While we wait for that to wrap up. It's I'm actually up here anyway I may as well introduce as you guys met her earlier this morning, but our esteemed leader Oh, there we go. Okay No by 63 to 29% and okay and still some undecided so Well, thanks very much everyone for participating in that but anyway our esteemed leader and reslaughter Those are actually surprising numbers. I would have Higher yes than I than I actually sorry Emory may I just have one moment? Yes, sorry. Can you put back the first one? Okay, so that is from before the debate 63% say no 25% say yes Now we're gonna put up the one after 68% say no 24% say yes, great. Thank you. Thanks guys. Go ahead Emory So before I Introduce this panel. I just have to say Peter Swire and I were carol mates in college and Neither of us would ever have expected that we would be both lawyers. Yes, but both Here at the conference on cyber security at least from my point of view. No, but it was great to have him back So we're gonna we're gonna talk a little bit now about doing cyber security beyond the Beltway And this is part of a much larger initiative at New America that is called Reinventing the think tank and I won't go through the whole argument But in a nutshell it is that if you are in the business of solving public problems It is still important to get a lot of smart people together and figure out answers and feed those answers to government That's the think tank model but that is not enough and that most of the or a great deal of the Solutions to public problems are actually now coming bottom up. They're coming bottom up in cities across the country I strongly urge you to read Jim Fallows Atlantic cover for this month that is all about the renewal of America that he sees across the country after Three years and 57,000 miles in a small plane going back and forth across the country and New America is opening hubs In different cities across the country you saw Megan Garcia, who's the head of New America's CA We're now prospecting in Chicago and we'll be looking at other cities and this panel is looking at Cyber security work beyond the Beltway may seem like a shock to many of us even beyond New York Even as far as my home state of New Jersey So we are joined by Ian Wallace whom you've met who is one of the co-directors of our cyber security Project and Dave Weinstein who is one of one of our New America cyber security fellows, but also cyber security advisor to New Jersey, which is my home state So I'm gonna listen to this with particular interest. So with that I will moderate the panel And now that we've established that there is cyber security beyond the Beltway Why should we be engaged in this kind of work? So I think I mean as part of New America's cyber security initiative We've been looking at where we can add most value. So the the very basic answer is We feel that no one else is looking at this and that there's a real opportunity But the the more substantive answer is of two more substantive answers one as Information systems become more and more part of our daily lives and for anyone who heard Paul Nicklaus is fantastic presentation this morning. You will get a sense of what this means And what it's going to mean going forward That means that pretty much at every level of government policymakers are going to have to make decisions that affects cyber security that in turn affect people's lives and Just as There was beginning to be a sort of industry focusing on cyber security policy at the federal level We see an opportunity to to have a look at what's going on at the State but also at the sort of local level some some big cities and some smaller cities have some really interesting stories to tell And then the second sort of substantive point is, you know, the similar to the same as the the Rationale behind the wider reinventing the think tank initiative. There's some really interesting good work Which is happening at that level including the sort of work that Dave is doing in in New Jersey that we want to shine a light on understand Think about in the same way that think tanks, you know ought to be thinking about public policy issues, right? So Dave you've worked at both the federal level and the state level So maybe you can just start by telling us from your point of view what the differences are. Yeah, thanks So at a macro level the public sector is not that different from a cyber security Perspective whether it's the federal level that the state level or even the local level It's important to note that States and cities as well are experiencing the same level of Sophisticated threats as the federal government is in many in many respects the so-called advanced persistent threat is Present at at the state level. It's present at the local level We see it every day and as states are building more capacity around monitoring and threat detection That's starting to become more and more apparent So I think from the same people or is it just that there's the same caliber or packer sort of wherever you are in some respects, there's some correlation between the actual actors in some respects there's commonalities around the tactics and the techniques they're using and you know It's a bit counter-intuitive, but if you think about it at the end of the day, they're they're after the same thing It's it's a data-rich environment whether it's state government or federal government So when you think about the the motivations behind the IRS hack behind the OPM hack and then you consider that States and localities are probably more vulnerable than the federal level is if that's possible no offense Then then it starts to come together But I think you know, it's useful to organize our thinking around State and local cybersecurity in kind of three buckets. The first is enterprise cyber risk management so there's a lot of focus on IT security at the federal level now in the wake of OPM These are the roles and responsibilities that fall under the CISO And states are taking more steps to to deal with those issues, right? Then there's the critical infrastructure protection mission, which is really unique at the state and local level We organize ourselves in New Jersey along the same lines as the federal government with the federally designated critical infrastructure sectors But there are over 500 assets in New Jersey that fall below that threshold of criticality For the federal government, but I can assure you as a as a New Jersey resident The wastewater treatment plan in Marse in Mercer County, New Jersey is is pretty critical to the residents in the surrounding area, so There's need to look at that and then finally the whole issue of privacy and this intersects with the enterprise security mission is protecting the data of Of citizens of your state or locality. That's a responsibility that now falls in the shoulders of Public officials at the local level So I heard Tom Fanning that say this morning that you really need to think of this as physical and cyber together And as you were talking I was remembering a presentation by the head of the FBI for New Jersey back in 2004 at Princeton about, you know, just doing counter-terrorism generally, right? So attacks on exactly those kinds of critical installations and so as you say, you know the Mercer Wastewater plant or energy plant that could be just as easily You know al-Qaeda or isle or any other group as it could be cyber How closely do you work sort of with the physical side? Yeah, we look we work very closely with the physical side the challenge I think in New Jersey and states across the nation is Establishing that cross-domain functionality kind of taking a holistic look at at risk that spans the cyber domain the physical domain To evaluate threats vulnerabilities and ultimately risk To the to these assets we're working closely with the Hs to kind of Take a high-level look at the risk picture But to your point Asset owners of spending a lot of resources on physical security. They're all running SCADA systems as well So so we're we're spending a lot of time actually traveling to these facilities talking to the The control operators talking to the IT Shops in these organizations and helping them establish a baseline awareness of best practices And assist with implementation, which is probably the highest barrier And I think I'm glad right in saying There is a fair diversity across the country of how states are grappling with these issues And so one of the things that we'll want to look at is you know, how states take a large amount of Resources that they've received from the federal government to deal with counterterrorism over the last decade and a half and How that relates to the challenges that they face on cyber security and there really are no right answers But there are definitely some answers that may be better than others And there's you know, I think David's actually doing a great job in New Jersey But there are different models that that are well worth considering and you know There are there are definitely organizations like the National Governors Association and others who look at sort of Conversations across states but but not so much from a sort of public policy perspective way that I think that would So Actually Davis you were talking and talking about across departments and the difficulties across departments I was thinking oh yes as compared to the fully joined up government at the federal level We we have these problems at the state level we you have them everywhere But are there specific challenges that you encounter at the state level that you don't see at the federal level? Yeah, so one of them is and again There's variations of this happening across the federal level But where I think it's more pronounced at the state level on the enterprise Cyber security side we are extremely federated and there is very little governance in multiple states around how we Implement security controls how we share information how we respond to incidents one area where I think state and locals Are really lacking where the federal government has made a lot of progress over the last few years is the incident response realm You know actually Responding to incidents having a public set sector capability that can so-called put the the cyber fire out at the state level That's that's pretty much universally non-existent capability I think there's a lot of opportunity in the future to scale the resources of the federal government in terms of Having local or county or state level Incident response teams that can actually serve not only public sector owners and operators event infrastructure, but also Industry as well small businesses, etc. So before before I ask the Question where the clock is stuck up here. So is somebody telling me that? Thank you Yes, back to we can operate it manually actually it works very well to hold up a little sign saying we have five minutes We're going to the audience I let me let me ask you sure ask you a question On my way into New York every time and out of New York going through Elizabeth and the refinery and the closeness of that refinery To Newark Airport. Yeah, it's always been a matter of Are you working with them to make sure that they can be cyber safe? Yeah, of course So, you know, this is a New Jersey example, but it's obviously common across multiple states We have a very