When it comes to shopping for groceries safely during the coronavirus pandemic, close contact with others and touching common services like door handles are the biggest concerns, says food virology researcher Aaron DiCaprio of the University of California Davis. There's currently no evidence of the virus being transmitted by food or food packaging. The highest risk is from people who may be shedding virus and droplets as they sneeze, cough, or breathe. Once you get home, don't sanitize your food. You should instead wash your produce under cool running water and then dry it with a clean towel. You also don't need to wait to unpack groceries or boxes. Instead, after unpacking, wash your hands. Gloves are not currently recommended for a visit to the grocery store. Wearing a mask can help keep you from spreading the virus if you have COVID-19 but don't know it. And if you're over 65 or have a compromised immune system, see if the grocery store has special hours for high-risk populations. And consider having groceries delivered to your home instead.


Okay, welcome back everyone. We're live in Las Vegas for IBM's information on demand user conference. I'm John Furrier, the founder of SiliconANGLE, and I'm joined by co-host Dave Vellante. This is theCUBE, our flagship program where we go out to the events, extract a signal from the noise. Our next guest is Jeff Schick, not Frick. I did that earlier, who works for SiliconANGLE. Jeff, welcome to theCUBE. Hello. We've chatted a couple years ago and I want to share with the folks out there that you've been in the social software space, you're the vice president of social software, for a long time, and you've seen the movie, Enterprise Software, now we've got the current trends here. IBM has had a lot of track record in social software. So my first question is, what's changed right now in social software? Why is it so relevant and what do you guys have right now and what are you guys positioned for in this market? Well, I'll tell you. I think we got started back in 2007 where we brought forward the first integrated social software platform for business. And by bringing that forward, it really became apparent that it was our view that you could better connect people with people and people with information, that people were moving beyond email and instant message as a primary way of sharing. And so at the time, we had observations in terms of the sharing that was going on in MySpace, the fledgling Facebook, there was no Twitter at that stage of the game and it was pretty clear that people were creating content and sharing easier than ever before. You used to have to know HTML or some sort of complex authoring tool and when I first got started, I tried to position it. This stuff is so easy to use, even young people can use it, but I say it much differently today. And I think the inflection point is that there's not a country on the planet, there's not an industry on the planet that doesn't have key customers leveraging these technologies to better their overall business purpose. And so in doing so, you start to create traction and visibility. TD Bank is using these technologies to connect 120,000 people across their enterprise right out into the retail store locations. And so their retail employees are allowed to describe their wow moments of the day and share them so that they can have better customer service, create better customer satisfaction, have the clients be delighted with their interaction in the branch. And I think with that groundswell of activity, you're starting to see everyone consider that as a high performance company. So I want to drill down on the ease of use questions. That's really kind of what we're seeing. And we're seeing kind of two camps of people. And I want to get your perspective on what you're seeing. You know, folks who understand the connections model of, hey, we got to connect our users and our workforce, et cetera. And then the folks who see Twitter, they see Facebook, this is the new way to connect with their customers and their employees. So one camp, yeah, I'm familiar with it. And then the new camp of, hey, I should be doing that. So that's kind of a little bit of a marketing built into the hype of the trend around social media. But deploying it has to be easy. So I want you to talk about your perspective, what you're seeing, and then the ease of use, not only from a tool standpoint, but rolling it out as an enterprise pulls this huge software opportunity and who's going to run it? Do they have to step up for it? Is it easy or easy? Some solutions we've heard, not that easy. So, you know, here's some social software. What does that mean? So talk about the ease of use and ease of use from a user standpoint, meaning the people deploying. Well, so from an ease of use perspective, I think that the software needs to be so easy. It doesn't need an instruction manual to use. No one has to tell you how to press a button to make a blog post, right? You shouldn't have to. But what is not genetic but learned is, how do I create a vibrant community? You know, create the executive sponsorship, who owns the community, that you have a healthy set of contributors and communicators, and that there are people that are leveraging this information for their business purpose as readers, lurkers, you know? And so, I think there is, you know, a way to approach adoption in the enterprise focused on a set of social business patterns that allow you to have real success and growth within the base. But with that said, in terms of a, you know, user experience point of view, that user experience has to be simple and easy to use and brought into the context of the way people work. So, if I live in my email, how can I get my status updates within a sidebar? How can I see the files that are shared within my social network? Can I make it that simple to use? And, you know, as we deploy these technologies, there are a lot of people that aren't considered technologists or knowledge workers per se, but they really are knowledge workers. At Lowe's, they've deployed this capability across all of the Lowe's stores around the country. And, you know, I thought one of the great stories coming from them was there was a young lady in the paint department and she had these, you know, expensive Teflon trays and she had these cheap plastic trays and they were selling a lot of cheap plastic trays, but none of these, you know, $19, you know, Teflon trays. She said, let me try an experiment. She took the paint and dumped it into the Teflon tray, let it harden overnight. The next day she put it out on the counter, pulled the paint out, put it in, paint out in, people got to see that. By the end of the day, people that had saw that bought the Teflon paint tray and she sold out the paint trays in just a couple days. So the first thing she did was blog about that as a best practice so that across the nation, people in paints departments were running that little experiment and they inevitably sold out of all of their Teflon paint trays. The very next thing she did after that was to blog about how she can't get any more Teflon paint trays. They're all back-ordered now. And so this stuff is so simple to use that they're connecting people with people and people with information in a way that, you know, any type of role, any job can benefit by finding an expert, having a threaded interaction and so forth. Why do people come to you? I've just been sort of thinking about the reasons why. Somebody would want to implement an enterprise, you know, social strategy.  You mentioned email, you know, before integration if you will.  Is that why people are buying from you? Am I missing some things here? I wonder if we could talk about that a little bit. What are the drivers that you're seeing within your customers? Well, so first off, I think we've done a good job with the technology we've created. We've sat as the number one social software for business at IDC through a market share study for the last four years in a row. You know, Yammer, Jive, are farther down in the list. And so we're really out there working with clients and I think we have great technology, but you know, I think also IBM drinks its own champagne. I prefer that expression over the English version where one would eat their own dog food, but we drink our own champagne. And so not only do we have great technology, but we have the knowledge and wherewithal to help organizations recognize how can I gain business value, right? And not just soft ROI, but hard ROI. For example, when IBM rolled out its community capabilities and social network capabilities on IBM.com, developer works as one of the largest communities on the planet. We have several million people participating, sharing information there. And when we moved from the only way to talk to us is through a telephone to establishing communities with discussion forums and a level of interaction, IBM saved $100 million the first year in terms of support. And that has only grown better over time because now you're capturing the tacit knowledge of that level of interaction and people are starting to move to self-service. And so there's a lot of examples of where you can demonstrate hard ROI and benefits to business in a way that is across every dimension of the clients that we serve. So okay, that's an example of hard ROI using cost savings as the numerator and I presume you got revenue examples as well, right? Yeah, of course. So can you share some of those with us? Well look, so I like to talk about some of the client experiences that we have. So for example, Petrobos, one of the largest petroleum providers on the planet are using the technology to support an entire set of safety activities and learning endeavors and sharing. So if I'm out on an oil rig platform and I'm replacing a gasket, if those employees don't know how to do that and approach that through training and through being able to find information, there could be some sort of catastrophic disaster. Bureau Veritas was established in the early 19th century to certify a ship was able to make the passage that it was booked for and then they then talked with the insurance company about what sort of premium would be set. The Bureau Veritas now is one of the organizations on the planet that examines quality in every single product out there. They certify the flat panels that are in the market, they certify the shirt that you're wearing, the coffee that you drink, and they're using this to connect their experts so that they get the right person on the right opportunity at the right time to yield the right result. And that's allowed them to expand into substantial markets. CEMEX is a cement company. They're using the technology to more quickly create products. As they created the ReadyMix product, they did it in one geography, but then as they moved around the planet, regional requirements for cement based upon climate and environment needed to be factored into the overall mix of that ReadyMix cement. And it's the way they were able to roll out a product 25% faster than they ever were able to do before. So there's a lot of examples of the business value gained in the way one can measure that. Jeff, one of the things that we've always talked about, it's always like there's the obvious, aha, we have to do this, ROI's are gonna be there, there's the blue sky, in some cases specific hard ROIs. But I gotta ask you the question, IBM has an organization that totally understands this, you guys have been doing communities, you have the tooling, your IBM, a lot of other organizations don't have that. So one of the things we've talked about is that the social software market or social media teams are small. Kinda like the web days back in the 90s when it was like a couple guys running HTML and rolling out the website. So for the companies that don't have the DNA of social, we've heard that some of those other platforms, like Jive and Yammer's, they get sold these community platforms but get the world's changing so fast that they feel stuck and understaffed. So the big challenge is what tooling do they need to do? Can you elaborate on your perspective on that? For organizations that are saying we want to commit to social software, is it just about having a social media team or is it more a line of business? What does that crossover happen for scale within a company? So they say yes, we want social software, now it's how do I do it? Social media teams are kinda small, what's your take on