So this is sort of a eclectic talk maybe about my experience with supply chain security in Anaconda, which is a company that I've been at for four years. So here's me looking dead inside. I'm Sebastian Awad. I've been working specifically on software supply chain security for about a decade now, mostly on the topic of trust. I promise that I will point to the projects I've worked on and what I do specifically, but there's some stuff I want to address first to define the talk and the space it occupies. I promise I'll get back to it. So a lot has changed in the last six months. The co-author of the prior version of this talk, who is a wonderful human being and my colleague in several different ways, Dr. Preston Moore, has moved on to a high paying financial firm to correct the deprivations of what our academic incentive structure has put him beyond that the last 12 months have been a wild ride in the security space and in the tech space. So I've made a lot of changes and I want this talk to instead be discussion heavy. So please ask basic or advanced questions, technical or not, please interrupt me, please disagree and express confusion, ask for give advice, feel free to share stories and I'll do the same. So first here's the skeleton of the talk. Right, so I'll talk a little bit about the user perspective on software supply chain security with four essential problems. Then I will talk on contract trust in particular, which is more of what I focus on. Trust architecture is the update framework, chains, bootstrapping trust, that stuff. Then software supply chain security of build chains and software supply chain security as architecture, then as a team sport, a little bit about systems complexity and possibly opine on order and chaos in the field. Okay, so first buzzwords are a blessing and a curse. So I'd like to break down what I mean by software supply chain security and by trust. And if you feel differently, please yell at me if you want. To be crass about it, from a user perspective, the central subject of software supply chain work is something like this. Why is it okay for me to run this code? Is this thing okay? So let's break this question down into what code is desired, how to acquire it and how to trust it. So that means roughly these problems. So we have project discovery. So in principle, what code projects might I want? Project assessment. In principle, are the projects that I think I want okay to use? Code discovery, where do I get the code and code assessment? How do I know the code I just obtained is what it says it is. We solve these first two problems in ways that usually involve a lot of soft things. Education, thinking and social interaction. What tools have people I know heard of to help me analyze this data? There are interesting problems and there is developer education around these. Companies are constantly trying to make these easier for folks to establish market share. So for the question of ongoing project assessment, SBOMs and security advisories are of course critical for determining whether or not a project is something that you want in principle. The third problem of code discovery is interesting to me and it's also a very dangerous place. How do you know what the official repository is for something? Whether it's a repository that you should trust, typo-squatic is a well known part of this problem. You type in something you expect and you get something different because you don't have the right URL, the right URI. So probably more than half of my time in supply chain security has been focused very specifically on the fourth problem. Suppose I know I want TensorFlow or Django or whatever. Suppose I even know where I'm supposed to get it. I know the project name in a Devian repository or the project name in PyPI or the GitHub repo URL or the App Store link. Suppose all that. I grab some code. How do I know that what I wanted is what I actually got? How do I know that the stuff that I found on the Internet is what it says it is? In other words, is this code catfishing me? I think a good phrase to refer to this problem is content trust or code trust. It's the ability that consumers of the code and data to treat the code and data that they receive, to trust rather, the code and data that they receive from some other location or service. So put another way, this is kind of data authentication, right, from the user side. It's the question of how consumers can trust the packages or content they receive. It is deceptively easy sounding from a distance, but our time has shown us, and this goes back before in a condo for me, that this is surprisingly complex. This is the domain where the update framework, SIG Store, in Toto, Docker Notary, Git commit signing, even to an extent TLS, and to some extent Salsa and in Toto, and lots of other efforts live, is how do we ensure tamper protection and things like that, right? So a quick aside on what I do now that we have that in the content trust space before continuing. So my focus in this trust category is mostly thanks to my time at the Secure Systems Lab at NYU, where I worked on some cool projects, the update framework, or Tuft, and Uptane, which is an automotive adaptation, and a bit on in Toto, which is sort of, I guess you could say it's a predecessor and slightly broader project maybe than Salsa. Don't add me for that, that's imprecise. So I spent time writing reference implementations, thinking about fun edge cases and standardizing and trying to convince automotive industry folks to do nice things, which was surprisingly successful somehow. So I think as a disclaimer, the phrase content trust was probably something Docker Notary used first, but in fairness, Notary is based on the update framework, so maybe that's fair game. So for almost four years now, I've been working for the condo community and also at the company Anaconda. I went there to put into practice some of the cool stuff we developed at the Secure Systems Lab. For context, here's a blurb about Kanda and Anaconda, so that I don't antagonize some of my coworkers. Kanda is an open source multi-platform package manager and environment manager. It is an open source project. It is at its heart multi-platform. It's a community project. It has a governance board and rules with some protections against corporate capture. More recently, it's become sponsored by the nonprofit NumFocus. It is most often used by folks, however, who work with Python, even though it's language agnostic. You can install all sorts of sophisticated performance libraries written in a variety of languages. Kanda is often associated with data science communities, science, finance, numbers, everything, but you can also use it to install Django or QTE. It's a little like PIP. It's also a little like apt, plus environment management. So beyond the package manager and environment manager itself, the Kanda ecosystem is sort of a broad association of related tools and repositories under the control of lots of different projects and nonprofits and companies. It includes lots of open source projects and things like Kanda Fortune Mamba, which are broader initiatives. The Kanda community includes roughly 30 million active users in any given month. The vast majority of them are all using this for free. These are the folks that we're working on protecting with what we've been developing. And to make Yanis happy, Kanda is not Anaconda. Anaconda is a company. Kanda was originally created there, and I think still most, but not all of the maintainers of Kanda work at Anaconda. We hope that will shift further over time toward more community folks. From my perspective, though, the heart of Anaconda's work is in its build pipelines. Anaconda builds open source packages for a wide range of architectures, and it makes them freely available. We host curated repositories of internally built packages. We produce S-bombs for those. We also produce sort of improved security advisories for those of us who are not particularly content with, well, what's available on certain repositories. Anyone can upload their own package builds to their own channel on the .org community repository, the Anaconda.org community repository, sorry. Each channel is kind of like a multi, mini repository, and users can find your channel and decide they want to trust it or not. And I don't, I say most of this not as a means of trying to advertise for Anaconda, but rather to capture some of the complexity. Because if you're paying attention there, I mentioned quite a lot of transitions of control from one place to another, and a lot of different pipelines. There are other things at the company, you might be familiar with PyScript, stuff like that. So I have a kind of neat job at this relatively small company where almost everything I think about is supply chain related, and a substantial portion of it is around content trust. I'm not sure how common that is right now, but our interviewing efforts regularly show me that there are not that many folks who get that chance. Anyway, like many of us, I basically work for both. So with a bunch of specifications and reference implementations and proposals, like PEP 458 and 480, in hand, I moved from a lab to Anaconda to make package installation safer for those people. Success and failure have ensued, of course, I think I'm happy with my time. So mission one for me was sort of direct application of what we were doing before, or attempt and direct application. Content trust for users of Conda and the Conda ecosystem. This is basically code and metadata verification to provide tamper protection authenticity. It's easy to think of this as sort of a signing task, but I think the most interesting task about this is actually a trust architecture and trust bootstrapping, something that operating systems get to some degree for free, but groups like us don't because we distribute installers. So we'll talk a little bit about responsibility separation delegation, compromise resilience, trust architectures and chains. So a particular content trust feature that we've released for Conda is called Conda signature verification. It has to be turned on, it's not yet on by default. So the work here is broader than this, but I think it's a good place to start. So in principle, this is about preserving the install integrity for end users by verifying the package data using a chain of trust. So this brings us back to do I trust what I'm installing? The question that keeps us up at night. Man in the middle attacks that involve malicious mirrors, diverting user traffic, et cetera, are often fairly easy to execute and you can yield thousands of compromised systems through a mechanism like this, even in a smaller repository. Sometimes things that are things are even more unsophisticated. You might be surprised even now at the number of folks that you can catch just by typo squatting on a public repository. We used to intro talks like this with this big slide of logos and ask what they had in common and then reveal shock that it was that all of these folks that had their software updates and package management taking advantage of to compromise user systems. Nowadays, over the last four years, I don't really have to scare folks anymore like that, which is nice. Those slides have gotten rusty. I don't even have them in here. But suffice to say that most of the big interesting cyber attacks you've heard of recently, including, maybe not so recently, including like careening jeeps across the highway in remote control have involved breaking parts of the software supply chain and package updates to get malicious code in the user systems. So let's see. I guess I will, let's skip this. So let's go through just sort of a conda install command. So you tell conda install a straight, which for the life of me, I actually don't recall what a straight is, but that's fine. It fetches from some repository, wherever it's configured to point to the repository data. This is things like the list of what the packages are that are available on it, the artifact, the particular build artifacts versions, all the build information, hashes of all the individual artifacts, and critically dependency lists for each individual artifact. There are strings to specifying what dependencies are for that particular artifact. After that, we have a thing called a solver. If you're familiar with satisfiability solvers, it's a pretty cool problem, but it's kind of niche that looks at the dependencies and pumps out basically a solution that says, hey, if you want this package, you will, you should install, you know, I'm gonna, I'm gonna prefer the latest version of the packages. I'm gonna look at what you currently have installed in your environment. And I suggest that you or install these extra packages, and then you will have what you need based on what you told me, which in this case is just any version of asteroid. But obviously it can be more complex. So after that, the solver, which has consumed this data, gives you this list. In this case, I guess it's asteroid. It's I think a very old example. So a particular version of asteroid, and a particular version of a dependency thereof. So solver does that, you know, maybe it issues a request to the user asking, hey, is this okay, depending on the configuration?  