Hello my DevNation friends, welcome to another Tech Talk. And today, if you like Quarkus, if you like web frameworks, today the talk is for you because we have a very special guest. I'd like to ask my friend, Stefan and Pardo, straight from Nice, I suppose, he's not traveling. Welcome, Stefan. Hi. Welcome. And thanks for pronouncing my name brilliantly. That's exactly it. Oh, yeah. Well, I studied French one year French, 25 years ago. And I hope I did a reasonable job. Absolutely. Perfect. And so, Stefan, today we're going to be talking about Quarkus-Henard. And I know that we have some Quarkus, we already have Panache, which is a French word, we have Henard, which is a French word. And I can see a pattern there. And maybe you're involved in this. So can you tell us why Henard? Yes, there is indeed a pattern. This is both our projects that I started. And I guess I'm really bad at finding names. And then I, at some point, I find a name that sticks in my head and it doesn't leave anymore. And for this one, I found the Renard name, which is a female fox. Because I thought what I was working on was a web framework which was trying to be smart and cute and clever. And when I thought about these qualities, then I thought about a fox. And female foxes, that's my opinion, if I'm not cute and smart and clever and agile. And so that's the thing that's stuck in my head, and that's why it's stuck. Yeah, good qualities for a web framework, right? Yes. All right, so let's see what we have with how amazing it is, how amazing Quarkus Henard can be, and I'll leave the stage to you. So today, live from Nice, France and Cary, North Carolina, welcome to Dev Nation. Thank you. So let me start the slides. I'm here to show you Quarkus Renard, which is a North school web framework, but modernized and running on Quarkus. So what is it exactly? So I do mention Panache. People ask me this question a lot, why are some extensions named after French words? That's because we have a lot of French developers working on Quarkus, and some of them just have this coming in mind. So what is it really? It's a web framework. It's very old school. It's not at all modern in the sense of the current way of doing web frameworks where everything is on the client. This is really something that is more akin to Rails and PlayOne with a, you know what I mean, attitude. We want the framework to let you do things as easily and short and concisely and intuitively as possible. It doesn't get in the way. It tries to help you always to what you want with a minimum of ceremony. And to that end, we use a lot of existing Quarkus features, like the server-side templating that we have with Qt. We use persistence with Hibernate ORM or reactive with Panache, which helps you a lot to cut down on ceremony as well. We use JaxRS and REST easy reactive, but something very enhanced that allows you to write your controllers and endpoints much easier. We make it very easy to deal with URIs, URLs, and redirection, et cetera, which is very important in web frameworks. We also use webjars to help you get client-side dependencies such as Bootstrap, jQuery, whatever. You name it. We use webjars so that you don't have to download them and package them in your application. Then we also have a lot of security integration with JWT, OpenID Connect, and web often fingers in the nose that we try to make it as easy as possible. So Qt. I don't know if you're familiar with Qt, but this is something that is in Quarkus that has been in Quarkus for a while already. It's a way to do server-side templating. But it's not just Qt and something that, because Qt is already more than two years old, there's been a lot of new additions to Qt lately, and this is very interesting to show, such as global variables with type checking, simpler type arguments, type type arguments, a lot of user experience progress, and we'll show in the demo integration with a VS code. When I talk about checkserries++ and REST easy reactive++, this is because we have much simpler endpoints with a lot of convention, such as your get methods don't need to be annotated with get because this is the default annotation if your method is public. Whenever your method is annotated with put, post, delete action, then by default we add the transactional attribute annotation. We also have implicit path annotations, and all this you opt in by extending a base class called controller, which allow you to get all these benefits for free, and a lot of methods as well that come from this base class. Whenever you're in a controller and you call another endpoint method, then instead of actually calling the method, it will trigger a redirect to this method, which is very handy to get down on ceremony because there's a lot of redirects going on when you do a web framework. If you don't want to do a redirect and you just want to obtain a URI, then we have a special method called router.getURI to which you pass a method pointer to obtain the URI to this method. This is something if you've done Jaxrs before, and you will know exactly what I mean because this is much simpler than the existing alternative of using reflection to get URIs. In templates, you also need to get URIs, so you have a special template, which is whenever it starts with URI column, then class.method, then you can point to the method you want to get the URI and pass the arguments directly there. It will build the URI for you. We have delayed validation for richer validation, which is something I will show, and the flash scope, which is also something that is very handy, which allows you to pass values from one request to another, especially after redirect. That's very handy. We have support for security, making it as easy as possible to do security with utility classes that help you secure your application in favoring JWT for user sessions. We also have a lot of utilities helping you deal with OpenIDConnect and WebOften. In all the cases, they work together. There's trivial configuration, great documentation, and lots of bug and UX fixes, and also support testing, where we provide mocks for both the WebOften hardware and OpenIDConnect providers, such as Twitter, Facebook, whatever we mock them, really trying to help you get everything working in your application. So now, next to be done is a to-do app. What we want to do in this demo is show an entire application from start to finish with user management to do handling and really an entire application written in runout. So as I said, maybe I didn't mention it, runout is a Quarkus extension, so the only thing you need to do is when you create your Quarkus application is to import the Quarkus runout extension, which has a few other options such as OpenIDConnect, OpenIDConnectTest, which with the mocking, et cetera. But mostly you just need to import the Quarkus runout extension in your Quarkus application, and then you will get the benefit from it. So when you create your Quarkus application, which we started here, I have a Quarkus application with the runout extension and a bunch of other dependencies, such as Postgres, I'm using Postgres, I'm using WebAuthn, OpenIDConnect, et cetera. I have my application running in Dev mode, and I have it running here, and whenever I go to the root of my application, I get a 404 because I don't have anything there. All right, so the first thing we're going to do is fix this. We're going to go in our sort folder, but there's a lot of convention in runouts. So here I'm going to create a class called application in the REST package, and I want this class to be a controller. So I make it extend controller out, and this allows me to opt in all the gray features and simplify Jack's REST. So I can just write string hello and return hello. And this will define a URL starting with application slash hello, which returns this. And I can go back here and paste it. I hit reload, and you can see that at some point I have this application slash hello appear. So I can try it, application hello, and I have my input. All right, this is cool, but this is not exactly what I want. This is the default path, but you can override it. And I want here actually to make it so that this happens at the root. So I go back here, and I'll reload my application. It takes a bit of time. Normally, hot reload is really fast on Quarkis, but in this case, I actually have a lot of OpenIDConnect configuration going on. And these hit a few endpoints going and querying Twitter and Facebook about configuration. So this is a bit slower than usual, but normally it should go like a few milliseconds for reload. So you can see here the root of my application is this. Now I want to make this a bit more complex. So I actually want to return a template instance. I want to be able to return a template called this index. And here I want to be able to say, I want a web page. So I'll use Qt and use check template, which is the way that we define type safe templates in Qt. And by convention, we put this in an aesthetic class called templates. And here, every method that is public static native and returns a template instance is going to be a template. And this is how we define the... Wait, why am I not... Should be... Well, okay, never mind. Yeah, that's the problem. I'm using the wrong key binding. So template instance here. This is how I define that I have a template and that it doesn't take any bar meters. Here I have a quick fix that I can use to create this template class. By convention, it's going to be in a folder called application with a class name and then the name of the method.html. But this is not really what I want. What I want here is to be able to include... Includes main.html, which is my main template. And then I'm going to pass a few parameters to it, such as the title. So this is going to be the title of my page. And this is going to be the body. So if you follow this link, you can see that we defined here the main template, which will insert the title. And create an HTML document with a bunch of stuff coming from Bootstrap that comes from the webjars. Which is something that we defined here as a dependency. We depend on Bootstrap, Bootstrap icons, and Quarkus webjars