Nano-architectonics is a novel concept that combines nanotechnology methodology with various research disciplines, especially super molecular chemistry. Self-assembly processes are crucial in many cases involving a wide range of component materials. This review re-examines recent progress in materials nano-architectonics and covers variously structured objects including molecular machines, molecular receptors, molecular pliers, molecular rotors, nanoparticles, nanosheets, nanotubes, nanowires, nanoflakes, nanocubes, nanodisks, naining, block copolymers, hyperbranched polymers, supermolecular polymers, supermolecular gels, liquid crystals, lanyo monolayers, lanyoblogic films, self-assembled monolayers, thin films, layer by layer. Structures, breath figure motif structures, two-dimensional molecular patterns, fullerine crystals, metal organic frameworks, coordination polymers, coordination capsules, porous carbon spheres, mesoporous materials, polynuclear catalysts, DNA origamis, trans-membrane channels, peptid conjugates, and vesicles. The examples presented demonstrate the strikingly wide range of possibilities and future potential of self-assembly processes and their important contribution to materials nano-architectonics. This article was authored by Kotsuhiko Aragah, Michio Nishikawa, Taiso Mori, and others. We are article.tv, links in the description below.


President Biden let us know he has recovered from covid and yes I have completely recovered is once again feeling I question your actions captain I question your choices hi and my tea however reporters suspect he got into his son stash again and is really just feeling the highest the kite hi is a kite everybody roof ball reporters advising the administration it's high time you hide the hemp in a higher hiding place


Hi, you're watching In the Studio here in the DCTV studios at Davis Media Access. My name is Autumn Laberino and I'm hosting this segment. Be sure to tune in weekdays at 10 a.m. to see other segments in addition to this on DCTV. Channel 15 on the Comcast system. You can also catch the replays on menu 99 on AT&T's U-Verse system. And be sure to check out our whole archive online at dctv slash davismedia.org. My pleasure today to have two of our Davis City Council members with us today and we're going to be talking about a proposed renters ordinance. So let me welcome Davis City Council members, Brett Lee and Lucas Frerichs. Welcome. Thank you. Thanks so much for having us. Yeah, so this interview came about, Brett, when you were in here recording your Meet the Candidates statements, we talked about this for quite a while and you were really passionate about it and it kind of got me intrigued that we have some real issues here in Davis. I think it starts with an incredibly low vacancy rate. So what can you tell me about that? Yeah, so the vacancy rates are less than 1%. It's sort of been estimated at anywhere from 0.3% to 0.5%. So in either case, far below 1%. And so the very low vacancy rent creates a dynamic where there's an imbalance, kind of a market imbalance in terms of the normal power of a renter versus the apartment owners in some sense. But there's actually a variety of reasons why I think a renter's ordinance is needed over and above the fact that there's a small vacancy rate. Okay, let's take those in turn. So where the renter's ordinance really came from was from my neighborhood association, the Osteemanner Neighborhood Association. And what was happening was there were certain houses that were known as party houses. So we live in the neighborhood where the pirate house is. So these houses would sort of be handed down from student to student. And so it could be the party house or it could be the volleyball player's house. And the neighbors or most everyone there sort of works. And so on Wednesday night at 1 AM when there's these crazy parties going on, you try it a few times where you'll go and try to be polite. Hey, can you turn the music down? And when it's this sort of ongoing recurring problem, what do you do next? And so the city had some tools to deal with it, but not that many. And really what happened was it just really degraded the quality of life for the neighbors. And so what a couple neighbors did, Vince Sturla and Daniel Boone, is they started looking at other university towns. They looked at Santa Cruz, Santa Barbara, Berkeley, San Luis Obispo. And they looked at what their rental ordinances were doing. And they got some ideas from that and they sort of started working on it. And about that time, well, I was involved with it. And then eventually I was on the council. And so the past couple of years, I've been working on it on the council. And I've been joined with Lucas to help kind of shape it and then get it to the point where we think that it's ready to be voted on. And this is something you're hoping to bring later this spring? Actually in two weeks. And two weeks, so very soon. Yeah, so it's May 17th. Yep, it's on the council agenda. So what are some of the problems experienced? You talked a little bit about the problems experienced by neighbors. But what kind of things might renters experience to you where this ordinance would benefit them? Yeah, there's a real need for sort of the sort of ombudsman's approach, where an ability where folks who have issues with their experiencing in their apartments or their house that they're renting, when they're in some cases have landlords, they're not very responsive. And may in fact in many cases be out of town and not nearby or not very responsive to their needs. So there's an example of a couple of undergraduates that I am aware of that live in South Davis earlier this year when we had quite a bit of rainy weather. They had experienced sort of the buckling of their ceiling in their bathroom. It started to water to start pouring through the management for the apartment they were in was not responsive very much at all. It took them a long while to actually get some results and to get someone in there to actually work on fixing it. And this is actually in addition to the same apartment not having a working front door lock for well over a month as well. So I'm not sure that it's universal problem in Davis certainly. But I think it's definitely