Then you can install, right? Simple case, happy path. Now let's consider, you know, a set of attacks that I think was made more famous in like the mid-2000s. Just a basic sort of set of man in the middle attacks of the sort that used to be surprisingly effective on Linux package managers, but which today happily is not. So, you know, maybe you have a TLS misconfiguration issue, or it's just off, right, which is a thing that people do. Maybe you have some, you know, evil certificate authority certificate, a bad one installed, there's been a server compromise at the repository that you're at the repository that you're contacting. These things happen. So one way or another, you have this malicious repository now. So you make the same install request to condo. Condo fetches repo data from this repository. That repo data goes into the solver, let's say it's malicious, right? It's fancy and red. And the solver can say something like, install this really old, I don't know, maybe extremely insecure old version of this package, or it could just insert, you know, here's a dependency on some arbitrary malware, or it could just say, hey, the hash of this package that you're trying to install is actually this other thing. And here's this other thing. It's malware, right? So then you just go ahead and install that stuff, right? It can lie to the solver. It can lie to you. There's not much to be done about that unless you're going through line by line in the code or something, in which case, I can offer you a job. Right. So then you've installed something. You have malicious code installed here. And what I've just described, there are many, many single points of failure. A judicious application of readily available cryptography solves most of this, right? TLS is helpful and important. It makes those, you know, the man in the middle attacks a little more challenging. It's far from a silver bullet. Transport layer is just not always secure. And we just can't assume that there are so many different ways that, you know, you have to distribute software to someone who's behind an air gap. You have to distribute software to a variety of mirrors that are, it's not fundamentally dependable. You need a more solid solution based in digital signatures. So we can do a lot better by focusing on something end to end, right? From the repository side, all the way to the user, some means of checking. In general, this is the purpose for which digital signatures exist. Someone can tell you that, yes, this is the stuff that we made for you. They can identify the stuff in what is effectively an attestation about the software and you can verify that attestation. Critically, you can sign a package as soon as it's built. We build packages so we get to do just that. And you can verify it at the end when a user is about to install it, right? Providing range of protection from build to acquisition of the package, you know, installation. This is, it is, and I'll show you the internals. This is a bit complex. It's certainly less complex than the sum of every transport mechanism that you will employ in a complex ecosystem. So I intend to skip the basic crypto here. It's a small crowd, so hashes and signatures and stuff like that. I don't have to skip it. We can go over the overview slides. It's pretty quick. Does anyone feel like a refresher? That's a no. Okay. Cool. So some design principles. These are inherited from the update framework, which now is, if you're not familiar with it, it's in a lot of your friends, right? So SigStore uses a variety of delegation mechanisms that are derived. I think, you know, from the update framework, feel free to yell at me. So tough is a design specification and implementation that's intended to provide substantial security improvements to package managers and software updateers. It does this by adding verifiable records about the state of the repository or application. And well, we'll get to what makes it sort of unique, but which is basically the trust architecture and responsibility separation. Tough is the result of the collaboration of security researchers and engineers working on software updateers. Its design has influenced package management across industries, etc, etc. So one of the key principles here is compromise resilience. So in order to achieve compromise resilience, in other words, in order to achieve a system in which a variety of compromises are to be expected and not fatal, you need responsibility separation. You need to be able to separate, you know, the roles and keys and sets of keys that are able to revoke, essentially revoke trust in other levels of the system to reassign trust and to regularly sort of rotate things. And you need that to be insulated from frequent use. The design here allows it to be sort of very, it can be very inconvenient to use these keys, making it very easy to make them offline. And I think I'll briefly go over what we do for our root key management and signing sort of ceremonies. So then in order to allow that root level of trust to not be used frequently and thereby end up inevitably getting put into insecure places or insecure processes, you then have delegated trust from that root. You might have something like a key manager for client X or Y or something along those lines, right? And then they can delegate further down that line. So that's a core of sort of what drives the update framework. Another critical thing, which I'm pretty sure is in Sigstore, is threshold trust. A lot of names for this, I think that's the one that we still use. So this is a notion of requiring a consensus of authorities. So you can list four public keys for a role and say, I expect any communication from these keys to be signed by two of them or three of them or whatever. All right. So I will not go into the, sorry, I will not go into the details of all of the roles in the update framework because our system is slightly simpler. But in principle, you have the root of trust, you have an authority for content integrity, you have an authority for freshness, an authority for consistency, things like that. Okay. So in practice, the way that it works for condescending verification and most of the content trust features that we have and or are working on, we have, you know, the fundamental thing to secure is a package, right? So for example, PyAero version 0.9.0 build, et cetera on a particular architecture, right? Along with critically, it's metadata, right? So the metadata for this package is part of what must be secured. You cannot just sign a package and expect that to be the end of the deal, right? If someone can tamper with your dependencies, if you're still in a dangerous place, even if you're expecting all the packages to be trusted, right? There are old packages on repositories, we cannot always remove them. In fact, we generally can't. So, I mean, among other issues, right? So if the, when the metadata is also, I'll get to that, metadata is also something we need to protect. So we produce a signature on that metadata once it has been produced. And I will show you one of those. And then this is the part that is frequently neglected, I guess, still is, you know, great, you have a signature from some key. Do you trust it? Is it, is it from the right authority? Who is this key, you know, held by? And for that, you have this trust metadata chain that I talk about as a critical part of the talk. Okay. Right. And so you have delegation from one to the other. This incredibly noisy slide is mostly here, so I can refer to it if there are questions. But I will blurt out a couple, you know, maybe interesting pieces. The way that we do our root keys is we have, we create, you know, for the fans, we create ED25519 keys on card on UB keys that each key holder, this is for root, that each key holder themselves like provisions. So they get a blank key, they can wipe it if they want. And then there are, you know, very tedious, not that long, actually, but very tedious human instructions using a minimum of possible code so that you don't have to trust as much. The only dependency I think we currently have for the, for the root signing process is a GPG version. When we have a variety of, like, there are hashes that we've saved and have these rotating emails and all this tediousness to try to make sure that the generation of these keys is done on the hardware device so that it cannot be removed. These are, these are sensibly tamper-proof devices, right? So if you try to mess with the device, it just erases all the keys. Right. So each person has one of these. They provision them. We share them. We share the keys amongst ourselves, you know, multiple modalities. And then we all sign using our key. We sign a document this, which maybe I can zoom into. I suspect not. Is there a way to zoom in like Google Slides? It does not look like it. Okay. Sorry. So this, you know, thing on the bottom left here is essentially the root metadata. The critical thing it does there is it lists here are the authorities for root. And then, you know, I think I've elided that because it could be long. And here are the signatures by those authorities designating this as trustworthy, right? I will get to the bootstrapping trick in a moment. So that's, that's sort of how we handle root. And there is a, you know, a careful updating procedure that comes from tough for how to fetch new versions, verify that I'm using the prior version and then discard the prior version and now you retain this, this root chain. Root can, like I said, it can delegate to other authorities which might have online keys or offline keys. They might have, you know, much reduced authority, right? So we have keys for signing S bombs, which are, you know, generally speaking, I'm much less, it's important to get the S bombs right. It's important not to lie in your S bombs. But if you get the wrong S bomb, you're probably not going to have your system compromised. You know, at least there's there's some mediation there. So we have because we have different levels of authority, it's important to have responsibility separation. And so that's the kind of thing that that this key manager role does in this case is it can delegate to an S bomb signer, it can delegate to a package signer, you know, for XYZ repository or, you know, ABC, you know, client repository or something. And then, you know, fundamentally what it comes to is we have an online key, right? In the end, there is an online key that sits in the build pipeline, you know, in a couple of different places, depending on the particular build pipeline. And that key, whenever a package is produced, it produces a record. It goes to this, it goes to this, it produces a signing request right away. The system that is capable of creating signatures, or use the signing request, signs it, returns the signature, and then we're off to the racist. So that's fundamentally the