Thank you very much Kathy. That was very gracious of you and and long and I'll Dispense with any other introductory remarks. I'm really honored to be asked to give a keynote in front of this many people on a topic that is so central to what you're going to do for the rest of the conference and In honor of that keynote thing. I'm not gonna Give you the normal power points with five hundred slot, you know bullet points and a recitation of what's going on Because I think you'll you'll get that at the rest of the conference What I want to start with is really to give you the benefit of about 20 years worth of work in the Intersection and this is going to be the theme at the intersection of Privacy cyber security data security law policy processes business stuff all that stuff. I've lived that the way to sum up what I've done in the last 20 plus years is I've lived at the intersection and And and that's I don't want to give you some lessons from living at the intersection because I think what you all are doing as security professionals in the education industry sector profession discipline is really Going to be your success is going to be dependent on how well you thrive at that intersection and how you manage the Intersection between what you do and what your other colleagues are doing within your organization or institution and outside So that's what I'm basically going to do Hello people on the on the web This is I guess very interactive so you can submit questions and somebody will represent your questions And anybody in the audience if you feel like raising a hand and asking something, please do that I'm very happy to stop and pause there, too So the technology is working which is really good And the theme really is collaboration living at the intersection and what it takes to do that is really team building a team and so Before I get started into the lessons. I want to talk a little bit about what why the landscape is so hard and I'm not going to recite a mandian statistics. Yay. I'm not going to recite Verizon report statistics I'm not going to do that.  So that's kind of what I do. That's that's my shtick, right? And And I've frequently been called upon to be a representative of a team or the translator for those who need some Kind of simplification of concepts that come so easily to those who are trained in in areas and really expert in them And I want to I want to give you that perspective and tell you why where we're living today is frankly terrifying Concerning, you know pick a pick an adjective. I don't want to get too flamboyant about it, but it is very serious and Example of the seriousness of it that's not coming out of one of the vendor reports is I was at the I don't at a ceremony in in February at the White House. It's all drop names I was at the White House on them in February for the release of the NIST Cybersecurity framework How many of you have looked at the framework? Everybody in the room everybody on the web. I'm sure so so this is a pretty You can argue about what it really means and how effective it will be But I happen to think it's a very consequential document and I'll tell you a little bit more why later but I was at the Ceremony and this thing was announced and you know there were a lot of their several CEOs There were several cabinet secretaries and the chief of staff for the White House gets up and and gives the introduction and He said, you know, there are There's one thing we can all agree on from the White House perspective from the administration is that cyber security is one of the only systemic risks Facing the United States one of the only systemic risks facing the United States and I thought that was very telling that the declarations have been coming in a very Blunt way about how significant these issues are that we're all addressing in our own institutions There are only a few others that are systemic Maybe global warming maybe a few others But this one is systemic and the realization the public discussion that's been had the last several years about What to do about post breach target that target is the target reference Target has terrified Boards of directors your bosses your management your your administrations to say are we doing enough? Are the people on my team? Up to the task. What do we need to do and how do I? Explain what we're doing. That is absolutely part of the landscape now Then a way that even five years ago three years ago was but not quite as much as it is and it really It makes people kind of in between betwixts in between because on the one hand you do have the targets and the the University of Maryland Incident and others that affect Individuals Individual records that might have been or were reasonably supposed to have been compromised and so you get to go Public with those because of the laws in the United States that require disclosure, which I assume everyone here is familiar with But you know if you have a penetration and reasonable, you know You have a reason to believe that records about individuals that involve credit card numbers or financial data are compromised You have to go public a very unique Invention of the American legal system by the way we started it other countries are now taking that in and saying well that makes sense I'll do that too So that's on the one hand you get that interplay and you get people coming to investigate and maybe sue you There's a plaintiff's bar now again an American invention plaintiff's bar. That's saying that's interesting but on the other side of the kind of thought process and Frankly on the other side of Capital Hill are those who are really focused on Nation-states, they're really focused on geopolitical issues and they're focused on China other geographies. They're focused on controversies. For example the Ukraine Tensions have had a cyber element to them and they're really focused on what do you do to? Incent and support behavior by the private sector including Education to protect intellectual assets and how do you incent? Collaboration and make everyone feel like they got to do their best and not be penalized by coming forward and saying we've got issues We've got a vulnerability We've got heartbleed and we're remediating and we've got some issues and you kind of get a landscape where you're in the United States in particular where you're caught between Those who are looking at identity theft and really want to reinforce the fact that everyone's got to have good security And we got to go deal with breaches in a fairly significant punishing sort of way and and the rest of the Issues which are let's let's all collaborate and get better at security and it's a very very challenging place and Those who are sitting in positions of having to allocate resources and make decisions are Struggling to figure out how do you do the right things? How do you do what their security folks are telling them to do their privacy folks are telling them to do but But keep in mind this landscape. So that's that's a backdrop and The the reason I guess I'm asked to do these kinds of talks is that I've been around for a while and I've lived in this intersection and So my background is I was an engineer Went to law school did a little bit of law, but then kind of backed into the privacy Space when I was asked to figure out what to do about privacy back in the mid 90s when the web emerged as a medium of business and That's how I got into security because I backed into it because once you got I've got to be appointed a Privacy officer. I think I'm the first in business. I guess fortune 1,000 at least and What does it mean to be a privacy officer? How many of your institutions have somebody doing privacy? About 30 percent how many of you do the privacy work? Almost as many so I think frequently it lands with IT security information security and that's fine but sometimes it's not and You could tell sometimes as an organization's mature. They actually start splitting them apart Because they're actually kind of different and that's what I what I discovered over time is that they're very different But at the same time if you're gonna need somebody to pull it together, you know, you end up Gravitating and and putting the two together sometimes and that's what happened to me. So I was doing privacy As a privacy officer and then I started getting calls around 2005 Right about when the first data breach notification law was enacted in California It said, you know what we seem to have an issue here an incident. Can you help us? I thought well, you know, I guess so That's data security and then eventually cyber security. And so my first lesson is a Lot of us do this together But there's actually a big difference between and amongst these concepts and it's useful to have a sense of what the differences Are and what the terms are so just for purposes of our discussion I'm gonna just kind of give you my definition and I would source the definitions from useful authoritative places and I I start with right now the there's a NIST framework has great definitions the NIST framework draws from White House Documents that I think are pretty good because they reflect a lot of stakeholders useful to start there, but cyber basically the policies that every technique you do to secure IT systems digital systems that have data and that are used to undergird our our society data security protection of the information on those systems privacy Policy decisions mainly policy decisions and actions you take to deal with information about individuals and More broadly when you're not talking about data privacy you get into the broader concept of privacy Which which I won't get into here, but basically there are differences and one Way to think about it is that you can't really have data privacy unless you have data security and cyber security You can't really have data security Unless you have a reasonable degree of cyber security because the data isn't gonna be safe unless you secure the the the systems on which it's up It's it's resident and on which it flows right But you can have cyber security without having either of the others But then why bother why bother with it because then you're not securing assets that matter and that you're not Maybe protecting values that have come to matter to us is in society So that's a way of thinking about the relationships between the among the three concepts the other though lesson to Over time I kind of figured it out that There are lots of places with people with very deep expertise and opinion Lots of situations where you end up spending a lot of time debating what these terms mean I Don't know how many of you have been in these discussions, but I have a friend who's involved in them She's a federal regulator She can't really tell me the details, but she tells me that she's in charge of an interagency task force trying to come up with Standards new new cyber security related standards that will be influential But she's telling me about these interagency meetings and they are spending she said a lot of time debating the meanings of words like cyber security Privacy in other words that have been defined many many times by the administration that that is responsible