Thanks for coming and I am here on a continuing series, Michelle's continuing series of Psychological Principles and how they apply to the social engineer. Do I need to move? Tommy, do I need to move? Okay, and it occurs to me that I should have gone to the gym a lot more before I squeezed my FUPA into this dress. However, we'll move on. All right, so the topic of today's talk is decision making and how and why we make bad ones. So, let's see, Peter, make the derp noise. Make the derp noise. Does anyone know the derp noise? Derp, derp, derp. What is the definition of a derp? Can someone tell me?  And here's the thing, we've all done it, all right? So, we're not making fun of these people, but we're making fun of the following decisions. Post it on Facebook. I'm so proud of my son. Here's a picture of his credit card right here. Derp. Second example, the road to success. There are no shortcuts. Bad decision. And I'm gonna give you three here. Derp, derp, derp. Yeah, bad decisions. All right, so here's the thing.  The smartest people in here have made a dumb or bad decision. And the really interesting thing to know as social engineers is that if you understand why and how people make these decisions, you can affect their choices, whether that is for good or for evil, depending on your profession. So, let me give you an example, all right? The most wonderful time of the year, I love Halloween. There was a guy named Dan Ariely. We're gonna talk about him later. He does a lot of interesting stuff. This isn't like a real psychological experiment, but what he did was, one year for Halloween, he gave out Hershey's Kisses to kids. And kids all love getting Hershey's Kisses, but he twisted it up a little bit. He said, okay, now that I've given you the Hershey's Kisses, we got a deal. We can make a trade. I can give you one Hershey's Kiss for a fun size, which I think all of you agree that this is not fun size in any metric, okay? Promise you. So, the deal is you can trade one Hershey's Kiss for a fun size, or you can trade two Hershey's Kisses for a really fun size. So, here's the interesting thing. What do you suppose the kids picked? For the most part, because kids are pretty good at maximizing chocolate. Yeah, the two kisses for the full-size Snickers makes perfect sense. At some point in the evening, he switched up the deal a little bit. What he did was, he said, all right, for the rest of you trigger-treaters, I have another option. You can trade one Hershey's Kiss for the full-size Snickers, or get a fun size for free. Now, what do you suppose the kids did? Yeah, what he found was a vast majority of kids elected for the free mini fun-size Snickers. Although, you know, if you think about it in terms of pure chocolate volume, obviously the first trade is a much better deal. Why do you think kids messed up on that choice? Free. Avoiding loss, thank you very much. There is no possibility of loss when it's free, right? So that is the deal, kids get anxious, and they get excited, and if something's free, they're not gonna lose a thing.  So it's not just kids, it's all of us that make these kinds of errors. So I have four considerations for you as social engineers. The first is that we, the interesting thing is that we tend to make the same kinds of mistakes over and over in the same kinds of ways. What that means, then, is that we are predictable in our decision-making process. So if you have done any sort of reading or are interested in doing any sort of reading into decision-making, Tversky and Canaman are sort of the granddaddies of decision-making. They've done decision-making for years and years and years, and what they have basically come up with, this is this idea that people use shortcuts. We all take shortcuts in our decision-making process. It makes life a lot easier, right? We can make quick decisions in a very brief amount of time and most of the time we don't die when we do it. So if it continues to work for us, we continue to do those things. So because we rely on these shortcuts, again, we are fairly predictable in the kinds of mistakes that we will make in our decision-making. So there's three different kinds here, which I'm gonna talk about briefly. All right, so the representative heuristic is the tendency to estimate the likelihood of something by how much it resembles a specific category. So I know a beautiful girl named Jessica, blonde hair, green eyes, boom, and figure. She loves good wine, jewelry. She loves going to the hot springs. So let me see a show of hands. Is she an accountant? Any hands? Any hands? Okay, we've got a few. We've got a few. All right, is she a farmer? Farmer, got a couple. Is she just an experienced scholar? Got a few more here. All right, is she a talk show host? Probably the most participation we've gotten at this point. You guys are so lame. Okay. All right, so who picked talk show host? All right, got anything short. Stand up for me. Come here, baby. All right. Why did you pick talk show host? Okay, she seems to fit the category. Thank you very much. Bubbly personality, she's attractive.  She's sociable. And what it seems like is that she is representative of this category that we call talk show host. Now, what do you suppose the right answer is? No, actually she's an experienced scholar. Okay, I promise, I promise, this is true story. I would not lie to you, this is actually true story. Now, the problem that we have here is that we use these categories and we try to decide if people fit these categories to make these decisions. Why is there a problem in this particular case? Say that again? Okay, so you don't really know what those would look like and so you find it most likely? Well, it's interesting, right? And we do this all the time. Does this person or we judge the likelihood of a person or a thing or decision fitting into a specific category because that's what they look like. And really, whether or not she is any of these things has nothing to do with her personality or what she looks like. We haven't even taken into account how many accountants there probably are in the United States versus farmers versus talk show hosts. I think it is fair to say that there are probably more accountants than talk show hosts and yet we may be more likely to choose one or the other simply based on how she looks. Let me give you a real life example. Who can give me in their mind what is the definition of a kidnapper? Wait, what's the definition of a kidnapper? Somebody who steals a kid. Somebody who steals a kid, anything else? Usually a parent. Usually a parent? Ow. Okay. Let me lead you a little further. Is there anything else that we sort of have in our minds that kidnappers do? Please, PG-13. Yes, ask for ransom. So here's a really interesting thing. People who take kids and ask for ransom are much more likely to be charged with kidnapping than people who just take a kid. And yet they're both kidnapping, all right? But in our minds, we have sort of the stereotype of kidnappers take a kid, they ask for ransom and that's what they do. So it even affects our decisions and our behavior. All right, so think about that. Think about how you have these little categories in your mind and how they affect how you see people, how you judge the likelihood of things happening and how really that will impact your decision-making process. So that's representative heuristic, okay? That is the shortcut that we take to make a decision based on how closely something or someone fits into a specific category. All right, let me ask you another question. Now, availability heuristic is our decision-making based on how easily we can recall something happening. How easily we can recall something happening? So let me, and really the bottom line is if you can think about it, it must be important. And that makes sense, right? If we can recall something quickly, well really it might have been life or death, it might be something really important so we can think about it right away. So the question is, what is more likely to kill you?  I know what you guys are, you guys are so smart. All right, how many people can think of a story or know somebody who's been bitten by a dog? Okay, probably the vast majority of dogs or your dogs can be pretty, pretty scary. And so we can think about that immediately. We can think about people who have been bitten by dogs. I remember there was a big story in the U.S. of a dog catcher, female dog catcher she was bitten by pit bull really bad. I saw the video, it was very scary. And so if you were to ask me, I would say, well you know, much more likely that a dog's gonna kill me than my sofa.  