I am KP Singh. I work in Google Zurich on security. We are part of an organization called Detection and Response. And this is a project to improve the stuff we're doing there in the upstream community. So we're going to talk about why we are doing this. We're going to like how does all of this work. We're going to talk a few detections that we build using that. What are the alternatives that are there in the community that exist. And we're going to do a little demo. Because I'm aware of Murphy's law, this is going to be a screencast and not a live demo. So, sorry about that. So motivation, right? Why do we want to do this? So there are two things that we want to, like there is signals. These are not unique signals. These are like things that correspond to malicious activity. And you can get this data from the kernel using things like audit. I executed a process. I opened a socket. These are signals or data that you can get from the kernel. You can use perf events for that. They could, a subset of these signals could correlate to malicious activity, but they don't mean that something bad is happening on the system. And then you have mitigation. This is the classic LSM space where you notice something bad happening and you deny the action from happening. And what this is, you would typically use your SELinux, app armor, LSM. So you could use sec comp. You could say that I want to reduce my attack surface. I don't want these system calls to be executed on the system. So security is essentially signals plus mitigation. That's the premise I'm going to build on. Currently, these two are disjoint in the Linux kernel. So if I want to build a new signal, I need to change audit. And that's hard. Like you have to update the space components. Let's say I want to change audit to start logging environment variables. And this means that this is a disjoint system. So you update audit or you add something to perf. And if I want to, if I realize something bad is happening based on that signal, I need to update the LSMs as well, which is more work that you have to do. And by that time, the adversary has already moved forward. So you were trying to audit, you were trying to audit LDP load environment variables. Now you've updated your LSM. You need to update the LSM to deny a particular fingerprint of an attack. So that's how signals and mitigation, we need a joint story for signals and mitigation in the Linux kernel is the motivation behind this. So again, what are some examples of signals? Like a process that executes and deletes its own executable. It shouldn't happen. It could happen, but it doesn't mean you need to always deny it. You may want to deny it. A kernel module that loads and then hides itself in slash proc modules. Why would it do that? Maybe. Suspicious environment variables. If you see LD preload being set twice on the environment vector, why is that happening? Maybe it's an honest mistake. Maybe it is something somebody tried to fool the lip-synter doing something. So these are all signals of malicious activity. Examples of mitigations. Like you, somebody mentioned that you don't want to load any kernel modules after the system boots. Great. You may want to whitelist certain modules that are allowed to be loaded into the kernel based on known hashes. You want to prevent known vulnerable binaries from running. The reason why you want to do such things is that when you build a binary, you want to release and qualify it. And typically, that takes more time than it would take you to update the policy that would prevent that binary from running in the system. And for a large deployment of binaries, this is actually very important to stop a known vulnerable binary or known vulnerable version from running. So that's there. You can also change these signals that I talked about. Not only those signals, but any signals that you think are relevant into a configurable MAC policy or an audit policy, but at the same place in the kernel. So that's essentially how signals and mitigation would go hand in hand. And this is why we want to do kernel runtime security instrumentation. So, and the way we want to do this is in our production systems and our endpoints. It's not just our data centers, but work stations and Linux work, developer work stations as well. So this is a great segue, actually, what Steve was talking about in the previous presentation. Unfortunately, I don't have the anonymous mask with me. I wish I did. But we won't use eBPF. And is everyone aware of eBPF? I saw you people laugh a little bit when Steve talked about it. But it's essentially a virtual machine that lives in the kernel. You can attach these programs to specific points. They are written in a C-like syntax. It's non-duary complete, so it can be verified. And eBPF is extended eBPF. It has maps. It has, like, more stack size, more registers. You have, like, more complicated lookups. And it has these things called helpers, which has more complicated logic that lives within the Linux kernel. And this is essentially what we want to use to build those detection helpers and use them in the LSM. So, essentially, extend the LSM using eBPF. We'll go into the details of all of this as we walk through the presentation. So, yes, we want to implement the LSM hooks as eBPF programs. And we don't want to do that with just the BPF tracing programs. You don't want to trace the LSM. You want to effectively have a new BPF program type that is geared for the security use case. And you would use those BPF programs to configure your Mac and audit policies. So, people ask me that why are you using an LSM?  And the answers are, like, the answers are basically what LSM was created for. They map not to the API. So, we earlier used to trace execs' calls to log process execution events. And execution execs' call is the API and not the behavior that represents process execution. So, when I have a security analyst come to me and tell me that we want to log this when a process gets executed, that's what they tell me. They don't tell me that I want to log something on an exec V event. And this is very key where LSM fits in. It doesn't hook at the API level, but it hooks at the behavior level. So, that's one thing it is very good at. It has also good mapping to kernel data structures. So, when you access a particular kernel data structure, that's where the LSM hook comes into play. And it gives you access to these things called security blobs, which the LSM can maintain some sort of bookkeeping or state. And this helps you build more complicated detections without having, like, complicated user space called to deal with the same thing. You also benefit, like, LSM is a proven mechanism to do security in the kernel. So, you benefit from the years of research that has gone into this space, and verification of the LSM system. So, you want to have that extensible with something very flexible that's EVPF. But you want it to be an LSM so that it's a proven mechanism as well, not just a random tracing thing. You also give back to the LSM in a sense, right? You add flexibility and extensibility. Right now, there are very specific LSMs. I saw there is an LSM for memory protection that is coming up, that is SARA. And you essentially can extend the LSM framework and not create these tiny LSMs and you make them flexible. This is actually a very good point as well that you get the feedback. The LSM, we're all engineers. We write great code, this is great. But there are these security analysts, they're intelligence teams who work on, who get, like, want to really write these logics and write mitigation logic. And we want to connect the LSM community with these people. So, if you have these people writing detections and make it easier for them to write detections, audit policies and MAC policies, you get a feedback loop that goes from the security analysts is how I try to refer to them and to the LSM developers, the maintainers, or the Linux security community in a sense. So, here it is. Here's what it looks like. You have the each LSM hook is represented by a file in security FS. Security FS is a fancy name for Cisco security. You have your PPF program, which is this object file that you compile, that is the run, this is the byte code I talked about. And this is, you're essentially saying to the LSM, please run this piece of logic when a process is executed as a part of the LSM hook. You get to, you have, you open the file, you have a program after using a PPF syscall and you attach these two together and you can attach multiple programs to each LSM hook. And it works along with the other LSMs. So, you can have AC Linux, App Armor, blah, blah, and then KRSI would run all the PPF programs there. So, that's like a easy high-level overview of what it looks like. So, what happens when you load that program? It can do two things. It can return an error, like, hey, you're not