locator. That allows us to get all these CSS and JavaScript dependencies automatically downloaded and packaged in our application. And then I have a little bit of a menu and a little bit of a cute template that if I have a message, then I'm going to show it. And otherwise, I'm just not going to do anything. So here I have my template. It's called index. And what I need to do here is return this template. So we do that. Templates.index. And this is what I return. And now if I go back here and I click reload. I should have my application. All right, that's a bit big. So I have my application here. And now what I'm going to do is add a second page. I'm going to add an about page. So here I'm going to copy this method and say that if I go to the about URI, I'm going to call the about template, which I'm going to define here. And I call it about. And here I'm going to define that I pass a parameter. I don't really have a good name. And I'm going to say pass this parameter here and say image. So I'm passing this parameter to here. I'm going to create this file. And because this is a bit boring, I'm going to copy this one. And this is going to be my about page. It also extends main. And it says this is about param. That's the parameter that I defined. And you can see that the ID knows about it and knows its type. So I get even proper completion because I know it's string. Because I defined it here, a parameter of string. So now I can say this. I'll be about page. And I can go here to my application and go to slash about. And I should have my page. This is about the nation. All right. So now I need some navigation because I've been typing those links. Those URIs myself. And this is a bit annoying. So I want to be able to say that if I click on the to do place, I want a URI that directs me to application index. And here I want a menu item. Menu item. I have to remember exactly what I, how I named these attributes, but I think it's title. It's title and the implicit one. So title is going to be about. And the implicit one is going to be URI to application. So this is a tag from, from Qt. And you can see if I click there, I go, and you can see that all the files. HTML in the tags folder are automatically created as tags that you can include in other places. This allows for great composition in your, in your templates. And let's go back here and hit reload. And I should have a menu. Now if I click here, I go to the main page. If I click here, I go to the about page. All right. So you can see we make it really easy to get URIs in the, in the views with this, this special thing. So now we have the skeleton of our application. Let's go and create the to do application. So the first thing we do is we go in the model and we create the to do entity. How do we create the to do entity with, or I'm with Panache. We define that this is an entity. And we extend Panache entity, which allows us to get all a lot of good stuff for free, such as having an ID and being able to define all the columns that we want to persist in a public field. So I'm going to say that I need a task. I need Boolean to know if the task is done. And then I'll need it to know when the to do is done. So this is what I need for my entity. And I'm going to create also a static method, returning a list of two here to be able to get the list of to do. So I'm going to use methods defined on Panache entity, such as this whole, and I'm going to sort them by ID. This way that we always get the same list in the same order. Now I'm going to create a controller. And for to make it easier, I'm going to call this just going to rename it and copy it. So to do this controller, I'm going to have a single method for now, which is going to be to do slash index. And what I'm going to do is I'm going to say that the template is going to take a list of to do. So list. And here I don't need a special path. I don't think so.  All right. So I've got my controller. I have an index template that I need to create that takes a list of to do. So let's do this here. I'm going to copy the about template that can be fine. Start. This is going to be my to do this page. So what I'm going to do here is I'm going to create table. And I'm going to have the first row with headers. I'm going to have the ID. And I'm going to have to do. And I'm going to have actions. Now I'm going to iterate. I'm going to create a row with three cells. I'm going to show the ID. Then I'm going to show the task. And let's start with no action. So I'm going to display the to do list. I have everything to display. Now I need to add a link to this in the menu. So here it's to do the index. Go back here. What happens when I click to do. Oh, I have an error. I'm doing a blocking operation on the I operate. Of course. Should have configured this. So what happens here is that I'm using having it. All right. And so I need to add the. An occasion here to say that I'm using a blocking framework. And this is then going to be fine. I should define this in on the package, but it doesn't matter. So here I have a list of two dues, but it's it's desperately empty. So what I do usually in this case is I add a file to the. have a list of to-dos, but it's desperately empty. So what I do usually in this case is I add a file called startup, which is going to be application scope, that is blocking. And I'm going to define a method startup, which is going to be called startup. And the way we do this on Quarkus is that we make it observe the startup even from Quarkus. And this is going to be called at the start of Quarkus. Now I'm going to create a new to-do with a task called Concentration. And this is going to be done. I've started this. When was it done? I'll say done date equals to date. Util. And then I'm going to process this to-do. I'm going to create a second to-do and I'm going to make this one not done yet. Do the definition talk. Because I'm going to create some persistence, I'm going to say that this is transactional because this is not a Quarkus run-out controller. So it's not automatic. So this should do the job. And now it's startup. I should have automatically created a set of to-dos which you show up here. All right. But here I don't see that one of them is done and when it was done. So let's go and improve the rendering of this. What I'm going to do here is that if to-do done, then I'm going to make it look removed and add on to-do done date since property. So at this point, you might be wondering, hold on, this is supposed to be calling this is supposed to be calling date methods, right? And there's no such thing as since property in date type. So what happens if I click there? You can see that I'm going to a file called Java extensions which has an annotation called template extension which allows me to add additional extension methods to existing types such as date by defining static methods and taking the first parameter as the type to which we have the method. So here the first parameter is type date and the method of the name, the method is named since which means we're adding a method named since to the date type and Qt will automatically call this static method to get extra methods on existing types. This is very handy. And in this case, we're going to use this. So let's go back to the view, click reload. Now you can see that one of them has been done 12 months ago. All right. So we can display to do this. Now I'd like to be able to add to do. So I'm going to have an action and I'm going to add here a form which points to to do the ad form. And I have here another tag that will help me which is called field. And I think I forgot the name. I need the name and the label. So name equals task. Equals task and I'll add placeholder as well. And this is going to call the ad method on the to do style. So now I need to create this ad method. And here the way I do this is that I define that it's both method doesn't do return anything, but it will take a rest form element which is the task, the element that you find in HTML holding. So here I'm going to say I need a new to do to do the task equals task to do the persist. And then I'm going to, so I'm persisting the new to do. And now I'm going to redirect to the index. I do this by just calling the index method. This actually triggers a redirect. It will not call this method at all. It will just throw an exception and redirect to the index. So now if I go back here, I have my field here. It's not exactly where I meant it to appear, but it will do. Hello, this works. Okay, well, here I have a problem. I'm missing validation because I've just submitted to use that warranty. And this is not what I want. All right, so I'll add validation. I'll add here that it can't be blank. This is having a validator in validation. This will make sure that if I call if validation failed, then everything will be set up automatically so that everything works and is forwarded back to the views. I'll show you exactly what I mean. If validation failed, I won't redirect to the index and be done. Again, this is this throws. So the flow doesn't continue. I don't need to change anything in my views. And here, if I go back here, I had reloads and I try to type enter. I get an error because it must not be blank. So what happens here is that if validation failed is a method which checks if the validation has errors. And if it has errors, it does a few things, such as prepare for an error redirect, which will take all the parameters we've taken, put them in the flash scope in preparation for a redirect, which happens here when I call index, I redirect to the get method. When I get to the get method, I see that I have a flash scope with values. I take all these values and restore them. And so that when I render the template index and I go back here and I go in the field, I can see I have here a bit of conditional says, if I have an error on this field, I will show the error for this field. This allows you to do validation very easily and pass all the validation errors that you need to your views. So now let's add a few more actions. I'm interested in two actions here. I want to be able to delete, to do. So I'm going to add a new form. Well, let's do