for this work That's an example. How many of you've been in standards efforts where you spent a lot of time doing this and I've been inside organizations I've advised organizations where you could see that there's a lot of delay in trying to get a team together and go work on an Answer work on a solution Because you're spending a lot of time saying you know what I got my definition. I've got you know information governance Let's not get off on a detailed discussion about what does that mean? Information governance and everyone has their view and everyone said that in order to put a team together You've got to settle on some common ways of rough cuts of what what you're working on what the terms mean what the ideas are But don't spend too much time or else you're gonna eat up the time and those are waiting for answers We'll come back and say what what's taking so long So that's one thing and then if you're gonna put a team together That's gonna do data governance or data security or security Part of the other issue is you know boundaries if you've spent a lot of time figuring out who's who's doing what and kind of guard them It's it's gonna it's gonna add time. So it really the answer to some of the big challenges facing us are Not to spend too much time on this but then you know not to ignore them either Why did why did they why did the folks at edgacos asked us asked me to talk about Team building a team. I think one of the the theme for the conference is Mind tricks and other strategies. So I think this falls into the context of other strategies I know that education is unique. I know that that kinds organizations that you all are in lend themselves to Decentralized decentralized actors right and but at the same time you've got responsibilities a cut across They cut across departments have got across institutions, maybe even campuses that are that are very large and Part of the only answer really is to build a team and I'm not talking I think I was talking to dinner at dinner last night with somebody from from the audience I'm not talking about building your team. I mean, yeah, that takes time that takes skill To identify the people who are going to really be part of your core team. I'm talking about team across your institution and team across Institutions like in edgacos, you know identifying those folks who you can work with to get something done and collaboration like that is Really useful Sometimes it can be a total waste of time So in the in the context of cyber and privacy The trick is to know which one to use and and when to use it sometimes if you're going to deploy a particular technology I get it. You need a project management plan and you got to go do it But if you're going to be deploying something or doing something that's controversial that has policy implications or privacy implications pause and Figure out who else needs to be part of that and there's a in the education space not Not in higher ed particularly. It's a new entrant is an example of of a privacy related Issue that got an organization caught in in a bind I'm not how many of you know the the organization in bloom if you've heard of in bloom Gates Foundation another foundation invested a hundred and fifty million dollars in the creation of a company That was intended to create and offer middleware cloud hosted middleware Solution for storage and management of education records the clients of in bloom were supposed to be school districts and So launched with a fanfare going to revolutionize educational records because you can put them in the cloud school districts and schools and you could track Student performance and teacher performance logitunally over time Which is a value proposition that is something many people find very valuable very very useful others think not so much and In bloom after operating for a few years just shut its doors Go put why? several reasons one of the reasons were From the outside looking at the situation Backlash and a concern about privacy and it really became evident that they had not built enough of a team Outside of their organization that said you know what here's the second station is doing something good And they have some protections in place and we know about what they're doing We help them do it etc etc that kind of collaboration if you're going to embark on a an initiative was was not quite there and It got it got to them. So that's a collaboration is a really important Point but knowing when to do it went to build the ecosystem Now I mentioned in bloom Because I was trying to figure out what are the examples here that absolutely are Resonant and unique to education as a sector Privacy or security and in bloom is definitely one of them The other is you know some of the reach recent breaches. There's a if you ever need ammunition or ever need Information about what's going on in education in terms of breaches. I don't know how many of you know the privacy rights clearing house site or Pogo was right Website It is kind of a funnest name, but the but these sites actually, you know, I don't see any better for Identifying pub where you can find information about publicly disclosed data data security events breaches You can actually sort or go through those for Incidents involving institutions of whatever sector right so it's educational educational institutions and You go through them and you kind of speak up patterns and Education is is kind of unique. I mean the threat actors that go after you all Most frequently are your own folks, right? So you get a lot of careless behavior That can lead to breaches. That's for sure. That's why awareness is so important and so, you know user engineering You might get insiders Insiders I as I understand now I am going to kind of go to the mandiant and Vendor reports, but I you know and from my own experience the insider issue Because of what you've gotten in your institutions is is a very serious issue. Not you're not unique in that a lot of other Sectors that have valuable data are Definitely targets of that but but your your institutions are pretty special and but your institutions also are ones where it's likely to You're likely to be able to isolate and find the crown jewels a little bit more easily maybe than companies which are More diffuse and have multiple instances of some of these pieces of data So so so that insider vector is definitely something that's very significant for your sector and then Whatever else I in terms of outside actors coming in What are people are really trying to get at with with your your sector in terms of Security you know it better than I do but you've got some you know the intellectual assets that you have a really key and then you know Student identities or personnel identities. You've got a lot of people educational institutions are all about people and you've got those assets and you're and The sector is known unfortunately as being one of the easier targets. So while you're not a bank You're not some of the companies I work with that are Maybe more significant targets You certainly have the right profile to continue being a target and continue being a Victim of these breaches. So that's that's one aspect on the security side What makes you unique in the education arena? It's probably more interesting. I think Because there's a lot there's gonna be a fair amount of attention on education I think in the next five years and there are a lot of forces that that drive that in bloom is an example of An organization getting caught in an interesting combination of factors First is that education like medicine like other areas which are a little bit slower to pick up and adopt new technologies or to do it in a way that's kind of made me more vetted Education is ripe. You're seeing your institutions adopt cloud platforms. You're getting Social platforms introduced into your environments potentially without you're getting too much Control over over who's using what so you're getting more consumer type platforms coming into your institutions You've got some regulation that covers data privacy or privacy in education Some but there's a fair amount of momentum building in Washington In particular, but also at the state level that whatever Exists is not enough to protect student privacy and it's not enough to protect the security of information that you all have You all your institutions have act to which you have access and to which for which you have management Responsibilities, there's a very significant amount of concern that's built up over the last five years There have been briefings where senator a couple of senators senator carries others have have talked about this They've focused on K through 12. They talked about higher education The the breaches involving respect institutions haven't helped matters and so you're sitting in a situation where you have now that concern front and center Driven by data security breaches, but also by this notion that there's new technologies and that institutions aren't spending as much time in oversight Deciding whether or not to vendor Certain solutions certain data And then once they do keeping keeping a handle on it That's I think palpable and so that's what will drive changes in law and Then changes and standards that might come out from those who fund As a result of the NIST framework and other activities going on in government a lot of the funding that will come out of the federal arena We'll have new conditions tied to it. I believe that we'll talk about, you know, show us your security plan Demonstrate that you have put in place the elements of recent education department guidance on using outside vendors for, you know Cloud services that sort of thing and I think that is inevitable and that's what makes the sector Not unique, but you'll see change happening in this sector as it's happened in others So I think that that's coming But in the main actually the or not here and what is not Unique is that what's happening to other sectors too. It's not it's not unique to education But the fact that you've got so many stakeholders and that you've got decision-making processes in your institutions that are pretty diffuse Means that you have to have a lot of collaboration a lot of Consensus building as you figure out how to deal with them. What's your position on legislation? What's your position on these standards? How do you take standards that are supposed to be imposed and then socialize them and get support for them? All of that points to the need to build consensus And I've talked about Proposals I've talked about other missed the NIST framework incidents The other tried and true techniques a trick. It's not a mind mind trick, but it's another strategy is You know, I don't know how many of you scan the social media or the press On your phone or every day, you know, I think the the folks I'm working with I may with CSOs lawyers and You know risk managers, that's that's who I work with these days client base and What I what's been very successful? I find is you kind of wake up in the morning Early early morning see what's happening out there. It's a new breach. It's a new lawsuit. It's a new proposal something It's something happened Maybe