All right, so that is the power of the availability heuristic. We can recall something and therefore it must be true or therefore it must be important. Again, think about how that impacts your decision-making. Now why do you think it is that we can recall things so quickly? What are some reasons? Survival, who said that? That guy, Brown shirt, why do you say that? Okay, so if something is really scary or something is risky, it would behoove us to remember it, okay? But why do we remember stuff like this? It's really simple, a false positive causes very little. A false negative is death. Okay, let's explain that in ways that the rest of the class can understand. It's not even a class. Sorry, the people in the room. Why is it that things, what is the reason that things are easy to recall? Repetition. Repetition, media, okay. What's that? Emotion, very nice. Yellow shirt. Instinct. Instinct, okay. I always ask this question in class, it's the same kind of thing. Are you more likely to be killed by a shark or a soda machine? Soda machine. Soda machine, you guys know the answer now. But why would the vast majority of people answer shark? Jaws, sharknado, shark week on discovery channel? Absolutely, right? I do not ever remember a new story of a guy getting squashed by a soda machine. However, again, actuaria tables indicate that people are much more likely to be crushed by soda machines than eaten by sharks, unless you live in Australia, from what I hear. Okay, so that is point two under this whole idea of how we make mistakes in sort of consistent manners. Tversky and Caneman also talked about the anchoring effect. So the anchoring effect is the idea that for the most part, people have to have a way to make a decision and they use a number as a starting point. That starting point has a way of drawing your answer. So for example, you go to the store and the salesman showed you a beautiful leather jacket. Okay, I'm from the 80s. I love my leather jackets. And he tells me, you know what? This leather jacket is $1,000. But today, it's on sale for 400, okay? What does that do to my decision-making, right? It gives me an anchoring point. In my mind, that leather jacket was worth $1,000, so if I'm only paying 400 for it, that is fantastic, all right? So anchoring is a very interesting way to think about the decision-making process. And the reason why I have this annoying wheel of fortune here is that Tversky and Caneman also did an interesting study where they had people estimate the percentage of African nations that are part of the United Nations, okay? And they had a wheel of fortune going and they had it actually rigged to stop on either 10 or 65. And what they found was that it affected people's answers. So the people whose wheel of fortune stopped on 10 were likely to estimate a median of 25% of African nations and the people whose wheel of fortune stopped on 65 were likely to guess a median score of 45% of nations belonged to the United Nations. So anchoring points are important to us. Again, these are shortcuts that we make. We have to have some way of making a certain decision. If someone throws out an answer to us, it will affect our decision-making process whether we think it is important or not. There was another really interesting study done where people were told to write down the last four of their social or actually the last two digits of their social and then ask what they would pay for like a good bottle of wine or tickets to a basketball game. And the people who were willing to pay the most for a good bottle of wine, their socials ended like in 99, all right? So again, we have an anchoring point. We wanna take these shortcuts. We don't wanna think about all this information. We wanna take a shortcut that's quick, that's easy and that will make sure we don't die, okay? So that is consideration number one. Consideration number two, I am going to lead in with a video or a movie that I'm sure we all know and love. So I'm gonna show it to you first and then we're gonna talk about what it means. And no, we're not gonna see the whole thing. I don't have any sound. Evan, sorry. And my tech support crew comes in. You just want to go and help your mic again. You need to adjust my mic again. Yeah, put that right in your USB there. Just put that right in my USB. Nothing bad will happen. She works for me. They look trustworthy. Sorry guys, should have done trouble shooting earlier. So I'm gonna go and help out. All my settings are open to the universe. It's all right. Are you wanting to start the video? Yay, thank you. He knows what movie this is, right? Okay, this is, I think this is the second dark night. Anyway, it's the reboot of the Batman. We have the decision where we've got the two boats and they need to make the decision whether or not they're gonna blow each other up or they both get blown up, right? Okay, decision making at its most critical. We're still here. That means they haven't killed us yet either. But you don't know how to take a life.  Everyone wants to get their hands started. Fine, I'll do it in their choices. They chose to murder and steal to make any sense for us to have to die too. You can tell them I took it by force. Give it to them, then I'll do what you should have did 10 minutes ago. Arguably a very dramatic and difficult decision. Now what does this video say about our decision making as it gets more complex and more difficult? Are we super on it? Are we better at it? We would like to think so for sure. The basic thing to understand is that as decisions get harder and more complex or more important, we really don't get better at them. We really will often take the path of least resistance or allow the system or decisions to be made for us. So think about how many of you probably, well, all of us I think should probably be saving for retirement and we should probably know what's being done with our money. It's a really important decision to make sure we're not eating cat food when we're in our 70s, right? However, a lot of us leave the decision making to money managers or we don't save it all. We just sort of avoid the situation because again, money is like scary. It's your life's blood. It's how well you're gonna do when you're older. And so really what we know is that this is a hard decision. It's a complex decision. It becomes too much for us and oftentimes we just sort of let things slide. Dan Ariely, Duke University, the guy who did the trick or treat experiment did a really, he did a really good TED talk and this was actually done by an organization in the UK looked at organ donations, okay? You can see there is a dramatic difference in organ donors by country. We've got some countries here that are not so great. Countries over here that are awesome in terms of donating organs, willing them after they die. Now, do you think it is because Austria, Belgium, France, Hungary, Poland, and Portugal and Sweden are so much cooler than all the rest of us in the US is over here too, by the way? Do you think that's why, you know, maybe? But yes, yes, you guys got it. It's an opt-in versus opt-out system. So it's opt-in, check the box. If you want to participate in organ donor, so the countries with the gold bars and low participation were under the system where you actually had to opt-in to participate. Countries that were very generous with organ donation, you actually had to opt-out if you didn't wanna donate. So what does this tell you? Does this tell you, again, that the countries to the right are much more generous? No, as a whole, this demonstrates that we're all lazy and we will all just sort of allow the default. Organ donation is kind of, you know, it's sort of an important decision. It's philosophical, it's what you want done with your remains. It is a complex decision if you really think about it. For the most part, we don't. And this demonstrates that we are all lazy and we all will resort to default when those decisions get really hard. All right. Consideration number three. We hate uncertainty. I will actually give you a real life example. I had an old phone for a really long time. Mike, our guy back there, Mike is the nicest guy in the universe. He threatened to throw my phone into the fountain at Caesars one year because the phone that I had was so old and horrible. So Mike and Chris, the exasperation, took me to Verizon to get a new phone. And I took over an hour to make a decision about getting a damn phone. Okay, and I promise it was not life and death, but I felt like, man, you know, I didn't realize they were gonna make me go and I didn't collect all this information and I felt really anxious because I wanted to make the best decision possible. And so I waffled and I waited and you know what, I ended up getting a phone.  So here's the bottom line. We hate uncertainty, but it really doesn't make us any better. When information is missing though, we feel like it's really important. When all of you guys visit places, where do you look to find the best restaurant? Yelp, right? You feel like that's gonna give you just that little bit more information that you need to make a really important decision. And the reason that we do this, we don't like uncertainty. We don't like randomness. What does randomness imply? Sort of in life, in the larger picture. Out of control and why is out of control so scary? It is stressful, why? The unknown, why is that scary? Because we could die. Yes, thank you very much. This is a very uncertain situation. Who can see anything? You know, if I tell you there's something here in this picture, what do you see? Well, you see the little goats down here.  But this is sort of a vague, ambiguous situation. If we were here, we might feel a little uneasy and the reason is in uncertain situations, there's always danger. I think that's a snow leopard up there.  So let me give you an example of how uncertainty and the need to collect as much information as possible affects our decision-making process. All right, actually it was Bastard and Shafir who did this study, really, really interesting lone officer study.  