Welcome to Pookey Ponders, the podcast where I explore big questions with brilliant people. I'm Pookey Nightsmith and I'm your host. Today's question is, men don't talk about mental health, myth or masculine trait? And I'm in conversation with Tim Bowton. Yes, my name's Tim Bowton. What about me? Well, I suppose I came from a broken home, sort of adoptive parents and various things. I was really lucky to go to a school where I got a music scholarship. So I was very musical as a child and really didn't spend much time with my family over that whole period of time. And so really then joined the army to try and find a family. So that was way back in 1989 where I did a short commission of the army out in Hong Kong with the Gurkhas, the Queen's Gurkha Signals, and then came back to then go to university, realized that university was far too difficult and I'm not very intelligent. So I ended up going back into the army full time. Long story short, I served in a whole raft of places and did various things, but I basically transferred then to fly helicopters for the Navy in 1996 and qualified in 1998 and became a commander helicopter pilot until 2008. At that stage I was diagnosed with post-traumatic stress and many say post-traumatic stress disorder. I don't believe it's a disorder and I'll come on to that sort of when we speak. But it went through a whole system of CBT and EMDR. I'm moving to sensitization reprocessing for those who don't know it. And then a sort of span of a banking career in the city in dispersed with a lot of work around mental health and veterans of mental health and really looking at mental health from a positive side rather than a negative side. I believe that if you take control of your own mental health issues, if you develop this self-awareness then you have influence and if you have influence you have control and if you have control then you can sort of deal with this in the ways that you want to deal with it. But it was very much then led to a path of helping people how to how to sort of gain that self-awareness. So I was then asked by the Army to be their strategic advisor on mental health which I started in May 2019 and then recently during Covid and you know everything that's been going on there. The Army asked if I would go back full time in the appointment of Kernel mental health engagement which is really responsible for helping the Army with everything to do around mental health and the education around mental health for the leadership, chain of command and also the soldiers and troops on the ground. So that's been hugely exciting and then as well as that founded a mental health company called the Elios partnership with two other guys that have been physically and mentally injured in Afghanistan and Iraq and really that was to just to get out there to the corporate organizations and blue light services and talk to them about the positive aspects of mental health. This idea of a post-traumatic growth and a journey rather than if you find yourself with anxiety and panic then that's it there's nothing else and I think one of the big things that I fought against was this whole idea of labelling you know people label you with something and that defines you you know we should not let our labels define us we should define the way we are and how we deal with that. So in a nutshell that's the sort of bubble of how I got to where I am today. Wow that's yeah been been through a lot and lots of different kind of things have kind of added together I guess to where you are now. I'm interested to understand a little bit more about how you came to viewing mental health through a lens of kind of positivity and taking control is that a kind of journey that you went on or was that always your kind of point of view and take on it? No it's a good question and actually it's it's I didn't realize that I had a mental health issue until it was pointed out to me and I was becoming verbally aggressive I was becoming office I was becoming you know I just wasn't I just wasn't the moment myself and I think I really struggled with that to start off with then when I started reading up on it so I read a lot of books I read one of the books that I read which really I credit with sort of literally saving my life is a is a book called Professor Mark by Professor Mark Williams and Danny Penman sort of mindfulness in a frantic world and it's really discovering this whole ability of if you've had moral injury if you've had if you feel guilt about something if you feel you know if you feel you've done something you shouldn't have done or you know a the understanding that we're all human we all make mistakes and you know anyone who says that doesn't probably hasn't recognized it or is a you know we'll do some stage in their life but this ability to forgive ourselves and how do we forgive ourselves how do we move on how do we you know how do we look at the fact that we can learn from those mistakes or those injuries or or you know our childhood issues and for me you know in the armed forces less than two percent of mental health issues is caused through post traumatic stress believe it or not although the public would have you believe that we're all mad and bad for me it was very much childhood issues and issues through childhood I'm really an aspect of needing to fit in and and having to to fit in so very long windy way of answering your question so for me I sort of realized that as I went through that journey I could either let myself sink back and just become a professional victim so somebody that you know was defined labeled I'm never going to succeed I'm never going to move forward I'm not that type of person and so it was a it was a real struggle okay what is there out there that I can latch on to that can help me through um through this journey and that's when I started to realize that actually if we if we if we gain this self-awareness um and we can influence our condition the way we think about our condition then actually we can take control of it and take ourselves to a greater place so in my case that looked very much like you know now I do a mindfulness session every morning I um try and do some form of physical activity every single day and I will continue doing research and hence the reason you know I said to you before we came online you know about my masters in mindfulness at Oxford um you know I spent sort of five very happy years there as a trustee being surrounded by people that had found mindfulness in some way shape or form that had gone from being broken people to to actually finding peace and and happiness living in the present moment we cannot change that past we cannot change what we've done in the past we cannot change who we are in the past neither can we define who we will be in the future but we can live in that present moment you know of being who we are here and now and if we do that you know one of the the lesser known factors that everyone knows is that we spend 88 percent of our mind subconscious mind in not being aware of our surroundings and what we do if we can increase that through being in the present moment then we have a wider outlook on life we can take the blinkers off and we can sort of exist better I think sorry a very long winded answer no I don't apologize it's interesting hearing you talk about it and um going back a bit there you said that you weren't aware of your you know your your struggles or your need to to kind of seek help until it was kind of pointed out to you how did that kind of come about who was it that noticed and what steps did you take to change things so it was my family and and my daughter at the time who came up to me said you know am I going to get good daddy or bad daddy's day because I've had enough of bad daddy um and that was a shocking realization I think um but also it was a realization that I was probably in the wrong job um commute to London on a daily basis you know um from very early in the morning coming back very late at night um was not conducive to good to good mental health I thought that you know having transitioned from the military that I'd landed you know and that was the thing that I that was going to define me you know a successful career in the city which was you know it was good while while it was there but um you know I very soon afterwards learned that actually we need to you know we need to really take control of what we do in our future in terms of you know being honest with ourselves about what is a right career or a wrong career um so after that that sort of initial shock and jolt I went to see various people I went to see a GP had a very bad GP who didn't really sort of help in any way shape or form um I went to some of the service charities they were you know mediocre to say the least and so that's when I really took it upon myself and said I'm going to define my own journey of my recovery uh and went and researched you know the best people to do CBT the best people to do EMDR um and then you know um was recommended mindfulness and really sort of got into that as a sort of um control um for for for what had happened um through that time and I found that by doing that I was happy to take other people's opinions and and and what they said but I could really distill what was useful and what wasn't you know as I went along that that journey and so I now found myself where I think you know I've addressed a lot I mean a large majority of my childhood issues I've um I've got to a place where I'm stronger and more secure in in in who I am um I've forgiven myself for you know a lot of the issues in the past whatever they may be um uh and you know I I'm driven I I'm driven every day by that that sort of that thought process and that that um you know that experience um and for me if I can do that on a daily basis to help others then you know I've succeeded I was going to ask how your own experience kind of led on to the the work that you've chosen to kind of dedicate your time to now so you've gone from someone who didn't recognize their own issues to someone who is very much proactively supporting and helping others to to recognize and respond to their own needs so what kind of inspired you to do that and what do you kind of hope to achieve in the work that you're doing? I think inspiration comes from knowing that you've helped somebody um the first time I mentored somebody who was um diagnosed with PTSD and got them to a safe space you know we talk about this you know um uh promote preventive tech um uh uh the side of mental health you know if we can bring people back from the brink of clinical um or from going from injured into the ill space which is the clinical treat space then um they stand a higher chance I think of of of of of a faster recovery but also not relapsing back into that into that space and for me it's just the joy of being able to give something back so I work a lot with veterans I work a lot with um obviously now current members of the armed forces um and it's the ability to just give something back um and and basically hopefully change you know a fairly old arcade policy that that really you know there are a lot of people out there that don't really understand mental health if we can educate them if we can stop them on a journey of survival which we're doing through an army program called the optimization human performance through stress management resilience training really counts title um called up smart um then we can prepare we can prepare people who have made the decision