the security is an exchange commission for those companies that are publicly held what the SEC says It's really important. So whoever is announcing something or saying something is to take that and plug it right back to the company management I Don't know how many of you do that or make a habit of it You don't want to overdo it, but really good trick the strategy is to say that's happened there, right? So if you're not using the University of Maryland incident or other things in your sector and say Look at what happened or I've been to edge a cause Here's what this peer group has said or here's what I learned about this is using that judiciously is Very effective It's very effective to attract resource to justify resource to justify and inform what your what your story is going to be You know a thought a story is worth a thousand words I'll get a one pictures worth a thousand words a story is worth two thousand words because an example will get some You know get your folks get your leadership wondering and and thinking that that's something they might do too It's not always going to work, but it's a it's a for sure useful and in terms of looking for guidance and other external developments, I think The NIST framework I'll come back to now and spend a little bit time on this because I actually do think it's a very useful tool even if you're not considered to be part of the critical infrastructure and I'm actually curious to think to ask you I mean do you all think that the institutions of which you're a part are part of the critical infrastructure Do you how many of you think you are part of the CI and it's a weird question? I know because it's a you can have different parts of the institution so about 15% of you Sort of raised your hands and that's about the state of the definition of critical infrastructure right there It's like it's a little like pornography You know when you see it they kind of know it to paraphrase a famous Supreme Court justice in case and and that's really kind of Why the NIST framework is actually a useful tool? so When in February when the when the Obama administration released out of NIST the National Institutes for Standards of Technology The framework it did so after a year exactly a year of a stakeholder process that involved about 3,000 people and I don't know if any of you were part of the workshops that were held the framework was in is intended By word but by black and white to apply and be used by the cyber by the critical infrastructure Those industries were a part of the critical infrastructure So the the framework resulted out of an executive order the president signed back in 2012 It said basically that the politics around that executive order were For the first term of the Obama administration The administration was building its position on cyber security. I was thinking about do we need legislation? It came up with a position said we need law and there's a kind of a write-up of what the law should be But at some point in 2011 20 early 2012 the administration concluded no, we're not going to push legislation We don't we're not going to do it. And so the the political play was in the state of the union address in 2012 Obama the president talked about cyber security and said basically I signed an executive order I'm gonna do we're gonna do as an administration what we're going to do and then we're going to Now wait for Congress to do more so the administration that the strategy that the administration is on is basically Doing what can be done under current law Within within its power within the the agencies and waiting for any other laws for Congress That's basically the posture that you can expect for the rest of this term this this administration See what next when next might bring That should tell you something about don't wait don't don't expect too many new laws Actually don't expect any new laws in privacy or security unless something really consequential happens at which point Then we're talking about a kind of a 9-11 kind of a situation. So that's the landscape The executive order that was signed in 2012 said, okay, here are all these things. We're going to do six or seven different areas One of which was let's get a new framework out there And we're gonna we're gonna mobilize and use NIST Which is a very respected agency to mobilize and take a framework that will be voluntary But that could apply to any critical infrastructure sector and anyone else who wants to use it 3,000 people get consulted stakeholder things and stakeholder sessions and You take all of the ISO NIST other security standards and you boil them down to what is a document that can be used by board of directors? By management by the CIO the CISO and anybody else in the organization who wants to kind of track and say How are we doing on managing cyber security risk and that document that Was issued a year later right on schedule is like 45 50 pages and is actually pretty pretty good I can read it. I actually help you know input to it So if if you know you can have lots of different type of people looking at it and using it It becomes a rosetta stone so you can use it to translate lots of people can look at it and say oh I get I get what that means and so the simple words That are used to describe the basic basic activities go I go back to the point about let's not argue about definitions. They could have used different words They could have used a lot better words probably I think so They have these like one word descriptions of the first thing you do in managing cyber security risk is identify Identify what the hell does that mean identify? I only kind of dig into it. So what they mean is identify the risks and then Identify because I had to keep we're using the word identify identify All of the assets that you have in your the information assets you have in your in your domain and you're in your organization Which is really hard nobody really knows exactly what they have but that's they say you know make an attempt there and I did they keep going and identify things and then detect and defend and recover and those are the words the one word One word descriptions of the basic things you need to do why is that powerful for you all it's it's silly Right, you know much better What the elements of a security program need to be you can go to much more sophisticated tools But you know what sit inside a board of directors or sit and answer your provost or your Chancellor's question if you ever if you ever been in the situation they say well tell me how are we doing in our security program and Explain to me because I'm not very technical explain to me What what are the ingredients that go into a good security program? I don't many of you have ever gotten that question. I have gotten that a lot of times Recently, I mean I've been consulting more on the consultant side the last couple of years I'd never got it inside a company because we already kind of knew that But on the outside I've been I've been consulting and talking to a lot of senior people the first time I ever got that question I froze Because I was so deep into what I knew and thinking and somebody asked me the simple question and I kind of looked at them And I thought you know, how do I answer that? Do I start talking about the law? Do I start talking about the elements of the ISOs? You know 27,000 framework do I start talking about? COVID do I use this that and I realized if I had opened my mouth and went if I'd gone down that road I'd have lost them within a second and They would not have understood what I was saying and they would say okay. Well, that's nice But I got to go figure out now What I can understand enough and then to go figure out how to make decisions about and make funding decisions particularly about and What the rose what the what this rosetta stone what the NIST framework does for all of us as a community is Is it helps us not have to come up with definitions and words on our own and then worry about them and all that we just I think I Think suspending the desire to to make your own for a second If I were in if I were appointed newly appointed a CISO or an IT security person, which I won't be but if I were Or if I was counseling one which actually more likely happens And they said well, you know, how do I explain what I want to do? I said well, you know take these words take these this kind of checklisty thing Which which is kind of a guide. It doesn't you have to do all of it and say, you know, here's this authoritative Summary of what the world in the United States at least what that what the United States currently expects to be in a security program and And look at it and say, you know, have you know, we're gonna be expected to have identified our risk and identified our information on our assets and have done certain things we are expected to Detect attacks and be able to defend against them and if we are hit we are expected to have certain mechanisms in there to recover et cetera et cetera and That's what we're expected. Those are the ingredients of a successful security program That is plain English makes sense and it's tied to an external standard that it's not mandatory, but it's actually eventually Because of the the landscape here and the challenges. It's it's likely to be something like it is coming Maybe not not in the next couple years, but it's eventually there'll be something there that says, you know What there is a standard of care to which organizations will be held in the critical infrastructure or anybody who even gets close to being considered to be important And that's why that's why I think this is you know, not legal advice But practical is like look for something you can hang your hat on and maybe edge of cause has other guidance To use but this is something that is sufficiently general and high level that you can hang your hat on and whether or not You know some of aspects some elements of your institutions likely will be considered to be vital critical and when they When the when the administration released the framework they they had it actually snuck in there kind of a definition of critical infrastructure that was Even more expansive and mind-blowingly so than other similar pronouncements. So it's basically anything that anybody Thinks is important or relies upon it's critical infrastructure So if if in your community your organization somehow plays that kind of role somebody's going to say well You really are important So, you know, I think what when clients ask me are we critical infrastructure or not, you know I've actually just you know several months ago produced a memo that true the trace the history of that term and It's kind of interesting to see the history. We don't have time to go into it here But you know, there is a there's a definition It doesn't if there's nothing magical that happens if you think about yourself or talk about yourself as critical infrastructure Might it might you might get regulation coming down the pike that sweeps in those who might be part of you Know what the Department of Homeland Security considers critical, but at this time for practical purposes You know that the definition is pretty loose so I Have two