authority here, right? And then there are algorithms for verifying these things, which I will not trouble you with, I think. Oh, I probably should have jumped this slide before describing it. This is sort of a brief summary of it. Okay. So yeah, on the user side, you use the trust metadata to check these signatures. So you check the hashes and dependencies and cetera, all the stuff that's all the stuff that's inside the package metadata. And then once you verify that, and you trust it, it includes a hash. So you just use that hash to verify the package. You never actually have to sign the packages themselves, you just sign this metadata over them. So, okay, I guess I can stop for questions, because it's very slightly more complicated, not much, I think. Yeah. Oh, am I providing mine? No, I'm sorry. Yeah. That's what I get for not paying enough attention in school. Maybe you went over it and I missed it. You signed the metadata, so that addresses some of the dependency problem, right? But what about or latest, where latest is not defined at the time you're signing the dependencies? Yeah. So you have to know to expect, you have to know to, so if I'm interpreting it correctly, what you're asking, I should, what you're asking is suppose there's an additional entry on the repository that is ostensibly for a newer version, you know, 3 million 0.5, right? A fast forward attack in a sense. So the package manager, any system that you're using your signatures on has to know to expect a signature, and it has to know from whom to expect those signatures, right? And so you can send, you know, you can send any metadata you want to the end user. You can sign it with whatever key you have, as long as you don't have the key that is on the in the build pipeline that's trusted at the time, they will just reject it, right? Now there are configuration options. This is as yet, it's not on by default. And I think that I think even if you turned around the primary configuration, just issues of warning. So we're, you know, this year, I'm hoping to roll out like the default on version of this, but it is available and functioning if you if you if you want to use it. Did that answer the question? No, okay. Yeah. For those who for some reason, crazy reason, don't know that's that's a really good question. So the, so we're, we're producing all the packages for this set of channels for this, this curated set of channels. And because we build them, we are able to immediately sign them. And you can expect that anything you acquire from these channels should be signed, right? There is a broader work. There's folks at prefix.dev. There's, you know, PyPI has been trying this for some time, community repositories where you can, where you can upload things and then have them signed by the repository or an intermediary on the way there. Those exist. There are mechanisms for that. The remaining thing for us is that we have to, we have to decide on, you know, we have to make sure that the community is in sync on this, right? So there's a SAP, a content enhancement proposal that we have to push through and make sure everything is everyone's okay with it. And then we have to have a mechanism for registering and getting either getting a dedicated key from us or you tell us what your public key is for what you're going to sign or we use something like Fulcio, which if you're familiar is like an, oh, I, yeah, okay. So, so, but that's not something we're doing yet, right? It's part of the, it's part of the delegation system, right? That we can, that we can say here is the key you should expect XYZ set of packages, however defined to be signed by because they've registered on this, you know, custom channel. So anaconda.org you can upload whatever you want to your own individual channel. That's the question? Okay, cool. Right. Okay. So, okay. So what differentiates basic designs for this kind of content trust problem from hardened ones is generally, in my experience, it's where in the pipeline you make your signatures. So how soon are you doing it?  You know, where do you sign? Where are you verifying the recoverability and resilience of your trust architecture, which I described a little bit of what that looks like. And again, that's based on, you know, responsibility separation and like things like multi key thresholds. And then how trust is established regarding what keys to expect signatures from, right? So the delegating architecture and bootstrapping trust, which I said I'd get back to. So I will. Okay. So that's where a lot of the subtleties lie. And some of these are where increasingly popular tooling out there, like six store and salsa, which are both truly wonderful. I think, I think, you know, unless I'm not up to date, I don't quite have solid answers to yet. There's a talk after this one by Marina Moore, which I would encourage everybody to go to, which explores, it's a little more narrow, I think, and it explores how to integrate some of that into six or I think is that one. So take a peek. Let's see my next slide about. Okay. So the bootstrapping problem. You know, when you get an operating system and you install an operating system, you get root certificate authorities, right? You get root certs included in that. And so that's part of how you always try to maintain this chain of trust. The same is true for Kanda. Whenever, however it is, you obtain Kanda.  We can explore what the, this trust is based on as well. But when you install Kanda, when you get Kanda, however, as you've gotten it, there is, you know, a fixed piece of metadata in that version of Kanda that is your fallback root of trust. So the very first time you run, that's all you've got. It might be version one of root. And that allows you to go out and get version two of a route. If there's some, if there is a version two of a route, these are not frequently updated and verify it using one and so on, right? Now, how do we trust that? Well, there's, so we do GPG sign, you know, our Debian packages. We use Windows code signing for Windows packages. We use Apple code signing for the Microsoft ones. But fundamentally, you know, there is, you know, it's not a perfect link there, right? I can't assume that everybody has like some sophisticated TPM, right? So that's where we are, right? We lean on operating systems and existing distribution networks for initial installer distribution. And then once you have Kanda, Kanda updates itself, so it checks everything, right? Okay. I can, if it's of interest, I think we're, I think I'm rapidly approaching time, so maybe I should stop. Yeah, let's skip all these changes and some examples. I'll post the slides. So do I have 40 minutes and then questions or is it 40 minutes including questions? Oh, okay. All right. Why don't we stop there? And any other questions anybody has? Okay. I mean, I'll stick around and say more things if you want. Okay. Okay. So that was sort of the most direct application of what we'd done in an Kanda, which I'm, you know, there's more to do for sure, but I'm pleased at least with progress. Other things I've had to learn working in, you know, a mid-sized air quotes startup that's been around for 11 years, but continues to reinvent itself, you know, one of these situations is, is that supply chain security is architectural. And in order to have, you know, in order to have a secure build network, in order to have secure processes, you depend quite a lot on the systems thinking of the tech leads and the systems thinking of the, of, you know, anyone who's involved in the maintenance of these systems. That's what I mean by it's architectural. So some folks from large companies might find what I'm about to say really obvious, I don't know. But at the places I've worked, this has been a place where improvement was key. So for example, it's easy to say that you need a threat model, but threat modeling means a lot of things. In almost any company, you can't drag every team lead through like a sophisticated specific threat modeling framework. So I don't bother. We write our own minimal one. The key as far as I see it, yeah, is to help people think about how to think about systems and architecture, rather than focusing on, you know, the functionality of an individual feature, they have to really understand where they're getting every piece of data they depend upon secrets and otherwise. That has meant that in order to get, you know, in order to make progress in a lot of places, I have to make sure that there is a maintained diagram, very detailed maintained diagram for all the projects with all the inputs with all the outputs with with security regimes like like shifts in one regime to another, delineated clearly. You know, when you when you make a request to a Lambda to run something for you, where are you storing the AWS credentials? How are you going to get access to those? Are there requests being verified in some particular way? Is there some key that holds the store to that that you then have to go get? I have seen systems where, you know, there are like three levels of interaction, where like a key is put, you know, in some vault server, that you then have to get out of last pass or something and the key to access that thing and so on and so forth. And all you're really doing in a lot of these cases is adding more avenues for attack and making it much more difficult to track use. So yeah, so all those things that, you know, have to be on the diagram, you have to you have to note where secrets are being retrieved from. What else? Yeah, your enemy is humans, it's time, it's complexity, it's lack of understanding and it's lack of ownership. And if you don't have checklists for like major changes that include things like update this diagram or else this will not be merged, it won't happen. Yeah, so what else? Yeah, so do I have that next? No, I'll get to that later. Yeah, so buzzwords will get away from you. Salsa is magnificent, it's wonderful, and it's also, you know, an effective lever for driving organizational engagement. It's much easier to say salsa than to say like, here are my large concerns about the build system and here's the, you know, the six primary attacks that really make me anxious. How do I compare their impact to the other things that you're thinking about at the top of the organization? But everybody understands, you know, a compliance framework, right? Well, you know, everybody understands the advantage of talking about a compliance framework. Yeah, so, you know, you have to be aware of zealous security theater. So we've gotten, you know, we've gotten a lot of push, a lot of value in using salsa as like a lever and a focus. But you have to be careful what you're playing with in your organization. There will always be efforts to, you know, trivially integrate, which we have avoided, we have avoided all of that just to be clear. Anaconda is great. But there is always a struggle, right? So another, I don't recall who was talking about this actually. One of the talks on Thursday actually talked about this a little bit, the threat of regulations coming early in the sort of development timeline of security tooling. You know, this has been a quick push. So the NIST guidelines, I'm forgetting the number now, but relating to the software, secure software development framework and life cycle, regulations are kind of early, right? So like a lot of the tools, for example, S-bombs, frequently not well defined. A lot of people don't know how they're consuming them. Again, yell at me if I'm out of touch. I fall behind a couple months, but that's my take currently. So those, you know, those being mandated early means that a lot of people are just going to push what they have, right? They're going to produce S-bombs. And, you know, we also, like we are in an iterative process of making our S-bombs more inclusive and interesting. If you've seen what Yachto does, I like theirs. I liked theirs a year ago. It's pretty cool. But I do see quite a lot of S-bombs that are not very good, right? That will describe things like patches that may have been applied but haven't necessarily been applied or will fail to note compiler flags and, you know, in numerical calculations at least, and a lot of other things, you know, those are critical, right? That you can break your calculations if you have one package that's trying to use different compiler flags. Right. So, okay. So one of the things that we've done, a number of folks, I think, have just said that, you know, there is no way to have enough security professionals. And that is true.  And it is certainly not enough. So leverage is critical. So as I said before, like, it's good to have all, you know, all your tech leads have fluency in a certain, in certain kinds of notions, right? And so one of the things we're trying to do is we're rolling out this security champions program. It's a pilot at the moment. And I'm, you know, I'm enthusiastic and I like it. I encountered, I think AWS has something like the security guardians or something along those lines. So I mean, I've seen other things out there. This is not in any way unique. But the idea is to sort of, you know, bring everybody along. It's a team sport. Yeah. Yeah, let's stop there. So I'll share links. I'll share links to some of these things. Any last questions? Yeah, I'll upload them on to sked. So I've not done that because I've made quite a lot of changes. I will. Yes. Okay, cool. Thank you.