allowed to do this stuff. Or you're like, this sounds fishy, I'm going to log that. So, you can do audit logs and the audit logging happens. Currently available mechanism in BPF is using the Perf Events Buffer. So, what you essentially do is you get data from the kernel using those helpers I talked about. You assemble a logging format and then you dump it into the Perf Events Buffer using this helper called PPF Perf Event Output. So, that's how you do audit policies in Mac at the same place. So, again, what's there in the program? You have helpers, right? The one that we talked about is Perf Event Output, but you can also have helpers that correspond to detections in the kernel. And there's this new thing that, I think Steve alluded to in his talk as well, is the BPF parts or like when they're trying to make trace points more generic. And we want to use that part where there is type information available. So, essentially, I can say that I want to access this field of the entry, and I don't want the program to break when the offsets change in the kernel. So, we want to use that part of what the BPF maintainers have developed in our thing so that the program is more flexible. I don't want to write a small helper each time I need to access a field of a struct. And this is only read access, by the way. It's not a write access. So, if you want to do a trivial scalar read, like say, what is the start time of this task? You could go about it with writing like a helper, an API functionality in the kernel, or you could just read it using this stuff. But then you risk breaking, if you don't have the correct offset you're reading from the structure, you risk breaking the BPF program. So, essentially, behave like the kernel module. And this is solved with BTF. What is BTF? So, these people who developed BTF, they took like the hundreds of megabytes of dwarf information and they distilled into this compact file that gets exported into, into like, say, kernel BTF VM Linux. So, it's like 125 megs, translates to about 1.5 megabytes. And it, like, describes all the various structures that are there in the kernel, what are the offsets of different fields, and how does it relate to various source codes. There's a LibBPF library or a user space component that looks at your BPF program that says, hey, you're accessing the DI node part of the I node. And I know that this is there in the kernel.  And this makes your BPF program corey is what the people who developed it call, but it's essentially compile once and run everywhere. So, it's where we want to have flexibility, but backward compatibility go hand in hand. This comes as something new before I gave the last talk because this was not there when we absolutely disallowed any structure reads in the GRSI program. And it makes it more flexible. So, it has actually enabled us. Last time I gave the talk, we just had one execution hook, the process execution part. We can, now you can attach eBPF programs to any LSM hook. So, I don't have a 53,000 number like Steve had, because there are not 53,000 LSM hooks, but I just quickly added what we had there and we have like 198 hooks that you can attach eBPF programs to. Which is not bad. I think it's a good balance between tracing and security. And again, I'm making this very clear. This does not use trace points or fancy trampolines or all of that stuff. We want this to be a proper LSM. It's just using eBPF as a mechanism to extend the LSM framework, but these are functions that are there in the current. These are like, there is a hook called KLSI BPRM check security, which takes the argument, it runs the eBPF programs and it is registered as a proper LSM hook, so that you benefit from all the things that are about the LSM framework we talked about. Okay. We're going to talk about some detections. This is going to show some code on slides, which is fine. So, the story here is security analyst walks to me and he says, and they say that we want to deny any process that tries to unlink its own executable. Like, okay, we're engineers. We can find that out. What do we, what information do we need to have that sort of detection build? We need, on the inode object, we need to see what are the processes executing that. And on the process object, the task struct, we need to see what is the executable for that particular process. And how do you track that? You use security blocks. And that's what it looks like. The, all the stuff we've been talking about is essentially this. You say that I am going to hook at the inode unlink LSM hook in the kernel. KRSI did some bunch of work internally and has provided you an API for that detection, which gives you three forms of responses. It says that you are a process that is unlinking itself, unlinking its own executable.  And based on how you perceive that as a, as a, and you can link that with other signals, and you can deny that action from happening. So in this case, like I am saying, only if you unlink your own executable are you not supposed to do that. Otherwise, sure, like it's a, it's probably an event that somebody's not aware of on the system and they're doing that. So it kind of adds that flexibility angle to that Mac. You may just even want this to happen. And you're like, okay, you're doing this. I'm going to log it. I'm going to make a note of that in my, in my long list of audit events. And if you do something bad after this, I'm going to deny everything you do. So that's how, that's how this works. Again, the other example that we alluded to is the LD preload being set twice. You hook at the BPRM check security, which is essentially the LSM hook for process execution. You say like, give me the value of LD preload. And this helper is like smart. This looks at all, all the environment variables. It gives you the value back. Even if the attacker here tries to like overflow the environment variable buffer, like it's, it's like giving you, you know, these environment variables can be really large. They can be two thirds of your, I think three fourths of the maximum stack size, which is roughly translating to six MB. So they could just set like a big environment variable. It also counts how many times this is set. And the, and the detection is based on like you setting and leave preload twice. And this is where you want to, you can get the value. You can get notified of an overflow here. And then you can say what you do when these two things happen or when one of these two things happen. So again, use that as a building block to assemble your Mac and audit policy. You want to, this is again the file open LSM hook. There is Keras says again, providing you a helper for, is this a process operation on the, on the procFS file? There is, there is some special hooks in the LSM that allow you to do and track such things. So whenever the process starts, you get an inode object pack and you can say that this is, this is a file that this process created in procFS. And when someone tries to read a right to proc grid mem or like open proc grid mem in this case, you can, you can log this. It's probably okay. Like you may be writing that, but we want, you, in this case, we want to log that. This happens a lot for a different, if a different process tries to write to a proc grid mem, it is very rare that a process tries to write it to its own. There are some cases where this is genuinely required. That's where the auditing comes in handy. Okay. So we, we have explained some detections there. We, the plan is to build more detections and use the flexibility of the BTF stuff so that at the very least by exposing all the hooks, you can create an LSM. If you need to access security blobs, this is again something that KSI will have to build internally. You don't expose that. But you can create these, it already exposes the LSM ecosystem to some, something that you can build using eBPF. This is a question that I was asked last time I talked about. There was a new patch set that was sent a couple of days back. I didn't get a chance to look at it because I was traveling. But what we found is that line lock is primarily targeting discretionary access control and it needs unprivileged eBPF. KSI is system wide mac. So it, it, we don't rely on unprivileged eBPF. You are, you have the, you have all the capabilities of route. So we don't want unprivileged eBPF for now. It has a, it has a second like attachment semantic where processes are like, they're attached to essentially task credentials or like a second data structures on the, on the task. It's theoretically possible to do system wide mac using these attachment semantics, but it gets complicated because that's not what it was designed to do here. Right. You can, you'll probably need to change in it. You have no trivial way to replace the attached eBPF programs. Kernel threads, like I, we, we noticed that KSI hooks get executed for user mode helpers. Every