more, it happens more often than we're aware of. And I think a lot of students just sort of also put up with some of these issues and they don't necessarily, there's no real resource for them to go to in sort of one organized way to come to the city and say, hey, we're having issues here and how to seek sort of remedy for that. And also some sort of resources to help assist them. So it's very important. I imagine also with such a low vacancy rate that there might be some fear about if I make waves, if I report things, where am I going to live? Yes, so that brings up an important point. So where I think the vacancy rate really creates this issue is, if I know there are, and there are 10 people waiting in line for the apartment that I'm living in, I don't want to make too many waves. So when I complain and something isn't done, there are some regulations that apply statewide and also some county health regulations. But they ultimately assume that there's one path is to move out. Like, well, if the landlord's not cooperative, then you can move out. Or at some level, you can complain if there's something, there are a couple items, you have to have a working toilet, right? So, that's health code, right? It is, absolutely. But the remedy there, so the example I give is, we've got a group of students. There's eight of us living in a three-bedroom, two-bath home. Which is a common scenario. Sure, yeah. And one of the toilets doesn't work anymore. And you let the landlord know, hey, the toilet doesn't work. And they're like, yeah, I'll get there, right? I mean, because sometimes, so this is not to throw all the landlords under the bus. There are some apartment complexes and some single-family residential rentals. They are really on top of things. They run a very good operation. You call and complain or point something out. They're there very quickly within a day or two, making the repairs and everything kind of moves forward. But a lot of times, especially with the single-family rentals, anecdotally, we have people who kind of might own a home in Davis, but they live in Boston. And then they try to rent it remotely, and they're not really professionals. And they try to save a little money on property management. So, okay, one toilet's out. Well, I'll get the plumber out there a week later, it's not working. Okay, and then the second toilet goes out. Well, now we can actually do something. As long as you have a working toilet, they're not really in violation of any sort of state laws. Once the second toilet goes out, there is requirement that you have a working toilet, it's a safety issue, it's a health issue. But the remedy is you let the county know, and the county condemns the property as uninhabitable.  Do you really want to go to the county, complain that your apartment or house is uninhabitable, and then have to go find somewhere to live? It's a major life disruption, potentially. And then there's sort of lower tier things, so imagine your oven doesn't work. I don't know, do people really cook in ovens? I don't know, maybe. But it's out and three weeks later, it's still out, five weeks later, it's still not working, and you're like, well, what should I do? Do you really complain, and then the landlord will then say, well, you're kind of a complainer, so I'm gonna not renew your lease, and then someone else can move in. So there's kind of a variety of things. And then the city's not trying to micromanage the rental relationship, but have some basic reasonable standards and also set the basic expectations for the landlord, for the renter, and also for the neighbor. I mean, that's one of the nice things about this is there's components which address the neighbor's concerns, sort of rights and responsibilities. Landlords, rights and responsibilities, and also the tenants. And there's a nice balance between all three. So how would it work? I mean, those are some of the things it covers, but how would it work? How would it be funded? Who would be the players in it? So there's a couple of components. Maybe I'll just talk a little bit about it, maybe Lucas can fill in some of the details. So part of it is just an information resource. So landlords would register their properties, and they'd be required to. And as part of that, they would pay a fee. For multifamily residences, so apartment complexes, the maximum fee would be what we're proposing is $100 a year for the entire property. So if it's a 75-unit apartment complex or a 200-unit apartment complex, it's still just $100 a year for the entire complex. And not per unit. It's not an important distinction. So it's very modest. And for single-family residential rentals, and actually as an aside, about a third of the single-family residential units, homes, in Davis are rentals. So I mean, it's a very, very large, significant number of homes. But that would be set at $25. And the reason the prices are relatively low is the biggest piece is consolidating a lot of information. So if you're a landlord and your tenant's not behaving as you think they should, or you're concerned about, you know, landlord, what your landlord is doing, you can have this one-stop shop, which would be a website which would have that information, and then also just a little kiosk at City Hall. And there's nothing like this in place right now. That's correct, yeah. It's all very disparate.  