that? Well, certainly the social media and communications teams have a role in how that can help communicate that company's messages or help the marketing team do the good work that they do to create a proper campaign and have an environment for sharing. But what we try to do is look at all of the different roles within an organization and start to assess in what ways can we transform the way they work in terms of whether it be leveraging expertise location, access to information. It really is an approach that really looks at the role more deeply. So if I'm a retail employee in a bank, how should it help me? If I'm someone that's on the marketing team building a new campaign, how can that help me? If I'm responsible for a merger and acquisition, how will this help me to do due diligence with the right people within the organization all the way through to in the process of the merger and acquisition? Can I do this outside my company boundaries where that sort of sharing has the proper information responsibility, stewardship of security, but allows you to work very closely with the acquiring company? So I think that you need to decompose. It's not one size fits all. So take me through some use cases where you've had success with some of your clients. Who makes the decision? Is it the CMO? Is it the business unit manager? Who's the user? Who's the influencer? Who's the deployer? Can you just walk us through? Because a lot of companies are trying to organize their staff. Where have you had the most success bringing that value to your customers? Well, so I can tell you this. As we've worked in, we have over 52,000 companies running our social business platform around the world. And as they're leveraging this sort of technology, it comes down to how do you get started? Well, that may originate in the IT organization with examining a better class of collaboration tools. It may happen within a line of business that says, I really think that we have the opportunity to better our overalls result by sharing in this way or working more closely with a partner or a client. So I think that those many entry points. There are many, many entry points. But with that said, I think that it takes all legs of the stool to be working together in a coordinated fashion. So for example, in the TD Bank example, they created an executive steering committee which was made of their chairman, their CIO, the heads of the lines of business, their compliance department, their legal department, human resource, and marketing. And that team said, we're going there. We're on the social business journey. We genuinely believe in the benefits and value we could derive. And so let no obstacle stand in our path. And I sat on that committee as one of the vendors. So it's top-down and bottom-up. So it's organic. You can come in at any entry point, and then it gets some momentum. In some cases, then the business models change. So what you're saying is top-down is more of a business model mindset from the top with organic participation from the folks in the organization. Organic comes from the people that just want to use this sort of stuff. Great. So let me ask you a question. What's some of the exciting things that you've seen in the market? I mean, you've been in the social space, I've said for a long time, collaboration spaces evolve. Certainly it's more if it's really hot right now, people want to change their business. What are some of the most exciting things that you've seen that you've said, well, I wouldn't have expected that to be such a massive home run? Well, I had the opportunity to create connections starting back in 2006. And as we've brought that technology out, seeing the way that people use it is very, very exciting to me. As I see that logo in their masthead, and they've done the customization, and I see their branding and their culture in that, it's thrilling whether it be the United Nations that has deployed our social capability across the entire enterprise, loving strong content management and analytics to help bring to the forefront that, which is important. And so I really think that, seeing how the clients are really using it and really changing the world or changing their business is really tremendous gratification. You mentioned sharing. Obviously people want to connect with each other. That's obviously the trend that we believe in as well. But it's also made a change to how people are deploying their communities in their forum software. It used to be, okay, we had our website, corporate website, company.com, you go there, they'd be like login, you have forums, they're still there, but there's now an emphasis of public forums that are happening. Tweets, got hashtags now, out there, there's a lot of crowdsourcing, so reviews, yeah, so all kinds of new dynamics are changing from an entry point standpoint, more omni-channels for sales opportunities for social. How is that changing those older models of communities and forums? Certainly they're not going to go away. It'll always be that intimate environment. But now you gotta bring that out to the crowd. What have you seen as a success path for folks saying, hey, I've got an investment in community software and aka forums or blogs. Now I want to go out into the wild where the people are. Sure, and at IBM, we've done just that. I mean, seeing IBM as genuinely a social business, we put in front of an employee social media guidelines, and every year, every single IBM employee need certify against those business conduct guidelines and social media guidelines, so they understand that as they use social media, describe who you are, speak within the boundaries of your job, be constructive in the interaction, and so forth.  We're allowing them to get out on Facebook, in LinkedIn, and Twitter, and really talk about what they're doing. So it doesn't mean that a sales rep can go announce a product, that's my responsibility, but they can then use- They can leak a product. Right, they can, well, they shouldn't. Accident. But what they can do is if they're a sales rep, they can say, this product was just released, I want to share with this community on the internet, or I want to share with my clients a specific event, and use all channels to basically communicate, so in the years past it was, here is the one person that's the blogger on this particular topic, internet-facing, and now all of our employees are client-facing, leveraging social media on the internet, whether it be the private infrastructure we built out on dot com, or the cloud, or that they're leveraging those large, public social networks. I remember you and I in 2009, we talked about this when we first chatted on the phone about influence, and most people think of influence, they think of Twitter, Justin Bieber, these big names, kind of the long tail, people who are popular. What's your view on influence? I mean, obviously influence is anyone who influences others at some level of degree. With big data analytics, we're seeing some demos here with Watson and other software, where you can actually go in and saying, hey, that person is an influencer, but he's not like a big power blogger, but in the unique community he's in, he's an influencer. What's your take on this influence, and where do you think it's gonna go, and how does that integrate into some of the collaboration connections pieces? Well, I can tell you that we have a program inside of IBM called Voices, and we wanna use our employee base to amplify our communication. So, Facebook's model now for communication and advertising and the way one approaches getting a message out. We're asking our employees to retweet, we're asking our employees to repost and to share widely information that's important. So our marketing and communications team may get a message out there, it may touch a wide swath of people, but if we allow our employees to amplify that, you have the opportunity to really widen your message. And so, we're completely all in. We're using analytics tools to assess where the influencers are, but genuinely, we're using our employees as well to go out and whoever they're connected to amplify the communication and interaction that we'd like to get more widely distributed. We're here with Jeff Schick, Vice President of Social Software at IBM. We're out of time, but I wanna give you the final word. Share with the folks out there who aren't here. The vibe of IOD this year around the social business trend here. And then share in your own words how that's gonna look going forward. How do you see the market evolving? What are some of the possibilities that are around the corner that some of the folks might not see? So the vibe here at IOD around social business and just in your own words, what you think is possible around the corner that connect the dots, read the tea leaves. Well, look, no matter where I turn here, I see social business every place and it's prominently featured in the expo floor. It's prominently featured in all of the sessions. There's a lot, a lot of discussion about what social can do for you or your organization. But I'll tell you, when I got started and I had my title, the Vice President of Social Software, when I knocked on people's doors, back in the early time, people say, this stuff, social software, if I install it, are people just gonna goof around all day? Or is there such a thing as anti-social software? And surely there is, but today- Clog of violence, can people go like, but today people get it and they wanna better connect their people with people and people with information and they understand it will drive value and the leading companies- So you see new innovation coming around the corner fast. Yeah, real innovation coming fast. And new capabilities and tooling. Anything that you think that will be surprised to folks out there in terms of these new capabilities? Will it be that kind of privacy, those conversations? Well, I'll tell you a direction that we're taking that I think is really important. You know, as we look at people, people being the most important asset within an organization and having built that social business platform in and around helping that person do their work, we embraced the acquisition of Conexa, which is focused on a broad spectrum of human resource related capabilities. So as I have this idea about people being the front and center and most important asset within the organization, expanding that in a way where you're supporting, recruiting, onboarding, enablement, talent management, performance, and assessments, that all comes down to the workings of people. And so in times past, it might have been, I'm sensitive to the idea that we need document life cycle management from cradle to grave on a document. And certainly we have that all in on the social business platform. But this idea of people being the center of the universe, we're now extended that in a way we truly built the integration between social network and collaboration and the full range of things that you need to do to support someone from higher to retire. Yeah, we yesterday we heard about contextually aware concepts. And yeah, we love that message. We're big believers in that, focus on the people. Smarter work. Time savings, people's time as a scarce resource and connecting to relevance. Contextually relevant things. I think there's another Google in there somewhere and it's new modern era. So you guys doing great work. Jeff, thanks for coming on theCUBE. I appreciate Vice President of Social Software. This is theCUBE. We'll be right back with our next guest after this short break. Guys, thanks for having me here today. Thanks, appreciate it.


So as we get ready to go back to work with our partner we always have to remember our conversation norms. It's so important that when you're having a conversation that you show respect. So what are the three ways we show respect for our partner? Brianna. Keep your eye on the speaker. Okay keep eye contact with the speaker. Make sure you're looking at your partner as they talk to you. Number two, Natalia. Listen to the people that are talking to. Right, be an active listener. Pay attention to them, okay, and they'll know that you're paying attention if you're looking at them as well, right? You're not looking out the window. Okay, and the last one which is most important I think for my class, what do we always try to do? Stay on topic. Absolutely, stay on topic. And what's our topic today? Vocabularies strategies. Okay, good. Vocabularies strategies.