now and then you will have a user mode helper come in, execute a binary, and this won't be logged by landlock if I, if I, if I understand that correctly. So there are, there are some things, I think landlock has its place as if unprivileged eBPF is a thing for, for unprivileged sandboxing, but it's not the right design for like system wide mac here. Why not audit? Well, like the obvious answer is that mandatory access control needs to have like, be handled separately. And we want to do that together in one place. There is considerable, with all due respect to audit, there is like, it's, it does give you a lot of information, but there is performance overhead. So like it, when you, even when you enable configure it on the, on the, on the kernel, like it causes a performance penalty. And it also imposes like in, in KSI, when you get information out of the kernel, you can choose the data structure in, in, or the format you want to assemble and write to the performance buffer. In this case, like you get strings back from the kernel. So that is, that there are some formatic constraints that we run into when we like essentially build detection pipeline on top of audit. I did some preliminary performance comparison with audit. We have some grains of salt at the very corner. So please take it with the grain of salt. I brought, I didn't get enough for everyone, but I think there are enough grains. KRSI is the blue part. So the, the, not the exact numbers, by the way, the, the Y axis is like, it's clipped at 500. So not doing any marketing trickery here. But the, the essence is that audit has a very fat distribution. So it has like high tail latency. It can have bigger impacts on the system. And even when you enable audit, you get performance penalties there. So that, that's the, that's the kind of, that's the kind of preliminary analysis that we found for process execution events. And we couldn't log environment variables without it because we have to build that functionality anyways. So that's, that's how it compares right now. And this is a question I got asked as well. Like, why don't you just go and trace the LSM hooks? Like you have BPF probe type trace. It's, it can do, or like you have trace points. Just create a trace point and trace all the LSM hooks. Seems like an interesting proposition.  Leaving that aside, you are, you are, it's not trivial to override the return value using current BPF tracing programs to signal a MAC decision. You have no access to security blobs because you, you want to write into security blobs. This is not something that you're allowed to do from BPF programs. At least we don't want KLSI programs to be writing arbitrary data into the CUN. And it's not really an LSM. If you go through all the security underscore functions in security.c, the hook, these security functions are wrappers around hooks registered by LSMs. And they are, they do, they, sometimes they do some processing on the data before they pass it to the actual registered callback. And you miss out on that if you're, if you're just tracing LSM hooks there. So that's one of the concerns we, we, we ran into. I'm going to quickly like do a demo. I'm going to pause a bit while we do that. So hope this. So I'm, oh, great. This is how you can mess up a screencast demo as well. Anyways, so we're starting a VM that is running KLSI as the LSM enabled along with the other LSMs. And, and then I'm listing the hooks to show you that they're all these LSM hooks available. And we will expect to see more because there are places where the LSM hooks, like we, we just not got the feedback. I need a hook for that particular point. And then what you have is I'm running the, this is the user space component that is essentially loading your eBPF program. So it's loading like four eBPF programs into, into the various hooks. So there's one for environment process execution. There's one for inode unlink. There is one for like the procfs file op file open. And, and we, oops, just a second, my laptop is, I did spill coffee on it. So that could be one reason I'm going to go to the webcast here. You cannot beat Murphy's law. This is like, this is amazing. So, yes. So I, whenever, when I, I, I assess to that machine and I go to the other, other side of the terminal, I see like a bunch of execution information getting audited there. I run this thing called mem, which is essentially a program that reads opens proc, but mem and tries to write, write to that. And what you see is an event that says proc blah, blah, blah was accessed, right? You also have another one. I run another program that's called fault, which is basically, you cannot set these environment variables on bash, like twice, bash actually filters them out. But you can maliciously in the execs is called like past the environment variable vector twice. And that's what this program does. I have excellent values for them. But it gives you a warning that this is set twice. You can actually deny the program from being executed as well. And, and then there is the famous, the executable unlink where this is basically removing argv zero from, like calling unlink on argv zero, and you get like an unlink event on the, on the system. So that's essentially, believe me, it was there. It's again detecting one type of unlink event. This is unlinking itself. You could have other types of events as well that you can detect on. So, yes. This slide has appeared multiple times as a cause of my failure demos. But again, thank you so much for all the people who have contributed to this project and who will in the future as well. It does, it is not possible to build these things without all the contributions. And thank you for listening to me. And if you have questions, I'm here to answer them. It's almost inevitable when you introduce something that is sophisticated as this mechanism, you're going to have an exploit. Where would you see that happening? I mean, the answer, the answer has been already brought up in the, in the, in the room is EBPF needs to be, it's the, it's the place where you could have potential. But that's where it's an opportunity to like work with the maintainers and make it more secure and safe. And that's actually something we're looking at. The answer is, the room knows the answer. But yes, EBPF could be the place where you could introduce exploits. Questions? If not, let's thank the speaker again. Thank you.


What's up guys, mine is Michael and welcome to my YouTube channel today. We're gonna go over find merge point of two lists Basically, you're given this really weird to really weird link lists. I Don't know that why they have like two next pointers. I don't know what's what it is, but essentially You have like Two link lists that connect to a single node. We want to find that node, right? So like we have in this case, we have a link list one that has a b and c and then the link list to has p and q then there's also a It's also you could also go to x and b you could go to x also and this is where it converges to at x, right? It just goes together It meets here in this middle here of x and then it continues goes y z and all so What you're trying to do is you're trying to find a create a function that's given these two link lists It just returns like the node that it that it's The know that it's at right that it converged to So I'm gonna just explain that what I did and then I might explain a better solution So what I did was I created an unordered set That's just gonna hash the pointer of each node that we're looking at So I start up the first node first list right this first list of A and then I'm just gonna every time I go to the next node I'm just going to add it into my link list and I link list into my set So here I created a current node called just current node And I pointed to the head one the first head of the first link list and then while it's not equal to null pointer I'm just gonna insert this This is the pointer into my Unordered set, which is gonna be like a hash set and I just go to the next node Then what I do is after I added all the nodes that are that I've seen already Right into my set that I've went through through the first list. I go through the second list Right. I'm gonna set my head pointer to point to my current pointer point to head to and I'm gonna do the same thing Except this time I'm gonna see. Hey, did I already see this node? so I Searched through my set and I see Set my set scene and I just check hey if seen not fine is not equal to the end That means I've already seen this node and if I've already seen this node Then I return the data at that node and the reason why this works is because let's say we're at this example of test case 0 It's gonna go through the first link list Right, and then it's gonna add all those to the set. So it's gonna add one. It's gonna add two It's gonna three. It's gonna add null and once it