dense infrastructure footprint and a lot of shared infrastructure so in the case of New York Airport you're talking about a port of Port authority asset shared infrastructure between New York and New Jersey We work very closely with them And I think this this kind of introduces the opportunity and the need at the state and local level to really partner with different organizations, whether they'd be national organizations or local or industry-aligned organizations We work extremely closely with the multi-state information sharing and analysis center Which is that the ISAC four states the MS ISAC is monitoring the networks of 40 state governments and Mining that data pooling it incredible value for learning organizations at the state and local level of emergent threats Similarly, we're partnering in the information sharing space to support organizations like the port authority or or airports for example To start sharing indicators of compromise threat indicators in Automated fashion so so doing away with kind of the manually intensive processes for sharing threat intelligence and adopting universally recognized frameworks to achieve this near real-time shared situational awareness of the the cyber threat landscape so machines talking to machines exchanging threat information that's pretty close to zero day And automatically integrating that into the security architecture of our partners whether those partners be Newark Airport or the The folks who are operating the industrial control systems for the pipelines that go from Lyndon, New Jersey to lower Manhattan There's a lot of goodness in realizing Operational fiscal and technical Efficiencies through some of these partnerships the MS ISAC is one, but other vertically aligned ISACs and soon to be ISAOs Are a great place to start and that's that's where we focused our efforts So, you know that that was a great example of an answer that focuses on how you can make us safer through technology through automated You know threat Updating all the time. What about the old-fashioned way of legislation? You know one of the things we talk about all the time is we need to solve problems through computer code But legal code still has its its role is there a a project that you see of sort of you know model state Cybersecurity legislation. Yeah, I think I think there is I think a big topic here around legislation It's kind of the blocking and tackling at the state level Revolves around governance, right and what we've what we've adopted what we put in practice in New Jersey even in the absence of legislation although legislation which strengthens it is the integration of threat intelligence security operations and Cyber policy and compliance under a single kind of cyber risk management governance framework And in doing so kind of elevated to use it an overly used phrase Elevated cyber security to the C-suite in this case the governor's office To raise awareness at that level To to ultimately To put to put decisions into action, right another really interesting concept that multiple states including us are experimenting with is kind of this this separation between the IT side of the house and The cyber security side of the house, right so establishing a governance model based on risk for Ultimately Reconciling the conflicts that always arise between technology professionals and security professionals Legislation can can really create some structure around that type of model But but I think what we're seeing play out at the state and local level right now is is experimental Practices and and you know, we'll see if if states start to put it into coming to ask you and our last question So what's next so in your answer to that? So I'm gonna follow on that and and tell you what's next so in addition to what Dave told us about How states look after their own security, of course states have a really important role in setting the context for Everyone who lives in their states and not just state cities as well And we're constantly reminded the Tom Fanning said himself Cyber security is actually often something that's delivered by the private sector So one of the things that we're going to be looking at and part of this project is sort of how states affect what they're wide Ecosystems and that includes sort of education. It includes workforce another of our programs opportunity at work is doing some great Work around the country to support the White House's tech higher initiative Which has a cyber security aspect to it and and there are other people out in the states, for example Regulators not many people realize that Insurance is regulated at the state level and that has potentially a really big interest in in sort of driving cyber security So going forward we are gonna do what think tanks do write reports But we also intend to get out in the states themselves partly so we can see what's going on and and Shine lights but also so we can take New America out into the states and run some events so As you we've heard partnership is part of what we do and therefore we're very interested in hearing from Anybody sort of outside of DC who feels they have a good story to tell and wants to work with us on some of these Really interesting issues great.  Yes that They my closing remarks, which was to everybody in this audience, but also people online on Twitter If you are involved in work at the local state and local level or accumulating that work we do want to know about it and Otherwise, I'm feeling a little better as a resident of New Jersey Although as you were talking about the governor's office all I can think was I was in New Jersey yesterday or Monday and The conversation all day was when Chris Christie would might ever come back to the governor's office But that was off-the-record political comments and we will now thank our Panel and turn it back over to our next event. Thank you. Thank you


Hey everybody, I am Matthew Miller, the Fedora Project Leader, and this is a Fedora Council video meeting. So in Fedora, we try not to drive all of our business through meetings because meetings are terrible, but it turns out you actually need meetings to make things work. So as a compromise, we do meetings. Oh, yeah, that's how that works. Most of the meetings are actually chat based. They're on our matrix chat every week or so. But once a month, we do a video call to do kind of a high bandwidth conversation about something interesting going on in the project, hopefully something that's going well, not something that's going wrong, something somebody has done or is doing, and I have a conversation about that and show something off. So today, we are talking about licensing, which is an important topic for Fedora since everything is all open source in our project, free and open source software. We kind of need to know how it's licensed to keep track of that. And so we recently went through a big change in how we do that. So we have David Cantrell, who is a member of the Fedora Council, but also worked a lot on this, Miroslav Tsuchi and Jelaine Lovejoy and Richard Fontana here to talk about this with, I guess, David says, a tag team sort of presentation. So with that, I will turn it over to you. Do you want us to, people with questions to jump in during the presentation, or would you like us to let you do your dog and pony show? Yes. So the slides probably won't take that long. I would prefer if we can get through these slides and then do a larger Q&A at the end. Another reason I ask for that is I have to drop exactly at 11 because I have another meeting. So if we can do that, if everyone's cool with that. That sounds good to me. Okay. All right. Now let me present the window here. Okay. Yep. Looking good. Okay. Okay. This is Fedora's adoption of SPDX license and expressions. Sorry. Yes. This is a very interesting topic. There's a lot to it. It sounds really simple, but let's get into it. First off, who are we? I'm not going to go in this order. I'm going to call on people. So as Matthew said, I'm David Cantrell. I work on the software management team. So I work on RPM and DNF and things adjacent to that. I'm a member of Fesco and on the Fedora council. Jolene? Hi. I'm Jolene Lovejoy. I'm a product council at Red Hat. I've also worked on the SPDX legal team pretty much since the beginning of SPDX and kind of always kept an eye on what Fedora was doing since the Fedora license list was a big influence for SPDX at the very beginning especially. And I've worked on other sort of open source legal type community issues over my career. Miroslav? My name is Miroslav Sukhi, I'm manager in packet and CPT team where we try to eat package maintenance and as a side job slash volunteering I'm a package maintainer of few packages in Fedora and related to this change maintainer of federal license data package in Fedora and license validate package. And Richard? Hi. I'm Richard Fontana. I'm a lawyer at Red Hat. I am on what's now called the technology and open source legal team and I've done work mainly around open source legal issues for a long time now, been at Red Hat for a long time, actually have worked, provided advice around Fedora related legal issues actually even before I got to Red Hat, which is an interesting fun fact, so I got to Red Hat in 2008. But that's me. Okay. Thank you. And I, before we keep going, I just want to point out that this, to me, this project we've been working on this for a couple of years now and it is a successful community project in Fedora that involves not just engineering but also people from Red Hat legal and I think this is a first for Fedora to have this level of involvement. I think it's worked out really well. So with that, I mentioned SPDX. So I want to ask Jolaine to kind of give us a little bit of information about SPDX. Yeah. So hopefully most of you have heard of SPDX before, but if you haven't or if you're not entirely sure what it is, it stands for the Software Package Data Exchange. Obviously, SPDX is what we usually go by and it's basically an open standard for communicating software build material information, including license information, which is of course what we're talking about here, as well as other information. So think about it as like a language, right? In the software supply chain, people often want to know what the software is made of and they ask for that in various forms and having various forms in your supply chain is not a very efficient thing. So SPDX was created the idea of like, let's communicate this information in a standard way and define that and that'll make everything more efficient. Now, you may have heard about software build materials a lot in the news the last couple of years, especially since the US government is now requiring them. However, this is not new, SPDX has been around since 2010. So been asking for this information since then, it's just gotten a lot more headlines, I guess you'd say in the last couple of years. SPDX, the specification, just a little side note, it's quite lengthy document with a lot of information in it and there's a 3.0 coming out, which will be a bit more modular to accommodate sort of different use cases by way of profiles. So for example, if you're interested in provenance but you don't care so much about licensing or so forth and so on. It became a standard, an ISO standard in September 2021, but