And both as neighbors and also as tenants and or landlords. So it's very important to sort of make this one-stop shopping sort of system. So we have everything, sort of that clearinghouse for all of this information to be together in one place, you know, resources for, you know, where to find housing. And for the first place, resources for folks dealing with code enforcement issues, right. I mean, things that might need to be addressed there. So all of that coming together under sort of one city umbrella website will be very helpful in- Dispute resolution as well. Absolutely. The city actually, that's a big part of it, I think. The city years ago had a mediation service set up. Yeah, and it was a city-funded program for a long, long time. Well, during the depths of the Great Recession, the city cut that program. You know, I mean, it was actually a very good program, but the funds were just not there to sort of continue to sustain it. And we had to take a look at, you know, many different types of programs and how to restructure. But out of the cutting of that program, a new nonprofit has actually formed here in Yolo County, the Yolo Conflict Resolution Center. And so this website that will be sort of under the city's umbrella will have direct contact and work with the Yolo Conflict Resolution Center to help connect folks for those types of services, some dispute resolution mediation type services between tenants and landlords or whomever. Yeah, so that would be the second sort of piece. So the first piece is just providing that information. The second is that resource. So before, like right now, if you have a dispute, really it sort of leads to small claims court. That's the only path. Pretty much. And so this would be the sort of intermediate step and more people would be able to take it and the Sacramento Rental Housing Association so they would provide some training for the mediators. So they would be really up on what the tenant landlord law is. So these aren't people just trying to reach an agreement for agreement's sake. They will actually be a good resource and say, hey, this is what the law is.  How come you guys aren't working together on this? And so there's the information piece and that mediation piece is very important. Sometimes it can be between roommates, right? I am on the name on the lease.  Just having a mediator just to sit with and go, oh, okay, well, that seems like we could probably do that. We're down to our last couple of minutes so I do want to ask, what are you hearing out there in terms of support or any concerns about the proposal? So I was going to say, we've had a lot of conversations with folks, I mean, in the community neighborhood groups certainly, but also had major conversations with a lot of the landlords themselves, particularly the big sort of apartment landlords that were the big complexes and things, tandem properties and other folks. And they're cautiously optimistic that we're sort of going in the right direction. They were really concerned. They did not want to see a fee assessed on an individual apartment basis. And they also, and I think this is a very valid concern and something that we've really worked to address is they don't want also the assumption that everybody is sort of guilty from the beginning. This is supposed to be to help solve problems. So when there are issues that arise, we can actually address those as opposed to assuming that everybody is sort of falling into this category with that there are issues that need to be fixed. So there's one other important piece to this. And so apartments are purpose built for rental activity. And this will also include a inspection component for single family residences. So single family residents are, the use is different. It's different when a family lives there versus eight relative strangers all sort of moving in. And so one of the things that we've heard a lot about our illegal garage conversions, which could be, there could be some safety issues there. Yeah, people living in a garage with the gas water heater and a variety of things. And so one of the things that this does include is an inspection component for single family residential. So initially when we talked about it, we met with the people who are in charge of apartment complexes. They were sort of like, well, this inspection piece, look, we're designed to be rentals. We're designed to do what we're doing. Do we really need to do this? And what was nice in those conversations that Lucas and I had with the various interest groups is we were able to kind of really better understand what the current situation is. And the reality is, I think the lion's share of issues in terms of inspection needs are around the single family residential, which are converted from one use to another. And we've actually started to see, in many instances around Davis, situations where you have what was historically a single family residence that was a three or four bedroom house that has been carved inside into 10 bedrooms with 10 to 15 students. I would call them mini dorms. Well, actually the city even has a mini dorm ordinance that limits on the upper end, essentially around a six bedroom home. But what we've actually seen is illegal activity where there's these conversions going on and you've had situations of up to 12 plus bedrooms in the same footprint of essentially a three or four bedroom house. So that's of concern. That's of absolutely serious concern. Even if the codes are being followed inside the house, we can't have that sort of density and you can't have sort of, if it's a four bedroom house, you cannot have 12 bedrooms going on inside. That's just something that we've got to make sure that we're being attuned to both the neighbor's concerns and the community, but also landlords and also tenants and students' concerns. So trying to be balanced. Just very briefly. One of the things also from the neighbor's perspective is we will require that there be a local contact. So there'll be somebody within, let's call it 50 miles away, so that if there is an issue with the property, they'll have somebody they can contact, whether that's the owner or property management company, but somebody, there needs to be somebody responsible nearby. Who's not in Boston, for example. Not just the absentee sort of, yeah. PO Box, somewhere in the Bahamas, right. All right, so again, this is coming to council. Your expectation is on May 17th. And if people want to get more information, I assume cityofdavis.org, and there's a way to contact council members there, if you have questions. You can just kind of click on the links. I want to thank you both for coming in and talking about this. And by the way, we're happy to do this, have this kind of informal discussion on any topics of the day with any council members. So please consider it an open invitation. Oh, thank you. Thanks so much. You've been watching in the studio here at Davis Media Access. We've been talking about a proposed renters ordinance. And my guests have been Davis City Council members, Brett Lee and Lucas Frerichs. I want to thank them for joining us. See you next time.