that they want to join the military on day one to help them you know for when they transition outwards and suicide is a real issue not only in society but it's it's the same issue within the armed forces as well although we're not specifically higher than you know civil society but um you know we've got to protect our people in a and what worries me more than anything else is we are in a complex world you know we have Timothy Goreway says this is brilliant quote in his in the book called the inner game of tennis which is our performances equal our potential minus our interference I don't know if you've heard of it but um if you take the interference as being emotional interference if we can basically take our potential of who we are and we look at that interference of what we have today and our children are surrounded by social media 24 seven um in an uncertain world we're piling loads of debt on them now through covid we're doing you know whatever it may be we have to mentally prepare them in the best possible way so that they can cope with that that form of life and in the past where our ancestors have turned around and say man up you know or it'll be you know you just sort of stiff up a lip and everything else very very good but you know when you sit down with them and sort of say yes but in your day you didn't have social media you didn't have the stress of you know commuting to work like the way you do now you didn't have the uncertainty you didn't have the debt you didn't have you know all these sorts of things I think that then becomes a realisation that it's it's our duty all of us to ensure that those that unfortunately are suffering with mental health issues be they acute or be they you know severe we have to you know come together and help and help them get through more find a way to help them get through absolutely and the the kind of central question from this episode was around men and mental health and whether men are prepared to talk about their mental health and if that's a myth or a masculine trait and I was interested to explore this because I have a worry about this rhetoric around men not talking about their mental health which is that I fear that we talk about this a lot and we say we need to address the fact that men don't talk about their mental health and I kind of almost feel that by saying that we need to do something about it we almost reinforce what I'm not even sure how true it is anymore but I just wondered yeah how much you experience that in your work and yeah what do we do about it if it is true so I I I finally think it's the opposite I think men are now more and more happy to talk about mental health issues it's how you frame the psychological safety for them to do so and if so let me give you an example we we've worked with a with a fire service and the issues that are there through what the people see and you know dislocation of expectations in the current that's fire service has been doing more duty and you know not their normal firefighting job they have they've sort of you know that frame that frame of reference has been removed we set in motion a whole mental health mental fitness and was in its package but on day one the chief fire officer stood up and said I'm going to tell you what happened to me I'm going to tell you how I have had mental health issues and how I've overcome them and how I regard them we then broke down into focal groups 25 firefighters mixture of senior officers to firefighters to civil staff everything and I've never seen interaction like it because the psychological safety had been given by the fire officer to say look it's okay go go talk about it use this forum and it's amazing how many people coming out saying oh I feel like this I've had this and somebody else go yeah I had that and this is how I dealt with it so did you do that yeah I dealt that too and before you know we as the facilitator were actually sitting back going this is brilliant and just letting people have the conversation and talk and every so often we go did you ever consider this oh yeah yeah we should have done that whatever it may be and likewise we then went into a law firm which most law firms bastion of sort of you know sort of you know that sort of work ethic of you know work hard you know you can't have any issues and we'll just fight through and again the managing partner stood up and gave the most powerful testimony to all these partners and I knew one of the partners who I know was living on the edge who was really in a bad place but it's said to me privately I can't open up because I'll lose my job I found himself in tears letting for the issues that he had and the managing partner took him aside and literally took his mobile phone off him his work phone off him and said go away for two weeks he said your job is here I don't want you to do any work you're being paid I want you to go off for two weeks and by the way I'm gonna you know I want you to go see your GP or you know and sign he signed posted accordingly and that changed his life that little moment of of that that sort of change of culture and ethos by somebody standing up and giving them permission so to go back to your original question I think a lot of people a lot of men are not afraid fun enough to talk about mental health issues and I say that from the construction industry from the sporting industry through through the through the military as well I think where the issue lies is a generational issue the old school people who you know are the just get on with it fight through you know it's not a problem but actually a large majority of those people that are that are espousing that that that sort of ethos are people that are really having tight issues themselves they're having real inner battle that they feel that they will be seen to be weak if they expose that and I was one of those people I mean you know I was one of those people who who mental health issues don't so stupid you know that's in that you know it's weak it's weak people have it but my god I might convert now and and and I think that I I would say in in all the companies we've been into in all the presentations we've given and I would honestly say hand on my heart that it's probably about 85 to 90 percent of men will talk about their issues and 10 to 15 that work and that's because you create that psychological safety where they feel able to to kind of go there yeah and I'm sure you're you're you are absolutely right and that if you don't create that safe environment if you don't sort of preempt or set the set the foundations and the seams then sure people that that that majority of people who don't talk about it will will be higher but I don't I think it is a myth that we regard that most men don't open up and talk it's just allowing them to do so in a dignified manner you know in the knowledge that they will not get backlash for it they will be supported and helped because that's what the majority wants but also we've got to be really careful I would say more so about the people that don't talk the people that sit in the back of the room with their arms folded the people that say this is all rubbish the people that say you know I don't believe in mental health and mental ill health because my experience is traditionally they're the ones that are in a worse position than the people who open up and that rings true with my experience working with young people in schools actually I've had a couple of occasions where I've talked to a big call of school kids and on the whole they've you know you've got their raptor tension and that's great and they'll be you know just one or two that are mucking about and what will generally happen is that they'll get hauled over by their teacher and actually they're the ones I want to talk to and generally I found that if I'm given the opportunity to speak with them separately there's usually something there that they need to open up about but it can feel very uncomfortable if you've you've not gone there and someone's talking about this stuff that's kind of scary and difficult and you don't know what might happen next can't it yeah what do you do in terms of you know obviously you're able to go in and you create that psychological safety because you're very used to doing that but what happens when you leave what's the kind of legacy that you leave behind after you're kind of training all your support to organizations so so we will not go into a business unless they have a system of mental health first data in place okay that is the baseline you know so we've been asked to go into companies and we said okay having mental health first data what do you want about mental health first data right okay let's rewind let's go back to a baseline and make them understand what mental health first is I do not think that mental health first stages are the panacea by the way but we also talk about this journey you cannot go into an organization and give them a lecture on mental fitness and resilience about how the brain works and how we do heightened awareness and you know all of those things that the habits and practices that we put in place to deal with anxiety or panic attacks or depression and expect that to be the quick fix and you know the sort of local moment and then we will walk out so we very much look at follow-up we will do one to one we will go back and then we'll do workshops and those workshops will be around so we'll do a survey after we've done the first session and the survey will sort of say what worked what didn't work what do you like what you did not like where are the issues what are the issues so we'll work with the organization and then what we'll do is we'll craft focus groups around that what is it that you you as a whole want to see or explore more and then what we'll do is we will put workshops and design workshops in place to address that and those workshops are where we will go through a workbook um I haven't got one to hand but we will we're sort of basically put a whole load of exercises in there we'll refresh on the on the habits and you know and some of the some of the principles and then what we do is we leave them with that workbook which at the back of it has a has a strategy for their own mental health journey so where you know a plan effectively well how do you then take this forward and how do you then work on it what traditionally that happens is we'll then get a phone call from the company and say look can you do one to one coaching the center or can you come in and give us a further bit around line managers or can you give us a bit around partners or whatever um so if anyone phoned us up or phoned me up and said that we want you to do a one shot wonder I would respectfully decline um because I think you can you can end up letting Pandora out the box or bottom you know out of Pandora's box whatever it is opening the lid it on so many issues that you then leave that person with and they don't know where to go or how to deal with it there is not one um lecture we have given and we've done a lot um where we haven't had a personal disclosure within that session and some of them have been suicidal idealization um others have been I'm asking for a friend um another one is my son is my daughter is um but mostly it's like you know I can't work at this company anymore I don't know how to tell them I'm worried about my job you know I'm having sleepless nights um you know I'm responsible for a team which I can't control you know all of those sorts of