Good morning ladies and gentlemen. First of all, thank you for the invitation to this session. And we are going to complete a different environment comparing Netherlands. And I would like to go through the chick case. At first, those who know me, I'm always complaining about the chip legislation, so I start again with this topic. So the research priorities, I know that the chip legislation mentions maybe in a few sentences. The old State Landmark Conservation Act was created in the late 80s and still it's working or not working well. And there were about nine, at this moment nine attempts to change it to bring to introduce some other law. So still, the most of the very rich care is organized by all communities law in a market economy more than nearly 30 years in the market economy environment. So it looks quite strange. The second law I want to mention is right now on the special plan in the building regulation where the most important part of the Valetok provisions are incorporated. Especially for the special planning, there is a written that there must be some, that all the projects, all the special plans must avoid over the destruction of archaeological monuments, archaeological heritage. But in reality, it's a kind of a mantra in each project. This project won't violate any way archaeological remains, even the highway or the road goes across protected parts. So it's not used appropriately. So in reality, no national research framework exists now. So, and I could finish my presentation at this moment. Or the other option is to show you how the chief coaches are dealing with this situation. Not only a requirement to have a research designs for scientific excavation. So it's about 20 excavations a year. On the other hand, there is about this moment about 15,000 of monetary construction or about 1,000 of the real excavation in the country. So it's just a piece of sand on the desert. What is protected in the Czech Republic? I start at the lowest point of the pyramid. The Czech law talks about this. There is the act on heritage protection. Talks about the era with the potential of archaeological finds. It's one of good points in this law. And it's nearly the whole Czech Republic, excluding the large coal mines already excavated in the US and so on. So nearly everyone is obligated in kind of construction to send that announcement to the Institute of Archaeology and we'll receive in the institute about 50,000 of this announcement a year now. So it's very good net that's covering about 17% of all construction in the country. That's the positive moment. But this era with potential archaeological finds and also the archaeological sites doesn't have any other special protection. So that means that in case of any development or research, the only question is how long, how much? How long does it take the research and how much the developer will pay? Only a special group of the cultural monuments. We can, I can say that we have three levels, the UNESCO sites, national cultural monuments and the cultural monuments. But this structure is also, it was built in the 60s and the 70s of the last century, most of them. And you can see that it's very unbalanced, distributed these cultural monuments. I can't say that it's part of the Czech Republic, the region called Moravia or Silesia is without archaeological finds. But the more active colonies were in Bohemia. So that's why we have, we have 12, 1200 protected sites. At this moment, it's very complicated to add any site to the list and usually it's about two, three sites a year. So to improve the situation, it would take a very long time. Who is responsible? Who's responsible in the decision making? At the top is of course the minister of culture and the decisions concerning the protected places are made by the regional administration. Yes, you've been talking about Spanish case or German case, where it's for each part, different legislation. We have one legislation for the whole country, but in 14 regions, we have 14 different practices. Maybe you know it from other countries as well. National Heritage Institute, it's an organization founded by the minister of culture, takes care only of the protected monuments. So they gave advice, it's working like an advisory board for the decision of the regional administration. But the decision making is on the regional level and you can appeal to the minister of culture when someone does not agree. The Institute of Archaeology and the Academy of Sciences has a really different position. It should control the quality, the scientific quality of the research. And so we are also a place where all the excavation reports are carved. Actually, the control of scientific quality we can do from the excavation report. So it's very hard to control what's happening during the excavations. So we see how it went in the terrain three years after the end of the excavation. So it's a little bit of a problem for the conductor to say that the person dies after the funeral. And who has the biggest responsibility and also the power? Our licensed organizations because the most, because the licensed organizations has to have ability to agreement with the developer. And what will happen in the terrain is based on this voluntary agreement. So the use of the methods, so the applied methods for the research, the costs, the time, it's not a matter of the state decision. That's a little bit strange. And it comes from the community's plot. It looks very liberal way. And it's necessary to say the licensed organization has to employ at least one person with MA degree and practice experience in acrology at least two years. So that's the qualification of these organizations. They get the license for one moment and then some of them they have to renew in two or three, five years. Some of them they have no limits of their license. That's also very different. And we have 110 these organizations. These organizations are mostly organized by the regional government. It's about 60, 70%. There are some state organizations, the universities, institutes of the academic sciences. And we have also about 15% private organizations that they do it for profiles. What means this situation? The state doesn't require any research frameworks, any system of decision making, but also for the acotica community is a very complicated to live in this system. So many tools were developed by the community and they are accepted by, it's not obligatory to accept these requirements. So in the 2010, I thought this was in the presentation, the rules of acotica excavation was produced by the acotica institute and other organization. It's something like the ethical, it's no more ethical dex. What to do, not to leave half of the skeletons in the trench and things like this. So it's very simple, the human having about 12 pages. So it's very short. And sometimes the developers requires to keep this rules of acotica research and it's part of the agreement, the birth agreement that happens. Also the developers wants to find any organization, any system in rescue excavation. And in regional practice, there's example of crack, then I have some general example of the whole country. The national, sorry, the make up, the national heritage institute produced a map of important acotica programs in crack preservation. They produce a map and in the map they mark places where acotica currents are still not damaged and they have very high potential. But they are belonging, if you remember the pyramid, the lowest level. It's only place with acotica fans, nothing else. But this is accessible for the developers and it says if you want to build in this place on the crack garage, that could be a problem. It will cost a lot of money. You will need some, it will be very complicated in time. So that's the only way or only one way how to inform the developers and so to say that try to find any other plot. One minute, okay, sorry. Another one is the central acotica map of the Czech Republic. It's a central evidence of acotica excavations and also it's used only on voluntary base. And I would like to show just two examples. One example is a highway. To the most densely-settled region in Czech Republic, one of the largest excavations. But at the beginning there were no plans, no decisions what, which way the highway should go. The company, the state company came to the acotica at the moment when they wanted to make it tender. So also the analysis of the potential was prepared for the protocols and the geophysics was done just one month before the start of the excavation. Just to know where to move the top stop soil. Other example was a decision of the developer Jewish Cemetery and was discovered on an unexpected place and the developer decided to preserve the cemetery in very strange way. It's a box inside of Antitron garage in the second floor. So it's big box of a concrete. But this decision was made only because of pressure of the Jewish community of course, pressure of the National Heritage Institute and so the developer now asked the state for recompensation. So the process is started three years ago, it's not finished yet. To the conclusions, I think these conclusions are nothing, I think positive to learn but I just mentioned because the start is short, just one. The different preface in regions actually abuse undermines reputation of archaeology in public that I wanted to mention. What does it mean when the framework or the rules are nearly unknown and always I created ad hoc for the special particle project, particle construction. So this is in my opinion a very important point that has to be included in the discussion. Thank you.