It's no time for you to talk about it. It's good for you. Just use your screen. Good. So hello everyone, can you hear me from the back? Backside? Hello guys. So my name is Alan and I'm going to present to you today API proxy pattern and how it makes your software API calls more reusable and mackable during testing. So how many of you guys are working on client-side applications? So how many are backend developers? Okay, that's nice. Basically, API proxy pattern is not just reusable or dedicated into Bue.js. It's also applicable if you're doing Java, if you're doing Node.js in the backend, you can still use this pattern because it's a generic design pattern but in this case, I will try to showcase how to do it in JavaScript and how it makes your code more reusable, more mackable, and more lighter in terms of bundle size. So, yeah. Let's start. So if you guys want to check out the demo application that I will share, it's available in this bit.ly link. This is the next one. So it's a slide deck link if you want to reference later. Okay, and let's start. Yeah, so the agenda of this discussion is what is this proxy design pattern, what is the problem that it solves and how to implement and improve because I will show you like the very basic usage of proxy and then I will resume with a much better form of it which is usually used for larger scale applications. And then I will showcase as well a basic good and bad testing with regards to API calls. And then we will check out as well how to introduce a proxy pattern natively in ES6. So, yeah. What is basically a proxy pattern? So how many of you are using NginX? So basically there's another concept related to NginX wherein a proxy, a reverse proxy is helping you to identify which background service are you going to hit if you try to hit a load balancer. So in code it's a little bit different because a proxy pattern enables you to centralize and encapsulate the access to a certain object so that your consumers meaning let's say you have modules in UJS so you can abstract away the mechanism that you use to retrieve data in an API. Let's say, how many of you guys coded back in 2010 like when Jake varied at Ajax rocks the world? Yeah, so if you have got, I used to work for an application that is written in 2010 that is still maintained until now. So since we use proxies back then we were able to migrate from jQuery to Angular to Vue and it's really reusable and it's quite cool. So, yeah. The basic concept surrounding it is that it's just a wrapper inside a JavaScript module so that you can reuse it between multiple components. So the common problem that you'll so this is how it looks like in drawing. I said too much but it's just something as simple as this. So the proxy stands in the middle and centralizes the access to your API. So how many of you guys had worked on a large project wherein the API calls are distributed everywhere and nobody wants to maintain them because five identical calls with several different parameter sets pass to it. This is become chaotic when you distribute your API calls. So a sample of it is something that I am bringing here. So this is the perfect example of repeat yourself. So if you see the mounted section of consumer A, I was retrieving data from localhosts, 3,000 users endpoint. So in consumer B, since another developer is working on another module, it copies it and then the party is starting. So this sample is quite simple but then when your backend developer gets started to get smarter, you'll tweak the parameter set and everything breaks down. So if the guy in charge of module B is on vacation leave, he will not update it until he's back from wherever he is. So let's go back to the slides. So if you have a proxy, this is how it basically looks like. So I know it's quite blurred here so let's just go to the code. So I am in the GitHub project that I shared earlier. So the first sample of consumer A and B were from ugly consumer project. Right now let's see how a proxy works or how it looks like. So this is a proxy sample of the version one of the application. So, yeah, we have three consumers trying to consume a centralized proxy. So if you notice what I was doing here, I now have a user's proxy and then absolutely the API call inside. So what capability does it bring to me? So first one, I'm decoupling my business layer, meaning my functional modules and the mechanism that I use to call my API, meaning your consumer modules can change without, let's say you want to migrate your application from view to react or to whatever framework is upcoming next. Since you have encapsulated the API calls inside, if you migrate your project, you can still reuse that thing. I mean the API layer, the proxy layer. So if you hard coded your Axios call inside will just be gone after migration. And it's another cost for the business. So, yeah, right now I'm using user's proxies here and it looks like this at code. So, yeah. So it's basically the counterpart to a repository pattern for those that are working on the back end. So you write a repository to access a single entity, right? So this is cool, this is nice, but it gets nasty when you're working with big projects. So what I meant by nasty is something that looks like this. You know, I had two operations here, no? First one is load all users, then the second one is get by ID. So this is okay because it's a small proxy. But then if your proxy becomes bigger, something like a God Objectlet, we all have that one entity in the application that is so complex that you need at least 20 operations to manage it. So it will start to look like this. Yeah, so your proxy can still grow to this one. So this approach can still be improved by taking a lesson from the CQRS pattern. But before we go to that I would like to share something that I see in production every day that I really hate. That's why I introduced the proxy pattern in my workplace. So this is an API call that I'm in a legacy project that we're working on. And it's literally 1300 lines. So when you try to import this thing inside your tiny module in your application