it like this. To delete, to do.id. And I'm going to make a button, put strap between the danger, I think. And then I'm going to have another one. Well, I'm just going to keep this one for now. I think I will add them to the other one. So I go back to to dos. And here I want to have post method, leads and rest path. I'm going to do it on the path, this one. Now, id, I want to take the to do, id. So to do find by id, id here. I'm just doing a find by id. And I'm going to call a method called not find if null, to do, which will throw a 404 if the to do doesn't exist. And if it exists, then I'm going to delete it. And I'm going to flash a message. Add a message to the flash go saying the gym. And then I'm going to redirect the index. This is what happens when I hit delete. All right, so let's go back to the view, hit reload. Now I have here an action that allows me to delete items. And I can still add them and delete them. All right, so it works. So you can see it's fairly easy to define actions, model, controller, reviews, everything falls into place. But now I have this to do application. I like to secure it and make it possible to have users register on the application and verify that they have a set of to do's which belong to them. So to that end, I have here an entity called user, which has a bunch of properties such as username, first name, last name, password, email, confirmation codes, and a few methods such as find by username, find by confirmation code. And I have a login application, which allows me to do a number of things. I'll have to show you the UI for this maybe first. So I'll go here and I'll show you that I have here a login page and I'm going to add this to the menu. So in the main HTML, I'm going to have a login page here. I'm going to the login and show you the UI. This is going to be simpler. So here, if I go to the login page, then I have two options. I can either login by username and password or register and verify in email. So let's see what happens here. This login page, what is it exactly? It's pretty simple. We have two forms, one that calls the to login method on the login controller and passes username and password. And the other one calls register by email. So what do those do? If I go to the login controller, I have here the login view. And if I call do login, I pass it a username which cannot be blank and the password. I verify, I do validation verifying that the password has been set if the validation failed and I go back to the login form. If not, I find by username. If I don't find it, then I say that the username is wrong. If I do find it, I will verify using bcrypt that the password matches the encrypted password. Well, not encrypted but hashed. And if it failed, I go back to the login page. And if it doesn't fail, then I do a redirect using the get URI API to obtain a URI to the application index page. And I set a new cookie asking Ronaldo to make a user cookie for this, which is a JWT cookie, which will allow me to log in. So here I'm going to create a user. First name equals theft, user last name equals Ronaldo, user email equals theft, user password equals bcrypt util hash secret password. And then user purchased. And I'm going to save this user. I'm going to be able to say that the owner of this to do is my user because I want this to belong to this user. And the way I do this is by adding a new property, adding this field and say here, this is my user and this is a mini to one, this is the relation I have. And I want to be able to then display only the to do's from this user. So I'm going to change a bit my query here and call list, which takes a query by, this is the query, this is the sort, and these are the parameters that I want to pass. So I want to query by user and all those that match this user. And I have to adapt my to do's controller saying that here, I want to be able to say that this is a controller which has a user of this type. This allows me to get a bunch of very interesting operations such as getting the crunch user, pretty useful. Whoa, not this one, this user. And here I'm going to say that when I add a new to do, I'm going to remember the user. And now I'm going to here do another thing, make it blocking so that I can go in the main template and display the user. And let's go back here, main template. And I'm going to say that here, I'm going to display the user. I'm going to do this here, user, in fact, the crunch user. So let's go back. Oh no, I can do conditional here as well. I want to be able to say that if I don't have a user, I don't want to be able to add the link to the to-do page. So if I have a user, I want to be able to do, to go to the user page, to the to-do page, and also to be able to log out. And if I don't, I want to be able to log in. And then I close my, I think I have a final thing missing to be able to pass the user to the view, but I think, no, this is set up, okay. So this should work. Now, normally, to be able to log in my application, no, something is missing. Email, yeah, I didn't add the email. Did I, did I add the email? Users, I think the, probably the user was not found. Something happened weird. Here, main template, inject user, username, well, there is a practical email in the user. Is there not? This is, but I forget to set it. User to email, the user persists. No, I have everything. So, hey, I'm not sure what's happening here, but I can see that I'm getting a bit late. So probably I'll need to cut short this demo. I mean, I'm not sure what's happening. In cookie, no, I don't. Talk to you, there is now half, which would be a beauty. I don't think I can, I don't want, yeah. I'm already going late. I'm sorry about this. I'm going to show you quickly another feature before I go back to the slides and cut the short and read, sorry about this timing. So in the login, I have another method here called register, which allows you to register by email. So I pass the email and I create a new user. I persist the new user and then I'm going to send an email to the user and how do I do this? I do this by having another check template as I showed earlier, but instead of pointing to a view that will be showed to the user, this points to a mail template instance. So you just change the return type and this allows you to define a template that will be sent by email. So when you call templates.register, then you can say from this person to this person and send the email. And this allows you to define your emails using templating again with Qt. And so you have two variants, text file, HTML files and this allows you to send emails very easily. I'm really sorry about this demo not working. I don't understand what happened, but I'm already, so I'm going to skip this and I'm also going to skip showing you OpenIDConnect and web often. I'm really sorry about this, but I'm running late and when it's not working well, it happens. So let's go back here. So, what now? Quark is found out was released on Quarkiverse which is where we put all the non-core extensions in Quarkus which means it's integrated in, when you go to code.quarkus.io, you can get it and it's going to be listed and you can create your application from the start with the run out. The support for it was added in Quarkus 2.8 and the remaining OpenIDConnect providers such as Twitter and Spotify and also web often support is added in Quarkus 2.9 which should be out any moment now. Conditory release one was out the door already. The entire application, the entire code for Quarkus run out is on the Quarkiverse GitHub repo and the to-do sample app with everything working actually this time unlike my demo is also on GitHub under the Quarkus run out to do folder. Next in line is going to be integration with web components and maybe Quinoa which is another Quarkiverse extension aiming to do web framework at this time on the client side. Maybe we can have a mix of client and server side web frameworks together. That would be very interesting to experiment. I have a branch at the moment I'm working on with scoff-holding allowing you to automatically add a back office generated website to allow you to update your entities when you don't have time to deal with this. I'd like to make sure that internationalization is trivial to do in run out as well. So that's another thing that I want to add. And of course while we're looking for users and feedback so contributors would be even better but even then it's already something that has two applications, two real applications ported to it and several users looking at it. So it already has a lot of features but it's still early on so don't hesitate to try it out and tell us what you like, what you don't and tell us if you want to change anything or bring it to a different direction if anything is missing or what. We would really like some feedback about this.  