All right, good afternoon everyone. So my name is Jorge Arce. I am a Blockchain and Cryptography Researcher at NetherMind. And today I want to tell you guys about Shamir's secret sharing with no ID numbers. But before we get into the problem we're trying to solve, we would like to have a bit of a review on what Shamir's secret sharing is all about. So for today, because this is a lightning talk, we're going to go with a simple example. So let's suppose you just got this great news. You just got the private key of a wallet that is holding a thousand ether. Here's the private key. Now do not actually input this into MetaMask or you will be very disappointed, okay? For secure long term storage of this seed phrase, you want to do the following because it's a lot of money, right? So you're gonna split the key into several 12 word seed phrases such that if you have two of those seed phrases then you have enough information for reconstruction. Furthermore, you want the secret to be accessible even if one of the pieces in which you like split the information gets lost. And there's a third property actually that I'm mentioning which is you would like it so that an attacker that has two of the pieces, no I'm sorry, if an attacker has one of the pieces but not two they cannot gain any information about your secret whatsoever. So you decide that you will create three pieces such that you need two of them to reconstruct the secret and technically we call this a two-three threshold scheme. This is what you're after. Okay, so how does this go? This is an old algorithm created by Shamir in 1979. We start with the seed phrase and the first thing we're gonna do is we're gonna turn this into a number. This is in binary. What we did is we took bit 39's 2048 word dictionary and we depending on the position of these words in that dictionary we assign a binary number to each of the words. Once you have that you're gonna take a good old XY plane and you're gonna take the secret. This is a number after all and you're gonna place it on the y-axis sort of like as an intercept. So that's stage one. After that you're gonna take a random straight line that passes through the secret. Why a straight line? Because this is the simplest example where you only need two pieces for reconstruction. If you wanted something more complex you would be using like a parabola or a higher order polynomial. But let's just stick with the straight line for now. So you have that straight line which you chose essentially at random and you're gonna pick three points on the line and those points are gonna be your shares. Now what happens is lines have this very nice geometric property that says that any two points on a line are enough to uniquely determine the properties of your straight line and in this context that translates to any two shares generate the correct secret. Just check it out. If I have those two points shares one and three let's assume that sure two got lost. You generate a straight line just as before and lo and behold the intersection with the y-axis is the secret that you were trying to conceal. And this is gonna be the same regardless of which two shares you have. It's independent of that right. You have share two and share three. You do the exact same thing. You get the same secret every time. So we got that nice redundancy property we're after. In this example and this is kind of unwieldy and a little bit hard to read, the shares are the following. The first one this is the binary that you get if you were to actually like get the coordinates of those points on the y-axis. Here's for the second point and here's for the third point. Notice that I am also labeling each of the shares with the corresponding x-values one two and three. Those are gonna be called the ID numbers. Now we don't like this. It's hard to read. So we're gonna use the bit 39 dictionary once more to turn this into words. Like so. And now that's more familiar. All right. So this is what Shamiro secret sharing is all about. But I want you to notice a special detail here, which is that, sorry my bad. I am keeping the ID numbers next to the shares. They must be labeled and this is crucial. If I were not to do that, like what would happen if I mis-wrote one of the ID numbers and I mis-labeled one of the many shares that I have. So if you come and check this example, let's say I have the second share and I make a mistake and I label it with a one instead of a two. Notice how the geometry of the situation is gonna change. Now this point is gonna be moved, slide it to the left. When you go ahead and try and do the reconstruction, oops, you're not gonna get the same straight line. You're gonna get something different. You get the wrong secret and that's a problem. This may not sound like a big deal, but keep in mind that you may be dealing with many shares at a time. You may be dealing with 12 points at a time. If the labels get lost, it can be a bit of a nuisance, like solving for all the possible permutations and trying to find which one is the correct one. So can we improve this? We are trying to circumvent the label in entirely. Can we encode the ID numbers in the seed phrase itself without having the need to add any extra words to the seed phrase? This would be nice because then I could just mix those seed phrases and no information would be lost, even if the label was incorrect. As it turns out, there's a peculiarity about bit 39 seed phrase standard that we can exploit to our advantage here. It turns out that not all the bits corresponding to the seed phrase carry independent information. There's a checksum hidden in here. In the particular case of 12 words, which is what we're dealing with, it turns out that the last four bits are not independent information. Like you took the seed phrase from the initial example, the one with 1,000 ether, you turned it into binary. And these four numbers, they do not carry independent information. What they do carry is a checksum.  The first four bits of that hash are what you put in here. And this is there so that if you miswrite one of your words, then a wallet software can tell you that you messed up. We can use this to our advantage here, because given that that is not independent information, there is no need to include the checksum bits for shared generation or reconstruction. Let us go with this slightly different approach. We have this beautiful seed phrase once again. This is the binary encoding of it. And let's just discard this. We can do that without fear because this information can be regenerated whenever we want. Now you're going to do Shamir's secret sharing, the same like straight line, put the secret on the y-axis, choose a random line passing through it, on the non-check sum bits, so that the ones that actually carry information. And this time, once you do that, let's say that we get these shares. Once again, this is hard to read. We don't like this format. But before we can turn it into words, using the dictionary, we're going to need to fill in these gaps. Now here's the nice thing. These gaps are places where we can store extra information. For example, I could take these ID numbers and encode them into binary. And those will be the last four bits of each of my shares. That I can put in there. Now I turned this into a seed phrase once again, like all of those into seed phrases. And you would get these three shares. Notice that they do not have any labels anymore. You don't really need to. Because if you take the last word in each of those and you turn it into binary with the dictionary, for example, popular, this one ends in 001, meaning that this should be the first share. This one ends in 001.10, the encoding of chaos, meaning that this has to be the second entry. And likewise for this one. So this is a nifty little trick that you can use if you want to get rid of the labeling. There's other things you can do with that extra space for information. You could add a checksum to the shares themselves. That's something you could do. But we're choosing to do this because it seems like a convenient extra feature that we can add to Schumer's secret sharing. All right. So thank you very much for your attention. Right here. And here's some advertising on behalf of Netermind. You can enter our repo, I mean our GitHub Netermind ETH, and you'll find this repo research mnemonic. So this is a tool that we built with extra love to all the Ethereum community. If you guys want to use Schumer's secret sharing for your privacy purposes, for your 1000 ETH error drops or whatnot, I don't know if you guys are lucky, then you can use this tool. And yeah. So thank you so much. I am Jorge Arce, blockchain and cryptographer researcher at Netermind. If you have any questions or comments, I'm more than happy to take those. Thanks. Hi. Is it possible that when converting to shares, it no longer fits into 12 words and has to be like 13 words or something? That's a good question. So what can happen is we have four bits of wiggle room, right? That means that we can label as many as 16 shares. If you wanted to go above that, we would need extra bits. And you would need an extra word. So we don't really like that. That seems not very elegant. So what we do is we limit the functionality of this feature to, if you're dealing with 12 word seed phrases to 16 shares maximum, which in practice is a sensible restriction. We've seen that, like important multisakes all over the Ethereum community, they normally don't go over like 11 shares or whatnot. But if you were to use like a 24 seed phrase, for example, then you have more bits that you can use. I think you have like seven or eight bits for the encoding. And then you have like 256 shares that you can use. But yeah, that's a good question. And there's a limit on how many of these you can label, but the limit is sensible considering like the real world use cases. Thank you for the question.