We're good Yes, I'm Jeremy Schweitzer. I'm the director of customer solutions for ethink education, and I'm Courtney Bentley I'm the VP of services here at ethink education and Obviously, I can't operate the technology Maybe nope Oh, there it goes So our title said Moodle magic and really it's more sleight of hand that we're talking about You know, most of you are probably You're running Moodle installations We know that many of you run multiple Moodle installations because you may have multiple audiences That you are trying to reach More and more we are hearing needs around the need to target information to particular users particular groups of users Really trying to personalize the experience. We know that you know This is one of the things that Martin talked about in the keynote is reaching users all over the world And so that need for personalization Is a really big key to what we're hearing many of our clients need So I'm gonna actually walk you through a Few of our examples. I thought Jeremy was gonna talk about my fake tendency, so I'll jump in before he moves forward I always refer to this as fake tendency. So what we're gonna talk about today briefly is The way that we have been working with some of our clients The ways that we've been working with some of our clients in order to organize their sites In order to really leverage both core tools and some plugins In order to do that sleight of hand So Jeremy's gonna talk you through a couple of examples and I'm a walk-and-talker, so I'm gonna walk a little bit So one of the examples is really that idea of targeting different locations So the example we have on the screen is showing you to it's an area education Association those go by a lot of different names and a lot of different locations But the idea is that they have a lot of different locations that they're all trying to target in slightly different ways Different courses that they're showing Different resources that they're highlighting and so what we've really done is set it up so that when anyone logs in They're seeing only the information for their particular location So it's a little bit hard to see maybe on the screen but when these users log in we did an example from the chief Lesh I If I've buggered that in anyone knows that I apologize and the baits locations for this particular one There we go. It is the clicker now. I know how it works this particular example is a kind of Student support program that's really designed around cohorts that are based year by year So they have a year one cohort a year two cohort a year three cohort And really what they have done is they are dynamically creating those cohorts Enrolling people into a cohort and then have a front page that is customized to pull in HTML blocks and other types of information That are specific to certain cohorts So from an administrator perspective the page maybe is a little difficult to look at but from the end users They're seeing only the information resources blocks that are really important for them and Then this is an example of a client of ours that is doing end user training around products So each one of their clients they want to be able to log into a single Moodle instance So they can share their courses across all those clients, but have a different tailored experience So what they're really doing is using those cohort blocks to do every single one of their clients has their own block that kind of says welcome to a particular company whoever you're working for and This kind of shows that you can create this kind of multi-tenant or fake tenant Dashboard experience and so just to reiterate what he just said I think that many of you may be thinking gosh We do that already on the front page and that is true Many of our clients are also doing this on the front page in similar ways. They're using pretty much just access restrictions With maybe profile fields and things like that So what this is doing is leveraging both core functionality as I mentioned along with plug-ins So when we're talking core functionality that we're leveraging custom roles So that first example that you saw where each of the Each of the different centers receives kind of their own list in the course category Each of those centers is set up as its own custom role a Little unwieldy to manage if you get up in numbers However, the role itself is really simple basically an authenticated user and then we can push and pull other things as needed cohorts, so This is actually I'll tell I'll tell a story on us I guess we've been working for working with each other for quite some time And I kept saying yeah cohorts is the solution cohorts is the solution We should be using cohorts and everybody looks at me like I'm crazy because everybody goes why cohorts only do enrollment? They're very focused And so finally we put this together and sort of broke broke through that door That cohorts really can be used for more than just enrollment. I can be convinced and trained. It just takes a while And then as we've mentioned access restrictions, so being able to use those cohorts For limiting access to particular blocks particular content and then obviously visibility so turning off the visibility on things Playing sometimes with CSS in certain situations in order to not make things appear hidden when they really probably are So Courtney was talking about the core functionality we do to really create this more of a seamless experience We are using generally some plugins to make this possible. So the kind of primary ones are the local profile cohort which allows you to Dynamically assign people into a cohort based on profile fields and then the block cohort specific Which actually allows you to do something that people really wanted a way of doing with blocks Which is making them hidden or shown to specific groups of users It really allows you to do that anywhere that you are using a block You can tie its visibility to membership or lack of membership, which is kind of cool. You can do it both ways Specifically in any cohort within the site Both of those plugins actually come from the university or Olm University. They just kind of flopped their name And they've done a really great job of developing those plugins releasing them to community Giving some basic use cases and then also being really open to feedback on the code Any issues performance-wise or anything that we've seen they've really taken that feedback and been great partners to work with And then the last one which is local cohort role And this is one that actually that team also recommends and one that we've actually used in the past that it really allows us to Say, okay, if this person's a member of this cohort automatically assigned them this system level role Which is where we're able to do things to kind of create this systemic level experience Which we're gonna dig into in just a minute So I always want to know that's great. You've told me some of the tools But let's dig in and take a look at how we've woven this together So the first thing is creating and if you know me you know that I will prefer to automate everything if possible So create and preferably automate those cohorts. So what you're seeing here is that profile field based cohort membership If you've not looked at this one before you'll notice that what it's doing is allowing you to Set up rule sets. So if the user matches this criteria, then add them to that cohort So pretty simple to set up And then you'll see that in the system available cohorts You'll notice the source is now profile field based cohort membership Anytime a new user comes in matches any of that criteria It will automatically push them into that cohort One of the really neat neat things about the plug-in is it'll actually allow you to start building out business rules So you can say must match these two things to get into this cohort or match only this one match all of these You actually have some flexibility for building out business logic within Moodle through this plug-in So then cohort role sync to custom roles. So again Being able to set up that custom role and then define the synchronization so that The cohort that's been established then pushes into that custom role that I mentioned really in this case It's kind of a glorified authenticated user There's not a whole lot extra that it's doing there because then it's pushing them in as a learner to those courses where they need access The nice thing is we're not excluding using cohorts for one of their primary use cases in the first place Which is enrollment, but you can also ignore the enrollment functionality of cohorts and use other enrollment methods if you're using something like the external DB Enrollment method or anything like that. Nothing that we're doing here excludes using any other method So when you get to the point where you're ready to kind of map those cohorts to the visibility of specific Categories, so that's what we were doing with the first example. We showed which gave you kind of a rundown of these Users log in there from this location. They can see these categories, but not these categories All you're really doing is going into the category level permission So this example is the baits example that you saw earlier and we've gone in and said the view hidden Courses no view see hidden categories. I'm sorry. There's both of those permissions you Just add that Basically that baits roll to that so that they can see that particular category and only members of that cohort can see that category And so the result is potentially a custom view So we went ahead and pulled those three examples forward just so that you remember What those looked like previously so the example that you just saw kind of built out is the one at the top where? Baits users are only seeing those baits categories When they take a look the one in the middle again is using Dashboard view. It's using the HTML cohort blocks in order to distribute information To that learn to that user based on their cohort membership And then the last one is aligned with their different Companies within their organization their different department areas so again notice it is on the dashboard Where it is displaying that? Specific menu set to them. I also know that people might have different setups There are options for things like automatically creating cohorts through different methods than the one we use as an example today So one of those would be if you're using LDAP for your authentication method There's the possibility of mapping those into cohorts So if you have a security group you can map that automatically into a cohort in the system So if you've already done that there's no need necessarily to back up and do it through kind of that cohort mapping