reaches the end right it stops and it's gonna go through the second list Right this second was starting at this point of one and it's gonna check. Hey, have I seen this already? So have I seen one well technically I haven't right because these two ones don't have the same pointer Right, so then I'm gonna go to this to hey have I seen this to already have we seen this link list to of This head pointer to I have Therefore, this is the point where the two linked lists meet and then I just returned the two So that's what I do here. So if like if the scene dot fine current is not equal to the end It was already found this. I'm just gonna return the data at the current node And then I just go to the next list Then when I've done going through the second list, right? I'm going to the next one when I've done and I reached the end of null pointer That and let's say I didn't return any Data, right? I didn't find any No that I've seen already And that means there is no converging point, right? That means that both of these link lists don't meet at one point So if that's the case, I return negative one because that means that the link lists haven't We haven't seen the link list. We already looked at we already went to where we haven't seen a pointer There we haven't went to so that's why we return negative one All right, I'm gonna show you guys another solution also which is in case if This one's in Java, but it's essentially the same thing except we're gonna have two pointers one's gonna point to the head a and one's gonna point to head B and we're gonna keep traversing until Reached a point where they're the same. So this is this this problem statement is actually assuming that Two link lists are gonna merge at one point, right? So if we're assuming that it's gonna merge at one point what this what this person did was he's just gonna keep Going to the next node until we reach Until these two pointers are the same, right? so we have one pointer starting at the head node of the first list and second Pointer pointing to head B of the second list and they're just gonna keep going next keep going next until Those two pointers are the same and then they return it. So when they're going next, there's checking hey Yeah, the first one what they're gonna do is they're gonna go keep going next for the first pointer and then the second pointer of Pointer B is gonna keep going next When they reach the end of the list Right, so if the first pointer is next is equal to null that means they reach the end of list What they're gonna do is they're gonna they're now gonna switch to the second list instead and Look through that direction because they switch to the second list There's a big chance that both of these two will meet in the middle right because After I'm done looking through the first list I have to look through the second list to see if I ever meet met in the middle that these two linked lists traverse together Right. So yeah, and then if the second pointer that they're pointing at is equal to null So this meaning that if the second pointer I've already looked through all my second list, right? I Already looked through all the nodes of my second list and it's equal to null then they're gonna go to the first list and Like through those pointers also So if they go to the first list The they're gonna set the second pointer to start pointing at the first list and they're gonna keep going down and the sooner Later, it's gonna meet with the other pointer the first pointer and in the middle Right, so yeah when this is done They just returned the current bees data because that means they're at the same position So this works because it's assuming that there is a converging point for two of the link lists So what it's gonna do is gonna the first point is we're starting to start a second point to start a P It's gonna keep going next next next and then once a link list is finished. It's at C and it's finished It's gonna start at P and it's gonna start going to the second list and once the the second list is finished, right? Once that pointer is finished that point is gonna go to the first list and they're gonna keep traversing down That's your later. It's gonna meet in the middle. Okay, so yeah It's been pretty much just the problem Personally, I think my solution is a little easier to understand because like we're just looking through all the notes that we've seen already And if we already seen it, we just return it But yeah, if you want to go to the two pointer out. That's also another way you could do it It's just a little difficult to Traverse through it, but yeah rate comp subscribe. I'll check you guys later. Peace


option of many of these procedures I think we can afford to take a step back and slow down slow down to of the meta makeover that I suggest here is not just the critique of meta science it's about actually meta science in critically it's about it's an endorsement of more critical deliberate mindful practice and consumption of meta science so first I say let's keep our eye on the price we got in this in the name of science so let that be our guiding principle and let's evaluate everything based on how they contribute to our science in concrete terms so what have we learned how have we made progress in advancing knowledge and how do our meta studies how are our meta studies going to help us epistemically do they help us reach our goals we need to replace our short term focus on existence not existence type of results to scientific understanding by a long term genuine painstaking exploration and we need to be more intentional about what we study and why and maybe divert our focus to stuff we are actually curious about and we aim to continually explore for example as opposed to out of a desire to debunk things that we don't actually believe in and we need to design better studies first and then better meta studies which we can properly specify we must raise our own evidential standards both when testing hypotheses we want to be true and when evaluating them and collectively we need to keep questioning the quality and rigor heuristics that we have established we need to keep questioning and resist meta science dogmas and we need to openly invite criticism like this symposium but not only that genuinely engage with it and use it to improve the way we have been doing things and the way we are going to continue doing things lastly we must actively cultivate intellectual humility and accept that we could be wrong accept that we may have made wrong decisions along the way and resist hubris so I will conclude with a quote from Claude Shannon in 1956 he wrote a piece called The Bandwagon in response to the large scale quick and mindless adoption of information theory by scientists in meta disciplines so this was the concluding paragraph of this short paper and I'd like to invite you to mentally replace information theory that I italicized here with meta science and scientific reform and communication theory at the end with science so Shannon says we must keep our own house in first class order the subject of information theory has certainly been sold if not oversold we should not throw our attention to the business of research and development at the highest scientific plane we can maintain research rather than exposition is the key is the keynote and our critical threshold should be raised authors should submit only their best effort and these only after careful criticism by themselves and their colleagues a few first rate research papers are preferable to a large number that are poorly conceived or helped finished the latter are no credit to their writers and a waste of time to their readers only by maintaining a thoroughly scientific attitude can we achieve real progress in communication theory and consolidate our present position thank you I'll conclude with this and invite any questions thank you Bernhard this was really interesting I don't really have a question yet but what I do have is an interesting comment that I think a reaction would be quite interesting because it addresses the issue of communities actually engaging with each other so it's a longer comment but I will only read the end out it's the general point that insufficient attention is given to theorizing is well taken but I don't think this is in a position to miss a logical reform framing miss a logical reform as un-rigorous science is unhelpful and unnecessarily antagonizing I kind of would have expected that kind of comment well this is a critical meta science symposium and that's what I meant to bring to the table nowhere I think here I said that the whole reform is just this I am just trying to caution people in that kind of heuristic representation of reforms not thinking about their mindless implementation of them it doesn't mean that everything reform has done is this so this is just a warning that this is possible and it's happening