You found out that the applicants at college grabbed them a solid credit score, they have a really good job. Now during the credit check, you find out that he hasn't paid his bill in the amount of $5,000 for three months, okay? What do you think they found in terms of who approved versus who rejected the application? More, more, do more people reject or approve? Yeah, yeah, what they actually found was only about 30% approved the application. The vast majority said, hmm, this guy's not a good risk and so they rejected the application. This is a very, very simple condition. What they did was they were really mean to the second group and made this a lot harder. Now, the applicants at college grabbed, they got a solid credit score, stable job, during the credit check, you figure out that he hasn't paid his bill in the last three months, but you're not sure if that bill is for $5,000 or $25,000. These people were given three choices. You can approve the application, you can reject the application, or you can wait until tomorrow because that's when we're gonna get the additional information. What do you think happened? They waited, yeah, 2% said he's good to go. Only 23% said, hmm, no, bad deal. Again, the vast majority said, hey, why don't we wait to figure out what the amount actually is? Part two of this very complex decision-making process. The next day, you find out that the amount owed was $5,000. So what do you think they did? Yes, the majority approved, okay? There were others that didn't make the decision, but so this is really interesting, right? We have a couple of factors at play, but let me compare the numbers for you. Regardless of the condition, if you think about it, the amount owed was the same, right? It was that $5,000. The fact of the matter was that the guy hadn't paid his bill in three months. However, that additional information, that the promise of information, it made Group 2 kinda waffle a little bit and it actually impacted the quality of their decision so they no longer saw the big picture. The big picture is the guy didn't pay for three months regardless of how much he owed. So that speaks to this idea of we think that information's really important, especially if it's missing. Yes, question? Yeah. Yeah, that is a great point. And so this gentleman here said that that $25,000 might have affected their decision-making and what was that principle that we just talked about? The anchoring effect, exactly. So you can see how all these sort of bleed together. They're not nearly as clean cut as I make them sound. So again, we wanna make these good decisions but now we've got these numbers that we use to make our decision and if information is missing, it really stresses us out because missing information must be really important. All right. So in terms of comparing the results of the study, condition one, people once again who approved 29%, they were like, no, he hasn't paid in three months. The condition two approval were much more likely because again, they were looking at, well, it was actually 5,000 that he owed, not the 25,000. So they anchored on that 25K. Very good point. All right. Again, point number four. People can definitely be nudged because according to Richard Thaler University of Chicago, he wrote two great books, Nudge and Misbehaving. He's a behavioral economist, writes very, very well. And his idea is that we don't make decisions that are necessarily in our best interests because of all the reasons that we talked about. You know, we tend, if decisions are complex, we tend to let other people or the situation make the decision for us. If information is missing, we'll waffle and stress out about collecting too much information. And because of that, the situation should be framed in a fashion that nudges people to make the best decisions. And he came up with the term choice architect. And this is definitely a choice architect. If any of you have done any sort of driving out West, you've probably seen this gas station like I have. And it used to stress me out, right? Last chance, this is your last chance for gas and a restaurant for 300 miles. And you may have half a tank, but you may stop simply because of this choice that's been provided to you. So framing is the last sort of point about nudging people in a direction that you would like them to go. I'm gonna throw a picture up here. Now, Colin, Colin, don't blurt this out. And anyone else who has seen this picture do not blurt this out. This is Colin, by the way. Raccoon suit guy. What do you see in this random group of dots? Does anybody see anything or does it look like a random group of dots? Oh, some people see it. Does anybody see a dog? Yes. Does anybody see a dog? Are people seeing dogs now when they didn't see the dogs before? Okay, we've got a Dalmatian here. His nose is here. He's like sniffing the ground. Here's his body. Here's his legs. Now, the problem is we have framed this for you and you probably can't unsee it no matter what.  So the situation can be framed in a way to nudge you in a certain direction or another because, again, we know that people don't necessarily make the best decisions and people will often default and let the situation take control. So if we are able to frame a situation as social engineers, then this will, this can guide behavior in a way that you would like. Framing. Ladies. Is you're feeling different?  Okay? It makes you feel different. It makes you think differently about a situation, affects your decisions, affects your emotional response. If she's in a bikini, she's still very attractive, not a big deal. But if she's in her underwear, I may feel differently about this. Amos Tversky did an interesting study about surgery. Would you rather have surgery with a 90% survival rate or a 10% mortality rate? Now, most of us can do math in this room and we know that the opportunity to die is precisely the same, but clearly people were much more likely to pick the survival, the 90% survival scenario. So framing is an important concept when it comes down to it, because again, we're not always aware of our decision-making processes and if it is a complex decision, not underwear or bikini, but surgery versus radiation versus whether or not you're gonna die versus investing your money in all these complex schemes, think about the load that that creates and think about what our general reactions are to complex decision-making. All right, so to sum it up, we tend to make the same mistakes in the same ways over and over and over again. That makes us relatively predictable because we have biases. We use shortcuts to make those decisions. As decisions get more complex or important or critical or life-threatening, we don't necessarily get better at them. A lot of times we're overloaded and we will allow people or the situation or the frame to make the decision for us. We hate uncertainty. I feel like if I had a little bit more time to research phones, I would have made a better decision on the phone that I decided on. You would have kept the old pieces. I know, and I would have been happy because I had the slide-out keyboard that I could use. I also had a full-size, pretty keyboard. It was awesome and I never made mistakes texting. Absolutely, that's what I feel like, all right? And lastly, people can definitely be nudged whether that is for their benefit or their detriment by the situation, how it is framed, how you frame the situation. Okay, implications for social engineers. Now, here's what's important to understand. Security decisions aren't always easy even for pros. Clearly, we even make mistakes. The example that I want to use for you is from 1983. Stanislav Petrov was an officer in the USSR responsible for early warning detection of nuke launches. This was when the US and the USSR was in full sort of cold war mode. We were very tense. We were waiting to see who launched first because the response was gonna be, well, somebody launches, we're gonna launch and we've got massive assured destruction and nobody's gonna survive, at least. In 1983, in September, the Soviet system actually warned of two launches by the US, one with one missile and one with four missiles. Imagine being that dude on alert and having to make a decision about whether or not to report that a launch has been made against the USSR. Fortunately for the entire world, he decided that it was an error in the system, did not choose to escalate the situation and probably saved us from mutually assured destruction, nuclear war, death, all that kind of stuff that we wouldn't be here today. So the implication for you all is understanding that making these decisions isn't easy even for people in security and it's surely not easy for your populations, okay? So understand how that works and why that works. If you understand how and why people make decisions, you can become a choice architect. Again, if you are in charge of security for your companies, think about ways to make people's decisions easier and safer and think about the ways in which they're likely to make mistakes or policies that you have in your companies that force your people to choose or make a decision when really they shouldn't be.  Now that you understand how all this works, don't use this against your populations unless you've been paid to do so. Yeah. All right, so my final thought to you is Dirty Harriet wants you to make a bad decision. Always think about the Dirty Harry's out there. I know what you're thinking. If I are six shots or only five, well, let's tell you the truth and all this excitement I have kind of lost track of myself. But even if this is a 44 mach, it's the most powerful handgun in the world and we blow your head, clean off. You've got to ask yourself one question. Do I feel lucky? Well, Dirty Hip Hunker. So think about that as you go back to your jobs. Dirty Harry's always wanting to make your populations make a bad decision. All right, folks. If you would like to call me, or well, actually don't call me, email me. Or come to our website. I will take questions if any of you have them. Thank you so much. Questions?