things which if the organization didn't have in place a system of dealing with that you know it would be fairly catastrophic yeah absolutely so you're taking a very um it it's not it's a longer-term approach of building a relationship and a real understanding which I think is really important and like you I find that wherever I go the disclosure just follow me and how do you manage that because actually you know you've you've had your own um struggles and issues and taking that on board from other people all the time is is quite stressful no so we have a very good system and that is um we signpost um we uh ensure so to give you an example we had we went to one business where the the chief financial officer was in a bad way um and that came out of the disclosure in one of the lectures um I took them to a prior office um really um uh brought them off the ceiling and then really to a sort of low level through mental health first aid you know that sort of those tenants and then I got the managing partner I said right my recommendation is that you now need to sign for this person to their GP um and then the system your system will take over from there so that that sort of happens that's how we deal it with it on the ground in terms of the three of us so Tim Olley and myself um um we we we are really good um because we're all experts we're really good at debriefing each other so we will sort of say are you okay with that do you do anything click any bells or anything else that and and you know nine times out of ten the answer is no but if there is something we'll talk it through and because we're so you know good at doing that with each other it's it's never it's never been an issue but the other thing is is is that we all we all absolutely made sure that we were psychologically robust and in a really great place before we even started this business um because there are too many people out there delivering so-called mental health first aid or mental health or or whatever it is under that under that um that banner because it's a sexy thing to do um who are in a really bad place themselves um and in using it as therapy for themselves but not realizing that actually people are presenting on the other side of that do you think that's a significant issue within the sector then people kind of we've lived or living experience perhaps wanting to help on some level but maybe doing harm to either themselves or others no i believe that learned experience is um is really powerful so you know myself you whoever it is have got the learned experience and it's really really powerful because you could you can almost step in other people she is you know you know you know the the sorry the problem comes when people are are going through recovery and are doing it to aid their recovery and are basically you know getting personal disclosures in those sessions or do it for a one-shot wonder so we'll go and say right you know this is when i this is how i got um ptsd in afghanistan we're in this situation and we're shooting that and this happened blah blah blah you know and and this is what this is what happened it's a great story but unfortunately it it leads other people to sort of go oh right i'm recognizing symptoms now that that i might so you've got to be able to deal with that as well yeah so it's about being able to do it safely isn't it yeah talk to me about ptsd question mark so you you don't believe in the d tell me more about that the first thing to say i think is everyone is different and you know everyone has their own different journeys so for me um a lot of my um pcs came from childhood experiences um and you know a lot of that is the reason why i went to the military to try and find a family you know i was always trying to fit in along that route um uh and i think you know it was only you know not not an awful lot of time ago that i sort of found what the real who the real me was but in that interim period it made a huge amount of mistakes so for me having gone through that journey and had the diagnosis the label being given the label um to me a disorder is something that you cannot change or is something that you are you will live with the rest of your life you will you know you will you will medicate for it whatever it may be um and again i must stress everyone is different for me um i was never going to live with a label i was never going to live with a label upon disorder i was always going to fight and strive away in which um i would come out and and leave that behind um i never went on medication that was my personal choice um i believe for me that if i've gone on medication then i i wouldn't maybe have come off it or i didn't want that uncertainty that i might come off it so it was how can i put in place those those um you know those those things that that would that would offset me going on medication be it you know doing lots of fizz mindfulness um you know finding a new sense of purpose developing a new frame of reference that really helped me on that journey to fight you know what i've been labeled um and so for me i i never considered or i don't consider that i've had a disorder um i consider that i've had a uh a moment in time when my brain has just it's all got too much my stress container has got too too full and at the time i didn't have the tools and the ability to work out how to turn the tap on that allows that all to sort of fade down my sediment layer within that within that was probably up here so my room for expansion was very little but actually through mindfulness and everything else that expansion that sediment layers come down to here so my expansion level is now quite high and just by managing that on a daily basis um enables me to sort of um feel that i've gone through to post-traumatic growth so if i had a disorder you know disorder for me personally i think it would have stunted what i believe that post-traumatic growth were off to be and tell me about post-traumatic growth that's something you've mentioned a couple of times and presumably quite relevant in in the work that you're um you're doing with the army and with others as well what does what does that mean what does that look like it sounds like a real positive out of a negative yeah i think if you if you look at mental health in a positive way then you're striving to work out how can you use your learned experience to make you stronger and if we take anxiety for instance many people don't recognize that you know what causes anxiety or why the fight and flight reflex happens you know what is the amygdala telling us why do we why does it happen you know is it fear false evidence appearing real so is our brain telling us that what is happening is real but actually it's not real yeah as soon as we start to understand how all that works then actually we can react to those situations quicker so all our brain is doing have i seen this situation before yes i have what was my reaction my reaction was to go panic okay so bang have some panic and we'll you know panic away if we can drag that out of our subconscious and actually interrupt that flow and go hold on stop so i'm a great believer in in this phrase that we came up with which is stop breathe reflect and choose in any situation that we are in whether it's somebody flicking you the v's in a car or cutting you up on the motorway if we just go stop okay i'm engaging my conscious mind breathe i'm grounding myself in the present moment i'm just stopping that adrenaline coming in the cortisol level reflect okay if i stick the v's back at that person or i get angry is it going to achieve anything no because they're half a mile ahead or if i answer back in the way that i want to shout at this person down the phone is it going to achieve anything no because actually the law be over so choose i can choose my reaction i can choose how i want to deal with it and before long our brain takes that on board so that the next time that you feel that anxiety or panic will suddenly cut you up on the motorway you suddenly go hold on a second i think i didn't i didn't react to it and that is the learned experience that we have and how we can train our brain to bring things back into the conscious and re reprogram the way in the back of our heads you know where all our library of learned experiences stored um next time the brain goes into the library it goes oh yeah okay no i've been reprogrammed on this one this is how i'm going to react do you think that becomes easier with time then the more that we do it the more that we're able to access them oh without a shadow without yeah and this is why um you cannot hope to get to a position of post-traumatic growth and you cannot hope to get to a position of um stronger mental fitness and resilience if you don't practice it if we're an olympic athlete we train hours and hours a day to get to that situation our physical is no different from our mental we're two are intertwined so if we train our physical to that ability why do we not devote an hour a day training our mental you know why do we not give it we have one brain that brain once it's gone once it's you know once it's um you know not functioning properly affects us in so many ways in our life in so many ways so why do we not look after it and give it the time it deserves is that um part of the kind of focus for your masters is that you're starting so i want to um a mindfulness is not it's not for everyone but it must be something because it's based in 3 000 years of teachings it's uh i'm looking at it from a very non-secular way you know i'm not a i'm not a massively religious person um but i do i do believe that there is something there from the way the buddhist teachings are there the sarties to to where we where we are you know where we are where we are now and can use it now and i think that you know what mindfulness enables us to do is to really take stock of just the pressure from the outside world um the technology the social media you know the social media you know life issues you know everything and you know and just pause in the way that we deal with things and and get ourselves to a you know to a much calmer way of dealing with things because you're always going to have people who hate you you're always going to have people that don't like the way you do things you're always going to cheat someone off you know you're always going to get it wrong we are human at the end of the day and i think if we can realize that then you know it you can just drop all those things that you can't control and it's a really cathartic experience you know it's worrying about things that you just have no control over it it's just so much wasted effort and you'll know that from from your background but you know it is it is about it is about really rebalancing your life and for some it works you know it takes a lot of practice mindfulness is not something that you can go and dial up headspace and do you know a couple of sessions a week and all of a sudden you're you're you're a deli ninja um it is it is something that you know takes practice and and you know regular practice and that's where i come back to saying that if we train our mind if we give our minds nutrition which mindfulness is then actually it will pay us back in space yeah i find mindfulness personally quite tricky because if i give myself that much space without a focus of a thing i'm doing that's when the memories and stuff tend to kind of invade in an often quite tricky way that said i found doing things mindfully