2012. Look how far we have reached. I mean they say the world will end on 21st December this year. Let me ask you, what's basically wrong in having an end? What have we achieved so much that we should preserve these distal money banks or these metallic buildings? What do we really talk of at the cost of a sobbing planet or at the cost of those species time? So let me tell you, even if you save this world, let me show you what it will be like in 2060. In a shocking incident, people claim to have met a real man who saw 40 years ago some real trees. Museums showcasing fossil fuels open to public today. Oxi-1, just as you have cops these years, Oxi-1, a meeting of ministers of oxygen affairs conclude with the opinion that a Joseph Priestley could only help with this problem. Well, sounds funny, right? What if it really happens? You know what? Not everything is fine in this world that we are living in. Not everything is fine. This is the world that we talk of. The country that houses just 4% of the population pollutes 35%. Tell me what sort of justice is this? We received a clean and a healthy planet from our ancestors and we are gifting a damaged one to our successors. Well, what solutions do we have? What solutions do you have? And now I introduce you with the concept of climate justice and climate equality. Climate justice, basically, is a very wide concept. It's more about how we do things on a decision-making level. It can be summed up in three simple words. Equal emission rights. On other hand, climate equality is more about a community-based participation. Tell me something. We all claim our parental properties. We go to courts just to get the movable and immovable assets of our forefathers and fathers. Then don't we have the right to enjoy the same environment and the same climatic condition that prevailed during their times? This is what climate equality is all about. You know what? I don't like believing in climate change because I don't like to believe the worst. And it so happened that in 2050, I'll be 54. And I wonder what planet I would be seeing then. I wonder if I will be giving oxygen masks to the next generation. I wonder if my children would be able to play around the lake that I had played around. And more than that, I wonder if it ever will be a good afternoon to them. Ladies and gentlemen, this is the time for especially youth and children, the 3 billion of this world population, to show that we are concerned about this planet of 7 billion. We are concerned if a child cries in the remote villages of Africa, we are concerned if a species is denied existence. We need to connect the dots. Things cannot stay the way they are and they simply have to be changed. And in this effort, we have a campaign named Plan for the Planet, which was basically started by United Nations. I'm very glad to inform you that United Nations has handed over this to us children and youth in the last corp in Johannesburg. Plan for the Planet, as you know, is a worldwide spread campaign that aims to plant trees mainly by contribution of youth and children. In this map, you can see the relative contribution of the nations in this campaign. I'm very glad to tell you that India has been one of the top contributors for this. 2008 until now, it was launched. We have 100 academies across 137 countries in four continents. And now, we hope to involve until 2020, 1 million kids and youth across 200 countries. I'm very glad to inform you that we have already planted more than 2 billion trees all across the globe. And this is some of the efforts that we are making in India. For example, this, as you see, is a solar water heater, which is located at the headquarters in Patna. This has been particularly made by the students itself. This is how that particular headquarters work only on the solar electricity. And this one, as you can see, is a biogas collector's where the students all across the world come and learn more about waste management. And not only this, we have been also speaking all across India, taking out rallies, speaking across to the bureaucrats to make the change. And not just this, we have been also indulged in worldwide restoration of ecosystem at various places and raising issues at all international and national podiums. And also, I had a chance to interact with world leaders. And what I got to know from one of very top officials of United Nations, as he said to me, as you grow up, you find more ways why things cannot be done. This is the ideology we need to reverse. As we grow up, we need to find ways things can be done. I just leave you here with two simple questions. If national security, peace and economic growth are your priorities, then why not climate change? And are environmental problems really linked to any age groups or geographical boundaries? Well, my answer is certainly no. And last but not the least, we have made this three-point plan program, which was mailed to 200 world governments all across the globe, which asks that we children in youth call for putting carbon into the museums, putting poverty into the museums and planting one trillion trees across the globe. That's like 153 per person. Just do it. Be a leader. If anyone who has solution to the problem is you, it's not it. If the change has to become, it has to begin from you. Maybe Pythagoras would have been very helpless in this situation of this particular triangle, but I hope you all are not. If not here, then where? If not now, then when? If not us, then who? Definitely us. Thank you so much.