somewhere and it's increasing in frequency as well in terms of you know like not reading pre-registration for example or automatically doing replication I am a meta scientist myself so yeah I know like there is a lot of good work I believe that my work is good yeah another comment is formulated as a question is while I understand the criticism here I wonder if this truly reflects how the majority have adopted open science practices yes there are many projects and approaches but most simply now to register they pre-print and maybe make data and R code open is this really a runway train a runway train interesting comment no I don't know I don't know whether this is the mainstream trend I don't know to what extent this represents how much or how much of meta science or scientific reform is being implemented I think this is a fair warning regardless regardless of how frequently it is being hated this way I think it applies it doesn't necessarily have to apply to everyone for it to be relevant that's my point thank you Beno and now we are going to have our panel discussions panel discussion where you can ask our panel everything that comes to mind related to reform movements or anything that you would like to ask about presentations but I think we could also quickly start by asking our presenters whether they want to ask another presenter anything because I saw during the presentation sometimes there was also hand up by our presenters so maybe we can give them a chance to ask each other questions and spark the discussion yeah I would like to open that I think by talking about something that came to mind during many of the presentations that I heard essentially all of them but was never made really explicit namely how do we think that these trends in meta science whether that is bureaucratization homogenization using heuristics instead of thinking well etc how all of that is related to notions of de-skilling like these molecular biology kits that Tim typed about in the comments and Nicole referred to that was already then they were introduced in the context of debates of de-skilling if you can't sort of make your reagents yourself and do all the work yourself really worthy of being a molecular biologist is this these tools that we are being handed these procedures that are being developed and optimized is that de-skilling science in some way or another do I need to answer it myself or do I need to point at somebody oh Thomas wants to go okay I'll have a go I think this is something that I've seen crop up a lot in the debates particularly around when it comes to workload there seems to be almost two schools of thought which are we need to train researchers to do open science and how to do pre-registrations how to share data how to share materials how to write reproducible R code and then they're kind of at the same time there's this perspective of saying we shouldn't expect researchers to be specialist software engineers at the same time as being experts in cancer or things like that and actually we should move to team-based research to be the team that has these skills I've kind of never really seen that sort of resolved really about you know should probably the answer is not to move one of the extremes entirely but it just seems to me to kind of be a bit of attention here about saying like well it seems a bit odd to kind of try and do both things at once like either we try and specialize people to have certain open science skills or we should try and develop like more rounded scientists who can do everything and I think probably the most interesting perspective I've read on this sort of comes from the higher academic the higher education literature where there's this really cool paper I'll put it in the chat by a guy called Bruce McFarlane who basically argues that even the term even what it means to do research in the kind of current climate of sitting down planning a research project that you do and then you write up is the skilling a broader perspective of what used to be like an academic where you know research isn't just something that like an individual project that you sit down and do it's a kind of intellectual engagement with a whole topic and involve sort of sitting around and discussing with other academic things and reading stuff and that in itself is all research rather than a sort of doing a specific project but yeah I'd be interested to hear some of the people's perspectives on that idea of like yeah should we be training specialists to do all these different things or should we be kind of upskilling academics in all these different areas and how do you kind of resolve that when you're trying to plan reforms Yes Stefan? Yeah just quickly I don't have an answer to the question you just posed I was just thinking with because there's a comment as well with AI and de-skilling and all that and there's this interesting narrative which actually I think is fed by a lot of the replication crisis narrative activism about you know if you look at any termoscientific, termo-fisher whatever all these companies they also increase your reproducibility and blah blah blah by bringing automation and often then there's this sentence like immediately you're worried that the human goes out and all this but then it's always like it's mere manual labor that will be taken over the researcher will still do the real science so it's kind of goes back to the point that Tom just made as well kind of where is the real science being done and what kind of skill or what does it entail but like I'm always curious about this notion of mere manual labor because a lot happens when I just do the pipiting and kind of I don't know it's just kind of there's these narratives of what we can lose and what not what skills are relevant and what skills are just like can be blended out and just it replied to Bart's original question I'm awesome maybe I'm not worried about de-skilling like when I did my PhD in biochemistry we started using more and more kits I didn't think it was getting easier or I lost skills or kind of but right now I'm more maybe worried about out-skilling because again with automation people are saying well we don't need to use normal pipettes anymore we can transfer liquids in different way and kind of it moves into an area where it's different kind of processes maybe being used that we cannot you know it's it goes into a pakeness and all that kind of where can we still tap into the process and kind of establish trust and reliability and all this I'm not sure but that's just one of the worries maybe Yes, Nicole? Yeah I might argue that we could reframe the de-skilling problem and maybe think of it in two different ways and I'm going to be historical case study guy today but one good analogy that we could draw I think the evidence-based medicine movement and there's some really nice work showing there that this tension between sort of like skilling and de-skilling is there as well and is maybe a fundamental tension or tension in reform movements so for example in EBM the reform of the curriculum for med school was all focused on people becoming critical consumers of the literature and figuring out how to use these sort of critical reasoning skills but in terms of the EBM reforms in practice it was a much more technocratic here evidence-based guidelines and you must follow them all and so that may be a skill that's just inherent to reform movements or a tension that's inherent to reform movements it may be also a thing that we could think of as a problem with technocratic approaches which maybe relates to what Berna is talking about that when you have a sort of technocratic prescriptive way of here's how you need to do science then that is maybe de-skilling is maybe a good word for it I think yeah my thoughts I think I have a question in case no one else has one it is kind of an aspect that hasn't been addressed yet so much but you read a little bit about it when you read critical perspectives on the reform movement and especially on meta science that people tend to have a certain background when they are in meta science or when they are in science of science and I think an interesting question would be how much do you think the background of the actual researchers who do meta science or are involved in these reform movements influence the appropriateness of the reforms for types of research or research cultures I'll have a go so one of the things that we hear most in the context of that type of discussion is the over-reliance on quantitative studies when it comes to meta science and if you take meta science as critical evaluations of research practices in the broadest sense if that's the definition then meta science has been around for centuries and most of it has not been quantitative so essentially the quantitative element of it is an innovation post world war 2 innovation for the most part in