more any questions or any any comments, please get ready or pop up a hand if you'd like or I don't know if we're Going to use are we going to use mics? We're going to use my so get ready if you want to do it Lesson seven FUD I assume this is a technology crowd. So FUD is a term you know fear uncertainty and doubt You know this this this don't let fear uncertainty and doubt about law particularly privacy laws get in the way of doing what you need to do And I hear I'm I'm really thinking about information sharing the kind of information sharing that is Commonly understood to be effective and useful in dealing with threat and I actually was talking to the NCF TA yesterday national cyber friend cyber forensics training Alliance if you know them in Pittsburgh and They had asked me to come do a version of this discussion for them because what they had seen is that? law enforcement forensics folks and others involved in response Were getting increasingly hampered by organizations is I can't share information because I got privacy concerns I've got the these issues and it's been a barrier for a long time, but there's a lot more interested information sharing now There's a there's a push to do it. It's in the next framework. There's a section says are you sharing information? There's legislation designed to try to encourage and alleviate the concerns here people understand that something useful to do But then if you go and try to do it, you know people like me in organizations will say wait a minute Did you think about this? Did you think about that? What about privacy? And there can be some absolutely valid issues totally valid But what is useful here is is really educated people what what really is useful to share? I mean most of the information you want to get out or get is not personal information So there really is no privacy concern. It's a much more technical and signature type stuff, right? So education is part of getting rid of the FUD Other other tech techniques would be to you know get help to figure out, you know, is there really an issue? Because you know, I don't know how many times this happened to you, but I go Sometimes I have an elderly mom and I have authority I have a power of attorney able to get information about her health care I'm completely authorized It takes me every time I go to a new provider or see somebody who doesn't know me It either get one of two things they kind of Disregard and just give it to me without even asking to see my power of attorney right like that, which is one one bad thing But then most of the time what happens is no you can't have that HIPAA tells me I can't give it to you I said well here. Here's this and this and that I said HIPAA HIPAA HIPAA, and they just they have the bureaucrat answer Which is there's there's something I don't know what it is, but I can't take a risk Because it's something here says I can't But if you read a little bit no, no, no, I can't and that's really human nature It's it's a time-saving risk mitigation strategy on an individual level is to say no because there's this this thing I've read about and there are penalties associated with it and I better say no and That I think it does help create an environment of fun You take that HIPAA example and make it applicable to others and you get this this in behavior in organizations and really what? My lesson has been you know, that's where it helps to have you know a couple of allies here to help say no no no I understand what you're saying, but no this is really not that it's this That kind of getting through and barreling through objections is it's really important to get stuff done And that's why I conclude with my last lesson That's kind of you know, maybe maybe a little self-serving, but the maybe maybe a lot less so sorry, but but the You know my best friend and ally when I was inside the company was my colleague the CISO the chief information security officer Because you can't have privacy without Security, so I couldn't do anything frankly without the benefit of and the collaboration of The IT and this IT security folks in particular We were extremely close both I as a counselor to them and a kind of a uber risk manager but they to me as Colleagues who understood much more deeply than I ever will the the process and the technology aspects that they were they were undertaking on behalf of an institution that's very large and Now what I see is organizations that do have Experts and leaders within them that are collaborating if you grab on to a lawyer grab on to your internal Colleagues who understand the policies and the legal aspects that you do not you're not specialized in they can help you barrel through I Cannot tell you how many organizations I've gone to where it's the general counsel Who is now sitting at these board meetings general counsels go to all almost all board meetings They have a corporate secretary role most of them they sit in those board meetings They listen to the discussion CIOs typically are Invited but the general counsel are always there and they hear about these issues They take it back and they're asked by the CFO or the CEO could you go figure out if we're okay? Guess who they're gonna call they're gonna call their friend the inside lawyers I think I say well you could could you could talk to these guys Could you like figure out if they're on the up and up are they okay? And then and then they come back and they put these issues on agendas you get presentations going they can be very influential in elevating the issues and Selecting and framing and if you make friends and allies of those folks They will take you places that you need to go to get your case and Case-made and your your your agenda prosecuted so that's why I think you know other than being generally nice person and collaborating That's why in in institutions. It's useful to have them as colleagues and friends anybody have Questions or observations, maybe short ones observations questions longer that you want to you want to raise and they could be about Legal issues policy Other lessons other observations because I think we're almost at time anything from the web Nothing from the web. Okay So what I've been trying to do and it Okay, so what I've tried to do is give you a kind of a sense of Context I think the things to watch for by the way I have a we are my team and I have a blog if you're interested in more Deep kind of analysis of legal issues in the security or cyber area as they come out We we propose something about once every couple of days. It's called HL data protection calm What I what I think is coming in in this area in terms of legal and policy issues that that teams ought to be aware of our Watch data breach notification. I think we're gonna be coming and seeing a federal standard sometime soon That is one of the pieces of law that Will be likely to progress if anything does the other is watch the Federal Trade Commission to the extent there is a regulator in the United States that talks about or looks at data security and data privacy It is the Federal Trade Commission their authority under their the laws that govern them It's been expanding because they've been suing and getting recovery and consent degrees with a number of different kinds of companies They are under challenged by a company called Wyndham Worldwide. It's a hotel company Their authorities being challenged and they're now on appeal The FTC won the first round that is also I think pretty consequential Another area to watch is or even to participate in is self-regulation The the in the United States the Obama administration is on record as supporting and they are supporting initiatives to create Standards and self-regulation in not just security but but privacy in particular around things like like online standards and Facial recognition use of facial recognition technologies, which is not about your areas But there are companies in organizations starting to use facial recognition as a way of authenticating for security purposes and for other purposes You know kind of physical security aspects There are some very interesting self-regulation going on sponsored by The U.S. Department of Commerce and then watch your agencies your agencies the ones that you deal with whether it's funding or standard setting Are going to be under pressure to do more in these areas and they're going to be doing more whether it's funding restrictions to wait for your programs or substantive Restrictions or standards that's coming to and the only way to do it is to have a team To respond. So thank you very much for the for the morning and have a great conference You


Applications are now being accepted. Actually, the Bel-Trami County Fair will talk about that story first because it is in full swing. And at this year's fair, you get to have a say in the future direction of the fair. Josh Peterson shows us how a unique set of surveys will out pave the way for the future of the fair. A lot can be said about a fair. Some come from the rides, some for the food, and of course, for the animals. And this information is exactly what the Bel-Trami County Fair Board wants to know. Have you attended the fair before this year? New for this year's fair is a team of surveyors who will be out striking up good old-fashioned conversation. Hi! Thank you! Nice to meet you. As a way to plan for the future. We rely heavily on grants that are out there. So right now, in order to obtain those grants, you need information. And what we're finding out by applying it for grants, you look at other counties, what they've done, other organizations, they need backing. For the five days of the fair, surveyors will be asking the not-so-tough questions. Kids going to be attending the carnival at all? Yes. Then taking the answers all the way to the University of Minnesota. What we've done is we've partnered with the University of Minnesota and have actually implemented a survey. And part of the survey is going to be a cultural survey as well as economic to understand how much money this fair brings to the community. For the surveyors who have been hitting the pavement, the overall response has been positive and educational. The response that I've gotten is very positive, very willing to help out and fill out the survey. I've had some lovely conversations with individuals. Crew members say it's all about the conversation. Have you come to the fair before? Hi honey. And having fun while doing it. Some of the questions are very simple to answer, very quick. And some of them take a little bit of thought about three to four minutes. If I don't talk to them, they get it done right away. Otherwise we like to talk and converse. So if you see a smiling face wearing a blue vest approach you at the fair, have no fear. Thank you so much. I appreciate it. Your input could be the next big thing at the fair. Inba Midgee, Josh Peterson, Lakeland News. The fair hopes to collect a minimum of 850 surveys after the fair. The data will be collected and will be turned over to the University of Minnesota for analysis and will be provided back to the fair board in the coming year. If you enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland PBS.