Krowing County and Bridges of Hope have partnered together to try and bring great change to the Brainerd Lakes area. Our reporter Anthony Scott has the story. Krowing County is facing their health and social issues within their neighborhoods head on by building a self-healing community. Krowing County has been trying for a really long time to solve a lot of social issues related to child protection, substance abuse, mental health and we know that we can't do it all on our own. So the county reached out to Bridges of Hope and together they came up with a self-healing community model. This model really started in the state of Washington in several counties in Washington in the 1990s and based on that the the communities there started to see some amazing outcomes for health. The model forces conversations to happen between people to really find out what is going on in the communities. This model actually gets into the community to ask the community what it is that they need as opposed to us coming in telling them what they need. I'm spending a lot of time having conversations with people who are working in the community and people who live in the community. The project will start in the communities of northeast Brainerd near Garfield and Lowell Elementary but the plan is to eventually expand to all of Krowing County. Once we're accomplishing some outcomes in that area we're going to move to Crosby because that was another area identified as having that high concentration of those types of issues. The county used a geographic information system also known as GIS mapping to decide what neighborhoods to implement the self-healing community. Now it's time to find the issues and come up with solutions. What can we do practically that's going to really help people and help them sooner than later. The self-healing community model will try to build stronger relationships within Krowing County and as a result we'll see great outcomes but the change will not happen overnight. But the really important stuff the outcomes or the actual impacts on the community a reduction in child protection, a reduction on suicide rates, an increase in school attendance those are going to take a while. We're thinking at least five years if not ten. The project is still at the beginning stages of talking to community members and finding out what issues people are really dealing with. But Krowing County hopes to see vast improvements within the community in the next several years. Reporting from Brainerd, Anthony Scott, Lakeland News. To learn more information on the self-healing community check you can check out this story on our website at lptv.org slash news. If you enjoyed this segment of Lakeland News please consider making a tax-deductible contribution to Lakeland PBS.


So let's have a look at four loops. Now these loops are phenomenal and they almost read like English sentences quite easy to follow along So they are constructed like this. Let's have a look. We have four and end You've got to tell this little loop way to end things and it's going to run around and around This is our little raft running around and around in the river We create inside of this for loop of computer variable and this time I've called it I can call it whatever I like within reason I can't use Julia keywords and Can't use plus or minus signs in between etc But I've called it just I for I in one to five now this one to five note There's no brackets around it. There's no square brackets parentheses around it So that makes this and we look have a look close look at this later. It's just a range object It's just going to go one two three four five Print line we've seen before it's just going to print a single line of text and what it's going to print is inside of These parentheses and at the moment it is the value that's inside of the computer variable called I and then end So we're going to run through this through this through this What this for loop does is it just evaluates? Whatever is there one to five. So when it gets to five, that's what we actually get to to the end of the of the code So the first time it runs through it's I's going to be one It's going to print one it goes run to through it again and because this is just a range object It's going to go to to all automatically you don't have to do anything, but the integer value it jumps by an integer value Let's run the code and you see As you expect one two three four five to the scheme this little tab that you see there Julia does that automatically for you or at least the the notebook here does If you write the four line and you hit enter it does this little places this little tab to keep things nice for you No issue Now have a look at this now this one two five didn't have any brackets around up and I'm putting these square brackets around what happens here and It's these strings these and are and words separated by comma So these are three separate things and they just happen to be strings inside of this these square brackets And I'm saying for word in this print word That's not print line to sprint comma and This backslash t that means that tab. That's just going to leave a bit of space in between We're going to execute this line of code. So you just can you can see what happens. So there's this computer variable called word Each time that runs through it's going to take the one then the next one then next next one as you can see It's these tab are tab words can't see the last tab there now We do this in in teaching computer language by using these words that make sense I just want to show you it doesn't really matter what you call this. I'm going to call it WRT Don't know why this did WRT Doesn't matter. It's not the word word doesn't mean anything It's just a computer variable that I came up with because if I ran this code again Exact same output. So it doesn't matter what it is and this for loop is clever enough to see that these This is a list of things actually called an array and we'll look at these kind of things in the upcoming lecture And it's these three and every time it's going to take one then the next one then the next one the print is this and I didn't say Print line here because I wanted everything on the same line If you just give it one String and there's no brackets around it It's actually going to be clever enough to take each letter on its own again I needn't have written letter there I could have written any computer variable name there with in with it that are within the rules So it's J with a tab you with a tab L with a tab and it just iterates through each of those characters Now I have a look at this now. I'm iterating through something that's in within curly braces So let's see what happens there and I'm calling my variable stuff Just to show you that I can use any word there within the rules So for stuff in this stuff that's inside this curly braces at 10 at 20 the word 30 and the square root of 1600 Print line and I wanted to print stuff So whatever's in that computer variable stuff through that loop Then a tab and then the type of stuff that should be interesting So we can see what 10 20 30 and square root of 1600 are and that's quite nice So the sprint line so each is going to go on a