Hello, my name is Dawn Jacobson. I am Senior Vice President of Home Care and Hospice Services for Hackensack Meridian Health. The backbone of healthcare in America is more than doctors, nurses and the many people working at healthcare facilities. It is also certified home health aides who provide personal care to people at their most vulnerable moments in the most intimate of all settings, the home. If you are a certified home health aide, I hope you will consider joining our team. If you have a passion for caring for others and are looking for a rewarding career, we offer free training and certification to begin your new career in healthcare. I invite you to see for yourself how rewarding being a certified home health aide with us can be. Please contact us today and thank you for taking a few minutes to hear from our team members. Before I was a home health aide, I was a department manager in a retail store. Retail, you are not valued as an employee. Here you are valued, you are thought about, they look forward to seeing you in the morning. You just build a relationship like no other. If you are at home providing, you know, compassionate care or care in general to a loved one, why not go ahead and take the extra step to become certified? The most rewarding thing about being a home health aide is the bond and the relationships you make with people and being there for them in their time in need. You just become part of the family. Some of them are with me for months. Some I only have the opportunity of being with for maybe 24 hours to 48 hours, but just knowing that they are comfortable and just giving them that type of comfort is reassuring to me. It's just a good feel to be in and it's very hands-on and you're just there for people. Some may take it as if it's just like very easy, you just go and it's more companionship, but in reality it's deeper than companionship. Sometimes we are the only people that our residents see, I mean 24 hours in some situations. If you want a job that's more rewarding and you want to wake up and go to work every day, this is a job for you.


think I got a pretty good transition or preparation for my talk from Professor Wambolt who said it's elementary or essential to get data out of silos and to get data into the hands of people in the different areas of work and make it more accessible so my focus here is on thank you is on the topic of getting data to the right people at the right time and I'm talking about a product that we have a tremble called Trimble Connect. Before I get started I'll cover industry challenges a little bit, talk about Trimble Connect, give some examples of how customers are using it and then provide a bit of an outlook. Before I get started I wanted to cover Trimble real quickly so Trimble's focus is to transform the way the world works. We are active in four different fields in construction, geospatial, transportation and agriculture and our solutions are covering all these areas and we are looking to essentially combine our solutions more and more because we identified that we have pretty much a lot of common challenges across all the different areas that Trimble's active in. One of the big challenges is that we have more and more data and is everywhere so data is fragmented in different silos and we're getting more and more data especially with reality capture solutions like scanning, point clouds, the data volume that we need to handle is really massive. In addition to that we also have very disconnected processes so the data is processed and used in different silos which basically needs different expertise, different environments and we need to connect data and break up these silos. Based on this disconnection and the fragmentation we also will then see a lot of basically errors in decision making and by removing silos, by getting data closer together and flowing we'll be able to tackle that problem. All of that is certainly combined with focus on margins so with slim margins errors is something you don't want to have, basically want to avoid so that is the fourth challenge that we're trying to tackle. To address those different problems Trimble has put together a strategy a couple of years ago which we call connect and scale. It's a three-footed strategy focusing on the customer first then focusing on building a platform and focusing on a more streamlined experience. So the customer focus really is about getting a more streamlined experience or more unified basically integrated approach to our customers so that the data will get out of silos, workflows are more flowing between the different types of customers and stakeholders we have. The platform strategy really speaks to an approach where our focus is to create an open platform because as Trimble we're well aware that we won't be able to cover and capture every or tackle every solution and problem in the world so we want to create an open platform that our partners and customers can integrate with bring their own solutions bring their own algorithms but also implement their algorithms in in their solutions and then finally streamlined experiences really focusing on making Trimble easier to do business with basically given that we cover so many different industries Trimble can be fragmented when it comes to how we interact with customers so that is our third focus. Now my area the area that I'm working in in Trimble is the geospatial side which is pretty much covering the wear of our industry continuum so Trimble really is focused on creating reality capture data creating survey data basically capturing the physical world. This data is then used to identify basically the why so basically used in construction management process optimization understanding what is going on in basically on a construction site and is also being used in the area that covers to what basically the planning 3d planning building construction planning and as geospatial we see ourselves at that intersection between the physical and the digital and we're focusing on providing solutions to tackle that area. The key area or the key focus and product I want to talk to about today is Trimble Connect and it is a cloud based common data environment combined with a collaboration user experience or collaboration environment so basically CDE combined with collaboration application and it connects the right people with the right data at the right time so the focus really here is on getting BIM data, getting scan data, getting surveying data integrated and easy to use across the different areas of activity. Trimble Connect is not a new solution it's been in the market for a while mainly with a building construction focus we have more than 30 million active users at the moment so it's pretty stable platform I would say we're used to dealing with lots of customers lots of users on that platform and we're now focusing on bringing that more and more into the geospatial environment. Within the geospatial world Trimble Connect can be used in a number of different areas you can use it to plan your work in the office or plan your work to be done in the field you can use it to get data from the office to the field so basically preparing your data for field work you can use it while collecting data in the field it can be used basically as a storage mechanism for data then you can use it to basically prepare deliverables in the office you can connect products like Trimble Business Center to the cloud through Trimble Connect and a very big aspect is sharing and delivering very complex data to a large amount of stakeholders or customers so basically that sort of collaboration aspect is where Trimble Connect is very strong and then finally the tracking of progress so understanding what's going on in the field where is the work what is completed what's going on and to give a bit more context to detail I picked out some of those areas to show how that can actually be done so when planning work for example you can use Trimble Connect to sort out and order or categorize certain data in the in the office and prepare the data for field use so you can build groups you can build certain elements that you can single out which you then can more easily select and identify in the field so this is really focused on model driven workflows in the field where you can then make it much easier to sort through complex models in a field workflow at the same time you can also organize your teams groups provide access rights create user groups basically manage who has access to what data at what time now once you've sorted and organized that data you can take it into the field onto your field controller you can tap back into the cloud identify which data to work on which model object to scan for example which model upside object to measure against and then that way steer your field work into along the digital model you can automatically download objects you can use design files from the offer from the the cloud directly in the field the big aspect also and that was covered before as well where we said we need to get the data into the hands of different users different stakeholders essentially break up the silos and this is really achieved through that sharing capability Trimble Connect offers a very easy to use environment in which we can surface quite complex data in a very simple environment really so that for example a planner has access to a point cloud in combination with a model to be able to measure distances measure how much cable to to use to get something installed aspects like that so really it provides a very capable environment to share data to create predefined views create basically projects that makes it then very simple to understand the data you can then also invite users create groups create link shares to get people into that data environment and then finally the aspect of tracking progress this is also a key one as a construction company or a survey company you need to know where the work stands how the progress is going on so Trimble Connect allows you to do that you can assign to do is our tasks to cruise in the field or to other stakeholders and then you can track completion you can set deliverable dates and status on those you can also keep track of your data you can understand what happened to the data who altered or changed data at what time and again this allows much more stakeholders to work on one data set one common basically set of information and also before we set the data needs to be available in the field so for that we also offer field applications so mobile application that allows you to get this complex data into the hands of field workers so that they can understand what's going on in the field if you if you do point cloud analysis in a certain area you can stream that out use that data directly in the field to understand what is going on and basically improve productivity out in the field I put together two customer examples of two of our customers using connect very effectively one is a project in Norway back in light rail and they used connect to quickly capture and then visualize the data the focus was really to create a completely digital workflow in which they would be able to cover the entire workflow and create a paperless work approach so they used Trimble connect sx 12 the TC seven so basically the full sensor field device setup and based on that created a very efficient workflow that kept the communication times at a minimum and really created a fully digital workflow another really attractive example is the a project in Switzerland done by the company Donach and partner they looked at modifying or renovating a complex tunnel structure and created a whole range of deliverables that they would share with stakeholders across the industry for various steps in their process being able to understand that complex data and being able to work on on that even capturing virtual reality type applications finally to wrap it up Trimble connect really is a very powerful environment that allows you to get different stakeholders into one easy to use environment gives stakeholders very simple access but it's also part of a wider ecosystem and the presenter following me will also focus on that area to give you an insight in what other solutions Trimble has connect is the let's say the glue between all these applications gradually following our connect and scale strategy we will bring more and more capabilities into the cloud with a strong focus on productivity getting the data into the cloud getting the processing into the cloud and as Trimble we're really also a renucley position to do that based on the breadth of our solutions with that at the end of my presentation thank you if there are any questions reach out to me or meet us at the booth of Trimble