or the Profile field mapping to cohorts that we kind of demoed today if you're using that When you're using kind of a standard restrict access you can use profile fields To do that restrict access But if you're using another method to create those cohorts you may not want to then map that to an extra profile field We would always try and avoid adding extra work and try and automate as many things as possible So if you have that set up there's options for doing things like standard access restrictions based on cohorts Actually the example in the middle when this picture isn't showing that but they also have that setup so that they can Do different things depending on whether it's a front page a dashboard or course page allowing them to do even things like semi-multi-tenant courses where some of the content is shared across the cohorts But some of it is shown specifically to individual members of cohorts And so they restrict access down to that cohort level for activities and resources as well So there's a lot of flexibility for how you build these things out a lot of it really that we do is Kind of stop and do some mapping What's already in place? What's already automated? Okay? What are you trying to accomplish? How do we put that together so that you are creating that curated end user experience that you're attempting to build? All right, so I hope that gives you a nice Kind of overview of some ideas that you might take home and implement I think we have maybe a couple minutes for questions if you have them And then obviously we're gonna be around for the next couple of days You're always welcome to track us down and we'd be happy to geek out about this Could you wait? So We can set cohorts right so within a cohort. Can you set selective roles for? different users, you know an example would be You know, I'm looking at not looking at non-academic settings So probably say and supervisor with people who report to a supervisor. So can you set different roles for people within a cohort? That's my question. Yes, so Find me. Oh, sorry find me and we can talk We have done some things where we set a user relative to a cohort so that the supervisor then has access To view reports and information about their cohort Yeah, it's a similar setup to what we're kind of talking about but a slightly flipped use case And there's a couple other things that you can do to kind of streamline that But yes, generally what you're doing then is assigning that role in the context of the cohort rather than Kind of the version we were talking about where you're assigning the cohort in relation to the user So it's gets into moodle contexts those of you who have been around moodle for a long time You know that there are a lot of context and they interact in sometimes unexpected ways Any more questions? I think there's one here. We've only got time for one more question. So just this gentleman here Thank you Thank you. What would be a good rule of thumb for choosing whether to use a cohort or a role? Is there a preferred way or one way where one would be better for the other? Well, I would say most of the time we're using both So the core cohort is really allowing you to identify the users you're attempting to target in a way that is readily Automated so if you already are doing this manually and you're saying it's a small group And we're just doing this manually you could assign the roles Manually and just skip the cohort but if you're starting to talk about scale and wanting to do this across hundreds or thousands of users the cohorts allow you a Slightly easier way of assigning this in an automated way so that as soon as someone enters the system You don't have to worry about them making sure that you manually go and add them to the right cohorts or add them to The right roles the system pulls that information and automates it all the way through And we have clients that are doing fully manual or self Registration that are using some of this but we also have some clients that have this entire stack automated It really depends on what you're trying to accomplish But if you're talking small groups of users you could skip some of the cohort pieces and just do it with a role Okay, thank you very much to Jeremy and to you call me


Hi, everybody. Welcome to this TechSoup hosted webinar today. We always love it when you hear, especially when you hear early, so we can get to know you, find out where you're from, and we found out we got people from California, Canada, Virginia, Texas from all over. This is what I love about being a part of TechSoup, but today, we're going to learn how to reduce, reuse and save with TechSoup refurbished hardware offers. So I know you're going to get some insights on refurbished hardware and also learn more about what TechSoup is bringing to you as a non-profit to support you. Before I get started, I want to go over some housekeeping. Many of you come here to our webinars, but if you are here for the first time, this is how you can engage. I would love if you would use the Q&A section to ask your questions. And if you would like, you can turn on the closed caption button, just hit the CC button at the bottom of your screen. And you'll be able to see the transcription of the webinar. We will be emailing the slides and the video replay within 48 hours. I'm going to move out the way. My name is Aretha Simons. I'm the webinar producer here. But I'd like to introduce you to Shasta Keating. She is the director of hardware programs, and she's been a consultant for a variety of clients in the public, private, and the nonprofit sector. So she's very passionate about creating equity in the technology space. And that's why we love her here. So I'm going to go ahead and turn this over to you, Shasta, so you can take it over. Welcome, everybody. You're still on mute. Thank you everyone for coming and Aretha for helping to kick us off. It's lovely to always collaborate with you, Aretha. Thank you very much. I'm so happy to do a Earth Day Savings event with you guys. We're all here for sustainability and environmental stewardship, and it is really my pleasure to walk you guys through the agenda for today. And introduce you to some of the players that are walking the walk and talking the talk, and it's just really, I'd like to share with you the TechSoup has been, you know, instrumental in doing green technology. Our journey began with Jim Lynch, who is a renowned entrepreneur and environmentalist in this space. We're so lucky to call Jim Lynch as the person that helped to kick off refurbished hardware at TechSoup. Long before it was Vogue and everybody else jumped on the bandwagon. I want to say that we were one of the very first retail marketplaces for hardware devices and refurbished devices. So it's a really kind of a jewel of the crown for TechSoup refurbished hardware. And the person that I'd like to introduce first, one of our key experts is Kelly Sullivan. I actually often refer to her as the queen of refurbished hardware, because she really did start at the inception many, many moons ago, almost 16 years ago. And it's just such a pleasure to work with Kelly she reminds not just me but all of TechSoup and our entire sector to always keep the environment at our forefront. She is the director sorry she's I think of as the her as the director of refurbished hardware she's the senior program manager for our program and absolutely owe you so much Kelly for being just a champion for this work and for working so hard and you know engaging our wonderful partners. We also have today. Matt Young joining us. He is a long term partner of TechSoup, and I just love Matt because he's a yes person from the very first minute Matt's actually a neighbor of mine and hopefully I will get a tour of his refurbished facility. He's a new dad so we're very excited to celebrate that with you Mark. Matt is the president and founder of EVR and we're just so so lucky to be participating with you. And there is a Che Cripplani, he is one of our newest partners, and we're very excited to bring Shay to the team, and he is the CEO of injured gadgets and he will be bringing mobile devices to TechSoup so we're excited to launch that program and you'll hear more about that from Kelly. So I'll hand it over to you to speak a little bit about the TechSoup refurbished hardware program. Thank you Shafa. Great to be here and thank you everybody for joining us today. Yeah, it's been a wild ride for 1415 years I've been with TechSoup and working on this program. And a lot of the lessons that we've learned throughout our journey have propelled positive change in the refurbished hardware marketplace for sure. We've been thought leaders in this marketplace, and one of the ways that TechSoup differentiates itself from other marketplaces is through value added services. The greatest service in this program is the close cooperation and years of collaborations that we do have with our refurbisher partners, which is also unique to the marketplace. We directly collaborate with our partners to offer nonprofits better value with our products. We meet directly with our partners on a weekly basis to ensure smooth operations. We are deeply involved in the day to day operations and we strive for continuous improvement. We review customer feedback and issues regularly and openly brainstorm with them to help us enhance our customer experience, which is huge importance. And together with our industry leading refurbishers, we help nonprofits across the US access the best possible product with the highest quality and the fairest prices. So that's kind of the program in a nutshell and how we work with our partners and we're really excited to have Matt and Shay here and we're really excited to be launching smartphones and mobile devices. This is something that we've been working on for several months, but it's been at the back of my mind for several years, so I'm very excited to be bringing this to the refurbished hardware program. So some of the highlights here with the program as you can see this is year to date information and what we've we've been doing for fiscal year 23. And excuse me, TechSoup understands the warranty support and quality is vital for maintaining customer trust by carefully tracking and continuously improving the program we enhance policy and processes for the program. We focus on details such as packaging and shipping quality assurance testing and cosmetic requirements. This collaborative process helps us to be confident in our in our partners products. As a result of doing this throughout the lifetime of the program TechSoup has a history of offering longer warranties than industry standard. Today I'm really happy to announce that this month we have once again stepped up in the marketplace and extended our product warranty to two years from one year. This brings additional value for the nonprofits who are helping the most vulnerable among our population. So this is a very big and exciting advance and I'm really happy to be rolling that out too. So you should see that in all of the products or most of the products in our catalog now. Shasta take it away. Oh Shay take it away. Hey guys I'm Shay Kripilani. Just started working with TechSoup and had the pleasure of meeting these wonderful ladies and learning about the organization for the past 45 days or so. And I'm super excited that they decided to include us as their refurbished device partner. I'd love to give everybody a little background about undergraduate real quick just because I assume most of you guys have never heard of us or know anything about us. Where'd my video go. Let's put that back okay sorry I clicked the button I guess I don't even know what I clicked. So we've been in the business since about 2009. And we started because back in 2009. I broke. I think it was my iPhone 3G so I don't know what was that like 10 models ago or so and I went online to try and find parts for my phone to repair it. And I realized that there was basically nothing. No reviews no real good vendors. And so I started researching overseas because I'm like you