it's like literally pulling a horse out of the web server because it's too big. So when you try to reshape this thing it's not going to work because a lot of internal private methods inside are coupled and married to each other already that tweaking something will break something somewhere. Because it's a centralized API call. So this is the first advantage that proxies are trying to solve. So yeah, so let's say that I have a proxy per entity let's say users. Like I have two operations to it. How can I make it even better? So you can even make that better by trying single responsibility principle approach. So when you say single responsibility you forget about your entities and start working with entity-dedicated operations. So in CQRS if you're working on big large scale applications your APIs will usually be split to a lot of small pieces. Like the rights are segregated from reads. So if you use proxy in this pattern you will be able to scale into large scale application as well. So instead of having a single users proxy I created an operation-based proxy sounds like in the golden room naming a class is that name it as a noun right? But my class right now is named as a verb starts with a verb. It looks like an action which it literally is because it's an operation that gets me the user by ID. So you get what I mean. So from like a single huge proxy I now split it into smaller pieces that look like this. So yeah. So what are the advantages of splitting to small? So if you're a web developer that will resume the work of your colleague if the file is this small I can read and understand without having so much pain in my head. Like if you have like 29 lines of code that you need to analyze it's quite easy to pick up what is it trying to do where is it getting to call? What are the parameters that I expect? And then if you want to make a change to it you're not nervous that it breaks something on the other side of the application because they share some private wiring so private methods that break something when you tweak it for one consumer. So yeah. So right now I use smaller proxies and then I also mention earlier that it makes your testing more easy. So how many of you guys are performing unit testing that performs actual API calls? Like okay so this is going to be useful at times but it's not something that is recommended because when you do unit testing you would really love to make sure that you don't rely on the internet to test the functionality of your units meaning your functions. You want to test the behavior and not the network itself. So and when you call an API let's say zero. Do you test zero in a unit test? No you don't. You want to have a behavior that you can predepine and when you use a proxy you can easily substitute it. So let's go back to the slides. Yeah so API proxies are perfect for API calls. So this is a sample of bad consumption of APIs and how it generally looks like in drawing. So yeah and this is how you use proxy in like in a better modular fashion. And then you will have your unit testing you know when you have a proxy and your consumers consuming it and it's the only operation for the API that is consumed. You can easily write a MAC object meaning a predepine behavior that is dedicated for your testing that can easily substitute your proxy meaning your consumers are now becoming more testable. So I have to prepare a sample test here that we can test so I mean I can share and just to prove to you this really works well in production I am bringing a source code here that will show you how many proxies do we have like you will see a lot of API calls in here. So yeah these are all our proxies. And proxies like I mentioned earlier don't just exist in the client side. You can write proxies if you want to let's say abstract consumption of zero API in your background API let's say you're consuming zero in the background. You can write proxy in your Node.js background application, backend application and consume zero. So meaning if you want to use a change your invoicing provider, your vendor you can easily change it without breaking your controllers. So let's go to testing So yeah so I've written two tests here so we're going to test user counter module so basically just counts the number of users in my system and it depends on load all proxy. So inside I have encapsulated access but if we want to perform an automated unit test to it I'm not supposed to call this one and I need to substitute it. So a bad test would usually look like this. So the test is actually consuming the counters without a substitute for the API call meaning if I perform the test I'm actually calling it. So why is it bad? So let's say that our counter is expecting poor when it was written let's say more users were introduced after the first initial test your test is going to break because your data is changing so it's bad to test data that is hooked to your database or your APIs. So a good test would usually look like this. It involves marking a proxy layer. So since I had written a proxy inside the user inside the user counter function I can alter the proxy function that it uses using third party library called MACRequire. So I'm using MACRequire to simulate and change the behavior of load all proxy by pre-depining a set of users that I want to count. So with the help of this I can make sure that I'm not calling any third party API so if you're working with payments, if you're working with invoicing, if you're working with authorization I had funny instance where I work on testing but I'm noob so I tried to test the authentication server and I got a block for some time because I hit the rate limit because I have 900 test cases and I tried to challenge the API module and it went really bad for me. So if you have your MAC you can now avoid performing actual API course. If you live in the Philippines connection is horrible. So we suffer from it and we need to really MAC to make sure that we can test the functions that we're trying to automate. So yeah that's all for me and I hope I had share something. So do you have question guys?