I'm sorry I ran over late and the demo fizzled at the end but sometimes it happens. Yeah, that's how we know it's a live demo and don't worry, content was great. We're happy to have you here. And my first, it's the first time I'm seeing Hennad and my impression is that, whoa, it looks super productive. So yeah, Kudos on the great work and we do have questions and actually some of them I was wondering myself. Let me try to see here on the list. And so the first question is from Daniel. So if I understood correctly the classes have to extend the controller. For endpoints, yes. This is how you opt in to all the magic that we do on top of Jack Serres. This allows you to have regular Jack Serres endpoints if you want that will not be touched and will not be magiced. And if you want them to be touched and magiced and opt into the whole magic thing, automatically adding annotations and redirects and all then you need to extend control. And Bruce has an interesting question. Can templates use JSF? No, no, I don't think you can use JSF. No, no, I'm sure you cannot. But I don't think he wants to really the the Qt templates are really nice and there's great integration with the IDE and there's a lot of features in Qt that you won't find in JSF. And it's old school but it's not that old school. JSF is really old and was not really built with the proper web mindset and had a lot of cost associated to it which we don't want to have in Qarkis. And also due to the ability to compile your application natively Qt has a lot of support, especially for that and benefits a lot for, we get a lot of benefits from using Qt with regards to native completion. So we get great performance and great features that would be very, very hard to do with JSF. And if I'm not mistaken, I think there is a Qarkis extension for a JSF too, don't we? Maybe there is, but I'm pretty sure it won't work with Ronaldo or I don't see how it would if people are very interested in this then maybe we could add it but I'm really not sure this is the right direction for templating. Yeah, I too understand that that they're completely different approaches. You have templating and have JSF components. So I understand the difference. And you can as well, I love JSF but I can see how I could use to love Ronaldo as well. And let's see another question from Daniel, probably about the email templating, like should we have two templates for the email, HTML and text? And if yes, how will be decided which one is sent? Actually both are sent. So you could have only one if you want to send only HTML emails and if you want to have only text emails, then you can have only a single one. But if you define both, then the email is sent with the proper, I can't remember how it's called but email supports a combination of multiple media types. So actually when you send an email, you can send the variance of the email within it. And so you have a text variance and HTML variance and then the user who's receiving it will, if he's reading it in mud, he will display the text email and if they're reading it in Thunderbird or Gmail, they will display the HTML email. So they're actually bundled together. It's a single email and that's supported by the email protocol. Oh, pretty cool. And Daniel seems to be very interested because he has another question. Like, is there a roadmap? No, when internationalization will be integrated? It's something that we really miss and he needs to support three or four languages? Well, there's no roadmap per se, but I also needed for porting more applications that I have. I have a bunch of applications running in production for 12 years now and they're all written in PlayOne. And I've ported one already to Quarkus with the Ronaldo and I want to port the other ones and they do need internationalization as well. So it's definitely on the roadmap and I know that Qt already supports internationalization. So maybe it's just a matter of documenting it or maybe there needs to be a bit of blue going on, but I'm sure it won't be hard. So it is on the roadmap and if it's urgent for you and you try Ronaldo and that's the thing blocking you then you can also help contribute it and then it will go faster. But I'm fairly confident that it should not be a lot of work because Qt already supports internationalization. Oh, and then you're saying, well, glad there is a version 1.0 now because he was waiting for it to use in production. So Qt is for the great work. Thanks a lot. And I'm trying to see here, I'm glad to say hi to DJ Maddy. DJ Maddy is one of our Dev Nation champions. He's always here watching the sessions. So hi, DJ Maddy. And I think we're out of questions. So, Stefan, thank you again so much for being here. You're always like, super welcome and super helpful when we ask you to present some of the great stuff that you're doing and let me put your screen here showing like the, the Ronaldo, is that the official logo that this is? Yes, I kind of minded it, it's a really like it. Cool, so thank you very much. Thank you all of our for our Dev Nation attendees, viewers. You're super welcome here. Just as Stefan is welcome here to present. And I'd like to thank you for all and see you soon in our next Dev Nation offering. Thank you very much. Thank you for coming. Take care. Bye.


point that you raise about smoking in pregnancy is of huge importance. I would actually say that that increases the priority importance that should be given to this particular piece of legislation. It also increases the importance of making sure we get across key messages. So for example, many of those who will be smoking while pregnant in deprived communities may have a sense of fatalism or despair. A critical message to get across is that if you smoke during the first trimester, the stats tell us that your baby should be born unaffected by the impact. So there's an imperative there to give up within that first trimester. So the messaging is absolutely critical but the work that we've done with communities is actually encouraging and I think what we need to do, if Scotland is going to achieve its ambition by 2034, we need to take this on as a society, we need to see this as something that's empowering, we need to recognise that if you as a couple are smoking a pack of 20 a day each, then by the time your child reaches 18 or 21, you could have had £100,000 that you could have given to that child. That's how Scotland needs to address the matter, but to come back to the specifics of this, what attracts us and the reason we're so supportive of this is because we see this as being a particular piece of legislation which has immediate and long-term impacts in terms of safeguarding children's long health and has very, very significant support, not just from the population as a whole but crucially from those people who smoke. Yes, but we're at the stage, the bill's about legislation enforcement. So if it had been all wonderful and the messages we're getting across, we wouldn't be at a stage where we're legislating and enforcing. As well as the legislation, there's a continuous hope of that educational message, refining our public messages and specifically targeting those people who we're talking about here. It's not the wider population that we're talking about, that's the point that you made and I agree with, but we're talking about legislation and enforcement. We anticipate that some people will not listen to that message, so how do we ensure that this is enforced effectively in terms of the bill? I think that you're right to flag enforcement. Our belief would be that the police, because they routinely are out-checking vehicles, enforcing other legislation would be best placed to monitor and be part of the enforcement in this. We're aware that environmental health, the Royal Environmental Health Institute for Scotland, has also said that they would be happy to work with the police to enforce this properly in Scotland. I take you back to the two pieces of New Zealand research that I mentioned previously following the implementation of smoke-free legislation. They concluded that there was a drop in the likelihood of children going on to take up smoking as a result of smoke-free legislation in vehicles, which was independent of smoking in the home and other areas. I think that this legislation looks like an investment in the next generation. Do you believe that you'll have the support of those hard-pressed communities who are enforcing smoking legislation in cars rather than scarce police resources being used to tackle the money lenders, the violence and the drug dealers in the street? We would divert people police away from that to enforce smoking in cars. We would hope that it could be done as part of their regular traffic duties, rather than be an additional significant burden. The parallel that I look most closely to is in terms of seatbelts. What we found was that when legislation was coming through, it gave a priority and a significance to the element of parental, grand parental safety, which it may not otherwise have had. It also allows an opportunity for advertising campaigns, which really get the message across. I do not think that we would, for a moment, anticipate diversion of actual police officers to this. I very much agree with Sheila's point that we would see it as being part of the on-going police activities in terms of road traffic offences. You would accept, as a very nice resource, the number of police officers that we have, the others, who could carry out similar work. If we are not for the fact that this is something that causes permanent and sometimes fatal impacts on children in Scotland on a daily basis, I would not be pushing for that. I accept your position on that, but in terms of drink, drive, seatbelts, mobile phones, they are all specific, in many cases specific, campaigns in and around Christmas, or summers, and on particular roads. Those initiatives are usually information-led. With the back of legislation? You are. Unless, as you are saying, it is just an add-on, that there will be no specific campaigns to do this, it is just when they are out doing a road check or a seatbelts campaign or a drink, driving campaign, then that would be added on. Is that what you are suggesting in terms of the police enforcement? British Heart Foundation Scotland does not have a position on how that should be enforced, but the examples that you gave there, I suspect Police Scotland and whoever runs the campaigns decide when to do them, drink, drive and sitbelts done around the Christmas period. I am sure that it was not thought of in the very first instance when we imposed drink, driving that it would be a Christmas campaign, so there is no reason why Police Scotland might not decide to say, we will have a week at the beginning of the summer holidays to crack down on this. I think that the point that James made is a really valid one that gives us an opportunity to raise the profile of this issue and educate through the legislation. The things that you mentioned in terms of mobile phones, seatbelts and drunk driving are all legislated for, so they have come up with ways of enforcing them, and I think that Sheila's point of it being part of the regular road traffic duties would be a sensible one to take. They do require resources and they do require police resources. If you have more responsibilities, they do require police resources, which is a resource on the week. You could, for example, I suppose decide that tobacco and alcohol would be dealt with