500 events and raised $300,000 for charity. Would you please massive round of applause for our guest speaker artist Sarah Rowan? Oh, yeah, how y'all doing today? Wow, you don't often get alcohol when you first walk into an event and have that kind of a smile. How y'all doing today? Yeah All right, come on sign guys help me out with some tunes Gracious trying to get some I make sure I've never tried it before so I'm scared shitless every time I flip it over to see if it actually worked and Then I spend the rest of the keynote Kind of fixing up Almost there almost there Now we need wisdom and what we do right we need some wisdom just like Tell me you can tell what that is back there Can you because sometimes when you write up on something you can't see what it looks like and then you step back? You're like, oh When you write up on your problems kind of need to take a step back, right? Does it look like an owl? Let me scare you for a minute. All right. I Come from a hollerback church. Okay. I'm from South Carolina Now if you don't know what that means that means I do better if you're laughing at me or with me I don't care. Just some feedback and I am all in right awesome now.  I Like being an artist because I can say whatever I want on stage Now raise your hand if you're tired Tired Try saying it like a southern tired You don't just leave it's kind of like really lazy, Australian. You just kind of like tired. I'm tired Your cup is empty. I Know right profound art right here. I Want it to be doable. I want you to feel like you can do it too be like yeah, I can do that That's what I want. I'm not here to impress you at all. I'm here to inspire you now when I was about 18 One of my mentors you had lots of them being in the south they all wanted to get you on the straight and narrow, right? One of them came up to me and said Sarah. There are deep wells within you So you're gonna have to know how to refill them So you can nourish the people that come to you for help And when you're 18, that's like a really deep statement, right? But over the past 30 years almost Okay, I barely passed math. I'm 42 just work it out It's like oh my god when people come to me if I have not refilled my cup and I'm tired What do they get? They don't get the best of me. They get cranky ornery Sarah or momma or whatever I am whatever hat I'm wearing to that person And I've discovered over the past year and a half how to keep that cup full You you want to know what that secret is? Yeah Yeah, cuz we don't want to just be tired. You want to live your best most awesome life So I I read about this metaphor It okay to be honest I heard about it in a podcast and pretend I read the book I'm a little bit ADHD there anybody else like that I bought the book and then it took me about nine months to get to page 26 Where that metaphor is mentioned but get this this metaphor could change your life And if you've got friends or family you want to share it with write it down This is brilliant your brain can only retain about three pieces of information today So when you're about the sixth speaker you're screwed So write this down When you're born you're born a castle With a thousand rooms and in each and every one of those rooms. There's a gift waiting just for you You're not scared There's no judgment. There's no shame. You're like two years older running through your castle going.  You're like joy. Wow, that's cool Curiosity creativity Anger you open all these doors like wow, this is awesome And then your parents come up to you go.      I was raised in the buckle of the Bible belt This I came to Australia to go to Bible school. I survived 20 years of conversion therapy I did the thing what I was told to do marry the man that you will be attracted to just believe believe believe It almost killed me and I've only been living free and happy for two years It's awesome and Now that my cup is full.  I don't know whatever is floats your boat open those doors because your life will be richer and fuller from it And if you want to think about this way, here's another picture for you that I came up with on myself All right, ready actually it's better if I do it with some Here we go ready, okay if you're Monday Looks like you're Tuesday Looks like you're Wednesday, you know, you put your clothes on with the exact same leg first Do you know that by the age of 35 that we are all zombies? That's what the medical science people say, okay They say that we are all living in our subconscious 95% of our life is in the subconscious you brush the teeth the same way you do everything the same way and you wonder why you're so bored and angry Wednesday, let me guess how you sign your email kind regards. I Try to spice it up a little bit and be like have a creative day I Just like trying to make sure I didn't write my girlfriend right before otherwise. It's like xx. Sorry Thursday Friday, you're getting the picture right now if you were to walk into a hospital And you see this line across the screen. Is that a good sign or a bad sign? It means it's over but What are we living? We are literally Monday through Friday and usually our weekends to Dragon our coffin Because every day is the same day. You only remember the days that are unique like today When you checked Sarah Rowan on your forum, of course with Marty You remember the days that are different the days that are fun. It doesn't have to be expensive It doesn't have to be crazy. It doesn't have to be bungee jumping or skydiving I've done both and guess what skydiving is less scary. You can make it fun. You can make it interesting Now one of the ways you can make it interesting is actually just trying thing that I mentioned earlier putting on your pants with your Opposite leg first be curious.  I'm not kidding. It's actually kind of hard There are so much parts of our life that we actually just think are mundane and boring I have a friend that when she sends her receipts to her accountant to take care of it is like the most boring part of her job So you know what she does?  They're like The dog have its fiber today like it's great. It kept it all interesting. They kept it alive. So refill your cup. I Have to keep mine full. I know how they keep it full.  I've spent like five hundred dollars in the past two weeks Just so my beautiful garden, but God it's really pretty Until my cat decided it was her new litter box and then five hours yesterday I spent putting a net around it, but I got there So if you remember anything that I've said today, I want you to remember that you are a castle I want you to write down a door that you want to open when you get home whether it's with sage or tequila your choice For every follower on Instagram. I give a dollar to charity and if you don't have Instagram, it's okay.  I'd really love to inspire Any and every event possible My heart is to raise a million dollars for charity and I really really am grateful for this opportunity. Thank you Michael and Marty Round of applause for the lovely Sarah Rowan ladies and gentlemen


This study aims to evaluate the effectiveness of videoconference delivered cognitive behavioral therapy, VCBT, for psychiatric disorders through a systematic and meta-analytic review. The results show that VCBT is effective for clients with psychiatric disorders, with a pooled effect size of minus 0.49. However, there are only a limited number of studies on specific psychiatric and somatic conditions, and more randomized controlled trials are needed to establish the effectiveness of VCBT for different disorders. This article was authored by Kazuki Matsumoto, Sayohamutani, and A. G. Shimizu.


Hello everyone Welcome, I Guess we're ready to start So I said that already welcome. I hope you enjoy the conference. I hope you enjoy Sophie and Bulgaria First of all, I want to say big thanks to our sponsors without them the event would not be possible Of course the freebies the foundation our biggest sponsors They've been supporting us every year and here they are again Existence also a long-term sponsor big thanks to them as well And we're lucky to get trivago on board for the first year this time And we hope they join us next year again Google of course with us every year and Google are actually giving away an acer homebook There will be a raffle Anyone who wants to join in I should open the link filling a quiz and Maybe they'll win an acer homebook The link is also in the programs Are again with us for the last couple of years Madison Gurka as the narrow networks PC engines again with us Eurogame technology, it's Bulgarian company my employer actually The net bestie foundation So a couple of quick announcements before we start with the keynote the social event will be tonight at Sofia hotel Balkan and we'll start at 7 30 p.m. Oh so we had to Make a few couple a few last-minute program changes There will be no freebies the death summit reports But we have three news talks on the schedule this afternoon and those are the talks There will be on the website in 15 minutes Yeah, and of course we are live streaming the event and those are the links to the web streams Okay, so enjoy the conference and I now give you Jordan Hubbard who will give the first key note. Hi I'm Jordan Hubbard. I'm currently the CTO of IX systems one of the sponsors of this conference and Obviously freebies D and I go back a long ways In fact, I probably should have called this talk looking forward to another 20 years to be symmetrical But I can't see more than 10 years ahead and in 20 years. I plan to be dead so So I'm gonna talk a little bit about the future and the title of my talk is a little bit of a double entendre I am looking forward to another 10 years. I think there's some great things ahead of us but I'm also going to try to make some Suggestions and and and points about what we need to do to be relevant in 10 more years so I'm going to predict I can't win this either way because if you Disagree with me you will say that things don't work this way in the open source community It's a big hobby and we do what we want and if you agree with me You'll say things don't work this way in the open source community and we do whatever the heck we want But I hope to change your mind a little bit about that because I think for many of us here Especially myself, but certainly not limited to myself. This is not a hobby anymore. This has become More than that and we have we have achieved more than than what you would achieve with the mere hobby And I think we're we're certainly All in personal positions where freebies D is a lot more relevant to our daily lives So but let me first look at let us first look at where we came from so Freebies T 1.0 November 1st or November 2nd depending on what time zone you're in 1993 Just over 20 years ago. I did the first as the release engineer, but obviously we're working with many people 1.0 release of freebies D and this was Our this is our 20th anniversary So we're almost 21 years old now and as I said we can we can drink legally in the US in just a couple more months Yes, we'll we'll touch more on the drinking theme in a little bit So this was our first distribution media Okay, I'm lying just a little bit But not by much. This was our first distribution media. I remember installing freebies D a number of