that sense and sure so if that is the epistemic culture you come from yourself with the moral programs and ideal articulations of science embedded in that program and as a result also in you then that means that you will bring a variety of ideals with you into your meta science project that is in itself actually not that much of a problem as long as alternative articulations also exist but they don't or they do actually but they exist in different spaces so we do have history of science, sociology of science, philosophy of science and we have meta science we speak to different audiences in different voices and these meetings are specifically orchestrated to get them all together and then for the moment we do and then we sort of articulate the plan that we should do this more often and make this sort of structural engagement but it doesn't stick at least not until now not so much I hope it does and I hope it changes maybe as the moment that it changes but probably not and I think that that is something that we need to well consider as one of the biases if we want to use that term anyway one of the biases that meta science essentially introduces in its project to reduce all sorts of other biases thank you what do the others think I certainly agree with Bard on that one it's hard to tell how much of that is our own biases as qualitative researchers towards the value of what qualitative research can bring but I think it is the case that a trap that sometimes meta scientists can fall into is assuming that they understand what the experience of doing this work is like for scientists who are not like them because meta scientists having been born out of a particular scientific field have experienced a spectrum of scientific training there's sometimes a problem wherein they use their own experiences to interpolate out to the rest of the community and what their experiences have been like without actually doing the qualitative research to see if that is indeed the lived experience of other people in the field I think that meta science is getting a lot better about that but I think there's a lot more room for systematically collecting information about what science is like for differently positioned people such that we can have a better understanding of how a particular reformer intervention would fall on people who are living and working in different scientific careers essentially Yeah, I agree with that as well and I think sort of a good example is that a lot of people, well myself included, my background in psychology I got into becoming aware of open research through the whole discourse of replication crisis and I think that a lot of people especially potentially well known people within the movement had similar backgrounds coming from psychology and quantitative replication crisis and a lot of the reforms like pre-registration were perfect for dealing with the issues that we encountered there, right, you know, PHAQ quantitative studies but I've definitely been in discussions where people have kind of almost taken perspective like oh, we need to, you know, spread the gospel of open research to other disciplines, you know, because it's been useful for us to like improve the way that we do science and psychology you know, so let's go and see how pre-registrations can help with like history and then it always kind of strikes me as like, it's almost like you have a solution and you're looking for a problem which doesn't always seem the kind of right way around to do it. Yeah, I think an interesting question maybe also for everyone is a question that was posed for Bart before is can you speak to the relationship between mechanical objectivity and I guess also this process of automation and what he called this post human epistemology with the aim of the very widely asked for fair principles and also with this machine action I think this is also probably related to the issue of that machine learning is getting more and more involved into the actual science processes maybe Bart you can start since the question was first posed to you Yes, yeah so this whole idea of mechanical objectivity of course sort of speaks to the idea that we are the problem and if you get rid of us then at least you solve that problem and maybe not all problems of the world but at least that one and well let me disclose first which is a sort of a positionality statement that I do not subscribe to mechanical objectivity I firmly believe that it is unattainable in the sense that you cannot remove humans or traces of humans from the process so if you remove the humans you are still left with the traces of the humans and whether that is in a racist AI or in some sort of imperfect machine so that means that in many situations it might not be problematic to strive for something resembling mechanical objectivity as long as we all recognize that it is essentially unattainable just like the actual truth is unattainable and you can strive for it the same goes for mechanical objectivity but the fact that we do try means that we also have sort of developed tools and instruments and concepts and things that should get us there and some are and yeah playing that part really well but none of them actually do it because they all essentially rely on human actors to work even AI does so the question is well can you speak more about the relationship well sure I would say that the relationship is fictional but very powerful and we all have to somehow relate to that fiction all the time even if we don't really want to yes Nicole yeah so I thought I would chime in a little on the question of mechanical objectivity since I've been thinking about this a lot as someone who is about to become the embedded ethnographer in a large-scale automation project to create a self-driving lab at Carnegie Mellon and I think that what we could say from the very extensive literature on ethnography of the bench sciences at least and this may not hold true for other areas of science is that automation tends to displace rather than replace tacit knowledge and so over and over again what we see is that when you automate a process rather than the tacit knowledge being the manual skill of how to pipette well then it becomes the tacit knowledge about for example which well plates you can use with the robot so that it doesn't go bonkers or some things like this so it's not that we don't reduce the human intervention or the human knowledge in the system we just sort of substituted out for other kinds of human knowledge and other kinds of errors now one of the things that I think is maybe really worth thinking about in terms of mechanical objectivity and trusted data is where that tacit knowledge is displaced to so for example in emerald cloud labs which is the parent private company of this project that's being implemented at CMU one of the things that I find quite interesting is that initially all of the staff that were actually working within the robotic lab setup carrying around the plates and test wells were basically biology undergrads kind of entral level job for somebody who had some training in biology but interestingly the company found them to be too interventionist trying to fix too many problems that they wanted people to behave more like the robots and ended up hiring former Amazon warehouse workers basically saying like I'll pay you double to you know instead of put product A in box B put like test tube A in slot B and so in this case we have a displacement of the tacit knowledge that's being gained into a workforce that is kind of fundamentally a different one in that they're not exactly part of the same sort of system of scientific norms and socialization and that to me is something interesting to think about in terms of how it's changing scientific work and trust because the movement of this tacit knowledge around through automation means that it's being displaced into places where we don't know as much about what the norms are governing these kinds of work communities and that I think is something really worth studying. I think we also have a question about math proficiency here. I just wanted to ask it.  