together as issues at the same time. Thank you, convener, and good afternoon. I will try and be brief, convener. I should declare as well that I am the convener of the cross-party group on heart disease and stroke. I have no qualms at all about the evidence regarding psychinhand smoke. I just sometimes thank you because we talk about smoke. When the smoke dissipated, there was no smoke and we were really talking chemicals, and this is maybe part of the problem of getting that information across. I have heard from everyone on several occasions in the short space of time that we have been talking this morning about education awareness. Do we require legislation? Is it about education and awareness? I would contend that we do. The most recent Salsa stats interviewed 12—excuse me—13 and 15-year-olds within Scotland, and that indicated that 22 per cent of those young people in Scotland are often or regularly travelling in a car and where smoking is taking place. Sheila has already indicated the fact that there is a certain powerlessness. I felt a powerlessness myself as an adult who just needed a lift to work, but certainly when it comes to the context of a child or a real person, there is a powerlessness to intervene to protect themselves in that way. When I put that alongside the scale of the immediate and long-term medical threat that this causes to children and young people, my conclusion is that, yes, there is. I have no plans about the evidence and the medical effects that impact that. I think that that is a given, to be perfectly honest. I am taking up the convener's point about enforcement to some extent. What I am saying is that it is still about education and awareness. We are accused sometimes in Governments and Parliaments about taking forward legislation that is not necessary and where it should be a different approach. Is education and awareness—do we need to have this absolute—do we need to be more smart?  Should there be a sensor built into the car so that, when someone lights up, it goes off, just like you have seat belts? If you are not waiting a seat belt, you will get a sensor going off. Are there other things that we should be doing, rather than taking forward legislation? Generally, we have to do a number of things and we have to do them repeatedly to be able to raise awareness and change practice. I saw the public attitude to tobacco smoke revolutionise itself over the course of six years in the debate on smoke-free public places. Now, if, as a nation Scotland had unlimited resources, we might be able to do the sustained level of education and awareness raising that would be required to change culture, but my experience would be that there would be significant media interest in this legislation and that you will get free education and awareness raising that would cost a lot of money from the public funds in any other way. Yes, David. From a British Heart Foundation point of view, we have looked at international examples in Australia and Canada and where it has been brought in and legislated for and seen that it has a substantial impact on the reduction in children going in car journeys. James alluded to the 60,000 a day that is happening. I think that the scale of the problem, the health impact that we are talking about here, begs the question of why we have not done it already in Scotland. We have a history of being progressive on things such as smoking in public places. The time has come that Scotland really needs to act on this. We are not talking about five or six kids a day that are doing the 60,000 journeys that are happening. That is one of too many really, but I think that that number and scale is massive and it is something that we really should be acting on. Richard, I am not against taking forward legislation. I am just asking if it was necessary. My other point, if I may convene, is that it is maybe something that those witnesses may not have a particular view on, but it is about the adult age limit, the 18. You can hold a licence at 17. My other point is that if you have a young person smoking in a car who is 16 and there is no adult there, they are just sitting in a car and they are smoking. The legislation does not seem to cover that. It is just the adult age of 18. That is a peculiar age limit for me. Do you have a view? My understanding is that 18 is generally an accepted age for child protection internationally. When you are talking about child rights, like to learn to drive or whatever, 16 tends to be preferred? We have a different legislation in Scotland in terms of the age, in terms of children, transitions, duty of care. I am just wondering if that needs to be looked at. That is to do with supporting children and children's independence and rights. The age of 18 is generally, I think, internationally accepted for protecting children. I think that, from the BLF point of view, we could see no clear definitive correct age because of the complexity that you mentioned. From an organisational point of view, we would be quite relaxed in terms of where that went and where the legislature thought would be the most sensible cut-off point. Sheila, can you come back? I suppose that, in terms of underage sales and so forth, having a higher age range makes it easier to distinguish when children are younger. There is less argument if the cut-off is 18 rather than 16. That was the point that I was going to make. 18 is the age that you are legally allowed to purchase cigarettes. Technically, we should not have 16-year-olds sitting smoking in a car, though, in reality, we probably do. I want to ask about a slightly different issue. That is the level of accidents that occur in cars with drivers who smoke. I understand that that is considerably higher than the cars that are non-smoking. Is that the case? I mean, my understanding is that it is noted as a factor in road traffic accidents and it is probably significantly under-reported. It is not always put down as the cause of the accident. I think that that may be covered under existing motoring restrictions. Because I am just wondering whether we should not, you know, why, as Mike McKenzie was saying right at the beginning, I mean, slippery slope but, you know, a slope upwards in this case, why don't we just ban smoking in cars completely? Because if the accidents are greater, you know, I think anything you do with your hands, apart from actually having them on the steering wheel, is not good. I mean, and smoking is really unnecessary, so why don't we just ban smoking in cars completely rather than just the more reasonable thing of protecting children? I suppose that this legislation for us is about protecting children and we would like to see that secured. We are here to examine the bill that did not propose the area for that. E-cigarettes in the car wouldn't be covered with this bill? That's not the proposal that's on the table and there isn't the same level of established evidence of harm that there is for tobacco smoke, which is really irrefutable, although I wouldn't be surprised if you didn't get challenges on that from some of the tobacco industry representatives. Is there any other questions? Thank you very much for your attendance today. We look forward to going on this journey with you over the next few weeks and seeing the further evidence. Thank you very much indeed, thank you. I think that concludes our business for today, but I didn't.


Greetings to everyone, I am Sheila Seder and I am not a patient of cancer but I am a victor of cancer. My cancer was detected in 2013, it was left breast, completely cured, treated and then in the month of September 2020 or so, I developed secondaries in my pelvic bone which was detected by this hospital in Manipal. When we were looking for the further care, my husband had a telephonic conversation with Dr. Piyush Bhashbhai and then just by talking to him, we found he talked to him directly. So he told me that he is very professional, very approachable and reassuring. So just by his telephonic talk, we were very happy and satisfied and thereafter we are here under his care. He is a thorough professional, he is very caring and he gives lots of patient hearing to his patients, not only me but I have seen when he comes for the rounds, he attends us, he is very patient and full of knowledge. You sometimes hesitate to approach a doctor, after talking to him one wins the half of the battle of whether it is treatment or after care, that's what reassurance is given by Dr. Piyush Bhashbhai. I am very satisfied, we all are as a caregiver from my family, we are very grateful, we are satisfied and it is a very gratifying experience coming to Manipal for getting our treatment done. Starting from the reception point to the various investigation, dietary department and personal relationship department and here the marketing department, they all are perfect. Dr. Piyush has ensured that his team of doctors who are with him including Dr. Kanchan and the nursing team is very skilled a lot, we find them very, very caring because in your logo, hospital logo and the punch line says care, human care which I feel care is very important what we are receiving here and it is meant to be, it's not that Dr. Piyush wanted to be just to attract one patient and thereafter we are still having the same experience of his care with the patient personally speaking with me and with my family members. Nursing care is also very good. Sometime I feel it is my personal feeling that cure sometime you can really assess or rather measure I don't know maybe I am not too correct but care part is very difficult to measure or assess. The feeling of care I am experiencing tremendously and I am very satisfied. It's just like oncology department of Manipal is like a river or stream flowing through this hospital healing, giving life to the patients who are flown along with the river or stream and those who are touched and came in contact with this hospital. So thank you very much, thank you so much. God bless you Dr. Bajpayee and your nursing team and every allied department or section associated with oncology department. Thank you, God bless you all. Thank you, thank you very much.