So we'll see in the workshop how to send back the application and especially a common line application So we will use a all vulnerable version because It is useful to see how it works and how an exploit my Well get access to your data So I hope everyone follow this setup if you didn't You should still be able to do that right now, but that might be a bit short. Anyway, if you didn't I can flash this query code Follow this URL and everything is explained there I saw reminder these slides are available on the Well on schedule, so you might want to download the PDF and to keep it Close because I will try to switch between these slides and a terminal. So So if you did follow this step So vagrant install on your machine, great You can connect Swisssh, vagrant.sh But now you need to shut down this machine because I deleted the repository this morning. So just pull it off You do a git pull on The vagrant repository that you just clown You do a vagrant up and vagrant.sh again, and then you get what deleted files If you miss that it's okay, you can do that later Okay, so I guess everyone did that already So if you don't know there's a feature with vagrant that in MLU to do snapshots And what that might be useful to restore pure state that was working for instance should not Well should not You're not required to use the video of course, but yeah, that's kind of free And then you can do in scissor vagrant scissor and connect to the machine If you have vagrant install you can so launch it and see the video machine But it will be more convenient to use a scissor so what did the reasoning if you execute the Setup script it first build the environment so with our nap-to-date Arch Linux distro install all the good packages Installed Vulnerable version of image magic which is not Easy to find but still there Then The set up created a new package and install it So now let's see how to sandbox this kind of stuff with Yes, oh Okay, maybe you should start again. Yeah. Yeah It was connected and it was Okay so it start again quickly just for the one which are Online Oops Yeah That's basically what I said. It will be easier to flash this square code now And yeah, so what you can do is go to the red one with three do a good pull We're gonna up and they're gonna see each to get the latest version But if you don't do that now it you could do it later No, everything is written in the with me so you have all that and Let's start for real so First why do we want to sandbox an application? Well, just assume that with enough skills and time Well, most application could be compromised that includes again, of course, but also all these space applications and as developers Well, we don't want to be involved in such issues. So It might be a good idea to kind of prevent that It's some kind of insurance. So you want to protect users and Even if there's a bug in your application because there is somewhere Well, that could Make such an attack more closely. So It will give more time to Updates your application fix it updates and push it over the fleet or distros or get a whatever and Yeah, as users well When you use an application, you can increase your attacks to face so Yeah, it would be nice. We're able to control these attacks face Simple example is as a Linux user on your desktop instance or on a server When you launch an application even a common light application Well, it runs Most of time with the same credential as the user So this case if this addiction is compromised, well, you can have access to all your files You might have You might have well harden this rule With Selenix, Apamor, SMAC, Tomeo, and whatever that's great, but I guess it doesn't cover everything because It is really complex and if you want to install whatever application you want Well, the system-wide policy needs to be aware of that. So most of the time might not Anyway most flexible and it's fun So Sunboxing is really to isolate an application to isolate process from the rest of system to not Let him harm or access your data Yeah, even in a just and trusted application processes can become many shoes, so you need to be careful and You don't want to give privileges to your application to be able for it to drop some more accesses and You don't want this can feature to harm your system. Yes, and unlock is designed just for that It is an upper-edge Linux security module So available to everyone. There is mainly what is free dedicated schools for that to configure security policy and to load it and to enforce it on the consulate and Still gaining new and new features of the time so When you update your canal, you might get new features if you Ask the canal to use them. So thanks to these schools Okay, so this workshop is focused on the file system access control Basically you can control which file an application and process can execute read or write which did we allowed to be read and where you can create fires dectories or character devices or stuff like that So let's see an example Let's say this one first sandbox Which is kind of a generic one. So it only configures the security policy to a low instance read and execute on the slash user It only allow read to slash ETC and so on so it's quite generic, but it might be even sense Enforce when I use a login so every efficient user will launch after that We'll be restricted by this first layer of sandboxing Let's say They either want well launch a new application Let's say it's a image magic instance Or any picture application Well division can force also a new security and self and this will see What should be kind of take load to its own use to the code of the application and Because the application knows which files it should it should have access to well, you can say Well, I don't access to Don't cage that config and the pictures data, but when this application open a file actually it can also Further restrict its own sandboxing By adding a new layer third layer in this case and that might be for instance to only allow read to the specific file That is requested to be opened by the user and To still have access to the cage because well that might need Required and How does this work? So let's say that we can actually open the cool.jpeg file here So the first year grants is access Forward access, so it's okay But we need to have the same approval for the two first layers too So the kennel goes through the hierarchy and Looks for the second layer and it finds that the second layer Granted access to the pictures data. So it's okay so Let's go for the first layer now and The can go back to the primary directory and find that well the first layer grants access to the Home directory. So that's okay. Everything you checked and the access is allowed Okay, so how do you send back some vacation? Well first you need to define a thread model. You need to know what is potentially Malicious or not what is trusted or not Most of the time Well, I think in cooperation should be trusted because it changed the behavior of the application, but input files like pictures Everything that we're between can ingest from the network or the fact is them could be harmful Then you need to identify some part of the call that are meaningful and Where there's kind of good chance that is some back for instance five parsing in this case in the case we will see it's when Image parser of image magic part image and then do some stuff that you should not do Then we need to identify Where is this code and where we can patch it actually And if possible where the application already loaded its configuration so this way the efficient knows what is literally made to be allowed to access and All everything else should be denied and then Well, you can do that in an incremental way You can identify all the parts of the code and make it more generic To what get more security countries There's something to keep in mind. I will not talk too much about that, but it's it's important in what? It's forward. Well, but what commodity is? Ensured by the canal but because now luck is gaining more and more feature of a time and Because it is deterministic Mechanism you need to ask for specific feature before being able to use it So this means that if you develop an application That should be run on new canal and So using a new feature if while this feature is not arable on another system with an other canal That might not work. So this mechanism in place to handle that and Well, there's some responsibility for the rubber to be sure that what the efficient will work well And the main idea is to prove for an ABI version so With one of the non-oxyscal You can ask the canal to give you a number and this number will change with increment One the canal will get new features and to know which feature we need to take a look at the documentation So at runtime you can check which feature are supported and knows what you should ask and what you cannot ask to the can This way you can implement some mixing in a best default way That would that should protect the user as much as possible. So how does it work? So for this we use a first is called which is called and I create a reset with a specific flag so the landlock create reset version and With this call we get the ABI version So if it's a less than zero, this means that the can doesn't support the log at all Otherwise, it means that it supports Without the full set of them fetus or a subset of them then When you know the can support some luck you can create a reset and for that you need to specify which Access right You want your son back to be able to restrict So this is part of the compatibility contract This case. Well, you tell the canal The tone box will by default deny execution writing files creating new files and so on and Then you can add exceptions to allow some specific files fire key to what be alert So to create this will set you feel district to this is called and like create with this call Yeah, so it's an extensible archer it's so this might grow of a time and Then you get a file descriptor. That's a real file descriptor It's not five, but it's file descriptor that can be used and to populate this will set and To populate this will set you first define a rule. So that would be an exception and You say well, for instance, I want To what this pass to be? Exitable for instance slash user you wanted to what you want to execute a picture that are in this day to it So you first define a set of access rights and then you define the route of this fire key in this case Slash slash So you open this directory you fill the file descriptor in district and then You pass this trip to a new syscall which is called Landlock at will The first as human is rule set by descriptor and then well you pass the rule So you populate the rule and when you're done Adding all your exceptions all your rule all the stuff that you have to need to have access to it Then you can enforce this will set on the ground said and for that most of the time you'll need to Kind of pledge to the canal that you will not get more privileges One way to get more privileges is to execute set ready binaries. That will not be allowed except if you run as what which is kind of special and Might not be a good idea Anyway, after that once you're ready. You can call a third syscall, which is landlock restrict self With they will set file descriptor and then from that point Until the end of this thread and all its child This thread will be restricted and the sandbox cannot be removed. Okay, that's patch image magic Just quick reminder image magic I say it is pretty common It is a set of tools to manipulate images pictures to transform them and displace them and Can end a lot of fight formats Most of the time it is used as a tool in common line, but it might also be used for what buy servers web servers and so on Might not be a good idea, but that's