So, I would like to welcome everyone very warmly and thank you for joining us today in a very busy day as we celebrate and commemorate International Women's Day. I am Jennifer G. I'm the gender team leader from the Fisheries Division, and today I will be guiding us through this webinar. I would like to note for all of you that this event will be recorded and available later for viewing.  And we ask you to please use the chat box feature with any questions or points you'd like to raise, so we're able to come back to you after the webinar, since our time is too short today to take live questions. Dear participants, panelists and colleagues, I have the really great honor of introducing the FAO Deputy Director General Maria Elena Cimedo for the opening and welcoming remarks. Maria Cimedo, the microphone is yours. Thank you. Thank you, Jennifer, and esteemed panelists, colleagues, ladies and gentlemen, dear sisters. It is my pleasure to welcome you all to this webinar on this International Women's Day, and especially to celebrate women in leadership in the fisheries and aquaculture sector. To me, particularly today's event has special significance, and I go back in 1991, when I started in Cabo Verde as Minister of Agriculture and Fisheries, and later on Minister for Fisheries, Agriculture and Rural Affairs, and I stayed 10 years taking care of fisheries. And I also want to share with you that I was the first women minister in my country. And during this period, I have always observed with admiration how women take on their shoulders, waiting long hours at the beaches for the fishing boats to arrive. They collect fish, clean process and sell, adding up to all other chores they had already performed at home. And women's first goal of achieving food self-sufficiency and improving the living conditions of their families and communities have always been a wonder for me. And I know firsthand that women in fisheries and aquaculture face gender-based constraints, not only in assessing resources, services, technologies, training, education, financial assets, credits and institution, but also in contributing to decision-making processes and attaining leadership position. Women make up 50% of the workforce in fisheries and aquaculture, especially in small-scale operations. Yet, they remain largely invisible in the industry, and their work is often unrecognized and always underestimated. And because of the informality of their status, women also have less access to social protection programs, making them even more vulnerable. We need to increase our efforts to make women and girls' contribution to fisheries and aquaculture more visible and valued. It is crucial to work together to remove gender-based barriers that limit women's empowerment and their capacity to reach their full potential. And this is fundamental for fisheries and aquaculture to be sustainable, as was recognized in the recently adopted coffee declaration on sustainable fisheries and aquaculture. A recent study of top-level seafood management published by the International Organization for Women in Seafood Industry, who are here today with us, reveals that only 40% of top positions are held by women. And when we go to the CU level, only 4% are women. This is unacceptable. This must change. The academics, professional and activists advocating for an increased recognition of women's rights in fisheries are, for the most part, women. We need men to step up and be allies with women and girls. Indeed, this message was carried in the Year of May Allyship campaign, launched by the United Nations, a he-for-she movement. An ally can be someone who amplifies women's voice, who educates themselves about different identities and experiences, someone who challenges the status quo, and someone who takes action. Bringing women to the negotiation and decision-making process is a non-negotiable element to be considered in fisheries and aquaculture. Fisheries and aquaculture development and management at local, national, or regional level. It is only by bringing everyone to the table and valuing women's experience, perspectives, and skills that women will be able to make game-changing contributions to decisions, policies, and laws. Today's impressive panelists bring a diverse range of roles, but are united by a common thread in holding rare position of leadership throughout the seafood sector. Indeed, COVID-19 response and recovery efforts clearly demonstrates the unique capacities, knowledge, and networks of women in leadership. Through the sharing of experience, we'll hear strong examples of concrete and engaged action that can abolish the deeply anchor gender norms and highlight the significant role of women leaders in building a resilient, inclusive, and most important, equitable society. And this is the right thing to do. Again, I would like to thank everyone for your participation and engagement. Let's be together. Let's be united to build an equitable society. Only with an equitable society, we can change the world. I wish you a very fruitful discussions and a happy International Women's Day. Thank you. Thank you, Ms. Samedo, for opening this webinar. It's a rare privilege to have one of the first female ministers sharing her perspectives with us. I opened this webinar for International Women's Day with a reminder that the work for Women's Day should be an everyday occurrence of action towards gender equality and dismantling the patriarchy. We are bringing you four panelists who are leaders in the seafood sectors and have a format where we invite them to speak and share their reflections. This webinar is designed to not only create space and amplify their voices, but also to forge strong partnerships and alliances in order to build future work. We aim to develop concrete actions with our partners and stakeholders, many of whom have already been active for decades in the fight for gender equality. We invite you to follow their discussions in this webinar, which is intended as a step forward, engaging towards gender equality, not as a box ticking exercise. The theme of this year's International Women's Day is Women in Leadership, and this theme is accompanied by a call to action made with the hashtag choose to challenge to call out gender bias and inequality. We welcome the challenges to the status quo brought by our panelists today, both through their career choices, but also by the challenges they will raise to us and the broader community. We now have the pleasure of beginning with the panelists presentations with Shirley and Anthony Sammon, and she's the director of InfoFish. Hi, everyone. Hi, Jennifer. Thank you. And it was a very nice message that we heard from the Semino just now. I'd also like to take this opportunity to thank FAO for inviting InfoFish to be part of this very important event. So I'll just give you a brief about InfoFish. We are an intergovernmental organization, which was set up by FAO in 1981 as a project. And our main mandate is to provide marketing information and technical advisory services for the industry in the Asia Pacific region and beyond. We currently have 12 member countries, mostly from the Asia Pacific region, and we have been working with them, providing them with supporting the industry with Fisheries Developmental Services and activities and these are mainly through training programs that we organize, consultancy or other project activities that we get through international funding. We are an integral part of the whole fisheries industry in the Asia Pacific region. And we actually play a very important role in providing up-to-date market information, export promotion activities for the region as well. We provide or disseminate this information, technical information, marketing information through our publications. I think many in the industry are familiar with the InfoFish International, InfoFish Trade News through which we publish up-to-date trade information and also industry-related information. Since the establishment of InfoFish, we trained more than 6,000 people in the industry in fish handling, in processing, also in quality control, HACCP, including trade and marketing as well. And we actually, you can sort of call us a one-stop technical and marketing information center for the industry in the region. We are also actually the regional body of FAO's Global Fisheries Information Network with regional office in the different regions globally. We have InfoFesca, InfoFish, InfoU, Infosamak, and GlobeFish, as well as EuroFish. So, as in my capacity as the director of InfoFish, I'm responsible for leading all the activities in the region, or rather the organization's activities in the region for the benefit of mainly the InfoFish member countries as well as in the region as a whole. Promoting of course the sustainable use of fishery resources, InfoFish also strongly supports issues on the global agenda such as decent work in fisheries, women in fisheries, and social responsibility. Well, just to touch a little bit on some of the hurdles that in my career in terms of facing issues related to gender. It's very much actually related to cultures in the Asia-Pacific region, which we can say is not really homogeneous. And in some countries, we still have the mindset that men make better leaders. We have come a long way from there, but we still have that notion that is still happening in this region, and that women are more naturally suited for softer roles such as communication and so on. When you give the choice between two professionals who have the same background, but different on different gender, many in the region would still choose the male. I would say one other factor is age, in addition to gender, and there's a prescription that either you're not old enough or you're not experiencing. So these are some of the things that I've experienced in my career since I've been in the fisheries. So you always have to push harder in order to instill the confidence in people. I must acknowledge here that I have had many women and male allies who have inspired me and supported me in my career and I'm fortunate in that sense. Another thing that has been hurdle in my experience is I would say maintaining a equitable gender balance in our organization as well as in our activities. And as we all know in fisheries, it's really hard to come by or rather it's a challenge to have more women in the managerial or senior leadership role. And so the number of candidates who choose to be or we try to select in this role are also correspondingly lower. So that's one of the things that we experience or rather experience. And one other factor that I can also mention is in relation to the cultural perceptions in the region which is women tend to be expected to be softer. In terms of, you know, the way we speak in our mannerisms and so on. But these are these are attributes that do not really translate, especially when you're at the managerial role leadership position. So, we have to find ourselves to push ourselves to be rich that sort of higher level of assertiveness without seemingly, you know, without being seeming aggressive. There's this perception that aggression in men is probably more readily acceptable than in women. So, these are some of the things that we find, or rather, I wouldn't say it's a big hurdle but it's the main challenges that we commonly come across. I would say that these are not something that has been resolved. These issues are not something resolved. I don't think there's anything that's going to be at a point that we have resolved it. It's an ongoing process. And I think we all have to keep pushing with consistent and persistent action. So it's a long going process that's that has not been resolved. And I would also add that it has come a long way. There's a lot of improvement and we have moved, progressed greatly, but still, you know, the journey is never ending. And these hurdles I would say varies according to the region. It can also vary according to countries and also different ethnicities. Some countries might be having, you know, by the take longer to solve, some may face