separate line 10 is a 64 bit integer 20 is a 64 bit integer 30 is a string and 40.0 is a 64 bit float Now I want to show you something We created this these computer variables first. I called it word. Let's change it back to word. This looks better It's good to write code so that the code makes sense, but I just wanted to show you it's not the actual word itself So I've created this variable called word you have created a variable called letter You have created a variable called stuff, but it's inside of a for loop Now this is called the scope of a variable. Where does it exist? I just want to show you that if you create a variable inside of a loop like this It does not it ceases to exist outside of the loop Unless unless something I'll tell you what that's something is So yeah, I want to show you that it doesn't exist because I'm gonna say stuff and it's going to return an error Now I don't just say stuff here and hit shift enter Or shift return because I know it's going to cause an error And sometimes you might know that something's going to cause an error But you don't want your code to stop executing because that's what happens when there's an error. It just stops it executing And you don't want that in those cases put it inside of this try catch in statement So try and then try something stuff if I just write the variable It's going to output what that variable is but it doesn't exist It's scope it only exists inside of this for loop If that returns an error, I catch that error and I put the error inside of a variable and yeah, I've called the variable x And I want to print two things I print and to print a line where I tell what is the type of egg the error And then there's this keyword show error in standard output and then the error itself an end So this is a try catch So block of code that I am running and just to show you So print line the type of the error It's an undefined variable error because that variable does not exist It only existed inside the loop once that loop was finished It was wiped from emny And this the show error standard output the error is stuff not defined So it's just a standard way if if ever you have code that you wanted that's not going to execute Place it here. Remember this little block of code. You can this is pretty standard stuff You can always have that in your code and put whatever you you think might not work in there And then the rest of your code can go outside of this Now let let's create stuff and put a string in it I exist If I just put stuff it says I exist there I just put stuff and it threw up an error But I put it inside of this little try catch statement So it's still con if if this happened the code wouldn't stop executing it would carry on Now it exists now that it exists. I'm using it inside of that same 4n loop there. Let's do the same thing So it went 10 20 30 40 with the types of this is that we had before but what is stuff now Does it still not exist does it cease to exist because it was in this? No, it actually doesn't because it existed before it has a scope that lives outside of its scope is I exist outside of this for loop. It is an explicit variable It was explicitly created before this for loop And now if inside of a for loop its value changes as it does first it was I exist then it was 10 and it was 20 then it was 30 then it was a square root of 1600 It will keep the last value that it had as it should So that is just the scope of a variable inside of a for loop Just to show you one more thing about for loops You can nest for loops inside of for loops So I'm running an outside for loop where a just iterates from this range object from one to three Inside of that is another for loop that goes from one to two And then I want it to print line a and b. What do you think it's going to happen? It's going to say a equals one. There's my one b equals one and then prints it to the scheme one and one But it stays within this inner little loop. So now it's going to go one two Before it exits that little loop and goes to the larger outside loops now moves over to two one two two and then three one three two So you can nest many for loops inside of other for loops. So we've learned quite a bit here. We've learned about iterating through a for loop and iterating through different things through a range object through these lists of arrays of texts Through single left through the letters of a single word through these funny stuff. That's all mixed up and jumbled of any type And we've printed to the scheme the type there of We've shown you that the scope of this variable inside of a loop is just internal to that It sees us to exist outside. I showed you how to catch an error So that your program doesn't stop running and a pretty standard output as to what to do to print it to the screen And then to show you if once it exists outside of this its scope is outside of just this little Loop it actually retains that value and then lastly how to nest little four loops inside of bigger loops


Hi folks. I'm Matthew Riley. I'm a software engineer at Google. Today I have the privilege of presenting along with Marina Moore. Marina is a PhD student at NYU, well known for her contributions to the update framework and the notary project. So the topic of the day is software supply chain security. At least from where I'm standing, it seems like we've agreed we're going to solve software supply chain security with signatures. To be short, code signing is nothing new. Just to call out a few examples, Microsoft had authentic code signing for Windows binaries back in the late 90s. Devian has secure app since the mid-2000s. Of course, we have some more recent container focused efforts like Docker Content Trust and Cosign. Now, something we noticed about these newer efforts is they seem to treat signatures as an end in and of themselves. Look for signed containers has become looking like for the padlock in your browser. If it's there, you're safe, right? Not quite. It's not quite where we are in part because on their own signatures don't mean anything. I mean, okay, there's one law of physics thing that signatures mean. A valid signature means that the private key and the signed data were in the same place at the same time once. But that's it, that's as far as the math can take us. If we want to make decisions based on valid signatures, if we want to use signatures to improve the security of an ecosystem, we need to rely on policy to answer questions like whose key was used, how did they protect it, and how is validations supposed to work? Policy is what makes signatures useful, and coming up with beneficial policies is the hard part of any signing infrastructure. That's what we're hoping to spend our time talking about today. First, I'm going to tee up the problem by looking at how policy defines an ecosystem and what sort of questions a policy might address. Then Marina will look at how this applies to real systems that chose policies based on their specific use cases. So we said policy is the set of rules that make signatures mean anything. To put it a different way, policy allows signers to predict how verifiers will behave and vice versa. And to grossly oversimplify, every policy decision that we're going to make falls on a spectrum. Or on the one end, we make signatures easier to create, and on the other end, we make signatures more meaningful. At either end of that spectrum lies peril. If we make it so easy to sign things that anyone can do it for anything all the time, then validators don't learn enough to tell good software from bad software, and they won't bother validating. On the other hand, if we make signatures mean a lot by making people jump through more hoops, then we reduce the number of signers in the ecosystem. We reduce the coverage of signatures, and validators can't rely on software being signed.  