really really helpful so i climb a lot and i find that if i'm just wholly in that moment and i'm focused entirely on on the climbing and i do that in a really mindful way that that for me is helpful but i think yeah for different people different things help don't they yeah and i think that you know mindfulness is not about trying to exclude thoughts or or or you know change the way um those thoughts are mindfulness is about just being non non-judgmental about the thoughts that come into our mind and either giving them the just giving them the recognition and then moving on it's not about fighting them or or you know those thoughts so if you have thoughts that bring back bad memories it's not about giving them the airtime to really go over what those bad memories are it's about sort of training our mind to say okay i recognize they're going to be there i'm going to move on and i'm going to think of something else it's it's it's not it's just being non-judgmental about pain it's really easy to say i get it it's really difficult to do but actually what you're doing um is mindfulness in the mindful matters or whether we brush our teeth in the mindful manner whether we eat in the mindful manner whether we walk climb you know i fly so i fly helicopters so for me being you know in the sky is one of the most it's one of the most mindful things that i can do there is never a day where i don't land and and feel as though you know the whole way to the world has been taken off my shoulders um so yeah how you do it it's very personal to you i think and music do you still have music in your life because you talked about being a music scholar as a youngster and i'm a very amateur pianist and i find that again for me because it takes so much focus that's a hugely mindful activity yeah so my daughter is is is a music scholar her school as well and and so i'm sort of happy to come back into it so i was a i did um piano organ trumpet and sax um were my my instruments and um you know i i i was classically trained then went into jazz um then then sort of went into a bit of um other stuff and so you know i've come back to the piano now um because my daughter came back to it um but you know i went from playing vidoz to katerin and bass fugue and d minor and all these sorts of things to now where i'm you know i know that i will never get that back so that ability to go back because you know i was practicing hours a day and everything else um but i see the joy of music through my daughter now um through her violin and every so often i've got a piano right next to me here actually every so often i'll just you know jump on it and play something and just you know yeah i mean and then my daughter's school if they're you know if they're calling out for a parent trumpeter at christmas carols i'll i'll dust off the trumpet and give it a go but apart from that that's about it see the main reason i started playing piano was because um my daughter started playing the trumpet which i used to play as a youngster and when i picked it back up after many years it was so hard and i just thought i'd rather start with something new i you know it made me think oh i'd like to play again but it's really hard as you say going back to something that you once used to be able to do really well and just not anymore um what do you use your the your work around mindfulness in your work with the army um and this this kind of new and growing world that you have there or is that quite a different approach no so it's a really good question and the topical one actually because um trying to trying to teach a whole lot of harry soldiers and and and and wonderful ladies about mindfulness um funnily enough it's a bit i thought it was going to be really fought against and and and actually it's been it's been it's been quite welcomed but there has been no governance around it there's been no um there's been no uh sort of engagement with someone like the oxford mindfulness center and the oxford mindfulness center is probably the world's leading research-based um and evidence-based um center for mindfulness you know john cabersen's but it's things in the states but you know oxford is regarded as that so what i'm trying to do through that through the mindfulness is a part of that and there is a part of it the the dissertation phase and the teaching phase is design the program that we can have validated that will be for the army to use through mindfulness um and because of having come from that background um i can tailor it to land better within that environment um but there there is great openness to it i mean there's a there's a defense mindfulness steering group there is a defense mindfulness initiative um you know we're using mindfulness in parliament now for some of the parliamentary groups so it's very much being looked at as i think the the one conflict that you have is that um is that mindfulness is very much you know everyone sees mindfulness as this um uh connection with the Buddha very peaceful you know the peaceful means the army and the military when you when you then and the Americans have done this a lot with their special forces in their army is that you know if you then use mindfulness to make you a more enhanced killer then that is where that is a real issue and i have a real issue over it you know if it makes you a better person and the consequences of making you a better person mean that you do your job better then i can sort of live with that but my interest in this is to help people within the family context you know the wives and the partners and the and the husbands uh spend a lot of time with their other halves away you know and dealing with that there is then this sort of you go and sort of um have your own um way of doing things you know your partner will come back from operations having done their own way when you come together you get this you know if we can if we can just have make develop that understanding of you know what each other goes through but also the children and for me the real focus is if we can get the children you know and the families and the husbands speaking the same language around medicine resilience and mental health and within that maybe mindfulness then that will deliver uh a huge effect um you know there is a there is quite a divorce rate within the military um not unsurprising especially when you know you had that kind of song on the rock um so we have to look at ways now where we include the families and pendants as well as the people who are on the front line sounds like an incredible piece of work how um yeah how how long you know is there a particular time period that you're doing this over or is it an open project no so it's a master's two years and within that two years will be me writing the program um you know teaching getting some validation uh to then launch um I'm really lucky in that there's a there's a chap in the in the army already who has done a phenomenal amount of work on mindfulness um who I hope to collaborate with and we've spoken so you know it hopefully won't be starting from scratch so that's a good thing wow brilliant and what are you hoping will happen next in terms of your your work in the different avenues it might take you and the impact it might have so I've been a really I'm quite a um entrepreneurial spirit so um I tend to live by my seat of the pants in terms of work I'm actually annoyed with everyone around um but you know I've got I've got an opportunity opening up with an American you know a great american family who want to open up a sort of basically a high-end well-being um uh and leadership center um here in the UK uh and they want me to run that well on the side of that which which I will do um there is um a lot more to be done within the army and that the sort of once I finish being mobilized in December I fall back to being a strategic advisor and I'm there until 2024 so there's more I'll be doing within that space um the veteran space I'd love to I'd love to work more within the veteran space but it's so toxic um there are there are two types of veterans the veteran that wants to do good and positively um further there what they're doing and then there's a veteran that wants to be a professional victim the whole time and will you know nothing you do will be right and it will all be wrong and and I've been trolled rather too many times for my own comfort um on you know likes of Twitter and other things to actually um to actually want to get really involved with that because it's wasted energy um and I can't control you know what other people think uh some of it has been absolutely you know I've had death threats I've had you know I've been called a coward you know um you know um lie pathological all sorts of things just for trying to help out people through that through that journey um so I'll stick with the things that I know I'll stick with the things where it's going to be well received um and I'll do it with like-minded people but you know I'm unfortunately I'm a sucker that if somebody rings me up and says like I'm struggling I need some help can you give me some wise words I'll of course I'll do that because that's what I believe that I personally need to give back to the organization I spent 20 years in it wow but many plans then it sounds like you've got yeah irons in many fires and and and you know lots of potential for impact there which is is really positive what what thought would you like to to close with what's the thing that you'd like to to leave in people's minds who've taken the time to listen in today uh thank you for getting to this point initially um I think if you're if you're thinking that you are struggling and you are worried about how people will react don't it is the one the one most liberating thing was to be able to just say I have a problem and I need some help and you will find that the doors will open around you and it won't be this you know cage that you think it will it won't be people thinking any less of you actually they'll think you're brave and that you're strong for for opening up