times over a 1.2 megabyte floppy and That's of course when I couldn't do it over a parallel port because that was faster. That was really high-tech And this had ramifications which which well we'll kind of touch on ramifications throughout this talk You'll notice for example that all of the files in the Bendist and this was true until comparatively recently is about just over 230k and that's because that was the size that we could break up the media and fit into both a 1.44 megabyte floppy and a 1.2 megabyte floppy so in case you've ever wondered why we picked that specific size it divided evenly into the installation media of the day and BSD turns out as full of these little Easter eggs where you wonder why did they do it like that? Well Let me take you 20 25 years back as Kirk can certainly tell us many stories about This was the 1.0 ports collection back when it was manageable You can see bash is there so It might have been We don't know can we scooch the Projector over a little bit. I think we're clipping clipping off the left edge. I don't know if that's possible but in any case Obviously some humble beginnings and this was my first bill machine that actually is not an actual picture of my first bill machine I don't think I ever photographed it, but it's pretty much what it looked like and it had a Absolutely blistering 50 megahertz Intel DX2 processor in it and I paid No kidding $1,600 for the first one gigabyte hard drive I remember when they first came out and I went and paid cash for it so that I could do builds of free BSD This was the first dream laptop many of us had This is Warner Losh and I in Japan. That's me touching of Sony vio Very lustfully because I couldn't actually afford one at the time, but Yeah, I was obviously a little lighter back then we'll touch on that too So And this was our very first conference As you can see not much has changed That is Kirk hoisting a a pitcher of beer and as David O'Brien in the background bringing two more pictures of beer To the to the podium at the Radisson. I think this was you giving your BSD talk Where you yeah, and you got progressively more inebriated as the talk went on, but you remain Remarkably lucid. I think we actually understood you for pretty much 99% of that talk but this was at the Radisson hotel in Berkeley and it was It's really interesting just think about how humble our beginnings were I mean the first morning the The water lines of the hotel was cut so nobody could take a shower and everybody showed up with their hair all plastered to their heads and looking and smelling not great and But we had a great time and we managed to pull it off and here we are More than 20 years later still having these conferences and having them internationally. So I think that's really awesome So the other thing that certainly changed is that 20 years ago Our targets in the commercial space and we did want to be relevant and have have commercial users were ISPs pretty much that was at least 90% of Free BSD's user base We also did a lot of Small and home office web servers and routers people got a 386 out of the closet with a couple of ethernet ports and made a router out of it Very do it yourself remember from all the Traffic on questions, and if we had any any major companies at all That was yahoo which remains to this day a free BSD shop and hotmail which does not We also obviously were used on a lot of basic developer desktop machines You know x11 plus 50 terminal windows was considered an acceptable developer desktop again, not much has changed And the majority of free BSD machines were physical PCs that ran on AC power And that may seem like a pretty obvious statement to make but again this is something that that will come back to later because that things have changed and The key takeaway from this slide is that free BSD's role in the world was pretty overt The the brand meant something when you talked about free BSD at least in the network services community and whatnot it had a had a certain Cache and there was a there was a certain brand value around it and everyone was very upfront about using free BSD So here. We are 20 years later. That's a 64 gigabyte USB thumb drive 64 times larger than the hard drive I spent $1,600 for and now most of you have one dangling from your key chains and Probably got it free at some conference as a giveaway It just amazes me and what you can obviously put on one is It's just astounding. We don't actually put much more than cat pictures and small installation images on them, but we could do a lot more with these and This little $35 device I rounded up to 50 because you have won an SD card obviously has more power by Probably almost an order of magnitude than my first 486 DX2 so That is a game-changer and it also means that a totally different part of the world can Can do this now, right? This is something you can sell into into much poorer countries. I paid a lot of money for my first PC Again many orders of magnitude more than $35 and the fact that you can now do meaningful development on something like that is again It's a it's a game-changer and obviously my dream laptop has evolved somewhat as well I don't have to stroke it anymore. I do own one and again this machine has Far more power almost a terabyte of flash storage huge display density Very powerful multi-core processor is just you know, I can I can run Five or six instances of free BST under virtualization Faster than I could ever have run it on a physical machine before Poor Sony vio just fell by the wayside somewhere and the other thing I want to point out Which I think is pretty relevant is that this has BST included You may not consider OS 10 to be BSD in the in the most classic sense of the word But there's a lot of BSD in there and more importantly There's unix in there and when we bought our sony vio's way back when when we could finally afford them you basically got windows on it and or OS to if it was that long ago and That those were your only choices and you had to to rip off some other operating system to get a unix desktop so the fact that we actually have Unix desktop this many decades after Microsoft did their very very best to kill Unix dead I think says a lot about the the staying power of Unix So obviously the current release version is 10.0 working on 10.1 is I believe we speak They're now 24,000 ports Somebody asked me if I had known then what I know now if I would have done it There are hundreds of committers from both act. I'm not gonna answer that question. There are hundreds of committers and A lot more we still have a lot of strong showing in academia But as I mentioned earlier a lot more of us are in the commercial world a lot of us have actually been paid to come here and that's a very interesting and very Telling development that again we've grown up We also for the first time Have long-term sources of funding the free BST foundation to broke a million in donations last year That's that's that's real money now, and it's not they're not just standing by themselves There there were a lot of sponsors We saw on that slide a minute ago And a lot of people putting putting real sums of money into free BST and sponsoring the development of it Which I think is a really great thing because there are there's always going to be a category of really annoying things that Nobody really wants to do that much for free Or just in their spare time and so the the funding makes tackling those sorts of challenges possible But what's also interesting is that the markets have really changed, you know We're not aiming at where we were 20 years ago or at least we should not be and one of the things that's really changed is that The GPL has gone to version 3 and it has created a renaissance in interest In the BSD license in the commercial space I use that particular animation because I really you know you think of kangaroos as nice cuddly animals And then we kicks you into the water Which is how a lot of people felt when in the commercial world when they followed the GPL Bandwagon and then suddenly v3 came out and a bunch of technologies that they were reliant on went v3 And there was a whole bunch of new scary languages Scary language in there that most lawyers Scares the crap out of most lawyers I mean I've been in a lot of meetings with a lot of lawyers where they're going in line by line through this thing and going Take it out. So That's actually helped us quite a bit In roles that I'll touch more on in a minute So one of the areas in which it's helped us is that you're seeing free BSD and other variants of BSD or pieces of BSD technology being used in a lot of appliances routers load balancers security appliances monitors file servers obviously And it's also the basis for a lot of software appliances, which you can put on more generic hardware Obviously, I work on free as so I had to put it on there But it's by no means the only one and if you look at the commercial page at the previous D website You'll see a bunch of different things there And as I was surprised to see last year, it's even the base OS for a popular gaming console so What's Really becoming more evident than anything else though is that what we used to consider the embedded market was engine computers and cars and Avionics computers things that were really really small and special purpose had very limited capabilities Not much memory and some sort of our toss that ran on them but that is really changing overnight and If there's a key takeaway to kind of set against my previous takeaway It's that free BSD is now becoming much more covert in its usage people rebranded right juniper calls it to Junos the Company whose name I can't remember right now up in Seattle calls it 1fs EMC and then their subsidiary Again, if you look at the website, there are probably a dozen different names for free BSD now People just I don't even know what Sony calls their operating system. They probably don't even refer to it It's just the operating system that runs in the PlayStation 4 What's that? Orbit, okay. Well, there you go Interesting name But it's not called free BSD and you know, is that a bad thing? Not really what it is is it just says that free BSD has reached a certain commodity value That it's useful as a brand name to know what technology with where the technology source is But you don't have to call your product free BSD in fact You probably don't want to because it you're gonna you're gonna do different branding exercise around whatever your product is If you're a security appliance, you're gonna try and put the word security in there somewhere if you're a gaming company I guess space or you know and so Again, that's that's a very interesting development for me at least because it really does mean we've reached the come the OS commoditization era where Free BSD is a brand is both meaningful and not meaningful And in fact, I've had a lot of arguments with people where they've said well You really need to change the name of it because free BSD. What is that now free has weird connotations in BSD? Well, that was 25 years ago at some obscure place in California and My rebuttal is always it doesn't matter. It's just a just a brand right when when we came up with the iPad at Apple There were a lot of people talking about