tougher situations, some countries may, maybe even having more subtle issues. So it's really quite contrast. I would not say that you can really generalize when it comes to the types of, you know, which hurdles would remain, or rather remain longer. But mainly I would say due to social cultural and religious norm, we do see women in the Asia Pacific region, particularly in this region where we belong to, are still lacking a strong strong voice in terms of making decisions or commonly found or commonly found at manager roles. Having said that, I must also add that in some of the countries in the Asia Pacific region, we do find women dominating the workforce, particularly in the government, in the government roles. For example, like in the Philippines at Thailand, we do see many women, a very strong presence of women in the government sector, and also holding manager roles, which is really inspiring and that really shows how important the role of women playing in the government sector. The challenge remains, however, that, you know, we got to prove our capability. This is a long process that when we are faced with social cultural norms, it's something that we are trying to sort of undo. Cultural norms, it's something that has been there for a long time. So when we're trying to undo this is definitely going to take time, but we have again come for a very long, in a very long way. But at InfoFish, we have been trying to ensure that we have a gender balance in all our activities as much as possible. Even our workforce currently at InfoFish, we have our current status is almost 80% of us are women in InfoFish. We're trying to still ensure that we have a balance in our activities. We are trying to have a greater participation of women and particularly in our international events, conferences, our training programs. We are having more and more women who come in as panelists, as moderators. At this point, I'd also like to add that at our Pacific webinar, tuna webinar that we had last November. For the first time, I think in the history of InfoFish, we had a lady who delivered the keynote address. So that's a milestone in InfoFish and I'd like to highlight and also thank Ms. Pamela Maru, who's the Secretary of the Ministry of Fisheries Cook Islands, who gave us the honor to deliver the keynote. So, you're doing step by step, you're moving, and you're trying to make a difference in whichever possible way that we can. So this is the first time that we have a lady who's in the line of InfoFish leaders since the establishment. And that's the organizations and also the member countries greatest achievement, I think, and just goes to show how important that it's placed the role of women is placed in InfoFish member countries as well. One of the things that we would like to highlight about young women who are willing to engage in the fisheries and agriculture center is, I think it's very important to create women entrepreneurs in communities across the region. So if you look at the examples highlighted by WSI in their video competitions, you'll see that empowered women are even in the marginalized communities can become real inspirations for young women. And I think we can talk about this, we can still, we can see a state that this is a man's world. But at the same time, if we do not do anything, then it's always going to remain a man's world. And honestly, we don't know if the daughters of these women in these videos that we are seeing who could be one day leaders themselves in our industry. Personally, I feel that we don't actually realize that we are also inspiration for someone in this world, or in this industry. So I realize that even before landing in this position, when I had this lady and gentlemen who came up to me once during one of our events training events and said that they were really inspired to see a lady at this event, and this happened in one of the countries in InfoFish member It's really nice to hear when somebody comes up to you and say it. So I think we women have greater opportunities in this industry to become, to make a difference, simply because there are less women in this industry. I think also how we could, some of the ways on how we could actually break these norms in the secret sector to have a little bit more or create that direction to have more gender inequality. I think it's very important for the governments, the private sector, the NGOs, and also the legislative environments to work together. It's very important because this definitely will bring a really important change and a better impact. The businesses and stakeholders take the responsibility to redress this issue of imbalance in gender. You'll definitely be seeing more, more impact, particularly, you know, by stakeholders providing coming up to provide training, improving handling and processing, giving them better access to markets, training them in how to access internet, e-commerce is becoming so important now, all the more with this COVID-19 crisis, e-commerce has become so important. And it's actually providing a very important potential outlet I would say for women to explore in terms of, you know, trying to make their lives better. So even training on how to access, you know, providing the access to internet and connectivity itself, considering some of some countries still have that challenge to have proper internet connection. So stakeholders can come in and try and provide this access to them, even providing easier access and training as well on how to do e-commerce. So this is quite important. And I think all this is only achieved, can only be achieved if we have that really good cooperation between these four components. And to be honest, there's already been some significant progress in this region, Asia-Pacific region, we have companies like Thai Union who's already providing quite a bit for their employees and women workers and also providing child care support in collaboration with NGOs. So this is also very encouraging to hear, providing empowerment for women's group and for example in PG, we see a lot of this in the Pacific Islands and for example in PG, we have the Ministry of Fisheries who have been working with the small business women business groups to provide them with support in developing their pearl business. So, I'm so sorry to interrupt. This is so interesting, but we have to ask you just to close down. Sure, sure. And thanks Jennifer. No problem, no problem. As I've, as I've interrupted you, I also wish to say thank you so much for the points and the discussion. I think particularly this is an excellent consideration for the next topic is this work making sure that women are included and have access to these new, new or not so new digital options to help improve gender equality. So thank you, Shirley. And we look forward to hearing more from you during the discussion. And I just make a note that Miss Amedo had to leave she has another event now for International Women's Day, but she passed on her best everyone and wished successful continuation of the webinar. Up next we have two presenters from the International Organization for Women in the Seafood Industry, or WSI. And so we will be hearing from Christelle Vigo, the chairwoman of WSI, and Marie Christine Montfort, who is the co-founder and executive director of WSI. So I pass the floor to them. Thank you very much Jennifer and good afternoon and morning and thanks to everyone. So WSI, the woman in the seafood industry association is a non-for-profit organization works exclusively on the gender equality in the seafood industry. It is an SDG file, and we think that it's a good way to leverage gender equality to achieve the other SDG. It has been created in 2016 by two seafood experts and two gendered specialists who came to the point that gender inequalities in the seafood industries was very high and very damageable to the people, the business and the planet. So, as has been already said by the, by the, by Miss Semedo and the first speaker, the women are not rare in the seafood industry, because they account for 50% of the global workforce, but they are rare at the top position. As recalled by the deputy director general, women represent less than 15% of private companies board members. They are rare in the professional organization, in the fisheries management organization, as well as in regional fisheries program organization, public institution, or even in investor, in agricultural sector and entrepreneur globally, and globally at the decision making position. And this absence of or imbalance of women at the leading position leads to very bad or not, we think not the best decision for businesses, organization and environment. Why so few women women at the decision making position. What we have, we have been observe and it is packet by research and academic paper and and and surveys and all of our work is that women do not enjoy equal condition and are slowed down when they carry out their work impediments to accessing inputs such as capital bank loans, new technology and training, which are all necessary to climb the hierarchy stereotype and social norms. Do you hear me perfectly. Thank you. So stereotypes and social norms, as well as sometimes some laws in some country prevent women from accesses to some jobs. For example, Fisher woman and not recognized as professional in many countries, and cannot become members of professional organization. On top of that, the stereotype of woman, we need to carry the family burden like disproportionately on the woman shoulder, we're taking care of family members, where the parents or the kids is a time consuming and energy consuming and very costly, leaving fewer resources for women's own work. And the role as well as informal networks where the business is made is not made in formal process but more in informal process, the seafood industry originates from and maintains a patriarchal system where the rules are made by the man from the man. The patriarchal system is in grade in the system itself. So in this industry, the informal setting relationship networks, flow of information, mentoring, and so on, where the career is made also favors men. Men have a far more active network. And at the end, it is to the advantage. Beyond the top leadership, what is important also is to acknowledge and recognize that they are true discrimination crimes and violence against women. Reports show that women who occupy 90% of all the job in the labor intensive seafood processing industry, commonly suffer discrimination, violence, sexual harassment and poor working condition. There is also unconscious bias during recruitment.  And before to pass the voice to my Christine, WSI is here to advocate gender balance at all the level of of the industry, including at the top level, because we think that absence of women is one of the cause of dramatic resource and non sustainability management. Thank you. Hello everybody. Can you hear me. We can hear you fine. Thank you. Thank you Jennifer. Thank you Jennifer for organizing this, this meeting this afternoon or this morning or this evening according to the place you are based in. Hi, I'm Christine Mofort. I am the director of WSI, the organization that Christelle just presented. And as she said, we now know that overlooking women is part of the reasons of the poor marine resource management in fisheries and in aquaculture. Overlooking and forgetting that women are really part of this industry is damageable to the industry. So WSI as an organization is embark on a three step voyage where the first step will be raising awareness. The second step will be advocating for a better understanding. And the third, the third step will be inspiring practical changes. So I will go and present for you the different steps and then turn into some examples. As we have been working on this for a few years now, we understand that raising awareness is essential. In order to raise consciousness, the issue needs to be recognized. If you don't see the problems, how would you like you to seek the solution. So in order to get the issues recognized at WSI, we count and we count and we count again. And for instance, the figure given by Mrs. Maria Elena Semedo come from a study that WSI run every year measuring the number of women sitting in boards of the hundred larger seafood companies. So count, count, count. This is our motto. We also advocate the creation of public and private statistics because what is not counted precisely doesn't count. And this is precisely the problem or one of the problem that women facing our industry. We also mean decision makers within private companies. We share with them our data, our understanding of gender gap and at all level of seafood enterprises. For instance, did you know that the seafood industry share with the mining industry the gold medal for the lowest percentage of women sitting in boards. 