Out of the annals of the strange and the incredible, accounts of Nightmarish creatures often appear to challenge our credulity. Here is a story about one such creature, a fantastic creature called the Abominable Snowman. It is true that no European can say that he has actually seen the Abominable Snowman and no American either. But if you should ask some wise and scholarly old monk, he will tell you. The Abominable Snowman? Why, yes, of course I have seen him and so have several of my brothers here. He dwells in the Himalayas and sometimes at night you can hear his great roar in his footsteps echoing down the valley. Come, I will show you a picture of him. Then the monk would lead you to a urid painting hanging on the wall. And you would see a monstrous creature of gigantic height and breadth. He stands on two feet like a man and his skin is white.  And if you should travel into the neighboring countries of Nepal or Bhutan, and if you should speak of the matter to one of the Sherpas or other native groups that inhabit Central Asia, the thing that would startle you would be the close resemblance between the picture he paints in words and the picture that hangs on the monastery wall.  But it must not be assumed that all Europeans are skeptical of his existence. There is, for example, Mr. H. W. Tillman who led the expedition of 1938 to the peak of Mount Everest. In reporting on his adventures, Mr. Tillman referred to one rather mysterious and perplexing sight that he and his party stumbled on. They were footprints, cracked of some sort. We found them in a snow field in the Karakorans far above the permanent snow line. They were round, the size and shape of an enormous soup plate. They ran in a double line for a considerable distance. All I can suggest is that they might have been made by this creature from the Asiatics called the Abominable Snowman. And then, of course, there was Ms. McDonald, an English lady of Dalimpong. She'd been warned by the natives of Tibet to beware of the fabulous monster. But, like others before her, she had smiled tolerantly and continued on her way. Then, on a certain afternoon, as she was traversing a high mountain pass that led across the Tibetan border, she heard... It was not the roar of an avalanche. Ms. McDonald made that quite clear in her comments on it. Oh, heavens, it was an animal, unquestionably. Why, it was so loud, so violent, that it actually shook the ground under my feet. Yes, it is quite probable that this fantastic creature does live and breathe and roam the snow-capped peaks of the Malyas. For otherwise, how can we explain the Asiatics' unquestioning faith in him and their unanimous agreement on his appearance? And how can we explain the tracks in the snow and the great roar that shook the earth? It seems, on the basis of the evidence available, quite likely that someday science will recognize the Abominable Snowman, not as a myth or a legend, but as a fact. Incredible but true.


First item of business oedda, is time for reflection, and our time for reflection leader, is Ms Abbey Lang, head girl, Harris academy Doondi and companion for awareness of young, sudden cardiac death in association with the ng int marathoning, cardiac risk in the young. Presiding Officer, members of the Scottish Parliament thank you for gyda'r perthdeithasol i osudwyddaeth i gael eu gweithio. Wel, rydyn ni wedi bod yn achos i ddigon nhw'r ysgol flynyddol ar gael a neu rwy'n symud dwyllgil. Dwi oedd yn rhangarwch i'r ddorol, oedd yn yn siarad, o'n arddangos i'r ddalaf. Ie i i rhangarwch yr greinid mwych grannu newidion ysgrifetig, dwi wedi gynhyrchu'r diagn REFARMAL oedd yn gwneud oes ysgrifetig, Fellywyr a'r hyn sy'n gwybod yn pryd yn dyn ni'n rhoi'r cyfrifon. Ffyrniadol a'r hyn wedi'i amgylchedd gyda'r dynnu diolchau amser dylech ar maen nhw. Foren nhw, mae'r pryd yn mewn gweld yn unig iawn rydyn ni'n ffwrdd rhain i'r rhain i'r rhaid i'r gweld yn dynnu diolchau amser. onddiagnosed heart condition. 80% of those deaths occur with no prior symptoms or family history. I've been actively raising the profile of national charity, Cardiac Risk in the Young, known as Cry, which believes every 14-year-old should have access to optional free heart screening. In March, the British Heart Foundation revealed people with potentially deadly heart conditions are too often not diagnosed until a life-threatening cardiac arrest or sudden death in the family. That highlights the importance of cry screening programme, which tests around 27,000 young people across the UK every year. Breved families normally finance cry-conducted community screenings. As a senior black belt in karate, I signed up for a test as I wanted reassurance that I can physically exert myself during cardiovascular activity without the risk of exacerbating a hidden heart condition. Fortunately, my electrocardiogram, which examines the electoral activity within your heart, was normal. My ECG was paid for by the Peter McEvoy memorial fund. The 22-year-old talented footballer from Dundee died of an undiagnosed heart condition whilst in a soccer scholarship in America. This coming weekend, the memorial fund's 200 cardiac screenings in Creef and Dundee are fully booked, confirming the demand for testing. The same number of individuals were screened last year, resulting in six onward GP referrals, potentially saving those young lives. I feel that it is fitting that, in Scotland's year of young people, this issue is addressed. Shakespeare's King Lear observed that nothing will come of nothing. As a Scottish nation, we are responsible for the health of young hearts, so my hope is that we can work together to do something.


This is the rarest object in the back rooms, and it's also the most powerful. It's object number 66, or the Leviathan's Tooth, as it's been nicknamed. The object was originally a full clay tablet that was 29 by 29 inches in size. Over the years it's been broken and smashed more, so it's not that big. It was discovered in 2003, and it said that any person who touches this object will instantly gain the power it possesses. And all the knowledge that it's said to have. As I just said, the tablet's been broken, so it's less powerful now, but its original purpose was apparently to transport people instantly from the back rooms to reality using the law of equivalent exchange, meaning a soul for a soul. You had to choose someone from reality to take your place in the back rooms and you would be sent back. But what are your thoughts on this object? Let me know below.


Hi, it's Jen with opensource.com bringing you my top five articles from this past week, September 8th through the 12th. Our content focused a lot on open education this past week, so you'll see that show a lot, show up a lot in my top five. Let's get started. Number five is Three Drupal Education Distributions Reviewed by Joshua Holm. He covers Julio, Open Academy, and Apigneo LMS. So if you're looking for a new tool, check out his article. At number four, why pay for a degree these days by Jodi Biddle? She talks about open education and takes a deeper look into MOOCs and what they have to offer higher education. At number three, free courses for getting started in the open-source cloud. Jason Baker shares ten of his top picks for free educational courses when you want to learn about the open-source cloud. At number two, we have Phil Shapiro's The Personality of a Linux Loving Teen. Phil shares his experiences working in a public library with students. At number one, we have Charlie Reisinger's Students Power This Open-Source High School. He writes about the Linux project high school kids are working on at Penn Manor High in Lancaster County, Pennsylvania, where Charlie is the IT director for the Penn Manor School District. He tells us that on any given day, you might observe their help desk apprentices answering questions from students and staff, repairing a damaged laptop screen, experimenting with code, or diving into the Linux configuration files. So, truly hands-on and thanks to the accessibility of Linux. This week, I have an honorable mention for you. We have a poll on the site called What Color Is Your Terminal Background? We have almost 2,500 votes and 75% of people are saying their terminal background color is a dark color. We have 11% saying transparent and 10% saying light. So, if you'd like to go vote in our poll, please do so on the site. And you can find all of these article links in the notes below. And I hope to see you next week. Thanks for joining me.