the connotations of that word Nobody thinks about it anymore. It is just a brand and free BSD has reached the same place We don't need to change the name. It's it's not it's not a problem so Looking at trends and I just grabbed this slide from from Gartner and I don't really care for it very much because it kind of tries to put all of us somehow at the iPad's doorstep, and I don't think that's Perfectly accurate. Obviously mobile devices in general are what have caused that curve to happen It isn't just Apple releasing the iPad on April 3rd it was probably the the match or the match that lit the gunpowder, but we're really seeing mobile devices take over the world and That's not going to stop and In fact, if we look at OS deployments today by sheer numbers or sorry Unix OS deployments phones are obviously the biggest tablets Watches that's an artist conception by the way. I have no idea what the actual I watch looks like and Cables what? Unix runs in a cable. Yes as a matter of fact it does There are a number of peripherals out there that do video transcoding DRM I hate to say Various tasks that require a pretty robust software stack You don't want to really take an mpeg for decoder stack, which is half a million lines of code and Put it on top of an RTOS because it turns out that that code was written on some sort of Unix operating system And it makes all kinds of system calls and relies on a number of libraries So as you start kind of pulling on that piece of string you very quickly find out geez I need a Unix in here. Well, it turns out that's not a big deal because there's enough space in those little connectors to put a tiny little arm chip at each end and so one of the first thing that cable does is boot and Yeah, what could go wrong, you know our cables gonna have heart bleed bugs or you know It's it's an it It's an interesting question so So yes, as I said the embedded market is really morphing what you think of in bed is embedded is So embedded you don't probably even realize it and when we get fully into the internet of things whatever the hell that means You're gonna see even more tiny devices that In these various ubiquitous roles that you never imagined a Unix operating system being in but people are gonna reach for Unix and stick it in there because it's the easiest and cheapest thing to do and The the hardware is powerful enough all the reasons that that you know Restricted you from doing it like having only 4k of memory or a one-bit processor that is so yesterday So, you know talking a lot about mobile here But obviously the enterprise space is kind of the other end of the barbell And I think it deserves its own own chapter so to speak And even there it's kind of interesting You're seeing a lot of pressure at what we kind of considered the classic enterprise desktop space with people bringing their own devices in That's that's the BYOD movement people talk about and it drives IT administrators insane because they have to take this Huge of array of devices that people insist and usually people by people. I mean the CEO Insist on bringing to work and insist on it Operating interoperating with their software and working with Salesforce and all the various things and so For about three or four years. They fought tooth and nail against it and finally they just gave up and so You're seeing that what what is considered sort of the classic desktop deployment even in the enterprise And I remember an era when people like GM and Unilever had 10,000 20,000 desktops They're they're going the way of the Dodo bird Why right just take your iPad with you or your your tablet of whatever flavor you like or your phablet your large phone and Use it during the meeting and that's what people are doing and they can project from it and do a lot of other things The other thing that's squeezing it from the other end is this whole cloud computing thing is becoming a little less nebulous And a bit more specific in that if you want to do computation and you want to do storage and you want to do a certain known set of things the the economics of off-hosting to the cloud and I hate that word because it means some so little and so much is actually becoming pretty compelling and Plus you're seeing a lot of software vendors a lot of ISV's saying I won't sell you a copy of my software any other way I don't want you hosting this yourself We're hosting it in the cloud So you you sign up and you pay your your monthly fee and pretty soon Why why do you need anything more than a web browser to run the software? The other thing that's kind of interesting too, and I've been noticing this I had a Older friend of mine even older than me Say that he just got a job at one of those San Francisco startups that are kind of going under the the collective description of two guys with two laptops and a coffee shop and He was amazed that they were able to do An entire office's worth of work from their laptops in the coffee shop because every time they committed a change to the code It fired off this huge chef driven set of automation which would spin up machine virtual machines and Amazon EC to and Start various tools running and they're due regression tests and the whole bunch of things and some more VMs would fire up and it would go to a staging server and then they would connect to their little URL for the staging server and they'd look at it and say you know click around use it Yep, looks pretty good They click a ship it button and then boom it would go and deploy and During the peak of the automation and they would run a lot of tests I mean this wasn't just a fly by the city or pants kind of operation they probably had 50 or 60 VMs running and So they didn't need a data center. They didn't need a dedicated IT guy they just they just had somebody who understood chef or salt stack or one of those automation frameworks and Spend a few days or maybe a few weeks or a few months even Spinning up all of the automation infrastructure they needed and then they were done and they just use that so again This has ramifications, which I'll get back to So No one's no one argues that Unix is basically Lego, right? It's it's a bunch of composable pieces you can put together in interesting ways and one of the one of the aspects of Lego is that It's a great general-purpose toolkit and we we kind of designed Unix the same way It's very composable and we see it as this elegant awesome ass kicking kind of thing The world sees us more like this Which is just a pile of Lego man We just we're gonna take the legos that we want and please try to make them all square And we'll put them together it's for these automation tasks and these sort of mobile and embedded development things But of course they're not all square because this is really more what it looks like It's a lot of square pieces and some very specialized pieces that you can't do anything, but one thing with so what What's what's hitting us hard in our in our insufficiently abstracted Lego universe is Again the fact that we have a we're carrying around a lot of weight to support physical hardware that really no longer exists in quantity The most most I think I don't have any metrics to make up on the spot But I would say that probably the majority of OS deployments today are virtual If you just counted sheer sheer number of seats And of course the devices attached to those are also virtual So the quality of your virtual device drivers is probably more important or becoming more important than the ones for your physical device drivers Now there are exceptions of course 10 base 10 gigabit Knicks and whatnot or 40 gigabit or soon a hundred gigabit They have a very specific demands that they place on physical hardware So at some point you have to run your your copy of ESXi or Zen Center or whatever on some physical hardware That has to work, but everything from there on up is virtualized and Again to talk about the the two guys with two laptops in the San Francisco coffee shop scenario Most of what their automation tools actually do is do their best to erase the notion of a host personality There to take all the configuration information and take it from some other place and splat it on top of a running OS instance So a lot of the the beautiful abstractions that we've built For for configuring and for sort of personalizing a box or even the the workflow that we're used to where we get a copy of free BST on a CD-ROM or thumb drive if we're a little bit more progressive and we install it on a physical machine and we go through all the configuration steps and Lovingly tailor it to our needs. That's dead It really is I mean we do it because we're used to it. It's really really familiar to it I mean we kept using system stall for how long so But that's not how the rest of the world wants to do it. They want to do it in an automated fashion They want to script it so getting back to mobile Again, I feel very comfortable in saying that the number of Unix machines running on a battery are now several orders of magnitude above those running off of AC and They're not plugged I mean I'm physically plugged into a few things because I have to be but again You're talking to radios now. You're talking to Bluetooth. You're talking to Wi-Fi.  I'm trying to find here the quality is variable in a radio signal and the things like interference and whatnot become real problems things like channel a Congestion so all of these things put back pressure on the operating system to do things like become more agile and Hop around or change the the radios configuration to to dynamically seek out the best possible connection opportunities and obviously if you're a truly mobile device you might be doing a hundred miles an hour down the autobahn and Continuously disconnecting and reconnecting to different cell towers. So that that puts some some really interesting constraints on the OS so one of the less obvious points to make is that trying to debug this and Actually diagnose problems in the field also put some some real challenges on you and our telemetry sucks Our ability to do remote debugging sucks. I'm not gonna not gonna mince words We have some work to do there because again if you're trying to make a genuinely mobile device You need those things you will live and die on the strength of those technologies So I wanted to point out something else. It was interesting because if we look at our open source brethren One of the biggest desktop providers in the Linux space that I think we can point to now is Ubuntu There they're a huge success story Mark shuttle worth opened his pocketbook and you know basically wrote them a lot of blank checks and they were able to do pretty much anything they wanted and If you look at the the evolution of their website over the last year They used to be a desktop OS and now if you look very carefully you see cloud server desktop Phone tablet TV management and all of the large panels down there are about how they're ready for smartphones And they're number one for cloud They they are they are not skating to where the puck is going, but they're chasing it they saw the puck go by and they went whoa what happened that way and We have to do the same so What that means in technical terms is we need to be Really open to fundamentally new