I am easily distracted by art supplies. Are you like that? If so, then welcome to my world, Okindred Spirit. Have you barely used the stuff that you purchased last month only to find a new paper you wanted to try out? Or maybe you get sidetracked by things like fountain pens or alcohol I don't know wax seals all different kinds of creative ventures. Well we are not alone my friend because a lot of the old masters were the same. If you look at a guy like Leonardo da Vinci, a small painting like the Mona Lisa which is only this big actually took him 14 years to finish because he just kept getting distracted by other projects. Well I'm kind of like that and it's good to know that other artists have suffered with the same kind of melody as me. When I was a little girl I was obsessed with different kinds of art and craft projects as well and one of the most transformative moments for me was when one of my teachers actually called me an artist for the first time. She was somebody who didn't have to say that. She wasn't family. She didn't have to pump me up. She just recognized the creative spark inside of me and decided to speak it out loud and that made a huge difference in my life because I could now see myself as an artist. If you get nothing out of all the videos that I post on this channel please know this.  Whether you make crafty projects, you make finished paintings, you create things out of beads or yarn or whatever it is.  I'd like to suggest that you and I make a creative pact right here and right now. Let's make this a two-way relationship. They say that the one way to really learn something and to find out if you really know it is to teach it to someone else. So you just by watching my videos make me a better artist and instructor and hopefully through the things that I share with you I can make you a better artist and give you more technical skills to be able to express yourself better. As my part in this pact I make some promises to you that I will create the best content I can on art, craft, design, color theory, shading, and so much more in the best technical ways that I possibly can. Now if you've seen my early videos especially that very first Snoopy coloring tutorial that I did you'll probably see that there's been some growth in my technical abilities and hopefully you'll see there's some growth in my artistic abilities as well as I grow through this process too. And I promise to continue sharing different difficulty levels in each of the mediums and putting together playlists so you can join in wherever you're at in your artistic journey. I use Copic markers, water-based markers, watercolor, watercolor pencils, color pencils is with a few crazy rabbit trails thrown in to alcohol inks, fountain pen art, yeah you'll just find some random things along the way as well because as I get inspired by trying new and different things hopefully those experiments can inspire you to try something new as well. Your part in this creative pact is to spend just 30 minutes a week with me. Three days a week Monday Wednesday and Friday I put out a video around 10 minutes or so so that's not much time to commit to this creative journey but what I'd like you to do is look in each one of those videos for one takeaway, one aha moment for something that you can apply right away in whatever project you're working on whether you're drawing in a sketchbook working on a finished painting making a card or a scrapbook project find one takeaway and go use it right away because if you don't use it you're going to forget it. Remember we've talked about having this easily distracted mentality you need to harness that knowledge right when you learn it so find that one takeaway and I recommend writing it in the comments down below the video writing it out also helps to cement that in your brain and you can also read the comments others make and you can see what inspired them in a particular video need some extra help in whatever the medium is at whatever level you're at well there's playlists here on youtube but I've also created something called inspiration posts on my blog every saturday I gather a bunch of them together so that if you're interested in coloring a particular type of thing or using a particular type of medium you can find all of that in one place and if you would like some more in-depth lessons with more step-by-step techniques that build on each other then by all means take a class I have a teaching site where I offer classes in a lot of different mediums at a lot of different levels just whatever it is that you decide I want you to commit that you're going to stay on this artistic journey as best you can one other thing I would have mentioned before I go and that's another old master who I find I resonate with artistically very much and that is Caravaggio he was an Italian painter born in 1571 and not only did he do incredible studies of light and shadow but he was also a bit of an artistic maniac Caravaggio was prolific he was always creating something new always on another painting he was known for spending two weeks straight on a painting and that means no sleep painting straight through for two weeks I'm a little bit like that I may not take two weeks to get a piece of art done but I have that same kind of excited mania about creating so if you find that there is not enough of me here on youtube you can certainly follow me on either of my instagram accounts where I share what I'm working on each day and a lot of short little videos that you may learn something from as well I invite you to join me on this creative journey start by subscribing and click the little bell so that you can get notified every monday wednesday and friday when my videos go live and I promise to meet you here with new excitement new passion for art new ideas to inspire you and just possibly a little bit of permission to enjoy your art and your supplies as much as you would like because you're an artist and you deserve good art supplies create something every single day it's going to help to keep you sane in this crazy world of ours i'll see you again soon


Now we're moving on to Brady, who's going to talk about.NET Core development on Mac. He's going to talk about Docker. He's going to do about Azure development and some other cool stuff there. So off to Brady. Cool. All right, getting started here. So I'm Brady Gaster. I am a senior PM on the.NET team. I'm going to focus a lot of my talk today on using SignalR and Docker and Azure together. Probably focusing more on the SignalR stuff because that's my main product and what I like to talk about. That's probably what you want to talk about today too. So the first thing we'll do is kick it off with a simple what is SignalR. Essentially, SignalR is a abstraction on top of a real-time HTTP connection. It's a little weird to think about HTTP as real-time, and we've got a couple of different ways that we can do that. So go ahead and get started with the demo. So what I've done, so I have a couple of projects open. Right here, I've got a pretty simple project open that if I were to run it, what we're going to see is just a simple spaceship on the screen. The idea behind this is that I want to be able to click that spaceship and move it around the screen. So if I click it, see right now, nothing's really happening. Definitely, if I were to open it up into another browser, nothing's going to happen as well either. That's where SignalR comes in because we can actually make things happen directly inside of the page. So what I'll do is I'm going to show you how to get started with SignalR without having to even use MPM. What I'll do is I use Unpacked and I go to the Unpacked. I'll look for SignalR. I find the 3.12 release, one that we just put out. I'll click on View Raw. Now I'll copy this and I'll paste it right here into my source. Now what I'm going to do is I'm going to put double at signs here because I'm in Razor. So if I were to scroll down, you'll see that the first thing is, let me get this colorization. It's a little odd on a colorization problem. So you'll see that the first thing I do inside a JavaScript is to create a new hub connection. Now that's actually a live connection back to my SignalR hub on the server side. Talk a little bit more about hubs in a minute. But the idea here is that I just have this JavaScript code and later I'll be doing the same thing with .NET code where I'm going to have a connection from my client that reaches back and talks to a SignalR hub. If I open up the hub here, see that I've got Game Hub, and really all I have is a move ship method.  In this case, you'll see that I'm doing clients.all.sendasync. I'm just going to basically make an async call out to all the individual clients that are connected to that hub. The point where I do that, I'm going to be handling that event here with the ship moved. So what I'll do is on the client side, I'll actually make a call here to invoke the move ship method. This will invoke on the server side, I'll turn around and then I will invoke an event, a foreign event called ship moved, and I'll pass it the X, Y coordinates that we got, and inside of my client code, you'll see right here, I've got connection.on, and I'll handle that event and do some HTML magic directly inside the client. So now that I've got that running, I've got my script tag added in here, and we've got SignalR on CDNJS coming. We have an older version out there. We have a current pull request out to the nice CDNJS folks to get it updated. But my favorite way to do it is really just using unpacked. It's pretty easy to get there. Now what I've done is you'll see that I've got my window open. I'll paste in a new browser window right here, and when I click this and I move it around, you'll see that as I move it around, it's going to be moving over there on that client as well. Now the way that works essentially is that SignalR can figure out whether I can run web sockets both in my client and on my server side, and if I can, it's going to use web sockets by default. But if it can't, it's going to figure out a way to back off and be more intelligent because it knows that I want real-time and I don't want to have to code each individual real-time capability. The way that works essentially is that at first before we had web sockets and before we had long polling and all kinds of