The next talk is going to be network traffic analysis using deep packet inspection data visualization. So it's basically this is Bram and he's really really good at staring at lots and lots of packets and if you actually want an application of Tetris block stacking, he is Bram. I'm at the University of Technology and I'm in the Computer Science and Mathematics department and I'm here to tell you something about my PhD project which is about natural traffic analysis using deep packet inspection. So I'm in the group of data visualization which means that we're trying to develop new types of systems that can help people to gain insight in complex data structures and in this lecture I will tell you something about wire shark traffic. For the people who are interested I will briefly give you some demos of systems that we've designed. You can also download them on a website. I will show you the URL in a minute. So why are we doing this deep packet inspection? In my topic I have the task to find so-called advanced persistent threats and these zero-day vulnerabilities they often tend to work in three stages. You have the infiltration phase where the virus is trying to enter the network using social engineering. Think for instance about a malicious USB drive or simply sending it by mail. Then you have the second phase which is expansion where the virus is trying to locate the system that it wants to harm and finally we have sabotage that can either result into staying under the radar and leaking information to the outside world or sabotaging the network by disrupting the services in the network. Although infiltration is nearly impossible to prevent we can detect signs of sabotage and expansion by analyzing the network traffic inside these environments. So how can we actually find these advanced persistent threats? There are several ways in which you can analyze network traffic and one of the more common ways are for instance analyzing network traffic at the level of bytes. So we ignore anything that's inside these packets we look at the byte structure and see if there are some patterns in there. Well the technique that's now most popular is a flow based analysis where people also try to incorporate IP and TCP information telling us where the messages are coming from and the over what protocol. But still the payload inside these messages is still unknown. Well if we want to find the advanced persistent threats we need to dig even deeper and we have to go into the level of application specific protocols to figure out what the message actually means. So in case for instance of file accesses in the network there is a protocol called Samba that can tell you what kind of files are being created in the network. But the more we go deeper into this hierarchy the more protocol fields that we have to analyze. So from a scientific point of view there are still lots of questions on which fields are actually interesting and how to deal with this large attribute space. So how can we obtain this data? For this we use Wireshark. So we take raw P-cap traffic and we run it through the Wireshark dissector. And for the people who do not know what Wireshark is it's basically an open source tool for analyzing network traffic. And the only thing that you have to know is that we run the data through it and we obtain a huge table where every row corresponds to a network packet and every column corresponds to a protocol field that can be present in these packets. So you can see that every packet has an IP and a TCP protocol but the more you go to the right you go into the application specific protocol such as Samba. Besides the large number of columns network traffic analysis involves the analysis of a large number of packets that have to be analyzed. So this is basically the summary of my PhD. I have four years to analyze this huge table to find APTs and then I'm done. There's a colleague of mine who also assists me in this by finding already marking some packets that are anomalous using machine learning. So I was wondering like okay I am in data visualization why should I care about this problem we have machine learning they can fix it for us they can mark these packets and it's all fine. Then I started to realize that these machine learning algorithms nowadays they generate a lot of alerts. So even though they tend to have false positive rates of 1% for network traffic where thousands of packets are being sent per second this still results into 10 alerts per second. So we can use data visualization to help users analyze these alerts that can help them to distinguish true ones from false ones. There are also other things that we can use for data visualization and that's just for instance abusing human cognition. So I have shown a figure here on the right where we apply machine learning simply linear regression on four different data sets and on the right you can see that this blue line represents the model and it's exactly the same in all these four data sets but if you look more closer from a visualization perspective you can clearly see that these data sets are that they are different from each other and last but not least visualization can also be used to help users incorporate domain knowledge so network traffic can only tell you what has happened what kind of packets are being sent but not why they're happening and this is why the user kicks in. The user has knowledge about this environment he is aware of things that have happened in the past and he might be able to relate the stuff that he is observing back to these phenomena. So we have been into this project for quite a couple of years now and we have looked at this problem from three different angles and one of these angles is data-driven so we were like okay can we create an image of this network traffic and maybe find some patterns inside these images. The second approach is alert-driven so here we relied on machine learning they give us a large alert collection and we had to analyze we had to find some patterns in these alerts maybe some alerts are all caused by the same user or they are being generated at the same moment in the time and last but not least and this will be the system that i will be focusing on in this presentation is knowledge-based where we simply use domain knowledge of a user who has a feeling about what's should be happening in the system and what not and based on this knowledge try to find patterns so to give you a bit of a flavor what data visualization is all about these are two systems that we designed in the area of data-driven and alert driven visualization and the system on the left is a monitoring tool where we created a pixel image of the network traffic that we were observing and as soon as you go into the application-specific area of this network traffic you can see that sometimes these network packets they generate a fingerprint that's specific for a particular type of message the system on the right focuses more on alerts so can we find protocol fields that are common in these alerts and can we for instance study correlations between them so i'm not going to discuss these systems in detail for people who are interested in these prototypes and how they work just contact me afterwards and i can i can show it to you now we'll be focusing on knowledge-driven development and for this we designed a system called eventpad and eventpad is actually a sublime text editor for wireshark i will it relies on several concepts that is very similar to a notepad editor and i will show you this in a few minutes you can also download the application and www.bromkappels.nl it's still a prototype but i really would like to have your feedback on this i'm working in academia everybody is working in their ivory tower and think that they are doing the greatest things but i believe that the true users are here in this room and i would like to have some feedback on whether the system could be useful for you and what you really would like to have for future investigations so the eventpad system i will give a brief a live demo of several data sets that we analyzed including void traffic and ransomware traces and the main system is basically an overview such as this one it's a bit overwhelming but i can explain you the main ideas in a few slides so the main concept is the view in the middle with all the blocks so basically every rectangle in this view corresponds to a wireshark packet and we can use rules to color these packets according to the properties that these wireshark packets have i can illustrate this so let's get back to our table and what we're now going to do is we're going to map every packet that is in the table into a gray square and in case of void traffic people were interested in what type of phone conversations are actually happening in my data can i find for instance phone conversations that are not conformed to the standard because void traffic is being transferred over a protocol called SIP and SIP is highly flexible so you can do lots of stuff that's not specified in the standards but it's still possible according to the protocol specification so what we here did is that every row corresponds to a phone conversation and every gray rectangle corresponds to a packet that was sent inside this conversation so applying this trick to all the data we eventually end up with a huge stack of these gray squares and sometimes these squares are very broad and otherwise they're very short and in order to find some patterns in there there are two strategies that we can apply we can try to reduce the sequences in the horizontal direction to make them shorter or we can try to find similarities between sequences well how do we do this for the horizontal direction here we go into the area of regular expressions is anybody of you not familiar with linux tooling such as crap or text searching like regular expressions or anything related to this no okay so what we do is we take a conversation and if we hover over one of these conversations then there is lots of information associated to this and we can use this this information to color these gray cliffs so in case of VoIP traffic i'm interested in two aspects i would like to know when a phone conversation starts and when a phone conversation ends and as soon as a conversation is not ending or not beginning properly then i think that's interesting to analyze so what we can do is we can use a visual query language that's very similar to regular expressions to color rectangles based on their properties well as soon as we have done this we can also now throw away information that we're not interested in so let's say that all the phone conversations that start with an invitation and and with a buy they are fine by me i want to see the ones that do not adhere to these rules then we can create a visual