the thing that we sort of care about most here is a sort of a subset of the bigger project and that is the SPDX license list, which is not simply a list as I always say, although that's what everybody thinks of it and obviously that's what it's called. But there are, if you go to the website, there's a list of licenses and you see the names and most importantly the license IDs, but the sort of work around that to make that a reliable way to identify the licenses and exceptions is that there's also some standards of how and guidelines of how things get added and there's matching guidelines to make sure that one ID truly represents an identified amount of text and we don't have two things called the same thing for, you know, or two things called different things that are the same vice versa. And so, yeah, so the SPDX license list is often used even if someone doesn't use the SBX specification, which is sort of what we're doing here. And just as a side note, there's been a long history of involvement with Fedora and SBX. I kind of looked back at the history in the course of this and Tom Callaway was involved in the early days and, you know, we were looking at the good and bad list and how things were tracked at Fedora and then in 2014, around that time, SBX legal team reviewed all of the, well, all of the software Fedora good licenses and added many of them to the SBX license list. I think this is notable because we added about 80 licenses at that time list, which is the biggest addition ever in one rev of the license list. And just last, last release of the SBX license list, I think we added about 40. Most of those were because of Fedora's adoption of SBX IDs. I don't think there's been another, like, you know, addition of that many licenses in the entire history of the SBX license list that's met that. So Fedora has been an amazing contributor to the SBX license list, which is really contributing to the bigger, you know, ecosystem, if you want to call it that, of being able to identify licenses and track them. All right. Thank you. So I'm a package maintainer, Miroslav is a package maintainer of Fedora, and I'm pretty sure that we already have license information on the packages. So I, like, why are we doing this? Richard, can you tell me why we're doing this? Well, yeah, I think we probably all have somewhat different perspectives on this. Like, for me, SBX expressions, so not just the identifiers that are in the SBX license list, but the sort of larger system of SBX expressions, which are, as Elaine said, a language which you can use for representing any sort of license information. This enables, the advantage that I see is it enables a kind of well-defined highly precise way of describing the licenses that apply to the various parts of a package. And that in itself, like, that degree of accuracy and completeness of information is sort of, to me, inherently valuable. Because otherwise, you know, you either have kind of inaccurate information or information that is like sort of too fuzzy and, you know, isn't going to mean the same thing from package to package, different conventions from package to package. SBX provides a way to have a uniform way of describing in a very precise way the licenses that apply to all the packages and products. So if you think that license description is valuable at all and we do, SBX is really the best system that we have right now for doing that. I would just add, I think, you know, the sort of stating the obvious, the reason this is important obviously is if, you know, we want to be able to reuse code and collaborate and open source license enable that, right? So the license, you know, does matter. I know sometimes developers might think otherwise, but that's what kind of helps create the framework for all the things we do, especially in Fedora. And one thing that, you know, Richard and I have debated sort of, is this important to Fedora package maintainers or Fedora contributors or not? But it's something I think that you should be aware of is if you aren't, you know, if you're creating open source software and you're not clear about your license, you know, you don't make it sort of easy for someone to know what that license is. It creates a lot of churn downstream because people who are redistributing, especially if it's in products, are going to, they really want, you know, they want to make sure they know what licenses they are dealing with. And so there's a lot of time spent and energy on sort of unraveling license information. And so, you know, I think there's almost a whole business around that. I think it's a better use of time to just let's make it the information better upstream. And then there's less time spent downstream instead of everybody redoing that work downstream. So I think it is important. It just makes it easier for everybody. However, they're using the code once it's created. Okay. Well, this is good because like as an engineer, I definitely like things to be correct and accurate. If I'm telling someone that something that I am offering them is open source or free software or both, I definitely want to know that they understand that and that the licensing information is correct. So this is good. Fedora has an opportunity to participate in this existing standard as a community member. And we get to sort of ensure that everything that we have in Fedora is represented correctly or advertises the correct licensing information. But also as a package maintainer, naturally we get a little bit of pushback. We have a well-established system that, well, I used the term established loosely because it was mostly the work of Tom Calloway and there wasn't a clear process to get information on there. So basically, you know, have a discussion with whoever wanted to have the discussion and then agree on a short name. And the objectives seem to be focused around what short abbreviation were we going to give the license. Not really are these the same thing? Are they different licenses? Are they actually things we can ship? It was focused more on the technical aspect. And we had no clear owner of this data. And it was duplicated in multiple places. We just, you know, we had grown past what it could provide us. So with all that, what have we done? All right. Here's the big reveal. It's text surprise. So we have Fedora legal resources documentation on docs.fedora.doraproject.org. This was lacking, missing. It was inconsistent. We have clear processes for everything now. And it's on GitLab. So if you see mistakes or you want to add something or information about a tool, please send a merge request. Fedora license data. This is what used to be those big license lists on the Fedora Wiki. We now have this managed as a project in GitLab. And it releases as a package. So the package is installed so our tools can read it. But it also gets published to the docs site, which is quite nice. I'll kind of go clockwise here. Contributions to SPDX. As we review packages and licenses here, we are contributing new licenses or changes to matching rules back to SPDX. Fedora has a lot of software, a lot of open source software, a lot of free software. There are changes that we can contribute back. And that's been going well. And it's nice to see that happening. And then the big part of this project is obviously the migration to the expressions in the spec files. This is obviously complicated and we've broken it down into a number of different phases. I just want to add, I think, just as a sort of a timeline and when I joined Red Hat in February of 2021, I think the discussion about moving the data off the Wiki had was already, you know, had predated sort of me. And of course, I had been talking to Tom and Richard for over a decade. I think we figured out about Fedora adopting SPDX expressions. I think the focus was on sort of those two buckets and across from each other on the slide. The documentation piece, I think, you know, we realized that the Wiki is getting old and everything should be moved to docs. And so that turned out to be a much bigger project than, you know, we didn't really count in the beginning and then, you know, sort of its own project to sort of revise and update all of that. So I think all of this, you know, is a bit more work than we anticipated.  And then I would just add from the SPDX perspective, I mean, besides I mentioned all those new licenses that were added, you know, I know Richard in times and others have said, you know, well, the SPDX license list is not, there's not enough licenses on there. It doesn't reflect, you know, say what's in an entire Linux distro. I mean, Linux kernel adopted SPDX IDs and so that, you know, definitely added. But it's as long as anyone, you know, there's as many licenses on it as people ask for there to be. So, I mean, other than when the SPDX legal went out and of course the initial release and then later went and tried to pull stuff off of Fedora. I mean, we sort of wait for someone to submit stuff. So I think that Fedora is adopting SBX IDs is having this really great, you know, and sometimes challenging knockdown effect on SPDX and therefore like a much wider range of people and community and influence, you know, beyond this Fedora community, which is I think a great thing about open source, right? And, you know, that's forced SPDX to kind of look at some of our processes and make it a little more efficient, hopefully, and, you know, that work will continue. Yeah. I would just want to emphasize also that this is kind of a, this is a project that's larger than just the SPDX piece of it. We've been improving, so we've been improving all the legal documentation by kind of creating this new documentation. We're making it sort of clearer and updating it and kind of rationalizing it. So there were certain contradictions in the way things were laid out in the Wiki in terms of documentation around not just like license names, but all sorts of other related Fedora legal issues. Also, the use of GitLab just by itself has enabled a kind of collaborativeness and transparency, a sort of way of working that is, I think, much better than, you know, the past approach of, you know, kind of having a mailing list and then kind of having some back channel email discussions between me and Tom Calloway. This is a much improved approach, I think, to just kind of getting this kind of work done. Yeah, that's a good point. It's really nice because people can see how the stuff plays out, how the process works, and they can get involved that way. I think, you know, just to build off of Richard's point about the documentation, I mean, I don't know if it's happening yet, but I think it's very foreseeable that that articulation of the license standards for Fedora and all of the information in that documentation could be reasonable for other projects, so it would be interesting to see if people follow from that. So, with all that, and that large overview, we did it, we're done, everything's finished. Well, the easy part was, so now we actually get to the business end of what we're doing, and that's going back to the migration here. So this is the part where we've been planning some HackFest. We will be sending out notices about that, but what we have found and what we've agreed on approach-wise is there's a subset of packages where the license