stuff, you would make a request from your client to your server. Your server is going to say, I got your request, it's going to do a process, and then it's going to fire an event and send back everything to the client. And that's how your request response model would work under long polling, which is what you'd probably have to do way before web sockets if somebody said, I don't want to have to hit the F5 key. So once we got web sockets, you have this capability where the client can basically say, I want to make a request of the server, I want to start a real-time connection. The server says, I support web sockets, we're good, and now we're communicating in real-time, we're partying in real-time. So this is the idea behind SignalR is when we created SignalR, web sockets wasn't quite as ubiquitous as it is today. It's pretty much everywhere today. All the browsers support it, most servers support it. We support it all over Azure. So for all intents and purposes, you'll usually be running on web sockets. But what's nice is if you don't support web sockets, or you know you're going to have customers who fail to support web sockets for whatever reason, SignalR can figure out exactly what sort of transport would be the most efficient and actually back down and use it. Let me do a quick little demo of that. Now if I go over here, we're done with Unpacked, so I'll close that. So up here, I've got this Move the Ship app that you just saw me write running out in Azure. So I'll go ahead and click Browse, and feel free to move the ship around if it excites you. Now what I'll do is I'll go here and I want to show you that we are connected using SSE. So this is actually connected using ServerSendEvents and if I were to open up another browser tab and paste it in, you'll see that over SSE, as I move one around, the other one will be moving around. So that's all well and good. But what I can do over here inside of the Azure portal is go to the configuration for my app service. They're right here in the general settings, and you'll see this handy-dandy little web sockets area right here. I want to turn web sockets on. By default, web sockets are turned off whenever you create an app service, but I want to turn them on because I want to make use of the web socket transport whenever possible because it's probably going to be the most real-time-ish of all the different connections. Everything else would be, we would be using ServerSendEvents by default. If ServerSendEvents weren't there, which luckily they are by default, you would be using long polling. Now if you'll see here, somebody's moving it around. Thank you whoever's moving around. But if you see that if I were to zoom in right here, now we are connected with a web socket. All I had to do was to go into my app service settings and toggle it from off to on, and now SignalR just knows that it needs to use web sockets. So that's a great example of how SignalR can make us dizzy, because somebody's probably Chris knows it's out there. So what I'll do is I'll close that for now, and I'll leave the site running. It appears that people are having fun with it, so I'll leave that on. While I'm at my browser, I want to show you the wonderful homepage for DocsMicrosoft.com. If you're looking into learning more about SignalR, either from the perspective of doing it inside of a server-based app or in a serverless app, like we'll talk about later, you would click here on ASP.NET. You notice we have the ASP.NET Core and ASP.NET Area, for those of you still using ASP.NET Framework. A lot of great apps still running Framework out there. You click on the Core, and then you would find here real-time apps, and this is where you'll find all the relevant information about ASP.NET Core SignalR. So if you want to find out how to use the clients, like the JavaScript client or the.NET client, or if you wanted to use the native Java client, you would come out here and take a look at this. We're currently working on a C++ client as well. So folks who want to do lower-level native development, hopefully by the end of 2020, with the.NET 5 way, we'd like to ship that C++ client as well. So folks who want to do native dev could grab the C++ client and do whatever they want. So with all of that being said, I'm going to switch back over to my presentation, and what I'll show you now is this concept of client targeting using Hubs. So we talked about a SignalR Hub briefly, and we'll get a little bit more in depth with it now. But what I want to talk about is how you can actually specifically target an individual client or set of clients or in this case, a group of clients. If you wanted to send messages out to an army of different clients that happen to be out there waiting for you.  So I wanted to send a message to all the connected clients all at one time. So I would just use clients.all.sendasync, or sendasync, and at this point, we would actually call that method. It would call it on every single connected client that happens to be connected 1,000, 5,000 doesn't matter. All the clients will get that event at that moment. But if I wanted to target an individual set of users such as a group, like let's say I wanted to target only the folks in the Seattle group, you can actually add individual signal or connections to logical groups that are managed on the server side or if you're using Azure signal or on the service side, and then I can actually send a message to that group and only the clients that have been put into that group would actually receive those individual methods. That's good. You can actually use client targeting to get down to a pretty small group of users. But let's say you only want to target one specific user. In this case, you would say clients.user, and you would pass in a name. You could also say users and you could pass in a series of names. But in this case, I only want to send a message to Brady to myself and I only want to send a message just to me as a user, which means if I'm connected on my phone, on my laptop, on my PC, on my TV, whenever a message comes to Brady, if I'm logged in as me on all those devices, I'm going to get that message on all of those clients all at the same time. So that's kind of nice. Now, if I wanted to target one specific client, like let's say I wanted to target Brady's phone, then I could actually get what's called the signal or connection ID, and I could say a client and pass in that particular connection ID and only hit that one client so I can get very, very low level in terms of like the individual clients that I can get to. So, got one more demo here. I've got a few more demos, but this is the next one. And this one is actually where we're going to talk about client targeting. So let me zoom out, take a look at my set of projects that I have open, and I'm going to do two quick demos for you here. So in this case, I've got two projects. One of them again is a web project, and one of them is a worker project. Now, in .NET 3, we added this new worker template. You can see if I open up my worker here, open up my worker file. You'll see this is my worker class, and all it's going to do is it's going to spin. And whenever I get a message off of a queue, I'm actually using Azure Storage queues here.  And as I run these steps, I'm actually going to call the process hub client, which is my client to wrap around my signal R Hub. You can see that I'm calling update dashboard, passing it in the connection ID for the individual connection that I want to target. And then I'm actually calling right here send async, telling it which of the individual methods I want to call, and I'm actually passing it in this case, I'm just passing it one particular connection ID because I only want to run it there. And I'm passing it the step completed object, which is essentially a pretty simple model. Now the idea behind this solution is you might have a web queue worker scenario where you have a web app and somebody takes action in the web app, they submit an order, the order goes into a queue, and then there's a couple of different processes that that order would need to go through before it's actually completed. And you might want to provide your customer some sort of a visual display just like you're in step A of the process, you're in step B of the process, and so forth and so on. So you might want to be able to show your customers exactly kind of how things are running, and in this case, signal R is really helpful there. Now what I've done in this particular solution, I just want to show you this because it's a nice feature in VS for Mac. As I've actually got, you see that I've got an all profile here, and I've got web and worker because I've got two projects. What I'll show you is if I zoom in on this, I'm going to double click on my solution and you'll see that this tab's going to open up, and you'll see that I have this configurations tab, and what I can do in here is I can actually click new, we'll just call it demo, I hit create, I'll click on the demo, and now I can actually specify which projects I want to run or not run whenever I do an F5 experience from within the tool. So here you see that I've got the web and the worker both set to run, everything's good there. Now I want to make sure that my other demos aren't actually running, it looks like everything else has stopped, so that's good. Earlier I had a scenario where I tried to run on a port that was already taken, so I just want to make sure that we're not doing that here. But at this point, what I'm going to do is I'm just going to hit run, and the first thing that will happen is we're going to start up that worker process. The worker process is essentially just going to run as a background process. If you think about microservices and Kubernetes, we'll get into that later, but essentially I'm just going to have a background process that's waiting and watching a storage queue. And you'll see here that here's my web app, my web app is going to open up, and what I'll do is I'll just paste in another instance of the browser, and the idea here is that I want to show you specifically how this might be the some customer who's looking at their cart, and this would be the customer who's ready to purchase everything that's in their cart. I wouldn't want to start that process and accidentally impact some other user. So that's what's great here