the fact Um, so the attack scenario is what was called image magic image tragic So it was some years ago the issue is that there is well some image format are quite flexible and They include some URL to get some Some Scheme kind of some some some extra information with a leader to the to complete the understanding of the fight and That was in a shell past to Well a tool Like curl or do you a get so I can find that it's not safe And it could lead to shell Jelly skate so and that was case Okay, and what we do is to use this version Test it and then patch it and then test it again to see what happened even if if the Expert is used So here's the agenda. We'll quickly switch to another laptop So, yeah, I try to switch between these slides and the console So, yeah, did all you or most of you downloaded the pf the slides, yeah, that might be useful and Yeah, as a reminder and it is within there What we are doing now is Well, these changes are in in the patches in the Repository, so you already have these patches So it's just in case or if you want to get back to that later But of course it is not to apply this patches. Otherwise, it will be done in two minutes But you understand how It works and what that So, yeah spoke a bit about that But the different steps we need to do and what we'll do is first to declare long log schools because as you may know a school is mainly an ID a number and it might not come with an Dot H and API header other time deep seas provides these kind feeders but In the case of long log like was our new schools. It is not the case. So it will be more convenient to write right simple shim around that Yeah, then we'll take a look at where we want to patch it Well, I will help you with that because that might take a bit of time to listen an application Especially when it's not yours, of course Then we'll create a rule set our static rules Dynamic rules and then finally enforce everything We might not do that in this order because we'll try to test as much as possible and Yeah, let's start Yeah, first you can go in this directory So it's a main one that contains the source code so On my system, it's it's here. So I like to Okay, okay so I Guess it's okay So we end the good radio the good repository and now that you updated your Vagran script repository you can update well launch this first script It will initialize Image the image magic source directory to make it easy to work with kids So yeah, I can go there My grant image magic patches in it repo And I don't have that I need to update it. It's okay Walk even better if I have internet So I guess I'll do like you. I will start again And the dragon's this one's good So you see that Right now automatically think the files Okay So let's go in this directory image magic trying source magic And there's no at RC. So it's a typo here, but we're good So let's say good this script Okay, good So I cheated a bit. I already have with the reset up so Can just you know that but yeah, that's it too. I have like you this commit Yeah, I guess it's not the same name, but That's it Okay, let's switch to next part Then we'll need to copy kind of skeleton with the syscalls and Changed a bit So let's do that. So for the newcomer we are in this territory. The PDF is on the website Okay, let's copy this sandboxer.c. So if you want to take a look it's exactly the file She's provided by the kind of sources So and the one that I use in the first talk, okay, so let's copy that into magic slash unlock and Then change a bit this file. So the main thing we want to remove is well the main function, of course because That should only be a kind of healer library So we remove everything after that We might want to keep these two definitions here There's access fs from roughly read and roughly writes so this groups well Mostly reads accesses and mostly write Accesses so that that will help us after that and You can remove all the rest of the c code Except the two Cisco definitions at the top the three Cisco definition as a top so if you Look again this landlock we will set here Then look at rule and Landlock restricts self Otherwise is kind of optional The define these two define will be useful So let's save that I'm using them I guess not everyone is using them, but you can use whatever you want If you want to start something you can do pseudo Like you should do Pac-Man and Install whatever you want. Okay. No now we are Will look at The code of one tool of your magic which is called convert. So I guess you get it It's to convert from one five format to another So let's open this file It's rend Convert so I guess you you get the joke Okay, and now well will not Look too much as this code because well this is a lot But I look at it before and I know where It's kind of the sweet spot to patch it So I would tell you you can look for copy magic string There's only one sense and Just after this line We will add our code So the first thing to add is to create a rule set Yeah, I guess it's okay for everyone So, yeah, let's define a rule set So we will create a new strict viable Then I will set it here. So let's call it to set it here and Had handled Access FS with You guess Everything that we want to handle so everything that will be denied by default and everything that can be A load by rule also So we'll use what was defined the other five so access FS roughly Read and the same for right, okay, so you should have something of that And let's first try to Test it But I forgot to first I guess you did it, but we might do it again to Exploit the install version So let's launch a shell So yeah convert is already installed here we are changing what modifying a new version so we can call the install one which is vulnerable With the exploit Phi and try to write it changing from MVG which is kind of uncommon five format to PNG so this works and Well, this works I can tell you that it works because there's a image here and What you can see when you so I guess before is that there's so something actually which is printed It's a USH key. So it is it key in the victim machine, of course But yeah, that's you want this one So yeah, that was generated when you created your victim machine. So it's unique and it's not used anywhere But in your real laptop I guess you have this kind of keys So you don't want this well first to be printed on screen, but that that is fairly an example But if it's if it can be printed here well, it can be uploaded anywhere and same for your personal pictures for Any key you can have any code and see so We change a bit the convert source code and Only added this will set definition, but it's not enough We need to well if you build with that will tell that it doesn't know the landline will set editor type Because it doesn't know where to look. That's okay. We need to add at the top to include the file. We just import it So when don't don't look I'll put that here So now that should be okay. It is not because it is not in one. It is in magic Magic and look and the build should be I guess it should be quite quick because you build it before But if it's not the next one will be much more quick So that's it. We have a long lock defined, but it's not used anywhere. So Let's use it So what is status here? Do you hold off the convert will compiling? Well, no issues great Yeah, now we need to add to use this rule So like this we'll call the non-increed rule set with the will set 80 tiers that we defy and We'll get a file descriptor and then if everything is okay We'll use this file descriptor But yeah, first, let's create this file descriptor So, yeah, let's define all the variable Soon as we need them. It will be easier in case you're wondering There's a zero at the end and that is a flag and that is mostly not used except This kind of trick but to get the long version but all the time we could get new features and we What these flies could what this empty flag could get new flags Empty argument, I mean Okay, so we should be good now Let's check if this rule set is Okay So if there's an error instead, so if there's an error, let's print something Okay, and in this case, let's return and let Exit the program. So magic rules is just one, I guess Not sure if we have that somewhere, but it's yeah It's used as a way you can see that here too So, okay. Now we should have our file descriptor. We can test that to be sure Let's bring a debug stuff Yeah, just printf The rule set was created Well, you can print it if you want Okay, something like that Okay, let's build that again. Okay, and now let's execute the same command that we did before But this time we are with our own version of Convert, so it's in utilities convert Then you can take the same input image pregnant Exploit malicious Write that here So it should do the same. Yeah, it works. It still works. It's okay. There's no something in force yet we just created a file descriptor and You can see that here file descriptor and File descriptor is free. Great. Let's move on and yeah at the end we should close this file descriptor Of course, it's not a secret security risk, but it will be a file descriptor leak. So, yeah It is always good to close stuff to avoid resource leaks Yeah, so Yeah, let's close it now maybe to not forget But we'll put that at the end here. So as you can see oops At the bottom right you can see the patch name that Contains this stuff. So you can either take a look at the patch or even apply it if you want But yeah, you should try to write it yourself Now let's enforce it and What do you think will happen if you enforce this rule set as is You have some idea I Get some clues We have a rule set that restrict all wheat and all white oppressions and Allows Nothing so everything all this action will be denied So you can test that Yeah, so Let's call the first C school Pia CTL. So it's kind of a bit special But if you use second, you know it because it is required for second to Pia CTL Pia set no new briefs and Set it to one the other arguments are just not used Is there's an issue? Let's print that okay, and Let's do same for actually their Lana X is cool. So Lana grist itself So there's a typo in a slide. It's not a survey because there's no survey available But it's will set a D and in this case Because it should not happen Let's exit if there's an issue here. So it's not restricted It was to luck which is Okay, and now as before let's return magic okay, so now to summarize we have We define a rule set We credit the rule set we call Pia CTL and We enforce this will take this rule set on the ground thread with this C score So let's build that again and this typo here so Better now Okay, and now let's land launch it again 2d these convert Let's take the malicious file and write to TMP and I didn't walk and That's okay because we denied everything and you can see well converts complain that Well, it cannot write Where it won't you can read stuff first, but it will not be able to write it either So, okay with some bugs, but it's useless because it doesn't work. We need to add exceptions We need to add rules So what is your status here? Do you all have the same stuff? Let's move on Now we'll add we'll define a first rule this one will be To allow Access to all the libraries and stuff that convert my use So it is about allowing slash us and Yeah, that we need to open it get the file descriptor this rule strict and then What defined is full with the access? Mostly execute Read file and write and read actually and all this is defined with the access FS probably roughly read So, let's do that Yeah, you can print some stuff if you want No, that's not good one. Okay Now Let's create the strict, okay, and this one again is defined the long log file not the H5. Well Which also includes A file she's provided by your distro this time We can take a look quickly at this file. It is Should be in USA includes Linux Landlock and that is yeah once again for it by your distro and it contains the relevant bit for The run bits for your space. So Strict definitions you can find it again the long group set 80 tier you can find the Long log path beneath 80 tier with the two fields and you can also find all the access right which are defined here Okay, let's look at this rule. So I will add first Brown file descriptor so the root of the hierarchy and You don't need to but it's a good