identifier that's in there is simple. Maybe it's just GPL V2 plus the old Fedora license, and the software is well understood. It's something major and we know what it is. So there's some things like that that we can generate an SPDX expression for, but really what this comes down to, and to get this information really correct, is manual inspection of source code, either by a scanning tool or reading it or something like that. And that is a thing that we need to incorporate into the general package maintenance process, the new package process, but we do understand that this is kind of new. It's a change from how we have done things. So that's why we want to do these HackFest days to show people kind of the process that you can use to go through this. Now, revised policy here, Richard, I wanted you to touch on these two main objectives here for package maintainers here. Yeah, so this is not conceptually new. This is the same thing that we did in the past before we were using SPDX Expressions to represent licenses, but this is kind of how we are using SPDX Expressions now. So there are two parts of this. First, as we encounter new licenses in Fedora packages, that's, you know, source code of Fedora packages. You know, if they're not already on our in Fedora license data and already classified, we undergo a review based on GitLab issues and determine, you know, did they, did they fit into one of our approval categories or are they, are we going to treat them as disallowed. And in some cases, we actually have licenses that are disallowed, but we grant certain limited exceptions to their use. And the way we kind of conceptualize what a license is in that phase is really from the start, sort of, we may not have an SPDX expression because there may not be an identifier yet to represent it. But we're always thinking, how would this fit in with the SPDX model of what a license is? And that's one piece of it. And then if something is approved, then the normal process is, or some exceptions is to kind of submit an issue to the SPDX project to add the license as a license identifier to the SPDX license. So that's, that's one part. And then the other part is once you do have an SPDX expression, you know, we have this practice in Fedora of representing license metadata. In RPM spec files. And so we created some updated documentation about this, but, you know, in addition to, you know, the fact that we're now using SPDX expressions in the license field in the spec file, we also have kind of clear documentation on how you sort of figure out what that representation should be. And so the, the sort of summary of the rule we have, which is, which is not different from the past rule under the Tom Callaway system, really, but it's more clearly sort of set out is that that the license field is supposed to be a simple enumeration of all the licenses covering code and content and, you know, anything that's in the binary RPMs that are shipped by Fedora. So there, there are going to be some packages that will have some material covered by a license, a particular license in, in the source code, where that particular license won't be represented in the license field. That's just because of this policy we have that Fedora has as far as I know had for at least 15 years of attempting to only have the license field represent what's in a given binary RPM. So that's the two pieces of how we are using SPDX expressions in this, you know, new system. Yes, thank you. So that that's the thing that I keep trying to communicate consistently to package maintainers is that the expression that you're generating is for code and content in the binary RPMs. Yes, that has been sort of an understood policy, but I don't remember where it was written down and I know that some people thought otherwise and would add other licenses to the license tag. So this is important when we have maintainers using scanning tools, because it's going to pick up, for example, auto conf and auto make template files which are littered with GPL boilerplate but that stuff for building the software that doesn't actually ship in the binary RPM in some instances. So we just need to work with package maintainers so they understand, you know, how to look at the scanning tool output and things like that. So, there's a lot of work ahead of us and Miroslav has been posting progress reports for us and sort of giving us an idea of where we stand so Miroslav. So I tried to send every two weeks to further our development in this legal mailing list status where we are. I create a burned out chart out of this data, which can give us some estimate where when we are going to be finished. Because we are at early stage it always go one month left one month right so this it oscillate around the summer 2024 right now and we are right now in 34% and done so two thirds are ahead of us. It's like how many 20,000 less than 20,000 packages and yeah we need the help of other people like we can't do that manually. Like if our team like David, Richard and Gillade would work on that solely alone that would probably 20 years estimated time. So we need the help of the maintainers and I'm sending these reports in a silly hope that other maintainers reading these statistics will like say, okay I see this mail with SPD statistics for 25 times already so maybe I can read it and usually at the bottom there's something so what you can do that your package appears in the done part. If you are curious there is a link for the scripts which actually check the data but it's very simple it checks the spec file changelog and then the disk it changelog. If there is SPD string and then I consider it done and then but it's followed by some heuristic whether license is valid as old and new one and based on that I do some recommendation. That's all. It's great thank you and and I wanted to add to that that I have noticed posting those those reports every two weeks I have seen package maintainers go and take that step and convert their packages on their own. You know not waiting for us to do a hack fast or or something you know that we would start so it is I think it is helping but there is a lot of work to do. So looking forward here to lane what what do we have what do we have down the road. Oh you're muted. I think so that's a great segue to how do we you know update help package maintainers update the packages more efficiently. One thing if anyone's wondering this and was talked about a lot early on was well can we just do like a. I'm going to call it a find and replace like well we have this mapping of the old ideas the new ones you know can we just sort of automate that in some way and that's not. That's not doable on scale for a number of reasons one of which is that the fedora. The four IDs had a concept of sort of category ID so like MIT was used to across a lot of different license texts and that's not how sdx works.  The packages and so that's sort of it's impossible for those those need to be sort of manually inspected. And then there's also a lot of some of us believe that while you know sometimes package maintainers. Don't update or look at the license except the first you know the very initial. Review and you know this might be a good opportunity to sort of double check things and otherwise you know we just sort of re. Regenerating the wrong information in a new format you know that wouldn't be good so we've now if there's a change order to that's posted on the wiki. That we thought well let's maybe. Kind of do something in the interim will map some IDs that we feel reasonably confident that are sort of a one to one relationship sdx and create. Merge requests on the or issues on those so the package maintainers a chance to actually review them and sort of a little bit of another nudge in addition to mirror slobs. Every other week kind of reminder we haven't done this yet that's going to you know sort of coming later. But in the meantime we have a hackfest planned for April 26. We need to announce that still they'll focus on the LN packages that'll sort of do some training on how. David will do a demo on how to how to kind of review a package so you know and then anyone can attend and. Review their packages during the hackfest and you know we'll have people there to help out so I think that'll be great in fact goes well maybe we'll do another one. I'm going to let Richard you talk about the the PELC data I think I've already mentioned the sort of influence on sdx and impact on other.  And we've been trying to improve the documentation like ongoing like as people have questions especially on the updating packages we've been you know and it's something's not clear. Richard I've been trying to just stay on top of that so it's it's not it doesn't get stale. Yeah so about the PELC data so PELC is this system you could say a sort of legacy system we have inside Red Hat for among other things it sort of makes use of license. Scanning and it sort of duplicates a lot of what this Fedora activity does it's mainly been sort of oriented towards Red Hat enterprise Linux. And we have this goal you know of kind of taking the license approval and disapproval data we've been kind of developing internally through this PELC tool and kind of like merging it with the Fedora data I think as time goes on that actually is getting less and less significant because as we sort of have migrated to using sdx identifiers and having this new process, we're actually getting that extra data that was, you know, gleaned from analyzing rel internally at Red Hat through this public process we have in Fedora. So I think increasingly, it may be less important to worry about merging that that sort of data but that's still sort of a goal from the Red Hat side that we want to have. Ideally ultimately the single list we speak of a single source of truth of, you know what from Red Hat perspective are approved and unapproved licenses based on you know what Fedora policy is. And then that will then you know Red Hat will use that as the license policy across all of its, you know, portfolio of community projects and and downstream commercial product and so forth. So, so that's, that's an ongoing thing but I think it's sort of in a sense taking care of itself through the progress we've made with Fedora. All right. Thank you. Everyone can see what a simple task software licensing is. Hopefully this answered some questions. I'd like to thank everyone for joining this call I'd like to thank everyone on the Fedora SBDX team for helping with this presentation. I'm going to stop sharing my slides now and we can move to, I guess, Q&A. Oh, my voice is not working. Sorry. Yeah, thank you everybody. This was really great. I don't think I have any questions because it was so thorough. I don't know if that's better. Also, I've been following this all along. So, yes. Does anyone else have a question? I said I would hope you don't have any questions. I should be able to like, you know, ask some leading questions or something. Yeah, I should have sent you some before the call. There's one thing I want to say is, David, I think you were a little bit harsh on the older process. I think there was, it wasn't just talking about like what the short ID should be. There were a lot of interesting conversations about. Yeah, so I should clarify with that. That was not my intent. I