Yeah it's so there's one comment about I do worry about the level of knowledge of statistics among scientists but also among meta-scientists so you think that the level of mass among biologists is a serious barrier to progress. I have some things to say about this but I don't want to be the talky-talky head so if anyone wants to go first go for it. I can go first here. I do more math oriented theoretical work myself so I don't know like to what extent it's a generalizable problem. It is a problem in some kinds of meta-science for sure. It is a problem when quantitative evidence or quantitative flames are presented to researchers to follow certain statistical procedures for example and when people who are presenting these procedures are not doing it either a good job or maybe dumb it down assuming that the audience will not get it so you leave a lot of nuance and a lot of auto-precision in terms of the claims themselves. So we just like in 2021 we published a paper on that the case for scientific reform in case for formal methodology in scientific reform and that was basically the focus because there's a lot of the I think reform initiatives addressed quantitative research and how data was analyzed you know P-hacking and everything and a lot of that is on point but some of the recommendations were not they were kind of being a little bit over eager to again instigate action some of the edges were kind of rounded to make some conclusions seem a little bit more appealing to the audiences but I think we need rigor in statistics as well and we need to understand it to be able to give people recommendations as to how to use it and that was kind of the point in my priorities of science reform versus what was the prioritized part was about that like some of the things that got prioritized was in the field of scientific practice you know what are our temples like what kind of models are we assuming are these models do we satisfy the assumptions of these models even in a lot of these multi-fights replications but the experimental design is never formalized so you try to figure out what the model is to put it in a mathematical form and it's sometimes impossible to gain that from the details of the experiment so yeah I think there's some some missing sophistication in that regard maybe it's on purpose that you know like assuming that the audience does not have the same sophistication so we need to make things simple maybe it's just lacking I don't know I don't have evidence in either way so I'll say my view on this is there is certainly a role for education and there are certainly people who are misusing statistics right like those things are real and true things about the world at the same time I worry that there's a bit of a deficit model assumption underlying this question that basically the only reason that people use statistics differently than you might use them is because they are lacking the knowledge and if we just fill them up with knowledge then they will behave in the same way that you would want them to behave and I think that that sort of undersells the problem both because we have lots of evidence that that kind of deficit model thing also because it doesn't acknowledge other things that might be contributing to people's usage of statistics so for example this little chat that Bart and Tim and I were having in you know sidebar in the chat here about the extent to which different disciplines think of things in terms of presence absence this is one of those I think underlying assumptions where it's the assumption and not the knowledge of statistics necessarily that's the problem so if you assume basically when you're studying a developmental system that if you have seen it's going to result in a presence absence phenotype it has it or it doesn't that fundamentally changes the way that you analyze the system then if you consider it to be something that's going to be drawn from a distribution that may be an assumption which is better in some cases than others and I think that I think happens a lot and this is something that some you know biologists have wanted to talk about to me almost in a guilty way is that they may have started their career studying phenotypes that really were better understood as binary presence but as they moved on towards studying more and more complex phenomenon it would have been more appropriate for them to switch over to thinking of something as you know drawn from a distribution of phenotypes but they never really made that transition and so in that case maybe the problem is partially knowledge you know they didn't have the statistical skills because they didn't need them initially but it's also partially about unseating that assumption that they have to approach their thinking about the data in a different way because they were using a frame of thinking that was appropriate for one question but now not appropriate for another Yes, Thomas your microphone I was going to ask a completely different question to Nicole but if anyone wants to pop in about that previous one please do so first okay but if not so my question for Nicole is about the platforms right that researchers are using and you talked a lot about how you know they become they homogenize the methods that certain disciplines use I was going to ask if any of your research is also on like how those platforms grow and survive and what the implications of that the sort of platform capitalism sort of area so obviously a lot of them are not capitalist products designed to make money but the bigger they get the more resources, the more people use them the more resources that are needed to sustain them and eventually that there was some chat before where people were sort of talking about ties into burners stuff about incentives to prove that metascience is working does it sort of get to a point where a platform becomes so big and so well used that it kind of needs to keep being used and promoted just to sustain so many people's jobs and is there kind of incentives there that are problematic Interesting questions and I would be interested to hear other people's experiences with kind of platforms that are relevant for their areas of study too but what I will say based on my sort of background studying this model organism approach of the stuff that I'm doing now on automated labs it is absolutely the case that we see instances in which technologies become too big to fail not in my mind as much for the economic reasons although they certainly are there but because of the sort of continuity of data lock in effect problems where essentially that if you switch to a platform which is too different then it becomes really difficult to draw a line between existing bodies of research and new bodies of research so when I was speaking before about some of the people who described themselves as Illumina shops basically one of their motivations for not wanting to change was not just the start-up cost of tacit knowledge but also the fact that they had samples that they'd analyzed over a period of decades that they wanted to be in as much sense as possible consistently analyzed so that they could go back and compare these sort of sequential analyses over time so I think it's not just economic self-interest which might generate these sort of effects where we lock into a particular platform it's also this general desire for intraoperability that I think maybe a lot of what we think about is kind of truth in science is actually really more so intraoperability like can other people work with this result can other people get this result almost like you know can I plug my USB-C thing in when I travel in Europe type thing and those intraoperability things if we think of science problems in that way we start to see them as these problems that are really analogous to a lot of other standard setters in the world and so that's how I would do it maybe if I just because I have to hand up if I'm just on the same point but on a much smaller scale I thought of that when before we came to this why is variation not necessarily factored in but just like absent presence in phenotypes and all that it's literally also not just to make like science work on a larger scale but literally just your own experiment like you need to generate when you work especially now I'm thinking of biology living systems all you do is stabilizing what is not stable you're trying to create some sort of stability that you have from time A where you start your experiment you still have the same thing at time B because otherwise you can't say anything you don't have to continue to you need to make reliable claims even within your own experiment so you're constantly you're constantly trying to create and maintain some I think that's maybe not it's it's real state you are distorting in order to enable certain forms of knowledge generation and that happens even at the smallest level even if there's no commercial interest it's just kind of inherent to what you need to eliminate variation and so on so it's just you can't get past some things but like with the platforms just to come back to that point as well I think and this is Nicole I have you know you will have a lot more direct insight into that but I'm just it's not even I'm not sure where the cloud lab for instance is to write sites no it's one interesting site and one relevant site but then there are a lot of it's maybe the cloud itself not the cloud lab like you know regular laboratories where a lot of work is now fed through the cloud and where certain automated systems are or fed through specific cloud systems that creates new platforms and monopolies that are hard to