regular expression that states that all sequences with an invite and a buy should be grouped into a gray rectangle of a green rectangle like this and then the ones that do not match these patterns are the ones that are of interest for our investigation so we can use rules to color the traffic based on our needs and it really depends on the type of traffic and we can use simplification in the vertical direction to see if we can find some patterns in there so we can for instance stack the sequences on top of each other and see how many times these sequences occur in the traffic but we can still see that there are some slight variations between these sequences although they look very similar so we can also apply different type of strategies where we let the computer align sequences based on certain properties using multiple sequence alignment and this for instance shows that in the end these phone conversations look quite similar to each other but there are some of them who have an error in between the last aspect that this tool has are selections and this is very important in data visualization the user should be able to play with these components interactively so users can write regular expressions to find sequences that they're interested in but they can also for instance group these sequences the packets together and see if there are some patterns in there for instance all the error in phone calls are coming from a particular country well let me just give you a live demo of the system so that you have an idea how this works so this is the prototype and as you can see initially all these squares are gray and if I hover over one of them I can inspect all the properties in these packets and if you look on the left we have histograms of all the protocol fields that are present in Wireshark so I can for instance filter on the so-called SIP protocol methods and then we can see for instance that in 50% of the cases we have invite messages and if I click on them you can see all the squares that corresponds to the invitation of these phone calls well we can also create a rule using a rule editor that's very similar to word where we can for instance say okay let's start with a wildcard rectangle and if we double click on it we can write a constraint to this we can say okay I want all packets that have the method invite in it and this is very similar to the Wireshark interface and let us now create a new rectangle where we specify a color like this invite and save applying this rule we can see that immediately all the selected rectangles are colored and we can have a view on the very far left that shows that 16% of the traffic was now matched by this rule well of course now creating all these rules on the spot takes too much time so let me just preload a rule set that we already designed earlier and these are designed by actual people who are analyzing this SIP protocol to the max and what you can see is now they created several rules so they have rules to show the invitation of a phone call and also the acknowledgement of a phone call and immediately things start popping up like why are there two invite acknowledgement patterns after one another so we can also see that there is an exclamation mark rectangle and if I zoom on that one then and inspect these details then this is an authentication error so apparently the first attempt in this phone conversation didn't go well and the second one either okay so let's have a look at the different types of sequences that we have in the data so we can for instance inspect different types of sequences by sorting them so simply sorting them already reveals that we have quite a number of these sequences that are repetitive maybe it's handy if we stack these sequences on top of each other to count how many times these sequences occur in the traffic so we're now stacking them and sorting them by frequency shows now that these are the most frequent sequences in the traffic well we can still see that there are some similarities between them but we can study them in a separate view let me check hold on then I will so I unfortunately I cannot duplicate my screen so I have to do this on the spot all right and if I make a selection of these sequences that I'm interested in like this I can get a summary overview on the right basically showing how the traffic looks like so all the conversations they start with an invite and sometimes there are these ringings events and acknowledgments but we can let the computer apply alignment to discover some patterns in there and applying this alignment shows that in some cases these acknowledgement events are always occurring on the end and sometimes we have two invite messages in between well we can also select these blocks and study what their commonalities and differences are and this for instance reveals that all the selected messages that we now have correspond to buy messages so we can now use again rules to assign these buy messages to the data so here we now specify that give me all buy messages in the traffic and let's assign a color to it okay buy like this and here you can see now the buy there were indeed buy messages well sometimes we see that these sequences they do not end with a buy and I'm only interested in the complete conversation so let's first find all the sequences that start with an invite and eventually is followed by a buy so here we can tell okay I have an invite I have a wildcard and after this wildcard there should be a buy and I do not care how many wildcards there are in between I simply want to have all of them applying this we get a selection and we can start a selection for future investigations so we can start them like this and what will happen is we have a summary overview over here that shows how many percent of the traffic we now currently analyzed so we can select this and only now focus on the complete conversations and now continue our analysis or this one so something else that we that we have have seen in the in the alignment view is that sometimes we have these nested map patterns that are in as an invite as inside an invite but this is an example of a phone conversation where there is a proxy server in between the recipient and the sender and if you want to study how many times these type of patterns occur we can write a rule for this so we can basically tell that okay give us all the invite messages that are eventually being followed by an hack and if I see these then we rewrite them into a new rectangle called connection attempt and by stating that in between an invite and an acknowledgement there is no invitation in between we can also take care of these proxy servers that are in the middle connect and applying this we can compress these sequences and you can see that the sequences have become shorter we can also convert these connection attempts we can only filter on these connection attempts like this simply throw the rest away and study how many times certain conversations needed to apply connection attempts and in some cases we can see that in most of the cases in three thousand cases the phone conversation only required one connection attempt in order to succeed but we can also see that there are examples of sequences where many attempts were necessary so this was an example of the devoid traffic we also analyzed ransomware so what we did is we installed a honeypot in the system and we wanted to see what kind of encryption is happening inside our network traffic to see what's going on so in ransomware traffic everything is being operated on samba and samba is a protocol where you can open files delete files read files and write files inside network environments so we created rules to represent the opening the closure and the find requests inside the network and what you can see is actually some very interesting patterns that a lot of open and closures are being done and then after which lots of read messages are being sent and if we look even closer we can also see that there are write messages and inspecting this traffic this is actually highly repetitive so I can also show a mini map and this will show you that there are these some very block structures here inside this traffic so let's reopen this network traffic and inspect this stuff by file we can for instance here decide to group the traffic by file id all right and now applying the same rule set again we can see what kind of requests are being sent per file all right let's find all the unique patterns in there and sorted by frequency frequency descending yeah and here we see some interesting things happening so we have 700 cases of the topmost sequence and the bottommost one and what we can actually see is that a file is being opened and being closed probably to check if this file already exists then we have an opening of a file and some content is being read after which it is closed and after opening the file it is being marked as delete and it is closed again well if we now inspect the type of files that are being accessed here in a tabular view then we can see that in this view all angular js files are being touched if we look at the topmost sequence however we see also that some writing is being done but if we now analyze the same files that are being accessed here then we can see that we also have these angular js files but with a fun extension attached to the back and this was kind of strange so we decided to investigate this more closer and eventually doing so like this let me go all the way to the bottom this one yep so we applied the open find enclosure events inside the sequences and by analyzing these rules we could find some some some interesting schema here it was always the case that for this particular virus that a scan was being performed some files were being open and being closed but the interesting thing about this jigsaw virus was that a file was first duplicated before it got encrypted and the original file was simply deleted from from the disk but it wasn't removed in any way so if you would simply apply hard disk tooling to scrape off all the the files that were still available on the hard drive you would still be possible to get the original files so this was actually a bug inside the ransomware virus that we detected using these patterns so these are also some examples of patterns that we discovered throughout this exploration but you can see that as soon as you already have some knowledge about the things that you expect and do not expect you can already find some patterns inside this data so yeah that was it if people have any questions feel free to ask them if people are interested in the system then also please contact me afterwards we're still looking for people who would like to try the tooling see whether it is useful maybe we can collaborate in some sort of way so thank you very much