thing to do. It's to the opath flag opath is Used to reference a file, but you cannot do anything with this file descriptor except reference it for some syscrolls And no look is one of them So yeah, you don't need to open this victory and to be able to read the content You just need to be able to tell to the candle that I want this secretary to be a load To reference it a tree. Yeah, and oak log is like it's always good Now let's add the access rights So once again this type of here Guess Can take a look quickly because I did a copy past and that should be a load access not Handle access FS but it's good in the patch. Okay so we should allow Read in the victory and that's it Now let's load this rule. Let's add this rule to the rule set with the alarm. Like I do which is called so Well, if I do set with file descriptor We tell the candidate that it is a path penis rule and Yeah, you put the route there if everything goes Wrong, let's print an error message. Okay and all that Well, there's a mistake here should be Before using the whole set, of course, so I Added that at the end, but as you can see on the slide, it should be before the peer CTL cool Of course So let's move this code Up Okay, so let's recap We define a rule set Recreate a rule set for descriptor. We define a rule we populate the rule and We add this rule to the rule set And then we call peer CTL and an aggressive self to enforce this will set on the ground set so now we have kind of Small sandbox, but that would make sense So it will not work because what some stuff will work, but you will not have access to The input file, of course, but we can still test that and make sure that it built. Well It does apparently Is everything okay for everyone? Good Let's continue So now we'll add more rules. So let me let me make some room here So Of course when you're developing stuff you want to factor out code and so on for this tutorial, it would be much more Easy to just do copy pass on the same code But if you want to you can improve this code, of course So that was it for the first Exceptions the first rule and now let's add another one because if you execute this you'll see some issues probably but We can test it We can test it Yeah, so it works The rule was added But yeah, you can you can you still cannot Read and write The input file right to the that's okay So yeah, let's copy this block and add a new Rule This time not will not be to for slash user but for slash Dev null because that might be used internally. So we change the path and We need to change the access right to and this time we'll use a wheel Landlock access right not a group of them. So it will be then look Access a fair sweet fine because we want to be able to read Dev Null because that might be used for Well internal reasons That's it again to be sure you can build to make sure that it works and We'll go to the next part Which it to which is to add dynamic arguments So dynamic That is a fun part I hope Okay, so once again, let's copy the block and this time so If you're curious you took a look at the code before that before where we are in setting code and You can see that is just The fine name here. So this fine name is a one which is passed as an input path and so in our use case in our case it will contain the slash background explore issues that MVG think So that's good. We need to Well a low convert to read this file because That's what we want So, yeah, let's use it. So let's replace the previous Dev Null with fine name Same here. You just we don't just print it. We just actually use it that's better and Yeah, that's it. We want to be able to read it and that's it. We don't want to write to the input file Okay and so this time we can also build again and Test if it can read the file which wasn't allowed before So again, I'm using well, of course the utilities slash convert version not the version which is in time So new error message you see So what is interesting is Pension deny mother time There is no more before there was Pension denied to Access the input file convert in able to open image here pension denied and that is gone now You can see that we create we created three rules slash reserve for slash reserve slash Dev Null and The input file, which is dynamic. So that's great. You cannot define that in a system wide policy because well That's static So I think is almost good The only issue is that this tool cannot write on the output file, which is infotainate so Let's add that Once again, let's copy this block the ad will block We'll change file name with something else and The same thing else is mostly that so I didn't mention that but I should have image magic is kind of written Special way It pass arguments as long as it reads them, which is okay, but it also interprets arguments When it reads them so there is actual computational code near the argument passing and as much as the Well the convert will read the CLI arguments it do it does stuff So that is not really clean and that is Yeah an issue for different reasons and one of them is Well, it is more difficult to maintain to evolve and so to patch But you can still do that here And so, yeah, it's a bit weird to look at the output path like this, but it's a way image magic and convert do it You can just look at the code and you'll see what it went so Yeah, let's do it The thing is the output file doesn't exist when you execute the application So the efficient will need to be able to write to the day tree Okay, so we cannot just Low will open the distinction file that doesn't exist yet We need to abandon the directory that should exist and then I'd exception to this victory So let's do that Let's get the other path first Properly, okay now let's get the Dear name of this one and now let's replace the fine names with out there and We need to change the access rights for this specific You need to be able to write on it so and I'm not sure but maybe read read on it too, but we can try first with only the right access So it should be something like Yeah Okay, so that should be it Maybe this some Stuff that convert need to do on the directory like listing the content, but we'll see that Just now Except in my not built because I guess is a missing here looks to be looks fine great Yeah, let's test it. Yeah, cool. That's not good. So if we trace it we can Get an idea of what's going on And oh Yeah, it's not one plus one. It's I plus one. Thank you Yeah, so you can see here this Dear name is not known That's okay So let's take a look at what we need for that It's Here, you know. Oh, yeah, sorry So if you take a look at the main page, I can see that we need to add the include deep gen H Either so let's add it At the top Like here instance And that should be it. Okay. No warning anymore. Let's try it and It looks like this An issue This is another permission denied because convert try to do something if we are done audit feature We could we couldn't know what's going on exactly But otherwise you can just use a trace and take a look We can actually and you can see that it tries to Well open the TMP out.png So it means that you need read and write access to the content of the directory So let's add it. So I just Did a copy of This access groups so we know we now have also access of every read and roughly writes for again the output directory That should be it. I Will come later if you need to take a look but everything is in the patch again number six Okay, let's try to convert it again without a trace this time And there is something this thing going on here The decision went well There's still some issues with convert but oh It is in able to open this fire, right? Let's make sure of that it did write on this file. So that's good and what you can see is The exploit is still executed which is okay, but It cannot read the private key so The picture is still available but we limited the impact of such Will limited to only the output directory and to read the input five mainly is that good for everyone? Did you succeed to patch it this way? I do want me to Show it again Yes Yeah Requirement So these three schools right so what you call a bi exactly Yeah Yeah, yeah Oh, yeah, so yeah, so that's for extensibility flexibility reasons to be able to extend it later and because Well arguments are kind of limited for instance, you cannot pass 64-bit value Because That's the way it is For computer regions and so on So if you need to buy something else than only a such to bits value, you need to have pointer and Yeah, the beauty with this API is that you can pass point to restrict and Because you specify the size of strict it can evolve over time and If you don't feel a strict even if the size of strict change But if the trading part is filled with zeros, it will work even with other cannons So, yeah, so that was a question. I Asked myself. Yes, and I think it's not a good thing because You ask a user of this API, you don't really care about the API about the version you care about features you want to check this and that okay and If you want to deal with ABI compatibility You want to use in the library that will handle that Better than you could because some people spend some time it and that's the idea. So, yeah, that's why It is really simple. They can I can just return an API version then the use base library can do whatever it wants It it find good for the goal of Sound bug thing Yes, right and it's much simpler for the can too, which is good Okay, so I guess everyone almost did patch the application to that's good Again, all the solutions are in the patches, which is provided You can install it if you want on your system with these commands And this time you're up on your system on your computer machine the patch version Okay, and here are some existing left if you want to continue that Well, of course that was a workshop. So The idea is to make it simple to explain. I hope it was okay But of course you may want to add some loops here to have more and more complex tricks to Park the pass and the access right and so on and then build something more flexible Convert imagine that also supports some specific we already scheme like fd and that can also Walk with slanlock You might want to support more commands than only convert and there's two more arguments because that is kind of straight here Well, if you want to go further you can build your own candle at the support and test and For your own application if you want to patch it We're working on a set of tools To make this easier and especially to make it easier to test your applications on different cannot versions and that some can inversion that may not super unlock and that some that may support subset of it and that and Other that may support all the new features So and that is really convenient to put that in a CI and to know when you're developing your library your application that Well, it would work. Well, whatever the innovation you're using. Well, your users are using and Yeah, if you want to go on you can send patches of stream idea and try to Yeah, it's left as an exercise Okay, let's wrap up. So What does this patch So this patch is To sandbox native CLI application and it deals with well, it's native arguments So whenever you will run this application if the kind of supports and lock It will be sandbox. You don't need to have any specific confusion for system any System-wide policy just need to run your application. So if it doesn't support unlock Well, you should check that and just not try to sandbox because it will fail, of course But if the current channel do support unlock, well You can use it in sandbox as a code. I Guess it was quite quick to implement this first proof of concept Even if well this more time required to understand where to patch to find the sweet spot But that is doable and it's even quicker with your application, of course because you know it. So that's much more If you want to contribute this lot of stuff to do is there on the other side or your space side There's a bus library go library Ask a library or the other stuff that you'll see some tools using it You can take a look at the website and unlock the tail and on the github and yeah, look for the unlock on github, you'll see if you want to test to challenge the implementation feel free and Yeah, there's still some improvement to Do for