Good morning, myself, Dr. Lokesh Verma, third year radiology resident from Pandit Vidhi 7th Post-Rajat Institute of Medical Science, Rohtak. My topic for presentation in the city-based conference being role of spiral city in detection and evaluation of mediasional masses. My purpose of the study was city characteristic of mediasional masses with regard to anatomical localization and extent, relationship to important structures, and tissue characterization with the help of Huntsville units. I have studied in 50 cases using a 28-slice CT scanner in the Department of Radiogenesis and Medicine of PJMS, Rohtak. It was a prospective study irrespective of agent sex, and it was a contrast-enhanced CT scan of the chest, and the classification used was the certain classification of mediasthenum. All the patients with mediasional abnormalities in CT were included irrespective of agent sex, and chest radiographs were available in all patients and were compared with the previous ones. And all the patients allergic to the contrast agents were excluded from the study. And the contrast material used was Omniopakar or Iohexal. And all the precautions like kneel by mouth at least four hours before the CT, and all the resistivity measures were taken actually. So out of my study of the 50 patients, I have found that in the most common cause was TB lymphadenopathy, out of 50 there was 26 cases followed by metastatic lymph shorts, then lymphomage, then the involvement of thymus, followed by high ethyl anhyngia, vasculabinol, neuroentric cyst, esophageal tumors, paraspinal abscess, hydrated cyst, neurogenic tumor, teratoma, pericardial cyst, and bronchocene cyst.  So case one is a 20-year-old female with weight loss and dyspnea. In the CC-taxial image, there was enlarged necrotic mediasional abs, bilateral preval thickening with thickened enhancing pericardium. So it was a case of TB lymphadenitis with pericarditis. Case two was a 14-year-old male, presented with acute airway compromise with dilated superficial veins in the neck and thorax. In the axial coronal and sagittal image, there was a large, lobulated solid mass in the anterior mediasional in the pre-vascular space, extending across the superior mediasional into the neck, compressing trachea, esophagus, and the superior venakava, displacing the branches of the aortic arch, posterior laterally. So it was a case of lymphoma causing superior venakava syndrome. Case three was a 63-year-old male with dyspnea. As you can see in the CC-taxial and sagittal scum, there is a large sacular aneurysm, arising from the distal arch and the descending thoracic aorta with peripheral thrombus, displacing the trachea bronchi anteriorly and causing the restructural vertebral bodies and ribs, and extending intraspinally also, and compressing the spinal cord. So it was a case of large sacular aneurysm descending thoracic aorta. Case four was a 52-year-old male with no chest complaint, but in the CC-taxial scum at the level of chest, there was a cystic mass with calciplication in the anterior mediasanum extending into the middle mediasanum. So it was a case of thymic cyst. Case five was a 40-year-old female with mastenia and gravies. As you can see, there is a homogeneous mass in the pre-vascular space in the anterior mediasanum with obscuration of fat plane between the mass and the main pulmonary trunk. So it was a case of thymoma in a patient with mastenia and gravies. Case six was a 64-year-old male presented with water brass. As you can see in the chest radiograph in the APN lateral, there was a retrocardiac mass with air field level extending below the diaphragm. So it could be a case of hietal aneurysm. And as in the CT scan, in the sagittal coronal and axial scum, we can see it's a sliding type of hietas aneurysm, but the GE junction is above the dome of the diaphragm. So it was a case of sliding type of hietas aneurysm. Then case seven was a 55-year-old female presented with dysphagia and dyspnea. And in the barium APN lateral film, there's a large filling depicting the midisophagus with proximal holdup of the contrast indenting on the posterior wall of trachea. It could be a malignant etiology. And in the CT, axial sagittal and coronal and 3D images also, there is a large heterogeneously enhancing sub-tissue mass arising from the posterior wall of isophagus. So it was a case of poorly differentiated carcinoma isophagus on FNAC. Case eight was a 48-year-old female with chest pain. As you can see in the axial image, there's a large heterogeneous mass in the posterior medial syndrome occupying entire the left lung with areas of calcification and fat component. So with the heterogeneous mass calcification of fat, it was a case of mature cystic teratoma. Case nine was a 50-year-old female presented with a per vaginal bleed due to total fibroid, but there was no chest complaint. And in the chest X-ray PA view, there was a well-depied mass in the right cardio-training angle, operating the right paraverteral line, and selecting the right heart, whatever the right heart border is well maintained. So it was a case of posterior medial senile mass. So, but in the axial CEC image, we can see a posterior medial mass in the right paraverteral region with mid-solid and cystic component. So it was a case of neuroentric cyst on FNAC examination. Case nine was a 26-year-old female presented with chest pain. As we can see in the CEC axial scan and in the T2 coronal image, we can see a large multi-loculated cystic lesion extending in all the compartments of the medial senile and along the pericardium. So it was a case of medial senile hydrated cyst with multiple doctor cysts also seen. Case 11 was a 42-year-old female presented with dyspnea. And the chest radiographs on the PA and the lateral view, there was a sub-carnal medial senile mass in the right bronchocis. As you can see, the sub-carnal location is most important here. And also in the CT, there's a well-dependent round sub-carnal cystic mass of water density. So in a sub-carnal location with water density, CEC is the most community was a case of bronchocinic cyst actually. So from all my observations, the maximum patients, 54% patients were more than 40 years age group and males were more commonly affected, 56% affected than females. And out of my 50 cases, histopathology was performing in 38% cases. But out of those 38, 36 were diagnosed on CT and CT was accurate in 36 or 92% cases and it was incorrect in actually 8% cases. So according to the CT imaging appearance, 35 cases were benign and 15 were malignant. So 70% were benign masses and 30% were the malignant masses. So from all these, we can conclude that CT delineated the abnormality and anatomic detail accurately in almost all cases. And with us conclude that medial CT is efficacious in detecting the disease, determining its extent and location and in increasing the confidence of diagnosis and obiating some other tests. Thank you so much.


Hi, everybody. I'm Christy Wilson. I'm a software engineer at Google, where I lead the Tecton project. Tecton, which we'll be talking about a little bit, is a continuous delivery platform built on top of Kubernetes. And somehow, I've been working on it for three years already, which is hard to believe. But even more exciting than that is I'm excited to actually be doing this talk in person. It's been at least a year and a half since the last one. So thanks for encouraging me to do this, Kim. You're welcome. Yeah, it's been a while since we did a talk together. And so, hey, everyone. I am Kim Lewandowski. I'm currently at Google, but Friday is actually my last day. So very excited to do this talk with Christy. And she promised me that we're going to do talks even after I leave Google, so yay. I worked in the supply chain space for the last three or four years, started the Tecton project with Christy, and currently leading our Google open-source security team. So it's been exciting. And here we go. So Christy, let's just kick things off with a demo. I hear you've been working on a new website. Yeah, let me show you. I've been working on a cool cat picture website, as one does. And while she's pulling this up, Christy made amazing Goose diagrams of the both of us that you'll see on the slide. She's very, along with being an amazing engineer, she's a very good artist. I didn't know you're going to flatter me. And she even wore the shirt for the occasion. But the open SS of Goose is our Goose mascot in the open-source security foundation. All right. So enough geese and back to cats. I've been working on this cat picture website. If you're familiar with Tecton, you might know that we sometimes have cat mascots for our releases. So I wanted to make a website to show them off. But I feel like it's kind of a little bit plain, like it could use a bit more color. Dogs. Or dogs. No dogs, no dogs. It would be cool if I could make this text rainbow colored somehow, but I don't really know a lot of HTML. So I'm not sure how I'd do that. But maybe I know of a library. Maybe I can just use that library. Let's see. So I happen to know about this rainbow library that will actually make my text rainbow colored. So I'm just going to add that dependency into my project. As one does. As one does. I just call this function. It's really easy. And let's see what happens. Let's go back to the cat website. OK, look at that. I've got rainbow text. It was that easy. Dependencies are really great. Let's go over here. Wait. Wait a second. What is this? Hold on. Every time I refresh this page, I'm getting this output about a malicious binary. What is that? And the only thing I really changed was pulling in a dependency. So let's take a look at this dependency I pulled in. So it's the rainbow HTML project. Look at the source code. There's already something kind of suspicious there. Let's take a look at the actual code that I'm calling. So I'm calling a function called text. It's doing some stuff with HTML. There's some colors. That all seems reasonable. But it's calling this do setup function. So this is actually writing an executable file and executing it. And actually, it's embedding a binary inside of this go package. So I don't think we want to use this dependency after all. Let's go back to our slides. All right, so I'm really glad that we caught that. But what if the binary hadn't just told us that it was there? Most malicious dependencies aren't going to just announce themselves. That was very helpful. So I mean, that's a good point about malicious dependencies. And of course, that's what we're here to talk about today. So here's quickly what we want to cover. Talk to you first about what we consider a dependency. And then talk to you about why you should care about risks like this. And then we'll talk really briefly at a high level about how Google handles third party code. And then we'll see our cool trick. And then we'll follow up with other helpful tools in this space. So let's talk a little bit about malicious dependencies. First, it's probably good to make sure that we're talking about the same thing when we say dependency. So what we're talking about is the code that your code depends on, and the code that that code depends on, the code that depends on. We're talking about all of those libraries that we import so that we don't have to reinvent the wheel every time we want to do something. And of course, not everyone is nice. We have attackers that are trying to take advantage of tricking developers and to downloading and using these malicious dependencies. And today, we're focusing on we're at the open source conference, and that's where a lot of risk lies. So that's what we're talking about today. And so this is a really high level diagram of a typical software supply chain. And this is where you can see where all the weaknesses are along a supply chain and all the different threat vectors. And so getting malicious dependencies into a production system is one of the most common software supply chain attacks today. And we're seeing this, unfortunately, way more frequently than anyone wants to. And here's just a list of some of the common tack types, like the terminology. So if you see these terms in the media or whatever, this is kind of just some of the more common ones that we're seeing. The first one is dependency confusion attack. And this is where it's tricking a build system to pull in the wrong dependency in your software supply chain. And then typosquadding is when an attacker just changes the letters or changes the symbols and tries to confuse you to download the wrong package. So image-editor, they might rename it to image-better-editor or something and try to trick you into downloading this malicious package. And then project takeover, we've seen a few examples of this. And this is where an attacker will try to come in and become an owner of the project and commit rights of a popular project and maybe convince the owner of that project to take it