break and that are obviously integrated with commercial interest as well and kind of you know you see collaborations already with like Gilson pipettes to have a cloud based you know certain automation help but they actually have a deal with quiet and you know the kids so you automatically get those protocols uploaded onto your Gilson pipette pipette man whatever they call it like your apps that you can use and so on so there's like the way diversity of experimental practices is reshaped happens in the very micro space within each laboratory maybe and that's just something to look at as well I think it's interesting thoughts and I think you know I might reframe slightly the idea of it happening within micro spaces because your comments really nicely point out how capitalism capitalism not just platform capitalism as Thomas was pointing to really impacts the way that standards proliferate in that it's not just certainly open science and meta science and advocates who are doing things that encourage homogeneity right obviously corporations instrument manufacturers are also trying to encourage homogeneity where homogeneity is everyone uses their product and so I want to you know be clear that we should put those kinds of courses alongside other things like reforms that are you know probably not even as potent as some of these other forces like okay if you buy our kaijin kit you get a suite of tools that become easy for you to use such that you become a kaijin shop like that's a real phenomenon as well yeah we also have a question in the chat that is related to this it's kind of like the question of whether interoperability will degrade interdisciplinarity into a mapping of meta standards are the participants actually able to speak about a limitation of the platform I would love to hear from Alexander more about what he means on that so that we could add his voice into the discussion I don't know if that's a thing yeah that's a limitation of the platform it's only they can only comment does anyone have any thoughts on this or well maybe I'll kick it off that I would love to hear where people chime in in terms of what they think this means I think that you know if we were to draw an analogy from thinking about the tech world more obvious in the tech world is that nature is not going to enforce a standard for you that there are many potential ways to design a technology and there needs to be some human intervention on deciding what the standard actually is whereas maybe one of the ways that we could think about the reproducibility crisis is an assumption that the combination of the constraints of nature plus the constraints of you know statistical methodology we're supposed to keep us you know sort of bound enough that there wouldn't be so much variation and now what we see is that that's really not the case that both nature and stats are malleable enough that we can get a number of different answers and so it becomes more appropriate than to think about it in this way that it's like all right of the many human standards that we've developed for bringing a phenomenon into being which one do we choose as to whether or not this will turn into a standard or many standards I sincerely hope it won't turn into a standard I mean the point of my talk today was to try and argue against that world I think sometimes it can be hard to defend heterogeneity because heterogeneity feels like messiness it feels like everybody doing their own selfish weird little thing but there are real benefits actually to accidental heterogeneity that isn't to say that we couldn't manage heterogeneity by deliberately including it in projects but that will always be limited to our assumptions about what variables we should be changing and part of the value of unmanaged heterogeneity is that it allows for a bunch of circumstances to kick up variation that we might not otherwise see because we haven't thought to look there so I would really like to argue for some lack of standardization and not just deliberate heterogeneization because I think that the unmanaged heterogeneity plays an important role in science that really ties into sort of many discussions about researcher degrees of freedom which is sort of the designated label in meta science where other reflective disciplines use actually quite different labels such as professional maneuverable spaces or just essentially just judgment and I would say that when you close down every route towards or shut down every researcher degree of freedom you are deleting potentially valuable heterogeneity from the system, from emerging and in that sense limiting yes but removing no I think another interesting question we have that touches on at least three of the presentations we had is in my experience of 12 years the tasks required for open science are much more than 20 to 30 minutes per administrative intervention I estimate it adds days if not weeks to certain projects why do I accept that burden because it raises my own confidence in my findings and my persuasive powers, thoughts? I feel like time is question oh good, good no I just wanted to say I think that a lot of practices do add time and this goes back to a comment I made in the chat earlier I also think that we need to reframe the issue such that we're talking about the distribution of time spent the distribution of labour so for example with registered reports yes it feels like they take heaps more time but I think if you spend time on a really good pre-registration getting it methodologically reviewed then collecting your data and getting your principal acceptance and collecting your data you spend so much less time later on trying to get it accepted at a journal and have all these reviewers saying oh you should add this analysis collect this more data do this other different thing than you did I think you decrease the possibility of more labour later on with some of these practices so I think yes there is sometimes this extra labour feeling but I don't think that has to be the case and I think if we reframe the discussion about where the labour actually takes place and how you distribute that labour of the research life cycle I think there's a good argument for a lot of these things not necessarily taking more time but taking more time upfront Yes Nicole I think you also want to say something No I was just going to encourage Thomas to add in his two senses that seems so relevant to his presentation Oh okay then Thomas would you like to add something? Yeah I mean I definitely think you know as much as I've said we need to think about the costs of the time costs of open research I do prescribe to the benefits of it and having just done a registered report myself actually yeah the process of doing that did create a better outcome than if I had just done it a normal standard sort of piece of research I do think that the costs part of what it comes down to is that when I was saying about the kind of the workload and the expectations of researchers is if we are and this speaks to broader things like incentives is that if we're still assessed on the number of publications rather than the quality of them then anything that takes longer if we've only got a limited amount of time to do research then if it takes longer then we are going to get fewer publications out of that time that we have available so the shift to trying to evaluate research based on quality over quantity is a big thing one thing I'm sort of unsure about though is that whether quantity in the end when you're trying to assess researchers is always going to come out as the ultimate thing that is assessed on because at the moment you might say oh well one really quality and this is particularly like like Bernard was saying kind of use things like pre-registration is like a heuristic for quality because then you're looking at researchers outputs and you say oh well you know they've got two publications which are fully open pre-registered open data open materials and that's like better than the sort of researchers five completely closed non-open outputs but then there's another person who has five pre-registered open top quality papers like they've got more than that other person with two so you kind of I don't know how the quality quantity of quality still ends up trumping quality and I'm kind of unsure how we get out of that kind of rat race really yep thank you I think we have to come to a close already over time I just would like to tell everyone that this event will be put on YouTube so if you want to revisit it or share it with anyone it will be openly available and before we end I also would like to thank everyone for attending and participating I would like to thank the Center of Open Science for providing the platform for this really interesting event and I would also especially like to thank our six presenters who made the event possible in the first place