13% for mining 14% for seafood. And 1717% for oil and gas. But the problem is even worse that what it seems because in mining, for instance, the workforce. We gather some 20% female workers when in seafood, this has been said by Mrs. Semedo, this has been said by Shaleen as well in the seafood industry 50% of the workers are women. So you see the gap, even with the mining industry. So some of our actions highlight the gender gap, make the invisible visible and raise the consciousness or try to raise the consciousness of leaders at their business is based on gender inequalities. Among our programs we have created the video competition to which you key that you will meet in a few moments participate and won an award in 2020. Until now we have received nearly 100 videos and note that 2021 contest is now open so we are waiting for your testimony and for your stories. We also compile all events that happen all over the world, but women in the seafood industry. What they do their success and their struggles. This document is a very useful tool to all who want to better understand what is at stake. I have the pleasure to announce that the watch this year with the date of 2020 was launched a few hours ago so you can get it for free on our website. It compiled some 250 stories from 55 countries and I promise you this document is really an eye opener. When we started meeting people as we were developing WSI it was common for men to tell us in a somehow compassionate voice. I understand. I understand you. I have one daughter. Sometimes they said I have even two daughters, but precisely in saying that they were telling us that they understood little about the subject. We have to take this this issue out of the personal sphere. It is not a question of me it is not a question of you it is not a question about your daughters. It is a question a question an issue of gender balance social and economic organization. We were also said that there were no more women a decision making level because they could not find candidates in digging a bit. It is true that the lack of female candidates came partly from the problem of the industry. It is not very attractive precisely because it is totally dominated by men. And secondly, because heavy unconscious bias made recruiters choose male candidate, as crystal said earlier, and this is quite obvious in the seafood industry but not only not only. I'm sorry to say that but if it were a country the seafood industry would be one of the most unequal country on the planet. So we at WSI are convinced that this industry in all its dimensions that is social, environmental, economical, need gender transformative policies. And to get that we need to have more women in high level decision making position. Women's leadership is key to make this industry more progressive, more attractive and more sustainable. Thank you for your attention. Thank you so much Marie Christine and crystal for your presentations. And I would actually if you have the link you could share it in the chat with the participants so everyone can have a look. And as you may have noticed we've been hosting the speaker bios as we go. So we're trying to keep up with information for all of the participants to see. So up next we have this video. This video was a finalist of the annual video competition hosted by WSI. It features Yuki Kyuudi and she will be speaking after the video so we get to hear from her in person as well. But first of all the video. There are a lot of women working in sushi restaurants but that's really not a lot. And most of the men are working in sushi restaurants. My restaurant is a restaurant where I'm the leader and I run the business. And the chef of Nadeshiko Sushi is all women. Sushi is important for Japan. Japan is surrounded by islands and it's surrounded by the sea. In the past we used to eat fish. But now it's the same now. We used to live in the center of the fish and we used to eat rice. So rice and fish are the main thing in Japanese food. Sushi is the main thing in Japanese food. We used to mix traditional food and make sushi. So I think Japanese food is the main thing in Japanese food. My favorite sushi restaurant is the one I like the most. It's a sushi restaurant where you can make sushi with your customers. It's a sushi restaurant where you can make sushi with your customers. The reason why I like sushi is that sushi is very simple. You have to make a lot of adjustments to the amount of rice and the amount of soup you use. You can add seasoning and other ingredients. And you can make a lot of adjustments to the amount of rice and the amount of soup you use. Simple colors such as white, red, maguro red, and rice white are made of only two colors, but I think it's because there are a lot of such processes that you can feel a wonderful art. If there are more female sushi chefs, I don't think there will be more if it's just the way it is. But in order to increase the number of sushi chefs, I want to create a place where it's easy for women to work. I think it's a responsibility for me to spread it out more, so I think there will be more if I do my best. Also, in order for women to become leaders and open up more and more sushi shops, it's important that there are opportunities for men to help people like in sushi shops, restaurants, and meetings. It's important that there are opportunities for women to help people like in sushi shops, workshops, and meetings. The way I am working right now is not only about sushi, but also about female artists. In Japan, we can't sell art, so we collaborate with female artists and sushi. For example, the other day, we made a sushi dish for the artist who made the dish. She made a dish that was suitable for Nadechiko Sushi, and Nadechiko Sushi made sushi that was suitable for Nadechiko Sushi, and collaborated with the customers. That's how we create a world like that. I'm sure you've all enjoyed this video as much as I have, and I think that Yuki better be ready for a lot of new customers as soon as we can travel. We now have the opportunity to hear directly from Yuki, and I would also like to introduce Makiko Saigawa, who will be translating for Yuki as needed. So welcome to both of you. Hi. Sorry, the internet was terminated, so it's an interception, but we'll revive it back again. Thank you. Amazing timing. Sorry for this. Okay.  Yes, please go ahead. Thank you. Hi everyone. Nice to meet you. I'm Yuki Chizui, and I'm a sushi chef in Japan. In fact, there is a very, very few sushi chefs in Japan, female sushi chefs. For the next generation, as a female sushi chef, I am a pioneer in the new sushi industry. I've been working as a managing director of a sushi restaurant called Nadechiko Sushi in Akihabara, Tokyo, Japan, for over 10 years. In fact, I'm the first female managing director learning a sushi restaurant who also does sushi supervisor and sushi making too. Also, I'm heading a sushi school as a founder, principal and lecturer there. Since last year, I've extended my business strategies. I established the Next Generation Sushi Association, based on my experience in this Next Generation Sushi Association. I launched a new incomplete company, BKTC IMCEO. Next Generation Sushi Association provides a course of education and knowledge for mainly three goals, to promote a freestyle sushi out of the box, to grow the expansion of a new permanent job, and professional choice for women and for the benefit of the children in the future. In reality, the world of sushi chefs is a completely male supplementary in Japan. Despite the challenge, my dream is to make the job sushi chef as an aspiring occupation among women. Also, to help people around the world eat sushi, not as a gastronomy, but as a daily healthy diet. And I find these goals are my important mission to carry. For this goal, I'm putting all my heart and energy into my new businesses. Among them, I'm committing the most to medical herb fishery, Yakuzen salmon. What is a Yakuzen salmon? I mean, medical herbs fish? I blend the feed of medical herbs. I blend using natural organic herbs to fish. Then, I nourish my fish with this special feed of medical herbs as a safe environment with rich green nature. I branding my fish for special fire yet fish. Health uses were functional food for this business. I'm setting a goal to found them as a sustainable business, harmonized with environment, nature, community, health, and longevity. I believe it is a world first attempt. It is unprecedented the challenge that the sushi chef, even women sushi chef invented. I want to promote fish belly diet in a wide variety of forms and styles to eaters around the world. Therefore, it is extremely important that I will use the special ingredient to over fish, which I commit myself so much. From now on, I'd like to encourage a presence of women at fishery industry. For this, I'd like to get along with more people around the world. Thank you for listening. Thank you so much, Yuki. We appreciate very much you sharing this news with us as well as the pioneering work you've already been doing. So we move now to the discussion points. We're very happy to hear again from our panelists. And so we'll begin by sharing the screen to show the questions. Sorry, just one little minute as we shift gears for the question sharing. You'll have to trust me. This is what was written in the question. I can read it directly. The first question is how can we make a connection between improving gender equality for women at the corporate level and for the women working throughout the rest of the seafood sector. Thank you very much. Thank you very much. So I'm suggesting, first of all, we should know this is the lesson I learned from my painful experiences. Listen, we must not be afraid of making mistakes in the past, action and statement. Then we should strengthen, encourage our career by combining joy joint together with other expertise in the other field so that we can produce a new powerful idea to make innovations. This is what I believe. And then she wants to continue the story behind why she says it. So I would like to explain why I say that recently, actually a year ago, I was targeted on online bullying, online harassment. It was triggered by reaction because I was, as a woman in Japan, it is a culture like a norm that women should not fight back against male's comments or something, but they're fighting so hard. No, not fighting that I want to correct the comment on me online. So my reaction, trying to correct the rumors about me, about comment harassment, just triggered, sparked the online blood of bullying against me. And it was more like a heated up by my, my small mistake on the traditional breaking a traditional code of a male sushi, something, but very small mistakes on, you know, cutting some fish in a different way or whatever. And then it was, so during the fire online, I decided, okay, we can keep filming the documentary about me. So the film that I show, the video we show was, you know, right after was during the middle of this online bullying harassment, sexual harassment and also gender harassment against me.  