feel like we kind of had, we had two sides to that process. And it was separate groups that didn't always necessarily know the other was talking. So from my point of view as a package maintainer, I would ask about something and then I was just waiting to be told what the short ID would be. You know, and so I didn't know what the rest of the involvement was. The process we have now moving to SPDX, everything is all tied together. You can see the whole workflow through the entire process, which I think is better, but I did not mean to be too harsh on the old system. Yeah, in the old system we actually had, as far as I was involved in it, going back to 2008, actually 2007, before I was at Red Hat. Tom Calloway was exploring like, you know, issues of boss license policy at an extremely deep and intricate level and I got involved in that. And so there are all these discussions happening largely between me and Tom Calloway behind the scenes, but that was not public. And I think we're, I think we're still sort of guilty, you know, in this new system of not being as transparent about this thinking process, part of it as we could be. But I'm trying to, like in dealing with issues on GitLab, I'm trying to do a better job of kind of publicly explaining like the reasoning process. And we want to, and this is also why we have better documentation. So one thing we didn't have in the old system is any attempt to have kind of like a distilled explanation of what Fedora license policy is, for the most part. We now have a sort of a more elaborate explanation of like what is our policy around documentation license? What is our policy around bond licenses in a way that we didn't quite have before? I mean, it wasn't that bad before, but I think it's better now. And I'll just add to that. I mean, it was very really interesting, that whole process of what Richard described of looking at the documentation, updating it, because even as someone who's not like intimately involved in Fedora, but have been sort of watching and was really familiar with the list and, you know, new Tom Calloway. I, you know, I thought I was like, Oh, well, of course it's written down, like, don't we all know what it is. And so it was really interesting. I mean, I think it speaks to Tom's influence that like you kind of knew, you kind of knew what it was, the policy of what was allowed. If you watch the Fedora legal mailing list and, you know, sort of like we all got to be a little bit inside Tom's head.  And you really need to have it documented. And I think that's a common problem in open source projects that reflected a lot on my role in SBX in the same way. We have someone who's just been involved for a long time and it takes a lot of discipline to kind of write it all down because, you know, it's like as Richard said, even he's kind of, you know, having to really think about doing that, and now that we have a more transparent process in GILAP. So I think it's a common challenge. And of course documentation is usually always like lagging, right? But, you know, it's good to refresh that and think about that again. And, you know, we've done the same thing at SBX, our documentation is not great. And when I start thinking about, okay, a package maintainer has never done, you know, double the SBX has come in and like can I point them to something that like clearly and consistently explains what the process is, you know. That's, it's always a good, good improvement. I want to also clarify for anybody watching. Tom Calloway is not dead. He's still around. We sounded like we're giving eulogies here. No, he's just went to work for Amazon and open source community stuff there and is very busy. He's still active in Fedora and maintains like 300 packages or something as well. Thank you, Matthew. Yeah, I think I was actually going to say something along those lines, but that's more extreme than I was thinking. That I think we were all a bit self conscious of like, oh gosh, you know, what's what's Tom thinking during all this, like, are we, you know, it's he like, and so unfortunately, David and I did a presentation about this whole process on early days and at all things open in Raleigh in October and Tom was there and we all went and had a beer, which was lovely and he was very supportive. And of course, you know, he was Tom, but we had a nice time chatting and joking about the whole thing. So yeah, not hating us for doing this. No, in fact, I think there were a few instances reset it. It seems like you're, you're solving a lot of long standing concerns and questions I had, you know, that we're just kind of like back burner issues, which was, which was nice. But yes, he was very supportive of everything we were doing and moving Fedora in this direction. One thing that I didn't mention in the presentation, but you'll see if you go to the legal documentation site is we we did not carry over. There was the compatibility table for GPL licenses. And yeah, Richard. And that that is a question that comes up from time to time from package maintainers because that was kind of a long established being that we had in and had in Fedora and our conversations with it have have basically been around trying to figure out where that came from, you know, where that sort of, you know, concept and maybe fear of using something licensed that wasn't GPL compatible where did it come from. And there and that led down this this whole path of, I was digging up old emails about questions about GPL, GPL v3 and v2 and things like that. And Richard, I can't remember if we ever actually conclusively found we are where this started we just sort of maybe theorized that it was around the drafting of GPL v3 and that the notion of license compatibility was a concern, but now going forward. Is that something that that we need to think about in the same way. Yeah, I mean, I don't I don't know how far back Tom Callaway was was making an attempt to to sort of notate judgments about GPL compatibility it may have actually been earlier than GPL v3. The issue is, you know, so Florian Weimer said on I think the Fedora legal list and a thread about this, you know, what would we actually do someone was saying like why'd you get rid of this information about GPL compatibility. And there's there's also just a compatibility with non GPL I think that Fedora never made any attempts to provide like documented information. And Florian said, Well, what what did Fedora ever do with this information. And I think that that's that's a fair comment. I don't think Fedora in general did use this information. I think we did sometimes like there's some things with like read line in particular I remember people being very careful about that, and making sure that you know, if he hasn't made wasn't GPL compatible you didn't link it with read line that that sort of thing. I think I at least used it used it for that kind of thing. I don't know. But I don't think we were consistent. I think that's fair to say we weren't consistent and it was like you said, like, mostly a self policing thing like we saw, we saw this chart we have to follow these rules kind of things. Yeah, I mean, the, this is actually my views on this topic were shaped in part by working on these Fedora issues that basically what we found was when license compatibility issues came up, we would always find a reason to explain why the general rule didn't apply in a given case. So the exception always canceled out the rule. And, and I think that we found that there was a big divide between sort of false community. I don't know how to describe like false community doctrine sort of like removed from practical day to day issues of software development and what what software developers, what project maintainers actually do in in in terms of like like what, what code under what licenses they introduced into their projects or what license of dependencies they use there was a big divide and this is a whole kind of big topic I've been obsessed with for for a while as Jolaine knows. But I think the picture that Fedora was giving and in kind of maintaining that information was not actually helpful because because in the typical case, we would actually determine that there was no license and compatibility problem at all. And we still say, we actually have some documentation about this now because someone raises on the Fedora legalists, we explained that this is a very confusing doctrine. But if you if you are concerned about license compatibility issue, submit a bugzilla issue and we'll look into it and I think that may have happened once since we published that. And the reason I brought that up is I wanted to reiterate on the on the license tag in the spec file is enumerating all of the license identifiers that appear in code that goes into code and content that goes into the binary RPMs. What we didn't mention in the presentation was that there's no effective license computation we don't like package maintainer should not be saying like oh well that's some BSD code and that's some GPL code that means my packages GPL they're not That's a big change. That is a big change. Well, I don't agree with the change. But but but it's a change from from the practice of a lot of package maintainers. That is that is accurate. Yes. So there was an instance. So one of the reasons why we have this rule. So I would contend that it was the old rule as I understood it. Maybe I misunderstood at least how some people were interpreting it. I think that the documentation some of the documentation expressed this as the old rule. The problem is that people package maintainers were applying it inconsistently from package to package. And so we had some people applying this effective license rule. Each person was basically interpreting the GPL on their own. And so the goal of having kind of a uniform sort of system that is going to be consistent from package to package was not being realized. Now it's one of the advantages of moving to SPDX is that you can have the potential of having a uniform standard system of license description. But if everyone is kind of interpreting like licensing in ways that sort of allow you to kind of remove certain licenses in different ways from package to package that advantage is is going to be it's going to be law. So yes. Yeah. So one of the things that's come up kind of related to that. Generally, if there was any other license whatsoever on anything that said public domain dedication or this is in the public domain, we would just ignore forever because hey that's not that doesn't matter. So now we are looking at identifying those public domain statements because each of those actually is a license or often is a license or a license the statement or something in its own way at least needs to be looked at like what what is this meant to does acting like a license. I don't know. So when you see something like that, we should bring that as a possible thing as well so that can get looked at by the people who know what they're talking about. And faces at my statements. This is another case where it's really not a change. So there was a Callaway public domain, not identify a rapid name. Maybe it wasn't used consistently from package to package just like we were just talking about. Generally, if something had was GPL with some public domain things in there, no one would