know what China's got to make the parts or India or some some country over there maybe China made the most sense because that's where Foxconn is for the iPhone. And I purchased the iPhone screen from over there. And I was like you know what this is a this is definitely a good business to be in so let me import 50 of these screens. We started selling on eBay and then today. I don't know 14 years later, we've moved warehouses four times have 12,000 skews and help to renew over two and a half million devices annually. And we're very thankful that we work with so many repair shops, depots, and companies who really believe in the reuse refurbishing and renewing model. We got into devices a few years ago, and thankfully, we got in touch with the tech soup. And so we are going to be bringing devices basically a lot of iPhone devices to start as well some Samsung devices to you guys. And it's all going to be refurbished stuff. A lot of it's refurbished in house with the parts we sell. And that we actually do some refurbishments in house so that will be battery replacements screen replacements sometimes sometimes just polishing devices. The idea is to extend the life cycle of a device by an additional two to three to four years. And it's very doable because honestly, I think even Apple has said they're really unable to innovate the iPhone anymore there haven't been significant changes in devices in four or five, six years. It's really just plopping a slightly better rear camera into a device, maybe increasing the battery size you're increasing the middle the emperage and device life cycle or life daily life usage, but there isn't any innovation. And the fact that we're able to refurbish devices. And so many other vendors and just resell them into the market is huge for our earth. So I'm glad to be part of that. We do a 30 point inspection on all on all of our devices. That's iPhones and Samsung's and hopefully as as we continue to grow with tech soup and learn you guys's needs a little bit more. We will hopefully add on MacBooks and Apple watches and iPads and other items that we carry right now, but we're going to start with a smaller inventory just to make sure everything's rolled out properly. We want to ensure that we take care of you guys and kind of live up to the tech seat brand name. Hi everyone, my name is Matthew young. I'm the president and founder of electronics value recovery. We've worked with tech soup for more than five years providing 10s of thousands of refurbished quality devices to nonprofits. I've been in this industry since 2008 working with some of the largest companies brands to know every day. And our business focuses on electronics refurbishing it asset disposition and material recycling. When you're talking about quality and the things involved in refurbishing different types of electronics. A lot of our processes are actually driven by software now which has been one of the big evolutions over the last 10 years of the business. Our software and you know physical quality control checks of devices will check 110 different points to make sure that every single thing from the webcam to the battery to the screen is performing and operating, as you would expect with actually better than new rates of quality in terms of returns and debt on arrival equipment. You know we're dealing with technology which changes all the time as new devices are coming out. And so being a refurbisher you've got to constantly stay in front of the newest technical trends that are coming out and making sure that you can test and validate all these different things that might not have even existed in the computers that we were saying two or three years before. And in these sorts of processes, you've got a lot of different things around quality control, where essentially we might even be testing the same product twice as it goes through our system to make sure that any changes ie swapping out of the system is adding new things in. We want to do a complete full validation that that equipment works. You know in the marketplace you may see used electronic goods. That can literally be just the computer that you have someone posting it on a marketplace or Facebook or something like that. And there is no validation of how good is this battery how long is it going to be lasting do all the different components of these work. And that backed by a warranty so you can have peace of mind that the equipment's going to perform is really the key differentiation between refurbished and used hardware to cover the, the sustainably impact that text super sad. So, one of the things that's really interesting about refurbished equipment compared to new equipment is that the manufacturing process is generally where most of the energy and most of the greenhouse gases emissions that will occur inside of a device is what will happen. The EPA has released some statistics and their course a standards, and we've used some of that data to help kind of quantify the impact that tech soup has had by redistributing 170,000 devices over the last several years. And that is 10 times better in terms of a carbon emission impact to reuse and extend the life cycle of a device simply versus recovering that device for commodity and scrap metal. So by buying refurbished equipment, it's not only great for your wallet, because you can get more technology at a better value. You're also having a significant greenhouse gas emission by extending the useful life cycle that device, and not needing to have a new device be manufactured. So much for running through this so quickly one of the reasons that we kept the conversation short with you guys is that we're all here to make a significant environmental impact and we wanted to give the audience an opportunity to really ask questions put them in the chat address them to particular panelists and I'll help kick that off. So Matt, Shay and Kelly. I think one questions that that's top of mind for everyone on this call is how to shop for refurbished electronics what are some of the nuggets of advice that you would offer to that question. Yeah, I mean for me, I think just because we saw a significant amount of refurbished devices. I think one of the most important things is to look for a quality seller. There are a lot of sellers who do, I guess, very shady practices in terms of devices right now. One example is, you can literally go into an iPhone, and you can use software to make the battery look like it's 100% so they can pretend like they're swapping out batteries with brand new batteries, or in actuality they're just boosting the battery and making it show a fake percentage of 100% or something like that. So there's a lot of sellers out there, specifically from what I've seen in some of the, not necessarily the USA market, but definitely some of the second and third world country markets. Just because it's so much less expensive, obviously, to use software, change the batteries, diagnostics in 30 seconds, versus actually purchasing a battery and replace it. So yeah, definitely finding a seller that's been in the business for a while that has good reviews and knows what they're doing.  The purchasing from the USA sellers is always good. I just feel like we've had, I mean, we've had conversations with some of our customers who are international, and they've asked us if we would be willing to sell them some of these shady tools or shady diagnostic processes. And that's honestly how we learned about them. What are you even talking about until they kind of explain it to us. So thankfully, we've only seen that a couple of times from a couple of USA sellers. But yeah, definitely look at the reviews and make sure that consumers are rating these products highly before you purchase something. But that's one of the things I would definitely do for refurbished devices and refurbished electronics. And I think to Shay's point, the devices are simply getting more complicated. You know, it was easier 10 years ago to be able to refurbish a computer because there just weren't as many components. And so the system was connected to the internet locks, the batteries being made out of packs instead of pouches were more stable.  But in order to do that, the technical sophistication and complexity in order to make sure that that computer is as good as it was when it left the factory originally has really raised the bar in the last couple of years. And the difference between a good to excellent product in the marketplace now versus a fair to poor product years ago is dramatically different in terms of the actual quality that you're receiving. That's right. Yeah. Both excellent points. And I would definitely like to add that when, when I work with all of the partners and considering products for the catalog. One of the things that I do is I compare the offers that the refurbishers are presenting to tech soup.  Excuse me. I compare them out into the retail marketplace. And when I do that, I position myself as a mind of the consumer or the end user. So I'm, I'm looking at competitive products. There's a comparison way of what, how, how do they stack up against this product and I'm looking at everything from, you know, just, just the basic specifications of the computer, you know, the, how much Ram it has how much hard drive it has, you know, the, the make the model all basic, you know, basic things but I'm also looking at do they charge for shipping are they what kind of warranty do they have what is the return policy, what kind of warranty support do they offer, I dig into all of those things because those are all kind of hidden, hidden things that accompany the computer after you've purchased it.  And for the, for the most part in most marketplaces, it's yours. And it's going to be, depending on the fine print of those warranties, it's going to be hard to return or replace. And so it's really important to scrutinize those warranties and scrutinize those return policies and what are they providing as services after you've purchased that computer or that device. The other thing that is really important to keep in mind when you're shopping in marketplaces, particularly big marketplaces like Amazon, or eBay is particularly Amazon and eBay when you, when you look for a device. They consolidate all of the sellers into a single listing. So when you purchase, you may not know exactly who you're purchasing from, because all of those ratings and the sellers are kind of consolidated into a single listing. And it makes it a lot harder to really discern who you're buying from, what you're going to actually get, the quality you're going to get, what the warranty is, you're making it a little bit trickier to kind of needle that out. So it takes a little bit more time, but it's worth the due diligence, because it is an investment for your company, for your office, for your home, for where, for, and so be sure to kind of look at those things when you're shopping. And don't be afraid to ask questions of the sellers before you pull the trigger, because it's an important investment. Yeah, thank you for that Kelly I think that that's really true of our partners and of the program as you run it Kelly because we come from a place of philanthropy because our members are nonprofits. We're a nonprofit, we're here to do good we're here for social benefit. And what I what I find and what I hear about when when Kelly is working with our partners is that, you know, our partners are philanthropy minded. So they will often extend that warranty to make it best in class because we're, we're looking to make the world better or they'll help us with returns just a little bit more, you know, because they're, they understand that you guys are out there and you have beautiful missions and you're actually making a difference to, to real people and real lives and addressing the hard issues so I love that about our program and, you know, can't thank you enough Kelly for really, really working closely with our partners and continuously explaining the needs of our nonprofits and the needs that we're trying to and the missions of our