What we're looking for instead is a trade-off, a spot somewhere in the middle where we can meaningfully improve security for everyone. All right, so we've talked about how to think about policies and trade-offs at a high level. Now let's get into the nitty-gritty of some specifics of what a policy needs to answer. And we'll start with one of the most foundational questions. If I have something that's signed, who signed it? How do I match a signing key to some real-world identity? Now, again, there's a real trade-off here. If I make this too hard, if I require ID cards and lawyers and contracts, then only big, well-resourced companies are gonna bother signing anything. And the long tail of software, the left pads of the world, are going to remain unsigned. But if I make it too easy to get a code signing signature, if I don't require any proof of anything, then we end up with spoofed identities and a lot of signatures that don't really tell us much. It turns out signatures have turned our software distribution problem into a key management problem. That problem is different, but it is not meaningfully easier. Different ecosystems end up solving this in different ways and the solutions tend to cluster into one of a few buckets. Some systems rely on a central directory or arbiter of identity, which is trusted to make statements like this key belongs to this name. This is sort of like the DNS approach. Other systems ship with a hard-coded set of keys, which are either used to sign things directly or delegate authority to other keys. This is like the web PKI model of certificate authorities and root CAs that ship in an OS store. Finally, some systems choose to provide a weaker guarantee. Rather than check that things are signed with the right key, they assume the first key they see is correct and they just make sure that the key stays the same over time. This works as long as your first request wasn't tampered with and as long as the entity does not change keys over time. Okay, so let's say that we have a way to map keys to real-world identities like people or companies. Now we have a new problem. A company doesn't sign code. Some computer at a company signs code. Wherever that signing happens, we need to keep the key protected so it is still meaningfully the company's key. We could bring software to a developer's desktop to sign it before release. Ideally, this would not mean that every dev has a copy of the company key. Maybe instead they have individual keys stored on hardware tokens and we have a delegation or a thresholding story for those keys. Even then though, we can only trust the signed software as much as we trust the sketchiest piece of software on that dev's machine. If we sign on some central infrastructure instead like a continuous integration server, now we have a chance to run more rigorous security checks in a more controlled environment. We could require that everything be built from head on a protected main branch that enforces code review. But now we have to have a machine key and that machine key is subject to machine compromise. It's especially true if we're using a persistent build server rather than throw away VMs. These examples also demonstrate another policy decision. Do we wanna keep our signing key somewhere that it can be accessed and used by automation or do we want it locked away where we need to run some sort of ceremony to get to it? We can trust those offline keys more, but we can't use them as easily, which might lead us not to assign every build or every commit. Spent a lot of time talking so far about how to get signatures right. But no matter how hard we try, something will go wrong. Your signing key will accidentally end up on GitHub. A developer's UVA key will walk off the desk over a holiday. Or maybe you kept control of your key but you signed a bad build because your source repository was compromised or your build server had malware and you didn't know. Our policy needs to have a story for how we find out about mistakes and how we fix them. In practice, the most common way to find out that your key was used to sign something bad is for a user to find that something bad on their machine and send it to security at your company.com. In some more elaborate setups, that key might be on a protected server that generates audit logs or we might have a binary transparency log setup where we list all the artifacts that we've signed that validators should trust and we can go through that list to see if anything is out of place. Once we find out about a problem, our policy choices will determine how easy it will be to fix. For example, how many good signatures do we need to invalidate to make sure the bad one doesn't pose a danger? Can we revoke just one signature for a release? Do we have to revoke a key and invalidate everything that it signed for however long it was valid? Or do we need to burn everything down and start with a new root of trust? And if we do need to do that, can we? We also have to think about what happens to users while we're fixing this. How quickly is a bad signature invalidated? And then if someone tries to use a container with one of those newly invalidated signatures, what happens? Do we fail fast? Do we show a reasonable error message? Or do we just prompt the user and say press Y to make this your fault? Dealing with mistakes is by far one of the hardest things to get right in a code-signing ecosystem. And that's because by definition, you're starting from a bad state and you somehow need to get back to normal without creating any, or at least many, new surprises. All right, we've talked about policies and the questions they need to answer. Before we get into covering some real systems, I want to quickly recap what we've seen so far. We saw that a signature only proves that the private key and the data were together once and that everything else, all the meaning we hope to imbue into that signature comes from policy surrounding how we map keys to identities, how those signatures should be validated and how we heal the ecosystem if things go wrong. That policy needs to be universal, agreed on and relied on by all the agents in the system. And it needs to find the right trade-off, the right equilibrium, where it's easy enough to deploy and strong enough to be valuable. Finally, to bring this back altogether as we go looking at real systems, remember that any useful policy needs to start with a full threat model of the system that we're trying to protect. We need to recognize the valuable targets, how they might come under attack and how we will use mitigations