the documentation and of course well What can suggest you is to sandbox your application and others If you want some motivation, well, there's some rewards program. So that might be a good things to do Thank you If you have any question feel free to ask them now or later There's almost no one sleeping, which is good Yeah, so my question is would it be possible to apply this type of sandboxing on top of a binary without Recompiling the binary directly so you would create a wrapper binary that would then load the secondary binary to sandbox it apply the the landlock Permissions on the top one and then the it would load the second binary and launch into it with those restrictions in place So that way you don't have to recompile your target Yes, definitely so That is so one goal from like is to be able to not only the sun does your addiction but create sandboxes like container manager or even Like application which are designed to send back stuff Like flatback or whatever the bell for up and so on and yes, you can do that I can do a quick demo. I did did the same in the pre-stock, but I can do it here So yeah, if you go in the samples landlock directory in a canel sistery, you'll see there's a sandboxer file and When you execute it, you'll see what the configuration so let's try to Yes So let's just copy the default the example configuration So in this case Yeah, I'm launching the sandbox application which is patch with strong lock will sandbox itself according to a configuration here in the Environment variables, it could be a fire or whatever you want and then launch. Well, what I put here to bash this case And that it's I'm in sandbox. Well, there's an error here, but it's an error from bash because you cannot read Well the home directory, but that's okay. I cannot read that. It's okay But I can still read the tmp directory, but I can read the slash actually and so on Got it. Thanks Okay So thank you


Good afternoon, ladies and gentlemen. I'm Glenn Richardson. I'm Professor of Early Modern History in the School of Arts and Humanities at St. Mary's, where I've been for quite a long time now. And I am an historian of what's called by historians the early modern period, more specifically the 15th and 16th centuries. And in broad terms, what I research and what I've been looking into for many years is, monarchy is a system of government as Renaissance monarchy is an idea in early modern Europe. So comparing the way the governments of England, of France, of the region known as the Holy Roman Empire, which is Germany and the central parts of Europe, and more latterly the lands of the Ottoman Turks all functioned. In this period, monarchy was the dominant system of government. It wasn't the only one, but it was the dominant system of government. And my research has always been trying to understand because monarchy is such an alien, notwithstanding our sacred queen, monarchy is such an alien concept in a way. If we really thought Elizabeth II was actually governing the country, we would probably find that rather weird. But there were, there were for thousands of years, many societies not just in Europe, but throughout the world, where that was a perfectly valid system of government and a functioning system of government, in which I would argue probably, here we go, no fewer people were more or less happy about the situation than modern government and modern democracy. I often challenge my undergraduate students to say, if you're an educated person in the 16th century, having gone to university, having a degree, you probably had far more influence actually, real influence in how your society around you was governed because of your education than you do in a modern mass democracy like we have now.  I'm not a monarchist. I don't want to see the return of the monarchy in any practical sense. But I'm just, my whole kind of teaching and research has been trying to make sense. People don't generally, in my experience, unless they're completely crazy, do things that don't make sense to them.  What mindset do you have to get your head into in order to understand why monarchy and monarchs functioned effectively as they did for such a long time? I tend to use a lot of audio visual material when I'm lecturing and indeed in my research because I began many years ago, I did my doctorate on, get ready for the snazzy title, what was it called? Anglo-French political and cultural relations in the reign of Henry VIII. Snazzy. And what I was trying to do in that thesis, which was somewhat revisionist, was to sort of get away from this whole idea of diplomatic history where, you know, it was all about ambassadors writing letters and that it had nothing to do with any other aspect of the history of the period. And what I tried to do in my doctorate was to pull in things like evidence of art and architecture of the way people actually behaved, the way they talked to each other, the way they, who they sent to each other, these monarchs, relating to each other, so that diplomacy became more than just signing treaties or negotiating like Theresa May has been doing this morning. For the good of us all, I'm sure. So, and trying to see, therefore, diplomacy in international relations as part of the being, the substance of monarchy. And the two kings who I became particularly interested in and from which everything else is developed were the man you see before you hear, Francis I, the king of France, probably second only to Louis XIV, who most people have heard of, is a patron of the arts and a developer of a kind of conscious sense of French culture. In fact, Louis XIV builds on the lot of what Francis does. And in that single painting, you have, in a sense, the whole system of monarchy in one selfie, as it were, because that's effectively what it is. Here is the king. This is painted by Francois Clouet in about 1526, 27. In the center is the king, painted in the very fashionable clothes of the time. He's a big man. He was about six foot two. But his clothes also accentuate, if you look at the shoulders and things, accentuate the width of his shoulder, all designed to emphasize his power and authority as the central figure in society. You have next to him three boys. They're his three sons. So that alerts us to dynasty, the incredible importance of dynasty and keeping the dynasty going. You can't understand the reign, for example, of Henry VIII, who will come on too shortly, without having a real concept that dynasty is important for the continuity of the country and the family. And family and dynasty link together. So that's his three sons. As it happens, two of them died before they reached full adulthood. He was succeeded by the second son, the man who would become Henry II of France, who had been involved in the French Wars of Religion, married to Catherine de' Medici. On our left side, you have the nobility, members of the nobility, dressed in their finery. That's something which has interested me, how the monarchy actually interacts with people. A lot of modern, everybody thinks that monarchs just sort of said jump and everyone said how high. That's not how it worked at all. It was a constant process of negotiation between the man, or indeed the woman in certain countries like England, who was at the head of the system, trying to contain and keep cooperation between the people who own the land, who had the most money, who they depended upon to do the things that they needed to do.  And they expect you to do things for them. Gifts, lands, titles, offices, in return for which they will support you. And if you get that wrong, and quite a few kings did get that wrong, you can end up giving your head cut off. Try Charles the First, or Dun to Death in other ways, Edward II. So it's a very, very fragile system of government, monarchy, particularly in the Renaissance. So there's an ability. They're ostensibly supporting the monarch, but in fact also wanting things from him. On the other side, you have the church, the incredible importance of faith, and the justification, the ideology of monarchy, very much rooted in the Judeo-Christian tradition in the West and of course in Islam, in the East with Suleiman. And both systems, the centrality of clergy and the church as a spiritual power house of the monarchy is important. And finally you have the least best-dressed person in the entire room is an academic, yes, poorly paid, and reading his dissertation out to the king. This is one of the scholars at that Francis' court, reading to the king's evident pleasure a translation of a Greek author which he's reading. I don't know what the dog's name is, but he's very nice, got a lovely collar, and that might allude to hunting and all that kind of stuff that monarchs do. So in a sense that's now completely forgotten where I do my little clicky thing. Does that work? It does. So that's Francis and he sort of stands for what's going on. The person with whom he had a very close and competitive relationship was Henry VIII of England. And a lot of what went on in the 1520s and 30s in Europe had to do with the competitive relationship between these two kings. And as I said, that's where I began my research, but probably in the last sort of 10, 15 years, it's sort of gone over to the French side, more than the English side. I won't say very much about Henry. He's a legend in his own lifetime.  And as I said earlier, the most important thing for him were two things. Firstly, dynasty, securing the succession, which is why he went through all those wives trying to get himself a son, which eventually does, and religion. Henry VIII is a very religious monarch. We think how can he be that? He's been married six times. He's just done people to death and all the rest of it. It's because he's a religious monarch that he does all that. In order to having secured this accession with the birth of his son in 1537, having had to break from Rome in order to do that, his whole second half of his reign focuses on the relationship between worldly monarchy and the church and completely revolutionizes that relationship. So he's quite a significant king for reasons other than that. I'll skip over this. This is just a brief illustration of the hierarchical nature of society, which I've sort of illustrated already with the reference to Francis. That's another picture of the same king by an artist called Jean Clouet, painted in 1526. It's interesting that in this period, although kings could often appear in, like I've just shown you a picture of Henry formally in Parliament, as the queen still does when she opens Parliament each year, most of the time, what they're really trying to project an image of themselves is a kind of hyper-gentleman. So there's no crown, there's no robes of state or anything like that. He is showing you that he is, as he would say himself, the premier gentilm of the kingdom. So he is the first gentleman, the first noble. In other words, cooperate with me, work with me to enforce the law, to ensure the protection and extension of our territories, because that is the duty of monarchy. And I will be to you as a good lord. They have this concept of good lordship. And that, I think, is key to understanding how monarchy actually functions. It's much more cooperative than people imagine. So what essentially are kings meant to do? Well, according to the theorists, I'll come back to him in a second, according to theorists of power, not exclusively, but men like Erasmus of Rotterdam and perhaps more infamously, Nicola Machiavelli. If you read them and half a dozen other theorists of the time, I've argued that Renaissance monarch can really be summarised in three things, that a monarch has to be, and it doesn't matter whether he's a man or a woman, they have to in this society be three things. Firstly, a warrior, that is, to defend and if possibly extend the extent of territory which they and their nobles, upon whom they depend, can profit, either directly by ownership or exploitation of land, trade, whatever. So you've got to be outward looking, whether you're actually at war or doing things that give your country, your kingdom, an international profile, that is the first thing. The second thing is that you have to be an effective governor, that is, you've got to keep the line between competing nobles, you've got to ensure a valid legal system that, with all its faults, functions, and the, because the king or the queen is the fount of justice. It's why even to this day, you know, somebody is charged with something, it's the crown, R versus so and so, because the crown is meant to be the supreme fount of justice in all these societies, whether it's in Islamic Turkey, whether it's in France, Spain, wherever. And the third thing which they have to be is a great patron, that is, to be able to balance the competing interests of all kinds of sectors of society, not just within the nobility, but within the mercantile classes and even at what you might call a lower or ordinary social level. You've got to be able to be seen to be distributing favor, calling on people through their merit or for merit to do things for you and generally keeping the ring in this society which, as I said earlier, has only interpersonal relationships, really, to keep the whole thing together. There's no great formal institutions of formal power. Erasmus wants your king, your European king, to emulate Christ to be, while powerful, still humble, to avoid warfare, to do justice, to be a good boy or girl. And he famously writes a lot about that. Machiavelli is famously, rather less worried about morality, you need to do what you need to do.  