bother to list GPL and public domain they would just list. Yeah, so that's that. But we have packages that do use that public domain. Kind of old name and I think what you probably said without maybe even realizing it Matthews like there's a there I've noticed in my many years of like dealing with looking at license and license type information in source files that sometimes something sort of reports to be public domain but it's really a license and so you know, because of using just a kind of a short name without really describing like rules around when it was used or you know, kind of being a little bit loose. You know, those things need to be looked at because maybe they're not really a public domain dedication. Maybe there's it's actually licensed or maybe it is now in an interesting kind of potentially come full circle. Scenario what we have been doing is we've actually been investigating those and like go look at it figure out what it is and then submit it and get lab. And we've been sort of collecting those in one text file and telling people to use a license ref license ref is an SBX specification designation for a license it's not on or license type stuff that's not on the SBX license list because there's no way the license list can accommodate everything that's found in software and the reason that we did that is and I kind of anticipated that like we don't really know how many of these these things will find and what they look like. And if we just submit them to SBX one one by one it doesn't really give a full picture of the scenario so like maybe there aren't that many or maybe there's like 100 variations that say kind of the same thing and so I wanted to say like let's just kind of do it's a little bit of a potential you know possibly a a you know interim fix that we might have to go back and change later but if we collect like all these things that look like a public domain you know a simple public domain dedication is what we kind of presume it would have been under the Callaway system and then we say hey look SBX going through you know this Linux distro fedora we found you know this line I'm actually about to send an email because now we have enough data like how should SBX deal with this because SBX has traditionally always been like a one you know one ID means one specific set of text and there needs to be identifiable text people have tried to suggest we should have a public domain tag but not define what that means and like that is super problematic. Like though our license right now is one single license ref that goes to a thought so if I find a dedication and get that added to the collected file and not need to come up with a new license each one that seems very sensible. Yeah and you know it's possible that SBX will look at that and say yeah maybe we'll adopt something like that for these and there's also some like ultra we call it we have another similar thing we're dealing with ultra permissive licenses where it's it's just like a one liner with no license conditions or anything and just again we don't know how many things like that are out there and maybe SBX will say you know we are going to create like a ironically a bit of a category ID I mean I'm not predicting the future big big big caveat disclaimer. But it's defined as meaning one of these defined things right like there's no way it's not helpful to just have some undefined thing that people have to figure out what it means right that we like. And a lot of these things are like I came across one that said this is public domain do not copyright this code. Which what does that mean I don't engineer shouldn't be writing statements like that I'm going to say it's a blanket thing because it's lawyers are bad at writing licenses. No one should write any of these things stop it everything's terrible we ended up with that piece of software just changing it to an existing very permissive license that. Yeah well. The problem is is even when you change the license that old the old versions probably exists with that other line. But I mean if the door is like going to only have the new version with a new license and like great you know. The old ones don't exist but yeah. Yeah that's a thing Fedora gets to do but yeah. Well you're at the hour here. I think David had to had to leave already. Anybody have any final thoughts or questions here. Okay, well thank you again very much this was great thank you for all this work and ongoing work and explaining it is very nice. This month we are having a Fedora Linux release rather than having one of these meetings so I think we will not have a video meetings at correct Ben. Well so we had sort of preemptively cancelled it but the release party is going to be a little later than normal. Okay. So if we might actually decide we want to do it in May and skip the June meeting so that's something for us to figure out later on. So stay tuned to discussion.floraproject.org to find out. Sounds good. All right. Goodbye everybody.


Welcome to the Spring Fever Garden Forums where we connect you the gardener with the experts at North Dakota State University. My name's Tom Cobb and I'm an extension horticulturist in the Department of Plant Sciences and I'm joined by Scott Swanson who's an electronic media specialist in the Department of Aeroculture Communications. This is the third of our four Spring Fever Garden Forums and tonight our theme is fruits and vegetables. Now the format that we use tonight is the one that we always use. We start with about a 20 minute presentation and then we have about 10 to 15 minutes of questions and we really do invite your questions. They really add a lot to the presentation. Keep your questions on the topic. So let's get started with a presentation on the number one fruit crop in North Dakota. So what are we talking about? Is it strawberries? Apples? It's aronia. Aronia. That's unbelievable and I've never heard of it. But aronia is supposedly easy to grow and it is a beautiful plant. And here to share with us your expertise on growing this crop is Cathy Weederhold. Cathy's been the manager of the two-and-a-half acre Northern Hardy Fruit Evaluation Project at the Carrington Research Extension Center since 2006. This orchard is one of the coolest places in North Dakota. It has 10 kinds of fruits and Cathy loves all of them. So Cathy, welcome to the forums. Thank you, Tom. Thank you. And welcome everybody. It's good to see, I guess, see you all again. And so yeah, we'll talk about aronia. And you know that I think they are one of the easiest plants to grow. So that hence my title. So here we go. Well, first of all, you kind of have to look and see where you are in North Dakota. Carrington's in that center, right? We're in the Drift Prairie and really that's probably considered some of our best soil. Of course, the valley, we won't talk about the valley. That's the best soil, right? But that's kind of clay. It can stay kind of wet. The cateau is not too bad for growing stuff either. The Missouri Plateau, we'll look at that for just a moment. So here's where the problem is. If there is a problem, are your soil conditions? And this goes for pretty much every plant you can try. And if you've tried to plant stuff and it's really hard for you, well, you probably know about those problems already. But most of all, our soil pH is quite high, seven and a half to nine. And that's pretty much the whole state of North Dakota. So it's hard to beat that. In the upper right hand corner is a map and the red is showing where the saltiest soils are. And those salts could be calcium salts. They could be magnesium salts. But they really kind of do a number on the roots of your plant. So that will kind of limit what you can grow also. And then finally, the overall limit is rainfall, right? But we can make a change to that. We can do irrigation, but that has, you know, that means your water has to be good. So so anyway, so we do have limitations on things you you can grow. So in general, Aronia, or they are also called black chokeberry and they are used for commercial fruit. They were mainly developed in Eastern Europe. You know, well, we can talk about this, but developed in Eastern Europe and then later reintroduced to the US. It was the great plantsman, Ivan Mitterin, who who developed these these cultivars that we use for fruit production. He crossed wild American Aronia. They took Aronia plants to Russia. So he crossed those wild American Aronia plants with Sorbus and, you know, Sorbus as mountain ash. And there are different kinds of Sorbus. If you get catalogs, there's something called ship of a, I think they might be in the shape of a pear. They're a small fruit, but but anyway, Sorbus is a fruiting plant. And so was Aronia. And when you cross them, you can get a Sorb Aronia. And then when you cross them again to another Aronia, then you got these Aronia that we're using for fruit production called Aronia Mitterinia. That's how they were referred to. So yeah, there's 75 percent Aronia, 25 percent Sorbus. So it's kind of interesting. And I've seen pictures of when they do the crosses and the leaves, the leaves, you know, are kind of funky. So so just some little information for the scientists out there. Most Aronia are tetraploids for copies of your chromosome. Humans are diploids. We have two copies of our chromosome.  This means that they do not need to be pollinated to have fruit and to have viable seeds. So it's it's asexual reproduction by seed. So even if you had had buds, flower buds, and you covered that part of your plant with a bag, you will get fruit on there. It may not be as much fruit if pollination happens, but you will definitely get fruit. And you know, Juneberry are the same way. So that means that it's very hard to breed those two plants. We don't really have breeding of Juneberries and not much for breeding of Aronia. So the varieties that you may have heard of and are quite available are Viking, Mackenzie, Galachanka. They're nearly identical when they've done genetic studies on them. They're they're quite alike, even though they have different names. They're all the fruit tastes alike. I I don't think there's one person on the planet that could differentiate one fruit from one plant, what kind of plant. There is one that is a little different and it's called Nero, N-E-R-O, Nero. You know, I don't know. I sometimes think I taste a slight bitterness to it, but really it produces fruit just like everything else and same size and all. So Aronia is popular in the world, not so much in the United States, but Eastern Europe and Russia, which you would expect because that's where Ivan Mitrin developed it. They've been growing it since the 40s and 50s. And actually one thing to know is that Ukraine was actually the biggest producer of Aronia and other fruits, too, like currants. But when the big nuclear disaster happened, all that soil was contaminated in the area and no one would even want to buy fruit from that area. So Poland took over. Poland said, ah, here's our opportunity. And they became the leader in fruit production in Europe. So in Poland, about 15,000 acres, making over 55,000 tons of fruit. And they export it quite reasonably, which makes it hard for us to, you know, people to get a market here in the US. In the US, Iowa seems to grow the most. They have like 