However, this challenge, this adversary gave me other positive challenges and opportunities. One was that some of the good people started standing for me to support. So one of the key person was the one with TV director, who was the first Japanese media, like covering my story as authentic sushi chef. So he helped me branding me with various type of experts in art or, you know, different, like, fashions, whatever. So even some artists, because my background is art school, I graduated from art college. Some artists appear to me and say, I want to help you. How can I help you? We should do some collaboration with sushi and the art or sushi with fashions or whatever, sushi with kimono or whatever. So, you know, I achieve it, I achieve it. I overcome this tone of online bullying about gender inequality, you know, but, you know, so what I learned is just, you know, you should, despite the challenge, we should, we should keep moving forward without any fear. And also we should have lots of friends to support you in a different genre and different field. This is the lesson I want to share with, with, with other women who want to challenge in the fishery industry. Thank you. Thank you very much, Yuki and Maikiko as well. And thank you for sharing this experience because I believe this is one of the realities of women in their everyday life, but even more so as you reach a position of leadership and maybe fame. And it's difficult because I suppose we ask you to share a painful experience, which repeats the difficulties of it, but I believe by you sharing your experience, you help men understand the realities for women. And also women to understand they're not alone in these experiences and how we work together so thank you again. For our next question, we turn to Charlene from InfoFish and we have a two part question. So considering women in the sectors fisheries and aquaculture, working throughout the value chain in the context of COVID-19 crisis. What do you see have been the greatest challenges and what opportunities or potential for changes are presented in the recovery and recuperation from the crisis. So thank you Charlene. Thank you, Jennifer. Yeah, in terms of some of the issues or challenges that is being presented during the COVID-19, I think among the most immediate or urgent one I would say is the decrease in income, lots of jobs, lots of independence, both women and in general. As well as also something that a little bit different from livelihood is the greater risk of suffering domestic abuse, simply because the 90 or rather the long shutdowns that has been imposed in many of the countries or rather globally. In addition to the lower resilience towards the impact of the pandemic. However, we have been looking at things very positively as in when we are being challenged as Yuki said just now, when we are being challenged, we should keep pushing and we should keep looking at ways on how to find ways to and how we can actually be better or find ways and how we can survive. So, it's, it's quite obvious that the demand for fish and fishery products is greater during this period, as consumers are actually looking continue to look for more healthier or healthy options for as food. Of course, fish and seafood is one of the main sources that they turn to this means that jobs in the fisheries sectors are not that effective, although we do see effects delays in getting our supplies, but people still the demand for seafood is still remains and in fact is even stronger. There has been a tremendous change in the way consumers are getting their seafood supply or the during this period and technology has played a very, very, very important role and continues to do so the trend is going to be such for the time being. You know, online sales has boom deliveries have boomed and people are using more and more apps to make their sales. The people behind these deliveries include women, a big number include women who are doing small businesses, whether they're owners of the business whether they're workers the delivery people, women play a very important role. And it's likely, as I said, this trend is going to stay for a while people are quite comfortable with having the deliveries to their homes, because it's safer. So it's a very potential avenue that women should look into how they can develop, especially those who have lost their jobs to have or planning to start a new job or looking for other means of income. This is a very potential way how they can look for opportunities to as a sort of life livelihood. The investment is pretty low.  So we have equal opportunities and you know people are looking for opportunities to sell their product to all kinds of me. So I think this is a very important opportunity and a very something that has to be or rather people should push women should really look at this opportunity on how they can explore. The the powerful or the potential of social media as a tool to spread information. In fact, it's been said that 51% of the global population is using social media today. That's, that's, that's a very big, big number. People are scrolling screens every day. We are almost, if we were doing that 20% before now we call it I think 50% or 70% on the on the on the phone or screen or any device. And of course, food, including fish and seafood is being sold through this internet. In Asia, there's been a tremendous number of ways people are using to get the fish to the consumer to social media WhatsApp Facebook auction everything. It's amazing how creative they come up with ideas on how to sell people. And again, women form a very important part in this and trying to sell so it's a good avenue to start and I think very important opportunity at this point. Thank you so much for your response. And yeah, this is a really interesting point that you make that there's some with the with things being sold digitally. There's some protection for this decision that might be made between women and and backed businesses. So this is an interesting point you raise. Thank you. We move to our third question now. And this question actually comes to us courtesy of Mal Williams from the gender and aqua fish network, and is inspired by a quote from Audrey Lord in age race class insects women redefining difference from sister outsider. And so Ricardo I'll ask you to move to this question on the PowerPoint. And the question is a lot of research and action to support women in the fisheries and aquaculture sector is done by women. And this is a continuation of the point made. And in the reference I just mentioned that in other words, it is the responsibility of the oppressed to teach the oppressors their mistakes. So let's ask this question to our colleagues from WSI crystal and Maria Christine. What role do you see for male allies, and what is your call to action for these male allies. Thank you very much Jennifer for this question. I love this question because we, we can sing that agenda and place of women in seafood is a, is the problem of woman or is a yes it's a woman topic. And I say no it's first it's a male topic because most indecision making a role so, and I can understand personally that it's, it's not easy for them to get the situation to get a sense of discrimination that women are suffering and so so I understand at some point, they are leaders, they're in position of power, they are smart, they can, they can lead with a bit of empathy and understand that there is yes there is a situation and this situation is a problem for all of us. My call to action is very simple and I think it's, it's a list of action that you can see nowadays in today, especially in all the social media. It's a list of things that each man can do towards one or several women around him, you can listen to her or to them, you can coach, promote, advocate and encourage. Only that it's simply powerful. And it's already a massive action and a massive impact and change for both men and women. Thank you. Thank you, Christelle, I will give. Not another version but my opinion on this very powerful quote from order Lord. You also said that when you are a woman you are afraid to speak or to not be heard. And when you are silent, you're afraid to so let us speak, and thank you to follow to give us this, the chance to speak now on on this subject, which is due to a heart Now, in echo to what Christelle just said, I would say that men don't see the privilege they have, or they don't want to see it, or and certainly they don't want to lose this privilege so what can we do. Back to the seafood industry. I have a suggestion. I would like the fo to organize an international conferences on that particular subject and targeted to men with male speakers, and you can have hundred male speakers it won't be a problem for me for this time. I will not count really, but invite male to discuss this subject because we need all together to understand the issue we need to share the diagnosis, which is not yet share perfectly between the two changers and and we have the feeling that male need to be educated on these issues and without this education, we will miss the point we will miss the subject so to make it short. Could FFO organize such an international conference at high level, inviting men, preferably. Thank you. Thank you, Marie Christine and crystal for your points. Thank you Christine for your call to action. I certainly think this is something we should like to take up, but we know that this is something needs to be discussed so I say, thank you so much for the action. Thank you for that enthusiastically very soon. As we leave behind these round of questions, we move to a form of a sound bite round, I suppose, where I would like to ask each of the panelists to provide a takeaway message that like everybody to recall as they think back to the webinar today. So, I would invite Shirley to begin and then we can go from there to Huki crystal and we'll end again with Marie Christine. Thank you, Jennifer. Okay, I just need to clarify. I've made a small mess. We'll ask Shirley to begin and then next. Okay, so. Right. Thank you. Thank you, Jennifer. I've got a very simple one. It's based on this quote by Mahatma Gandhi, be the change you want to see. And I believe this very strongly. And also, make the change and leave the way. Every step counts, even if it's a follow step every step counts and I think we should not nothing should stop us from being the first to change or not let's whatever or whichever group that we are representing let's be the first to change or not even if it's the smallest change. Thank you. Thank you, you keep please go ahead. Thank you. Thank you. There's a warm words that I, I eat every day as a, as a like vitamins as a nourishment is a today's, how do you say, out of a common sense in common sense. Revolution should be a revolution in the future tomorrow. So, you know, every time I get lost. Where should I go. Should I do in bright or not it's out of a common sense, but he will keep if I keep believing what I feel, and then I pave a way. So it's happened. Now we see the change in the fishery industry today. So I, you know what I want to tell us a message. Believe in yourself without any fears.  