with me being able to use the connection ID to target an individual user. So in this case, I'll start this process, I'm passing it the connection ID, and you'll see that it's only going to run down there. It's not going to run on this top one. If I were to start the process up here and then start the process again, you'll actually see that we're going to have two different separate processes and two different timelines in terms of it actually processing everything. Now I started the second one, so it's going to go through there again. Clicked it twice. So this is an example of when you can use SignalR, specifically the SignalR client for .NET inside of say a background running a microservice like a worker project, and then you can use the JavaScript client on the HTML side to actually listen for the incoming messages. So what I'm doing at that point is I'm actually just sending messages from one client using .NET and receiving those messages from another client using JavaScript. So pretty neat way of doing things. The one thing I would also show you here, and this is a fantastic feature that I love we got in VS for Mac, I can right click my worker here and I can say add and do Docker support. And I can actually add Docker support directly to this project. You'll see that I get my Docker compose files up here, and this is pretty much the Docker file that I would write myself by hand if I actually had to do that. What that's really useful for is if I wanted to run an ASP.NET core application and to our worker application connected over a SignalR hub in something like a Kubernetes cluster, which is similar to what I have running right now. So what I'll do at this point is flip over to one more set of code that kind of demonstrates this, and what I've got is two projects again or a couple of projects here. We had a question earlier that I'm gonna try to answer right now. The question was if I wanted to do Blazor WebAssembly today inside of VS for Mac, but I have that capability. Well, you do, I've actually got one running here. So in this case, I did a.NET new from the command line according to the wonderful blog post that Daniel Roth put out recently when we shipped a preview for Blazor WebAssembly. So you see that I've got my server project and I've also got my shared project. I don't really have much in there right now. And then I've got my client project. This actually comes out of that Blazor WebAssembly project structure. Now I've got another one here. And again, this is a worker that's gonna run in the background process. And I'll show you real quickly what that worker does. There's not a lot of stuff going on in it. Essentially what I'm doing is I'm using an awesome fake data generator called Bogus. I cannot recommend it highly enough if you need to generate a lot of fake data or you want to fake your UI to make sure things are gonna look right, which is pretty much what this is gonna do here. What I'm actually doing is I'm generating a random set of names. And with each one of these names, I'm going to generate a random lat long point. And I've kind of given it like an area that I wanted to start with, essentially the area around huge sound area. So what's gonna happen is this worker's gonna run and every time it runs, it's gonna create a fake map point and then it's gonna send that map point to a signal or hub. And it's gonna pass it some information. Now what that signal or hub is simply going to do is to turn around and bubble that up into the client experience itself. Now in my case, what I've got here is if I were to expand my client project, now this is again a Blazor WebAssembly project. If I were to expand this, and I go right in here to Pages and I open up index dot razor, what you'll see is that I'm actually using the dot net client for signal or directly inside of my Blazor WebAssembly razor page code. This is great because I get all the fidelity of dot net. I don't have to do the context switching between JavaScript and dot net if I don't need to. And in this case, everything I'm doing, I'm doing directly inside of dot net code. I'm not doing any JavaScript magic whatsoever. And I'm not gonna run this locally, but what I will do is I'll show it to you running up in my Azure Kubernetes service instance. So what I can do here is I can actually click on my DevAKS bookmark that we have here. Here's the link for if anybody wants to look and you'll see here that as I forward to zoom out, you'll see that just random points are just getting generated by that worker process. And as the worker process generates those random points, it's sending a ping up to my SignalR hub, which is running in the server side of my Blazor WebAssembly solution, it's actually the server part. And then that hub is basically bouncing the message out to the dot net client in my Blazor WebAssembly client project. So at this point, we're getting messages out of the cloud we're pumping them right into this Blazor WebAssembly UI.  Now these are Docker containers that I was, I created these Docker containers and wrote the Kubernetes Hound myself and published these up. I did that all from within VS for Mac. I did use of the command line to actually do the Docker publish. Looking forward to those tools coming one day soon too.  And if you see this map.generator here, that's actually the background process that is pinging my SignalR hub and sending it points. You can see we've generated quite a bunch of points since we started this demo today. If I were to click on view live data, what you'll see down here in the bottom of my browser window is the outputs, the logging output of that individual worker project, just sending data up into the cloud. You can see this is just the log data and if I were to click here on the map.ui and show you the live data here, now essentially if I just go here and I hit refresh, should see there's our logs coming in because I actually made it, made a hit to that site. And if we were to again look at this one and look at the view live data, you'll see that as we have points popping into the log, we have points popping into the map. The idea behind this, the reason I wanna show you this is it's a great use case. If what you wanna have is just a screen in your team room or a dashboard that you wanna monitor forever and ever, SignalR is really, really great for those things because you can kind of set up code that will instrument out, as a process happens, you can see individually each step of it or in this case you can see dots appearing on a map. So that's the nice thing about SignalR is it's really great for adding that UI sugar and making things appear real time, which is always fantastic. Now, flip back over to my deck one more time. I wanna go here to flip that. So real quickly, another feature that we added in the recent releases of SignalR is this concept of automatic reconnection. It's one of my new favorite features and what we have some great documentation for it. Let me actually go back to docs.ms.com and I wanna show you this in the SignalR area. So I were to click here and look at our clients and right now I'll just go to the .NET client because that's where we are today. You can see over here handling a loss connection and see that we have some pretty sensible APIs, specifically in this case with automatic reconnect. If I pass, if I just call with automatic reconnect, it's gonna try maybe four or five times and the documentation points out here that we wait zero seconds to 10 and then 30 seconds and then we stop trying. So you can customize that if you want to. Now on the .NET side, you can customize that pretty easily. So I've done right here. Again, this is a similar project structure than what we saw just a moment ago. In one case, I've got my SignalR server and the idea behind that is I'm gonna run my SignalR server outside of my Blazor app, not for any particular reason, I just might wanna have something connect to it that isn't my Blazor app. So I wanna take that and split it apart and what I'll show you in that, if I were to open up startup CS, here is a handy block of code and it comes to enabling cores. Sometimes if you wanna have, Site A is gonna communicate with Site B either through your REST API or with SignalR, you're gonna have to turn on cores and this is about the least amount of cores code I could get in here and make everything work. Essentially what I'm gonna do is I'm gonna tell this app which is running on port, you see here, running on port 4000. I wanna tell this app that it can trust anything coming from port 5002. If you wanted to, you could configure that, put it in your app settings, use Azure app configuration to configure it however you want to for deployment. But the idea is you wanna enable that trust relationship because this server is going to run the hub and then this server is going to reach out and connect to it as is this client. So you wanna make sure that you're enabling cores here and in this case I'm just passing a URL, I'm gonna be going over to port 4000 to get to that sequencer hub and more on the sequencer hub later. And in this case you'll see that I've called with automatic reconnect and I've passed it an array of time spans, essentially getting longer and longer and longer each time. So what I'll do here is I'll scroll down a little bit more and I'll show you that the hub connection and this wave of with automatic reconnect love, we've also added you some new events specifically reconnecting and reconnected so that you can handle those events and customize your UI to basically tell people you can't click the button right now or you can't fill out the form or insert whatever it might be right here. But we gave folks those events so that you could have more capability in terms of being able to handle those reconnecting situations on the client side. You also have this inside of the JavaScript client too so you can do everything you'll see me do in a Blazor WebAssembly project. You can do this inside of JavaScript as well. So the first thing I'm gonna do just to kind of show you how this reconnection would work is I'm gonna run this inside of my command line first. So I'll say open in terminal here from that SignalRServer project and here's my SignalRServer and I can do .NET run. See if this guy will start up and once the SignalRServer starts up, I don't wanna click the URL