nonprofits right to try to make this happen. Yeah. Kathy actually some Kathy has a question in the chat that I want to answer while we're on the topic. Kathy's asking what warranty and repair will go into these renewed items. I can speak to the warranty part and, and perhaps Matt and Shay can jump in on the repair side of things. I'm going to assume that Kathy's asking prior to them being sold. So the warranty for our standard warranty and I say standard because it does. The warranty will go up to two years and standard warranty is covers computers laptops desktops and monitors. And that is most so there's going to be some sometimes there's going to be an exception to that rule, like everything there's always an exception for a rule phones will carry a standard 90 day warranty, which is industry standard. Actually, it's above it's above industry standard by 30 days. And all of the products in the catalog carry a 30 day. No questions asked return policies so the first 30 days that you have the product if you receive it, you open it you don't like it, you can turn around and send it back for a full refund. Of course that's assuming that everything is as it was when we shipped it to you, of course. And the warranty covers hardware defects. So if anything goes wrong, functionally with the hardware during the warranty period. The warranty will protect that protect it, and you'll be able to receive a replacement of the same product. If we are unable to replace the product with the exact same thing will replace it within equal or greater value product. So today do you want to speak to repair just a tidbit on the phones before they go out for the scene. Two things about our devices that you may not see in other devices is that you're not really going to see any genuine error messages or warnings like that. So if we are replacing batteries or screens, we're going to be either using a OEM screen or we're going to be transferring over original chip sets to keep the devices as original as possible. So you're never dead and have any updates or any issues with like firmware updates or iOS updates, or internal components not working. If the battery is ever below I think we have it at 80% it will be replaced and I would say the average lifespan for a battery is five years or so. So even if it's an 80% you still have a solid four years before that battery is completely degraded and unusable, or barely usable. And then I know we do have a take back program so if you ever do decide to return your devices we're happy to take them back rather than you throw them in the landfill specifically those batteries. And then the last thing is a lot of times when clients sell their refurbished or their use devices that become refurbished later, their use devices they may lose the original cables or the original blocks. So it will be including MFI which is the certification that Apple uses MFI certified lightning cables with every device, as well as a block I believe so the cables will always have the MFI certification so you never have to worry about if it's providing the proper voltage or the proper voltage to the battery, and that it will blow up your phone or anything like that. I know it hasn't happened for a while but it's definitely very plausible and people's batteries are often. A lot of people don't realize this but when you buy for instance the gas station charger the gas station cables. If they're not using those proper MFI certifications and improper voltages are going in your batteries and I've actually seen this before. I've gone to a Walmart for say, and they'll have like an iPad on display. And the glass will be lifting off because the battery has bloated so much, because they're using an aftermarket charger, or an aftermarket cable, and it's literally just blowing that device up. So, anytime you do buy for anybody wanting to know anytime you do buy an accessory we highly recommend buying either original accessories, or original compatible accessories. That's really, really good advice sorry Matt, please go ahead. And I would just say that in general speaking in the rare event that there is an issue with the device, rather than getting that device back repairing it and sending it back to the customer. Usually send would send a product out of, you know, are already finished created goods, because that gets the computer back into the hand of the customer faster than bringing it back in preparing it. There are special exceptions happen all the time, but it's one of the reasons why it's always important to have good data backup solution in place if you ever do have an issue, you can move over to another device quickly. Thank you yeah that's, I know we always say backup your data backup your data and sort of the high tech world and then we always realize when the data is gone that we should have hopefully moving to cloud makes it easier for us to have our essential data secure and backed up. And, and, you know, I just wanted to alert you also that we do have a webinar coming up on Cisco product Cisco security product at the end of May 23. So mark your calendars for that. If anyone, if anyone here is looking to secure their infrastructure we've got some really good new, what 50 new products that Cisco has generously donated to tech soup and we can offer to our nonprofits. One other thing that's in the chat. And Kelly, these would be really great for you to answer. Before I move on to the questions that we've devised, what kind of services are provided to determine what may be needed for a nonprofit Shannon thank you for asking this question. Kelly is master of things that are available through tech suit dot org and I'll let her speak to that. When you. So, sorry, is a little caught off guard by that question. So, and she asked, can you repeat the question. Yeah, so what I don't see it in the chat. No problem what type of Shannon wants to know. Because she would like some help with determining from a service perspective, what type of equipment would be suitable for her nonprofit so you know one of the things that you can do since you're a part of a special group here today is actually reach out to us and Kelly can give you an email to the hardware team and you can reach out to the hardware team through that email, but Kelly what other ways do we help our customers to determine what type of refurbished hardware would be a good fit for them. So we actually have tech soup actually has a customer service line that is run by draw steam that Kevin Mulhill is an expert in helping nonprofits choose their technology. Kelly is the expert in that particular field, and I can certainly get that information during this. It's going to take me a second to get it, but I will put it in the chat for you. Yeah. And Shannon, just to answer whether it's upgrading your current equipment or purchasing new equipment. We could certainly help with either of those. And then the other thing is, you know, to plan for future needs as well so we can have kind of a more holistic conversation about the size of your nonprofit the particular mission you're trying to accomplish and certainly help you. One of the things just planning this session you know I'm guilty of buying new computers and after everybody educated me on the, on the emissions impact that tech soup has made. I said to them I go my gosh I think I may have, I may have bought my last new laptop, you know, because they were so compelling by, by our partners and by Kelly that the reason to do so. There's also another question on Windows 11 Kelly. So our attendees has asked. Is all the refurbished equipment capable of running Windows 11. Unfortunately, it is not there. So, only about Matt you can correct me if I'm wrong about 15 to 20% of the equipment and the refurbished marketplace today. This is worldwide is actually capable of running Windows 11. So, so be mindful when you're out there shopping and looking to upgrade to Windows 11. You need to look at the processor and make sure that the specifications of the processor meet the Windows 11 requirement. So here's what I can say are two things. The first thing I can say is if you contact us through client services. We can provide you with the most current list because it changes on a pretty regular basis of anything that's in our catalog that is readily available and available to Windows 11 at that time that you contact us. The other thing that I can say to you is, we are currently, we're just beginning to work on our next catalog update. And it is probably going to be live in late June, maybe early July, hopefully sooner, but I like to, I like to go the long date just to be on the safe side. So we're going to be rolling out a Windows 11 category that Windows 11 category is actually going to have computers that will have Windows 11 pre installed. So we are going to be introducing Windows 11 ready to go computers for the first time since Windows 11 launched. So I'm very excited about that too. And just before I jump into our next question, you know, I was speaking with our services, the director of our services team and since Shannon you brought up this question. One of the things that I wanted to just put out there as a, as a question to you guys is what type of, you know, I always think that in order to create value added services for our nonprofits that you would really expect from pre pre installed software and then we could walk you through it. So for example, you know, you may want into it to capture your financial stuff or you may want information information on data privacy, and, or you may want work planning to get an Asana and then you're trying to get your workforce ready for Asana so you may want a package that includes the hardware Asana and say a course on Asana or are one of our service providers could help you with really maximizing the use of a work planning tool to achieve your mission. So is this can can people raise their hands and if you're a zoom kind of challenged, maybe shoot a little some information around that so we can gather feedback from you I love to have a kind of an information loop happening. So that we can meet your needs as best as possible so as we're continuing the discussion, let, let me please know if there are things that you would really value in terms of products that are bundled together or services that are bundled together or products or courses that you would really value. So we can include that in our offerings, and I would be happy to communicate that back to colleagues because everybody loves our hardware work, you know people know about our hardware, and if we can use the hardware to help you to better meet your needs by including services by including courses by including software. I would love that direct feedback from you so that we can actually make these value added suggestions possible. It'll really help also for our leadership to hear from from the things that you have to say so if you could take a minute to do that. While you're doing that. I would love to ask our panelists how can the nonprofit sector contribute to sustainability and environmental stewardship in general. So I mean I would say that everybody who works at a nonprofit, you know, kind of at your core, you've got values based or, you know, working with values based organizations in your DNA. And it's actually going to be an interesting opportunity for nonprofits because you know environmental social governance, things like this are really in vogue right now. And like we were talking about yesterday shot so they're even like grants things like that available for nonprofits to be able to improve their ESG and sustainability sorts of goals. We've worked a lot with both customers and on the regulatory side around some of these issues. The one thing that I would say is really important is whenever you're looking to engage in sustainability stewardship activities internally. It's really great to have some sort of a way to be able to track the impact that you're doing. So what we can put into data kind of this was our baseline this is our improvement, and then be able to look