Thank you. Thank you. Thank you so much. Yeah, crystal. And I will ask questions instead of a message as in 2020. Humanity entered in you in a kind of new era, where we, we feel the, our vulnerability, our volatile. We are in a VK world now it's, it's all aware, I will ask you, okay, what kind of leadership do we want today. I would say. Count count. No, sorry, I said that earlier. But you remember we have to count every day in every meeting we enter or every kind of conference we assist to we should come but no really my last matches would be to all leaders be aware of gender inequality before any decision you take. Remember that your decision differs from the ones you have taken in the past. We are now in the 21st century and decisions should take that into account and certainly not be copy of decision, you as a leader have taken in the past before any decision that would be my message. Thank you so much, Marie Christine. I really appreciate all of the contributions from the panelists today and we, we hope by giving a bit of space for you to discuss. And present to share real experiences. We're able to increase the understanding of the colleagues and participants who work, I think throughout the seafood sector in different areas also. So thank you so much, Marie Christine. I really appreciate all of the contributions from the panelists today and we, we hope by giving a bit of space for you to discuss and present to share real experiences. I think throughout the seafood sector in different areas also in research academia and for the UN bodies. We have a long ways to go in this work, and we luckily have a strong advocate who is going to be closing for us today. This is the deputy director of the fisheries division out in them, and he also is my supervisor. And so I would invite him to share his words with us now. Thank you Jennifer and hello to everyone distinguished panelists colleagues, participants and friends. This round table discussion on women's leadership and fisheries and agriculture has certainly been stimulating, interesting, and with great interventions and perspectives. We've had the opportunity to learn about the experiences of chef Yukikuri, as she cuts through the male dominated sushi industry, becoming an example and role model, not only for women in Japan, but for female chefs all over the world. We've heard from Charlene as the head of the info fish. And also, the perspectives and their success by Marie Christine and crystal in their individual ways to leadership, and there are studies that they've conducted as part of the work of their organization. I want to thank my colleague Maria Elena's the middle for her inspiring example and leadership also in this field. We know that whenever we discuss women and leadership, we are touching on a topic that needs much support and advancement. Today's round table discussion is called on leaders from the fisheries and agriculture sector, a sector that remains very much a work in progress when it comes to gender equality and equal opportunities for women and men. Indeed, one of the problems we face is the very perception of gender as a domain only of study, and not an issue of implementation or equity or opportunity. In fact, when we look more closely on the fisheries and agriculture sector, we sometimes register even some tension between technologies and experts on one hand, and on the other hand, the social and gender specialist. But in reality, we need to acknowledge the complementarity of these areas and the need and relevance of both disciplines are all disappears. There is much work to be done, but this is not work to be done by women alone. Men have a crucial role in the movement towards gender equality, and in fact, a responsibility to take on this work as allies. In this respect, let me quote the he pushy movement initiated by the United Nations, which states, an ally can be someone who amplifies women's voices. It educates themselves about different identities and experiences, someone who challenges the status quo and someone who takes action. Gender equality is critical to women and men, boys and girls, rethinking the power relationship between human beings and traditional gender roles will release us from old and restrictive norms that limit men, women, as well as those who define their identity otherwise. With the COVID-19 pandemic, this has become even more urgent. The pandemic has turned out to be a carrier and revealer of inequalities, as it has severely impacted global seafood value chains. And the impact of the crisis has been born particularly by women. They have been losing income and leaving the labor market at a far greater rate while taking on, at the same time, a larger burden of care and domestic work. The crisis has been shown to worsen existing inequalities, and we are now at risk of losing decades of progress for gender equality. This crystallizes our need for immediate action by incorporating a gender lens in all our work. Indeed, without the general focus, we will not capture the reality of women and men in the sector, nor will we achieve the goal of sustainable and equitable fisheries and agriculture, while ignoring the loss of opportunities for women and the sector itself. This clear message is also reflected in the outcomes of the 2019 international symposium on fisheries sustainability. It is also a principle well-addressed in the FAO of Fisheries Small Scale Guidelines. Therefore, the Fisheries Division of FAO is committed to mainstream gender in all its activities to enable the fisheries and agriculture sector to reach its full potential. Before I close, I would like to take this opportunity to announce a forthcoming technical webinar on experiences in implementing gender transformative approaches in the fisheries and agriculture sector for food security and nutrition. This will take place on March 16 and is organized in the framework of the European Union-funded, role-based agencies joint program on gender transformative approaches for future security and nutrition. This is one of the many steps that our division in FAO is taking, together with our colleagues, towards gender equality and the transformation of the sector towards full sustainability in all its three dimensions. We thank our colleagues from the Inclusive Rural Transformation and Gender Equity Division for involving us in this upcoming event, and for their generous support in gender mainstream in our Fisheries Division. Finally, I would like to thank each and one of you for your participation in this special webinar as we mark the occasion of the International Women's Day in 2021. Thank you. The seminar is here while closed.


Hi everyone, welcome to our talk. We're going to talk to you about today about hidden vulnerabilities in open source. So a little bit about us. My name is Sharon and with me is Shaour. We're security researchers at Prisma Cloud from Palo Alto Networks. We deal with open source vulnerability research, vulnerability management and whatever comes within it. I find vulnerabilities in open source. And a little bit about supply chain security because we deal with open source security. So just to give a bit of an abstract about what we're going to talk about today. So we will give an overview about vulnerabilities and CVEs. And then I advance to open source and hidden vulnerabilities, what they are, a different type of hidden vulnerabilities. And we'll talk a bit about behaviors that we found in the research that we did in the last two years in the open source security world. And just our findings and our incomes. Let's just dive in and start. So CV, let's talk about CVEs. Security vulnerability is just an issue, a flaw in the software or in code or something that causes things that we're not intended to do. It could be just a privilege escalation or cause execution or things that the code is not intended to do at the first place. And to identify a vulnerability to distinguish between vulnerabilities, there is CVE ID. CVE just a description of vulnerability and ID with a short description about it. Each one gets an ID. And the CNA, a CVE numbering authority, is the one that is responsible for assigning those CVEs. If everyone can request for a CV, I can, researchers and users and developers, everyone can ask from CNA. And I just assigns a CV. Palo Alto Networks is also a CNA, for example. But the problem with CVE is just a list with a description. It doesn't have the metadata that we need to understand what is really the components that are impacted. And with version, what version is fixed, what is the severity of the vulnerability. So this is one NVD, the National Vulnerability Database, commonplace. It shows us all the missing information that we need, that vendor needs, in order to understand they are vulnerable, they are affected, and they need to update or fix the vulnerability. And there are also other feeds, like GitHub advisory, that also give this information and more other feeds. So let's talk a bit about open source. This is why we're here, right? We all love open source. We use it all the time. We contribute to it. And there's a good reason for that. It's why they use it for the last, I don't know how many years from now. It is well maintained. It is very easy to use. And it's really transparent. Like, I can just import something, but I can also go to GitHub, or whatever the code is based, and see the code and contribute. And actually, it's all out there. It saves tons of resources, time and money for vendors or for users that don't need to go and bend the wheel and do something that somebody else has already done. For instance, I wouldn't just write a code again, Kubernetes. It's a very complex platform, when somebody else already did a big community. But with it, and with all the fun in open source, there are security issues that comes with it. First of all, it's code like any other. It's relevant, what I'm going to say is relevant for both closed source and open source. Code is written by human, we're human, and some bugs can exist. And some bugs, like I said at the beginning, can be security flaws, security issues. When a lot of people work on the same project, it's also challenging. Sometimes it's also too convenient. We just import or require a package. And we don't really go and check what is exactly the function are in this package. How does it look like? How the code looks like? First, there can be a flaw or something vulnerability inside. And also, we all use package managers, which is great. But there could be malicious packages that we would import and won't even notice. Malicious packages, I mean, packages that have malicious code inside of it. And this is not the package we intend to use. For example, they could come out. I could install a malicious package because of typo, which is called typosquadding. Someone uploads to the package manager a package that its name is very similar to the name of the package that I want to use. So I can do typo and incidentally download the package that I didn't intend to. Or dependency confusions or even it doesn't have to be something that is damaged. The maintainer itself could do, could install something or just release a new version with a security issue. I'll give you an example. I'm sure most of you have heard about the colors package. Not long ago. The maintainer of the package released a new version of the package with a security issue inside with an infinite loop, which actually caused a denial of service for most of the users that just uses this package with the latest release. So it's quite dangerous. Also, because it's so wide and so spread so wide, it's an easy platform for supply chain attacks. For someone just to come and search for vulnerability in one platform in one application, and then use it to damage a lot of applications that uses it. So there are issues. But who is responsible in open source? Like, I mean, in large vendors, there is usually a disclosure process, a security policy with disclosure deadlines. Usually, it's up to 90 days between the security issue is reported until the reporter can just publish it. So there's a time there's time frame that the maintainer or who is responsible for the package for the for the software can fix the issue. But it is less common in open source, it exists. And some packages do have a security policy, but it's not that wide as in large ventures. And the result here, when it's really hard to to contact a maintainer sometimes or vulnerabilities are just like when a really reports are just ignored. The result is public disclosure or what calls full disclosure. And that the public that the information about vulnerability is published out loud published in GitHub or in Twitter, someone out there. So it's coming but both ways. The responsibility is is both way. The maintainer also responsible for putting this this policy is not doesn't exist. But also the reporter that needs to to understand or follow and contact the maintainer and don't just publish it out loud. So yeah, this is talk about our problem. There are vulnerabilities out there. And they're published and they don't get a CVE. So what do we do? So let's talk about the hidden vulnerabilities. What are those hidden