around a lot with that, screwed up, I think, two or three of the Arduino's in the process. And there I came up and said, okay, some of the experiments I found. So this is not about code. You can look at other code. It's horrible. It's all on GitHub. I'll show you the URL later. It's about the little lights. So instead of going to the slides, you should supposed to go down. Okay. So the first one is random color, random leds. Instead of going to the slides, I'm simply going to my little Node Red command center where I have, if I could read without glasses, I have the ten samples. So the first one was, okay, just give me some random lights. And you see it's blinking nicely. And that's just like I said, it takes you probably, well, two minutes before it gets really annoying. And I said, okay, let's do something more useful. The next pattern I want to show is like, say, what I call sunrise. The funny thing is, I start looking around and there's not real good information around what is the color sequence, sunrise. You find a lot of analysis. People take pictures of sunrise and derive a color palette out of it. But that's a static one shot image, but not a sequence. So I played around a little bit. The sequence now runs very fast. But just imagine that sequence running over a duration, the whole sequence, 15 minutes.  Like say, bird sweeping and then like say, Stefan wake up.  So second one, sunrise. So it starts off a little bit. So it gets blue. The dawn kicks in and it's a little brighter. Then the sunlight comes up and finally it gets really, really bright.  One of the things I realized, the strip I used, it's not the latest one. It has trouble with yellow. So you saw it just now, it went a little bit greenish in between, which from the color code is actually yellow, but that one isn't too color accurate. That's also a lesson I learned. So the latest generation neopixel, you can actually just punch in RGB values and it comes back. And this one, it only has 127. So it's a seven bit color value, which is kind of, I played a lot of things. I had to fight quite a bit to get the colors halfway right. So that's the one. The next one is, of course, you have something coming up. Take your meds. That's important for the geeks. Otherwise, AHD kicks in. I want to be reminded about something. And what you see, I'm just using a little button, but the Node-RED actually allows you to take input from all sorts of sensors, time database and all that. So if I want to be reminded of something, I just send out an exclamation mark and then I go and blink the two exclamation marks a little bit. You get ready, you get ready. You really need to have to go. I realized that the exclamation marks for a horizontal one doesn't work that well. So that would be a case where I would go and try to have a stripe that's actually vertical. So that seems to work better. The question is with the color. So I put both. Is it red on this? Yeah. Red and green both in there. And I said, is it more an alert type? Like I said, really you have to do this or more like a joyful reminder? Call your wife. Tell her you love her or something like that. Then the other one is the next one is like say, if you're a new programmer, you listen to heavy metal while you're code, so you don't hear the phone. So you want to have a visual reminder. And there I felt like say, can I go and we had the physical phone when it ring was vibrating a little bit. So I tried to create a pattern that kind of resembles the vibration and probably make this a little faster. So it goes back and forth. So that gives you a visual pattern you can learn. It's not really, really obvious. It needs to be explained, which is bad because you eyes and jokes that need to be explained are bad. But I realized when you're limited to one dimensional information matrix, there's a few things you really, really want to go and start getting used to. So we also know that like say, like and no like. That's also something you need to learn. Nobody using Tinder? How do you think I met you? Chase. Okay. The next one, like say you still have your heavy metal on the head is like say, the door rings. Usually it's either the pizza guy or an unexpected visitor like, oh money, pay money. So they said, okay, it starts with a little blinking to get your alert and then say, please go to the door. After the door. It's blinks a little bit and then I said, okay, I got your attention now. What do I need to do? After the door. So you get a bit of it becomes a little bit more playful at the thing. Then of course the next thing is like say, if you're an outdoor person like me, this is always when I misbehave. I have to sleep outdoors. You want to know what the weather is like. And so a good use case were to go and said, okay, you use approximation sensor. You get close to the door to go out and then you start the weather pattern. And I say, in this case, I say bad weather. So it's all raining and splitting and all that.  Okay, take the umbrella or take the shower gel depending on what you want to do. And then of course, and this one I'm not so happy with, but you see I'm just trying to get it going. And I said, how to signal good weather? And I said, okay, it's all joyful. It's sunshine and it's greenery and all that. So, so entice you to enjoy the colors of the outside world. I would go at that as the edge of annoying. But it was like, say, just an attempt. Can I go and signal? Oh, this is nice. Get out. The next one, a little bit more technical. What happens if you want to check your stock portfolio? So get rich quick scheme. And then the idea was you start, okay, the blue point is my buying green was this is what I bought. Now the stock goes up. This is all the profit I made.  