1200 acres. And then the rest of the country has another 1200 acres, so 2400 acres altogether. And in North Dakota, I was surprised to see there was an increase. From 2017, we had about 88 acres. And in 2020, 208 acres, the market is just really tough. You kind of have to find your own way. You know, making your own products. It's it's it's been really hard. And people have tried, goodness knows, people have really tried to make a market with Aronia. And I guess it's just easier to buy it from Poland, which is too bad. But if you would like to grow fresh Aronia in your in your yard, you can easily do so. You know, if your soil conditions are correct. So, you know, it's hardy to zone three. And I don't know if you know, but there's been a new USDA map about every 10 or 12 years. They update it. And all of North Dakota now is pretty much in zone four, both both for A and for B. So that's kind of sort of nice. But anyway, just you need average soil conditions not too high. We do get a little iron chlorosis in ours. And I do know someone by Devil's Lake. He's one of our extension agents. He's had a really tough time with Aronia and they have finally died because they had so much chlorosis. So that that's too bad. So I mean, the only thing you can do is try and see what happens. So this picture is Aronia that is ripe. And you can see kind of in the middle that there are small reddish berries. And, you know, we just see those and it's not exactly sure why they happen. And I've talked to people from around the country or the Midwest and they see them to, you know, it's probably just that the plant doesn't have enough resources sometimes to really finish out those berries. So you'll see them. But, you know, you can screen them out and they don't really have too much of an effect in the end.  That's pretty much how they most people will get them from from a greenhouse. A potted plant. So you can you can plant that plant at the level they are growing right in the pot or because it's a shrub, you can plant it slightly deeper. You know, for trees, we really want to keep those main main order roots. We want to keep those right at the surface. But shrubs can kind of they can go a little deeper because, you know, they can add a little roots on. And so so up to you right at the surface or slightly deeper. And then you're going to mulch around there in the in the end. So so anyway, you want to trim or break up your roots, which is a very, very good advice for any shrub or any tree that you plant. I mean, physically, take a little saw like we have pruning saws. Right. I take a cheap one. And you can saw off that outer inch of soil around the pot because you when you take the pot off, you're going to see roots going in a circle around that around the edge and just saw those roots right off or you can take some kind of an implement and break them up, spread them out. But you want to break up that circling and then planted in a hole that is as deep as it needs to be, not not really deeper. And then because you want, you know, have some have it be solid at the bottom. And then you want to have you want to have dug and then loosen the soil in an outward direction because then those roots can go outward and, you know, for a shrub, even though your pot may be about 10 or 12 inches deep of soil, in the end, the roots of your plant are going to be in that top six inches. So that's really where you need to loosen up. And then water your plant that first year, you know, deeply and less frequently, we talk about and want to make sure it stays moist, but not too wet. And then mulch, mulch, mulch, mulch, about three inches of wood chips or some other kind of material. So so do that. And then you should start getting fruit in your third year. You know, if the plant is looking green and healthy, you don't probably really have to fertilize. I have rarely fertilized the aronia at Carrington. We have about four percent organic matter, what you would consider to be a nice, dark garden soil. So it's really up to you whether you do or not. Over fertilizing makes a lot of leaves, makes a lot of shoots and not a lot of fruit. So you want to be careful about that. And really a young plant, if you don't feel like you're getting much growth on there, a young plant, you would only give about, I would say, a quarter to a third cup of 10, 10, 10. That's pretty, that's kind of an average for, you know, a fertilizer. Only do a quarter cup to a third cup per plant. And that would be an early spring. But in general, I think you're not going to have to fertilize. So, you know, just just take it, take it as a comms, I guess. So in general, the growth habit of aronia are is a non-aggressive suckering from the crown. These are pictures from when the aronia were younger, but you can see they have spread out, but they are not taking over that whole area. And sometimes some shoots do come out of there and I've cut them off just to keep them tidy for mowing and stuff. But yeah, they're not really aggressive. And then use, use your renewal pruning methods.  You just want to keep the best ones. Yeah, so that's OK. Aronia flowering, it's going to happen in like mid-May to the second week of June. It's the last, it's the last fruit to flower. And let's see here. And you can see them flowering here in these pictures. It's a nice white umbil of flowers. They smell when you have several of them. You can actually smell them. I think they smell like dandelions. And it's not a not an unpleasant smell. It's I don't know if it's super pleasant, but it's not unpleasant like Juneberries. They're they're unpleasant. Yeah, they're going to bloom. And then I do not see very many bees, certainly not many honey bees in in Aronia. So perhaps they don't have much for nectar, but I see a lot of flies. And then I will see some native bees, but a lot of flies and hover flies. So kind of our standard North Dakota pollinators nowadays. One time in in 2015, we did have some freeze damage. If it froze May 19th, pretty cold. I think it was about 17 or 18 degrees Fahrenheit. And then when the flowers open the next day, you know, and then and this is probably several weeks later when the little fruits are starting. You can see that we did have damage, but that was one year out of all these years. So, you know, it's a possibility. And then pests. We have pear slug soft flies on the left. They eat on the top side of the leaf on the right side. We have lily spugs and those eat on the bottom side of the leaf. They kind of cause a stippling that you'll see on the top side. And they say you can like wash these things off with a jet of water. I don't have water in the orchard. I do use a spinosid or maybe a pyrethroid that I have. And I'll just spray them probably once in the summer.  You know, they have a lot of leaves. They have a lot of leaves, even if you see the leaves being eaten. There's a lot of leaves out there. So when you start to see a real problem, that's when you really need to bring out an insecticide or something like that. But anyway, and then our last insect is this. I think it's a cherry fruit worm. Somebody told me about that. And I see them sometimes. I'm seeing more of something recently. And I think it's a cherry fruit worm, but I'm a little confused. The berries will sometimes be dry inside, but I cannot see an entry point or an exit point. So I'm not sure what's going on there. I hope to find out some more information on that. So so just to tell you that it takes about a month when the when the fruit starts to turn color until you actually picking it. I've looked at several years of my pictures. I take way too many pictures of the orchard. But on the very left hand side, that is the beginning of variation. You can that is that when they the fruit starts to turn color and swell. So on the upper part of that left hand picture, you can see some green berries yet. And then on the bottom, you can see some are red and actually some are swelled. So that's the beginning of a variation. And that's probably around the fifth of August to the tenth of August. And then on the right hand side, the berries are swelled, but they are not black color. You can see one black berry and that's how they need to look. So it takes, you know, they kind of hang in there for about 10 days or so at this red color. And then finally, in the end, this this picture we saw before. And this is about three to four weeks after the fruit first started turning color. You're going to you're going to have this dark blue color. They're going to kind of have a whitish haze on the on the berries. They're very dark colored. And the best way to tell if they are ripe is to taste them. And, you know, Aronia do not taste great when they are raw.   And then a few days later, you might think, well, this is interesting. Are they as bad as I thought they were? And then probably within another three to five days. Then finally, the fruit is going to be juicy and it's going to be way better tasting, but it's still going to be a stringent.  But that is that is ripe for Aronia, juicy, kind of sweet and a stringent. And you can get rid of. I wouldn't say getting rid of is too strong of a way to think about it, but you can reduce your astringency by freezing them. Almost everyone who uses Aronia freezes them first, freezes the berries. And then if you put them into something, if you put them into a banana bread, if you put them into oatmeal, if you make a smoothie out of them, if you make them into ice cream or something, the protein from those foods actually bind the tannins that are in the Aronia.  So those proteins bind it and they kind of remove it from the whole system. And you'll find these are a very mild fruit. They don't have a lot of acidity. They're probably the most healthy fruit that you can eat. They have way higher levels of the purple compounds. You can see how black they are. They have way higher levels of the purple compounds than any other fruit. So they are actually better for you than blueberries or blackberries or things like that. So they're kind of cool. And then harvesting. OK, I guess I could have gone on harvesting is in late August to early September. And I generally wear gloves. I learned in this early time that your fingers will just get completely coated with with the juice from this berry because it doesn't have a little release point. You know, like when an apple is ripe, you pick it and twist it. And then it comes off when it's ready. Aronia will never do that. And neither will June berries. Maybe you can see on the picture, there's a little hole at the top of the berry. And that's where the stem pulled out. And that's eventually what gets all over your hands.  So you I really like to wear gloves when I when I pick Aronia.  And it's not very important. I just wanted to show you that they are very productive. They're super, super productive. And production has gone up over time. And I want to highlight years 2018 and 2021. 370 and 320 pounds of fruit from let me see that it would be 16 shrubs. That's just 16 shrubs. That's a lot. And there's four plants of each of these. So Nero has four plants, Viking has four plants, seedling and select. Each have four plants. So just look at that. A hundred, a hundred pounds from the four plants. That's really too much. The fruit, it's not very good on a year like that. It is it struggles to get sweet. They stay small and so you really don't want a lot of fruit. But I'm going to tell you, it's impossible to stop it. Aronia is just the most productive fruit there is. And it's impossible to stop it. And you're just going to have to be disappointed with the quality of your fruit that year.  