like signatures to frustrate those attacks. And with that, I'm gonna hand this over to Marina. And we're gonna hear about how these decisions have played out in real life systems. Thank you, Matt. So as you've heard so far in this talk, signatures are just one piece of the puzzle. In this section, I'm gonna discuss some of the policy trade-offs that really complete this picture. Each of these policies is based on a threat model for a specific project. And the examples I'm gonna use are from software distribution and I've seen these through a lot of the work I've done on Tuff. So first, a little bit of background. Tuff, or the update framework, is a framework for secure software updates. It uses cryptographic signatures to sign metadata that provide information about various pieces of the software update process. Each piece of metadata is signed by a role, and a role is just a key or a collection of keys controlled by a person or a collection of people that's responsible for a specific piece of this update process. And really responsible for a specific piece of the metadata in this update process. These roles can delegate some or all of their authority to other roles by signing metadata with the public keys of a role that they're delegating to. And Tuff makes some policy trade-offs itself, like some of these signature policy trade-offs that we've talked about, like specifying how delegations can be used for revocation and also things like timeliness and consistency of different things in the ecosystem. But it leaves a lot of policy decisions to individual implementations, and that's what I'm gonna talk about next. So as our first case study, I'd like to talk about Uptane, which is the automotive variant of Tuff. This is pretty unique because automobiles, sorry, are a very controlled and safety-critical environment, and this really affects the policy trade-offs that are made in this implementation of Tuff. Because cars are physically in a factory before being sent out onto roads, Uptane can do key distribution just in the factory, in person, which is pretty unique in the world of software. It also has a pretty interesting approach to the trade-off between online and offline keys in that basically it uses both. So the image repository uses two different repositories. The first of these is the image repository, which contains a library of all of the images that are currently approved for use in any car, and these are signed using offline keys. And then we also have the directory repository, which uses online keys to specify what images a particular make-and-model of car or specific vehicle should install at any given time for various reasons. And the vehicle then uses a variation of threshold or multi-signature signing to ensure that any image that's installed on that vehicle was signed by both the director and the image repositories. And this gives Uptane both the security of using these offline keys, as well as the flexibility of online keys, which is a pretty cool system. So the next case study I'd like to talk about is PEP480, which is a proposal for end-to-end signing of Python packages with Tuff. The first half of this proposal, something called PEP458, is in the process of being implemented in warehouse, and by the time you're watching this, it will likely be in practice in warehouse, which is the PIPI server. The key piece here that informed the trade-offs was the importance of developer usability. We really want end-to-end signing to be adopted by as many developers as possible to secure as much of the Python ecosystem as possible. And as we know in supply chain security, that every package has dependencies. So the more of these packages we can include in our end-to-end signing solution, the more of them will have broad consequences. So for key distribution, PIPI hosted a public key generation in signing ceremony, which was live-streamed and also recorded to establish public trust in this generation process, the key generation process. These public keys are posted online, publicly available in as many places as possible, and they'll also be distributed in PIP and other warehouse consumers, so they can automatically be used as well, but you can verify using the online sources. So warehouse controls these root keys and then uses them to delegate to some intermediaries, what Tuff calls the target's role. And then these intermediaries delegate to individual developer keys for specific packages. So does this in two ways. For established projects that are known periodically, these are delegated to using an offline key controlled by warehouse in kind of a manual process. But between these manual processes, we still want to have this end-to-end signing, and so new projects can automatically be added using online keys that are just controlled on the warehouse server and no manual interaction needed. So the final case study that I'm gonna talk about is Notary V2, or specifically, the Tuff Notary Subproject of Notary V2 that implements Tuff on registries. One of the main goals for many of the Notary V2 implementers is real-time availability and scalability. This case study also has the particular challenge of dealing with ephemeral clients. And for ephemeral clients, trust on every use is the first use. So if using trust on first use, it's kind of an infeasible way to manage your key distribution. So instead, for this key distribution piece, Tuff Notary suggests distribution during container provisioning or using existing secret distribution mechanisms like Spiffy Inspire. Also in Notary V2, real-time use requires the use of online keys. But security risk of online keys can be mitigated through delegations from offline keys. That's kind of the way that this works in many of the cases of people using this. And so this works by having an offline key that lists the online keys that'll be used for your day-to-day signing. And if anything goes wrong with this online key, if it's lost, if it's stolen, if something happens to your server, this online key can then be revoked by using the offline key that is not on your server. So you can use this offline key to then create a new online key and use that for any future signing. So the main takeaway from all of these examples is that policy decisions really depend on your threat model. And you really can't make these decisions so you know what your threat model is and what particular things you're protecting against. So if you'd like to use signatures, first look at why you wanna use them and ask yourself which policy trade-offs make sense for your particular project and the things you wanna gain through the use of these signatures. And then finally, I wanted to include a friendly reminder that once you have these signatures and policies in place, make sure that you implement the other side of this where you actually verify the signatures and enforce the policies so that they're actually used to improve the security of supply chain instead of being used just to check a box. So thank you all for watching and please let us know if you have any questions in the chat. And our contact information is listed here if you have any further questions or if you missed this live Q&A session. Thank you everyone.