Whoop, my stock goes down. So you could go and said, I start with a reference point. Let me do this again. This is my buying price. This is what it is right now. This is what it was yesterday. So I lost a little money. Stock price jumps. It goes, and then it tanks. So you without, without looking at some boring tables or graphs or all that, you straight away, am I, am I going to go to McDonald's or to the fine dining restaurant that day? Which is kind of funny because like say a stock you haven't sold is actually not money that you earned or lost. The next thing is like say something really, really bad happened. So you needed alert notification. And then that's for all our friends who were in the military service that should recognize that. Short, short, short, long, long, long, short, short, short. And there what I played around with like say short can be duration, short can be size. And in this pattern, I actually use both of them. And then last and at least I say you all watched it. Battlestar Galactica. The silence are coming. So what I, one of the things I learned is like say getting the colors right is really, really hard. Getting the patterns right is a question of taste. So one of the things what I, what I'm planning to do is like say test run that with a few people, whether there's cultural differences. I haven't figured it out. So one of the things, for instance, red color is commonly seen as a warning color, unless in Chinese color, in Chinese culture it's good luck. So if I, would I put the gains I make in the stock market in red if I have a Chinese investor? So that's the question I asked. And the next thing what I was looking at is like say I found the two dimension quite limiting. So what happens if I like say take four or five stripes and put them next to each other? So I could have two or three dimensions where I can actually play with, where you can then pulse rate, heart rate monitor or like all this stuff. So that's in a nutshell what I experienced playing with all these light patterns. The next step what I need to do, convince the wife that we can have all the LED stripes and not just the white ones in the house. But I'm getting there. Quick one to technology what I used. I say let's go back to the presentation. So any questions? So it's running under the Arduino, running as a web server? Yeah, that's the feather, the Arduino feather that's actually this one. Is a little Arduino 256K RAM, so it's quite generous with a web server built in. So once I'm done and remove all the mess on the cable, it sits in a little box, gets powered by the main power that also powers the LED stripe and takes its command to the web server. Technically, let me just show you that. I say let's node red, let me switch this on and this one off, deploy this. So when I send a command, for instance, I say let's do the sunrise again. It simply goes and sends a get to the web server's URL using, okay, that was actually the wrong, the wrong, let me wire this here. Let's say let's use the visitor pattern again and oops, okay, no, stupid, still there. And, oh yeah, that was not message payload, message URL, done, deploy. And then when I click on any of them, you see here the pattern that's my web server configured. I'm connected to the link, it has its own little access point, so you can configure it as an access point, you can configure it as a web server. And then it said I just go, V is visitor and then I say incoming call was I for incoming call or alert notification, I simply had an end. So it was a very, very simple, straightforward exercise. I used node red as my little command center instead of using curl because there you can have all sorts of funding inputs like the analog devices, IOT or so, to then go and command the strip. Final one, so that was the feather and I used, that's a NeoPixel, this is what I'm really going to deploy, that's one generation ahead of that. This is 32 LEDs per meter, the NeoPixel has 60 LEDs per meter, so you have a higher signal density and the best thing is proper RGB colors. And then the node red came out of IBM research, is now part of the JavaScript foundation, that's the graphical environment and I'm currently running it on the Mac, but like I say in the home setup it's running on a Raspberry, so that's straightforward. Okay, if you want to see the crappy code, the slide, all the code is in my GitHub repository. The presentation is there as well, I'm using Reveal.js for the presentation, so no proprietary software has been halved in creation of this. What do you think is the maximum incidence of inequality? Okay, so there's two aspects to it, one is signal and the second one is power and if you have a 4 meter stripe with 60 LEDs per meter you need about 10 amps to power that. And you need to have multiple power points along the stripe, which is okay because it has separate power wires. And then with the Arduino library, like I say, Adafruit set, you should be able to, with a single controller, control about 4 meters and you want to have multiple of them if you have more of them like that. Okay, any more questions? What about Raspberry Pi? Raspberry Pi runs Linux based operating system, so you will have timing issues. So you can do it if you use the image channel, but I just wouldn't do that. So typically when you look at all the guys who do the LED experiments, they all go down to Arduino and eventually use the Raspberry Pi just as a control center. So I would, in my setup, I run the Node-RED on a Raspberry Pi and then just talk to this device who sits somewhere away using Wi-Fi. Okay, in this case it was, it's actually a little older library, that's the 8806 library, that's the driver for that one. Fast light. I found, it took me a while to figure out, I have different stripes at home and they all use different libraries. And I tested with the NeoPixel strip, I tested the Adafruit library they provide and that worked reasonably well. One of the funny things, took me half a day to figure out, there's a little capacitor that is over the power supply, just 100 mu. And I didn't have that in, and I say, my pattern went for a while and then it just stopped.  So try, try, try, and then I posted in the Adafruit forum, they immediately came back, you need to have a step up controller and all that. And pointed me to power could be the issue. And then I said, okay, in the NeoPixel Uber Guide, they put a capacitor over there, put it in, bang, problem solved. Yeah, so resistance wasn't the issue, it was noisy power supply. So that was, like, I bought that power supply at Simlim Tower and it was cheap, cheap. You can do that, of course, that was the idea of, like, say, making the controller accessible to Wi-Fi. Whatever application you use to then signal it to it, that's up to you. So you could very easily build a, like I said, even a mobile web page which then simply does a HX call to the controller and to activate the light. Okay, any more? Thank you so much.