And I kind of see that with cherries, too, one year high, one year kind of low. You probably could moderate that with with more irrigation. And I have I started irrigating in 2021 because the crop was so big and we had a drought and really, really needed the water. So the fruit that year were really terrible with between the drought and the fruit load, the fruit were not good. They were much, much better in 2022 and 2023. So, you know, kind of that moderate amount of fruit per plant. So you'll have enough to share with the neighbors. That's for sure. You only need one plant since they don't need to be pollinated. But up to you if you want a couple, you never know. The birds don't really share them with you, which is kind of nice because because they're smart. So, yeah, today when I was looking, I was looking at like the quantity of fruit that Poland produces. And I came up with this this website, Aronia Eggert from Poland. They produce a lot of plants to sell and there they deal in Miro Aronia. But they do, they make a lot of products here. I once read that Aronia was the second favorite ice cream flavor in Poland. I don't know, but there's juices, there's liqueurs, there's chocolate covered Aronias, which I'm sure are dried Aronias. And then they cover them Aronia honey, Aronia jam, Aronia wine. We have Aronia wine in North Dakota and it's pretty good. It's pretty good. So there you are, all kind of products you can make from Aronia.  I've people from Minnesota have said, oh, this is a terrible fruit. But I think, you know, if you just try it from the plant and you don't try to do anything with it, that might be your only opinion of it. But if you can mix it with something that has protein in it, you'll be really surprised. So, all right, that is Aronia here and I'm ready for questions. OK, Keith, here we go. All right.  Berry, yes. That's right. Now there's someone from Saskatchewan who's wondering, does choked berry take the same as their native choked cherry? They do not taste alike. The choked cherry is very almondy and a little more sprightly. The Aronia are quite mild.  No. Yeah, they're different families.  Yeah, but they both make you choke. Yeah. How about what's the size of an Aronia berry? Is it like a gooseberry or a currant or like a gooseberry? Like a gooseberry. OK, yeah. OK, now this person's already inspired by your talk, Cathy. And they say you just have limited space in their landscape. Would Aronia be the fruit that you would grow? If it was the only fruit I had. Yeah, only a little space. If you had only a little space, actually, there is Iroquois beauty. And there are some other landscaping varieties like low mound, moundscaping, something like that. They actually produce edible fruit. I would actually go for Iroquois beauty, a smaller plant. Maybe it gets three feet tall. I think it's from the Morton Arboretum and it's in catalogs. And it's a nice small plant and it would not overproduce for you. I mean, it might, but for its size, it wouldn't. And then you get the benefit of the beauty like the great fall color and the flowers. Yep. But some fruit. I don't know. Personally, I would not plant Aronia if I just had a little space because that I'm sorry. Well, how healthy you'd be, though. You got a good point about that. You could convince me and it's easy. That's the other nice thing. It's easy. So it doesn't take a lot of work. No. Now, how about let's see here. Can this person wants to make a whole windbreak of Aronia? Can we buy it, bare-root plants? I think you can, but I'm not sure where. How about Mackenzie from the Plant Materials Center? The soil conservation. That's what I was just thinking. The Plant Materials Center developed Mackenzie and the soil conservation districts have them. If you're, I'm not sure how homeowners get stuff from soil conservation districts. I don't know if you're only allowed to have the excess or they can order for you. That I'm not clear on. Well, you can get it if you pay for it. So maybe it sounds like Mackenzie is a good way to go because you said that it's just, I mean, it would be much more affordable than a liking. And you say they're identifiable. They're just as good and they actually produce a lot. And I think they're really a little bit better. They were selected because they grow more. They have a lot more suckers from the crown and they get really thick. And I find the fruit just a little bit juicier, a little bit bigger. And I don't know if there is an age difference in my plants. So that's, you know, always confound stuff a little bit. But I do like the Mackenzie erronea. Now you say it's suckers. Does it sucker aggressively? No, just from the crown. Just from the crown. It gets really thick as it comes up. Okay, good. How about the birds like choke berries? I think birds do not like choke berries. I've only seen like in some years, when the Robins are really desperate, they'll, you can see beak marks. And the wax wings came in in 2021 when it was so dry and they tried picking at some. But in general, the birds don't like it because I bet it dries their throats out too. Yeah, maybe, maybe like this time of year when there's nothing else to eat. Yeah. They're desperate. Maybe they've mailed out a little too. They might.  How about deer to deer like erronea? I'm sure they do. They're in the apple family and I'm sure the deer love them. Okay. Now, what's the height of an erronea shrub? They're taller than me. I'm five foot six. So they probably get around six feet, maybe six and a half feet tall, something like that, and kind of round. So as big a round as they are tall. Okay. Now, when you make juices, do you have to remove the seeds ahead of time? I do not. I actually just steam juice them, put them in the steam juicer and turn it on and get your juice out. But you could also press them. But no, you don't need to take the seeds out. We'll have a wildlife questions here. How about, what do you think about rabbits? Do rabbits like chokeberry? Rabbits would love them too. I'm sure they would. We've had, we haven't, we don't have rabbit problems, but we have had sometimes rarely, but voles, we've had voles chew on them a little bit in years where we've had a really a lot of snow. So I would consider them to be an edible plant. So now we're back to the seeds inside the fruit. So is there like four seeds in a fruit or how does that work? There's five. There's five. There's five. Five petals and there, so you can have up to 10 seeds. But how big are those seeds? Small, like a raspberry seed size, but not as hard as a raspberry. Okay, that's small. And you just, you can eat those seeds. You can eat them. Yep. Have you ever preserved aronia? I have made aronia jam with them and I found the jam to be astringent, but then I made jelly and the jelly was fine. And how about, let's say you find some aronia plants in the wild. Can you move them? If it's not a public place, I would assume, but I don't think you'll find, you won't find aronia growing wild in North Dakota. I don't think, but you might in Nebraska or somewhere in Missouri. I've seen them in Maine. Actually, I was canoeing on a little lake in Maine and I saw aronia and I tasted them and I thought they were fine. So they were our native, that was native aronia. Kind of cool. Okay. So I think what you would do is, if you wanted to move it, if, let's say it's your own aronia bush and you wanted to just move them to your other side of your house, probably like maybe like kind of now, like, or pretty soon early in spring. Yeah, the spring would be a good time. I would say spring when they're still dormant. Yeah. And if it's kind of a big plant and you need to move it, I would prune it off so that it was kind of small because then the roots are damaged and they don't have to try to support that whole top part of the plant. Okay. This person's got, as a sad case here, they got a five-year-old aronia plant. It's just one plant all lonely by itself and it's not producing the leisure yellow. I'm wondering about chlorosis. Chlorosis. Yeah. You know, the best thing you can try is sulfur. Sulfur, sulfur, sulfur. And I talked about that recently for somewhere. Maybe it was like Williams County, I talked about it, or Ward County. It was for Ward County. Why don't the person who asked about that could try to email me at the Carrington Research Extension Center? It's my name. Oh, it's here, right here. Kathy.Wederhold at NDSU.edu. And there's also an extension bulletin on iron chlorosis. That's really nice. How about get a soil test? And get a soil test. Yes. Just so you know what's the pH, right? A soil test is an excellent idea, like 25 bucks from the university. There you go. So choked cherry can be grown in zone three. It can be choked berry can be grown in zone three and zone four. No worries. Everybody in North Dakota can grow aronia. Everybody can grow it. Yes. Okay. Now it says here from Golden Valley Swell Conservation District, you can order plants. Every conservation district is going to have it probably. Just reach out here. Probably. They had a seed failure a few years ago, so then they didn't have aronia for a couple years. So check it out. Couple bucks a plant. Yeah. If it's available, it's a couple bucks. Yeah. Take a trip to Iowa maybe. Poland. Yeah. How about to aronia plants have thorns? No. No thorns. No thorns. Okay. Easy. Now we've got a southerner. We can grow it in zone three and four. Well, aronia grow in zone five. Yes. Of course. How about? Probably good to around seven. Yeah. Five sounds like Iowa. Could be Wisconsin.  Me too. How about, how do you prune an aronia plant? Well, the best way is to do that renewal pruning.  And then, you know, cut out the crossing stuff. And if you need to reduce the height, you find a bud and you cut about a quarter inch above that bud. And then that's where the new shoots will grow from is at that bud. So our website also has some pruning information on it. And there's, I'm sure there's, there's so much pruning information out there. Yeah. Now how about for a cheap person doesn't want to buy a plant for two bucks. They want to propagate it via suckers. Can we do that? Can we just dig out the suckers? You can do that. I do not believe that the Aronia are plant protected. I don't think they are. Oh, those are old varieties. The patents are all gone. Yeah, yeah. Yeah, but it will work. And they will, it will work. We weren't that worried about the lawyers. Some of the suckers have. I know it will work. It will work. It will work. It has, if it has roots on it, it will work. And they, they do those, some of those side ones come out and they'll have some roots on them. Okay. Let's, okay. Kathy. Okay. Get a great job, man. I'm, I, I, I'm really thinking about planting some Aronia because it's so easy and it is beautiful. I'm not. Yeah. Yeah. Sounds good. You're all right. So thank you so much for your talk, Kathy. You really enjoyed it. Okay. Sorry. I'm so enthusiastic. We love it. Keep it up. Okay. Bye everybody.