over and then they slip in malicious code. And then all of a sudden, you have a malicious dependency. So this is all pretty scary. And the more you think about it, it just kind of starts to get worse. I've always thought about dependencies as a way to make things easier, but there's a dark side. Of course. It's so easy for me to pull in a dependency. And mostly it makes sense for me to do it. I don't have to implement and maintain the code myself. I can focus on whatever it is I'm actually trying to do. And if there are bug fixes or other improvements in the library, I'm going to benefit from those. But it's not always safe. And just a simple command like this actually has the potential to accidentally give somebody root access to one of my production systems. And so it's getting scarier. I mean, that's the fact of the matter here. This is a recent report, and you may have seen the stat now. And a few other decks at this conference is that there is a 650% increase in just 2021 alone for these software supply chain attacks. And the majority of these are the typosquadding variety, the dependency confusion, and the account takeovers. And again, this is not all just theoretical. People aren't just making this stuff up. Here's a timeline. I run out of space. I don't have all of them on here of recent attacks that we've seen in the last couple of years. Like, for example, Ruby Gems, they found 760 typosquadded packages in the Gems thing and had to pull them down. And then the great suspender attack was one of these account takeover attacks, where someone came in and said, hey, I want to help out with your project. I've got some changes I want to make, earned the owner's trust, and then took it over and then started putting malicious code into a very popular comb extension. And that was taken, the extension was taken down. And the Microsoft Halo attack was a dependency confusion attack that we saw recently. So this is the problem that we're looking at. It makes so much sense to leverage dependencies, but it's really easy to mess up. It's hard to do the right thing, and we don't even really have a lot of guidance about what the right thing is to do. Another interesting fact from the report that Kim was mentioning is that of all these dependencies we're using, only about 25% of them are even being updated regularly and pulling in bug fixes. And as software gets more complex, which it definitely is, you might find yourself pulling in hundreds or in some cases even thousands of dependencies to your project. And like Kim was showing, it's not just theoretical because we are actually seeing more and more attacks that take advantage of this. OK, so now that we've sufficiently scared you, let's just take a really high-level look of how Google handles third-party code. And you can see a lot of this. I added the link at the top of the slide. This is all on our public website about what you need to do if you want to bring in third-party code as a Google engineer. So the first thing is you have to be an assigned owner. So if Christy wanted to ingest her Rainbow HTML, she would have to take ownership of that dependency. She would be responsible for keeping it updated, monitoring for vulnerabilities, patching it, license compliance, and things like that. And again, a really high-level diagram. I think we have some Googlers that can probably speak to more detail if we need in some of how Google works. But I think people know that Google is pretty famous for having a monorepo. So even third-party dependencies come into this monorepo. And we have a trusted build system that's got we have very high security requirements around our build system. We're capturing metadata along the entire supply chain for these artifacts. And we can go back and verify all the properties of them. We know when there's a change that's pushed out, we know where the code is running. We can see what's happening. There's nothing too magic here. I think any organization can cobble something like this together with enough time, whether that's the best thing for a company to do, who knows. But it doesn't work for everyone. You're limited. We can only run one version of something. So if I don't like her rainbow HTML version, I'm kind of stuck with it because she's the owner of that third-party package. And then a few other things that I mentioned. And so of course, we always ask ourselves, can we even do better as a large organization? There's a lot of risk of depending on third-party software. We're seeing the attacks rise. We're seeing examples of this. So what can we do as an organization, as a community, just to make this whole situation better? So there are a lot of different things to address. And we can't get to all of them at once. So is there anything that we can do right now? Let's get back to my cat picture website. What if that malicious dependency hadn't been as helpful as it was, and I didn't realize it's there? Let's see what would happen. OK, so let's say I didn't see any of that. So if you remember, the only changes I've made are pulling in this dependency and then calling the function.  So over in GitHub, let's open a pull request with those changes. So here is my branch. Here are the changes that we were just looking at. Open pull request. And right away, you can see that we actually have a required GitHub action that's running that's going to be scoring my dependencies, which we're going to talk a bit about what that means. So what that's doing is it's using a project that we're going to be looking at in more detail called OSSF scorecard. So this is a project that's all about looking at a project and looking at some of these kind of known problems that they can have and known weaknesses and then scoring the project. So let's see what happens in our GitHub action. So this GitHub action is actually calling, creating a tecton pipeline and running it. I'm going to get into a bit more detail about that in a second. Let's let it run. It's done a git clone. Now it's running the scorecard. And it's failing. OK, so ultimately, this pipeline is failing. Let's take a look at why. So we have a bunch of output from scorecard about all kinds of different checks that it's doing and the failures it's finding. And actually, most projects do fail. Most of these checks, fortunately. But some are more important than others. And so ultimately, we had a required check, which was the check to make sure there are no binary artifacts in the repo. And this check actually did notice that there's a binary artifact in the repo that I was adding as a dependency, so it failed. And so even if I wasn't paying attention as a reviewer, I didn't notice that there was a dependency being pulled in here. Fortunately, this check has failed and it saved me. So let's look at what actually happened here in a bit more detail. OK, so thanks to the automation, we were able to catch the bad dependency. Let's break down what we just saw. So I used a GitHub actions workflow that connected to my Tecton cluster in GKE, which executed a Tecton pipeline. And then that finally ran a tool for evaluating go dependencies with Scorecard. So at this point, if you're familiar with GitHub actions in Tecton, you might be wondering, why am I using both of them? So the easiest answer is because I'm very biased and I work on Tecton. So I wanted to use Tecton. It's got a cool logo. But secondly, let me just talk a bit about what Tecton is. So Tecton is a continuous delivery system built on top of Kubernetes. One of the goals is to provide a specification for CD workloads that's portable across CD systems. So actually mixing something like GitHub actions with Tecton is very much in line with those goals. And another thing that's cool about this kind of portability is that before I hooked any of this up to GitHub actions, I could actually run the tasks and pipelines in my own cluster. And when I ran into things, I could debug them there. So we just saw GitHub actions triggering Tecton, which used scorecards to evaluate my project's dependencies. That slides me. All right, so a little bit more on the scorecards project. So this is a newer project. We created it in the OpenSSF about a year ago. And the goals were pretty simple. We wanted a way to automate the security posture of these open source projects so we could make better decisions on the risk that we were willing to take. And give developers just more insight into these open source projects. And then the sub-goal is really to help inspire projects to earn a better score. A lot of these open source projects are kind of a single maintainer, not security experts, or just don't even realize that some of these things are best practices. And so that was, hopefully, we want to encourage you to get a better score on your project. Oh, and the last thing, I just got an update today that we have public data for over 150,000 GitHub repos today. This is a public data set, so it's all stored in BigQuery. I'm not sure if you're querying BigQuery, but anyway, it's there. And we're pulling in the data in a few different places. And the project originally started out is like a pass-fail on these security checks. But now we've moved into a model where it's a 0 through 10. And we kind of give a confidence of how confident we are that it meets these specific criteria. I don't think Rainbow HTML made it into that cache yet. No worries. So here's a list of the current heuristics we see today, or that we have today. And of course, I think every single project that we're talking about today, except for one, is actually open source. So if there's a heuristic you'd like to see, definitely open and pull requests or what have you. But a few of these, like our branch protection. So we want to see if branch protection is turned on the repo. We want to see if maintainers have access to push to the main branch without going through a pull request process. We want to see how many contributors are a part of the project, or how many organizations are involved. And then we're doing other checks around like fuzzing. Fuzzing looks for vulnerability. So is the project integrated with fuzzing? It doesn't have a CII badge. This one's near and dear to David's heart. This is a list of best practices that we encourage projects to follow. And then this data is a little stale, but this is an aggregate of, I think, when we had like 50,000 repos that we had scorecard data for, and just looking at the aggregate metrics. And unfortunately, there's a lot more red. And so I think it's a goal. Make this graph more green than red is what we're going for here. So let's talk a little bit again about malicious dependencies and how scorecard fits in with them. So sometimes a library is intentionally malicious, like the one that we were looking at. Other times it's accidental. But lastly, even if there's nothing particularly malicious in a library, if you're not following best practices, then your library is open to some of these attacks. For example, if you're not requiring any kind of code reviews for patches, then there's a higher chance that somebody might be able to sneak something malicious into your library. So what scorecard can do for you is it can identify some of these overt problems, like unpatched vulnerabilities, but it can also give you a signal about how vulnerable a project is to some of these known attacks. So in the demo that you just saw, I used a proof of concept tool I made for evaluating go dependencies. And this is the kind of thing that you could potentially