Thank you all for coming. We decided to slide the schedule a little bit just because of all the security measures downstairs. We hadn't expected to have a UN summit happening next door to our little event. So thank you all for coming. We hope that you're going to have a very interesting afternoon discussions now on this topic of the Cyber Resilience Act and also the digital policy in general that affects the free and open source software business ecosystem of Spain and of Europe and even the world. We have organised this jointly with the partners that you see before you. Myself, I'm from Open Forum Europe, we're a think tank based in Brussels and we try and work on the Brussels level EU legislation. So I will give a presentation on Cyber Resilience Act but we're organising this together with Red Hat to do group Learning Foundation Europe and Biturgia who all have their own angles of interest and you will get all these different points of view during the afternoon. I hope you're looking forward to as much as I am. Other than that I will mostly get straight into the content for the day and for that I will ask for my very basic slides to begin displaying on the screen. So the first half of the day is going to be about the Cyber Resilience Act or the first half of the afternoon. This has been a topic that has gotten a lot of attention over the last 12 months and it really got off to a little bit of a rocky start because we are used to having to deal with legislation but a lot of the time it's copyrights or it's patents and if we can go to different organisations we can say who's your copyright specialist but this is the first time I think that we've really had market regulation and so in that sense it was difficult to find all the right people but a very large coalition did form to work on this and so we work on this in particular from the angle of free and open source software. Now the Cyber Resilience Act is not about just free and open source software but we hope that there are other people in the software industry working on other parts and we focus mostly on the parts that are specific to our sector. So the general idea of the Cyber Resilience Act is that product safety should be that exists already for physical products should be expanded to include software and so this means that products have to be safe for the things they're going to be used for but also for things that you don't didn't expect people to use them for but you could imagine they're going to do. So for physical products this is a toy car for a child has to be safe for them to play with but they're going to put it in their mouth as well and even if you didn't intend them to put it in their mouth this is what it has to be safe for. So the way the Cyber Resilience Act is written it would work kind of fairly well for physical products and there's a lot of similarities between physical products and proprietary, non-free, closed source software. So normally you have a company and inside the company of all these different sub departments and units where they make different parts of the product and they pass the different parts around amongst themselves and then at some point they they put this product on the market and they get some income for doing this and so the Cyber Resilience Act comes in here to create obligations at the moment when the product is put on the market and so it's relatively simple for physical products and for proprietary software. Our software isn't developed within one company now we tend to have these entities that are out in the in the wild and the wild in legislative terms is called the EU market so everything that we do is happening on the market and we generally don't have a small number of contributors or we we aim to have a very large number of contributors and some of them are big and some of them are small. The issue for us then is what happens if we get new legislation which adds costs and obligations each time the software gets moved around among these different entities. So that's the the distribution aspect that's the complexity that we that makes our software different from proprietary software. There are other ways which I won't go into detail but on the supply side so that was the development side of the of the product on the supply side we we tend to have very frequent releases we don't wait until a certain number of features are ready and then do a big release we release early release often and this means that you're going to have more compliance procedures and we also have the same software being commercialized by a large number of companies and we encourage more and more companies to get involved commercializing software packages but of course this means that the more companies are doing commercial distribution the more compliance procedures are going to be carried out for the same piece of software. So one nice thing that is in the Cyber Resilience Act is that there is a paragraph at the start which explains that software is exempt is is not subject to the Cyber Resilience Act if it is free and open source software and if it is non-commercial. Now there are various different texts circulating and so different texts have different details I can't put all the different texts on one slide but that's the the initial plan was that free and open source software if it's non-commercial it's it's not out. The first issue we found then is how do you know if you're non-commercial and many people would assume that well if you're not selling the software but that's not what the word commercial means in EU legislation in EU legislation if you're making regular releases then you are like a commercial entity and then therefore you are commercial or if you're if your quality is very high then you are like a commercial entity and then you are commercial. So we have this flow chart for deciding if you are inside or outside the Cyber Resilience Act. This is maybe a third of the actual criteria that have to be looked at but this is the sort of thing that people would then have to go through when they're trying to decide whether this legislation applies to them or not. So until now the way we've always built our software was that we focused on having the lowest barriers to entry possible. We wanted everyone to be able to contribute their skills. If they're only good at being a user interface designer they can contribute that. If they're good at encryption they can contribute that. Nobody has to take responsibility for the whole thing and that's why our license as always says this comes with no warranty. It's to protect the