because there's not gonna be any UI there. It's just gonna be my hub running in the back. But what I'll do next is I'll right click on my Blazor SignalR loves Blazor.Server project and I'm gonna say start debugging the project and what that's gonna do is it's gonna run my Blazor server, compile my Blazor WebAssembly client into it and then launch the UI. And it's just a pretty basic UI here. If I were to open up our debugging tools, I'm not gonna do any Blazor client side debugging yet but if you consider debugging tools, it's important because I want you to see how this will change and then you'll also see over here that it's trying to reconnect. So if I just stop the server, see now it says connection refused, it's trying to reconnect, there's no server to connect to so it can't but it does tell us, hey, I'm trying to reconnect, I'm trying to reconnect in a moment maybe if the server comes back online or I exit the tunnel, now we're reconnected again. So this is great because the user won't have to sit there and click refresh and you can provide cues to tell them for just a moment, we don't know how long, you might have gone into a tunnel, the application is not connected to your SignalR Hub so we're gonna do what we can to get you reconnected again. So it's just a nice way for you to be able to help your users understand what's going on in the application. So with that said, I'll go ahead and close this down and I'll stop everything else and we'll flip back over to my slides one more time and this is one thing that early on in SignalR we had a lot of questions about scaling out with SignalR and I'm gonna talk to you about why. And this is pretty much gonna be the end of our presentation on SignalR and running your .NET Core app inside of a Docker and creating your Docker containers and side of VS for Mac. So what I'll do right here is I wanna show you the scaling out for Azure Part. Now something to think about is that your Hub lives on your web server, lives on your application server.  If you were to take your application and move it on to multiple servers, now you're gonna have multiple instances of your app along with multiple instances of your Hub. Bad things can happen. Here's what it would look like. So in this case, the Hubs are server bound so one client sends a message. All the clients or the different groups that are supposed to get it will receive the message. See that there's the third request coming in but what happens when you scale your SignalR application out into a server farm? This is when things get a little tricky. What'll happen is that your request will come in and it will hit the server, you will start communicating with your Hub and each client that connects to each server will only communicate with other clients that happen to be connected to that server. So what that means is you're kind of in a bad place if you wanna scale it out. Now what you can do is you can actually drop in what's called a SignalR backplane. Now in the early days of SignalR we had a couple of different options. We had a SQL server backplane. We had an Azure service bus, a service bus backplane, yeah, service bus backplane and then there was a third one, a Redis backplane. So we actually had three different backplanes and we kept thinking we needed to make this better but essentially what would happen is you send one message in, it hits your server and then they're gonna come back out to all the different servers. What we did was we created a new thing called the Azure SignalR service. Now the Azure SignalR service gives you a way to offload your ASP.NET Core SignalR hubs. So what you can do is you can create a hub, let's say you're hosting your hub in Azure App Service. You can actually put your app into Azure App Service and then you can turn on Azure SignalR service that basically will cause all the traffic that goes to web sockets that goes to your hub to go there instead of chewing up the bandwidth going back and forth to your Azure App Service. Essentially the way that works is your client reaches out and it makes a call to your ASP.NET Core app.  And then what will end up happening is the Azure SignalR service has a server side connection back to your hub. Very much, I think it's actually a signalR connection back to your hub and what we'll do is we'll instantiate four or five connections between your server side app and your Azure SignalR service hub. What that means is that on the server side you only have about four or five of those active connections instead of 100,000 connections. Now what also does is that frees up the HTTP traffic going to your actual front door of your web application so that that front door is not handling all of your normal HTTP one traffic and all of your web socket traffic. All of your web socket traffic basically goes over to the Azure SignalR service. The other nice thing that Azure SignalR service can give you is the concept of serverless signalR. So you can actually use Azure Functions, have a nice feature inside of them called Azure Function Bindings and you can actually apply the Azure Function Bindings for signalR service so that whenever you make a call into your Azure Function, it will call back to the signalR service and then if you have any clients that are connected to the Azure SignalR service instance, they'll get those messages. That's really helpful when you're starting to cloudify your applications and doing serverless dev and all that good stuff. In this case, you wouldn't even have to have a server side hub anywhere. You could just use the Azure SignalR service instead of having to actually craft your own hub. But if you start getting into Blazor development, what you'll see inside of the tooling is that we're giving you the opportunity to create Azure SignalR service instances whenever you're deploying your app services because we want you to have that enhanced capability of that enhanced performance. We want all of your web socket traffic going to where it should go, which is the Azure SignalR service and all of your normal ACTP traffic to go back and forth to your actual web application. That's pretty much all I have to share today. I think we have a couple of questions. My good buddy, Christos is back in the room now so I think we'll turn it over to him for a question or two. Exactly, well, thank you very much for showing us all the cool stuff there. We actually have a couple of questions but before we jump the questions, I want to give a shout out to Simone here who's actually working out on his static bike while watching the sessions, right? That's amazing, fitness and learning at the same time. Let me jump quickly to the questions. One of them is, when should I choose Azure SignalR services over hosting my own SignalR service? That's a great question. And I presume what that question might be asking is, let's say I wanted to create my own server-side application like you saw me do a couple of times here that's just running a hub. In that case, if you scale that thing out, remember you're gonna scale it out and all of your, if you connect to it, you're only connecting to it. Clients that only connect to it and send messages into it will only be hitting clients outside. The reason you would use the Azure SignalR service there is it not only gives you that back playing capability but you don't even need to write a hub. You can actually call the Azure SignalR service directly using JavaScript, Java, or any of our other clients. And we actually have a native iOS client not being built but an open source one on GitHub.  And the great thing about that is you don't even have to do anything with .NET. You're not a .NET person. You don't wanna write a hub. You don't have to worry about it. You can use the service and use the service in a server-less capacity and then you can just communicate. Serverless. Serverless. I love serverless. Right. And the other question we had was, obviously, let me just close this one down. Open this one. What we do here is anything we need to consider when thinking about production scaling? There is. There are quite a few things. I don't know if I can get the screen back again. But one thing that I've also done is I've pulled up the Azure documentation. I've gone out here to the docs real quick. I'm gonna click on Azure and just show you how you can get to the Azure SignalR docs. It's currently in the web area. So I'll scroll down here to web and you'll see there's the Azure SignalR service. And if I were to click on this, what you'll see is that there's a couple of great articles in here specifically on how to scale things out. There's one here on scaling. If you wanna scale the single instance of Azure SignalR service, this is how you could do it. But what a lot of folks wanna do is they might need more than 100,000 active connections. So what you would do there is you would actually use multiple instances. And what we've seen a lot of folks do is they'll use a set of multiple instances for the Azure SignalR service. So everybody that connects to West gets put into a West group. That West group goes to the Azure SignalR service running in the West and so forth and so on. So you can actually shard things out and there's a couple of really great articles in here on disaster recovery in the same way. So you can actually set up a couple of different Azure SignalR service instances. And if a tidal wave hits a particular region and that region goes out or in certain reason here, it can go to the next one and the next one and the next one. So you can actually do disaster recovery with it as well. That's great. Tidal waves and SignalR. I think we had it all. So we're gonna take a very quick break and then we're gonna move on to ASPnet core apps in Visual Studio for Mac with Sahed Brahimi and Juan John to help us out. Thank you.


I'm telling you, Dallas at that number has my attention a little bit. See, this is why I love House because we're always on the same page. Right now, if we're looking at the board, it's Dallas 26 to 1. And House already spoke about how they have two guys who they can crush you in the clutch. Kyrie and Luca Donkage, their chemistry is just, it's out of this world at this point in time. And there's not too many teams other than, say, Denver or the Milwaukee Bucks who I would put up against them in the clutch and Milwaukee can't stop anybody.