vulnerabilities? How they look like and where we can find them? So just like a tip of an iceberg, the visible, the visible part is perhaps very impressive. But the hidden part is much larger and much more significant. So based on our research, we were able to categorize this type of hidden vulnerabilities into three main types. We call the first type hidden but visible. It's meant that there is a commit or security issue. Usually there are also a fixed version and a click clear states of problem or security vulnerability. Like this example in Octoprint, Python library. And this example, we can understood from straight from the title, that there is security vulnerability here. There is also a fixed version and very detailed description about the vulnerability. The second type of hidden vulnerability is hidden but fixed. It's basically just a commit or just an issue, not always a security issue. The bug is usually fixed. And we not just mark the word bugs, it's managed and handled and treats like a bug. So not always we had some clearly starting about problem or in the vulnerability or no indication of the security impact. So this is a good example, Envoy, go long package. There is a fix, you can see the fix, but it's look like a bug fix without any details. But in practice, this is a fix of a security vulnerability. The third type of hidden vulnerability is hidden and undercover. It's look like an announcement or feature but actually address a security issue. It will be difficult for the simple user to notice there is some security vulnerability here. And you need some technical knowledge to understand the security impact. And a good example is a list monk. Okay, from the initial reading is look like an addition of some capability to the package. But from the point of researcher or an attacker, we can understand that behind this add of capabilities, or without this addition capabilities, there is some security vulnerability that can be exploited. And we can say that in this currently, this this commit is currently in some disclosure process and we'll get the CV. So let's talk about the timeframe between the first time there is some vulnerability discussion or commit to the time it will get eventually CV. We need to remember that this vulnerability has exist open and visible and attack here or some research here we look to this public discussion or this fix or commit and try to exploit. So the first example is well commonly an NPM package handlebars. And it's a remote code execution on a well downloaded package over 9 million download per week. And it was hidden open and public for 58 days. So here is the the first time we introduce this hidden vulnerability on the February 21. And it finally got a CV almost two months later. So I will repeat it, it was public, visible and exploited exploitable. The second example is a well commonly use the Golan package, GTA, it was a arbitrary file deletion and also well commonly use package and was hidden for 55 days. It was first introduced in March in the middle of March, and was finally got a CV almost two months later. So we talked about the time it takes to this vulnerability to finally get a CV. And now we will see a live example of hidden vulnerability we found as a part of our research. The vulnerability was hidden. This vulnerability was hidden for 70 17 days. And we wrote an exploit. So let's take a look. So this exploit is about less open UI, it's an MPN package for generate some themes. And we create a craft, crafted team to to get a CV. So in the right screen, you can see the exploit that eventually will got an RC. In the left screen, you can see that we import the vulnerable package version. And as a part of our building process, we will point to use the crafted theme that we wrote, and we'll get a remote code execution as a part of the building process of the team. Now we point to the crafted the theme. And we got a CV and we got an RC. So we understood the problem. Like, there is a problem here.  So meaning there are scanners from our beta scanners that shows there is a vulnerability, just one catch them. So why are they existing? And why doesn't don't all vulnerabilities get a CV? So we don't have a clear answer for that. However, some there are some some someone needs to file CV in order for it to be opened. And as we said before, there is no enforcement or some standard for open source for vulnerabilities in open source. So it doesn't require anyone to file CVE. If the maintainer won't ask for it. Probably it wouldn't be done at all. And it's okay, we know that maintaining a package, it's a very, very difficult job. And in addition to their normal job, their normal day job, most maintainers just do it on a free time. And they have to deal with a lot of other things that keep keep the program and the application running and do new features and also just correct bugs. And but they do have to rely on security researchers or reporters that goes and just tells them about vulnerability. So, yeah, we need to ask for our vulnerability to be for a CV to free to be a CV, right? I want to give you an example that I've seen in one of the discussions in GitHub, for for package, that the maintainer really asked, why why we should file a CVE. This example shows that that not all maintainers knows knows and realize the impact of CV. So, when see, when we file CVE, when there's CV for vulnerability, it's published. So everybody can know that a release that is fixed is fixed as a vulnerability has has an impact that I need to update my package. Otherwise, I wouldn't be usually updating a package it can break my build or something. So in this discussion, someone asked the maintainer if he could file CVE. And he said that he's curious why we would be providing to the community. So yeah, when it's out there to the community, users this library knows that they need to update. Simple as that. But why actually should we care that there are vulnerabilities that out there. And as I think that we emphasize is a lot of time in the stock. There are vulnerabilities that are out there, not published and not disclosed, are published, that everybody can exploit. Us as security researchers, we find these vulnerabilities and report them to to our our product. But there are also black hat attackers that looks at the same public issues are the same, the same things that we look for. But they're looking for it for a different way to trying to look for unpatched vulnerabilities and use them. And then just exploit them and do things that we don't want them to do. And this is also a part of taking place for supply chain attacks, like the first link in the chain. When there is a vulnerability out there that the data curse, it can look for and just exploit. There are a lot of instances that are open because they don't know they need to fix. So in our last couple of last two years of research, we found that there are a lot of behaviors, common behaviors for maintainers, and how they deal with security issues. Just as disclaimer, we split them into four types. But these are the edge cases. It's maintainer. It's one of us. It's it's part of in the same in different part of the area. And each one has some different merge of that of those behaviors. So let's talk. So the first type of behaviors is by the book Responsive Silent and Neglectful. So the first the first type of behavior, we call it by the book, the type we really love. It has a security policy with security MD, very detailed, responsible disclosure process, and usually very detailed release notes, usually request for CV. And it's very welcoming security researcher. The second type of behavior is the responsive maintainer. It's usually fixed issue and release or update usually with the fix, the commit message has mentioned the security impact and it's very clear and easy to the simple user to understand the security impact of the commit. It has willing to disclose vulnerabilities, usually request for CV if necessary. But it's dependent, it's dependent on the wheel and the mood of the maintainer. The third part is the silent, the silent maintainer. It will fix the issue will fix the security problems, but it will do it will do it silently. It's very hard to identify the commit with some security impact. And most of the time you need some technical knowledge to understand the security aspect. Usually, there is no documentation of the security issue. And the main the main behavior we make limits merge to master. And you need to understand that merge some commit to fix to the max master is really similar to a role. So if you clone the package before the marriage, then you're vulnerable. And if you clone the package after the marriage, so you are safe. And just like a role. So it shouldn't be like this and maintainer should understand that they have some responsibility to the to the user and to the open source community. And the last type is the neglectful. It's maintainer with no security awareness, security discussion will stay open for long time or even never will be closed. He had some even vulnerable dependency usually won't fix vulnerability and is an welcoming security researcher. So we just we just covered a lot of some behaviors of maintainers and how to deal with security issues. We talked about also hidden vulnerabilities. And really realize that there's a gap here between researchers and between security between security and between the maintainers and contributors and whoever develops the the the application. I have to say that this gap is decreases in the last in the last year. And I hope it will keep decreasing. We keep closing. So each one would know the vulnerability reporters and the maintainers would know their with corporate like would know which would be responsible. But there's still an issue that exists. There are a lot of vulnerabilities that are publicly discussed without a severe ID. So let's talk about a bit what can we do in the meantime. So the first thing I can advise is to get with the visibility. Both users and maintainers should use vulnerability management scanning tools to know what vulnerabilities they're exposed to. And I know this solves only the problem with CVS. Most of the time, scanners won't have the information about hidden vulnerabilities. This is the problem that we discussed. So there are some some some fees or some applications that scanners that do have researchers who look for these vulnerabilities and just publish them. So you can scan and do know. There are open source tools are also closed source tools like something that we do. But yeah, just the first thing you need to know is to gain visibility to know what you need to fix. But and public discussion on security issues still exists. So we need only to be responsible. The responsibility is on all of us for maintainers for users for researchers. We all needs to to act in the way that we would like to do to do when we want to to have a security policy with security and that really is really details with the detail about how we should how security researchers should disclose vulnerability. What is the time gap that the time frame that the maintainer have to fix the vulnerability. And also just a platform to to communicate. And also it's need to be respected by the researchers, just researchers or just humans and users that don't think they report on a vulnerability and just put an issue. So there need to be clear way to to to communicate. And both ways are both both directions, both people are responsible. So also, you can dedicate a team to handle reports or just even someone that can be the maintainer or or contributor even. So it will be reachable and people will know who to reach to. So we need to talk about it more. We need to put it in our in our life. And to know that security is something that we need to we need to to take care of we need to respect. Because we all do we don't want to have a package that is insecure. And so just be with a security mindset and keep that in mind. And thank you very much for joining I talk. If you have any questions, we are happy to answer. And thank you very much.