developers to let them know they can contribute without creating an idea that they are a company that is responsible for this whole thing. People found it easier and cheaper than to contribute to the main project to contribute upstream because if they want to make changes to the software, if they don't contribute back to the original project then they have to maintain their modified versions, basically a fork. They have to maintain that separately and so our software grows in quality as we get more and more contributors because everyone finds it easier to contribute their software to the unified upstream project. So if we have then a cyber resilience act which creates obligations for people who distribute software or move software around then this is going to be the decision will be difficult for a company who's making a lot of money from a piece of software but a lot of our contributors are casual contributors. People who use the software in a company and they fix a bug, they add a feature and they send the software upstream and for them if they have to think about if they have to go to their boss and say can I get clearance to send this patch and then the boss says okay we'll check with the legal department, a lot of them will simply not be contributing anymore. We also have a lot of SMEs and at the start they're not profitable, that's the way SMEs start a lot of the time and they start off small, there wouldn't be a collaborative project, there would just be a few people. We have a lot of people in risk adverse sectors and in particular the public administrations. We've spent 20 years trying to get public administrations to join in in the development of free and open source software and in the last 10 years they've actually started and it would be a real shame if they then slowed down again simply because every time they're thinking about distributing software they have to think about do I have am I creating obligations for my government department and then there's also a lot of individuals and consultants who simply don't have legal staff to give them opinions and they would be nervous about contributing. So that's from the contributors side then the other issue is that from the project side whenever somebody does decide that they're going to contribute code upstream the projects will have to think well do I want to accept that code because once I accept that code I'm going to have to take responsibility for it and this is a problem if we want to grow our community by having more and more people contributing but this then creates more and more questions for the the maintainers of the project. So just to summarize some of the previous slides just for brainstorming for the discussion that will happen later we have to think about SMEs and anyone with a lean business model we have to think about how team building might become difficult we have to think about that people may stop distributing software and we may move more and more towards software as a service which means that in Europe we have even less control over our computing and we're often financing industries in other parts of the world instead of financing our own industries and finally if we make it difficult for development to happen in the EU it's possible that a lot of companies will continue their development in other parts of the world and they'll still send the the released versions to the EU and there would be cyber resilience act compliance but the we will lose expertise and we will no longer have as many developers in the EU which would be useful for doing security audits and addressing security issues. So right now the situation is that we've been looking at this for more or less 12 months we're in the trilog which is the the final stage now possibly the final two weeks the the text has been improved in quite a number of ways there's clarification now that people simply hosting code platforms and code hosts will be exempt there's a new idea that foundations would be referred to as stewards and they would no longer face the possibility of fines and I maybe I should mention that the minimum category of fines in the CRA is an up to five million euro category there is a an idea of a risk assessment which could allow some flexibility in deciding whether or not the the CRA's obligations apply but there's very little details on this so this is something we still have to work on in the coming days. The idea here is that the the CRA says that you cannot distribute software if it contains exploitable security vulnerabilities and of course there are many pieces of software that contain exploitable security vulnerabilities and we would like to continue to be able to distribute those pieces of software in the EU so the idea of a risk assessment could allow for that and the implementation which was originally planned to happen 24 months after the law was finalised it's now looking more likely to be 36 or or even 48. So there is quite a good bit of progress being made but there are still definitions and there are still parts of the text that rely on this concept of whether or not your software is commercial or whether you are commercial and these are often very unclear for software and for online services and then to be a foundation who would be a steward you have to make sure that your the money you're receiving is only covering costs and of course for a foundation they would generally aim to have a surplus at the end of the year and they would generally aim to be to be growing year by year to be able to take on more staff and including for dealing with things like cyber resilience act and so there are a lot of definitions like this that we're still working on even at the in these final days so that's what's happening right now in the in the legislative process we're trying to get these definitions done there's a very limited time because of the European elections in next June most piece of legislation are being finalised hopefully by the end of this year so that then people can focus on reelection campaigns and there's no clash between that the elections and legislation but once the cyber resilience act gets finalised we then have 44 obligations in the cyber resilience act and each one will be subject to a standards procedure so there's going to be a standard setting body which will give a definition or some clarity on what these obligations mean individually unfortunately free and open source software is not very well represented in these standards setting bodies and SMEs and innovators in general are also fairly weakly represented so we'll have to work on