approaches one of the really one of the the best things that I got to do when I went to Apple in 2001 was get given essentially a blank check on the engineering side I was told look we already pissed off our installed base of Mac OS 9 users There's really nothing more you can do to them that hasn't already been done your your starting fresh with OS 10 and Do whatever has to be done to make it the the best OS for the kinds of products that we want to make and We I took them up on that that we all collectively took them up on that and we we went I won't say we went nuts that that would be that would be too too strong a word But but we took full advantage of it. We we ripped cron out. We ripped. I net D out We ripped a bunch of other weird legacy services for mock out and we consulted it all at launch D We wrote all kinds of different mechanisms for dealing with dynamic Device arrival and removal and power management and we just we just went to town and we knew that we were going to be able to abstract all the system administration Issues through away through the GUI or later with iOS with almost no UI at all at least not for system administration and So we were able to fundamentally rearchitect big big chunks of the system and that was actually a wonderful thing because For the first few years we dealt with all the same reactions that you would expect in a classic Unix environment You did what you changed what you can have my I net D when you pry it for my cold dead fingers, right? We had all the same reactions. It wasn't like everybody was like oh sure But a couple of years down the line whenever one saw a G You know I can just launch this by dropping this file into this directory And I can specify in a very flexible fashion how to scrub the environment and how to launch it in a secure fashion I don't have to worry about people Pre-pending stuff to my command line, you know There were a bunch of security ramifications and just ease of use ramifications that came along with the rearchitecture that In a couple of years it was like of course you do it that way. Why wouldn't you? so Again, that's really hard and open-source We have the the famous bike shed effect that we like to talk about in free BSD where you know any proposal that That threatens to change the status quo gets bike-shedded to death and I think that's really Not as charming as it used to be I think that needs to change because to do all the things that I'm pointing at and to move into these markets means Some things have got to change. We've got it. We've got a Fundamentally, we architect some things We also need to be willing to shamelessly, I mean adopt and learn from things that are that other people are doing I mean, we don't have to do this all ourselves. There are a lot of technologies out there that have been Practically offered on a plate to the free BSD community in the past and they've kind of said It's not really our flavor. We didn't we didn't architect that ourselves Yeah, we'll think about it and then years go past and opportunities are missed So I think we need to be a lot less proud about that because again, we are a commodity OS now There's not a lot of point in being truly unique and Nishi anymore And the the last thing is I think we need to be willing to take on some big picture challenges Back back in the 90s when I first started doing this I used to you know stand up and stages like this and talk about Finding a mountain and my big analogy was you know when you're going on a mountain climbing expedition It has a wonderfully focusing effect on everybody involved You got a pack for it You got to get all the right supplies and now it's kind of dangerous and you're climbing up a peak and it's hard But it's also incredibly rewarding and you're doing something that you've never tried to do before at least if it's the first time you climb that mountain and It it brings you all on the same page, right? You're gonna climb that mountain and try not to die and I think I think we may have lost sight of that a little bit I think we need to find some more mountains to climb We need to pick some big picture challenges that will be hard because you know when I first Got involved with this. I was I was 30 years old and 30 pounds lighter and I'm I'm getting old and A lot of us in this room are getting old and we need to find something We need to find challenges that will appeal to the next generation of of hackers And that's something we actually did pretty well in in the 90s and the first part of this millennium It it shocks me sometimes to realize that some of the movers and shakers in this project that the leaders the grand old men We're just starting college when they first came to free BSD. They were the young snotty-nose kids, right? and Now they're not they they they have they have become the new generation and the leaders Well, that's gonna happen again again if we're trying to get 10 20 years further down the line we have to think about that now and Thank God for the Google Summer of Code by the way because I think without it. We wouldn't even know what interns were So again, I want to get specific. I don't want to just keep waving my hands up here but one obvious project idea that we need to take on is To automate a machine to to really run it through all of its paces cradle to grave you need to be able to munch its configuration data and Slash Etsy is a septic tank It is just a whole bunch of weird-ass formats and things that have been there forever and ever and ever It's really really time to just toss that out. That's one of these re-architecture goals. I'm talking about And I don't care about the format. It can be YAML. It can be JSON. It can be XML but there should be a single way of accessing it reading it writing it finding it and You know, it's really kind of sad that even in this day and age in the year 2014 if I write a new utility that's going to be a new demon that runs on my system and I need to have a Configuration file format for it. There is no API. I need to write my own bison parser and Invent something and put it in slash Etsy because why not everything else is there That's and let's not even talk about the dot files in your home directory, right? This is just architecturally Yes, and obviously we need to have the the cojones to go back and alter all the existing tools to use it That's the thing that everybody always stops at. Well, yeah But if I come up with the library and I come up with the single unified format that I gotta go change these things and change them It's it's more trouble to talk about it than it is to just to do it. It really is I've been there done that It's not as hard as it looks Oh and Just to point that out that it's not as hard as it looks to use this little machine here as an example Everything in OS 10 whether it's system configuration data per app configuration data per service configuration data It's all an XML P list in a couple of known locations And that's it and we went we hacked the utilities We did everything required to to unify on that. Is it the best format that ever walked the earth? No Is it good enough? Yes What's that? No, you just look at core foundation light and you can again steal the ideas You don't have to take the implementation just I mean there's not a lot to it There really isn't and they're there are probably 50 XML parsers It's you know, you don't have to write this yourself So another thing that needs to be done Especially if you want to work in the mobile space is you need a notification centralized notification system You need to be able to register for notifications. You need to be able to post notifications Right now on your average free BST based appliance if I even just changed my host name a bunch of stuff stops working That's really silly. It's one of the first notifications that OS 10 added was calm dot system dot host name You subscribe to that anybody changes it from any place boom You know, it's changed go do whatever you have to do to your internal state adapt move on Obviously radio is powering up and down at all times like I talked about that were configuration changing because you're moving between cells Your IP address is changing Chef or puppet has gone and whacked a new set of configuration data on to you entirely and everybody now needs to go and you know The world has fundamentally changed and right now that is done so crudely It's just you run around here everything with a hammer that you think might have been affected and restart it And there's just no technology there. It's just brute force And it doesn't need to be it really doesn't what you also see is a result of not having a distributed notification system is there's a bunch of things like active directory libraries and whatnot that cash information and Since they have no way to do cash invalidation, you know, they break the first rule of computer science never cash anything You don't know how to invalidate. Well, what they do instead is they run a cron job once every hour or whatever to shoot the cash In the head so they do a bunch of work wasting a bunch of power and you know And possibly doing needless network traffic to recreate a cash that didn't need to be recreated or During that one-hour period when that user got added over there and now people are going I can't chone something's wrong Well that cash is still screwing you up So you really we really need it and again because I want to talk about real examples Here's the notify API Notify if I API was done probably in all of two weeks and a simple notify demon If you have an OS 10 box You can send it a sig user one and it will dump all the subscribers Into var run notify and the name of the PID status and you'll see there's just a huge number of notifications And when we first did this we probably had five six in fact I think we first did it to do with time zone changes because we found out there was code and libc that was statting Etsy local time Thousands of times a second. Why well because the time zone might have changed So it's one of the first things we did is make that a notification And you'll see if you can read the slide that some of those well, it's to slid over too far But some of them are you know direct point-to-point notifications. Some of them are using a little shared memory cells So if you want to pull Periodically just see if your caches and melody you can do it that way it'll send you a signal It'll do any number of things. It's open source So again either use the implementation or just use the ideas so as I keep mentioning the whole system startup and service wrangling stuff is there There's an old saying you you you can't polish a turd, but you can paint it and Etsy RC dot D is a painted Etsy RC So, you know, I was one of the architects of this stuff I I think I probably checked in the first copy of RC dot local RC dot cough actually because hey, let's add some knobs What harm can that do? And it's it's evolved. It's incredibly sophisticated I've actually looked at the Etsy RC dot code and seen all the little provides and you know It requires stuff in there and it's seeing how it builds a directed acyclic graph and runs all the things in the right order And it's like wow, this is kind of a triumph of of brute force over adversity But it's also wrong It's just not how you want to do it. You want to do things dynamically you want to essentially just register and say hey when something who tries to talk to me start me up and I don't want to make any dependencies explicit anywhere because the problem with explicit dependencies is they keep changing and You keep having to chase that dragon And anyone adding a new service doesn't even necessarily know which what they depend on they find that out by trial and error so again you know, I'm I'll talk about that in a second But you know, I'm not gonna I'm not gonna suggest launchy because I've beaten that drum enough times But even the Linux die-hards have gone with system D.  