do for your own project and for whatever languages you're working with. So what the tool does is first it grabs all the dependencies of the project, including the dependencies of the dependencies. Then it resolves vanity URLs, which is a Go specific thing. And for all the GitHub-based projects, it runs scorecard against them. It summarizes any of the failures, well, all of the failures that it finds, and it fails completely if it finds any known vulnerabilities or any binary artifacts. So you may be wondering if this is really worth it and what it gets you. It's not foolproof, but I think if you compare it to the alternative, which is relying on people to catch things, then you can kind of see the value. It can also do a lot to just guide reviewers. For example, take the check that will tell you if a project hasn't been updated for several months. As a reviewer, you could see that failing and you could decide whether or not that's important to you. Maybe you're okay with that. Maybe you want something that's being updated more regularly, but without something like scorecard guiding you, as a reviewer you might not even know what to look for. And I think you'll find this especially useful if you haven't been paying very much attention to your dependencies so far and they've just been building up. If you run scorecard against them, I guarantee you'll find some interesting things. So, yeah, so scorecards is one new tool in this space. Unfortunately, it doesn't solve all of our software supply chain security issues. And, but we do have a lot of other tools that we wanted to talk about today that can also help in this journey. And so the first one is another project in the open SSF called All Star. And All Star is a bit newer than scorecards. I think we launched it, I don't know, several, couple months ago. And it's meant to be a complimentary app to the scorecards project. And so what it does is it has real-time enforcements of some of the scorecard checks. And it allows you to define, like what user-defined actions you want it to take if it sees that it's failing one of these. So, for example, if you're a maintainer on a project and you install the All Star app, it actually runs as a GitHub. It's called a GitHub app inside your repo. And then you can say, if it fails the branch protection, it can either try to automatically turn back on branch protection, it could create an issue, or I think maybe it emails you. I don't know, maybe that's a feature that we wanted to add. One of the things that All Star could help with is the CodeCov attack where dependencies weren't pinned and that's something it could pick up on and it'll lure you on. And then another project that I wanted to mention, this is a Google project that was also launched, I think, in June, but one of the interesting things is that it's pulling in the scorecard data. So this is a site called depth.dev. You can go to it, you can type in a project, and you can actually get one of the things that it shows you is a graph of all the dependencies of a project and the scorecard results that are coming out. Right here, we're looking at the Kubernetes project and the graph is a little bit daunting, but just to give you a full breath of how scary this world that we're operating in is many, many dependencies that these big projects rely on. Hey, Kim, I came across this trailer. I was wondering if maybe you could explain it to me. Oh, idea. What is that? I mean, I wish I knew. So another big project that we're excited about within the OpenSSF is something that we call Salsa. That's how we pronounce it. It stands for supply chain levels for software artifacts, and it's a framework around software supply chain integrity. So where scorecards is about the artifact itself and there might be some overlap in the future, Salsa is all about the framework around how does that source code get committed and the path that it takes all the way to being a usable artifact. As one does before they're about to leave Google, you put a film together, a feature film, and trying to explain the Salsa framework to get people more interested in these types of topics, and we try to make it fun. I think the full video's coming out in KeepCon. I think you have to do your own segment before we can release. So this is something we're really excited about in the OpenSSF, and we really want to ensure that software artifacts meet end-to-end integrity standards. It was inspired by what we do internally in Google. Our different build systems and our source repository have to meet these specific requirements before we trust them, and everyone has their own definition of trust. Let's see, and a very big topic in the repo today is Salsa personified as chips, or chips and salsa, or a dancer, and luckily maybe we have that partly solved. I don't know, the video kind of talks to it more as chips, but a Googler, a colleague of ours, drew the amazing Goose logo, as one does, with a salsa dress on. And so here's a table of the requirements at each of the salsa levels. This might be a little outdated, but I think it's fairly accurate now. We're working on this with the community. We have bi-weekly community meetings and lots of folks that are involved, and actually just helping us sort of make sure we have the right requirements right that fits different use cases and whatnot. I think the note, you know, the thing to note here is like, while the higher levels of salsa today look very hard to achieve for these large projects, like any of the requirements that a project ends up meeting, it just means it's that much more secure. So it's not like all are lost if you only make it to, you know, salsa one with a few more requirements or something. I think these things are all very important for the trustworthiness of artifacts. And then, yeah. And so, and this is just a kind of a high level picture again of how like the salsa framework can fit in with dependencies. So as Christy was saying, you got dependency, dependency on turtles all the way down of these dependencies. And it's a, I think it's an open discussion or an open issue maybe in the salsa framework today is like, maybe we should consider actually adding another higher level or like the higher level, you know, all of the direct dependencies need to meet a specific salsa level. So it really can get, you know, the scope of these things can kind of explode. But again, any improvement for security is a good improvement. Another project that's very dear to my heart is Tecton chains. So I talked a little bit earlier about what Tecton is. It's built by extending Kubernetes. Tecton runs pipelines and tasks inside a Kubernetes cluster. And one of the benefits of using Kubernetes is it's so extensible. So Tecton chains is an optional controller that you can add to an existing Tecton cluster and it observes the execution of tasks and pipelines. If it sees an image being built, it can generate provenance and sign those images for you. It's early days, but the idea is that eventually it'll be able to recognize and do this for all kinds of artifacts, which means you'd be able to write your tasks and pipelines without having to add any kind of explicit supply chain security support into them and Tecton chains would just add it for you. Well, cool. We made it almost to the end.  And there's really no single solution here. I did attempt to break down the problem in a bit more tractable way that we can start framing it. The first part is awareness. And I think this is where the scorecards projects help, like know the hygiene of the stuff that you're shipping into your production systems. And then that ties into automation. I think a key to a lot of these things are it needs to be really easy for developers to either implement or use or understand. And that's where we see the All-Star project and the Tecton chains project doing a lot of that automation for you. And then I think the last bit is really a cultural shift. And that's where we think maybe new standards and processes come into play. That's also a framework being an example of that. And then that's a picture of my kids. They like to pick up trash. And so one of my takeaways, and I was trying to figure out how to sneak a quick, a cute picture of them in there. And this is a Boy Scouts thing, is like always leave the software cleaner than you found it. So if you want to help your fellow developers out, run scorecard against the projects that you work on and see where your gaps are. If we all improve just one or two of these things that we find in our own projects, then open source software as a whole would be that much less vulnerable. Yay. And then, yeah, our last slide. So here's a link to a lot of the projects that we talked about today. All of them except for the depths.dev. I mean, anyone can access depths.dev. All of these live in foundations. Tecton is part of the Continuous Delivery Foundation and community meetings, all that kind of fun stuff. And then there's a couple more that I added at the bottom here just to check out the package feeds and package analysis projects. And the OpenSSF are interesting as well. They're trying to detect things like typosquadding, like while packages are being imported in package managers and not like at real-time scorecard type things. And then OSV is another interesting project that actually ties into scorecards a bit now looking to see if there are any unpatched vulnerabilities. So that's another good one to check out. And I think we made it. Thank you all for coming at the end of the day. So we definitely have time for questions if anyone has any questions. Yes, David. It's not really a question of an observation. Being trouble-finding because of the CI background effect but detecting static analysis tools turns out to be hard. So it detects them well, it misses some, so this is actually the field everybody else here which helps scorecards. Be better. Get better at some of those heuristics because some of them are challenging. Totally. And you know what we're missing. Yeah, I think with all these things too there's a bit of gaming that can happen. You know, and we're just trying to do better, I guess, but yes, always room for improvement. Yeah, I think the CI test one was one I noticed in particular. I think it knows how to look at GitHub actions in Proud but it doesn't know about anything else. So it says a lot of projects don't have CI tests but it just doesn't know how to evaluate like Azure Pipelines. Yeah, yeah. Yeah. Right, so you mentioned the CI best practices in that itself. It has static eye and so it doesn't notice. Yeah. I think it's not an impossible problem. Yeah, yeah. Totally. And I think, I mean, that was one of the things, you know, scorecards when we first built, you know, the project was just making sure that we could automate these things because that was sort of key for us to make sure they were scalable. Like you saw 150K repos now. If you really dig in and try to manually check all these things, you know, we might not be able to scale as much. So I think there is a balance between those two things but hopefully we can keep doing better as the project progresses. Yeah. In the back. So the question is the scorecard, the trick. So yeah, that was. We actually have one cool trick. That was the cool trick. I mean, the idea is like how, you know, how can we make these things more usable again in an easy fashion, automated fashion? We've seen some projects, larger projects like use scorecards for their dependency policy. And so I think that the Envoy project, I'm not sure where they're current, but early on they were looking at it as a way to say for maintainers, you know, for the Envoy project, like we want some sort of guidance. You know, if you're gonna introduce a new dependency, let's try to give some sort of guidance on these things. And they were looking at scorecards as one way just to give some information as to the riskiness of these projects. So yeah, sorry if we disappointed that that was the cool trick. That's a great question. Can you run this with Just GitHub Actions or do you need TecTon? You can definitely run it with Just GitHub Actions. The Scorecard project publishes a Docker image so you can just run that Docker image as part of GitHub Actions or as part of any CI workflow that you want. There's also a TecTon task that will run it. The unknown bit and the answer to the cool trick bit as well is the part where something actually looks at a project, grabs all the dependencies and runs them for that. And the missing thing there is really just a supported tool for each language to do that. But again, nothing that requires TecTon. You could do it with GitHub Actions, you could do with Jenkins, CircleCI, anything you want. Oh, that's a great question. So she's asking on duts.dev if there's not the most recent version of a project in there, how can we get that included? Unfortunately, I don't know the answer.  