Bah what's up everybody once again this is Brandon man Sean on a Saturday morning recording straight from my phone that's what I do on these Saturdays and I got two big things that I want to talk about number one is something that is killing a lot of artists out here that you guys are it's just going over your head you don't realize it's killing you and number two I'm excited to show you guys the new intro for the channel the new outro for the channel I did a beat contest for you guys who don't know they're producers they send me beats and you know we pick one and we came up with a new intro for the channel showing you that in but before I get to both of those things whoo boy I don't know what that was um Kory dropped a video yesterday right and it was about the dark side of going viral and how going viral like just not having a team together and all these things but I want to stop and ask you guys one question what would you do if you went viral tomorrow if you woke up tomorrow and you had five million views on one of your songs like you had a video out what would you do stop and think about it for a second that part is some of the point of what Kory was talking about I've done a video on this before but I know I have a lot of new people on on the channel these days think about the fact that going viral is like hitting the lotto for a rapper right or an artist in general but the difference between going viral and winning the lottery is there's a ticking time bomb the moment you go viral so you know getting the one in the lottery you can be like all right I'm just gonna sell the money spend it real slow wait talk to figure out what I'm gonna do with it no when you go viral as a rapper as an artist in general you have to figure out how to flip this as quickly as possible and not only are you going to have like people wondering and judging your brand off of whatever went viral and that might not be your brand you're gonna have a lot of people who see opportunity in you a lot of people that you don't even like know coming at you or nothing's gonna happen at all because you don't know how to get out there and do it so just think about that just think about it for yourself what would happen if you went viral and that'll probably change the perspective of a lot of you guys who are wishing that you went viral immediately because you have no idea what you would do and that time bomb will be ticking next thing you know is just another song that passed I know quite a few people um who's there's who that's happened to actually um but we'll get into that now the first thing that I said I wanted to talk about that's killing a lot of rappers actually is wanting to be liked wanting to be liked and this is what I mean this isn't like some little feel good thing think about memes these days everybody's saying becoming a meme when you think about the process of becoming a meme a lot of times it's to strike a nerve none of them are to be like if you think about the kashi if you think about blueface blueface is um he it's like people are making fun of him right not taking them seriously if you think about lil pump a lot of people were laughing at him at first it's entertaining there's this process of yeah you get some fans you get it but it's more so for attention and it might not be something that's completely positive and that's the difference like these days before you want everybody to like you you're trying to make as many people as possible rock with you avoid bad press or but avoid bad feelings all you can but today a lot of times the primary way a lot of people are standing out are doing things that might cause people to dislike them at first but you have to be able to you know get through that fire and wait it out be patient be strong until you get to the other side i'll do more on that in a video i'm on blueface i got coming up that'll probably be either tomorrow or next wednesday i haven't decided i did the video i just got figured when i want to drop it you know you know just just waiting things out but the next thing keep this in mind as well oh two days left until you can get the free access to the bonus live branding sessions as well by the way that'll be on the 14th today is the 12th so if you watching this video i don't know when you're gonna watch this video it might be too late by the time you see it but two days left to get free access to that i'll put the link in the description below if you want free access to those live branding sessions you know you got to get the pro music branding god um those will be some rather intimate sessions and i'll do as many as possible not even a lot of people on each one because i want to have like some intimate sessions with people talk about branding like other people see other people's brands that should be super dope first time we're gonna do those um but everybody will get like literal specific attention from me on their brand anywhere oh the beat see i just start rambling sometimes the beats i'm about to do a clip because i'm recording this to my phone i gotta edit the new intro in but get ready to see the new intro right now run that back run that back so yeah that's the intro shout out to beats by malice for that intro and now we're about to play the outro shout out to adonis callo for the outro i appreciate both of y'all at beats by malice and at adonis calso you know what to do hit that subscribe button as you see the outro you know just chill on the way out you know i'm saying a good little vibe and then but the intro it comes in with a force letting you know that the channel is here that's kind of the energies i wanted to go for thank you again for everybody who submitted their beats on instagram all that good stuff to producers once again you have to think about this like a placement because your stuff didn't get chosen it does not mean it wasn't a dope beat or wasn't good at all you know of course some people's beats might not have been great but we have to think about a placement in general remember there might be a love scene and your music might not make sense for a love scene but you submitted it so some other beats that got submitted just didn't make sense to be an intro not for what we were going for energy wise and some things didn't make sense for being an outro right so keep that stuff in mind um but there were a lot of dope beats i tried to you know thumbs up or like a lot of the things that i was hearing that were good and solid appreciate y'all once again have a great weekend be cool oh hold on hold up if you like this video go ahead like button if you like even if you like this video you might as well hit the like button if you like you might as well share it and if you're not subscribed you know what to do hit that subscribe button


Hi to everyone. So this is a personal experience made up in my company, Groen's, is talk about optimized user experience and performance through Grafana, Prometheus, and LightTouch. So first of all, I'm Miki. Hi to everyone. And the context is that MailApp is an Italian cloud platform for email marketing automation. And we are using Micro Frontline and Micro Services architecture. And we have some issues with performance and also in the process to parting all the monolithic architecture to the newest Micro Frontline and Micro Services. So what we want to achieve is improve the performance, improve the user experience, and improve also the user interface. So this was the issue because the platform has a lot of components, features, pages, and also a lot of tests and trend, unit, and also regression. So we wanted to monitor everything. Because of these, the solution that we wanted and the solution that we wanted to find out is a way to use the normal DevTools that everyone is using on the web, such as the DevTools from Chromium. It is used the power of Lighthouse. This is a open source software made possible with the Google team to collect some metrics about the speeds, the performance of a page, of an application. And try to find out with an architecture with Doher Garfano-Promity's puppeteer that is a headless browser how to find those metrics and try to improve it. So let's try to dig into it a little bit. Lighthouse with the PageSpeed is an algorithm made by Google from the web standards. And it's open source you can find out on GitHub. Also, we are using puppeteer that is a headless browser that you can control with JavaScript via an interface API, a low level API interface. And also you can find it on GitHub, then Garfano for monitoring, and of course, Prometheus. I jump a little step behind and try to let you know how Lighthouse is working. It's basically a pipeline for collecting metrics from visiting your page, basically. So the script is visiting our pages, collecting those metrics, and give it back to our Prometheus server and then on Garfano to collecting those metrics. These are the metrics that we wanted to collect, performance, accessibility, best practice, and they last to never mind. But they were there, so why not? And as a final result, we wanted to have a timeline to check also if the features that we are making in the time, they were improving our performance, they were improving our user experience, they were improving the user experience for our platform. As I'm a programmer and I cannot speak very well, it's better if I just let you see what we achieve. So it's basically a Garfano dashboard with all the metrics that we wanted to have, some metrics that we prefer for months, some metrics are talking about the page speed, so how our page is loading, if everything is above the fold correctly and correctly also through an amount of time that the user will not fall asleep waiting for our website to just finish loading. So our solution is basically this little schema. We have a node process with Puppeteer and Lighthouse on it, and also we are saving on a disk in local environment or on S3 on AWS. And we are working with our servers with Prometheus and Garfano to collect and to publish on Garfano dashboard those metrics and to make some analysis. Of course, we are using Docker for any of them, for porting, for portable, commodity, and also for everything that we want to achieve locally. So the takeaway are we want to improve our product development process. So we needed a fast way and an automation to achieve those improving and performance issues. And this was our best choice as a solution that we had. Also, we wanted to add metrics to our deploy. We are fast deploy every day is about three, four, five probably in every kind of environment in every kind of team. Also, we wanted to improve our user experience, user interface as we are moving our architecture from a monolithic way to a micro front end way. And also to have a better control on all the front end development. And of course, be more efficient on releasing. So this is our personal experience, company experience. I hope that I have you inspired to automate those changes through Prometheus, especially, and Garfano with the support of Garfano. And to be also portable in local and cloud environment with Docker and everything else. So thank you.