the standards and hope that we can improve our efficiency there businesses will have to adapt procedures and to comply with the CRA some businesses will find it easier to continue their business somewhere else so we will have to take into account that there will be some businesses who will no longer be contributing and then as a community we'll have to organise to try to develop ways to comply with the cyber resilience act in a collaborative way if we can centralise how this work is done and by doing that hopefully we can minimise the number of companies that do decide to leave the European Union for a less regulatory regime elsewhere. So we're glad to see there is a paragraph about free and open source software in the text on the other hand according to different studies and numbers 75% to 95% of software today is free and open source software so this is going to be the subject of a lot more market regulation in the coming years and we're going to have to think about the idea that regulation and procedures is a way that you can improve cybersecurity but our software with access to source code and the permission for anyone to audit it and to improve the security is also a way that we include increase the cybersecurity in the EU and so at the moment the CRA is focusing on regulation and procedures and we have to try and find a way to make regulation and procedures work hand in hand with making the use of the unique opportunities that our software provides and so we probably should expect regulation in the future that will focus hopefully on part two of those two criteria. I had a sentence at the end by moving up the topic just to make sure nobody is going to miss it at the very bottom. What we really need is as many commercial companies as possible taking an interest in free and open source software because this is how we improve our security the more contributors we have the more review and the higher the quality of the software so we have to think about how to preserve the number of contributors we have and encourage more companies to get involved. So to summarise what will be discussed on the panel the problems created are that one is developers will be nervous about putting software online projects may be nervous about accepting contributions projects may have less interest in starting a business and this would be really unfortunate because starting a business is one of the best ways to increase the quality of your software and then projects might also be unwilling to accept financing which would again be a pity if we had a way to finance the development of our software and we had to people felt the obligation to refuse because they don't want to lose the non-commercial categories that they're in. So we're we're still working on terminology and there is a text circulating which creates a lighter regime for the foundations which I mentioned as would then be called stewards it does this by defining these entities working on projects that are fully decentralized or collaborative and so we have to think about what these words mean because that's it's not defined too clearly in the text the text mentions the idea of having a single company exercising control and we also have to think well what does this mean and you know for us having a release manager is a sign of the quality of project but would this then cause a project to not be collaborative if there is a company employees the release manager so I hope all that looks solvable there are a few more issues that I didn't mention there are stricter categories for critical products which include things like web browsers and they may have to register with national authorities when you're developing these projects there are issues for component third-party components and due diligence there's discussion of an exemption for the public sector which could be good or could be bad or may may not work but I'll let somebody else delve into that support term the the cyber resilience act requires that you provide security updates for for five years and so this this number is up for discussion and that may change and then the last topic is responsible reporting of vulnerabilities this has gotten a lot of interest from national governments to the so much so that they want to work mostly on it themselves now but this is also something that we could improve by coming up with with proposals for how we plan to do responsible reporting of vulnerabilities in a coordinated way with that I hope I haven't started off on too negative a note the purpose of the presentation was to set the stage for other people who will hopefully have some solutions and some proposals and with that I will hand over and thank you all for your attention I welcome to the stage have you thank you


You already mentioned earlier the role of companies that I think merits a lot more scrutiny, both of the companies based in the U.S. or Europe, for example, that don't appear to have due diligence strategies in place to even assess whether they might be contributing to or otherwise enabling human rights violations. Do all of the manufacturers out there know who's making their products in Xinjiang? Do they know who their partners are, whether those are government or security apparatus partners? Those are important questions. Similarly, we've written a lot about some of the big Chinese tech companies and their involvement in repression in Xinjiang. They're investing all over the world. And I think, again, there's a real discussion to be had amongst governments and publics about whether it is appropriate to let companies who are responsible for serious human rights violations or who are implicated in serious human rights violations inside China provide data and other kinds of service technology beyond China's borders. Those are not the companies that I want handling my data.


This is truly the most impressive aspect of Islam to me personally. When I talk to people, people ask me, what's new about Islam? If I compare it to the Bible, for example, the Bible is so much bigger than the Quran. Is there really something new in Islam? I, of course, understand that position because I came from the same ignorance. However, when you once realize what the Tawheed truly is, you, of course, understand the value of that message. No, it's nothing new. Of course, it was there from day one. This is the message of Islam to return to the worship of one God and to get away from all the innovation, to get away from all the inventions and all the other worship that is redirecting your attention towards something else and not towards God.