Easy to find malicious stuff, which is not that different from what rule with Android where people try to do malicious things in binary and they're doing analysis to try to find the root kids in there. And whatever tests you write, the person doing this, once they know your test, they can write another thing to get around and they don't give you the answer. Right. So I have a feeling that the first part is very helpful, but the second part is really just catching people who are behind or not trying very hard. But like a real attacker is not going to get caught by that. Is there anything to say? I think that's a good point. I would say that I think that that's kind of then my observations from the outside of security are that I think that's sort of the nature of security to some extent in that you're kind of always playing catch up. There's always this one group that's kind of finding new things to check and there's this other group that's watching what they're doing and then trying to like dance around it and find new ways. So I think with something like the binary artifact check, like actually full disclosure if you look at it, it's just looking for file extensions at the moment. So tricking it is extremely easy right now. So you can imagine the next iteration, maybe we're looking at what's actually in the file, then an attacker is going to find a way around that. But you're kind of, you're making it, you're narrowing what you can get away with so that it's harder and harder and harder. So I think we'll never have a perfect solution but we'll just be making things more challenging. More challenging. Have those been based on though? Do you mean like the binary artifacts in particular? I haven't written any of this. Yeah, yeah, I don't, we haven't found any yet but I mean I wouldn't be surprised if it can capture something that we're not aware of. Like the pin dependency stuff, like that kind of check would have helped with the code cover attack, for example. And I mean that's one of the things we're trying to do, you know, with scorecards and also the salsa framework is really map these things to real world attacks, real threats that we've seen and not just make this stuff up. Like, you know, because it's fun to build a lot of these things and engineer a lot of these things together but show that it actually would have helped in these specific instances. Yes, please. Oh, thank you, yeah. Yeah, let me repeat it for you. Yeah, they were saying a bunch of the people working on the scorecards have been accumulating these attacks to apply it back to how they're building out the project. In salsa level four you had an O on reproducible builds, what's the story? Hey, David Wheeler. Do you want me to repeat the question? So the question was in the salsa level four, the highest level of the salsa framework right now. There's a little zero that's not like a clear check box or a clear like not required thing for salsa level four on reproducible builds requirement. Do you want to elaborate on that one or do you want me to? All right, yeah, of course, now they're really good. Here's what we think makes sense and now we have a much broader community discussing things. Google's very confident in their building environment and they work incredibly hard. Other people are less confident in either there or just build environments in general. If you are not absolutely certain that your built environment is crystal clear and wonderful, well the strongest countermeasures is reproducible build. If you total trust your build environment, what are you worried about? So this is one of those areas where there's ongoing discussion about what should be a requirement, what should not. I mean, if you look at the docs on the site, it still says it's drafted and it's in progress. See, again, that says that now is the right time to get involved if you have different experiences and different backgrounds. It would be a good time to speak up and say, here's what makes this and have that discussion. Yeah, I mean, I think for, maybe David probably agrees that reproducible builds is a great end state where you get a bit for bit, matching of these software artifacts, no matter what build system you're building on, but actually achieving that all around is no easy task. So I think the indication of the circle here, if I remember correctly, is kind of like best effort. We would love to see this in this level. Maybe Salsa 5 is a check box, you know, TBD. If that's actually what they discussed. Yeah, yeah, yeah. And that's one of the goals and the motivations for the Salsa framework too, is to really just come to a common language with the broader community and organizations. And we can say, like, hey, David, I trust your build system. And so I know if you're building an artifact on your Salsa level four compliant build system, that I trust that, I don't need to rebuild it myself. Or maybe if I do rebuild it myself, we can get the reproducible, you know, bit for bit thing, or maybe, you know, these really critical projects to the community, to organizations, you know, David's building it, I'm building it, you can compare at the end, that these are things that are in, and have more trustworthiness in the process to create it. Yeah. This could also include timestamps and such anything here, but I would have two different things. You know, I don't think the Salsa system stands well known. If you're not doing a pre-producible build, the idea is to rebuild things and get bit for bit answers. If you allow random dates, then clearly you're not gonna get bit for bit answers. There are actually, well, no, no, no, no, no, no. I'm sorry? The part of the build is not included. Actually, if you go to the perl box, they explain how to create it. No, we see why it's a circle. Yeah. Yeah, it's just saying, hey, here we go. This is why it's a circle. There are solutions, but now you have extra steps, which really comes back to the old ways. There are ways to deal with big time savings. There is a new bit of work trying to solve this, separating the metadata of the build process from the actual input and output binaries, like the fourth file has the binary output, and find that, build that tree and find that, there's a new work happening around that. You may actually also want to have a simple question. When you have to do some rewrites in front of it, he has scripts and stuff to actually do, look at only actually the flow of the assembly code, and sometimes build like a random with the power of pictures registered for what? For different reasons. But he was able to actually find out that these two are identical. It's one of the connections that's square. If I could look at the P and L of the M integration of this data, I would put a build tree that would be available. Yeah, yeah. And there are solutions for the compiler so you can set dates actually, set the date to whatever you want to commit to. Sorry? Sometimes we want the date of the last build. Yeah, well, yeah, but oftentimes it's your own, but we really want it to date the last build. Nobody cares when it's built, it's built 35. Great discussions. All right. I'm going to the bar. Thank you all for coming. All these projects would love more input and more thoughts and discussions, so come join us. Thank you. All right, thanks.


Major oil and gas producing communities in the Dostate say they will no longer tolerate their alleged actions of cattle marudas in their localities. In a protest at Oben, or Rimouan, local government area of a Dostate, the protest has sought government's intervention. It's an irony, the truth is that we are the Dostate over the actions of one Adamu who deliberately decided on his own that he cannot press, suppress and disorganize us by killing our youth, raping our wives, and destroying our farms with Islam and cattle. Unabated, we've cried so much, so many times we've lost pressure so we will no longer accept this media appeal to the Federal Republic of Nigeria and to everyone concerned that the breach of peace in my community is beyond control and we will no longer accept it. Waiting with the Asserv, since 12 years now, Fulani asked me that they take care of the trouble we, kidnapper, raping everything that they can to trouble we for here. So many people are dying for this, asthma, cow issue. They want to use force now, they call our area, our community people, Oben call people and say, may they bring money, may they bring money, may they bring their cow with force as we hear now that we rise up so we don't need them again. That also rejects the nomination of Patrick Assoverin to the NDDC Board.


This paper reviews LIDAR ground filtering algorithms used in the process of creating digital elevation models. We discussed critical issues for the development and application of LIDAR ground filtering algorithms, including filtering procedures for different feature types and criteria for study site selection, accuracy assessment, and algorithm classification. This review highlights three feature types for which current ground filtering algorithms are suboptimal and which can be improved upon in future studies, surfaces with rough terrain or discontinuous slope, dense forest areas that laser beams cannot penetrate, and regions with low vegetation that is often ignored by ground filters. This article was authored by Kai Guangxiao, Nate Currit, and Xuelian Meng.


together with the soup. Be sure to lather the backs of your hands between your fingers and under your nails. Scrub your hands for at least 20 seconds. If you don't have a clock nearby, keep scrubbing until you've sung the Happy Birthday Song twice. Rinse your hands well under clean running water. Dry your hands using a clean towel, electric hand dryer, or air dryer. Washing your hands using the steps we just demonstrated is very important to get hands completely clean. Let's see how well we got rid of the germs and chemicals. Great! No more germs and chemicals. Why is this so important? Germs and chemicals from unwashed hands can get into our foods and drinks when they're being prepared.