at what different opportunities are available to your organization, and then prioritize, you may find that you know changing all your light bulbs to have just as much impact is lowering the temperature a couple degrees stuff like that. And so it's really important to have data and be able to track your goals, rather than just what sounds nice sounds great to do. Wonderful. I also, Aretha maybe you can help me I see Michelle masters has her hand up I think that would be wonderful to engage some folks in a real live discussion. Actually, Michelle, if you can put your hand back up I went down. So, I can see if I can bring up I would have to share the link so you can put it in the q amp a or chat because I have to share the link out to her. Since this is a webinar style, but I did notice that a lot of people want to know about iPads. So if we're going to get any iPads or anytime soon. We actually just launched an iPad. A week ago, or the beginning of this week. Yes, at the beginning of this week we just launched an iPad. We have been historically difficult to get, I will say, but we are hoping to change that with our new relationship with injured gadgets. But in the meantime we did just launch one on Monday, and you can find that in the mobile devices category. And I believe that Aretha just put the link to our catalog in the chat. So you can click there and then scroll down to the mobile devices category and you will find our iPad. And the other link that Aretha put in I just want to make note that is a throwback. Facebook live that was done six years ago, and Molly Bacon who is no longer with TechSoup interviewed Jim Lynch, while he was still pre retirement, and Jim Lynch talks about how he how you can green up your nonprofit in your business if you are interested. It's about a 20 minute Facebook live, and it's wonderful. I encourage you all to go over and have a look at it, and you can hear a little bit about who Jim Lynch is and how he got his start, how he started the, the, this program. 1617 years ago. It's a, it's a great video. Yeah. And I think also, you know, on the whole iPad front, I always find that it's always good as, as soldiers for the environment, you know, war years sometimes for the environment I certainly would put Kelly in that category and Shay and Matt. I think that we need to, you know, put our corporations and ask them and I think most are philanthropical minded, all are, you know, environment social impact governance minded. And now regulation around ESG that folks have to follow. So always important for us and our sector to, to be asking for our corporations to do the very best that they can do to be asking our elected officials to be doing the best that they can do so be sure that you know you're raising this awareness for refurbished for renewed items and, and hopefully together we'll keep making a difference to, to all kinds of devices. So I wanted to turn to the last question that we have here and, and please feel free to add more questions to the mix. There are, there is a special that Kelly has going on there's also a new, a couple of new programs that Kelly has implemented. And so I would like her to help you to understand what you could do today to make a difference. And it's exciting the work that's happening in Texas. Kelly and please do share. Absolutely. So, many of you I'm sure every actually every one of you has at least two devices. And I'm sure at least one of those two devices is sitting and collecting dust, or isn't being used anymore. And I know that I have, I'm pretty sure I have more than half a dozen devices in this house and multiples of them are not being used. So, one of the things that we wanted to solve was what to do with those devices and help people help other people solve that, that issue, because I for one don't like sending my device out there, knowing that even if I, you know, delete all my things off of the device I still wonder in the back of my mind. What if I missed something what if there's a password sitting out there what if somebody gets a hold of it that really knows how to resurrect that information. So that's why it sits in my house for so long because I'm just very concerned about my information getting out there. So we created a new relationship with a nonprofit called donor connection. And this donor connection is an organization who manages donated electronics. Those donated laptops, tablets and smartphones get shipped to donor connection free of charge. The data is securely wiped. The assets are inserted back into the refurbished marketplace, if they are identified as usable. If they are not identified as usable they are responsibly recycled. There's a business so the other on the flip side of that if a business has a large number of computers that they wish to donate through tech soup, like 50 or more. They, we can work with them with one of our refurbish your partners to transport the computers to their location safely wipe the data refurbish them and then they would go into our catalog. Both of those donation streams allow us to continue offering low cost hardware to the nonprofits. Nice. And donor connection. So, one little last note on the donor connection piece. We are working on creating a form. It's actually for both donor connection and large donations. We're creating a form on our website. It should be live probably within the next two, three weeks. And where anyone can go. You don't even have to be registered with tech soup as a nonprofit you can be just anyone you can go and you can fill out that form and put in the information about the device that you wish to donate. And you'll get a response on how to donate that and eventually you'll get a shipping label and you'll be on your way to helping the environment clearing some of the stuff out of your house and all of that great stuff. Thank you very much. Thank you for the lively discussion. Thank you for everyone's lovely questions. And I think we've got a couple more questions and comments, everybody agrees that iPads or tablets and camera systems would be wonderful. Here's and we couldn't agree more. Let's ask for them. Let's, you know, reach out and say hey, you know, we've noticed that tech soup could use these products if you reach out and actually I receive emails from you guys about certain things. Then I can kind of fight for you guys. So, give me give me the tools to be able to really fight for you guys and all these pictures. I wanted to bring this picture back because all these people. These are actual real life tech soup people, and they really truly care about the mission of building capacity. I'm going to read another question Kelly I think you might be a good one to enter this. Can someone give me some guidance for software issues. I purchased the tech soup software package for M 365 office suite. And I have been having problems with the one note app. I was making a switch from my old account to new account with tech soup. So you want to talk about CSP and what we offer there Kelly or you want me to take it. I think that if you want to take it and I can get you a support email while you're taking it. Yeah, so we do have a team for the for Microsoft cloud services that's designed to help you with just exactly that issue. My colleague can help you over there and so what I would say is if you Kelly is going to shoot you a direct email and give you a place where she can be reached. And then either you can reach Kelly directly or you can reach me Kelly give her my email and I'll forward along if you can find the CSP email or Rita somebody can can make this happen and get you the help you need. Yeah, it looks like Gary is out but I have one more one more place to check. Get that email. Great. Any other questions. Yeah Kathy exactly we should just be working together. You know I was at the World Bank meetings representing tech soup just last week and it's just incredible I mean 50% of the world doesn't even have access to the internet and digital inclusion and capacity building for our sector. We just have to really work together, you know, share our needs, be very, very vocal and become experts in asking for what we need learning about what we need. I share your passion, I feel so committed to this work every day we get to go and work for one cause or another or another right you guys represent so many different things whether it's a homeless shelter whether it's a, you know agency that helps with our clients whether it's, you know, a sustainable sustainability organization it's just that we do good work, and we deserve good technology. And, and we certainly the more we work together to ask for the things to build our technology capacity the more we will close that gap. And as Aretha said, I think every single one of us including Aretha, we come every single day and, and, and feel very, very, very excited to offer digital equity to all of all of you. Does anybody want to know how they can reach either you or Kelly or Matt or Shay about their specific question maybe your team. I'm happy to share the hardware team alias Kelly if you could do that and as appropriately funnel that will funnel that over to the right people. To be honestly particularly about your needs we would really love to hear, we would really always looking people talk about data data data, but the data of how we can help you. That's the data that I would like to focus on and you're the keepers of that information so please take the time I know we're all, we're all busy doing good but please take the time because I think that helps. It helps us to help you and our entire sector. Well, I would, if there aren't any more. Oh, there if there aren't any more questions. It would be really, really wonderful I just want to have you guys join me in thanking our panelists, thanking Aretha was just always a joy and so lovely to work with. And Kelly, really, in particular she has been just and I think there are some people in the audience that are very, very special. They're often unsung heroes of the environment. So thank you all for joining us and most of all thank you folks for doing the good that you do and we'll see you next time. Hopefully on May 23 to talk about security with Cisco so pen that in or pencil that in and we'll we'll get you more information soon. Thank you everybody. Thank you everybody. Oh, one person has a last minute question UVC. Okay, what's your question. They may have left. Are you still here UVC. I do have one last minute question. Somebody did put bait, they're looking for Katie video equipment to be able to push our content to the internet. I don't know if we have that okay you can see wanting to know where the individuals got the iPads on TechSoup. So the iPads if you go if you follow the link and I can put it right back in. Unless everything you have that handy. There you go. If you follow that. Well, here, let me get you a better link. Aretha this one here. Let's see here. Let's use that link that one that one will go straight to the catalog. If you click on that link to the catalog and then you scroll down to mobile devices, you will be able to find the iPads and the mobile devices. And also just a quick plug on the catalog for today and tomorrow. The rest of Earth Earth Day week. We are offering a Bogo for if you buy a designated desktop. You can get a free monitor. You just need to send in your fulfillment email to the refurbisher and they will send you a free monitor along with your desktop that you purchase so it's a great savings opportunity. And on video equipment we do offer cameras now in the catalog I was just having a conversation with with our business development person on on video conferencing type information. So please go have a look since there are Cisco cameras they're mostly security focused. Yeah, but that's a really good need and we should, we should now that we have phones thanks to Shay we can move on to cameras with Kelly that's a really great piece of feedback. Thank you. No. All right. Glad to have caught that last minute question and we'll talk to you soon. Bye everybody. Bye everybody.