Hi, my name is Ethan Nestor and you're watching Crank Gameplays. Go to, I have to do this, dot show, and get tickets for the tour now. Uh, listen, I know what you're thinking. Ethan, why are you playing Sekiro right now? This game came out in- R20 Sekiro, 20, my team. I am playing Sekiro right now.  Maybe I'll stream more of it, depending on what I think of it. But, I am currently playing Sekiro because Elden Ring is about to come out, and I don't have access to Elden Ring yet. And I've been playing Bloodborne in my free time, and it's such an amazing game. And I was like, I don't know what I want to record today. I really want to play Bloodborne really bad, but I don't want to record Bloodborne. And then I was like, I've never tried Sekiro, which this is, as far as I'm pretty sure I'm correct in saying this, this is the most recent FromSoft game with Elden Ring coming out in, like, about a week. I was like, maybe I'll play a little bit of Sekiro and make a video of it. And then once Elden Ring comes out, obviously, I'm definitely gonna make at least a few videos on Elden Ring. I don't think I'll do an entire series. Elden Ring will probably be much more me maybe making a few videos and streaming more of it and playing it in my own time. But anyway, we're just gonna start a new game, and we are going to get into it because I've never played Sekiro before. I've heard it's very, very good, and I've also heard it's very, very hard. And more recently, I've been really getting into Souls-type games, mostly with Bloodborne. And again, with this video, and if I make another video, we're probably gonna be focusing less on the story and more about, like, going around and fighting. I'm very interested to see what the enemies are like in this game, though, because, one, like I said, I've never played Sekiro. But two, I haven't really watched much of Sekiro either, so I'm interested to see how I like it compared to something like Dark Souls or Bloodborne, because, like, one of my favorite things about specifically Bloodborne is, like, how fantastical the bosses are, and, like, just, like, the crazy, like, eldritch horror-style kind of monsters. I love that kind of stuff. Very curious to see what the bosses are gonna be like, because I know... I know about one of the bosses. And he's the big monkey boss, and how he's... Spoilers. How he fakes you out. Whoa, not even a single flinch there? Is this me? Am I the one? Will you join me, Starving Wolf?  This looks so pretty. Here we go.  It's a very stark contrast from, like, something like Bloodborne. Everything in, like, Bloodborne and Dark Souls is so dark and, like, desaturated and grungy, and this is all... Like, all the colors are very saturated and pretty. Let her thrown into a well. Kuro's Wolf. Your destiny awaits you at the tower... At the Moon View Tower. Escape from the well and find the tower-bathen moonlight. Even without a blade, you can still reach it.  Oh, I can wall jump? That's sick. Oh, that's so cool. That's, like, one of my least favorite things about Bloodborne. The sprinting and jumping mechanic is dumb. Like, I hate how you have to hold circle to run, and then to jump, you have to, like, double-tap it. It's just... You checked how it's locked, right? It's certainly locked, but... How do you fix that hole in the wall? Don't worry about it. Whole face is the edge of the cliff, no one can pass through it. Except for me, baby! I do like already how, like, I feel very agile, which is nice. All the other, like, FromSoft games, I always feel kind of slow. Anybody up there? No.  Well, you're surely mistaken, isn't it? Hi! Who are you? Oh. You did well to come here. Look how cool he looks! Oh, here we go, baby. Here we go. Probably butchered that. A katana given by Kuro, the divine heir. An heirloom of the Hirata family, a cadet branch ascended from Maschina. Once thought lost, it is found its way back into the hands of Wolf. All right! Here we go, baby! Hey! What's up, my guy? A shinobi aims to break an opponent's posture. Attacking an enemy is one way to achieve this. One enemy's posture breaks. He is vulnerable to a shinobi death blow. Oh. Oh, yeah. Here we go. Here we go! Oh, baby! Sometimes relentless attack is not enough to break an enemy's posture. Deflecting enemy attacks is another way to damage their posture. Master shinobi uses a combination of deflect and attack C to the victory. Moment of attack lands, deflect. Okay.  Me likey! Hey, baby. Yep. Oh, yeah. Oh, for sure. Thank you so much. Thank you for coming. I really appreciate you being here. Would you guys like to show me where a counter slash? Counter slash can be performed immediately after defecting an attack. It allows you to deal posture damage without giving the enemy time to recover. Why did I not? Did I do it? Maybe. I got him. Some powerful opponents require multiple death bullets to be killed. The number of death bullets required to kill an enemy is shown in the red circle of markers above their vitality bars. Oh, I'm dead! I've died! But hold on. Shadows die twice, though. Maybe they don't. Am I dead again? Fuck!  Ah! I'm probably going to die again. Ha ha ha! Ha ha ha ha!  Thank you. Medicinal pellets that slowly retore vitality. A secret treatment path down for generating the lands. Well, now that we have that, what is this? A fistful of ash? I don't know. I mean to temporarily distract them. That's kind of fun. Hey, everybody. How you doing? No secret passage to the bottom of the moat under the bridge? We just got orders to guard it. Oh, security's getting tight. Do you think they know about me? Hmm? Down here? Me? Right there? Or we'll be upon this soon. Okay, climb up. No, let's be really sneaky. Hey, bud. What are you doing down here? Who are you? Sorry. Look at the butt, though. Look at the cakes on these, dude. Is there anybody? Aw. I was hoping that I could, like, drop down on somebody. This appears to be the escape route. Call the Divine Air. With the reed whistle? Yeah, sure. Whoa. You escaped quick and easily?  