So you need to shoot it down and or you need to at least have something that's in charge to report on it Say hey, this guy is acting weird. You should probably do something about that So again, I keep coming back to this But yeah, we need we need telemetry and speaking with my free NAS hat on we're gonna do it at iX systems we're gonna create a telemetry a demon and some API's for it and we're going to pretty much instrument the crap out of everything because We we are at the pointy end of the spear in terms of dealing with enterprise customers who have file servers Which are one of the most critical pieces of infrastructure for people and when those things go go hinky They rely on us to figure out why and far too often we have no idea We we come we come to the scene of the accident an hour or two after it's already occurred and all we do is see bodies lying all over the road and We don't even have things to measure the skid marks with because there are no skid marks, right? These are virtual bodies and it's a virtual accident and so We need to we need better than syslog. We need some way to say alright Let's look at your telemetry. What what was going on in the hour prior to this event? And maybe even what was going on from a couple of different daily collection points because guess what people break their networks people have clients that go completely insane at three o'clock in the morning usually on Saturday night and Start flooding, you know the server with with with NFS requests or just otherwise acting bizarre And you can't even always detect that from the server. All you know is you get a lot of traffic. Was that good? Was it bad? I don't know so Usually when you talk about telemetry and remote debugging Certain three-letter agency gets mentioned and everybody starts throwing things Let me tell you something the NSA does not need our help They do their data collection much further upstream where it's already pre aggregated for them They do not need to attack the individual boxes. That would be a waste of their time but the the users do need the telemetry because again to keep her turning to this point maybe harping on a little We're running in a lot of appliances now and those appliances the users just want them to work and You've probably used a hundred products just in the last year where there's a little question Do you want to help make this product better? Unless you're really paranoid you probably said sure guess what that meant? You signed up for telemetry So finally on the debugging comment, which I think should be totally uncontroversial We do need a way of doing IP debugging and that's another thing that I existence is going to sponsor We have a rough prototype already working, but I'll tell you I could never have worked on this or the phone Without some way of debugging it remotely. It was just just insane trying to do anything else You know you're not going to always have a serial port or or a Serial over IP or you know any of those sort of Clujie ways of getting at debugging and of course sadly firewire is going the way of the dodo to and that was really cool Because you could do firewire DMA But it's leaving so we need to be able to deal with panicked boxes in the field over IP And that means basically a very simple IP stack that that gets that gets used in the in the times of last resort and says All right, debug me now And guess what when you have that feature you can also start doing other interesting things which I've used as well Which is a little web portal things that do nothing But say give me an IP address and I will go connect for you and I will scrape that box And I'll run a bunch of GDP scripts on it and I'll grab all the relevant information and I'll file a ticket And I'll attach this stuff to it and I'll even tell the triage team Hey, it's still there at the debugger prompt if you want to connect and do different things And if you don't well, I got you everything that most people need to debug a kernel panic so Also being able to NMI a box when it's stuck or hung or really really slow Or you know there's some weird lock contention problem going on it can make the difference between finding a really pernicious problem That's been annoying people for years and and not So One other thing I've raved about on the the project mail is a little bit is I think I Think the SBC is the raspberry pies the beagle bones all of that as porting platforms have been really valuable I don't want to even sound like I'm disparaging them. I think they're really cool. They're really cheap They're really useful and we should keep porting to them But I think I think we've reached the level of stability and usefulness with the arm port that it's time to actually move to real stuff due to to a reference phone to a reference tablet and I'm not even sure what that reference phone or tablet is yet There's a plethora of them right now if you go to Singapore or Hong Kong you can go to a market and buy Five tablets for for a hundred bucks. I mean, you know, they're they're really generic now And they usually run some weird concocted version of Android or something but they are getting cheap enough now that at some point we're going to be able to kind of look at the the horrible The not so bad and the the great and then pick something in the middle because the greater probably going to be expensive and Say that's going to be our first rest reference platform for a phone port or for a tablet port And and the main reason for that is is is multi fault They're multiple reasons for this one is as I point out here You're never going to know how to deal with real radios real devices like accelerometers Cameras etc. And so forth until you actually run on a platform that has those things And you want to be able to support those things because they're part of what make a phone or a tablet an interesting device to use Also being able to carry around a copy of you know free BST running on one of these reference things means we'll be able to actually Validate that our telemetry and our debugging stuff works because if you don't use it you don't live on it so to speak then you are not Validating that that an end user in that same role is going to have a good experience And finally again using those sort of things will require that we think of a little higher up We're not just a kernel We are a collection of services and utilities and at some point we'll have something for dealing with Bluetooth and dealing with audio and dealing with displays and all those things are going to have to be part of the Software stack and I think it's time that we we tackle some of those things because again those are the interesting challenges It's it's previous to you should be more than just hacking on kernels So to sum it all up I think we still have some rough edges and not being sufficiently legal like again OS is a commodity now It's it's been out for decades and decades, so we should make it More usable for the people who want to automate it virtualize it stick it in a cable and and not have anything that stands in the way of doing that or Essentially force them to do the subtractive exercise of pulling stuff out It's it's one of the first things that people do is is have to have to yank code out of free BSD and that's kind of silly We we should make it possible just to conditionally compile it in the first place And again just to reinforce my previous point. We need to pick hardware platforms that are that are real and relevant phones tablets watches Cables let's let's find some reference ones and actually start porting to those and see how it works and Because we're going to be kind of late to the party We should be willing to look over the fence to people who've already done all this the androids and the apples of the world Have already been down this path, and they've done a lot of cool technology some of which is open source Some of which you can just look at a header file and say all right come and see kind of what they did in this design Or just watch it work, and you can learn a lot from that and clone it You don't have to necessarily take the same code. You can you can create your own independent? Implementation, but but skipping a lot of the hard work and figure out what it should look like So and let me just say that we do have a bit of a rep in being resistant to this kind of thing that you know If you go to the BSD folks, oh, they'll bike should eat a death. They're not going to take your ideas on board They're not interested that that's a really unfortunate reputation, and I don't think it's entirely merited But to the degree that it is we should shake it off and change that reputation So in summary the future is ours if we want it. Thank you


Yeah, so okay, first things first, what are the signs that a business has got people in it who are suffering? You know, sometimes this is an interesting one because mental health problems we know from the data that 50% of people will not tell their managers they have a mental health problem regardless of how severe it is. So that you could be having a mental health problem in your team right now and according to statistics you do if you've got more than 10 people you have at least a couple of people in there that may be having a mental health problem to you know depending on the severity of the problem doesn't have to be completely severe but you could be having two at least and but you may not know about it or they may not be willing to talk about it. So the issue is big it can be under the surface but what we're seeing now especially in Australia more people are coming out because we've become more aware more people are putting their hand up and say yes I do have a mental health problem. In some cases they wait until there's a performance management meeting and then they've gotten into trouble to say well the reason why I'm not performing is because I'm anxious or I'm or I'm depressed and then HR teams are panicking and say well what do we do now because we went in with this objective of dealing with the contact or a performance issue but now we found that there is a mental health issue what do we do and that's when they come to us they come to the workplace mental health institute and that's why we wrote the book mental wealth you know to help managers have a good balance between helping people and caring poor people and making sure they're engaged and also taking care of the business. So mental wealth is not really a mental health book it's a business it's a leadership book that deals with the mental health aspect of things.