The whole sentence is, it is better to be feared than loved, but the good prince will avoid being hated by the people. In other words, if you have to have either being feared or loved, how many was that? Thank you. Then go for it and do what you need to do. But just be careful because you need to avoid being hated by the people. And tyranny, they recognized tyranny as a concept, tyranny will bring revolution, rebellion, etc. and the downfall of your system. One of the characteristics of the period, the person I'm currently working on, is that that complex system I've just been outlining. Almost by necessity, monarchs need friends and helpers. And it's interesting that right across Europe and beyond, in the 16th century, what you might call the the minister emerges, for really for the first time in European history at least, not so much in Chinese or Indian history, but certainly in European history, a great minister of state emerges in all of these countries to try and guide and assist the monarch in what they're doing. And I could give you chapter inverses to who these people are. In the case of Henry, of course, it's the man who's very closely associated with this part of London, namely Cardinal Wolsey, in that his palace, which he built as a country residence to entertain people and as an expression of his power as the minister of the king and also as a papal legate and cardinal of the church, is of course Hampton Court Palace, which is a 10-minute bus ride away if the traffic's all right. I'm writing a biography of him at the moment, trying to sort of make sense of him as neither being a kind of relic of the Middle Ages, which is what a lot of 20th century historians made of him, that he was in an overweight, overpaid, over here, kind of churchman, who was everything that the corrupt church that Henry got rid of was all about. And trying to actually say, well, no, he might be that, but that's not really why he's important. He's important because of the extraordinary skill he's got in being able to manage about five or six portfolios. I mean, if there was a government now, Wolsey would have been Secretary of State, Foreign Secretary, Finance Minister, Treasurer. The whole lot was committed to him. And he was also responsible for England's relations with the Papacy and his whole career was built on telling the Papacy what it wanted to know about England and trying to arrange things for the Papacy and telling Henry that he could get the Papacy to do whatever it wanted to increase his power over the Church in England. That worked brilliantly for about 20 years until the King decides he wants to get rid of his wife, Catherine of Aragon, who is the aunt of the most powerful sovereign in New York, Charles V, and the Pope is not going to do anything to help Wolsey do that. And of course, he falls from power as a result. So he's a really interesting character. I'll pass on to the, oh, look at that. Some of the things which I've been looking at in more recent years is a meeting in 1520 between Henry VIII and Francis I of France and trying to understand what that was about. Huge amounts of money spent in this lavish entertainment, one of each other, really trying to impress and intimidate each other to inter- cooperation and trying to stop being attacked by each other. So, monarchy is a very tricky business. The last two slides I want to show are just because I mentioned Hampton Court. One of the reasons why they build palaces and things like that is because the court, which is the other institution I'm very interested in, it's not just the minister, it's not just the king, it's people who surround them. We began with a slide of what is the court, not judicial court, but the royal court. What kind of institution is it? How does it function? Who holds the keys to what doors? What determines whether you can get close to the king or not? Who can sit with him at lunch? Who can't? All that kind of etiquette and ceremony, which in many ways was seen in the last century is irrelevant and a sort of fripperite, not to do with the reality of power. I think in the 20th and increasingly now in the 21st century we're seeing it as incredibly important and central to understanding of early modern power. So, building buildings to house courts etc. is a very important aspect of a kind of magnificence, a compelling a compelling capacity to support the country is what these buildings are trying to say. Of course, they're very lavish, they're very luxurious, you know, but and I'm not sort of justifying the huge expenditure on them, but I'm trying to understand why they're built as they are and they're built to express power and also as actual machines for government as to see how how you actually work a monarchical system of authority. And my last slide is really probably the one that everybody knows all these monarchs, but they could stand for each and every one of the monarchs I've been studying, but we'll furnish with Henry the very famous portrait of Henry VIII by Holbein with standing with his hands on his hips like that. If you practically anybody in this country and many others, if you just showed them that without telling them anymore, they would know that was Henry VIII. And I think that says something about the importance of artistic, architectural, patronage and communication in the 16th century, which you didn't have, things like printing, etc., which you didn't have in centuries before, which is why, apart from the extraordinary things he does, that period of monarchy in general and his Renaissance monarchy in particular has fascinated me for these 20 odd years. Is that the time? Yes. Thank you.


One of the biggest shifts that the West Vancouver Memorial Library is making is with our technology. We embrace a broad definition of literacy, acknowledging that our youth need fluency not only in reading, writing, and arithmetic, but also in the evaluation and creation of content that has images and sounds. So our library staff have a huge role to play in helping our youth to learn how to navigate resources so that they find the best information, and also how to use technology to best communicate their work. When it comes to thinking about 21st century literacy and the kinds of technology that we're really implementing in the youth department, there are a few things that come to mind. The first is our Kindle Lending Program for youth. Many libraries now have e-reader lending programs. West Bend Memorial Library was one of the first to have a Kindle Lending Program, and I believe we're also one of the first now to have a Kindle Lending Program specifically for kids and teens. Another thing that we offer here in the youth department is our technology petting zoo for young people. Unlike petting zoos for adults where really they're coming in to maybe try before they buy, we find that young people and families come in to try the content on these devices. And the content we very carefully selected, we've scoured review journals and blogs and Twitter, and helping patrons select the content that they're going to purchase for their device is another big area that we're seeing a shift in. So the entire second floor of our library is essentially dedicated to youth. There's a few really distinct sort of special places up here on the second floor. The first is our picture book area or the picture book circle as we call it. This is a space that does much more than just house our collections for young children. We really want caregivers and parents and families to feel at home here and play here and squeal here and have a great time. So when it comes to shifting our program offerings towards encapsulating a lot of the 21st century literacies like collaboration and inquiry and content creation, that really does start in the early years. Obviously when you get into the school ages, traditional library programs might be something like an author visit for 8 to 12 year olds, but we've also tried to shift that to be more of an immersive interactive collaborative type of program. So while they get to spend time with a really great author, it's not them simply sitting back and hearing about the process. They're really engaging and making something creative. The library has a 2011 through 2015 strategic plan and in the process of creating that plan, we really looked at the teen space and identified it as a priority. The current story of footage was extremely small for the size of the teen population here in West Vancouver. And also its proximity to the picture book area was really less than ideal because we have teens and young children very close together. So we're really delighted that the teens are going to be moving into their own dedicated space. When I came sort of on board this project, and it was really important to me that we have meaningful engagement with teens. They are really the ones who have driven this project from the beginning. We essentially went to our teen populations with no even real ideas of what we wanted that space to be. So the consultation process was very in depth and it was very successful. So I think because the teens in our community are so busy and so engaged in other activities, when they come and volunteer at the library, they need it to be meaningful. They need it to have a value add to what it is they're trying to accomplish and their bigger goals. And we really see the youth department as a place to facilitate that, to give them meaningful engagement opportunities. So ultimately what we want is for all youth to experience a library as this amazing place where they discover themselves and they discover the community around them throughout their lives. So we're looking to develop lifelong learners and youth that are engaged with their community.


Thanks for checking this video out your mountaintop news video was coming up in just a minute Did you know this could be watched thousands of times shared a bunch of times likes comments you name it It's going to be there. Why is it your ad here? Call me The Pike County Public Library on Lee Avenue holds a teen activity club at 4 p.m. On alternating Wednesdays It's a lot of fun. It just as much for me as it is for them And it's like I said we try to do different things each week So this week for instance, we're making Kool-Aid lit fall the teen activity club hosts many events and activities where teens can Make art and learn helpful life skills. I work with anyone from 12 to 18 And it's pretty much we meet every other week and we do craft activities It might be teaching a 16 year old how to sew making their own stockings last Christmas. Sometimes we do paintings It's just a variety of little skills that maybe they would you know, need to know later and things that you know We're just fun little things for them to do the teen activity club takes place at the Lee Avenue Pike County Library at 4 p.m On alternating Wednesdays teens interested in joining the activity club need only show up for mountaintop news. I'm Kelsey Dean