Except there's two guys on the bridge. I did find it. I'm very good at what I do. I definitely did not die. As you can see, because I'm alive. Now we go through the creepy, creepy place. The creepy, creepy dungeon. I can't pull out my weapon at all. This feels... Not great. Um... For my honest. The Divine Air. I feel like this is gonna be hard. This must be the first boss. Damn, you have starter-facial hair, too. Genichiro? Genichiro? I don't know if I read the rest. Is he gonna do the... And then he's gonna be sliced in half? Alright, here we go. First boss fight. Let's go, baby. That's quick. I feel like... And maybe I'm wrong with this, but I feel like... This game is a bit more linear. It seems a bit more linear than, like... Bloodborne or Dark Souls. Where, like, Bloodborne is, like, very... Exploration-based. It's not, like, open-world exploration. Exploration. Jesus Christ. Okay, you're fast! I get it, dude.  Oh! My guy! Wait, is this where my shadows die twice? Guys, thank you so much for watching, Sekiro. That's the whole game. Thank you so much for watching. It's been a good one. So, thank you so much. Please make sure to like and subscribe. Not on my watch! Who are you? Okay, bye. What happens if you beat him? Do you think the air is just, like... Oh, uh... Sorry, I didn't... I didn't think that you could do that. I guess... Yeah, I guess we'll just leave then. Alright. There was a bunch of other stuff that probably would have happened, but... Wait, am I gonna get a cool metal arm? What is my arm made out of? I DO have a cool metal arm! It's like half bone, half... kind of metal. Kind of... It looks like it's made out of stone, some of it. Like I'm a statue. You have hairy legs. That's not your face just yet. Dude, you gotta clip your toenails.  It's not... It's not Mr. Gadget. Inspector Gadget! Mr. Gadget! We have to commune. Sculptor's Idol serves as a checkpoint and can be found throughout Ashina. Resting out of Sculptor's Idol will completely replenish vitality and restore the use of resurrection. Additionally, quick items and spirit emblems and storage can be added to your current inventory. With some exceptions, Resting will also revive defeated enemies. I guess there maybe there isn't leveling up in the game? Maybe just like getting better weapons? Because I didn't choose like a class at the beginning or anything like that. The Shinobi prosthetics grappling hook allows to... Oh, what a... My God! I'm horny! I just use a grappling hook like that? That's so cool.  Oh my gosh. Okay. Go to sleep. Go to sleep. Uh-huh. Can I grapple people? That would be cool. Oh! What is that? Bye-bye, big boy. Big boss is big hog. Hey, oh! Would you like a little slice and dice? Thank you. Yes you would, dude. I'm loving this grappling hook. It is so cool. Whoa, wolf boy. Wolf boy, wolf boy. What do you see? I see a wolf boy that's dead.  There's more! Oh, there's so much more of them!  Are you coming back for seconds? Nope, listen. I love doggies. I don't know anything in the whole wide world, but when a doggie comes at me, and they've got their teeth barred, right?  That's when I tap out, and that's when my sword taps in. Parallel attacks. Some enemies are unguardable parallels. Use unguardable parallel attacks? Oh man. When they occur watch carefully and look for a performance to perform a specific response. Let's thrust lands deflect before sweep lands jump. For grabs. Step dodge. Hey baby.  Hey, hey.   Yeah.  I'm dead. Wait, but when did my shadows die? I'm asking. No, I'm pleading. Let's take my blood and live again. Is this where my shadow dies again? Or I get my shadow lives? Through me? Damn. Resurrect. To stay down after being knocked on the ground, surely means death. Safety roll. Can use as quick as fun. That was sick.  Dude, are you kidding me? Are you joking me? Well, I'm dead now. Gotta get this guy, right? Oh, oh, yeah.  Yes, finally. I bested my opponent. A loose prayer bead. Offering four of them at the sculptor's idol will increase maximum vitality and posture. Currently, Wolf has one bead in special.   Oh, look at him. He's around here. Whoa, whoa, whoa, lock on to anyone. Whoa, whoa, whoa, whoa, whoa, whoa, whoa. Okay, just wait one moment. Just one moment. Is there anything that I can do here? Nope. Just try and get away from them real quick. Here I go. Oh, wait, I can resurrect here? I thought that I already... I thought that I had already used that. Oh, God.  Get him. There's too much going on. Where are the other people coming from? I hear other people. I hear things happening. The music is playing. The music is loud. That means there's something happening. What is happening? I don't see anyone. Oh, there's somebody up here. There you are.  All right, you come over here.  I just got a job to do.  And I said, well, that's no good for me.  I signed up.   It's better be Thanksgiving for me. I'm gonna fathom you and I'm gonna thank you.  All right. Also, I got some comments recently that just made me feel really good.  And I've gotten a lot of comments of people finding comfort in that. And I think that that's really sweet. And they're just like, oh man, like I say that. Not a lot of other people say that.  But yeah, I say that all the time. Because we use that term a lot in New England, especially in Maine, Massachusetts.  Going around A in New York. Where are my friends? My friends, I know you're here. Where are my friends? Dude, I feel like it's like, it's got like Spider-Man mechanics almost with those kind of kills. Hi there, friend. Oh, there we go. Where's he at? Ceramic show. See, but then we've got things like this where there's 1,500 guys coming around. And that's not something that I like to date. Do you like lose sight of me? Fuck. Hey, revive, died twice. Thank you.  But I don't appreciate twice at once.  Well, I've been playing for a solid hour-ish. I am going to end this one here. Let me know what you think of Sekiro. I had a lot of fun playing this. I'll play more of this. I don't know if I'll do it in a video, but I think I'll definitely stream this for sure. Over at twitch.tv slash CrankGameplays, link's always down in the description. Also, tour is in less than a month now. So please, please, please, if you are in the continental US or in Vancouver or Toronto or anywhere near there, please go to... I have to do this dot show. Go and check it out. There's tons of dates in a ton of different cities. And there's still tickets left in many spots. So please, if you're thinking about coming to the tour, please do. I am so proud of the show. And I'm very, very excited to show it to you guys. So go check it out. But thank you guys so much for watching. Hope you enjoyed. If you did, make sure to slap that like button right in the face. And I will see you guys in the next video. Love you all. Stay cranky. Bye.